kresd.conf

-- Default empty Knot DNS Resolver configuration in -*- lua -*-

net.listen('127.0.0.1', 53)
net.listen('192.168.100.1', 53, { freebind = true })
net.listen('192.168.104.1', 53, { freebind = true })

local self_ip = os.getenv('SELF_IP')
if self_ip ~= nil and self_ip ~= '' then
    net.listen(self_ip, 53)
end

-- Switch to unprivileged user --
user('knot-resolver','knot-resolver')
-- Unprivileged
cache.size = 100 * MB
trust_anchors.remove('.')

-- Clear cache upon restart
cache.clear()

-- For tmpfs
-- cache.open(300 * MB, 'lmdb:///tmp/knot-resolver')

-- See https://gitlab.labs.nic.cz/knot/knot-resolver/issues/470
net.ipv6 = false

modules = {
        'hints > iterate',  -- Load /etc/hosts and allow custom root hints
        'stats',            -- Track internal statistics
        'predict',          -- Prefetch expiring/frequent records
}

-- minimum TTL = 2 minutes
cache.min_ttl(120)

dofile('/etc/knot-resolver/knot-aliases-alt.conf')

-- Function for resolving upstream DNS
-- local socket = require('socket')
-- local function resolve(domain)
--     local ip, port = socket.dns.toip(domain)
--     if ip then
--         return ip
--     else
--         return '1.1.1.1'
--     end
-- end

local dns = os.getenv('DNS')
local dns_ru = os.getenv('DNS_RU')
local adguard = os.getenv('ADGUARD')

-- if not dns then dns = '127.0.0.11' end
-- if not dns_ru then dns = '77.88.8.8' end

if os.getenv('LOG_DNS') == '1' then
    policy.add(policy.all(policy.DEBUG_ALWAYS))
end

if (regex_allowed ~= '' or regex_blocked  ~= '') then
    policy.add(
        function (_, query)
            local command = string.format(
                '/etc/knot-resolver/regex.sh "%s" "%s" "%s"',
                kres.dname2str(query.sname),
                regex_allowed,
                regex_blocked
            )
            local handle = io.popen(command)
            local result = handle:read("*line")
            handle:close()

            if result == 'blocked' then
                return policy.STUB({'127.0.0.4'})
            elseif result == 'allowed' then
                return policy.FORWARD({dns})
            end

            -- filter did not match, continue with next filter
            return nil
        end
    )
end

-- Forward blocked domains to dnsmap
policy.add(
    policy.suffix(
        policy.STUB(
            {'127.0.0.4'}
        ),
        policy.todnames(blocked_hosts)
    )
)

-- Resolve OpenNIC, EMCDNS and Namecoin domains
policy.add(
    policy.suffix(
        policy.STUB(
            {'172.104.136.243', '176.126.70.119', '87.98.175.85', '193.183.98.66'}
        ),
        policy.todnames(
            {'bbs.', 'chan.', 'cyb.', 'dyn.', 'geek.', 'gopher.',
             'indy.', 'libre.', 'neo.', 'null.', 'o.', 'oss.', 'oz.',
             'parody.', 'pirate.', 'free.', 'bazar.', 'coin.',
             'emc.', 'lib.', 'fur.', 'bit.', 'ku.', 'te.', 'ti.', 'uu.'
            }
        )
    )
)

-- Resolve Apple
policy.add(
    policy.suffix(
        policy.FORWARD(
            {dns_ru}
        ),
        policy.todnames(
            {'apple.com.', 'aaplimg.com.', 'apple-dns.net.', 'icloud-content.com.', 'itunes-nocookie.com.',
             'akadns.net.', 'akamai.com.', 'akamaiedge.net.', 'edgekey.net.',
             'mzstatic.com.'
            }
        )
    )
)

if adguard == '0' then
    -- *.ru, *.рф, *.su
    policy.add(
        policy.suffix(
            policy.FORWARD(
                {dns_ru}
            ),
            policy.todnames(
                {'ru.', 'xn--p1ai.', 'su.'}
            )
        )
    )
end

-- Upstream DNS
policy.add(
    policy.all(
        policy.FORWARD({dns})
    )
)