blocky,coredns: disable caching, add falltrough

2026-05-06 08:41:30 +00:00 · 2026-05-02 16:36:15 +02:00
parent a0dc90a708
commit 30f0726821
2 changed files with 39 additions and 37 deletions
--- a/kubernetes/system/blocky/values.yaml
+++ b/kubernetes/system/blocky/values.yaml
@@ -29,30 +29,29 @@ resources:
        cpu: 50m
        memory: 64Mi
 # Full list of options https://github.com/0xERR0R/blocky/blob/main/docs/config.yml
-# Using Kubernetes DNS ClusterIP (10.96.0.10) - this is stable and won't change
-config: "upstreams:\n    groups:\n        default:\n            - 1.1.1.1\n            - 1.0.0.1\n        lan:\n            - 10.101.207.1\n\nconditional:\n    mapping:\n        lan: 10.101.207.1\n        cluster.local: 10.96.0.10\n        in-addr.arpa: 10.96.0.10\n\nblocking:\n    allowlists:\n        ads:\n            # Inline domain entries (one per line)\n            - |\n                dealabs.digidip.net\n                s.click.aliexpress.com\n                fonts.googleapis.com\n                fonts.gstatic.com\n                wl.spotify.com\n                www.googleadservices.com\n    \n    denylists:\n        ads:\n            # Using hosts-format lists\n            - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts\n            - https://adaway.org/hosts.txt\n    \n    clientGroupsBlock:\n        default:\n            - ads\n    \n    blockType: zeroIp\n    blockTTL: 1m\n    loading:\n        refreshPeriod: 4h\n        downloads:\n            timeout: 60s\n\ncaching:\n    minTime: 5m\n    maxTime: 30m\n    prefetching: true\n    prefetchExpires: 2h\n    prefetchThreshold: 5\n\nprometheus:\n    enable: true\n    path: /metrics\n\nports:\n    dns: 53\n    http: 4000\n\nbootstrapDns: tcp+udp:1.1.1.1\n\nlog:\n    level: info\n    format: text\n    timestamp: true\n"
+config: "upstreams:\n    groups:\n        default:\n            - 1.1.1.1\n            - 1.0.0.1\n        lan:\n            - 10.101.207.1\n\nconditional:\n    mapping:\n        lan: 10.101.207.1\n        cluster.local: 10.96.0.10\n        in-addr.arpa: 10.96.0.10\n\nblocking:\n    allowlists:\n        ads:\n            - |\n                dealabs.digidip.net\n                s.click.aliexpress.com\n                fonts.googleapis.com\n                fonts.gstatic.com\n                wl.spotify.com\n                www.googleadservices.com\n    \n    