Github messages for voidlinux
 help / color / mirror / Atom feed
* [PR PATCH] New package: encrypted-dns
@ 2023-08-02  5:14 MeganerdNL
  2023-08-02  5:28 ` [PR REVIEW] " classabbyamp
                   ` (51 more replies)
  0 siblings, 52 replies; 53+ messages in thread
From: MeganerdNL @ 2023-08-02  5:14 UTC (permalink / raw)
  To: ml

[-- Attachment #1: Type: text/plain, Size: 986 bytes --]

There is a new pull request by MeganerdNL against master on the void-packages repository

https://github.com/MeganerdNL/void-packages encrypted-dns
https://github.com/void-linux/void-packages/pull/45381

New package: encrypted-dns
**DNSCrypt v2 server with support for DNSSEC, DoH forwarding and anonymized DNSCrypt**

#### Testing the changes
- I tested the changes in this PR: **YES**

#### New package
- This new package conforms to the [package requirements](https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#package-requirements): **YES**

#### Local build testing
- I built this PR locally for my native architecture, (x86_64-glibc)
- I built this PR locally for these architectures (if supported. mark crossbuilds):
  - x86_64-musl
  - i686-glibc
  - aarch64-glibc
  - aarch64-musl
  - armv7l-glibc
  - armv7l-musl
  - armv6l-glibc
  - armv6l-musl

A patch file from https://github.com/void-linux/void-packages/pull/45381.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-encrypted-dns-45381.patch --]
[-- Type: text/x-diff, Size: 9097 bytes --]

From eca3ef8203d95e1cac1bbb6166dfe317d01564c3 Mon Sep 17 00:00:00 2001
From: MeganerdNL <meganerd@meganerd.nl>
Date: Sun, 30 Jul 2023 13:40:26 +0200
Subject: [PATCH] New package: encrypted-dns

---
 srcpkgs/encrypted-dns/INSTALL                 |  10 +
 .../encrypted-dns/files/encrypted-dns.toml    | 255 ++++++++++++++++++
 srcpkgs/encrypted-dns/files/encrypted-dns/run |   3 +
 .../encrypted-dns/patches/cargo-lock.patch    |  11 +
 srcpkgs/encrypted-dns/template                |  38 +++
 5 files changed, 317 insertions(+)
 create mode 100644 srcpkgs/encrypted-dns/INSTALL
 create mode 100644 srcpkgs/encrypted-dns/files/encrypted-dns.toml
 create mode 100755 srcpkgs/encrypted-dns/files/encrypted-dns/run
 create mode 100644 srcpkgs/encrypted-dns/patches/cargo-lock.patch
 create mode 100644 srcpkgs/encrypted-dns/template

