DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases 1 Wiki Activity
Files
d05c0a6e7120043adc3fb9a6e0731f5a5e8f5b8b
truecharts/charts/stable/blocky/values.yaml
T
Kjeld Schouten d05c0a6e71 port yaml-language-server logic from common2026
2026-02-14 22:35:03 +01:00

424 lines
11 KiB
YAML
Raw Blame History

# yaml-language-server: $schema=./values.schema.json
image:
repository: ghcr.io/0xerr0r/blocky
tag: v0.28.2@sha256:5f84a54e4ee950c4ab21db905b7497476ece2f4e1a376d23ab8c4855cabddcba
pullPolicy: IfNotPresent
k8sgatewayImage:
repository: ghcr.io/k8s-gateway/k8s_gateway
pullPolicy: IfNotPresent
tag: 1.6.3@sha256:d9b797ad64619dfa565fb38c147d790338c053a0a7aee1af3cf9c2ffbff3665a
workload:
main:
replicas: 2
strategy: RollingUpdate
podSpec:
containers:
main:
probes:
liveness:
enabled: false
type: exec
command:
- /app/blocky
- healthcheck
readiness:
enabled: false
type: exec
command:
- /app/blocky
- healthcheck
startup:
enabled: false
type: exec
command:
- /app/blocky
- healthcheck
# -- Blocky Config File content
blockyConfig: {}
# upstream:
# default:
# - 1.1.1.1
# -- some general blocky settings
blocky:
# -- Enable prometheus annotations
enablePrometheus: true
service:
main:
enabled: true
ports:
main:
enabled: true
port: 4000
protocol: http
targetPort: 4000
dns:
enabled: true
ports:
dns:
enabled: true
port: 53
protocol: udp
targetPort: 53
dnstcp:
enabled: true
protocol: tcp
port: "{{ .Values.service.dns.ports.dns.port }}"
targetPort: 53
dot:
enabled: true
ports:
dot:
enabled: true
port: 853
protocol: tcp
targetPort: 853
https:
enabled: true
ports:
https:
enabled: true
port: 4443
protocol: https
targetPort: 4443
k8sgateway:
enabled: true
ports:
k8sgateway:
enabled: true
port: 5353
protocol: udp
targetPort: 5353
# -- Path to cert and key file for SSL encryption. If not set, self-signed certificate will be generated
certFile: ""
keyFile: ""
# -- logging configuration
# Log level (one from trace, debug, info, warn, error)
logLevel: info
# Log format (text or json)
logFormat: text
# log timestamps (true or false)
logTimestamp: true
# Obfuscate log output (replace all alphanumeric characters with *) for user sensitive data like request domains or responses to increase privacy. (true or false)
logPrivacy: false
# -- Mininal TLS version that the DoH and DoT server will use
minTlsServeVersion: 1.2
# -- set the default DNS upstream servers
defaultUpstreams:
# Cloudflare
- 1.1.1.1
- 1.0.0.1
# Google
- 8.8.8.8
- 8.8.4.4
# Quad9
- 9.9.9.9
- 149.112.112.112
# OpenDNS
- 208.67.222.222
- 208.67.220.220
# ComodoSecure DNS
- 8.26.56.26
- 8.20.247.20
# -- set additional upstreams
upstreams:
# - name: group2
# dnsservers:
# - 1.1.1.1
# -- optional: timeout to query the upstream resolver. Default: 1s
upstreamTimeout: 1s
# -- set bootstrap dns (not needed)
# Ensures bootstrap encryption and ensure it doesn't use k8s dns
# When using an upstream specified by IP, and not by hostname, you can write only the upstream and skip ips.
bootstrapDns:
# -- Upstream
upstream: ""
# -- IP's linked to upstream DoT/DoH DNS name
ips: []
# -- set additional bootstrap dns (not needed, only used if bootstrapDns is set)
additionalBootstrapDns: []
# - upstream: ""
# ips: []
# -- Return empty answer for these queries
filtering:
# -- Ensures filtering by query type
queryTypes: []
# -- Set manual custom DNS resolution
customDNS:
customTTL: 1h
filterUnmappedTypes: true
rewrite: []
# - in: something.com
# out: somethingelse.com
mapping: []
# - domain: something.com
# dnsserver: 192.168.178.1
# -- Setup client-name lookup
clientLookup:
# -- upstream used for client-name lookup
upstream: ""
singleNameOrder: []
clients:
# - domain: laptop
# ips: []
# -- Configuration for caching of DNS responsesg
caching:
minTime: 15m
maxTime: 0m
maxItemsCount: 0
prefetching: true
prefetchExpires: 12h
prefetchThreshold: 5
prefetchMaxItemsCount: 0
cacheTimeNegative: 30m
# -- set conditional settings
conditional:
fallbackUpstream: false
rewrite: []
# - in: something.com
# out: somethingelse.com
mapping: []
# - domain: something.com
# dnsserver: 192.168.178.1
# -- set blocking settings using Lists
blocking:
