diff --git a/charts/premium/blocky/Chart.yaml b/charts/premium/blocky/Chart.yaml index 17e6a666463..209624114a2 100644 --- a/charts/premium/blocky/Chart.yaml +++ b/charts/premium/blocky/Chart.yaml @@ -46,5 +46,4 @@ sources: - https://hub.docker.com/r/spx01/blocky - https://quay.io/oriedge/k8s_gateway type: application -version: 18.7.8 - +version: 18.8.0 \ No newline at end of file diff --git a/charts/premium/blocky/templates/_blockyConfig.tpl b/charts/premium/blocky/templates/_blockyConfig.tpl index 0aadca5d946..c7d9c857e4c 100644 --- a/charts/premium/blocky/templates/_blockyConfig.tpl +++ b/charts/premium/blocky/templates/_blockyConfig.tpl @@ -15,9 +15,11 @@ redis: required: true connectionAttempts: 10 connectionCooldown: 3s + prometheus: enable: true path: /metrics + queryLog: # optional one of: postgresql, csv, csv-client. If empty, log to console type: {{ .Values.queryLog.type }} @@ -33,17 +35,17 @@ queryLog: # optional: Max attempts to create specific query log writer creationAttempts: {{ .Values.queryLog.creationAttempts | default 3 }} # optional: Time between the creation attempts - creationCooldown: {{ .Values.queryLog.creationAttempts | default "2s" }} + creationCooldown: {{ .Values.queryLog.creationCooldown | default "2s" }} -upstream: - default: -{{- .Values.defaultUpstreams | toYaml | nindent 8 }} +upstreams: + groups: + default: +{{- .Values.defaultUpstreams | toYaml | nindent 10 }} {{- range $id, $value := .Values.upstreams }} - {{ $value.name }}: -{{- $value.dnsservers | toYaml | nindent 8 }} + {{ $value.name }}: +{{- $value.dnsservers | toYaml | nindent 10 }} {{- end }} - -upstreamTimeout: {{ .Values.upstreamTimeout | default "1s" }} + timeout: {{ .Values.upstreamTimeout | default "1s" }} ports: {{- if .Values.service.dns.enabled }} @@ -62,7 +64,6 @@ ports: {{- if .Values.certFile }} certFile: {{ .Values.certFile }} {{- end }} - {{- if .Values.keyFile }} keyFile: {{ .Values.keyFile }} {{- end }} @@ -71,6 +72,9 @@ log: {{- if .Values.logLevel }} level: {{ .Values.logLevel }} {{- end }} + {{- if .Values.logFormat }} + format: {{ .Values.logFormat }} + {{- end }} {{- if .Values.logTimestamp }} timestamp: {{ .Values.logTimestamp }} {{- end }} @@ -78,10 +82,6 @@ log: privacy: {{ .Values.logPrivacy }} {{- end }} -{{- if .Values.dohUserAgent }} -dohUserAgent: {{ .Values.dohUserAgent }} -{{- end }} - {{- if .Values.minTlsServeVersion }} minTlsServeVersion: {{ .Values.minTlsServeVersion }} {{- end }} @@ -130,19 +130,18 @@ filtering: {{- if or .Values.customDNS.filterUnmappedTypes .Values.customDNS.customTTL .Values.customDNS.rewrite .Values.customDNS.mapping }} customDNS: -{{- if .Values.customDNS.upstream }} - upstream: {{ .Values.customDNS.upstream }} -{{- end }} {{- if .Values.customDNS.customTTL }} customTTL: {{ .Values.customDNS.customTTL }} {{- end }} +{{- if .Values.customDNS.filterUnmappedTypes }} + filterUnmappedTypes: {{ .Values.customDNS.filterUnmappedTypes }} +{{- end }} {{- if .Values.customDNS.rewrite }} rewrite: {{- range $id, $value := .Values.customDNS.rewrite }} {{ $value.in }}: {{ $value.out }} {{- end }} {{- end }} - {{- if .Values.customDNS.mapping }} mapping: {{- range $id, $value := .Values.customDNS.mapping }} @@ -175,13 +174,15 @@ clientLookup: {{- if or .Values.conditional.rewrite .Values.conditional.mapping ( and .Values.k8sgateway.enabled .Values.k8sgateway.domains ) }} conditional: +{{- if .Values.conditional.fallbackUpstream }} + fallbackUpstream: {{ .Values.conditional.fallbackUpstream }} +{{- end }} {{- if .Values.conditional.rewrite }} rewrite: {{- range $id, $value := .Values.conditional.rewrite }} {{ $value.in }}: {{ $value.out }} {{- end }} {{- end }} - {{- if or .Values.conditional.mapping ( and .Values.k8sgateway.enabled .Values.k8sgateway.domains ) }} mapping: {{- if and .Values.k8sgateway.enabled .Values.k8sgateway.domains }} @@ -198,14 +199,20 @@ conditional: blocking: blockType: {{ .Values.blocking.blockType }} blockTTL: {{ .Values.blocking.blockTTL }} - refreshPeriod: {{ .Values.blocking.refreshPeriod }} - downloadTimeout: {{ .Values.blocking.downloadTimeout }} - downloadAttempts: {{ .Values.blocking.downloadAttempts }} - downloadCooldown: {{ .Values.blocking.downloadCooldown }} - startStrategy: {{ .Values.blocking.startStrategy }} - processingConcurrency: {{ .Values.blocking.processingConcurrency }} + loading: + refreshPeriod: {{ .Values.blocking.refreshPeriod }} + downloads: + timeout: {{ .Values.blocking.downloadTimeout }} + writeTimeout: {{ .Values.blocking.writeTimeout }} + readTimeout: {{ .Values.blocking.readTimeout }} + readHeaderTimeout: {{ .Values.blocking.readHeaderTimeout }} + attempts: {{ .Values.blocking.downloadAttempts }} + cooldown: {{ .Values.blocking.downloadCooldown }} + concurrency: {{ .Values.blocking.processingConcurrency }} + strategy: {{ .Values.blocking.startStrategy }} + maxErrorsPerSource: {{ .Values.blocking.maxErrorsPerSource }} - whiteLists: + allowlists: default: - https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/optional-list.txt - https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt @@ -215,8 +222,7 @@ blocking: {{- $value.lists | toYaml | nindent 10 }} {{- end }} - - blackLists: + denylists: default: - https://big.oisd.nl/domainswild - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts diff --git a/charts/premium/blocky/values.yaml b/charts/premium/blocky/values.yaml index 18ba1c6a966..5787bc4157c 100644 --- a/charts/premium/blocky/values.yaml +++ b/charts/premium/blocky/values.yaml @@ -89,17 +89,25 @@ service: port: 5353 protocol: udp targetPort: 5353 -## TODO Add support for SCALE certificates and certificates secrets here + +# -- Path to cert and key file for SSL encryption. If not set, self-signed certificate will be generated certFile: "" keyFile: "" + +# -- logging configuration +# Log level (one from trace, debug, info, warn, error) logLevel: info +# Log format (text or json) logFormat: text +# log timestamps (true or false) logTimestamp: true +# Obfuscate log output (replace all alphanumeric characters with *) for user sensitive data like request domains or responses to increase privacy. (true or false) logPrivacy: false -dohUserAgent: "" + +# -- Mininal TLS version that the DoH and DoT server will use minTlsServeVersion: 1.2 + # -- set the default DNS upstream servers -# Primarily designed for inclusion in the TrueNAS SCALE GUI defaultUpstreams: # Cloudflare - 1.1.1.1 @@ -116,15 +124,19 @@ defaultUpstreams: # ComodoSecure DNS - 8.26.56.26 - 8.20.247.20 + # -- set additional upstreams -# Primarily designed for inclusion in the TrueNAS SCALE GUI upstreams: # - name: group2 # dnsservers: # - 1.1.1.1 +# -- optional: timeout to query the upstream resolver. Default: 