truecharts/charts/stable/blocky/values.yaml

# yaml-language-server: $schema=./values.schema.json
image:
  repository: ghcr.io/0xerr0r/blocky
  tag: v0.30.0@sha256:d9f15eddffedded40797406349012cbd5966ef99c286b13321e7a76efddb9bdc
  pullPolicy: IfNotPresent
k8sgatewayImage:
  repository: ghcr.io/k8s-gateway/k8s_gateway
  pullPolicy: IfNotPresent
  tag: 1.8.0@sha256:e17ed387f48da00b4736fbeecc338238b11ea20478c3c9ad35876509eb65c022

workload:
  main:
    replicas: 2
    strategy: RollingUpdate
    podSpec:
      containers:
        main:
          probes:
            liveness:
              enabled: false
              type: exec
              command:
                - /app/blocky
                - healthcheck
            readiness:
              enabled: false
              type: exec
              command:
                - /app/blocky
                - healthcheck
            startup:
              enabled: false
              type: exec
              command:
                - /app/blocky
                - healthcheck
# -- Blocky Config File content
blockyConfig: {}
# upstream:
#   default:
#     - 1.1.1.1

# -- some general blocky settings
blocky:
  # -- Enable prometheus annotations
  enablePrometheus: true
service:
  main:
    enabled: true
    ports:
      main:
        enabled: true
        port: 4000
        protocol: http
        targetPort: 4000
  dns:
    enabled: true
    ports:
      dns:
        enabled: true
        port: 53
        protocol: udp
        targetPort: 53
      dnstcp:
        enabled: true
        protocol: tcp
        port: "{{ .Values.service.dns.ports.dns.port }}"
        targetPort: 53
  dot:
    enabled: true
    ports:
      dot:
        enabled: true
        port: 853
        protocol: tcp
        targetPort: 853
  https:
    enabled: true
    ports:
      https:
        enabled: true
        port: 4443
        protocol: https
        targetPort: 4443
  k8sgateway:
    enabled: true
    ports:
      k8sgateway:
        enabled: true
        port: 5353
        protocol: udp
        targetPort: 5353

# -- Path to cert and key file for SSL encryption. If not set, self-signed certificate will be generated
certFile: ""
keyFile: ""

# -- logging configuration
# Log level (one from trace, debug, info, warn, error)
logLevel: info
# Log format (text or json)
logFormat: text
# log timestamps (true or false)
logTimestamp: true
# Obfuscate log output (replace all alphanumeric characters with *) for user sensitive data like request domains or responses to increase privacy. (true or false)
logPrivacy: false

# -- Mininal TLS version that the DoH and DoT server will use
minTlsServeVersion: 1.2

# -- set the default DNS upstream servers
defaultUpstreams:
  # Cloudflare
  - 1.1.1.1
  - 1.0.0.1
  # Google
  - 8.8.8.8
  - 8.8.4.4
  # Quad9
  - 9.9.9.9
  - 149.112.112.112
  # OpenDNS
  - 208.67.222.222
  - 208.67.220.220
  # ComodoSecure DNS
  - 8.26.56.26
  - 8.20.247.20

# -- set additional upstreams
upstreams:
#  - name: group2
#    dnsservers:
#      - 1.1.1.1

# -- optional: timeout to query the upstream resolver. Default: 1s
upstreamTimeout: 1s

# -- set bootstrap dns (not needed)
# Ensures bootstrap encryption and ensure it doesn't use k8s dns
# When using an upstream specified by IP, and not by hostname, you can write only the upstream and skip ips.
bootstrapDns:
  # -- Upstream
  upstream: ""
  # -- IP's linked to upstream DoT/DoH DNS name
  ips: []
# -- set additional bootstrap dns (not needed, only used if bootstrapDns is set)
additionalBootstrapDns: []
# - upstream: ""
#   ips: []

# -- Return empty answer for these queries
filtering:
  # -- Ensures filtering by query type
  queryTypes: []

# -- Set manual custom DNS resolution
customDNS:
  customTTL: 1h
  filterUnmappedTypes: true
  rewrite: []
  # - in: something.com
  #   out: somethingelse.com
  mapping: []
  # - domain: something.com
  #   dnsserver: 192.168.178.1

