From 1060d74b26eb8207dd2e3c12b9a7af260a344011 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Jochum?= Date: Thu, 13 Aug 2026 10:24:50 +0200 Subject: [PATCH 1/3] feat(examples): update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: René Jochum --- docs | 2 +- examples/README.md | 5 +- examples/caddy/.env | 9 +- examples/caddy/caddy/Caddyfile | 65 ----------- examples/caddy/compose.incus.yaml | 18 ++- examples/caddy/compose.yaml | 32 +++++- examples/caddy/external/Caddyfile | 45 ++++++++ examples/caddy/internal/Caddyfile | 66 +++++++++++ examples/dns/.env | 8 -- examples/dns/compose.incus.yaml | 25 ---- examples/dns/compose.yaml | 32 ------ .../dns/dnscrypt-proxy/forwarding-rules.txt | 2 - examples/dns/knot/config/knot.conf | 24 ---- .../dns/knot/storage/10.in-addr.arpa.zone | 5 - examples/dns/knot/storage/example.com.zone | 9 -- examples/pdns-dnsweaver/.env.sample | 30 ----- .../dnscrypt-proxy/cloaking-rules.txt | 1 - .../dnscrypt-proxy/dnscrypt-proxy.toml | 107 ------------------ .../dnscrypt-proxy/whitelist.txt | 1 - examples/pdns/.env.sample | 21 ++++ examples/{pdns-dnsweaver => pdns}/.gitignore | 2 - .../compose.incus.yaml | 11 +- .../{pdns-dnsweaver => pdns}/compose.yaml | 61 ---------- .../dnscrypt-proxy/cloaking-rules.txt | 0 .../dnscrypt-proxy/dnscrypt-proxy.toml | 0 .../forwarding-rules.txt.template | 2 +- .../dnscrypt-proxy/whitelist.txt | 0 examples/{pdns-dnsweaver => pdns}/install.sh | 30 ++--- .../pdns/pdns.conf.template | 0 29 files changed, 199 insertions(+), 414 deletions(-) delete mode 100644 examples/caddy/caddy/Caddyfile create mode 100644 examples/caddy/external/Caddyfile create mode 100644 examples/caddy/internal/Caddyfile delete mode 100644 examples/dns/.env delete mode 100644 examples/dns/compose.incus.yaml delete mode 100644 examples/dns/compose.yaml delete mode 100644 examples/dns/dnscrypt-proxy/forwarding-rules.txt delete mode 100644 examples/dns/knot/config/knot.conf delete mode 100644 examples/dns/knot/storage/10.in-addr.arpa.zone delete mode 100644 examples/dns/knot/storage/example.com.zone delete mode 100644 examples/pdns-dnsweaver/.env.sample delete mode 100644 examples/pdns-dnsweaver/dnscrypt-proxy/cloaking-rules.txt delete mode 100644 examples/pdns-dnsweaver/dnscrypt-proxy/dnscrypt-proxy.toml delete mode 100644 examples/pdns-dnsweaver/dnscrypt-proxy/whitelist.txt create mode 100644 examples/pdns/.env.sample rename examples/{pdns-dnsweaver => pdns}/.gitignore (73%) rename examples/{pdns-dnsweaver => pdns}/compose.incus.yaml (63%) rename examples/{pdns-dnsweaver => pdns}/compose.yaml (55%) rename examples/{dns => pdns}/dnscrypt-proxy/cloaking-rules.txt (100%) rename examples/{dns => pdns}/dnscrypt-proxy/dnscrypt-proxy.toml (100%) rename examples/{pdns-dnsweaver => pdns}/dnscrypt-proxy/forwarding-rules.txt.template (50%) rename examples/{dns => pdns}/dnscrypt-proxy/whitelist.txt (100%) rename examples/{pdns-dnsweaver => pdns}/install.sh (65%) rename examples/{pdns-dnsweaver => pdns}/pdns/pdns.conf.template (100%) diff --git a/docs b/docs index 74cad0b1..e7d62868 160000 --- a/docs +++ b/docs @@ -1 +1 @@ -Subproject commit 74cad0b1301d971ff8bb469232c6dfa5999dddfc +Subproject commit e7d628685db8a0696db82756fd7409f3f6245627 diff --git a/examples/README.md b/examples/README.md index e4546fd2..7230d3a6 100644 --- a/examples/README.md +++ b/examples/README.md @@ -1,7 +1,6 @@ # Examples -- [caddy](https://docs.incus-compose.org/examples/caddy) — Caddy as a reverse-proxy front door — automatic HTTPS, one `Caddyfile`, no separate cert management. -- [dns](https://docs.incus-compose.org/examples/dns/) — A split-horizon home resolver: `dnscrypt-proxy` as the client-facing resolver, `knot` as the authoritative server for the local `example.com` zone. +- [caddy](https://docs.incus-compose.org/examples/caddy) — Caddy