1s +upstreamTimeout: 1s + # -- set bootstrap dns (not needed) # Ensures bootstrap encryption and ensure it doesn't use k8s dns +# When using an upstream specified by IP, and not by hostname, you can write only the upstream and skip ips. bootstrapDns: # -- Upstream upstream: "" @@ -139,6 +151,7 @@ additionalBootstrapDns: [] filtering: # -- Ensures filtering by query type queryTypes: [] + # -- Set manual custom DNS resolution customDNS: customTTL: 1h @@ -149,6 +162,7 @@ customDNS: mapping: [] # - domain: something.com # dnsserver: 192.168.178.1 + # -- Setup client-name lookup clientLookup: # -- upstream used for client-name lookup @@ -157,27 +171,29 @@ clientLookup: clients: # - domain: laptop # ips: [] -# -- Setup caching + +# -- Configuration for caching of DNS responsesg caching: minTime: 15m - maxTime: 0 + maxTime: 0m maxItemsCount: 0 prefetching: true prefetchExpires: 12h prefetchThreshold: 5 prefetchMaxItemsCount: 0 cacheTimeNegative: 30m + # -- set conditional settings -# Primarily designed for inclusion in the TrueNAS SCALE GUI conditional: + fallbackUpstream: false rewrite: [] # - in: something.com # out: somethingelse.com mapping: [] # - domain: something.com # dnsserver: 192.168.178.1 + # -- set blocking settings using Lists -# Primarily designed for inclusion in the TrueNAS SCALE GUI blocking: # -- Sets the blocktype blockType: nxDomain @@ -187,14 +203,23 @@ blocking: refreshPeriod: 4h # -- Sets the block download timeout downloadTimeout: 60s + # -- timeout for list write to disk (each url) + writeTimeout: 60s + # -- timeout for reading the download (each url). + readTimeout: 60s + # -- timeout for reading request headers for the download (each url) + readHeaderTimeout: 60s # -- Sets the block download attempt count downloadAttempts: 3 # -- Sets the block download cooldown downloadCooldown: 5s - # -- Set the start strategy (blocking | failOnError | fast) - startStrategy: fast # -- Sets how many list-groups can be processed at the same time processingConcurrency: 8 + # -- Set the start strategy (blocking | failOnError | fast) + startStrategy: fast + # -- Number of errors allowed in a list before it is considered invalid + maxErrorsPerSource: 5 + # -- Add blocky whitelists # `default` name is reservered for TrueCharts included default whitelist # example shows the structure, though name should be changed when used @@ -229,9 +254,23 @@ blocking: # Allows for using the hosts configured in kubernetes and such hostsFile: enabled: false - filePath: /etc/hosts - hostsTTL: 60m - refreshPeriod: 30m + sources: + - /etc/hosts + - https://example.com/hosts + - | + # inline hosts + 127.0.0.1 example.com + hostsTTL: 1h + filterLoopback: falsr + loading: + refreshPeriod: 4h + downloads: + timeout: 5s + attempts: 3 + cooldown: 500ms + concurrency: 4 + strategy: blocking + maxErrorsPerSource: 5 podOptions: automountServiceAccountToken: true @@ -241,6 +280,7 @@ serviceAccount: # -- Specifies whether a service account should be created enabled: true primary: true + # -- Create a ClusterRole and ClusterRoleBinding # @default -- See below rbac: @@ -267,6 +307,7 @@ rbac: verbs: - list - watch + k8sgateway: enabled: true # -- TTL for non-apex responses (in seconds) @@ -287,7 +328,6 @@ k8sgateway: # dnsChallenge: # enabled: false # domain: dns01.clouddns.com - forward: enabled: false primary: tls://1.1.1.1