denylists:\n        ads:\n            - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts\n            - https://adaway.org/hosts.txt\n    \n    clientGroupsBlock:\n        default:\n            - ads\n    \n    blockType: zeroIp\n    blockTTL: 1m\n    loading:\n        refreshPeriod: 4h\n        downloads:\n            timeout: 60s\n\ncaching:\n    minTime: 5m\n    maxTime: 30m\n    # Disable negative caching (NXDOMAIN responses) for dynamic DNS\n    cacheTimeNegative: 0\n    prefetching: true\n    prefetchExpires: 2h\n    prefetchThreshold: 5\n\nprometheus:\n    enable: true\n    path: /metrics\n\nports:\n    dns: 53\n    http: 4000\n\nbootstrapDns: tcp+udp:1.1.1.1\n\nlog:\n    level: info\n    format: text\n    timestamp: true\n"
 sops:
-    lastmodified: "2026-05-02T13:46:03Z"
-    mac: ENC[AES256_GCM,data:B8NGD8pFktVBA8IgClXiV6PoTnCePXQ6fzj0bVmEmDhP7875oOnVTAgDqgffWA8dh5/UVoGM9kh9SjntM1Bu5f11ihC6roFxeHyLUdwNdXlZsKGtoyct+GXqmdUNPk8eqotZedsOWHLRJZz0XoGAmEyIxsYzNgH0Z4zb8W0sNvU=,iv:LPnGqY3ja7JLA8zeVrQ+apIp6w3cmN9CzkeWRKMXMDI=,tag:RRHTbzZYNZ1b1sF1Uymisw==,type:str]
+    lastmodified: "2026-05-02T14:36:10Z"
+    mac: ENC[AES256_GCM,data:1SV8u2ozDlB/m8uo7I7AIa/1njmu1bJ5vKilcirfNByz8wp/LRTtRgWwpUOrxzd1+qg+ZC1/mSLQY/kdwWcTU9uP6uBNSLemWJgIRBobFmExDvtfidkJXRhTMUm9zdSNGS/EbQQOz+DV8AAuByTwbP6i5fTiVNVes8kBlYbPvjc=,iv:Ox25bYW8ch63eJgCkOTZxUP/6+w43lKjC2lzYdBzUjw=,tag:LgXken02vzuXDuxg4Iovrw==,type:str]
    pgp:
-        - created_at: "2026-05-02T13:46:01Z"
+        - created_at: "2026-05-02T14:36:09Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiARAAv7BwD5jFu6rz116wCdbiYhJLEMcw4ktq9Aj3rdUlVKMk
-            352bUDe9XK/ANmpeBzIbvaSgGRupU6ba/zCRsVBn3S+2DkG1+iXU+M3wgf9RrQx2
-            ksp653uMPUp8bQ/8SMnQ24nACTCI9njUTZBxmHN+G299TfLSLIBX0H8V5EyNZPV2
-            HIhj+vTBXUlplm5DV9/C0A3Yg/uE0nImtAe44FhtzseUfSr1n+vx9uy0oqJQUXrv
-            wm6XW4PYHFSdi73xiawVY/hNh4LTHGjE0U3QTo2orgleFzXX2YAs+Bmp6pEphJbk
-            X7j5WoEcenW2N4ifkZpz4XkXjvyQCmF4UjHcum93+4FLrE23L1ekpuNf2EpT8Dd5
-            HoeyensBQjsdqG1NGAlt5dzA9rlxk+MsTo7kb1f1/VSKI06hR/PTd02DiiY8qj2f
-            Q0v7UYPWKHdtJRhzIgI73FUieLbZV+6VgeeAA5AzLp0EiBE5848TVXOEQZAsw1K3
-            gDb+vEEgi3b6BzALn46F6VhmJfUEEfl2fEcNFdutc/5BflKzgYkElUH6VWJkkaiS
-            GYQhUVMmDnjj8FgoT5FCaQXVqZCzMCBYvPitNPskIJlHkos0ETq1G/A5RkubQc/X
-            Yjx+UuXmFzDLEaKHBUAV7EdQO0Y7hqLr3kijaBc8LyBjjeYYnI8jXWQVZ6e2a3TS