as a reverse-proxy front door, split in two — a host-facing instance and an internal one, sharing one certificate store. - [gitea](https://docs.incus-compose.org/examples/gitea/) — Gitea, a lightweight self-hosted Git service, backed by Postgres. - [hugo](https://docs.incus-compose.org/examples/hugo/) — Hugo is one of the most popular open-source static site generators — fast builds, no runtime dependencies. - [immich](https://docs.incus-compose.org/examples/immich/) — Immich, a self-hosted photo and video backup solution. @@ -9,6 +8,6 @@ - [leafwiki](https://docs.incus-compose.org/examples/leafwiki/) — LeafWiki — a self-hosted wiki as a single Go binary, Markdown + SQLite on disk, no external database. - [many-dependencies](many-dependencies/) — Testbed and example for a deep service dependency graph, exercising `depends_on` with `condition: service_healthy`. - [oci-registry-cache](https://docs.incus-compose.org/examples/oci-registry-cache/) — Runs distribution registry instances as pull-through caches, one per upstream registry, so container images are fetched once and served locally on subsequent pulls. -- [pdns-dnsweaver](https://docs.incus-compose.org/examples/pdns-dnsweaver/) — Combines powerDNS, powerdns-admin, dnsweaver and dnscrypt-proxy. +- [pdns](https://docs.incus-compose.org/examples/pdns/) — A split-horizon home resolver: `dnscrypt-proxy` as the client-facing resolver, PowerDNS as the authoritative server for the local zone, with PowerDNS-Admin and MariaDB behind it. - [raw-bind-mount](raw-bind-mount/) — Bind-mounting an arbitrary host path into an Incus container via `x-incus.raw.lxc`, for when a regular Compose `volumes:` bind mount isn't expressive enough. - [wikijs](https://docs.incus-compose.org/examples/wikijs/) — Wiki.js, a modern wiki app, backed by Postgres. diff --git a/examples/caddy/.env b/examples/caddy/.env index 21cfdb8c..1516deed 100644 --- a/examples/caddy/.env +++ b/examples/caddy/.env @@ -1,4 +1,9 @@ # Static IP export EXTERNAL_NETWORK="incusbr0" -export IPV4_GATEWAY="10.179.215.1" -export IPV4_CADDY="10.179.215.4/24" + +export NET_EXTERNAL="true" +export NET_NAME="incusbr0" +export IPV4_GATEWAY="10.1.2.1" +export IPV4_NETMASK="23" +export IPV4_CADDY_EXTERNAL="10.1.2.3" +export IPV4_CADDY_INTERNAL="10.1.2.4" diff --git a/examples/caddy/caddy/Caddyfile b/examples/caddy/caddy/Caddyfile deleted file mode 100644 index c66375fb..00000000 --- a/examples/caddy/caddy/Caddyfile +++ /dev/null @@ -1,65 +0,0 @@ -www.example.com { - redir https://example.com -} - -docker-registry.example.com { - log { - output file /var/log/caddy/docker-registry.example.com-access.log - } - - reverse_proxy 10.132.32.17:5000 -} - -ghcr-registry.example.com { - log { - output file /var/log/caddy/ghcr-registry.example.com-access.log - } - - reverse_proxy 10.132.32.18:5000 -} - -gitlab-registry.example.com { - log { - output file /var/log/caddy/gitlab-registry.example.com-access.log - } - - reverse_proxy 10.132.32.19:5000 -} - -immich.example.com { - log { - output file /var/log/caddy/immich.example.com-access.log - } - - reverse_proxy 10.131.32.17:2283 -} - -clock.example.com { - log { - output file /var/log/caddy/time.example.com-access.log - } - - reverse_proxy 10.137.32.17:8001 -} - -git.example.com { - log { - output file /var/log/caddy/git.example.com-access.log - } - - reverse_proxy 10.136.32.17:3000 -} - -example.com { - log { - output file /var/log/caddy/example.com-access.log - } - - root * /var/www/example.com - encode - handle_errors { - rewrite * / - file_server - } - file_server -} diff --git a/examples/caddy/compose.incus.yaml b/examples/caddy/compose.incus.yaml index af01cad8..a94512f0 100644 --- a/examples/caddy/compose.incus.yaml +++ b/examples/caddy/compose.incus.yaml @@ -1,13 +1,19 @@ services: - caddy: + external: networks: default: + ipv4_address: "${IPV4_CADDY_EXTERNAL}/${IPV4_NETMASK}" x-incus: - ipv4.address: ${IPV4_CADDY} - ipv4.gateway: ${IPV4_GATEWAY} + ipv4.gateway: "${IPV4_GATEWAY}" + + internal: + networks: + default: + ipv4_address: "${IPV4_CADDY_INTERNAL}/${IPV4_NETMASK}" + x-incus: + ipv4.gateway: "${IPV4_GATEWAY}" networks: default: - external: true - x-incus-compose: - network: ${EXTERNAL_NETWORK} + external: ${NET_EXTERNAL} + name: "${NET_NAME}" diff --git a/examples/caddy/compose.yaml b/examples/caddy/compose.yaml index 171fea99..1193aee1 100644 --- a/examples/caddy/compose.yaml +++ b/examples/caddy/compose.yaml @@ -1,11 +1,37 @@ services: - caddy: + external: + # https://hub.docker.com/_/caddy/ image: docker.io/library/caddy:2.11.4-alpine - command: /bin/sh -c "/bin/sleep 5; caddy run --config /etc/caddy/Caddyfile --adapter caddyfile" + container_name: external_caddy + entrypoint: /bin/sh -c "sleep 3; caddy run --config /etc/caddy/Caddyfile --adapter caddyfile" volumes: - - ./caddy:/etc/caddy:ro + - ./external:/etc/caddy:ro - ./sites:/var/www:ro - data:/data/caddy + networks: + default: + restart: unless-stopped + ports: + - published: 80 + target: 80 + # x-incus-compose: + # nat: true + - published: 443 + target: 443 + # x-incus-compose: + # nat: true + + internal: + image: docker.io/library/caddy:2.11.4-alpine + container_name: internal_caddy + entrypoint: /bin/sh -c "sleep 3; caddy run --config /etc/caddy/Caddyfile --adapter caddyfile" + volumes: + - ./internal:/etc/caddy:ro + - ./sites:/var/www:ro + - data:/data/caddy + networks: + default: + restart: unless-stopped volumes: data: diff --git a/examples/caddy/external/Caddyfile b/examples/caddy/external/Caddyfile new file mode 100644 index 00000000..82af0e52 --- /dev/null +++ b/examples/caddy/external/Caddyfile @@ -0,0 +1,45 @@ +{ + storage file_system /data/caddy +} + +www.example.com { + redir https://example.com +} + +docker-registry.example.com { + redir https://example.com +} + +ghcr-registry.example.com { + redir https://example.com +} + +gitlab-registry.example.com { + redir https://example.com +} + +clock.example.com { + redir https://example.com +} + +git.example.com { + log { + output file /var/log/caddy/git.example.com-access.log + } + + reverse_proxy 10.136.32.17:3000 +} + +example.com { + log { + output file /var/log/caddy/example.com-access.log + } + + root * /var/www/example.com + encode + handle_errors { + rewrite * / + file_server + } + file_server +} diff --git a/examples/caddy/internal/Caddyfile b/examples/caddy/internal/Caddyfile new file mode 100644 index 00000000..de25ba74 --- /dev/null +++ b/examples/caddy/internal/Caddyfile @@ -0,0 +1,66 @@ +{ + storage file_system /data/caddy + auto_https disable_certs +} + +www.example.com { + redir https://example.com +} + +docker-registry.example.com { + tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/docker-registry.example.com/docker-registry.example.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/docker-registry.example.com/docker-registry.example.com.key + log { + output file /var/log/caddy/docker-registry.example.com-access.log + } + + reverse_proxy 10.132.32.17:5000 +} + +ghcr-registry.example.com { + tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/ghcr-registry.example.com/ghcr-registry.example.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/ghcr-registry.example.com/ghcr-registry.example.com.key + log { + output file /var/log/caddy/ghcr-registry.example.com-access.log + } + + reverse_proxy 10.132.32.18:5000 +} + +gitlab-registry.example.com { + tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/gitlab-registry.example.com/gitlab-registry.example.