mirror of
https://github.com/cfal/shoes.git
synced 2026-11-06 08:14:11 +00:00
cfal
d8481fae2d
Add optional global_settings.default_dns so listeners, TUN entries, and WireGuard inbounds can share DNS configuration without repetition. Omitted or null inbound DNS inherits the default, while explicit objects override it completely. Inline fake-IP defaults share one pool, and independent bootstrap and service lookups remain unchanged. Includes validation, regression coverage, and English and Chinese documentation.
103 lines
3.3 KiB
YAML
103 lines
3.3 KiB
YAML
# DNS resolver examples
|
|
#
|
|
# Shows the hickory-backed per-upstream tuning knobs:
|
|
# - timeout_secs: overall lookup timeout inside hickory
|
|
# - connect_timeout_secs: connection setup timeout for TCP/TLS/HTTPS/H3 upstreams
|
|
# - attempts: retry count for failed queries
|
|
#
|
|
# Without a global default, omitting dns selects the OS resolver. An explicit dns
|
|
# object with omitted or empty servers always does. shoes caches successful results
|
|
# for 60 seconds from lookup completion, across ports, with at most 10,000 cached hosts.
|
|
# This is an application result-age policy, not a DNS record TTL: OS/getaddrinfo
|
|
# lookups do not expose authoritative TTLs and may themselves return OS-cached
|
|
# data. Failed and empty results are not cached.
|
|
# Concurrent misses share a lookup, up to 1,024 participating callers per resolver.
|
|
# Excess callers look up independently; this is not an OS lookup concurrency cap.
|
|
# Cancelling the owner makes surviving callers retry. The resolver sets no lookup
|
|
# deadline; caller timeouts must bound the retry, which may not finish in time.
|
|
# Already-running OS calls cannot be stopped. Expired results are not served on
|
|
# refresh failure; expiry during a DNS outage can therefore fail new lookups.
|
|
# These defaults leave configured upstream resolvers, raw DNS exchange, and
|
|
# bootstrap unchanged.
|
|
|
|
# Native OS/NSS lookup memoization is separate from hickory tuning and DNS TTLs.
|
|
# Implicit system DNS caches for 60 seconds. Explicit system defaults to no cache.
|
|
- dns_group: native-short-cache
|
|
dns_servers:
|
|
- url: system
|
|
native_cache_secs: 15
|
|
|
|
- dns_group: native-no-cache
|
|
dns_servers:
|
|
- url: system
|
|
native_cache_secs: 0
|
|
|
|
# Direct DNS group with fast-fail tuning.
|
|
- dns_group: tuned-direct-dns
|
|
dns_servers:
|
|
- url: tcp://1.1.1.1
|
|
ip_strategy: ipv4_only
|
|
timeout_secs: 3
|
|
connect_timeout_secs: 1
|
|
attempts: 1
|
|
- url: tls://8.8.8.8
|
|
server_name: dns.google
|
|
ip_strategy: ipv4_only
|
|
timeout_secs: 4
|
|
connect_timeout_secs: 2
|
|
attempts: 1
|
|
|
|
# Inbounds without dns, like the HTTP proxy below, inherit this group.
|
|
- global_settings:
|
|
default_dns:
|
|
servers: tuned-direct-dns
|
|
|
|
- address: "127.0.0.1:8080"
|
|
protocol:
|
|
type: http
|
|
|
|
# Reusable proxy tunnel for remote DNS resolution.
|
|
- client_group: dns-tunnel
|
|
client_chains:
|
|
- address: "edge.example.com:443"
|
|
protocol:
|
|
type: tls
|
|
sni_hostname: "edge.example.com"
|
|
protocol:
|
|
type: vmess
|
|
cipher: aes-128-gcm
|
|
user_id: "b85798ef-e9dc-46a4-9a87-8da4499d36d0"
|
|
h2mux:
|
|
max_connections: 2
|
|
min_streams: 4
|
|
padding: true
|
|
|
|
# DNS group that sends queries through the named tunnel.
|
|
- dns_group: tuned-proxied-dns
|
|
dns_servers:
|
|
- url: tls://1.1.1.1
|
|
server_name: cloudflare-dns.com
|
|
client_chain: dns-tunnel
|
|
ip_strategy: ipv4_only
|
|
timeout_secs: 4
|
|
connect_timeout_secs: 2
|
|
attempts: 1
|
|
- url: tcp://8.8.8.8
|
|
client_chain: dns-tunnel
|
|
ip_strategy: ipv4_only
|
|
timeout_secs: 3
|
|
connect_timeout_secs: 1
|
|
attempts: 1
|
|
|
|
# SOCKS5 proxy using the proxied DNS group and the same tunnel for traffic.
|
|
- address: "127.0.0.1:1080"
|
|
dns:
|
|
servers: tuned-proxied-dns
|
|
protocol:
|
|
type: socks
|
|
udp_enabled: true
|
|
rules:
|
|
- masks: "0.0.0.0/0"
|
|
action: allow
|
|
client_chain: dns-tunnel
|