DNS¶

Encrypted DNS resolution for the host itself.

Rune: dns - Active when: mode != "none" - Default: on (Blocky)

Modes¶

Switching modes converges: dot_resolved stops and disables the Blocky services before configuring resolved.

blocky¶

• Runs the pinned Blocky binary as a dedicated blocky service user.
• Binds to listen_address (default 169.254.0.53). For a non-global, non-loopback address, a dns-internal oneshot service creates a dummy interface holding it - the resolver stays reachable regardless of external interface state. Wildcard and loopback addresses use existing interfaces.
• Renders /etc/blocky/config.yaml with DoH upstreams from the selected provider (IPv6 upstreams included only when the host has IPv6).
• Points /etc/resolv.conf directly at the Blocky address, replacing any symlink.
• Restarts Blocky only when the binary, config, or unit changed.

dot_resolved¶

• Configures /etc/systemd/resolved.conf with DoT upstreams (address#SNI form) from the selected provider.
• Links /etc/resolv.conf to the resolved stub and flushes caches on change.

Providers¶

ecs = true (EDNS Client Subnet) selects Quad9's ECS-enabled endpoints and is rejected for other providers.

Configuration (features.dns)¶

Example¶

from nullforge.models.dns import DnsMode, DnsProvider
from nullforge.molds import DnsMold

dns = DnsMold(mode=DnsMode.BLOCKY, upstream_provider=DnsProvider.QUAD9, ecs=True)