DNS Resolver Infrastructure

Infrastructure Overview

• acme.sh (TLS certificate generation for haproxy)
• nsd (OpenNIC)
  • unbound (DNS Resolver)
    • dnscrypt-server (dnscrypt)
    • doh-proxy or m13253-doh
      • haproxy (DNS-over-HTTPS)
    • haproxy (DNS-over-TLS)

Getting started

Quick start**

pacman -S docker docker-compose docker-buildx
git clone https://github.com/publicarray/dns-resolver-infra.git && cd dns-resolver-infra
# Set the domain to issue TLS certificates for
echo 'DOMAIN=dns.example.com' >> .env
# Add Cloudflare credentials for acme.sh / TLS certificates
echo 'CF_TOKEN=xxxx' >> .env
echo 'CF_ACCOUNT_ID=xxxx' >> .env
echo 'CF_ZONE_ID=xxxx' >> .env

# Issue the TLS certificate first, unbound and haproxy need it to start
docker compose up -d acme
docker compose logs -f acme

./deploy.sh

Docker Compose

# Build Images or pull them:
docker compose pull

# Set the domain to issue TLS certificates for
echo 'DOMAIN=dns.example.com' >> .env
# Add Cloudflare credentials for acme.sh / TLS certificates
echo 'CF_TOKEN=xxxx' >> .env
echo 'CF_ACCOUNT_ID=xxxx' >> .env
echo 'CF_ZONE_ID=xxxx' >> .env

# # Setup CA
# docker-compose run acme --register-account -m [email protected]
# # or
# docker-compose run acme.sh --set-default-ca --server letsencrypt

# Issue the TLS certificate first, unbound and haproxy need it to start
docker compose up -d acme
docker compose logs -f acme

# Launch
docker compose up -d

sysctl

sysctl net.ipv4.tcp_congestion_control=bbr

Tests

# uses npm, curl and openssl, or a docker container when npm is missing
./test.sh
# force the docker container
TEST_WITH_DOCKER=1 ./test.sh
# human-readable check with doggo
./test-doggo.sh
# lint the Dockerfiles
./lint.sh