mirror of
https://github.com/cfal/shoes.git
synced 2026-11-06 16:14:11 +00:00
cfal
f94fa61e36
Add a system-only native_cache_secs option for configurable OS/NSS application memoization while preserving the existing 60-second implicit default and uncached explicit system behavior. Disable completed-cache reads and writes for zero windows, reject invalid DNS options, and document freshness and lookup-sharing semantics.
101 lines
3.2 KiB
YAML
101 lines
3.2 KiB
YAML
# DNS resolver examples
|
|
#
|
|
# Shows the hickory-backed per-upstream tuning knobs:
|
|
# - timeout_secs: overall lookup timeout inside hickory
|
|
# - connect_timeout_secs: connection setup timeout for TCP/TLS/HTTPS/H3 upstreams
|
|
# - attempts: retry count for failed queries
|
|
#
|
|
# With no dns field, or a dns field with omitted or empty servers, destination
|
|
# lookups use the OS resolver. Shoes caches successful results for 60 seconds from
|
|
# lookup completion, across ports, with at most 10,000 cached hosts.
|
|
# This is an application result-age policy, not a DNS record TTL: OS/getaddrinfo
|
|
# lookups do not expose authoritative TTLs and may themselves return OS-cached
|
|
# data. Failed and empty results are not cached.
|
|
# Concurrent misses share a lookup, up to 1,024 participating callers per resolver.
|
|
# Excess callers look up independently; this is not an OS lookup concurrency cap.
|
|
# Cancelling the owner makes surviving callers retry. The resolver sets no lookup
|
|
# deadline; caller timeouts must bound the retry, which may not finish in time.
|
|
# Already-running OS calls cannot be stopped. Expired results are not served on
|
|
# refresh failure; expiry during a DNS outage can therefore fail new lookups.
|
|
# These defaults leave configured upstream resolvers, raw DNS exchange, and
|
|
# bootstrap unchanged.
|
|
|
|
# Native OS/NSS lookup memoization is separate from hickory tuning and DNS TTLs.
|
|
# Omitted listener dns defaults to 60 seconds. Explicit system defaults to no cache.
|
|
- dns_group: native-short-cache
|
|
dns_servers:
|
|
- url: system
|
|
native_cache_secs: 15
|
|
|
|
- dns_group: native-no-cache
|
|
dns_servers:
|
|
- url: system
|
|
native_cache_secs: 0
|
|
|
|
# Direct DNS group with fast-fail tuning.
|
|
- dns_group: tuned-direct-dns
|
|
dns_servers:
|
|
- url: tcp://1.1.1.1
|
|
ip_strategy: ipv4_only
|
|
timeout_secs: 3
|
|
connect_timeout_secs: 1
|
|
attempts: 1
|
|
- url: tls://8.8.8.8
|
|
server_name: dns.google
|
|
ip_strategy: ipv4_only
|
|
timeout_secs: 4
|
|
connect_timeout_secs: 2
|
|
attempts: 1
|
|
|
|
# HTTP proxy using the tuned direct DNS group.
|
|
- address: "127.0.0.1:8080"
|
|
dns:
|
|
servers: tuned-direct-dns
|
|
protocol:
|
|
type: http
|
|
|
|
# Reusable proxy tunnel for remote DNS resolution.
|
|
- client_group: dns-tunnel
|
|
client_proxies:
|
|
- address: "edge.example.com:443"
|
|
protocol:
|
|
type: tls
|
|
sni_hostname: "edge.example.com"
|
|
protocol:
|
|
type: vmess
|
|
cipher: aes-128-gcm
|
|
user_id: "b85798ef-e9dc-46a4-9a87-8da4499d36d0"
|
|
h2mux:
|
|
max_connections: 2
|
|
min_streams: 4
|
|
padding: true
|
|
|
|
# DNS group that sends queries through the named tunnel.
|
|
- dns_group: tuned-proxied-dns
|
|
dns_servers:
|
|
- url: tls://1.1.1.1
|
|
server_name: cloudflare-dns.com
|
|
client_chain: dns-tunnel
|
|
ip_strategy: ipv4_only
|
|
timeout_secs: 4
|
|
connect_timeout_secs: 2
|
|
attempts: 1
|
|
- url: tcp://8.8.8.8
|
|
client_chain: dns-tunnel
|
|
ip_strategy: ipv4_only
|
|
timeout_secs: 3
|
|
connect_timeout_secs: 1
|
|
attempts: 1
|
|
|
|
# SOCKS5 proxy using the proxied DNS group and the same tunnel for traffic.
|
|
- address: "127.0.0.1:1080"
|
|
dns:
|
|
servers: tuned-proxied-dns
|
|
protocol:
|
|
type: socks
|
|
udp_enabled: true
|
|
rules:
|
|
- masks: "0.0.0.0/0"
|
|
action: allow
|
|
client_chain: dns-tunnel
|