dns-ingress/config.toml.example at main · ttimochan/dns-ingress · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# DNS Proxy Configuration Example

[rewrite]
# Base domains to match (e.g., ["example.com", "example.org"])
# The rewriter will extract prefix from hostnames matching these base domains
# Examples:
#   - "www.example.org" -> extract "www" -> rewrite to "www.example.cn"
#   - "api.example.com" -> extract "api" -> rewrite to "api.example.cn"
base_domains = ["example.com", "example.org"]
# Target suffix for upstream (e.g., "www" -> "www.example.cn")
target_suffix = ".example.cn"

[servers]
# DNS over TLS (DoT) - TCP 853
[servers.dot]
enabled = true
bind_address = "0.0.0.0"
port = 853

# DNS over HTTPS (DoH) - TCP 443
[servers.doh]
enabled = true
bind_address = "0.0.0.0"
port = 443

# DNS over QUIC (DoQ) - UDP 853
[servers.doq]
enabled = true
bind_address = "0.0.0.0"
port = 853

# DNS over HTTP/3 (DoH3) - UDP 443
[servers.doh3]
enabled = false
bind_address = "0.0.0.0"
port = 443

# Healthcheck server - HTTP endpoint for health checks
[servers.healthcheck]
enabled = true
bind_address = "0.0.0.0"
port = 8080
path = "/health"

[upstream]
# Default upstream server
default = "8.8.8.8:853"
# Protocol-specific upstream servers (optional, falls back to default)
dot = "8.8.8.8:853"
doh = "https://dns.google/dns-query"
doq = "8.8.8.8:853"
doh3 = "https://dns.google/dns-query"

[tls]
# Default certificate configuration (optional)
# Used when no domain-specific certificate is configured
[tls.default]
cert_file = "/path/to/default-cert.pem"
key_file = "/path/to/default-key.pem"
# ca_file = "/path/to/default-ca.pem"
require_client_cert = false

# Domain-specific certificate configurations
# Each base domain can have its own certificate files
[tls.certs.example.com]
cert_file = "/path/to/example-com-cert.pem"
key_file = "/path/to/example-com-key.pem"
# ca_file = "/path/to/example-com-ca.pem"
require_client_cert = false

[tls.certs.example.org]
cert_file = "/path/to/example-org-cert.pem"
key_file = "/path/to/example-org-key.pem"
# ca_file = "/path/to/example-org-ca.pem"
require_client_cert = false

[logging]
# Log level: trace, debug, info, warn, error (default: info)
# Can also be set via RUST_LOG environment variable
level = "info"
# Log file path (optional, if not set, logs only to stdout/stderr)
# file = "/var/log/dns-proxy/dns-proxy.log"
# Enable JSON format for logs (default: false)
# json = false
# Enable log rotation (default: true if file is set)
# rotation = true
# Maximum log file size in bytes before rotation (default: 10MB)
# max_file_size = 10485760
# Number of log files to keep (default: 5)
# max_files = 5