-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathconfig.yml
More file actions
207 lines (196 loc) · 9.8 KB
/
Copy pathconfig.yml
File metadata and controls
207 lines (196 loc) · 9.8 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
######################################################################
# SERVER #
# listen: IP to bind to. Use 0.0.0.0 for all interfaces #
# port: UDP port for DNS queries. Standard port is 53 #
# log_level: Log verbosity - debug, info, warn, or error #
# query_log_file: Append every query as a JSON line to this file. #
# Leave empty to disable. Rotate with logrotate's #
# copytruncate or send SIGUSR1 to reopen. #
######################################################################
server:
listen: 0.0.0.0
port: 53
log_level: info
query_log_file: ""
#######################################################################
# RESOLVER #
# timeout: Seconds before an upstream query is abandoned #
# attempt_timeout_ms: Per-nameserver deadline (ms) during iterative #
# resolution; moves to the next candidate after #
# this many ms. 0 = use full timeout each hop. #
# max_depth: Max DNS referral hops before a query fails #
# max_concurrent: Simultaneous upstream lookups, 0 = unlimited #
# edns0: Advertise EDNS0 for larger UDP payload support #
# tcp_fallback: Retry over TCP if a UDP response is truncated #
# dnssec: Full DNSSEC chain validation from the root KSK #
# Bogus responses return SERVFAIL; secure ones #
# carry the AD bit. Only applies to iterative #
# mode (not forwarder mode). #
# rate_limit: Per-source-IP token bucket for client queries #
#######################################################################
resolver:
timeout: 3
attempt_timeout_ms: 800
max_depth: 20
max_concurrent: 200
edns0: true
tcp_fallback: true
dnssec: false
######################################################################
# RATE LIMIT #
# enabled: Enable per-source-IP query limiting #
# qps: Tokens added per second for each source IP #
# burst: Maximum saved tokens per source IP #
######################################################################
rate_limit:
enabled: true
qps: 100
burst: 200
######################################################################
# CACHE #
# enabled: Enable caching of DNS responses #
# negative_ttl: Seconds to cache NXDOMAIN responses #
# prefetch: Refresh near-expired entries before they expire #
# min_ttl: TTL floor; prevents caching with very short TTLs #
# max_size: Maximum number of cached entries (0 = unlimited) #
# When full, the soonest-to-expire entry is replaced. #
######################################################################
cache:
enabled: true
negative_ttl: 300
prefetch: true
min_ttl: 30
max_size: 0
######################################################################
# ACCESS CONTROL #
# Restrict which client subnets may query kmresolv. #
# Rules are evaluated in order; first match wins. #
# default: allow - permit clients not matched by any rule (default) #
# default: deny - refuse clients not matched by any rule #
# action: allow - permit queries from matching subnet #
# action: deny - send REFUSED to matching subnet #
######################################################################
acl:
default: allow
rules: []
#rules:
# - subnet: 127.0.0.0/8
# action: allow
# - subnet: 192.168.0.0/16
# action: allow
# - subnet: 0.0.0.0/0
# action: deny
######################################################################
# ZONES #
# Forward specific domains to specific upstream servers. #
# Evaluated before the global forwarder; longest domain wins. #
# Supports the same server formats as the forwarder (plain, DoT, #
# DoH). No fallback to iterative — if zone servers fail, SERVFAIL. #
# #
# domain: DNS suffix to match (e.g. internal, corp.example.com) #
# servers: Ordered list of upstreams to try for this zone #
######################################################################
zones: []
#zones:
# - domain: internal
# servers:
# - 192.168.1.1
# - domain: corp.example.com
# servers:
# - tls://10.0.0.53
######################################################################
# FORWARDER #
# enabled: Forward queries to configured upstreams #
# servers: Upstream resolvers, tried in order. #
# Plain IP/host UDP (port 53 default) #
# tls://host[:port] DNS-over-TLS (port 853 default) #
# https://host/path DNS-over-HTTPS (RFC 8484) #
# Use an IP for DoH to avoid a circular DNS #
# lookup when resolving the server hostname. #
# fallback_to_iterative: Iterative fallback if all forwarders fail #
######################################################################
forwarder:
enabled: false
servers:
- 1.1.1.1
- tls://1.1.1.1
- https://1.1.1.1/dns-query
fallback_to_iterative: true
######################################################################
# CUSTOM RECORDS #
# Define local DNS records answered directly by kmresolv. #
# name: Hostname to resolve #
# type: Record type - all standard types through RFC 9460 #
# ttl: Time-to-live in seconds #
# value: IP address or hostname target for this record #
######################################################################
records:
- name: example.home
type: A
ttl: 3600
value: 192.168.1.50
######################################################################
# FILTERING #
# mode: blacklist - Block all listed domains and their subdomains #
# mode: whitelist - Allow only listed; block everything else #
# mode: off - Disable filtering entirely #
# #
# inline: Domains to filter, listed directly here #
# lists: Remote URLs or local file paths to lists #
# reload_interval_hours: Re-fetch lists every N hours, 0 = disabled #
# Also triggered on SIGHUP #
######################################################################
filtering:
mode: "off"
inline:
- ads.example.com
- tracker.example.net
lists:
- https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
- /etc/kmresolv/custom.list
reload_interval_hours: 0
######################################################################
# DASHBOARD #
# Web interface for monitoring and managing kmresolv. #
# #
# enabled: Toggle the web dashboard on or off #
# listen: IP address for the dashboard to bind to #
# port: HTTP/HTTPS port for the dashboard #
# username: Basic auth username (leave empty to disable auth) #
# password: Basic auth password #
# tls_cert_file: Path to PEM certificate for HTTPS. Both cert and #
# tls_key_file: key must be set (or both empty) to toggle TLS. #
# Strongly recommended when listen is 0.0.0.0 and #
# auth is enabled. #
######################################################################
dashboard:
enabled: true
listen: 0.0.0.0
port: 8080
auth:
username: "admin"
password: "changeme"
tls_cert_file: ""
tls_key_file: ""
######################################################################
# UPDATER #
# check_enabled: Check for new kmresolv releases on startup #
######################################################################
updater:
check_enabled: true
######################################################################
# MINECRAFT #
# Built-in Minecraft server lifecycle manager. #
# #
# enabled: Toggle the Minecraft server manager on or off #
# listen: IP address for the Minecraft server to bind to #
# port: Minecraft server port (default: 25565) #
# min_ram: Minimum JVM heap allocation (e.g. 1G, 512M) #
# max_ram: Maximum JVM heap allocation (e.g. 2G, 8G) #
######################################################################
minecraft:
enabled: false
listen: 0.0.0.0
port: 25565
min_ram: 1G
max_ram: 2G