diff options
Diffstat (limited to '')
| -rw-r--r-- | doc/kresd.8.in | 122 |
1 files changed, 122 insertions, 0 deletions
diff --git a/doc/kresd.8.in b/doc/kresd.8.in new file mode 100644 index 0000000..b052a5a --- /dev/null +++ b/doc/kresd.8.in @@ -0,0 +1,122 @@ +.TH "kresd" "8" "@date@" "CZ.NIC" "Knot Resolver @version@" +.\" +.\" kresd.8 -- kresd daemon manpage +.\" +.\" Copyright (c) CZ.NIC. All rights reserved. +.\" +.\" SPDX-License-Identifier: GPL-3.0-or-later +.\" +.\" +.SH "NAME" +.B kresd +\- full caching DNSSEC-enabled Knot Resolver @version@. +.SH "SYNOPSIS" +.B kresd +.RB [ \-a | \-\-addr +.IR addr[@port] ] +.RB [ \-t | \-\-tls +.IR addr[@port] ] +.RB [ \-S | \-\-fd +.IR fd ] +.RB [ \-T | \-\-tlsfd +.IR fd ] +.RB [ \-c | \-\-config +.IR config ] +.RB [ \-n | \-\-noninteractive ] +.RB [ \-q | \-\-quiet ] +.RB [ \-v | \-\-verbose ] +.RB [ \-V | \-\-version ] +.RB [ \-h | \-\-help ] +.IR [rundir] +.SH "DESCRIPTION" +.B Knot Resolver is a DNSSEC-enabled full caching resolver. +.P +Default mode of operation: when it receives a DNS query it iteratively +asks authoritative nameservers starting from root zone (.) and ending +with a nameservers authoritative for queried name. Automatic DNSSEC means +verification of integrity of authoritative responses by following +keys and signatures starting from root. Root trust anchor is automatically +bootstrapped from IANA, or you can provide a file with root trust anchors +(same format as Unbound or BIND9 root keys file). + +The daemon also caches intermediate answers into cache, which by default +uses LMDB memory-mapped database. This has a significant advantage over +in-memory caches as the process may be stopped and restarted without +loss of cache entries. In multi-user scenario a shared cache +is potential privacy/security issue, with kresd each user can have resolver cache +in their private directory and use it in similar fashion to keychain. + +.P +To use a locally running +.B kresd +for resolving put +.sp +.RS 6n +nameserver 127.0.0.1 +.RE +.sp +into +.IR resolv.conf (5) +and start +.B kresd + +.P +The daemon may be configured also as a plain forwarder using query policies. +This requires using a config file. Please refer to documentation for +configuration file options. It is available at +\fIhttps://knot-resolver.readthedocs.io\fR or in package documentation +(available as knot-resolver-doc package in most distributions). + +The available CLI options are: +.TP +.B \-a\fI addr[@port]\fR, \fB\-\-addr=\fI<addr[@port]> +Listen on given address (and port) pair. If no port is given, \fI53\fR is used as a default. +Option may be passed multiple times to listen on more addresses. +.TP +.B \-t\fI addr[@port]\fR, \fB\-\-tls=\fI<addr[@port]> +Listen using TLS on given address (and port) pair. If no port is +given, \fI853\fR is used as a default. Option may be passed multiple +times to listen on more addresses. +.TP +.B \-S\fI fd\fR, \fB\-\-fd=\fI<fd> +Listen on given file descriptor(s), passed by supervisor. +Option may be passed multiple times to listen on more file descriptors. +.TP +.B \-T\fI fd\fR, \-\-tlsfd=\fI<fd> +Listen using TLS on given file descriptor(s), passed by supervisor. +Option may be passed multiple times to listen on more file descriptors. +.TP +.B \-c\fI config\fR, \fB\-\-config=\fI<config> +Set the config file with settings for kresd to read instead of reading the +file at the default location (\fIconfig\fR). +.TP +.B \-f\fI N\fR, \fB\-\-forks=\fI<N> +This option is deprecated since 5.0.0! + +With this option, the daemon is started in non-interactive mode and instead creates a +UNIX socket in \fIrundir\fR that the operator can connect to for interactive session. +A number greater than 1 forks the daemon N times, all forks will bind to same addresses +and the kernel will load-balance between them on Linux with \fISO_REUSEPORT\fR support. + +If you want multiple concurrent processes supervised in this way, +they should be supervised independently (see \fBkresd.systemd(7)\fR). +.TP +.B \-n\fR, \fB\-\-noninteractive +Daemon will refrain from entering into read-eval-print loop for stdin+stdout. +.TP +.B \-q\fR, \fB\-\-quiet +Daemon will refrain from printing the command prompt. +.TP +.B \-v\fR, \fB\-\-verbose +Increase logging to debug level. +.TP +.B \-h +Show short command-line option help. +.TP +.B \-V +Show the version. +.SH "SEE ALSO" +@man_seealso_systemd@\fIhttps://knot-resolver.readthedocs.io/en/v@version@/\fR +.SH "AUTHORS" +.B kresd +developers are mentioned in the AUTHORS file in the distribution. |