{
	email [REDACTED]
	dns cloudflare {env.CF_API_TOKEN}
	ech dnsbunker.org
	grace_period 3s

	log {
		exclude http.log.error
		level WARN
		format filter {
			wrap json
			request>remote_ip delete
			request>remote_port delete
			request>client_ip delete
			request>headers delete
			remote_addr delete
			error regexp `(\[[0-9A-Fa-f:.]+\]|\b[0-9]{1,3}(\.[0-9]{1,3}){3}):[0-9]+` "[redacted]"
			request>uri query {
				delete dns
			}
		}
	}

	servers {
		keepalive_interval 10s
		keepalive_idle 10s
		keepalive_count 3
		max_header_size 16KB

		timeouts {
			read_body 5s
			read_header 5s
			write 10s
			idle 120s
		}
	}
}

(hardened_headers) {
	header {
		Server "DNSBunker"
		X-Frame-Options "DENY"
		X-Content-Type-Options "nosniff"
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		Permissions-Policy "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()"
		Referrer-Policy "no-referrer"
		Content-Security-Policy "default-src 'self'; base-uri 'none'; connect-src 'self' https://check.dnsbunker.org https://*.check.dnsbunker.org; font-src 'self'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'"
		-X-Powered-By
	}
}

(admin_headers) {
	header {
		X-Frame-Options "DENY"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "no-referrer"
		Strict-Transport-Security "max-age=31536000"
		-Server
		-X-Powered-By
	}
}

(method_lockdown) {
	@bad_method not method GET HEAD
	handle @bad_method {
		header Allow "GET, HEAD"
		respond "Method Not Allowed" 405
	}
}

# [REDACTED: access restriction of the operator administration host]

(doh_proxy) {
	request_body {
		max_size 16KB
	}

	reverse_proxy 127.0.0.1:8053 {
		lb_retries 2
		lb_try_interval 0
		lb_retry_match {
			method GET POST
		}
		request_buffers 16KB

		transport http {
			versions h2c
			compression off
			keepalive 120s
			keepalive_idle_conns 128
			dial_timeout 1s
			response_header_timeout 10s
			max_response_header 16KiB
		}

		flush_interval -1
	}
}

:80 {
	abort
}

:443 {
	abort
}

www.dnsbunker.org {
	import hardened_headers

	tls /etc/ssl/dnsbunker_rapidssl/fullchain.pem /etc/ssl/dnsbunker_rapidssl/privkey.pem

	rate_limit {
		zone www_client {
			key {remote_host}
			events [REDACTED]
			window 1s
			ipv4_prefix 32
			ipv6_prefix 64
		}
	}

	redir https://dnsbunker.org{uri} 308
}

dnsbunker.org {
	import hardened_headers

	tls /etc/ssl/dnsbunker_rapidssl/fullchain.pem /etc/ssl/dnsbunker_rapidssl/privkey.pem

	rate_limit {
		zone doh_client {
			match {
				path /dns-query
			}
			key {remote_host}
			events [REDACTED]
			window 1s
			ipv4_prefix 32
			ipv6_prefix 64
		}

		zone site_client {
			match {
				not {
					path /dns-query
				}
			}
			key {remote_host}
			events [REDACTED]
			window 1s
			ipv4_prefix 32
			ipv6_prefix 64
		}
	}

	handle /dns-query {
		header Access-Control-Allow-Origin "*"

		@doh_preflight method OPTIONS
		handle @doh_preflight {
			header Access-Control-Allow-Methods "GET, POST, OPTIONS"
			header Access-Control-Allow-Headers "Content-Type, Accept"
			header Access-Control-Max-Age "86400"
			respond 204
		}

		@doh_bad_method not method GET POST
		handle @doh_bad_method {
			header Allow "GET, POST, OPTIONS"
			respond "Method Not Allowed" 405
		}

		import doh_proxy
	}

	import method_lockdown

	handle {
		encode zstd gzip
		reverse_proxy 127.0.0.1:53888 {
			header_up -X-Forwarded-For
			transport http {
				keepalive 120s
				keepalive_idle_conns 16
				dial_timeout 1s
			}
		}
	}
}

check.dnsbunker.org, *.check.dnsbunker.org {
	import hardened_headers

	tls {
		dns cloudflare {env.CF_API_TOKEN}
	}

	rate_limit {
		zone check_client {
			key {remote_host}
			events [REDACTED]
			window 1s
			ipv4_prefix 32
			ipv6_prefix 64
		}
	}

	header {
		Access-Control-Allow-Origin "https://dnsbunker.org"
		Cache-Control "no-store"
		Content-Type "application/json"
	}

	import method_lockdown

	respond `{"dnsbunker":true}` 200
}

# [REDACTED: operator administration host. It serves the password-protected dnsdist statistics dashboard and is reachable only through Cloudflare.]