diff --git a/srcpkgs/encrypted-dns/INSTALL b/srcpkgs/encrypted-dns/INSTALL
new file mode 100644
index 000000000000..5dda7e1e618a
--- /dev/null
+++ b/srcpkgs/encrypted-dns/INSTALL
@@ -0,0 +1,10 @@
+case "$ACTION" in
+    post)
+        if [ "$UPDATE" = "yes" ] ; then
+            :
+        else
+            chown _encrypted_dns:_encrypted_dns var/lib/encrypted-dns
+            chmod 750 var/lib/encrypted-dns
+        fi
+        ;;
+esac
diff --git a/srcpkgs/encrypted-dns/files/encrypted-dns.toml b/srcpkgs/encrypted-dns/files/encrypted-dns.toml
new file mode 100644
index 000000000000..063e776b4833
--- /dev/null
+++ b/srcpkgs/encrypted-dns/files/encrypted-dns.toml
@@ -0,0 +1,255 @@
+####################################################
+#                                                  #
+#        Encrypted DNS Server configuration        #
+#                                                  #
+####################################################
+
+
+
+##################################
+#         Global settings        #
+##################################
+
+
+## IP addresses and ports to listen to, as well as their external IP
+## If there is no NAT involved, `local` and `external` can be the same.
+## As many addresses as needed can be configured here, IPv4 and/or IPv6.
+## You should at least change the `external` IP address.
+
+### Example with both IPv4 and IPv6 addresses:
+# listen_addrs = [
+#     { local = "0.0.0.0:443",    external = "198.51.100.1:443" },
+#     { local = "[::]:443",       external = "[2001:db8::1]:443" }
+# ]
+
+listen_addrs = [
+    { local = "0.0.0.0:443",    external = "198.51.100.1:443" }
+]
+
+
+## Upstream DNS server and port
+
+upstream_addr = "9.9.9.9:53"
+
+
+## File name to save the state to
+
+state_file = "/var/lib/encrypted-dns/encrypted-dns.state"
+
+
+## UDP timeout in seconds
+
+udp_timeout = 10
+
+
+## TCP timeout in seconds
+
+tcp_timeout = 10
+
+
+## Maximum active UDP sockets
+
+udp_max_active_connections = 1000
+
+
+## Maximum active TCP connections
+
+tcp_max_active_connections = 250
+
+
+## Optional IP address to connect to upstream servers from.
+## Leave commented/undefined to automatically select it.
+
+# external_addr = "0.0.0.0"
+
+
+## Built-in DNS cache capacity
+
+cache_capacity = 100000
+
+
+## DNS cache: minimum TTL
+
+cache_ttl_min = 3600
+
+
+## DNS cache: max TTL
+
+cache_ttl_max = 86400
+
+
+## DNS cache: error TTL
+
+cache_ttl_error = 600
+
+
+## DNS cache: to avoid bursts of traffic for popular queries when an
+## RRSET expires, hold a TTL received from an upstream server for
+## `client_ttl_holdon` seconds before decreasing it in client responses.
+
+client_ttl_holdon = 60
+
+
+## Run as a background process
+
+daemonize = false
+
+
+## Log file, when running as a background process
+
+# log_file = "/tmp/encrypted-dns.log"
+
+
+## PID file
+
+# pid_file = "/tmp/encrypted-dns.pid"
+
+
+## User name to drop privileges to, when started as root.
+
+user = "_encrypted_dns"
+
+
+## Group name to drop privileges to, when started as root.
+
+group = "_encrypted_dns"
+
+
+## Path to chroot() to, when started as root.
+## The path to the state file is relative to the chroot base.
+
+# chroot = "/var/empty"
+
+
+## Queries sent to that name will return the client IP address.
+## This can be very useful for debugging, or to check that relaying works.
+
+# my_ip = "my.ip"
+
+
+####################################
+#         DNSCrypt settings        #
+####################################
+
+[dnscrypt]
+
+## Provider name (with or without the `2.dnscrypt-cert.` prefix)
+
+provider_name = "secure.dns.test"
+
+
+## Does the server support DNSSEC?
+
+dnssec = true
+
+
+## Does the server always returns correct answers (no filtering, including ad blocking)?
+
+no_filters = true
+
+
+## Set to `true` if the server doesn't keep any information that can be used to identify users
+
+no_logs = true
+
+
+## Key cache capacity, per certificate
+
+key_cache_capacity = 10000
+
+
+
+###############################
+#         TLS settings        #
+###############################
+
+[tls]
+
+## Where to proxy TLS connections to (e.g. DoH server)
