114 lines
2.6 KiB
YAML
114 lines
2.6 KiB
YAML
# Bare-metal equivalent of deploy/k8s/00-config.yaml.
|
|
# Keep this file, zones/, rpz/, and TLS material in sync with the cluster's
|
|
# ConfigMaps/Secret as appropriate. The persistent state in ./data is local
|
|
# to this host and must not be copied/shared while the server is running.
|
|
server:
|
|
max_concurrent: 2048
|
|
timeouts:
|
|
upstream: 2s
|
|
list_fetch: 60s
|
|
|
|
dns:
|
|
# Container ports stay unprivileged; Compose publishes the conventional
|
|
# host ports 53, 853 and 443.
|
|
udp: ["0.0.0.0:1053"]
|
|
tcp: ["0.0.0.0:1053"]
|
|
max_udp_size: 1232
|
|
dot:
|
|
enabled: true
|
|
listen: ["0.0.0.0:1853"]
|
|
cert_file: /etc/fancy-dns/tls/fullchain.pem
|
|
key_file: /etc/fancy-dns/tls/privkey.pem
|
|
doh:
|
|
enabled: true
|
|
listen: ["0.0.0.0:8443"]
|
|
cert_file: /etc/fancy-dns/tls/fullchain.pem
|
|
key_file: /etc/fancy-dns/tls/privkey.pem
|
|
base_path: /dns-query
|
|
|
|
upstream:
|
|
forward_zones:
|
|
- zone: local
|
|
servers:
|
|
- addr: 10.10.0.1:53
|
|
proto: udp
|
|
policy: parallel
|
|
max_attempts: 3
|
|
healthcheck_interval: 30s
|
|
servers:
|
|
- addr: 9.9.9.9:53
|
|
proto: udp
|
|
- addr: 1.1.1.1:853
|
|
proto: tls
|
|
server_name: cloudflare-dns.com
|
|
- addr: 9.9.9.9:853
|
|
proto: tls
|
|
server_name: dns.quad9.net
|
|
|
|
memory:
|
|
limit: 1GiB
|
|
reserve: 256MiB
|
|
cache_max_bytes: 384MiB
|
|
|
|
cache:
|
|
enabled: true
|
|
size: 500000
|
|
max_ttl: 1h
|
|
serve_stale: 30m
|
|
persist:
|
|
enabled: true
|
|
path: /var/lib/fancy-dns/cache.db
|
|
interval: 30s
|
|
|
|
blocklist:
|
|
enabled: true
|
|
default_action: nxdomain
|
|
local_zones: ["/etc/fancy-dns/zones/*.zone"]
|
|
lists:
|
|
- name: edge-router-x-address-overrides
|
|
format: rpz
|
|
path: /etc/fancy-dns/rpz/address-overrides.rpz
|
|
enabled: true
|
|
refresh: 0s
|
|
- name: haas
|
|
format: plain
|
|
url: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
|
|
path: /var/lib/fancy-dns/lists/hosts
|
|
enabled: true
|
|
refresh: 24h
|
|
categories: [ads, tracking]
|
|
|
|
acl:
|
|
default_policy: allow
|
|
groups: []
|
|
|
|
# One JSON line per blocked or failed query on stdout (docker logs). The
|
|
# resolver keeps no query log of its own; the metrics count everything.
|
|
access_log:
|
|
enabled: true
|
|
log_blocked: true
|
|
log_errors: true
|
|
log_cached: false
|
|
|
|
api:
|
|
enabled: true
|
|
listen: ["0.0.0.0:8080"]
|
|
base_path: /api
|
|
# Backup resolver mode keeps the console disabled. Set true when an operator
|
|
# wants the embedded console; it remains reachable only via host loopback.
|
|
ui: false
|
|
allow_config_write: false
|
|
auth:
|
|
mode: apikey
|
|
api_keys: ["${FANCYDNS_API_KEY}"]
|
|
trust_loopback: true
|
|
|
|
metrics:
|
|
enabled: true
|
|
path: /metrics
|
|
protect: true
|
|
|
|
log:
|
|
level: info
|
|
format: json
|