From 45d6379135504814ab723b57f0eb8be23393a51d Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 27 Apr 2024 09:24:22 +0200 Subject: Adding upstream version 1:9.16.44. Signed-off-by: Daniel Baumann --- contrib/dnspriv/README.md | 23 +++++++++++++++++++++++ contrib/dnspriv/named.conf | 20 ++++++++++++++++++++ contrib/dnspriv/nginx.conf | 43 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 86 insertions(+) create mode 100644 contrib/dnspriv/README.md create mode 100644 contrib/dnspriv/named.conf create mode 100644 contrib/dnspriv/nginx.conf (limited to 'contrib/dnspriv') diff --git a/contrib/dnspriv/README.md b/contrib/dnspriv/README.md new file mode 100644 index 0000000..8fa6795 --- /dev/null +++ b/contrib/dnspriv/README.md @@ -0,0 +1,23 @@ + +### DNS Privacy in BIND + +This directory contains sample configuration files to enable BIND, +with Nginx as a TLS proxy, to provide DNS over TLS. + +`named.conf` configures a validating recursive name server to listen +on the localhost address at port 8853. + +`nginx.conf` configures a TLS proxy to listen on port 853 and +forward queries and responses to `named`. + +For more information, please see +[https://dnsprivacy.org/wiki/](https://dnsprivacy.org/wiki/) diff --git a/contrib/dnspriv/named.conf b/contrib/dnspriv/named.conf new file mode 100644 index 0000000..e5ab3cd --- /dev/null +++ b/contrib/dnspriv/named.conf @@ -0,0 +1,20 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + listen-on port 8853 { 127.0.0.1; }; + allow-query { localhost; }; + recursion yes; + dnssec-validation auto; + tcp-clients 1024; +}; diff --git a/contrib/dnspriv/nginx.conf b/contrib/dnspriv/nginx.conf new file mode 100644 index 0000000..83f2a88 --- /dev/null +++ b/contrib/dnspriv/nginx.conf @@ -0,0 +1,43 @@ +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# uncomment to choose an appropriate UID/GID; default is 'nobody' +# user bind bind; + +worker_processes auto; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; + multi_accept on; +} + +stream { + upstream dns_tcp_servers { + server 127.0.0.1:8853; + } + + server { + listen 853 ssl; + proxy_pass dns_tcp_servers; + + # update to a suitable SSL certificate (e.g. from LetsEncrypt), + # and uncomment the following lines: + # ssl_certificate /etc/nginx/lego/certificates/.crt; + # ssl_certificate_key /etc/nginx/lego/certificates/.key; + + ssl_protocols TLSv1.2; + ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_session_tickets on; + ssl_session_timeout 4h; + ssl_handshake_timeout 30s; + } +} -- cgit v1.2.3