-            XAHSiI5bdISuWcg2ULFaFm/buVO0PzQ6gkyRhgAaJbXeMTTsZq9b+o3hMU3NhDoo
-            +5iuMQn4UW0VkXxHI0lW2Qwntn+ooRjFduSSbVuUAFT9a5+dgp+5o7zyze9y
-            =ufxs
+            hQIMA7uy4qQr71wiARAAtdzdOgPBhpRSSnw5ZNXHpb6//E5SpCTDDOUbgpvw4FQj
+            ndqJwONMEm7RlZELlxpXq4Gr621j5hcdcc2vUl4ak8wC+1Ml2AAEYf0rrL2SQVVC
+            DAiRdHXilzOKJBx+qA+afZT4SNXnN8kv8LRq354mEpxMZ21ot0nZ+sjJiHrVGbSO
+            B2l39o3POLoTmzB/0+iTn953txjijVn/Hm7JoQ7yqQXBwnzjK1F7IkOdv0hyvpW1
+            /Sba+yqZQTqdpH/EwRfQxf6OJpxMBIAj6/COzcp143O3tjVQAEHTaqHbY4rbrt07
+            yxvOZKy2tNP/xY62E35rTzGvMrRqUzFNtaYeycx5F0jHgYNITtlCPh1txf5PBq5H
+            kmR9NFCOHncX5BFTAXbWaGVQiWxa71mn3vy49BZCwwz21D3u5/PI0Vqe5JBccyVu
+            4yqqIdwIrj5i0BdlIFHig1WbYzDjRriR4H1z/Y2Vvv1wtRao99rf8DhCxcWwEgNo
+            vAOM1wSBHacr9uZrgAOvObkMWZ4m1UekIJXkA5803cb8J+ceneJ+EOWyYiFVPV8h
+            MshaL9M1zuEydZqHwDHfMgR/BgVvSVFwPQSkfXnKYJHNS8QGTfZKFudBiP0Ij7DB
+            pjRf5f2b4FhDgCIg5BopWBxES0LscpFmHgrV0QDKiXOXJNMkVUF5+ITz6HwwwlnS
+            XAEwKWrC58GzNBKFCvSMeD83xy7icfdTkXvO30EW9CbEUAMYN4twgsHG+J5NDrUR
+            yaET3e2kmOWStkQsPmMtYEVRfRHOWr8XKQXMJfrA87ZC0P19UwUM0eRXJVCN
+            =0h7d
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
--- a/kubernetes/system/coredns/values.yaml
+++ b/kubernetes/system/coredns/values.yaml
@@ -27,9 +27,12 @@ servers:
          configBlock: |-
            path /skydns
            endpoint http://etcd.coredns.svc.cluster.local:2379
+            fallthrough
        - name: file
          parameters: /etc/coredns/zones/lan.zone
-          configBlock: reload 10s
+          configBlock: |-
+            reload 10s
+            fallthrough
        - name: cache
          parameters: 30
        - name: loadbalance
@@ -43,27 +46,27 @@ extraVolumes:
      configMap:
        name: coredns-lan-zone
 sops:
-    lastmodified: "2026-05-02T14:19:13Z"
-    mac: ENC[AES256_GCM,data:sKMzYey0fs+uydADSBSqRD84RZRjqiRYVg7lP7U0sYzo/0rM2Jz5QJeEZ+HO6MVd0SqzNJrWX72vDpY3Tzl+X/sjPvwHrlD7JJDEnKEBmBdBqi51Y3xAH+Xy/SM1tzOAg52PBv2d0YyD/lNK0REMYXHd5kXoqt4ti89gqhDuNUM=,iv:7QdY/mFfI99ZBefGcqhRI2WD7x9k5kauVye+BC6kUFw=,tag:0C4zn5YuU9wacEFH/ggxbQ==,type:str]
+    lastmodified: "2026-05-02T14:36:12Z"
