doh-server.sample.conf

# DNS over HTTPS server configuration.
#
# This file is a template.  It is processed with envsubst when the container
# starts, so every "${VARIABLE}" placeholder is replaced by the matching
# environment variable.  The template is owned by the image; to use a custom
# configuration mount your own file on /server/doh-server.conf and it will be
# used as is (no substitution is applied to it).
#
# The supported options are defined by the upstream project:
#   https://github.com/m13253/dns-over-https/blob/master/doh-server/config.go
# Unknown options make the upstream server refuse to start.

# HTTP listen port
#listen = [
#
#    "127.0.0.1:8053",
#    "[::1]:8053",
#
#    ## To listen on both 0.0.0.0:8053 and [::]:8053, use the following line
#    # ":8053",
#]
listen = [ "${DOH_SERVER_LISTEN}" ]

# Local address and port for upstream DNS
# If left empty, a local address is automatically chosen.
local_addr = "${DOH_SERVER_LOCAL_ADDR}"

# TLS certification file
# If left empty, plain-text HTTP will be used.
# You are recommended to leave empty and to use a server load balancer (e.g.
# Caddy, Nginx) and set up TLS there, because this program does not do OCSP
# Stapling, which is necessary for client bootstrapping in a network
# environment with completely no traditional DNS service.
# The certificate and the key have to be set together.
cert = "${DOH_SERVER_CERT}"

# TLS private key file
# If left empty, plain-text HTTP will be used.
# The certificate and the key have to be set together.
key = "${DOH_SERVER_KEY}"

# Require the clients to present a certificate that is signed by the
# certificate authority below. The authority is only read when the client
# authentication is enabled.
tls_client_auth = ${DOH_SERVER_TLS_CLIENT_AUTH}

# Certificate authority that signs the certificates of the clients
tls_client_auth_ca = "${DOH_SERVER_TLS_CLIENT_AUTH_CA}"

# HTTP path for resolve application
# Multiple paths can be served at the same time, they are given as a comma
# separated list. The first one is the primary path, the others are aliases.
path = "${doh_http_paths}"

# Upstream DNS resolver
# If multiple servers are specified, a random one will be chosen each time.
# You can use "udp", "tcp" or "tcp-tls" for the type prefix.
# For "udp", UDP will first be used, and switch to TCP when the server asks to
# or the response is too large.
# For "tcp", only TCP will be used.
# For "tcp-tls", DNS-over-TLS (RFC 7858) will be used to secure the upstream connection.
# upstream = [
#     "udp:1.1.1.1:53",
#     "udp:1.0.0.1:53",
#     "udp:8.8.8.8:53",
#     "udp:8.8.4.4:53",
# ]
upstream = ${upstream_servers}

# Upstream timeout
# timeout = 10
timeout = ${DOH_SERVER_TIMEOUT}

# Number of tries if upstream DNS fails
# tries = 3
tries = ${DOH_SERVER_TRIES}

# Enable logging
# verbose = false
verbose = ${DOH_SERVER_VERBOSE}

# Enable log IP from HTTPS-reverse proxy header: X-Forwarded-For or X-Real-IP
# Note: http uri/useragent log cannot be controlled by this config
log_guessed_client_ip = ${DOH_SERVER_LOG_GUESSED_CLIENT_IP}

# By default, non global IP addresses are never forwarded to upstream servers.
# This is to prevent two things from happening:
#   1. the upstream server knowing your private LAN addresses;
#   2. the upstream server unable to provide geographically near results,
#      or even fail to provide any result.
# However, if you are deploying a split tunnel corporation network environment,
# or for any other reason you want to inhibit this behavior, change the following
# option to "true".
ecs_allow_non_global_ip = ${DOH_SERVER_ECS_ALLOW_NON_GLOBAL_IP}

# If ECS is added to the request, let the full IP address or
# cap it to 24 or 128 mask. This option is to be used only on private
# networks where knwoledge of the terminal endpoint may be required for
# security purposes (eg. DNS Firewalling). Not a good option on the
# internet where IP address may be used to identify the user and
# not only the approximate location.
ecs_use_precise_ip = ${DOH_SERVER_ECS_USE_PRECISE_IP}