-- SPDX-License-Identifier: CC0-1.0
-- vim:syntax=lua:set ts=4 sw=4:
-- Refer to manual: https://knot-resolver.readthedocs.org/en/stable/

-- síť
net.listen('127.0.0.53', 53, { kind = 'dns' })
net.listen('127.0.0.53', 853, { kind = 'tls' })

net.listen('127.0.0.1', 53, { kind = 'dns' })
net.listen('127.0.0.1', 853, { kind = 'tls' })

net.listen('::1', 53, { kind = 'dns' })
net.listen('::1', 853, { kind = 'tls' })

net.listen('10.0.1.100', 53, { kind = 'dns' })
net.listen('10.0.1.100', 853, { kind = 'tls' })

net.listen('cafe:a:b:c::100', 53, { kind = 'dns' })
net.listen('cafe:a:b:c::100', 853, { kind = 'tls' })

-- moduly
modules = {
	'hints > iterate',  -- Allow loading /etc/hosts or custom root hints
	'stats',            -- Track internal statistics
	'predict',          -- Prefetch expiring/frequent records
}

predict.config({
    window = 30, 
    period = 24*(60/15)
})

-- cache
cache.size = 100 * MB

-- obecný hairpin pro webserver
policy.add(policy.all(policy.REROUTE({['WAN.IPv4.address.0'] = '10.0.1.60'})), true)

-- RPZ - převzato přímo z PiHole/BIND9
policy.add(policy.rpz(policy.DENY_MSG('Zablokováno RPZ'), '/etc/knot-resolver/rpz.zone', true))

-- vnitřní domény
internalDomains = policy.todnames( {
  'domena.lan', '_domena.eida.lan',
  '1.0.10.in-addr.arpa',
  'c.0.0.0.b.0.0.0.a.0.0.0.e.f.a.c.ip6.arpa', 

  'extranet.ext',
})

-- přesměrování vnitřních domén na knotd
policy.add(policy.suffix(policy.FLAGS({'NO_CACHE'}), internalDomains))
policy.add(policy.suffix(policy.STUB({'127.0.0.1@1053'}), internalDomains))

-- upstream servery - CZ.NIC ODVR přes TLS
policy.add(policy.all(
   policy.TLS_FORWARD({
      {'2001:148f:ffff::1', hostname='odvr.nic.cz'},
      {'2001:148f:fffe::1', hostname='odvr.nic.cz'},
      {'193.17.47.1', hostname='odvr.nic.cz'},
      {'185.43.135.1', hostname='odvr.nic.cz'},
   })
))