+
+# upstream_addr = "127.0.0.1:4343"
+
+
+
+#######################################
+#        Server-side filtering        #
+#######################################
+
+[filtering]
+
+## List of domains to block, one per line
+
+# domain_blacklist = "/etc/domain_blacklist.txt"
+
+
+## List of undelegated TLDs
+## This is the list of nonexistent TLDs that queries are frequently observed for,
+## but will never resolve to anything. The server will immediately return a
+## synthesized NXDOMAIN response instead of hitting root servers.
+
+undelegated_list = "/var/lib/encrypted-dns/undelegated.txt"
+
+
+## Ignore A and AAAA queries for unqualified host names.
+
+ignore_unqualified_hostnames = true
+
+
+
+#########################
+#        Metrics        #
+#########################
+
+# [metrics]
+
+# type = "prometheus"
+# listen_addr = "0.0.0.0:9100"
+# path = "/metrics"
+
+
+
+################################
+#        Anonymized DNS        #
+################################
+
+[anonymized_dns]
+
+# Enable relaying support for Anonymized DNS
+
+enabled = false
+
+
+# Allowed upstream ports
+# This is a list of commonly used ports for encrypted DNS services
+
+allowed_ports = [ 443, 553, 853, 1443, 2053, 4343, 4434, 4443, 5353, 5443, 8443, 15353 ]
+
+
+# Allow all ports >= 1024 in addition to the list above
+
+allow_non_reserved_ports = false
+
+
+# Blacklisted upstream IP addresses
+
+blacklisted_ips = [ ]
+
+
+
+
+################################
+#        Access control        #
+################################
+
+[access_control]
+
+# Enable access control
+
+enabled = false
+
+# Only allow access to client queries including one of these random tokens
+# Tokens can be configured in the `query_meta` section of `dnscrypt-proxy` as
+# `query_meta = ["token:..."]` -- Replace ... with the token to use by the client.
+# Example: `query_meta = ["token:Y2oHkDJNHz"]`
+
+tokens = ["Y2oHkDJNHz", "G5zY3J5cHQtY", "C5zZWN1cmUuZG5z"]
diff --git a/srcpkgs/encrypted-dns/files/encrypted-dns/run b/srcpkgs/encrypted-dns/files/encrypted-dns/run
new file mode 100755
index 000000000000..9bdff1794f55
--- /dev/null
+++ b/srcpkgs/encrypted-dns/files/encrypted-dns/run
@@ -0,0 +1,3 @@
+#!/bin/sh
+exec 2>&1
+exec encrypted-dns -c /etc/encrypted-dns/encrypted-dns.toml
diff --git a/srcpkgs/encrypted-dns/patches/cargo-lock.patch b/srcpkgs/encrypted-dns/patches/cargo-lock.patch
new file mode 100644
index 000000000000..43092c2697e8
--- /dev/null
+++ b/srcpkgs/encrypted-dns/patches/cargo-lock.patch
@@ -0,0 +1,11 @@
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -226,7 +226,7 @@
+ 
+ [[package]]
+ name = "encrypted-dns"
+-version = "0.9.12"
++version = "0.9.13"
+ dependencies = [
+  "anyhow",
+  "byteorder",
diff --git a/srcpkgs/encrypted-dns/template b/srcpkgs/encrypted-dns/template
new file mode 100644
index 000000000000..edaa5d8ec586
--- /dev/null
+++ b/srcpkgs/encrypted-dns/template
@@ -0,0 +1,38 @@
+# Template file for 'encrypted-dns'
+pkgname=encrypted-dns
+version=0.9.13
+revision=1
+build_style=cargo
+makedepends="libsodium-devel"
+short_desc="DNSCrypt v2 server with support for DNSSEC and DoH forwarding"
+maintainer="MeganerdNL <meganerd@meganerd.nl>"
+license="MIT"
+homepage="https://github.com/DNSCrypt/encrypted-dns-server"
+distfiles="https://github.com/DNSCrypt/encrypted-dns-server/archive/refs/tags/${version}.tar.gz"
+checksum=5e4f9143313bf58888c31ec4e220e9fb65b28b60fe5b6aff872f9f2ecb7537d5
+
+system_accounts="_encrypted_dns"
+_encrypted_dns_homedir="/var/lib/encrypted-dns"
+
+conf_files="/etc/encrypted-dns/encrypted-dns.toml"
+
+mutable_files="/var/lib/encrypted-dns/undelegated.txt"
+
+if [ "$XBPS_TARGET_NO_ATOMIC8" ]; then
+	XBPS_CROSS_RUSTFLAGS+=" -latomic"
+	makedepends+=" libatomic-devel"
+fi
+
+case "$XBPS_TARGET_MACHINE" in
+	*-musl) makedepends+=" musl-devel libstdc++";;
+esac
+
+post_install() {
+	vlicense LICENSE
+
+	# Install config file and list of undelegated TLDs
+	vinstall ${FILESDIR}/encrypted-dns.toml 0644 etc/encrypted-dns encrypted-dns.toml
+	vinstall undelegated.txt 0644 var/lib/encrypted-dns undelegated.txt
+
+	vsv encrypted-dns
+}