# -- Setup client-name lookup
clientLookup:
  # -- upstream used for client-name lookup
  upstream: ""
  singleNameOrder: []
  clients:
  # - domain: laptop
  #   ips: []

# -- Configuration for caching of DNS responsesg
caching:
  minTime: 15m
  maxTime: 0m
  maxItemsCount: 0
  prefetching: true
  prefetchExpires: 12h
  prefetchThreshold: 5
  prefetchMaxItemsCount: 0
  cacheTimeNegative: 30m

# -- set conditional settings
conditional:
  fallbackUpstream: false
  rewrite: []
  # - in: something.com
  #   out: somethingelse.com
  mapping: []
  # - domain: something.com
  #   dnsserver: 192.168.178.1

# -- set blocking settings using Lists
blocking:
  # -- Sets the blocktype
  blockType: nxDomain
  # -- Sets the block ttl
  blockTTL: 6h
  # -- Sets the block refreshPeriod
  refreshPeriod: 4h
  # -- Sets the block download timeout
  downloadTimeout: 60s
  # -- timeout for list write to disk (each url)
  writeTimeout: 60s
  # -- timeout for reading the download (each url).
  readTimeout: 60s
  # -- timeout for reading request headers for the download (each url)
  readHeaderTimeout: 60s
  # -- Sets the block download attempt count
  downloadAttempts: 3
  # -- Sets the block download cooldown
  downloadCooldown: 5s
  # -- Sets how many list-groups can be processed at the same time
  processingConcurrency: 8
  # -- Set the start strategy (blocking | failOnError | fast)
  startStrategy: fast
  # -- Number of errors allowed in a list before it is considered invalid
  maxErrorsPerSource: 5

  # --  Add blocky whitelists
  # `default` name is reservered for TrueCharts included default whitelist
  # example shows the structure, though name should be changed when used
  whitelist:
    []
    # - name: default
    #  lists:
    #   - https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/optional-list.txt
    #   - https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt
    #   - https://raw.githubusercontent.com/rahilpathan/pihole-whitelist/main/1.LowWL.txt

  # -- Blocky blacklists
  # `default` name is reservered for TrueCharts included default blacklist
  # example shows the structure, though name should be changed when used
  blacklist:
    []
    # - name: default
    #  lists:
    #   - https://big.oisd.nl/domainswild

  # -- Blocky clientGroupsBlock
  clientGroupsBlock:
    - name: default
      groups:
        - default
        - default-ads
        - default-tracking
        - default-malicious
        - default-suspicious

# -- configure using hostsfile for lookups
# Allows for using the hosts configured in kubernetes and such
hostsFile:
  enabled: false
  sources:
    - /etc/hosts
    - https://example.com/hosts
    - |
      # inline hosts
      127.0.0.1 example.com
  hostsTTL: 1h
  filterLoopback: falsr
  loading:
    refreshPeriod: 4h
    downloads:
      timeout: 5s
      attempts: 3
      cooldown: 500ms
    concurrency: 4
    strategy: blocking
    maxErrorsPerSource: 5

podOptions:
  automountServiceAccountToken: true

serviceAccount:
  main:
    # -- Specifies whether a service account should be created
    enabled: true
    primary: true

# -- Create a ClusterRole and ClusterRoleBinding
# used by k8sgateway
rbac:
  main:
    # -- Enables or disables the ClusterRole and ClusterRoleBinding
    enabled: true
    primary: true
    clusterWide: true
    # -- Set Rules on the ClusterRole
    rules:
      # General CRDs
      - apiGroups:
          - apiextensions.k8s.io
        resources:
          - customresourcedefinitions
        verbs:
          - get
          - list
          - watch
      # Ingress
      - apiGroups:
          - extensions
          - networking.k8s.io
        resources:
          - ingresses
        verbs:
          - list
          - watch
      # Service
      - apiGroups:
          - ""
        resources:
          - services
          - namespaces
        verbs:
          - list
          - watch
      # HTTPRoute, TLSRoute, GRPCRoute
      - apiGroups:
          - gateway.networking.k8s.io
        resources:
          - "*"
        verbs:
          - watch
          - list
      # DNSEndpoint
      - apiGroups:
          - externaldns.k8s.io
        resources:
          - dnsendpoints
        verbs:
          - get
          - watch
          - list
      - apiGroups:
          - externaldns.k8s.io
        resources:
          - dnsendpoints/status
        verbs:
          - "*"

