config

type Config struct {
	Version          string
	Directory        string
	BlockLists       []string
	BlockListDir     string
	RootServers      []string
	Root6Servers     []string
	DNSSEC           string
	RootKeys         []string
	FallbackServers  []string
	ForwarderServers []string
	AccessList       []string
	LogLevel         string
	AccessLog        string
	Bind             string
	BindTLS          string
	BindDOH          string
	BindDOQ          string
	TLSCertificate   string
	TLSPrivateKey    string
	API              string
	BearerToken      string //nolint:gosec // G117 - not a hardcoded credential, loaded from config file
	Nullroute        string
	Nullroutev6      string
	HostsFile        string
	OutboundIPs      []string
	OutboundIP6s     []string
	Timeout          Duration
	QueryTimeout     Duration
	Expire           uint32
	CacheSize        int
	Prefetch         uint32
	Maxdepth         int
	RateLimit        int
	ClientRateLimit  int
	NSID             string
	Blocklist        []string
	Whitelist        []string
	Chaos            bool
	QnameMinLevel    int `toml:"qname_min_level"`
	EmptyZones       []string

	// Views are per-client static answers, evaluated in order. A
	// query whose source IP falls in a view's Sources gets that
	// view's Records as the response; non-matching queries fall
	// through to the rest of the middleware chain (blocklist,
	// resolver, etc.).
	Views []ViewConfig

	// Dnstap configuration
	DnstapSocket        string
	DnstapIdentity      string
	DnstapVersion       string
	DnstapLogQueries    bool
	DnstapLogResponses  bool
	DnstapFlushInterval int

	// Domain metrics configuration
	DomainMetrics      bool
	DomainMetricsLimit int

	// Kubernetes middleware configuration as a section
	Kubernetes KubernetesConfig `toml:"kubernetes"`

	// DNS64 middleware configuration (RFC 6147). Translates A
	// records into AAAA records embedded in a configured IPv6
	// prefix, so an IPv6-only client can reach IPv4-only services.
	DNS64 DNS64Config `toml:"dns64"`

	// ECS (EDNS Client Subnet, RFC 7871) policy. Default-disabled
	// per §11 privacy guidance: the resolver strips client ECS on
	// the way out unless the operator opts in via [ecs].enabled.
	// Stage 1 of the feature uses Enabled / ForwardV4Max /
	// ForwardV6Max / ClientNetworks for upstream forwarding; the
	// remaining fields ride along for the Stage 2 cache changes
	// so the on-disk schema only bumps once.
	ECS ECSConfig `toml:"ecs"`

	Plugins map[string]Plugin

	CookieSecret string
	IPv6Access   bool `toml:"ipv6access"`

	// TCP connection pooling configuration
	TCPKeepalive      bool
	RootTCPTimeout    Duration // Timeout for root server TCP connections
	TLDTCPTimeout     Duration // Timeout for TLD server TCP connections
	TCPMaxConnections int      // Maximum number of TCP connections to pool

	// Resolver concurrency limits
	MaxConcurrentQueries int // Maximum concurrent DNS queries (default 10000)

	// Reflex: DNS amplification/reflection attack detection
	ReflexEnabled      bool    // Enable amplification attack detection
	ReflexBlockMode    bool    // If false, only log but don't block
	ReflexLearningMode bool    // If true, log detections but don't block
	ReflexThreshold    float64 // Suspicion threshold (0.0-1.0, default: 0.7)
	// contains filtered or unexported fields
}

type DNS64Config struct {
	Enabled             bool     `toml:"enabled"`
	Prefixes            []string `toml:"prefixes"`
	ClientNetworks      []string `toml:"client_networks"`
	ExcludeZones        []string `toml:"exclude_zones"`
	ExcludeANetworks    []string `toml:"exclude_a_networks"`
	ExcludeAAAANetworks []string `toml:"exclude_aaaa_networks"`
}

type Duration struct {
	time.Duration
}

type ECSConfig struct {
	Enabled        bool     `toml:"enabled"`
	ForwardV4Max   uint8    `toml:"forward_v4"`
	ForwardV6Max   uint8    `toml:"forward_v6"`
	ClientNetworks []string `toml:"client_networks"`
	CacheLimitTTL  Duration `toml:"cache_limit_ttl"`
	MinScopeV4     uint8    `toml:"min_scope_v4"`
	MinScopeV6     uint8    `toml:"min_scope_v6"`
}

type KubernetesConfig struct {
	Enabled       bool   `toml:"enabled"`
	ClusterDomain string `toml:"cluster_domain"`
	// KillerMode is deprecated and ignored. The kubernetes middleware
	// always uses the sharded registry; the field is retained so
	// older configs parse without error. Remove it from new configs.
	KillerMode bool   `toml:"killer_mode"`
	Kubeconfig string `toml:"kubeconfig"`
	// Demo populates the registry with synthetic services so the
	// middleware can be exercised without a real cluster
	// (development / tests). It is NEVER safe to enable in
	// production: the middleware will answer synthesised names
	// that look real. Independent from Enabled.
	Demo bool                `toml:"demo"`
	TTL  KubernetesTTLConfig `toml:"ttl"`
}

type KubernetesTTLConfig struct {
	Service uint32 `toml:"service"`
	Pod     uint32 `toml:"pod"`
	SRV     uint32 `toml:"srv"`
	PTR     uint32 `toml:"ptr"`
}

type Plugin struct {
	Path   string
	Config map[string]any
}

type ViewConfig struct {
	Zone     string
	Networks []string
	Answers  []string
}