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/gitlab-registry.example.com/gitlab-registry.example.com.key + log { + output file /var/log/caddy/gitlab-registry.example.com-access.log + } + + reverse_proxy 10.132.32.19:5000 +} + +clock.example.com { + tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/clock.example.com/clock.example.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/clock.example.com/clock.example.com.key + log { + output file /var/log/caddy/time.example.com-access.log + } + + reverse_proxy 10.137.32.17:8001 +} + +git.example.com { + log { + output file /var/log/caddy/git.example.com-access.log + } + + reverse_proxy 10.136.32.17:3000 +} + +example.com { + log { + output file /var/log/caddy/example.com-access.log + } + + root * /var/www/example.com + encode + handle_errors { + rewrite * / + file_server + } + file_server +} diff --git a/examples/dns/.env b/examples/dns/.env deleted file mode 100644 index a516c368..00000000 --- a/examples/dns/.env +++ /dev/null @@ -1,8 +0,0 @@ -export TIMEZONE="Europe/Vienna" - -# Static IP -export EXTERNAL_NETWORK="incusbr0" -export IPV4_NETMASK="24" -export DNSCRYPT_IPV4_ADDRESS="10.179.215.2" -export KNOT_IPV4_ADDRESS="10.179.215.3" -export IPV4_GATEWAY="10.179.215.1" diff --git a/examples/dns/compose.incus.yaml b/examples/dns/compose.incus.yaml deleted file mode 100644 index 1c60f90c..00000000 --- a/examples/dns/compose.incus.yaml +++ /dev/null @@ -1,25 +0,0 @@ -services: - dnscrypt-proxy: - networks: - default: - ipv4_address: "${DNSCRYPT_IPV4_ADDRESS}/${IPV4_NETMASK}" - - knot: - volumes: !reset - - ./knot/config:/config:ro - - type: bind - source: ./knot/storage - target: /storage - x-incus: - security.shifted: "true" - initial.uid: "53" - initial.gid: "53" - networks: - default: - ipv4_address: "${KNOT_IPV4_ADDRESS}/${IPV4_NETMASK}" - -networks: - default: - external: true - x-incus-compose: - network: ${EXTERNAL_NETWORK} diff --git a/examples/dns/compose.yaml b/examples/dns/compose.yaml deleted file mode 100644 index ab24c97f..00000000 --- a/examples/dns/compose.yaml +++ /dev/null @@ -1,32 +0,0 @@ -services: - dnscrypt-proxy: - image: klutchell/dnscrypt-proxy:main - container_name: dnscrypt-proxy - volumes: - - ./dnscrypt-proxy:/config - - dnscrypt.storage:/storage - restart: unless-stopped - - knot: - image: cznic/knot:v3.5.5 - container_name: knot - command: -c knotd - volumes: - - ./knot/config:/config:ro - - type: bind - source: ./knot/storage - target: /storage - x-incus-compose: - seed: true - environment: - TZ: "${TIMEZONE}" - restart: "unless-stopped" - healthcheck: - test: ["CMD", "/usr/local/bin/dnsprobe", "google.com", "127.0.0.1:5053"] - timeout: 1s - interval: 5s - retries: 6 - start_period: 1m - -volumes: - dnscrypt.storage: diff --git a/examples/dns/dnscrypt-proxy/forwarding-rules.txt b/examples/dns/dnscrypt-proxy/forwarding-rules.txt deleted file mode 100644 index e635ca20..00000000 --- a/examples/dns/dnscrypt-proxy/forwarding-rules.txt +++ /dev/null @@ -1,2 +0,0 @@ -example.com 10.179.215.3 -10.in-addr.arpa 10.179.215.3 diff --git a/examples/dns/knot/config/knot.conf b/examples/dns/knot/config/knot.conf deleted file mode 100644 index 8a95d164..00000000 --- a/examples/dns/knot/config/knot.conf +++ /dev/null @@ -1,24 +0,0 @@ -server: - rundir: "/rundir" - user: knot:knot - automatic-acl: on - listen: 0.0.0.0@53 - listen: ::@53 - -log: - - target: stderr - any: info - -database: - storage: "/storage" - -template: - - id: default - storage: "/storage" - file: "%s.zone" - -zone: - - domain: example.com - dnssec-signing: off - - domain: 10.in-addr.arpa - dnssec-signing: off diff --git a/examples/dns/knot/storage/10.in-addr.arpa.zone b/examples/dns/knot/storage/10.in-addr.arpa.zone deleted file mode 100644 index 0eba1a29..00000000 --- a/examples/dns/knot/storage/10.in-addr.arpa.zone +++ /dev/null @@ -1,5 +0,0 @@ -10.in-addr.arpa. 60 SOA ns1.example.com. hostmaster.example.com. 