+    mac: ENC[AES256_GCM,data:YdQflKCt1BXlVT1haK5PyKe/WgNPE6Oul6R1zcbLaXNkaZ1Z+JWVy27wunfTVDviWnh13ohwaBH6m+1/jOLGZs7eFUVXReJzUQcUvMWtgW0p1rM871H/0+wKHCvQSzTQvk/uVU9AvGpHxmEGtSQBQheawMAhmvs4B4pM0w9YdNg=,iv:z9OS7EaESosDOc2y2weT5mHlxGFO7RotEBBTNxHn2R4=,tag:/1gX8Evf2PKSrzmKxZRF9g==,type:str]
    pgp:
-        - created_at: "2026-05-02T14:19:12Z"
+        - created_at: "2026-05-02T14:36:10Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/+Ot53Cy0R/rB6qMMY2xLRVxuLQF1wZ+BtUXYVcFxQgumF
-            q9lB9/O03dZp33pTgZwCP8LEFx/NRexMuQxbtRH7gg6c21PSByJ6tBlcjiQOi2Vw
-            rQz+Bn+CCljSHuGJEU6LCbImhzWobvsLUSLmZDU8e1RiIyqweINlSWrmRa0beY/o
-            aEX2kez+pYKhLIRB7C4+nTX/xSEtC4ZZpPyzirTfGbioRZOSp1LnbaI1bFPaX7+d
-            /+Tg/baAMkfunBZ+kOeYbPVYYiUBB4NxOraqfwmvCIXC9ip2yIu71VclKqFmBhCQ
-            1P21tzY5JuPJEO8hRN3L0Lzqazm0Lfo5DI0vkE9YJi2SM+TtGW+GOoJvwbDBoYX+
-            WSFkdZbi0Ky6maSh2bXiq2s/J0iQhrvo/NtdH8KDlwYd7BXZmo5AmnETdxCK+FDW
-            SRVV2PrNhfwIbMourIn7SDraf2xSly5mlXu6sjVwKZf9TsYJukWb+fBopwp3eqCZ
-            iSrfySdmz7jTUtAsZxZ8oJrWE7zNnhgRxyyDs3vCG1fRR082vm9ArmzyruVubhCL
-            mCfiIDCcg1qTwpysb2Qmu8j+woSAG1oiUywx8ZKrP9/kOFsm7mlzv79f1WiSoFvc
-            pROzeyY6hcfG9VwWhsKOggJNWcKLdDt3oVu5MhMNvGqqIDVDjQRWH9k1kOiAEAvS
-            XgEgnkp+IPaaINeF7IxEqvEXx7zg/hC0soZ+erWKIX8GBIkGDFv/DQLzIDpPyZnp
-            dJEcPqosrrsCH3v8cF6fa7p3lPC5CD2tplrd7Phcp3Q+/Ix42eFIJV7SnoIF2+E=
-            =WH3K
+            hQIMA7uy4qQr71wiARAArQqDtkqGx+33d97I/kjpKcrhOZfgSmM7f9uDCdvCFQsO
+            X3yWCfwlCO5ZH3ZJkMRIE7AKT3lXUk1W2zxAvxTPXhQokh6jsUF5/Ih/PEZe2uGU
+            nCpkWE44EBKSSIsfsLlrkpvITa+9ErOKQBytBZrEUlTzFKCMxMYUApCHLXA18e3c
+            uYwKFuyKHzvpOrcnEY+ww+ZHLXL4exPhX79+uhn/BG0k70i39wgGuIZWdfvUVN+x
+            4UFkYvLWRexoFnqTStbuD7IX0O7BIBfliSJjqNCJOi3CO7GXwZ6r4D1B+S6tyxEs
+            JHEwGmR6n1sCjJyrP2toAFhOrFpky6HbOzehdMf3xVm7ry2LmUllrx43HKfjhY91
+            A0vpVAHGkwcUBYBxIQL4L6yeDUsrPLkYeJFCgRsppvPguOH3ZSLqKXx77UFgT+yi
+            lfYRKRnYxfY6wADQ+xhXxgtuHcEezile3s1b9xc6gMgzfuukBrd/WcgexO+c0feY
+            GmFoyfOcxCai+RCSW5eiXRDSdgxKSaTuGdPzLYtMeyceoXY/ML8yRZR/fpSZGNUp
+            1DPFHssmpJMhUjB/XhkkoC025nrLhgWQj9tIrEkBsFmPXk7wfiBj6y50oNwww+MK
+            X/E6mHvIt9ASSUAEaNHqMDZEOXz67qv2YbkTqw/UBCC6ehQXhOkMm7IRSp9iL6zS
+            XAG1+7cdB/aDluAbOAdBA8YMyLn/NrLTf5UB1TdgJmmHqmVsihwX+UCcKRdu8Q8W
+            bbpBVKQA1cjDw0k8jl9eUN/azMuv8xBXuzyvOKImLnUp7FJFhMS1BWD2CQL3
+            =jBX7
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$