mirror of
https://github.com/dnscrypt/dnscrypt-server-docker
synced 2024-11-26 10:23:48 +01:00
84 lines
3.0 KiB
Markdown
84 lines
3.0 KiB
Markdown
|
DNSCrypt server Docker image
|
||
|
|
============================
|
||
|
|
|
||
|
|
Run your own caching, non-censoring, non-logging, DNSSEC-capable,
|
||
|
|
[DNSCrypt](http://dnscrypt.org)-enabled DNS resolver virtually anywhere!
|
||
|
|
|
||
|
|
If you are already familiar with Docker, it shouldn't take more than 5 minutes
|
||
|
|
to get your resolver up and running.
|
||
|
|
|
||
|
|
Installation
|
||
|
|
============
|
||
|
|
|
||
|
|
Download the Docker image source:
|
||
|
|
|
||
|
|
$ git clone https://github.com/jedisct1/dnscrypt-server-docker.git
|
||
|
|
|
||
|
|
Build the image:
|
||
|
|
|
||
|
|
$ docker build -t dnscrypt-server-image .
|
||
|
|
|
||
|
|
Think about a name. This is going to be part of your DNSCrypt provider name.
|
||
|
|
If you are planning to make your resolver publicly accessible, this name will
|
||
|
|
be public.
|
||
|
|
It has to look like a domain name (`example.com`), but it doesn't have to be
|
||
|
|
a registered domain either.
|
||
|
|
|
||
|
|
Let's pick `example.com` here.
|
||
|
|
|
||
|
|
Create and initialize the container, once and for all:
|
||
|
|
|
||
|
|
$ docker run --name=dnscrypt-server \
|
||
|
|
-p 443:443/udp -p 443:443/tcp \
|
||
|
|
dnscrypt-server-image init -N example.com
|
||
|
|
|
||
|
|
This will only accept connections via DNSCrypt. Containers on the same virtual
|
||
|
|
network can directly access the DNS cache on the standard DNS port (53), but
|
||
|
|
to create a non-authenticated public DNS resolver, this extra port has to be
|
||
|
|
explicitly exposed (`-p 53:53/udp -p 53:53/tcp`).
|
||
|
|
|
||
|
|
Now, to start the whole stack:
|
||
|
|
|
||
|
|
$ docker start dnscrypt-server
|
||
|
|
|
||
|
|
Done.
|
||
|
|
|
||
|
|
To check that your DNSCrypt-enabled DNS resolver is accessible, run the
|
||
|
|
DNSCrypt client proxy on another host:
|
||
|
|
|
||
|
|
# dnscrypt-proxy \
|
||
|
|
--provider-key=<provider key, as displayed when the container was initialized> \
|
||
|
|
--resolver-address=<your resolver's public IP address> \
|
||
|
|
--provider-name=2.dnscrypt-cert.example.com
|
||
|
|
|
||
|
|
And try using `127.0.0.1` as a DNS resolver.
|
||
|
|
|
||
|
|
Note that the actual provider name for DNSCrypt is `2.dnscrypt-cert.example.com`,
|
||
|
|
not just `example.com` as initially entered. The full name has to start with
|
||
|
|
`2.dnscrypt-cert.` for the client and the server to use the same version of the
|
||
|
|
protocol.
|
||
|
|
|
||
|
|
Let the world know about your server
|
||
|
|
====================================
|
||
|
|
|
||
|
|
Is your brand new DNS resolver publicly accessible?
|
||
|
|
|
||
|
|
Fork the [dnscrypt-proxy repository](https://github.com/jedisct1/dnscrypt-proxy),
|
||
|
|
edit the [dnscrypt.csv](https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.csv)
|
||
|
|
file to add your resolver's informations, and submit a pull request to have it
|
||
|
|
included in the list of public DNSCrypt resolvers!
|
||
|
|
|
||
|
|
Details
|
||
|
|
=======
|
||
|
|
|
||
|
|
- Caching resolver: [Unbound](https://www.unbound.net/), with DNSSEC, prefetching,
|
||
|
|
and no logs. The number of threads and memory usage are automatically adjusted.
|
||
|
|
Latest stable version, compiled from source.
|
||
|
|
- [LibreSSL](http://www.libressl.org/) - Latest stable version, compiled from source.
|
||
|
|
- [libsodium](https://download.libsodium.org/doc/) - Latest stable version,
|
||
|
|
minimal build compiled from source.
|
||
|
|
- [dnscrypt-wrapper](https://github.com/Cofyc/dnscrypt-wrapper) - Latest stable version,
|
||
|
|
compiled from source.
|
||
|
|
- [dnscrpt-proxy](https://github.com/jedisct1/dnscrypt-proxy) - Latest stable version,
|
||
|
|
compiled from source.
|