2026071201 21600 60 604800 86400 -10.in-addr.arpa. 60 NS ns1.example.com. -2.215.179.10.in-addr.arpa. 60 PTR dns1.example.com. -3.215.179.10.in-addr.arpa. 60 PTR ns1.example.com. -4.215.179.10.in-addr.arpa. 60 PTR proxy.example.com. diff --git a/examples/dns/knot/storage/example.com.zone b/examples/dns/knot/storage/example.com.zone deleted file mode 100644 index cc2d1c24..00000000 --- a/examples/dns/knot/storage/example.com.zone +++ /dev/null @@ -1,9 +0,0 @@ -example.com. 60 SOA ns1.example.com. hostmaster.example.com. 2026070302 21600 60 604800 86400 -example.com. 60 A 10.179.215.4 -example.com. 60 NS ns1.example.com. -example.com. 60 MX 10 mail.protonmail.ch. -example.com. 60 MX 20 mailsec.protonmail.ch. -*.example.com. 60 CNAME proxy.example.com. -dns1.example.com. 60 A 10.179.215.2 -ns1.example.com. 60 A 10.179.215.3 -proxy.example.com 60 A 10.179.215.4 diff --git a/examples/pdns-dnsweaver/.env.sample b/examples/pdns-dnsweaver/.env.sample deleted file mode 100644 index c80455c7..00000000 --- a/examples/pdns-dnsweaver/.env.sample +++ /dev/null @@ -1,30 +0,0 @@ -# Make sure to change pdns/pdns.conf as well when changing these -export DB_NAME="pdns" -export DB_USER="pdns" -export DB_PASSWORD="superSecret" -export DB_ROOT_PASSWORD="superRootSecret" - -export DB_MY_CNF="[client] -password=superRootSecret - -" - -# PowerDNS -export API_KEY="superAdminKeySecret" - -# PowerDNS Admin -export ADMIN_DB_NAME="pdns-admin" - -# dnsweaver -export DNSWEAVER_PDNS_ZONE="home.example.com" -export DNSWEAVER_PDNS_DOMAINS="*.home.example.com" -export DNSWEAVER_INCUS_URL="https://10.90.190.1:8443" -export DNSWEAVER_INCUS_DOMAIN_SUFFIX="home.example.com" - -# Incus -export NETWORK="pdns0" -export DNSCRYPT_IPV4_ADDRESS="10.138.32.2" -export PDNS_IPV4_ADDRESS="10.138.32.3" -export ADMIN_IPV4_ADDRESS="10.138.32.4" -export IPV4_GATEWAY="10.138.32.1" -export IPV4_NETMASK="24" diff --git a/examples/pdns-dnsweaver/dnscrypt-proxy/cloaking-rules.txt b/examples/pdns-dnsweaver/dnscrypt-proxy/cloaking-rules.txt deleted file mode 100644 index 8b137891..00000000 --- a/examples/pdns-dnsweaver/dnscrypt-proxy/cloaking-rules.txt +++ /dev/null @@ -1 +0,0 @@ - diff --git a/examples/pdns-dnsweaver/dnscrypt-proxy/dnscrypt-proxy.toml b/examples/pdns-dnsweaver/dnscrypt-proxy/dnscrypt-proxy.toml deleted file mode 100644 index 6da6aa80..00000000 --- a/examples/pdns-dnsweaver/dnscrypt-proxy/dnscrypt-proxy.toml +++ /dev/null @@ -1,107 +0,0 @@ -listen_addresses = ['0.0.0.0:53'] - -max_clients = 500 - -ipv4_servers = true - -ipv6_servers = false - -dnscrypt_servers = true - -doh_servers = true - -odoh_servers = false - -require_dnssec = true - -require_nolog = true - -require_nofilter = true - -force_tcp = false - - -timeout = 2500 -keepalive = 30 - -log_level = 2 -log_file = '/dev/stderr' -use_syslog = false - -cert_refresh_delay = 240 - -dnscrypt_ephemeral_keys = false - -tls_disable_session_tickets = false - -bootstrap_resolvers = ['8.8.8.8:53'] - -ignore_system_dns = false - -netprobe_timeout = 30 -log_files_max_size = 10 -log_files_max_age = 7 -log_files_max_backups = 1 - -block_ipv6 = true - -forwarding_rules = 'forwarding-rules.txt' -cloaking_rules = 'cloaking-rules.txt' - -cache = true -cache_size = 512 -cache_min_ttl = 600 -cache_max_ttl = 86400 -cache_neg_min_ttl = 60 -cache_neg_max_ttl = 600 - -# [allowed_names] -# allowed_names_file = 'whitelist.txt' -# log_file = '/storage/whitelisted.log' -# log_format = 'tsv' - -# [blocked_names] -# blocked_names_file = 'blacklist.txt' -# log_file = '/storage/blocked.log' -# log_format = 'tsv' - -[sources] - [sources.'public-resolvers'] - urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/public-resolvers.md'] - cache_file = '/storage/public-resolvers.md' - minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' - refresh_delay = 72 - prefix = '' - - ## Anonymized DNS relays - - [sources.'relays'] - urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/relays.