Adopt nanoDNS-style INI config for the guide gateway

Replace the gateway's env-var DNS policy with docker/nanodns.ini, modelled on https://github.com/drakmor/nanoDNS#config: [general] (redirect_url, allowed_clients), [upstream] (ordered resolver list + timeout_ms), [overrides] (mask = IPv4 spoof) and [exceptions] (masks forwarded upstream). Masks use shell-style wildcards and match case-insensitively; resolution order is exceptions -> overrides -> NXDOMAIN. The unmatched-name behaviour is deliberately inverted from upstream nanoDNS: names matching no rule return NXDOMAIN (default-deny) instead of being forwarded, so PSN, updates and telemetry stay blocked. The source-client allowlist now lives in [general] allowed_clients. The INI is baked into the image; CONFIG_FILE can point at a mounted file for per-host overrides. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-10-11 13:38:29 +01:00
parent 9f28b8e2a1
commit 50dd2d8266
7 changed files with 237 additions and 72 deletions
@@ -0,0 +1,47 @@
+# PS5 User Guide DNS gateway -- nanoDNS-style policy.
+#
+# Config model adapted from https://github.com/drakmor/nanoDNS#config, but the
+# unmatched-name behaviour is deliberately inverted to default-DENY.
+#
+# Resolution order for each query:
+#   1. the source address must fall inside [general] allowed_clients, otherwise
+#      the query is dropped and logged as "denied";
+#   2. a name matching an [exceptions] mask is forwarded to [upstream];
+#   3. otherwise a name matching an [overrides] mask is answered with its IPv4;
+#   4. otherwise NXDOMAIN. Unlike upstream nanoDNS, names that match no rule are
+#      NOT forwarded, which keeps PSN, updates and telemetry blocked by default.
+#
+# Masks use shell-style wildcards:  *  ?  [abc]  [a-z]  [!0-9]
+# Names are matched case-insensitively.
+
+[general]
+redirect_url = http://192.168.20.30:8000/
+# Source networks allowed to query this resolver (comma/space/newline separated).
+# Consoles VLAN /28, server VLAN /24, trusted management VLAN /27.
+allowed_clients = 192.168.40.0/28, 192.168.20.0/24, 192.168.10.0/27
+
+[upstream]
+# Resolvers tried in order; the first valid answer wins. Several may be listed,
+# separated by commas, spaces or newlines. Must be IP addresses, not hostnames.
+server = 1.1.1.1
+timeout_ms = 3000
+
+[overrides]
+# mask = IPv4  -- matched names are answered with this address (A records).
+manuals.playstation.net = 192.168.20.30
+
+[exceptions]
+# One mask per line (no address) -- matched names are forwarded upstream. These
+# are the reviewed homebrew-store, PS5 Payload Manager, Spectrum Library and
+# BlackBox endpoints. Everything not listed here or in [overrides] is NXDOMAIN.
+homebrew.page
+itsplk.github.io
+store.spectrumlibrary.online
+api.github.com
+github.com
+raw.githubusercontent.com
+release-assets.githubusercontent.com
+prosperopatches.com
+cdn.prosperopatches.com
+image.api.playstation.com
+gmedia.playstation.com