diff options
Diffstat (limited to 'etc/config.cluster')
| -rw-r--r-- | etc/config.cluster | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/etc/config.cluster b/etc/config.cluster new file mode 100644 index 0000000..8647587 --- /dev/null +++ b/etc/config.cluster @@ -0,0 +1,40 @@ +-- Config file example useable for larger resolver farms +-- In this case cache should be made as large as possible, and prefetching turned off +-- as the resolver is busy most of the time. +-- Alternative is using `etcd` as a configuration backend. +-- Refer to manual: https://knot-resolver.readthedocs.io/en/latest/daemon.html#configuration + +-- Listen on localhost and external interface +net = { '127.0.0.1', '::1', '192.168.1.1' } + +-- Drop root privileges +user('knot-resolver', 'knot-resolver') + +-- Auto-maintain root TA +trust_anchors.file = 'root.keys' + +-- Large cache size, so we don't need to flush ever +-- This can be larger than available RAM, least frequently accessed +-- records will be paged out as long as there's enough disk space to back it +cache.size = 100 * GB + +-- Load Useful modules +modules = { + 'hints > iterate', -- Load /etc/hosts and allow custom root hints + 'stats', -- Track internal statistics + graphite = { -- Send statistics to local InfluxDB + -- `worker.id` allows us to keep per-fork statistics + prefix = hostname()..worker.id, + -- Address of the Graphite/InfluxDB server + host = '192.168.1.2', + }, +} + +-- Use local root server copy for performance reasons +hints.root({ + ['j.root-servers.net.'] = { '192.168.1.4', '2001:503:c27::2:30', '192.58.128.30' } +}) + +-- Apply RPZ for all clients, default rule is DENY +policy.add(policy.rpz(policy.DENY, 'blacklist.rpz')) + |