637b374d8b
Numa becomes a true DNS resolver — resolves from root nameservers with complete DNSSEC chain-of-trust verification. Recursive resolution: - Iterative RFC 1034 from configurable root hints (13 default) - CNAME chasing (depth 8), referral following (depth 10) - A+AAAA glue extraction, IPv6 nameserver support - TLD priming: NS + DS + DNSKEY for 34 gTLDs + EU ccTLDs - Config: mode = "recursive" in [upstream], root_hints, prime_tlds DNSSEC (all 4 phases): - EDNS0 OPT pseudo-record (DO bit, 1232 payload per DNS Flag Day 2020) - DNSKEY, DS, RRSIG, NSEC, NSEC3 record types with wire read/write - Signature verification via ring: RSA/SHA-256, ECDSA P-256, Ed25519 - Chain-of-trust: zone DNSKEY → parent DS → root KSK (key tag 20326) - DNSKEY RRset self-signature verification (RRSIG(DNSKEY) by KSK) - RRSIG expiration/inception time validation - NSEC: NXDOMAIN gap proofs, NODATA type absence, wildcard denial - NSEC3: SHA-1 iterated hashing, closest encloser proof, hash range - Authority RRSIG verification for denial proofs - Config: [dnssec] enabled/strict (default false, opt-in) - AD bit on Secure, SERVFAIL on Bogus+strict - DnssecStatus cached per entry, ValidationStats logging Performance: - TLD chain pre-warmed on startup (root DNSKEY + TLD DS/DNSKEY) - Referral DS piggybacking from authority sections - DNSKEY prefetch before validation loop - Cold-cache validation: ~1 DNSKEY fetch (down from 5) - Benchmarks: RSA 10.9µs, ECDSA 174ns, DS verify 257ns Also: - write_qname fix for root domain "." (was producing malformed queries) - write_record_header() dedup, write_bytes() bulk writes - DnsRecord::domain() + query_type() accessors - UpstreamMode enum, DEFAULT_EDNS_PAYLOAD const - Real glue TTL (was hardcoded 3600) - DNSSEC restricted to recursive mode only Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
91 lines
3.2 KiB
TOML
91 lines
3.2 KiB
TOML
[server]
|
|
bind_addr = "0.0.0.0:53"
|
|
api_port = 5380
|
|
# api_bind_addr = "127.0.0.1" # default; set to "0.0.0.0" for LAN dashboard access
|
|
|
|
# [upstream]
|
|
# mode = "forward" # "forward" (default) — relay to upstream
|
|
# # "recursive" — resolve from root hints (no address needed)
|
|
# address = "https://dns.quad9.net/dns-query" # DNS-over-HTTPS (encrypted)
|
|
# address = "https://cloudflare-dns.com/dns-query" # Cloudflare DoH
|
|
# address = "9.9.9.9" # plain UDP
|
|
# port = 53 # only for forward mode, plain UDP
|
|
# timeout_ms = 3000
|
|
# root_hints = [ # only used in recursive mode
|
|
# "198.41.0.4", # a.root-servers.net (Verisign)
|
|
# "199.9.14.201", # b.root-servers.net (USC-ISI)
|
|
# "192.33.4.12", # c.root-servers.net (Cogent)
|
|
# "199.7.91.13", # d.root-servers.net (UMD)
|
|
# "192.203.230.10", # e.root-servers.net (NASA)
|
|
# "192.5.5.241", # f.root-servers.net (ISC)
|
|
# "192.112.36.4", # g.root-servers.net (US DoD)
|
|
# "198.97.190.53", # h.root-servers.net (US Army)
|
|
# "192.36.148.17", # i.root-servers.net (Netnod)
|
|
# "192.58.128.30", # j.root-servers.net (Verisign)
|
|
# "193.0.14.129", # k.root-servers.net (RIPE NCC)
|
|
# "199.7.83.42", # l.root-servers.net (ICANN)
|
|
# "202.12.27.33", # m.root-servers.net (WIDE)
|
|
# ]
|
|
# prime_tlds = [ # TLDs to pre-warm on startup (recursive mode)
|
|
# "com", "net", "org", "info", # gTLDs
|
|
# "io", "dev", "app", "xyz", "me",
|
|
# "eu", "uk", "de", "fr", "nl", # EU + European ccTLDs
|
|
# "it", "es", "pl", "se", "no",
|
|
# "dk", "fi", "at", "be", "ie",
|
|
# "pt", "cz", "ro", "gr", "hu",
|
|
# "bg", "hr", "sk", "si", "lt",
|
|
# "lv", "ee", "ch", "is",
|
|
# "co", "br", "au", "ca", "jp", # other major ccTLDs
|
|
# ]
|
|
|
|
# [blocking]
|
|
# enabled = true # set to false to disable ad blocking
|
|
# refresh_hours = 24
|
|
# lists = ["https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/pro.txt"]
|
|
# allowlist = ["example.com"] # domains to never block
|
|
|
|
[cache]
|
|
max_entries = 10000
|
|
min_ttl = 60
|
|
max_ttl = 86400
|
|
|
|
[proxy]
|
|
enabled = true
|
|
port = 80
|
|
tls_port = 443
|
|
tld = "numa"
|
|
# bind_addr = "127.0.0.1" # default; auto 0.0.0.0 when [lan] enabled
|
|
|
|
# Pre-configured services (numa.numa is always added automatically)
|
|
# [[services]]
|
|
# name = "frontend"
|
|
# target_port = 5173
|
|
#
|
|
# [[services]]
|
|
# name = "api"
|
|
# target_port = 8000
|
|
|
|
# Example zone records:
|
|
# [[zones]]
|
|
# domain = "dimescu.ro"
|
|
# record_type = "A"
|
|
# value = "3.120.139.105"
|
|
# ttl = 30
|
|
|
|
# [[zones]]
|
|
# domain = "test.local"
|
|
# record_type = "A"
|
|
# value = "127.0.0.1"
|
|
# ttl = 60
|
|
|
|
# DNSSEC signature validation (requires mode = "recursive")
|
|
# [dnssec]
|
|
# enabled = false # opt-in: verify chain of trust from root KSK
|
|
# strict = false # true = SERVFAIL on bogus signatures
|
|
|
|
# LAN service discovery via mDNS (disabled by default — no network traffic unless enabled)
|
|
# [lan]
|
|
# enabled = true # discover other Numa instances via mDNS (_numa._tcp.local)
|
|
# broadcast_interval_secs = 30
|
|
# peer_timeout_secs = 90
|