# Router with DNS-based advertising and malware blocking.
version: 1

system:
  hostname: pebble
  timezone: Europe/London

network:
  wan:
    device: igb0
    ipv4:
      mode: dhcp
  lan:
    device: igb1
    ipv4:
      address: 192.168.10.1/24
  ipv6:
    mode: disabled

dhcp:
  enabled: true
  authoritative: true
  start: 192.168.10.100
  end: 192.168.10.199
  lease_duration: 12h
  domain: home.arpa

dns:
  enabled: true
  recursive: true
  dnssec: true
  cache_mb: 64
  records:
    - name: nas.home.arpa
      type: A
      value: 192.168.10.20
  blocking:
    enabled: true
    # nxdomain: blocked names do not exist. null: they resolve to 0.0.0.0.
    response: nxdomain
    update_interval: 24h
    max_domains: 300000
    max_download_mb: 32
    lists:
      - name: stevenblack
        url: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
        format: hosts
      - name: hagezi-pro
        url: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/pro.txt
        format: domains
      # Names of DNS-over-HTTPS servers, so clients cannot look them up.
      - name: doh-domains
        url: https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/master/doh-domains.txt
        format: domains
    allowlist:
      - s.youtube.com
    denylist:
      - telemetry.example.com

wireguard:
  interfaces: []

firewall:
  default_inbound: deny
  default_forward: deny
  default_outbound: allow
  nat:
    enabled: true
    outbound: wan

  # Downloaded IP lists become PF tables, refreshed by cron. A failed
  # download keeps the previous list.
  ip_lists:
    update_interval: 24h
    lists:
      - name: doh
        url: https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/master/doh-ipv4.txt
        max_entries: 10000

  # Clients that hard-code a DNS-over-HTTPS server's address would bypass
  # the DNS blocklists above. Block HTTPS (TCP) and HTTP/3 (UDP) to the
  # known DoH servers; ordinary DNS on port 53 is unaffected.
  rules:
    - description: Block DNS-over-HTTPS bypass to known DoH servers
      action: block
      interface: lan
      protocol: tcp/udp
      source: lan
      destination: list:doh
      ports: ["443"]

management:
  ssh:
    enabled: true
    allow_from:
      - 192.168.10.0/24

updates:
  automatic_install: false

recovery:
  rollback_timeout: 120s
  keep_generations: 5