From 427f6417aa3adfa5592a989c4a591722089013e3 Mon Sep 17 00:00:00 2001 From: Boemeltrein <130394941+Boemeltrein@users.noreply.github.com> Date: Sun, 31 Aug 2025 20:22:47 +0200 Subject: [PATCH] chore(blocky): update depricated values and add some more configs (#38853) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Description** In the latest versions, since this chart is made configs are changed, hereunder some depricated examples. Tried to match with https://0xerr0r.github.io/blocky/latest/configuration/ and added some more settings. Depricated example: ``` [2025-08-27 19:09:07] WARN Setting a duration without a unit is deprecated. Please use '0 min' instead. [2025-08-27 19:09:07] WARN Setting a duration without a unit is deprecated. Please use '3 min' instead. [2025-08-27 19:09:07] WARN config option "upstream" is deprecated, please use "upstreams.groups" instead [2025-08-27 19:09:07] WARN config option "upstreamTimeout" is deprecated, please use "upstreams.timeout" instead [2025-08-27 19:09:07] WARN config option "blocking.blackLists" is deprecated, please use "blocking.denylists" instead [2025-08-27 19:09:07] WARN config option "blocking.whiteLists" is deprecated, please use "blocking.allowlists" instead [2025-08-27 19:09:07] WARN config option "blocking.downloadTimeout" is deprecated, please use "blocking.loading.downloads.timeout" instead [2025-08-27 19:09:07] WARN config option "blocking.downloadAttempts" is deprecated, please use "blocking.loading.downloads.attempts" instead [2025-08-27 19:09:07] WARN config option "blocking.downloadCooldown" is deprecated, please use "blocking.loading.downloads.cooldown" instead [2025-08-27 19:09:07] WARN config option "blocking.refreshPeriod" is deprecated, please use "blocking.loading.refreshPeriod" instead [2025-08-27 19:09:07] WARN config option "blocking.processingConcurrency" is deprecated, please use "blocking.loading.concurrency" instead [2025-08-27 19:09:07] WARN config option "blocking.startStrategy" is deprecated, please use "blocking.loading.strategy" instead ``` ⚒️ Fixes # **⚙️ Type of change** - [x] ⚙️ Feature/App addition - [x] 🪛 Bugfix - [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 🔃 Refactor of current code - [ ] 📜 Documentation Changes **🧪 How Has This Been Tested?** Open for good suggestions to test this locally. Else we need to be ad-hoc when it releases. **📃 Notes:** **✔️ Checklist:** - [ ] ⚖️ My code follows the style guidelines of this project - [x] 👀 I have performed a self-review of my own code - [ ] #️⃣ I have commented my code, particularly in hard-to-understand areas - [ ] 📄 I have made changes to the documentation - [ ] 🧪 I have added tests to this description that prove my fix is effective or that my feature works - [x] ⬆️ I increased versions for any altered app according to semantic versioning - [x] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):`, `chore(chart-name):`, `docs(chart-name):` or `fix(docs):` **➕ App addition** If this PR is an app addition please make sure you have done the following. - [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._ --------- Signed-off-by: Boemeltrein <130394941+Boemeltrein@users.noreply.github.com> --- charts/premium/blocky/Chart.yaml | 3 +- .../blocky/templates/_blockyConfig.tpl | 60 ++++++++-------- charts/premium/blocky/values.yaml | 68 +++++++++++++++---- 3 files changed, 88 insertions(+), 43 deletions(-) diff --git a/charts/premium/blocky/Chart.yaml b/charts/premium/blocky/Chart.yaml index 17e6a666463..209624114a2 100644 --- a/charts/premium/blocky/Chart.yaml +++ b/charts/premium/blocky/Chart.yaml @@ -46,5 +46,4 @@ sources: - https://hub.docker.com/r/spx01/blocky - https://quay.io/oriedge/k8s_gateway type: application -version: 18.7.8 - +version: 18.8.0 \ No newline at end of file diff --git a/charts/premium/blocky/templates/_blockyConfig.tpl b/charts/premium/blocky/templates/_blockyConfig.tpl index 0aadca5d946..c7d9c857e4c 100644 --- a/charts/premium/blocky/templates/_blockyConfig.tpl +++ b/charts/premium/blocky/templates/_blockyConfig.tpl @@ -15,9 +15,11 @@ redis: required: true connectionAttempts: 10 connectionCooldown: 3s + prometheus: enable: true path: /metrics + queryLog: # optional one of: postgresql, csv, csv-client. If empty, log to console type: {{ .Values.queryLog.type }} @@ -33,17 +35,17 @@ queryLog: # optional: Max attempts to create specific query log writer creationAttempts: {{ .Values.queryLog.creationAttempts | default 3 }} # optional: Time