|
 |
d89b54 |
# Fedora/EPEL version of dnssec-trigger.conf
|
|
|
d89b54 |
|
|
|
d89b54 |
# logging detail, 0=only errors, 1=operations, 2=detail, 3,4 debug detail.
|
|
|
d89b54 |
# verbosity: 1
|
|
|
d89b54 |
|
|
|
d89b54 |
# pidfile location
|
|
|
d89b54 |
pidfile: "/var/run/dnssec-triggerd.pid"
|
|
|
d89b54 |
|
|
|
d89b54 |
# log to a file instead of syslog, default is to syslog
|
|
|
d89b54 |
# logfile: "/var/log/dnssec-trigger.log"
|
|
|
d89b54 |
|
|
|
d89b54 |
# log to syslog, or (log to to stderr or a logfile if specified). yes or no.
|
|
|
d89b54 |
# use-syslog: yes
|
|
|
d89b54 |
|
|
|
d89b54 |
# chroot to this directory
|
|
|
d89b54 |
# chroot: ""
|
|
|
d89b54 |
|
|
|
d89b54 |
# the unbound-control binary if not found in PATH.
|
|
|
d89b54 |
# commandline options can be appended "unbound-control -c my.conf" if you wish.
|
|
|
d89b54 |
# unbound-control: "/usr/sbin/unbound-control"
|
|
|
d89b54 |
|
|
|
d89b54 |
# where is resolv.conf to edit.
|
|
|
d89b54 |
# resolvconf: "/etc/resolv.conf"
|
|
|
d89b54 |
|
|
|
d89b54 |
# the domain example.com line (if any) to add to resolv.conf(5). default none.
|
|
|
d89b54 |
# domain: ""
|
|
|
d89b54 |
|
|
|
d89b54 |
# domain name search path to add to resolv.conf(5). default none.
|
|
|
d89b54 |
# the search path from DHCP is not picked up, it could be used to misdirect.
|
|
|
d89b54 |
# search: ""
|
|
|
d89b54 |
|
|
|
d89b54 |
# the command to run to open login pages on hot spots, a web browser.
|
|
|
d89b54 |
# empty string runs no command.
|
|
|
d89b54 |
# login-command: "xdg-open"
|
|
|
d89b54 |
|
|
|
d89b54 |
# the url to open to get hot spot login, it gets overridden by the hotspot.
|
|
|
d89b54 |
# login-location: "http://www.nlnetlabs.nl/projects/dnssec-trigger"
|
|
|
d89b54 |
# should to be a ttl=0 entry
|
|
|
d89b54 |
login-location: "http://hotspot-nocache.fedoraproject.org/"
|
|
|
d89b54 |
|
|
|
d89b54 |
# do not perform actions (unbound-control or resolv.conf), for a dry-run.
|
|
|
d89b54 |
# noaction: no
|
|
|
d89b54 |
|
|
|
d89b54 |
# port number to use for probe daemon.
|
|
|
d89b54 |
# port: 8955
|
|
|
d89b54 |
|
|
|
d89b54 |
# keys and certificates generated by the dnssec-trigger-keygen systemd service
|
|
|
d89b54 |
# (which called dnssec-trigger-control-setup)
|
|
|
d89b54 |
server-key-file: "/etc/dnssec-trigger/dnssec_trigger_server.key"
|
|
|
d89b54 |
server-cert-file: "/etc/dnssec-trigger/dnssec_trigger_server.pem"
|
|
|
d89b54 |
control-key-file: "/etc/dnssec-trigger/dnssec_trigger_control.key"
|
|
|
d89b54 |
control-cert-file: "/etc/dnssec-trigger/dnssec_trigger_control.pem"