^ permalink raw reply	[flat|nested] 53+ messages in thread
end of thread, other threads:[~2023-12-30  1:45 UTC | newest]

Thread overview: 53+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-02  5:14 [PR PATCH] New package: encrypted-dns MeganerdNL
2023-08-02  5:28 ` [PR REVIEW] " classabbyamp
2023-08-02  5:28 ` classabbyamp
2023-08-02  5:28 ` classabbyamp
2023-08-02  5:28 ` classabbyamp
2023-08-02  5:28 ` classabbyamp
2023-08-02  5:28 ` classabbyamp
2023-08-02  5:35 ` MeganerdNL
2023-08-02 12:15 ` MeganerdNL
2023-08-02 12:16 ` MeganerdNL
2023-08-04  7:48 ` MeganerdNL
2023-08-04  9:33 ` [PR PATCH] [Updated] " MeganerdNL
2023-08-04  9:37 ` MeganerdNL
2023-08-04  9:40 ` [PR REVIEW] " MeganerdNL
2023-08-04  9:41 ` MeganerdNL
2023-08-04  9:41 ` MeganerdNL
2023-08-04  9:41 ` MeganerdNL
2023-08-04  9:42 ` MeganerdNL
2023-08-04  9:43 ` [PR PATCH] [Updated] " MeganerdNL
2023-08-04  9:59 ` MeganerdNL
2023-08-04 12:58 ` [PR REVIEW] " classabbyamp
2023-08-04 12:58 ` classabbyamp
2023-08-04 12:58 ` classabbyamp
2023-08-04 12:58 ` classabbyamp
2023-08-04 12:58 ` classabbyamp
2023-08-04 18:08 ` [PR PATCH] [Updated] " MeganerdNL
2023-08-04 18:17 ` MeganerdNL
2023-08-04 18:18 ` MeganerdNL
2023-08-04 18:22 ` MeganerdNL
2023-08-04 18:29 ` MeganerdNL
2023-08-04 18:41 ` MeganerdNL
2023-08-04 18:51 ` [PR REVIEW] " classabbyamp
2023-08-04 18:57 ` MeganerdNL
2023-08-04 19:01 ` [PR REVIEW] " MeganerdNL
2023-08-04 19:01 ` MeganerdNL
2023-08-04 19:20 ` classabbyamp
2023-08-04 20:52 ` MeganerdNL
2023-08-11  8:52 ` [PR PATCH] [Updated] " MeganerdNL
2023-08-11  8:53 ` MeganerdNL
2023-09-02 15:27 ` MeganerdNL
2023-09-02 15:31 ` MeganerdNL
2023-09-02 18:09 ` Duncaen
2023-09-02 19:12 ` MeganerdNL
2023-09-02 19:53 ` Duncaen
2023-09-02 22:11 ` MeganerdNL
2023-09-03 11:26 ` Duncaen
2023-09-03 11:26 ` Duncaen
2023-09-03 20:47 ` [PR PATCH] [Updated] " MeganerdNL
2023-09-03 20:57 ` MeganerdNL
2023-09-03 20:58 ` MeganerdNL
2023-09-15 10:08 ` [PR PATCH] [Updated] " MeganerdNL
2023-12-15  1:46 ` github-actions
2023-12-30  1:45 ` [PR PATCH] [Closed]: " github-actions

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).