adam/jarl
1
0 Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases 34 Wiki Activity

DNS over TLS and HTTPS set up in one step

Browse Source 
jarl encrypted-dns setup (and the Encrypted DNS page) finds or obtains a
certificate for the host name, checks that nothing else listens on the
DoT and DoH ports at the chosen addresses (offering a free DoH port), and
stages named's tls statement and listeners as one change, keeping port 53
where it was when there was no listen-on, plus the host name's records in
the private views (local to the view in a linked zone). Status shows what
to give Android, Linux, Firefox, Chrome and Windows clients. A tls
statement with missing files is refused (tls_file_missing), and a
certificate named uses can't be deleted. docs/encrypted-dns.md, e2e with
real DoT and DoH queries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adamandClaude Opus 5.5 committed 2026-10-12 17:09:14 +01:00
1 parent ebd3a3dfbe
commit 66dcf53684
21 files changed
+1790 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/e2e.sh
+24
View File
@@ -764,6 +764,30 @@ if [ -n "$PEBBLE" ]; then
run "a second certificate for the web UI is refused (exit 6)" 6 $J cert create other --domain nas.adbraun.test --use web
run "certificate metrics" 0 curl -sf http://127.0.0.1:$HTTP/metrics
contains '^jarl_certificate_failing{certificate="ns1",source="acme"} 0$'
# Encrypted DNS set up by Jarl (docs/encrypted-dns.md), next to the
# hand-written listener above.
EDOT=${EDOT_PORT:-25855}; EDOH=${EDOH_PORT:-25856}
run "encrypted-dns: off" 0 $J encrypted-dns
contains "Encrypted DNS: *off"
run "encrypted-dns check: the ports are free" 0 $J encrypted-dns check --address 127.0.0.1 --doh-port $EDOH
contains "The ports are free"
run "encrypted-dns check: jarld's port is taken" 0 $J encrypted-dns check --address 127.0.0.1 --doh-port $HTTP
contains "jarld (Jarl's web UI and API) listens there"
run "encrypted-dns setup" 0 $J encrypted-dns setup --hostname ns1.adbraun.test --address 127.0.0.1 --dot-port $EDOT --doh-port $EDOH
run "status: on, with what to give clients" 0 $J encrypted-dns
contains "DNS over TLS: *127.0.0.1 port $EDOT"
contains "For DoH clients: *https://ns1.adbraun.test:$EDOH/dns-query"
run "DoT through the setup" 0 $DIG +tls +tls-ca=$E/pebble-root.pem +tls-hostname=ns1.adbraun.test +short -p $EDOT @127.0.0.1 nas.adbraun.test A
contains "^192.168.1.20$"
run "DoH through the setup" 0 $DIG +https +tls-ca=$E/pebble-root.pem +tls-hostname=ns1.adbraun.test +short -p $EDOH @127.0.0.1 nas.adbraun.test A
contains "^192.168.1.20$"
run "plain DNS still answers on port 53's listener" 0 $DIG +short -p $DNS @127.0.0.1 nas.adbraun.test A
contains "^192.168.1.20$"
run "a certificate named uses can't be deleted (exit 6)" 6 $J cert delete ns1 --yes
contains "take it out first"
run "encrypted-dns disable" 0 $J encrypted-dns disable
run "encrypted-dns: off again" 0 $J encrypted-dns
contains "Encrypted DNS: *off"
dot_id=$($J option list -o field=id,name,value | awk -F'\t' '$2 == "listen-on" && /tls e2e/ {print $1}')
run "named: remove the DoT listener" 0 $J option unset --id "$dot_id"
run "named: remove the tls block" 0 $J option unset tls --toplevel