config

type Config struct {
	Version      string
	Directory    string
	BlockLists   []string
	BlockListDir string
	RootServers  []string
	Root6Servers []string
	DNSSEC       string
	RFC8198      *bool `toml:"rfc8198"` // nil is default-on for backward compatibility
	RFC9520      *bool `toml:"rfc9520"` // nil is default-on; false is an emergency kill switch
	ServeStale   bool  `toml:"serve_stale"`
	// ServeStaleMaxTTL caps how long a positive answer may be reused after
	// its admitted TTL expires. Omission defaults to 24 hours. An explicit
	// zero leaves the delegation lease as the only bound; in forwarder mode,
	// where no delegation cut is learned, that means retention until eviction.
	// Serve-stale itself remains opt-in through ServeStale.
	ServeStaleMaxTTL Duration `toml:"serve_stale_max_ttl"`
	RootKeys         []string
	FallbackServers  []string
	ForwarderServers []string
	// ForwardZones route individual zones to their own upstreams. They are
	// consulted before ForwarderServers, which remains the whole-server
	// setting: a query matching no zone resolves normally.
	ForwardZones    []ForwardZoneConfig `toml:"forward_zone"`
	AccessList      []string
	LogLevel        string
	AccessLog       string
	Bind            string
	BindTLS         string
	BindDOH         string
	BindDOQ         string
	TLSCertificate  string
	TLSPrivateKey   string
	API             string
	BearerToken     string //nolint:gosec // G117 - not a hardcoded credential, loaded from config file
	Nullroute       string
	Nullroutev6     string
	HostsFile       string
	OutboundIPs     []string
	OutboundIP6s    []string
	Timeout         Duration
	QueryTimeout    Duration
	Expire          uint32
	CacheSize       int
	Prefetch        uint32
	Maxdepth        int
	RateLimit       int
	ClientRateLimit int
	NSID            string
	Blocklist       []string
	Whitelist       []string
	Chaos           bool
	// QnameMinLevel is deprecated and retained so older configs keep
	// parsing. It capped minimization by delegation depth rather than by
	// the queries a lookup spends, which is what RFC 9156 section 2.3
	// bounds. A non-zero value here is folded onto QnameMaxMinimizeCount
	// when that is unset. Remove it from new configs.
	QnameMinLevel int `toml:"qname_min_level"`
	// QnameMaxMinimizeCount is RFC 9156's MAX_MINIMISE_COUNT: the total
	// minimized queries one lookup may spend before the full name goes
	// out. 0 disables minimization entirely. A pointer because an explicit
	// zero and an absent key mean different things: written zero is the
	// operator switching minimization off, and it must win even when the
	// deprecated qname_min_level is still in the file; only an absent key
	// falls back to it.
	QnameMaxMinimizeCount *int `toml:"qname_max_minimize_count"`
	// QnameMinimizeOneLabel is RFC 9156's MINIMISE_ONE_LAB: how many of
	// those queries add a single label before the remaining labels are
	// grouped over the queries left. 0 selects the RFC's suggested 4;
	// grouping from the first query would expose a deep name almost at
	// once, so it is not an available setting.
	QnameMinimizeOneLabel int `toml:"qname_minimize_one_label"`

	// HyperlocalRoot serves the root zone from a local copy (RFC 8806):
	// transferred over AXFR from the root servers that publish it,
	// verified against the ZONEMD digest (RFC 8976) chained to the root
	// trust anchors, refreshed on the zone's own SOA schedule, and
	// withdrawn past its SOA expire — the resolver then walks to the real
	// root servers as if the copy never existed.
	HyperlocalRoot bool `toml:"hyperlocal_root"`
	// HyperlocalRootSources overrides the built-in transfer sources
	// (host:port). Empty selects the RFC 8806 appendix set.
	HyperlocalRootSources []string `toml:"hyperlocal_root_sources"`

	EmptyZones []string

	// RPZ subscribes the resolver to Response Policy Zones — operator- or
	// vendor-fed zones that rewrite, deny, or drop answers for the names
	// they list, in the standard RPZ encoding so existing feeds work
	// unmodified. Off by default; semantics in the README's Response
	// Policy Zones section.
	RPZ RPZ `toml:"rpz"`

