Skip to content

Commit 4280770

Browse files
klutchellklutchell
committed
config: Update example configs to listen on all IPv4 addresses
Signed-off-by: Kyle Harding <kyle@balena.io>
1 parent ea0d4e2 commit 4280770

10 files changed

Lines changed: 1287 additions & 4 deletions

‎Dockerfile‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,11 @@ RUN --mount=type=cache,target=/home/nonroot/.cache/go-build,uid=65532,gid=65532
1919

2020
WORKDIR /config
2121

22-
RUN cp -a /src/dnscrypt-proxy/example-* ./
22+
# Copy example configs for reference and update listen address
23+
RUN cp -a /src/dnscrypt-proxy/example-* ./ \
24+
&& sed -i '/^listen_addresses/s/127.0.0.1/0.0.0.0/' ./example-dnscrypt-proxy.toml
2325

24-
COPY dnscrypt-proxy.toml ./
26+
COPY config/dnscrypt-proxy.toml ./
2527

2628
ARG NONROOT_UID=65532
2729
ARG NONROOT_GID=65532
@@ -32,8 +34,8 @@ RUN addgroup -S -g ${NONROOT_GID} nonroot \
3234
# ----------------------------------------------------------------------------
3335
FROM scratch AS conf-example
3436

35-
# docker build . --target conf-example --output .
36-
COPY --from=build /config/example-dnscrypt-proxy.toml /dnscrypt-proxy.toml.example
37+
# docker build . --target conf-example --output ./config
38+
COPY --from=build /config/example-* /
3739

3840
# ----------------------------------------------------------------------------
3941
FROM --platform=$BUILDPLATFORM golang:1.25.5-alpine3.21@sha256:b4dbd292a0852331c89dfd64e84d16811f3e3aae4c73c13d026c4d200715aff6 AS probe

dnscrypt-proxy.toml renamed to config/dnscrypt-proxy.toml

File renamed without changes.

‎config/example-allowed-ips.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
##############################
2+
# Allowed IPs List #
3+
##############################
4+
5+
#192.168.0.*
6+
#fe80:53:* # IPv6 prefix example
7+
#81.169.145.105

‎config/example-allowed-names.txt‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
2+
###########################
3+
# Allowlist #
4+
###########################
5+
6+
## Rules for allowing queries based on name, one per line
7+
##
8+
## Example of valid patterns:
9+
##
10+
## ads.* | matches anything with an "ads." prefix
11+
## *.example.com | matches example.com and all names within that zone such as www.example.com
12+
## example.com | identical to the above
13+
## =example.com | allows example.com but not *.example.com
14+
## [a-z0-9\-_]*.example.com | allows *.example.com but not example.com
15+
## *sex* | matches any name containing that substring
16+
## ads[0-9]* | matches "ads" followed by one or more digits
17+
## ads*.example* | *, ? and [] can be used anywhere, but prefixes/suffixes are faster
18+
19+
20+
# That one may be blocked due to 'tracker' being in the name.
21+
tracker.debian.org
22+
23+
# That one may be blocked due to 'ads' being in the name.
24+
# However, blocking it prevents all sponsored links from the Google
25+
# search engine from being opened.
26+
googleadservices.com
27+
28+
29+
## Time-based rules
30+
31+
# *.youtube.* @time-to-play
32+
# facebook.com @play

‎config/example-blocked-ips.txt‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
##############################
2+
# IP blocklist #
3+
##############################
4+
5+
## Rules for blocking DNS responses if they contain
6+
## IP addresses matching patterns.
7+
##
8+
## Sample feeds of suspect IP addresses:
9+
## - https://github.com/stamparm/ipsum
10+
## - https://github.com/tg12/bad_packets_blocklist
11+
## - https://isc.sans.edu/block.txt
12+
## - https://block.energized.pro/extensions/ips/formats/list.txt
13+
## - https://www.iblocklist.com/lists
14+
15+
163.5.1.4
16+
94.46.118.*
17+
fe80:53:* # IPv6 prefix example