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/relays.md'] - cache_file = '/storage/relays.md' - minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' - refresh_delay = 72 - prefix = '' - - ## Oblivious DoH servers - - [sources.'odoh-servers'] - urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-servers.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-servers.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/odoh-servers.md'] - cache_file = '/storage/odoh-servers.md' - minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' - refresh_delay = 72 - prefix = '' - - ## Oblivious DoH relays - - [sources.'odoh-relays'] - urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-relays.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/odoh-relays.md'] - cache_file = '/storage/odoh-relays.md' - minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' - refresh_delay = 72 - prefix = '' - -[anonymized_dns] - - - -[static] diff --git a/examples/pdns-dnsweaver/dnscrypt-proxy/whitelist.txt b/examples/pdns-dnsweaver/dnscrypt-proxy/whitelist.txt deleted file mode 100644 index 8b137891..00000000 --- a/examples/pdns-dnsweaver/dnscrypt-proxy/whitelist.txt +++ /dev/null @@ -1 +0,0 @@ - diff --git a/examples/pdns/.env.sample b/examples/pdns/.env.sample new file mode 100644 index 00000000..a43599f0 --- /dev/null +++ b/examples/pdns/.env.sample @@ -0,0 +1,21 @@ +# Make sure to change pdns/pdns.conf as well when changing these +export DB_NAME="pdns" +export DB_USER="pdns" +export DB_PASSWORD="superSecret" +export DB_ROOT_PASSWORD="superRootSecret" + +# PowerDNS +export API_KEY="superAdminKeySecret" +export ZONE="lan" + +# PowerDNS Admin +export ADMIN_DB_NAME="pdns_admin" + +# Incus +export DNSCRYPT_IPV4_ADDRESS="10.1.2.2" +export PDNS_IPV4_ADDRESS="10.1.2.5" +export ADMIN_IPV4_ADDRESS="10.1.2.6" +export NETWORK="incusbr0" +export NET_EXTERNAL="true" +export IPV4_NETMASK="23" +export IPV4_GATEWAY="10.1.2.1" diff --git a/examples/pdns-dnsweaver/.gitignore b/examples/pdns/.gitignore similarity index 73% rename from examples/pdns-dnsweaver/.gitignore rename to examples/pdns/.gitignore index 22b35c38..c3cb7d3d 100644 --- a/examples/pdns-dnsweaver/.gitignore +++ b/examples/pdns/.gitignore @@ -1,6 +1,4 @@ .env -client.crt -client.key pdns/pdns.conf work/ dnscrypt-proxy/forwarding-rules.txt diff --git a/examples/pdns-dnsweaver/compose.incus.yaml b/examples/pdns/compose.incus.yaml similarity index 63% rename from examples/pdns-dnsweaver/compose.incus.yaml rename to examples/pdns/compose.incus.yaml index 40b94cdd..1853f8a5 100644 --- a/examples/pdns-dnsweaver/compose.incus.yaml +++ b/examples/pdns/compose.incus.yaml @@ -4,21 +4,26 @@ services: networks: default: ipv4_address: "${PDNS_IPV4_ADDRESS}/${IPV4_NETMASK}" + x-incus: + ipv4.gateway: "${IPV4_GATEWAY}" dnscrypt-proxy: networks: default: ipv4_address: "${DNSCRYPT_IPV4_ADDRESS}/${IPV4_NETMASK}" + x-incus: + ipv4.gateway: "${IPV4_GATEWAY}" pdns-admin: ports: !reset [] networks: default: ipv4_address: "${ADMIN_IPV4_ADDRESS}/${IPV4_NETMASK}" + x-incus: + ipv4.gateway: "${IPV4_GATEWAY}" networks: default: - x-incus: - ipv4.address: "${IPV4_GATEWAY}/${IPV4_NETMASK}" + external: ${NET_EXTERNAL} x-incus-compose: - network: ${NETWORK} + network: "${NETWORK}" diff --git a/examples/pdns-dnsweaver/compose.yaml b/examples/pdns/compose.yaml similarity index 55% rename from examples/pdns-dnsweaver/compose.yaml rename to examples/pdns/compose.yaml index 20ed1502..5f20a081 100644 --- a/examples/pdns-dnsweaver/compose.yaml +++ b/examples/pdns/compose.yaml @@ -52,59 +52,6 @@ services: pdns: condition: service_healthy - dnsweaver: - build: - context: ./work/dnsweaver/ - image: maxamill/dnsweaver:latest-custom - container_name: dnsweaver - environment: - DNSWEAVER_INSTANCES: pdns - DNSWEAVER_PDNS_TYPE: powerdns - DNSWEAVER_PDNS_URL: http://$PDNS_IPV4_ADDRESS:8081 - DNSWEAVER_PDNS_API_KEY_FILE: /run/secrets/pdns_api_key - DNSWEAVER_PDNS_ZONE: "$DNSWEAVER_PDNS_ZONE" - DNSWEAVER_PDNS_DOMAINS: "$DNSWEAVER_PDNS_DOMAINS" - DNSWEAVER_PDNS_TTL: "5" - DNSWEAVER_PDNS_TARGET: "$PDNS_IPV4_ADDRESS" - - DNSWEAVER_PLATFORM: none - DNSWEAVER_SOURCES: incus - DNSWEAVER_INCUS_ALL_PROJECTS: "true" - DNSWEAVER_INCUS_URL: "$DNSWEAVER_INCUS_URL" - DNSWEAVER_INCUS_DOMAIN_SUFFIX: "$DNSWEAVER_INCUS_DOMAIN_SUFFIX" - DNSWEAVER_INCUS_TLS_CERT_FILE: /run/secrets/incus_client_cert - DNSWEAVER_INCUS_TLS_KEY_FILE: /run/secrets/incus_client_key - DNSWEAVER_INCUS_CERT_STORE: /var/lib/dnsweaver/incus - secrets: - - source: pdns_api_key - uid: "1000" - gid: "1000" - mode: 0o400 - - source: incus_client_cert - uid: "1000" - gid: "1000" - mode: 0o400 - - source: incus_client_key - uid: "1000" - gid: "1000" - mode: 0o400 - depends_on: - pdns: - condition: service_healthy - restart: unless-stopped - healthcheck: - test: - [ - "CMD", - "/bin/sh", - "-c", - "echo -e 'GET /health HTTP/1.0\r\nHost: localhost\r\n\r\n' | nc localhost 8080 | grep -q '200 OK' || exit 1", - ] - interval: 30s - timeout: 5s - retries: 3 - start_period: 10s - pdns-admin: image: powerdnsadmin/pda-legacy:latest container_name: pdns-admin @@ -118,8 +65,6 @@ services: GUNICORN_WORKERS: "2" GUNICORN_LOGLEVEL: "INFO" OFFLINE_MODE: "False" - ports: - - "9191:80" volumes: - pdnsadmin:/app/upload healthcheck: @@ -140,9 +85,3 @@ secrets: environment: DB_PASSWORD db-root-password: environment: DB_ROOT_PASSWORD - pdns_api_key: - environment: API_KEY - incus_client_cert: - file: client.crt - incus_client_key: - file: client.key diff --git a/examples/dns/dnscrypt-proxy/cloaking-rules.txt b/examples/pdns/dnscrypt-proxy/cloaking-rules.txt similarity index 100% rename from examples/dns/dnscrypt-proxy/cloaking-rules.txt rename to examples/pdns/dnscrypt-proxy/cloaking-rules.txt diff --git a/examples/dns/dnscrypt-proxy/dnscrypt-proxy.toml b/examples/pdns/dnscrypt-proxy/dnscrypt-proxy.toml similarity index 100% rename from examples/dns/dnscrypt-proxy/dnscrypt-proxy.toml rename to examples/pdns/dnscrypt-proxy/dnscrypt-proxy.toml diff --git a/examples/pdns-dnsweaver/dnscrypt-proxy/forwarding-rules.txt.template b/examples/pdns/dnscrypt-proxy/forwarding-rules.txt.template similarity index 50% rename from examples/pdns-dnsweaver/dnscrypt-proxy/forwarding-rules.txt.template rename to examples/pdns/dnscrypt-proxy/forwarding-rules.txt.template index c7f2a511..840a888d 100644 --- a/examples/pdns-dnsweaver/dnscrypt-proxy/forwarding-rules.txt.template +++ b/examples/pdns/dnscrypt-proxy/forwarding-rules.txt.template @@ -1,2 +1,2 @@ -DNSWEAVER_ZONE PDNS_IPV4_ADDRESS +ZONE PDNS_IPV4_ADDRESS 10.in-addr.arpa PDNS_IPV4_ADDRESS diff --git a/examples/dns/dnscrypt-proxy/whitelist.txt b/examples/pdns/dnscrypt-proxy/whitelist.txt similarity index 100% rename from examples/dns/dnscrypt-proxy/whitelist.txt rename to examples/pdns/dnscrypt-proxy/whitelist.txt diff --git a/examples/pdns-dnsweaver/install.sh b/examples/pdns/install.sh similarity index 65% rename from examples/pdns-dnsweaver/install.sh rename to examples/pdns/install.sh index 20099360..c7b45202 100755 --- a/examples/pdns-dnsweaver/install.sh +++ b/examples/pdns/install.sh @@ -14,39 +14,23 @@ fi mkdir -p "${SCRIPT_DIR}/work" -if [ ! -d "${SCRIPT_DIR}/work/dnsweaver" ]; then - echo "Cloning dnsweaver to ${SCRIPT_DIR}/work/dnsweaver" - pushd "${SCRIPT_DIR}/work" >/dev/null - git clone https://github.com/maxfield-allison/dnsweaver.git - popd >/dev/null -fi - -if [ ! -f "${SCRIPT_DIR}/client.crt" ]; then - echo "Creating a incus client