diff options
Diffstat (limited to 'etc/config/config.cluster')
| -rw-r--r-- | etc/config/config.cluster | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/etc/config/config.cluster b/etc/config/config.cluster new file mode 100644 index 0000000..3bd12dd --- /dev/null +++ b/etc/config/config.cluster @@ -0,0 +1,36 @@ +-- SPDX-License-Identifier: CC0-1.0 +-- vim:syntax=lua:set ts=4 sw=4: +-- Config file example useable for larger resolver farms +-- In this case cache should be made as large as possible, and prefetching turned off +-- as the resolver is busy most of the time. +-- Alternative is using `etcd` as a configuration backend. +-- Refer to manual: https://knot-resolver.readthedocs.io/en/stable/ + +-- Network interface configuration +net.listen('127.0.0.1', 53, { kind = 'dns' }) +net.listen('::1', 53, { kind = 'dns'}) +net.listen('127.0.0.1', 853, { kind = 'tls' }) +net.listen('::1', 853, { kind = 'tls' }) +net.listen('127.0.0.1', 443, { kind = 'doh2' }) +net.listen('::1', 443, { kind = 'doh2'}) + +-- Refer to manual for optimal cache size +cache.size = 16 * GB + +-- Load Useful modules +modules = { + 'hints > iterate', -- Allow loading /etc/hosts or custom root hints + 'stats', -- Track internal statistics + graphite = { -- Send statistics to local InfluxDB + -- Address of the Graphite/InfluxDB server + host = '192.168.1.2', + }, +} + +-- Use local root server copy for performance reasons +hints.root({ + ['j.root-servers.net.'] = { '192.168.1.4', '2001:503:c27::2:30', '192.58.128.30' } +}) + +-- Apply RPZ for all clients, default rule is DENY +policy.add(policy.rpz(policy.DENY, 'blacklist.rpz')) |