k8sgateway:
  enabled: true
  # -- TTL for non-apex responses (in seconds)
  ttl: 300
  # -- Limit what kind of resources to watch, e.g. watchedResources: [ Ingress | Service | HTTPRoute | TLSRoute | GRPCRoute | DNSEndpoint ]
  watchedResources:
    - Ingress
    - Service
    - HTTPRoute
  # -- Service name of a secondary DNS server (should be `serviceName.namespace`)
  secondary: ""
  # -- Override the default `serviceName.namespace` domain apex
  apex: ""
  # -- list of processed domains
  domains: []
  # -- Delegated domain
  # - domain: "example.com"
  #   # -- Optional configuration option for DNS01 challenge that will redirect all acme
  #   # challenge requests to external cloud domain (e.g. managed by cert-manager)
  #   # See: https://cert-manager.io/docs/configuration/acme/dns01/
  #   dnsChallenge:
  #     enabled: false
  #     domain: dns01.clouddns.com
  forward:
    enabled: false
    primary: tls://1.1.1.1
    secondary: tls://1.0.0.1
    options:
      - name: tls_servername
        value: cloudflare-dns.com

configmap:
  dashboard:
    enabled: true
    labels:
      grafana_dashboard: "1"
    data:
      blocky.json: >-
        {{ .Files.Get "dashboard.json" | indent 8 }}
      blockypostgres.json: >-
        {{ .Files.Get "dashboardpsql.json" | indent 8 }}
  datasource:
    enabled: true
    labels:
      grafana_datasource: "1"
    data:
      datasourceblockypsql.yaml: |-
        apiVersion: 1
        datasources:
        - name: BlockyPostgres
          type: postgres
          uid: blockypostgres
          url: {{ printf "%s.%s:5432" (.Values.cnpg.main.creds.host | trimAll "\"") .Release.Namespace }}
          access: proxy
          user: {{ .Values.cnpg.main.user }}
          secureJsonData:
            password: {{ .Values.cnpg.main.creds.password | default "na" }}
          jsonData:
            database: {{ .Values.cnpg.main.database }}
            sslmode: 'disable' # disable/require/verify-ca/verify-full
            maxOpenConns: 100 # Grafana v5.4+
            maxIdleConns: 100 # Grafana v5.4+
            maxIdleConnsAuto: true # Grafana v9.5.1+
            connMaxLifetime: 14400 # Grafana v5.4+
            postgresVersion: 1500 # 903=9.3, 904=9.4, 905=9.5, 906=9.6, 1000=10
            timescaledb: false

metrics:
  main:
    # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
    # @default -- See values.yaml
    enabled: true
    type: "servicemonitor"
    endpoints:
      - port: main
        path: /metrics
    # -- Enable and configure Prometheus Rules for the chart under this key.
    # @default -- See values.yaml
    prometheusRule:
      enabled: false
      labels: {}
      # -- Configure additionial rules for the chart under this key.
      # @default -- See prometheusrules.yaml
      rules: []
      # - alert: UnifiPollerAbsent
      #   annotations:
      #     description: Unifi Poller has disappeared from Prometheus service discovery.
      #     summary: Unifi Poller is down.
      #   expr: |
      #     absent(up{job=~".*unifi-poller.*"} == 1)
      #   for: 5m
      #   labels:
      #     severity: critical

redis:
  enabled: true

queryLog:
  # optional one of: mysql, postgresql, csv, csv-client. If empty, log to console
  type: "postgresql"
  # directory (should be mounted as volume in docker) for csv, db connection string for mysql, ignored for included postgresql
  # target: /var/log/something
  # postgresql target: postgres://user:password@db_host_or_ip:5432/db_name
  # if > 0, deletes log files which are older than ... days
  logRetentionDays: 0
  # optional: Max attempts to create specific query log writer, default: 3
  creationAttempts: 3
  # optional: Time between the creation attempts, default: 2s
  creationCooldown: 2s

cnpg:
  main:
    enabled: true
    user: blocky
    database: blocky