certificate" - INCUS_CONF="${SCRIPT_DIR}/work/incus" incus remote generate-certificate - mv work/incus/client.crt "${SCRIPT_DIR}" - mv work/incus/client.key "${SCRIPT_DIR}" - rm -rf work/incus - incus config trust add-certificate --name="dnsweaver" "${SCRIPT_DIR}/client.crt" -fi - echo "Creating configs from templates" sed "s/DB_NAME_HERE/${DB_NAME}/g; s/DB_USER_HERE/${DB_USER}/g; s/DB_PASS_HERE/${DB_PASSWORD}/g; s/API_KEY_HERE/${API_KEY}/g" "${SCRIPT_DIR}/pdns/pdns.conf.template" > "${SCRIPT_DIR}/pdns/pdns.conf" -sed "s/DNSWEAVER_ZONE/${DNSWEAVER_PDNS_ZONE}/g; +sed "s/ZONE/${ZONE}/g; s/PDNS_IPV4_ADDRESS/${PDNS_IPV4_ADDRESS}/g" "${SCRIPT_DIR}/dnscrypt-proxy/forwarding-rules.txt.template" > "${SCRIPT_DIR}/dnscrypt-proxy/forwarding-rules.txt" echo "Creating powerdns to copy the schema from it" -incus-compose up --no-start --no-deps pdns +incus-compose up --no-start --no-deps pdns --detach echo "Copying the schema from pdns-auth" incus-compose incus file pull pdns-auth/usr/local/share/doc/pdns/schema.mysql.sql "${SCRIPT_DIR}/work/schema.mysql.sql" echo "Starting mariadb" -incus-compose up --no-deps mariadb +incus-compose up --no-deps mariadb --detach echo "Importing the PDNS schema" incus-compose exec -e MYSQL_PWD="${DB_ROOT_PASSWORD}" mariadb mariadb -uroot "${DB_NAME}" < "${SCRIPT_DIR}/work/schema.mysql.sql" @@ -59,10 +43,10 @@ incus-compose exec -e MYSQL_PWD="${DB_ROOT_PASSWORD}" mariadb mariadb -uroot -e FLUSH PRIVILEGES;" echo "Starting pdns" -incus-compose up --no-deps pdns +incus-compose up --no-deps pdns --detach -echo "Creating your zone: ${DNSWEAVER_PDNS_ZONE}" -incus-compose exec pdns pdnsutil create-zone "${DNSWEAVER_PDNS_ZONE}" +echo "Creating your zone: ${ZONE}" +incus-compose exec pdns pdnsutil create-zone "${ZONE}" echo "Starting the project" -incus-compose up +incus-compose up --detach diff --git a/examples/pdns-dnsweaver/pdns/pdns.conf.template b/examples/pdns/pdns/pdns.conf.template similarity index 100% rename from examples/pdns-dnsweaver/pdns/pdns.conf.template rename to examples/pdns/pdns/pdns.conf.template From 407fb4804a264bd050836657f585bffb247ce3c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Jochum?= Date: Thu, 13 Aug 2026 10:26:07 +0200 Subject: [PATCH 2/3] feat(tooling): run prettier in docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: René Jochum --- just/mod.just | 2 ++ 1 file changed, 2 insertions(+) diff --git a/just/mod.just b/just/mod.just index 0030b527..dfe4d01e 100644 --- a/just/mod.just +++ b/just/mod.just @@ -12,11 +12,13 @@ modules: lint folder="./...": shellcheck **/*.sh npx --yes prettier --check . + cd docs; npx --yes prettier --check . golangci-lint run {{ folder }} # Lint and fix all files. Imports are gopls' job, not this one - see AGENTS.md. fix folder="./...": npx --yes prettier --write . + cd docs; npx --yes prettier --write . golangci-lint run --fix {{ folder }} # Run `go mod tidy` in every module, reporting every failure rather than the first. From 44da1703d7182bd034a5ee3bf09e2ae04e3e2622 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Jochum?= Date: Thu, 13 Aug 2026 10:26:28 +0200 Subject: [PATCH 3/3] fix(tests): fix a race in tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: René Jochum --- client/resource_image_test.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/client/resource_image_test.go b/client/resource_image_test.go index 8ab6c303..a4d5b0f3 100644 --- a/client/resource_image_test.go +++ b/client/resource_image_test.go @@ -515,6 +515,10 @@ func TestImageLockStore_SameAliasSerializes(t *testing.T) { release, err := a.lockStore(ctx) require.NoError(t, err) + // The t.Fatal below returns without reaching the release further down. + release = sync.OnceFunc(release) + defer release() + acquired := make(chan error, 1) go func() { releaseB, err := b.lockStore(ctx)