	// Views are per-client static answers, evaluated in order. A
	// query whose source IP falls in a view's Sources gets that
	// view's Records as the response; non-matching queries fall
	// through to the rest of the middleware chain (blocklist,
	// resolver, etc.).
	Views []ViewConfig

	// Dnstap configuration
	DnstapSocket        string
	DnstapIdentity      string
	DnstapVersion       string
	DnstapLogQueries    bool
	DnstapLogResponses  bool
	DnstapFlushInterval int

	// Domain metrics configuration
	DomainMetrics      bool
	DomainMetricsLimit int

	// Kubernetes middleware configuration as a section
	Kubernetes KubernetesConfig `toml:"kubernetes"`

	// DNS64 middleware configuration (RFC 6147). Translates A
	// records into AAAA records embedded in a configured IPv6
	// prefix, so an IPv6-only client can reach IPv4-only services.
	DNS64 DNS64Config `toml:"dns64"`

	// ECS (EDNS Client Subnet, RFC 7871) policy. Default-disabled
	// per §11 privacy guidance: the resolver strips client ECS on
	// the way out unless the operator opts in via [ecs].enabled.
	// Stage 1 of the feature uses Enabled / ForwardV4Max /
	// ForwardV6Max / ClientNetworks for upstream forwarding; the
	// remaining fields ride along for the Stage 2 cache changes
	// so the on-disk schema only bumps once.
	ECS ECSConfig `toml:"ecs"`

	// RecursionFirewall bounds aggregate work across one recursive
	// request tree. Shadow mode records limit crossings without
	// changing responses; enforce mode terminates over-budget work.
	RecursionFirewall RecursionFirewallConfig `toml:"recursion_firewall"`

	Plugins map[string]Plugin

	CookieSecret string
	IPv6Access   bool `toml:"ipv6access"`

	// TCP connection pooling configuration
	TCPKeepalive      bool
	RootTCPTimeout    Duration // Timeout for root server TCP connections
	TLDTCPTimeout     Duration // Timeout for TLD server TCP connections
	TCPMaxConnections int      // Maximum number of TCP connections to pool

	// Resolver concurrency limits
	MaxConcurrentQueries int // Maximum concurrent DNS queries (default 10000)

	// Server ingress bounds. These are deliberately separate from
	// MaxConcurrentQueries, which is the resolver's upstream fan-out
	// semaphore. Left at zero, each derives from the machine's resource
	// plan (memory, CPUs, descriptor limit); nothing is preallocated —
	// admission is capped, slabs are created on demand and parked in an
	// idle cache between requests.
	IngressWorkers  int // Fixed handler workers per listener (default: derived from CPUs and memory)
	IngressQueue    int // Ready-queue depth before a job is served on its own goroutine (default 64)
	IngressTCPConns int // Concurrent inbound TCP/DoT connection cap (default: derived from available memory)

	// MemoryTrim returns a burst's slab memory to the operating system
	// after a long idle. Off by default: the trim is one synchronous GC
	// over the whole process, which a busy or big-memory server never
	// needs and a single small core feels. Meant for memory-constrained
	// devices (containers on routers, small VPSes) where resident memory
	// after a traffic burst matters more than an idle-time pause.
	MemoryTrim bool

	// Reflex: DNS amplification/reflection attack detection
	ReflexEnabled      bool    // Enable amplification attack detection
	ReflexBlockMode    bool    // If false, only log but don't block
	ReflexLearningMode bool    // If true, log detections but don't block
	ReflexThreshold    float64 // Suspicion threshold (0.0-1.0, default: 0.7)
	// contains filtered or unexported fields
}

type DNS64Config struct {
	Enabled             bool     `toml:"enabled"`
	Prefixes            []string `toml:"prefixes"`
	ClientNetworks      []string `toml:"client_networks"`
	ExcludeZones        []string `toml:"exclude_zones"`
	ExcludeANetworks    []string `toml:"exclude_a_networks"`
	ExcludeAAAANetworks []string `toml:"exclude_aaaa_networks"`
}

type Duration struct {
	time.Duration
}

type ECSConfig struct {
	Enabled        bool     `toml:"enabled"`
	ForwardV4Max   uint8    `toml:"forward_v4"`
	ForwardV6Max   uint8    `toml:"forward_v6"`
	ClientNetworks []string `toml:"client_networks"`
	CacheLimitTTL  Duration `toml:"cache_limit_ttl"`
	MinScopeV4     uint8    `toml:"min_scope_v4"`
	MinScopeV6     uint8    `toml:"min_scope_v6"`
}