# -- Sets the blocktype
blockType: nxDomain
# -- Sets the block ttl
blockTTL: 6h
# -- Sets the block refreshPeriod
refreshPeriod: 4h
# -- Sets the block download timeout
downloadTimeout: 60s
# -- timeout for list write to disk (each url)
writeTimeout: 60s
# -- timeout for reading the download (each url).
readTimeout: 60s
# -- timeout for reading request headers for the download (each url)
readHeaderTimeout: 60s
# -- Sets the block download attempt count
downloadAttempts: 3
# -- Sets the block download cooldown
downloadCooldown: 5s
# -- Sets how many list-groups can be processed at the same time
processingConcurrency: 8
# -- Set the start strategy (blocking | failOnError | fast)
startStrategy: fast
# -- Number of errors allowed in a list before it is considered invalid
maxErrorsPerSource: 5
# -- Add blocky whitelists
# `default` name is reservered for TrueCharts included default whitelist
# example shows the structure, though name should be changed when used
whitelist:
[]
# - name: default
# lists:
# - https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/optional-list.txt
# - https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt
# - https://raw.githubusercontent.com/rahilpathan/pihole-whitelist/main/1.LowWL.txt
# -- Blocky blacklists
# `default` name is reservered for TrueCharts included default blacklist
# example shows the structure, though name should be changed when used
blacklist:
[]
# - name: default
# lists:
# - https://big.oisd.nl/domainswild
# -- Blocky clientGroupsBlock
clientGroupsBlock:
- name: default
groups:
- default
- default-ads
- default-tracking
- default-malicious
- default-suspicious
# -- configure using hostsfile for lookups
# Allows for using the hosts configured in kubernetes and such
hostsFile:
enabled: false
sources:
- /etc/hosts
- https://example.com/hosts
- |
# inline hosts
127.0.0.1 example.com
hostsTTL: 1h
filterLoopback: falsr
loading:
refreshPeriod: 4h
downloads:
timeout: 5s
attempts: 3
cooldown: 500ms
concurrency: 4
strategy: blocking
maxErrorsPerSource: 5
podOptions:
automountServiceAccountToken: true
serviceAccount:
main:
# -- Specifies whether a service account should be created
enabled: true
primary: true
# -- Create a ClusterRole and ClusterRoleBinding
# @default -- See below
rbac:
main:
# -- Enables or disables the ClusterRole and ClusterRoleBinding
enabled: true
primary: true
clusterWide: true
# -- Set Rules on the ClusterRole
rules:
- apiGroups:
- ""
resources:
- services
- namespaces
verbs:
- list
- watch
- apiGroups:
- extensions
- networking.k8s.io
resources:
- ingresses
verbs:
- list
- watch
k8sgateway:
enabled: true
# -- TTL for non-apex responses (in seconds)
ttl: 300
# -- Limit what kind of resources to watch, e.g. watchedResources: ["Ingress"]
watchedResources: []
# -- Service name of a secondary DNS server (should be `serviceName.namespace`)
secondary: ""
# -- Override the default `serviceName.namespace` domain apex
apex: ""
# -- list of processed domains
domains: []
# -- Delegated domain
# - domain: "example.com"
# # -- Optional configuration option for DNS01 challenge that will redirect all acme
# # challenge requests to external cloud domain (e.g. managed by cert-manager)
# # See: https://cert-manager.io/docs/configuration/acme/dns01/
# dnsChallenge:
# enabled: false
# domain: dns01.clouddns.com
forward:
enabled: false
primary: tls://1.1.1.1
secondary: tls://1.0.0.1
options:
- name: tls_servername
value: cloudflare-dns.com
configmap:
dashboard:
enabled: true
labels:
grafana_dashboard: "1"
data:
blocky.json: >-
{{ .Files.Get "dashboard.json" | indent 8 }}
blockypostgres.json: >-
{{ .Files.Get "dashboardpsql.json" | indent 8 }}
datasource:
enabled: true
labels:
grafana_datasource: "1"
data:
datasourceblockypsql.yaml: |-
apiVersion: 1
datasources:
- name: BlockyPostgres
type: postgres
uid: blockypostgres
url: {{ printf "%s.%s:5432" (.Values.cnpg.main.creds.host | trimAll "\"") .Release.Namespace }}
access: proxy
user: {{ .Values.cnpg.main.user }}
secureJsonData:
password: {{ .Values.cnpg.main.creds.password | default "na" }}
jsonData:
database: {{ .Values.cnpg.main.database }}
sslmode: 'disable' # disable/require/verify-ca/verify-full
maxOpenConns: 100 # Grafana v5.4+
maxIdleConns: 100 # Grafana v5.4+
maxIdleConnsAuto: true # Grafana v9.5.1+
connMaxLifetime: 14400 # Grafana v5.4+
postgresVersion: 1500 # 903=9.3, 904=9.4, 905=9.5, 906=9.6, 1000=10
timescaledb: false
metrics:
main:
# -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
# @default -- See values.yaml
enabled: true
type: "servicemonitor"
endpoints:
- port: main
path: /metrics
# -- Enable and configure Prometheus Rules for the chart under this key.
# @default -- See values.yaml
prometheusRule:
enabled: false
labels: {}
# -- Configure additionial rules for the chart under this key.
# @default -- See prometheusrules.yaml
rules: []
# - alert: UnifiPollerAbsent
# annotations:
# description: Unifi Poller has disappeared from Prometheus service discovery.
# summary: Unifi Poller is down.
# expr: |
# absent(up{job=~".*unifi-poller.*"} == 1)
# for: 5m
# labels:
# severity: critical
redis:
enabled: true
# CANNOT be defined in above yaml section
queryLog:
# optional one of: mysql, postgresql, csv, csv-client. If empty, log to console
type: "postgresql"
# directory (should be mounted as volume in docker) for csv, db connection string for mysql, ignored for included postgresql
# target: /var/log/something
# postgresql target: postgres://user:password@db_host_or_ip:5432/db_name
# if > 0, deletes log files which are older than ... days
logRetentionDays: 0
# optional: Max attempts to create specific query log writer, default: 3
creationAttempts: 3
# optional: Time between the creation attempts, default: 2s
creationCooldown: 2s
cnpg:
main:
enabled: true
user: blocky
database: blocky
Reference in New Issue View Git Blame Copy Permalink