|
|
|
d89b54 |
|
|
|
d89b54 |
# check for updates, download and ask to install them (for Windows, OSX).
|
|
|
d89b54 |
# check-updates: no
|
|
|
d89b54 |
|
|
|
d89b54 |
# webservers that are probed to see if internet access is possible.
|
|
|
d89b54 |
# They serve a simple static page over HTTP port 80. It probes a random url:
|
|
|
d89b54 |
# after a space is the content expected on the page, (the page can contain
|
|
|
d89b54 |
# whitespace before and after this code). Without urls it skips http probes.
|
|
|
d89b54 |
|
|
|
d89b54 |
# provided by NLnetLabs
|
|
|
d89b54 |
# It is provided on a best effort basis, with no service guarantee.
|
|
|
d89b54 |
# url: "http://ster.nlnetlabs.nl/hotspot.txt OK"
|
|
|
d89b54 |
|
|
|
d89b54 |
# provided by FedoraProject
|
|
|
d89b54 |
url: "http://fedoraproject.org/static/hotspot.txt OK"
|
|
|
d89b54 |
|
|
|
d89b54 |
# fallback open DNSSEC resolvers that run on TCP port 80 and TCP port 443.
|
|
|
d89b54 |
# the ssl443 adds an ssl server IP, if you specify a hash it is checked, put
|
|
|
d89b54 |
# the following on one line: ssl443:<space><IP><space><HASHoutput>
|
|
|
d89b54 |
# hash is output of openssl x509 -sha256 -fingerprint -in server.pem
|
|
|
d89b54 |
# You can add more with extra config lines.
|
|
|
d89b54 |
|
|
|
d89b54 |
# Provided by fedoraproject.org, #fedora-admin
|
|
|
d89b54 |
# It is provided on a best effort basis, with no service guarantee.
|
|
|
d89b54 |
ssl443: 140.211.169.201 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
|
|
|
d89b54 |
tcp80: 140.211.169.201
|
|
|
d89b54 |
ssl443: 66.35.62.163 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
|
|
|
d89b54 |
tcp80: 66.35.62.163
|
|
|
d89b54 |
ssl443: 152.19.134.150 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
|
|
|
d89b54 |
tcp80: 152.19.134.150
|
|
|
d89b54 |
ssl443: 2610:28:3090:3001:dead:beef:cafe:fed9 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
|
|
|
d89b54 |
tcp80: 2610:28:3090:3001:dead:beef:cafe:fed9
|
|
|
d89b54 |
|
|
|
d89b54 |
# provided by Paul Wouters (pwouters@redhat.com)
|
|
|
d89b54 |
# It is provided on a best effort basis, with no service guarantee.
|
|
|
d89b54 |
# tcp80: 193.110.157.123
|
|
|
d89b54 |
# tcp80: 2001:888:2003:1004::123
|
|
|
d89b54 |
# ssl443: 193.110.157.123 16:41:49:E0:9D:62:CD:DB:79:A7:2B:71:58:C4:D5:E8:70:FA:BF:4D:6D:36:CC:07:35:33:C0:16:17:1B:61:E7
|
|
|
d89b54 |
# ssl443: 2001:888:2003:1004::123 16:41:49:E0:9D:62:CD:DB:79:A7:2B:71:58:C4:D5:E8:70:FA:BF:4D:6D:36:CC:07:35:33:C0:16:17:1B:61:E7
|
|
|
d89b54 |
|
|
|
d89b54 |
# provided by NLnetLabs (www.nlnetlabs.nl)
|
|
|
d89b54 |
# It is provided on a best effort basis, with no service guarantee.
|
|
|
d89b54 |
# tcp80: 213.154.224.3
|
|
|
d89b54 |
# tcp80: 2001:7b8:206:1:bb::
|
|
|
d89b54 |
# ssl443: 213.154.224.3 DC:22:7B:1C:00:1A:CE:C5:48:49:B1:E3:30:DE:61:93:61:12:4E:CB:5C:B4:33:C4:BC:75:8C:D6:16:9D:F0:9F
|
|
|
d89b54 |
# ssl443: 2001:7b8:206:1:bb:: DC:22:7B:1C:00:1A:CE:C5:48:49:B1:E3:30:DE:61:93:61:12:4E:CB:5C:B4:33:C4:BC:75:8C:D6:16:9D:F0:9F
|
|
|
d89b54 |
|