kadinhoandClaude Opus 4.8
50dd2d8266
Replace the gateway's env-var DNS policy with docker/nanodns.ini, modelled on https://github.com/drakmor/nanoDNS#config: [general] (redirect_url, allowed_clients), [upstream] (ordered resolver list + timeout_ms), [overrides] (mask = IPv4 spoof) and [exceptions] (masks forwarded upstream). Masks use shell-style wildcards and match case-insensitively; resolution order is exceptions -> overrides -> NXDOMAIN. The unmatched-name behaviour is deliberately inverted from upstream nanoDNS: names matching no rule return NXDOMAIN (default-deny) instead of being forwarded, so PSN, updates and telemetry stay blocked. The source-client allowlist now lives in [general] allowed_clients. The INI is baked into the image; CONFIG_FILE can point at a mounted file for per-host overrides. Co-Authored-By: Claude Opus 4.8 <[email protected]>
48 lines
1.8 KiB
INI
48 lines
1.8 KiB
INI
# PS5 User Guide DNS gateway -- nanoDNS-style policy.
|
|
#
|
|
# Config model adapted from https://github.com/drakmor/nanoDNS#config, but the
|
|
# unmatched-name behaviour is deliberately inverted to default-DENY.
|
|
#
|
|
# Resolution order for each query:
|
|
# 1. the source address must fall inside [general] allowed_clients, otherwise
|
|
# the query is dropped and logged as "denied";
|
|
# 2. a name matching an [exceptions] mask is forwarded to [upstream];
|
|
# 3. otherwise a name matching an [overrides] mask is answered with its IPv4;
|
|
# 4. otherwise NXDOMAIN. Unlike upstream nanoDNS, names that match no rule are
|
|
# NOT forwarded, which keeps PSN, updates and telemetry blocked by default.
|
|
#
|
|
# Masks use shell-style wildcards: * ? [abc] [a-z] [!0-9]
|
|
# Names are matched case-insensitively.
|
|
|
|
[general]
|
|
redirect_url = http://192.168.20.30:8000/
|
|
# Source networks allowed to query this resolver (comma/space/newline separated).
|
|
# Consoles VLAN /28, server VLAN /24, trusted management VLAN /27.
|
|
allowed_clients = 192.168.40.0/28, 192.168.20.0/24, 192.168.10.0/27
|
|
|
|
[upstream]
|
|
# Resolvers tried in order; the first valid answer wins. Several may be listed,
|
|
# separated by commas, spaces or newlines. Must be IP addresses, not hostnames.
|
|
server = 1.1.1.1
|
|
timeout_ms = 3000
|
|
|
|
[overrides]
|
|
# mask = IPv4 -- matched names are answered with this address (A records).
|
|
manuals.playstation.net = 192.168.20.30
|
|
|
|
[exceptions]
|
|
# One mask per line (no address) -- matched names are forwarded upstream. These
|
|
# are the reviewed homebrew-store, PS5 Payload Manager, Spectrum Library and
|
|
# BlackBox endpoints. Everything not listed here or in [overrides] is NXDOMAIN.
|
|
homebrew.page
|
|
itsplk.github.io
|
|
store.spectrumlibrary.online
|
|
api.github.com
|
|
github.com
|
|
raw.githubusercontent.com
|
|
release-assets.githubusercontent.com
|
|
prosperopatches.com
|
|
cdn.prosperopatches.com
|
|
image.api.playstation.com
|
|
gmedia.playstation.com
|