type ForwardZoneConfig struct {
	// Name is the zone apex. Queries at or below it are forwarded.
	Name string `toml:"name"`
	// Servers are the upstreams, in the same forms as forwarderservers:
	// "ip:port", "tls://ip:port", or an https:// URL.
	Servers []string `toml:"servers"`
}

type KubernetesConfig struct {
	Enabled       bool   `toml:"enabled"`
	ClusterDomain string `toml:"cluster_domain"`
	// KillerMode is deprecated and ignored. The kubernetes middleware
	// always uses the sharded registry; the field is retained so
	// older configs parse without error. Remove it from new configs.
	KillerMode bool   `toml:"killer_mode"`
	Kubeconfig string `toml:"kubeconfig"`
	// Demo populates the registry with synthetic services so the
	// middleware can be exercised without a real cluster
	// (development / tests). It is NEVER safe to enable in
	// production: the middleware will answer synthesised names
	// that look real. Independent from Enabled.
	Demo bool                `toml:"demo"`
	TTL  KubernetesTTLConfig `toml:"ttl"`
}

type KubernetesTTLConfig struct {
	Service uint32 `toml:"service"`
	Pod     uint32 `toml:"pod"`
	SRV     uint32 `toml:"srv"`
	PTR     uint32 `toml:"ptr"`
}

type Plugin struct {
	Path   string
	Config map[string]any
}

type RPZ struct {
	Enabled bool `toml:"enabled"`
	// Mode is "shadow" (the default: every match is counted and logged,
	// nothing is rewritten) or "enforce". An operator turns a new feed on
	// in shadow, watches the counters, then flips.
	Mode  string    `toml:"mode"`
	Zones []RPZZone `toml:"zone"`
}

type RPZZone struct {
	// Name labels the zone in metrics, logs, and the EDE text.
	Name string `toml:"name"`
	// File is the policy zone in standard zone-file format.
	File string `toml:"file"`
	// Source is the AXFR primary (host:port). The zone then follows its
	// own SOA schedule — probe on refresh, transfer on serial change,
	// withdraw past expire — and File must be empty.
	Source string `toml:"source"`
	// Origin is the policy zone's apex, the name the AXFR asks for.
	// Required with Source.
	Origin string `toml:"origin"`
	// TsigKey authenticates the transfer when the provider requires it:
	// "name:algorithm:base64-secret", e.g.
	// "feedkey.:hmac-sha256.:c2VjcmV0". Empty for an unsigned transfer.
	TsigKey string `toml:"tsig_key"`
	// Policy overrides every action the zone's rules carry:
	// given|passthru|nxdomain|nodata|drop|tcp-only|cname|disabled.
	// "given" (or empty) uses what each rule says; "disabled" logs what
	// would have happened and lets a later zone act.
	Policy string `toml:"policy"`
	// Cname is the rewrite target when Policy is "cname", the draft's
	// walled-garden override. Required then, forbidden otherwise.
	Cname string `toml:"cname"`
}

type RecursionFirewallConfig struct {
	Mode                    RecursionFirewallMode `toml:"mode"`
	MaxOutboundQueries      uint32                `toml:"max_outbound_queries"`
	MaxInternalQueries      uint32                `toml:"max_internal_queries"`
	MaxDNSKEYCandidates     uint32                `toml:"max_dnskey_candidates"`
	MaxRRsetSignatureChecks uint32                `toml:"max_rrset_signature_checks"`
	MaxSignatureChecks      uint32                `toml:"max_signature_checks"`
	MaxDSDigests            uint32                `toml:"max_ds_digests"`
	MaxNSEC3Hashes          uint32                `toml:"max_nsec3_hashes"`
	MaxConcurrentCrypto     uint32                `toml:"max_concurrent_crypto"`
	FailureCacheSize        int                   `toml:"failure_cache_size"`
	FailureCacheMinTTL      Duration              `toml:"failure_cache_min_ttl"`
	FailureCacheMaxTTL      Duration              `toml:"failure_cache_max_ttl"`
}

type RecursionFirewallMode string

type ViewConfig struct {
	Zone     string
	Networks []string
	Answers  []string
}