Server configuration
Copies of the configuration running on dnsbunker.org on 14 October 2026, published with the privacy audit. Passwords, API keys and abuse thresholds are replaced with [REDACTED]. The SHA-256 checksums are listed in section 9 of the signed audit.
dnsdist.conf.txt
/etc/dnsdist/dnsdist.conf: DNS frontend (DoT, DoH, DoQ, DNSCrypt)recursor.conf.txt
/etc/powerdns/recursor.conf: recursive resolverrpz-00-local.rpz.txt
/etc/powerdns/rpz/00-local.rpz: own blocklistrpz-10-allow.rpz.txt
/etc/powerdns/rpz/10-allow.rpz: HaGeZi allowlistrpz-20-deny.rpz.txt
/etc/powerdns/rpz/20-deny.rpz: HaGeZi denylistrpz.dnsbunker.org.zone.txt
/etc/powerdns/zones/rpz.dnsbunker.org.zone: target zone for blocked namesrpz-update.txt
/usr/local/sbin/rpz-update: blocklist updaterCaddyfile.txt
/etc/caddy/Caddyfile: website and DoH proxycaddy-config-build.txt
/usr/local/sbin/caddy-config-build: Caddy config, ECH and TLS ticket settingslighttpd.conf.txt
/etc/lighttpd/lighttpd.conf: static websitechrony.conf.txt
/etc/chrony/chrony.conf: public time servicejournald.conf.txt
/etc/systemd/journald.conf: volatile system journalnftables.conf.txt
/etc/nftables.conf: firewallsshd-10-dnsbunker.conf.txt
/etc/ssh/sshd_config.d/10-dnsbunker.conf: SSH, keys onlysystemd-swap-dropins.txt
/etc/systemd/system.control/*/50-MemorySwapMax.conf: no swap for five services (concatenated)dnsbunker-stats.txt
/usr/local/sbin/dnsbunker-stats: statistics collectordnsbunker-stats.service.txt
/etc/systemd/system/dnsbunker-stats.service: sandbox of the statistics collectordnsdist-dnscrypt-dropin.conf.txt
/etc/systemd/system/dnsdist.service.d/dnscrypt.conf: RAM directory for DNSCrypt keyssysctl-99-dnsbunker.conf.txt
/etc/sysctl.d/99-dnsbunker.conf: kernel settings, including disabled core dumpsruntime-state.txt
Runtime state: versions, sockets, swap limits, core dumps, journal, /var/log