between the creation attempts - creationCooldown: {{ .Values.queryLog.creationAttempts | default "2s" }} + creationCooldown: {{ .Values.queryLog.creationCooldown | default "2s" }} -upstream: - default: -{{- .Values.defaultUpstreams | toYaml | nindent 8 }} +upstreams: + groups: + default: +{{- .Values.defaultUpstreams | toYaml | nindent 10 }} {{- range $id, $value := .Values.upstreams }} - {{ $value.name }}: -{{- $value.dnsservers | toYaml | nindent 8 }} + {{ $value.name }}: +{{- $value.dnsservers | toYaml | nindent 10 }} {{- end }} - -upstreamTimeout: {{ .Values.upstreamTimeout | default "1s" }} + timeout: {{ .Values.upstreamTimeout | default "1s" }} ports: {{- if .Values.service.dns.enabled }} @@ -62,7 +64,6 @@ ports: {{- if .Values.certFile }} certFile: {{ .Values.certFile }} {{- end }} - {{- if .Values.keyFile }} keyFile: {{ .Values.keyFile }} {{- end }} @@ -71,6 +72,9 @@ log: {{- if .Values.logLevel }} level: {{ .Values.logLevel }} {{- end }} + {{- if .Values.logFormat }} + format: {{ .Values.logFormat }} + {{- end }} {{- if .Values.logTimestamp }} timestamp: {{ .Values.logTimestamp }} {{- end }} @@ -78,10 +82,6 @@ log: privacy: {{ .Values.logPrivacy }} {{- end }} -{{- if .Values.dohUserAgent }} -dohUserAgent: {{ .Values.dohUserAgent }} -{{- end }} - {{- if .Values.minTlsServeVersion }} minTlsServeVersion: {{ .Values.minTlsServeVersion }} {{- end }} @@ -130,19 +130,18 @@ filtering: {{- if or .Values.customDNS.filterUnmappedTypes .Values.customDNS.customTTL .Values.customDNS.rewrite .Values.customDNS.mapping }} customDNS: -{{- if .Values.customDNS.upstream }} - upstream: {{ .Values.customDNS.upstream }} -{{- end }} {{- if .Values.customDNS.customTTL }} customTTL: {{ .Values.customDNS.customTTL }} {{- end }} +{{- if .Values.customDNS.filterUnmappedTypes }} + filterUnmappedTypes: {{ .Values.customDNS.filterUnmappedTypes }} +{{- end }} {{- if .Values.customDNS.rewrite }} rewrite: {{- range $id, $value := .Values.customDNS.rewrite }} {{ $value.in }}: {{ $value.out }} {{- end }} {{- end }} - {{- if .Values.customDNS.mapping }} mapping: {{- range $id, $value := .Values.customDNS.mapping }} @@ -175,13 +174,15 @@ clientLookup: {{- if or .Values.conditional.rewrite .Values.conditional.mapping ( and .Values.k8sgateway.enabled .Values.k8sgateway.domains ) }} conditional: +{{- if .Values.conditional.fallbackUpstream }} + fallbackUpstream: {{ .Values.conditional.fallbackUpstream }} +{{- end }} {{- if .Values.conditional.rewrite }} rewrite: {{- range $id, $value := .Values.conditional.rewrite }} {{ $value.in }}: {{ $value.out }} {{- end }} {{- end }} - {{- if or .Values.conditional.mapping ( and .Values.k8sgateway.enabled .Values.k8sgateway.domains ) }} mapping: {{- if and .Values.k8sgateway.enabled .Values.k8sgateway.domains }} @@ -198,14 +199,20 @@ conditional: blocking: blockType: {{ .Values.blocking.blockType }} blockTTL: {{ .Values.blocking.blockTTL }} - refreshPeriod: {{ .Values.blocking.refreshPeriod }} - downloadTimeout: {{ .Values.blocking.downloadTimeout }} - downloadAttempts: {{ .Values.blocking.downloadAttempts }} - downloadCooldown: {{ .Values.blocking.downloadCooldown }} - startStrategy: {{ .Values.blocking.startStrategy }} - processingConcurrency: {{ .Values.blocking.processingConcurrency }} + loading: + refreshPeriod: {{ .Values.blocking.refreshPeriod }} + downloads: + timeout: {{ .Values.blocking.downloadTimeout }} + writeTimeout: {{ .Values.blocking.writeTimeout }} + readTimeout: {{ .Values.blocking.readTimeout }} + readHeaderTimeout: {{ .Values.blocking.readHeaderTimeout }} + attempts: {{ .Values.blocking.downloadAttempts }} + cooldown: {{ .Values.blocking.downloadCooldown }} + concurrency: {{ .Values.blocking.processingConcurrency }} + strategy: {{ .Values.blocking.startStrategy }} + maxErrorsPerSource: {{ .Values.blocking.maxErrorsPerSource }} - whiteLists: + allowlists: default: - https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/optional-list.txt - https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt @@ -215,8 +222,7 @@ blocking: {{- $value.lists | toYaml | nindent 10 }} {{- end }} - - blackLists: + denylists: default: - https://big.oisd.nl/domainswild - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts diff --git a/charts/premium/blocky/values.yaml b/charts/premium/blocky/values.yaml index 18ba1c6a966..5787bc4157c 100644 --- a/charts/premium/blocky/values.yaml +++ b/charts/premium/blocky/values.yaml @@ -89,17 +89,25 @@ service: port: 5353 protocol: udp targetPort: 5353 -## TODO Add support for SCALE certificates and certificates secrets here + +# -- Path to cert and key file for SSL encryption. If not set, self-signed certificate will be generated certFile: "" keyFile: "" + +# -- logging configuration +# Log level (one from trace, debug, info, warn, error) logLevel: info +# Log format (text or json) logFormat: text +# log timestamps (true or false) logTimestamp: true +# Obfuscate log output (replace all alphanumeric characters with *) for user sensitive data like request domains or responses to increase privacy. (true or false) logPrivacy: false -dohUserAgent: "" + +# -- Mininal TLS version that the DoH and DoT server will use minTlsServeVersion: 1.2 + # -- set the default DNS upstream servers -# Primarily designed for inclusion in the TrueNAS SCALE GUI defaultUpstreams: # Cloudflare - 1.1.1.1 @@ -116,15 +124,19 @@ defaultUpstreams: # ComodoSecure DNS - 8.26.56.26 - 8.20.247.20 + # -- set additional upstreams -# Primarily designed for inclusion in the TrueNAS SCALE GUI upstreams: # - name: group2 # dnsservers: # - 1.1.1.1 +# -- optional: timeout to query the upstream resolver. Default: 1s +upstreamTimeout: 1s + # -- set bootstrap dns (not needed) # Ensures bootstrap encryption and ensure it doesn't use k8s dns +# When using an upstream specified by IP, and not by hostname, you can write only the upstream and skip ips. bootstrapDns: # -- Upstream upstream: "" @@ -139,6 +151,7 @@ additionalBootstrapDns: [] filtering: # -- Ensures filtering by query type queryTypes: [] + # -- Set manual custom DNS resolution customDNS: customTTL: 1h @@ -149,6 +162,7 @@ customDNS: mapping: [] # - domain: something.com # dnsserver: 192.168.178.1 + # -- Setup client-name lookup clientLookup: # -- upstream used for client-name lookup @@ -157,27 +171,29 @@ clientLookup: clients: # - domain: laptop # ips: [] -# -- Setup caching + +# -- Configuration for caching of DNS responsesg caching: minTime: 15m - maxTime: 0 + maxTime: 0m maxItemsCount: 0 prefetching: true prefetchExpires: 12h prefetchThreshold: 5 prefetchMaxItemsCount: 0 cacheTimeNegative: 30m + # -- set conditional settings -# Primarily designed for inclusion in the TrueNAS SCALE GUI conditional: + fallbackUpstream: false rewrite: [] # - in: something.com # out: somethingelse.com mapping: [] # - domain: something.com # dnsserver: 192.168.178.1 + # -- set blocking settings using Lists -# Primarily designed for inclusion in the TrueNAS SCALE GUI blocking: # -- Sets the blocktype blockType: nxDomain @@ -187,14 +203,23 @@ blocking: refreshPeriod: 4h # -- Sets the block download timeout downloadTimeout: 60s + # -- timeout for list write to disk (each url) + writeTimeout: 60s + # -- timeout for reading the download (each url). + readTimeout: 60s + # -- timeout for reading request headers for the download (each url) + readHeaderTimeout: 60s # -- Sets the block download attempt count downloadAttempts: 3 # -- Sets the block download cooldown downloadCooldown: 5s - # -- Set the start strategy (blocking | failOnError | fast) - startStrategy: fast # -- Sets how many list-groups can be processed at the same time processingConcurrency: 8 + # -- Set the start strategy (blocking | failOnError | fast) + startStrategy: fast + # -- Number of errors allowed in a list before it is considered invalid + maxErrorsPerSource: 5 + # -- Add blocky whitelists # `default` name is reservered for TrueCharts included default whitelist # example shows the structure, though name should be changed when used @@ -229,9 +254,23 @@ blocking: # Allows for using the hosts configured in kubernetes and such hostsFile: enabled: false - filePath: /etc/hosts - hostsTTL: 60m - refreshPeriod: 30m + sources: + - /etc/hosts + - https://example.com/hosts + - | + # inline hosts + 127.0.0.1 example.com + hostsTTL: 1h + filterLoopback: falsr + loading: + refreshPeriod: 4h + downloads: + timeout: 5s + attempts: 3 + cooldown: 500ms + concurrency: 4 + strategy: blocking + maxErrorsPerSource: 5 podOptions: automountServiceAccountToken: true @@ -241,6 +280,7 @@ serviceAccount: # -- Specifies whether a service account should be created enabled: true primary: true + # -- Create a ClusterRole and ClusterRoleBinding # @default -- See below rbac: @@ -267,6 +307,7 @@ rbac: verbs: - list - watch + k8sgateway: enabled: true # -- TTL for non-apex responses (in seconds) @@ -287,7 +328,6 @@ k8sgateway: # dnsChallenge: # enabled: false # domain: dns01.clouddns.com - forward: enabled: false primary: tls://1.1.1.1