‎config/example-blocked-names.txt‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
2+
###########################
3+
# Blocklist #
4+
###########################
5+
6+
## Rules for name-based query blocking, one per line
7+
##
8+
## Example of valid patterns:
9+
##
10+
## ads.* | matches anything with an "ads." prefix
11+
## *.example.com | matches example.com and all names within that zone such as www.example.com
12+
## example.com | identical to the above
13+
## =example.com | blocks example.com but not *.example.com
14+
## [a-z0-9\-_]*.example.com | blocks *.example.com but not example.com
15+
## *sex* | matches any name containing that substring
16+
## ads[0-9]* | matches "ads" followed by one or more digits
17+
## ads*.example* | *, ? and [] can be used anywhere, but prefixes/suffixes are faster
18+
19+
ad.*
20+
ads.*
21+
banner.*
22+
banners.*
23+
creatives.*
24+
oas.*
25+
oascentral.* # inline comments are allowed after a pound sign
26+
stats.*
27+
tag.*
28+
telemetry.*
29+
tracker.*
30+
*.local
31+
eth0.me
32+
*.workgroup
33+
34+
35+
## Prevent usage of Apple private relay, that bypasses DNS
36+
37+
# mask.apple-dns.net
38+
# mask.icloud.com
39+
# mask-api.icloud.com
40+
# doh.dns.apple.com
41+
42+
43+
## Time-based rules
44+
45+
# *.youtube.* @time-to-sleep
46+
# facebook.com @work

‎config/example-captive-portals.txt‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
###########################################
2+
# Captive portal test names #
3+
###########################################
4+
5+
## Some operating systems send queries to these names after a network change,
6+
## in order to check if connectivity beyond the router is possible without
7+
## going through a captive portal.
8+
##
9+
## This is a list of hard-coded IP addresses that will be returned when queries
10+
## for these names are received, even before the operating system reports an interface
11+
## as usable for reaching the Internet.
12+
##
13+
## Note that IPv6 addresses don't need to be specified within brackets,
14+
## as there are no port numbers.
15+
16+
captive.apple.com 17.253.109.201, 17.253.113.202
17+
connectivitycheck.gstatic.com 64.233.162.94, 64.233.164.94, 64.233.165.94, 64.233.177.94, 64.233.185.94, 74.125.132.94, 74.125.136.94, 74.125.20.94, 74.125.21.94, 74.125.28.94
18+
connectivitycheck.android.com 64.233.162.100, 64.233.162.101, 64.233.162.102, 64.233.162.113, 64.233.162.138, 64.233.162.139
19+
www.msftncsi.com 2.16.106.89, 2.16.106.91, 23.0.175.137, 23.0.175.146, 23.192.47.155, 23.192.47.203, 23.199.63.160, 23.199.63.184, 23.199.63.208, 23.204.146.160, 23.204.146.163, 23.46.238.243, 23.46.239.24, 23.48.39.16, 23.48.39.48, 23.55.38.139, 23.55.38.146, 23.59.190.185, 23.59.190.195
20+
dns.msftncsi.com 131.107.255.255, fd3e:4f5a:5b81::1
21+
www.msftconnecttest.com 13.107.4.52
22+
ipv6.msftconnecttest.com 2a01:111:2003::52
23+
ipv4only.arpa 192.0.0.170, 192.0.0.171
24+
25+
## Adding IP addresses of NTP servers is also a good idea
26+
27+
time.google.com 216.239.35.0, 2001:4860:4806::

‎config/example-cloaking-rules.txt‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
################################
2+
# Cloaking rules #
3+
################################
4+
5+
# The following example rules force "safe" (without adult content) search
6+
# results from Google, Bing and YouTube.
7+
#
8+
# This has to be enabled with the `cloaking_rules` parameter in the main
9+
# configuration file
10+
11+
12+
www.google.* forcesafesearch.google.com
13+
14+
www.bing.com strict.bing.com
15+
16+
yandex.ru familysearch.yandex.ru # inline comments are allowed after a pound sign
17+
18+
=duckduckgo.com safe.duckduckgo.com
19+
20+
www.youtube.com restrictmoderate.youtube.com
21+
m.youtube.com restrictmoderate.youtube.com
22+
youtubei.googleapis.com restrictmoderate.youtube.com
23+
youtube.googleapis.com restrictmoderate.youtube.com
24+
www.youtube-nocookie.com restrictmoderate.youtube.com
25+
26+
# Multiple IP entries for the same name are supported.
27+
# In the following example, the same name maps both to IPv4 and IPv6 addresses:
28+
29+
localhost 127.0.0.1
30+
localhost ::1
31+
32+
# For load-balancing, multiple IP addresses of the same class can also be
33+
# provided using the same format, one <pattern> <ip> pair per line.
34+
35+
# ads.* 192.168.100.1
36+
# ads.* 192.168.100.2
37+
# ads.* ::1
38+
39+
# PTR records can be created by setting cloak_ptr in the main configuration file
40+
# Entries with wild cards will not have PTR records created, but multiple
41+
# names for the same IP are supported
42+
43+
# example.com 192.168.100.1
44+
# my.example.com 192.168.100.1

0 commit comments

Comments
 (0)