1 Release 1 Tag

RSS Feed

• v0.0.1 3c2d0d41f0

  Compare

  v0.0.1 Stable

  mokhtar released this 2026-08-08 23:26:44 +00:00 | 1 commits to master since this release

  First release. Everything below is new.

  Added

  • Forwarding DNS server. UDP and TCP listeners with a wire-format parser and
    encoder written against RFC 1035 and EDNS(0), a bounded worker model, per-client
    rate limiting and a pause control that stops filtering without stopping
    resolution.
  • Encrypted upstreams. DNS-over-HTTPS and DNS-over-TLS clients over a pool
    that tracks per-upstream health and fails over, with SNI and certificate
    verification driven by a per-upstream TLS name.
  • DoH and DoT endpoints. nxdns also answers as an encrypted resolver, with a
    certificate store that reloads on disk changes and through the API, so renewals
    do not need a restart.
  • Blocklist filtering. Subscriptions in hosts, plain-domain and
    Adblock-Plus-style formats, compiled into a compact matcher; per-group allow
    and block rules with wildcards; safe-search enforcement.
  • Per-client policy groups. Clients are identified by address and assigned to
    groups, so the filtering a device gets depends on which device it is.
  • Local DNS. Local A/AAAA/CNAME/PTR records and conditional forwarding of
    internal zones to another resolver.
  • Cache. A bounded in-memory cache that respects upstream TTLs and expires
    entries rather than serving them stale.
  • Query log. Queries land in SQLite under a retention policy in both rows and
    days, with disk-full self-protection that degrades instead of corrupting, and a
    live SSE stream of the same events.
  • Web UI and REST API. A React single-page admin UI embedded in the binary,
    a REST API with a served OpenAPI document, session authentication, API rate
    limiting and Prometheus-style /metrics.
  • Configuration. A ZON configuration file seeds the database on first boot;
    after that the database is the truth, and nxdns export / nxdns import move
    configuration in and out. nxdns check validates a file without starting.
  • CLI. run, check, export, import, version and help.
  • Packaging. A hardened systemd unit with a sysusers fragment, and a
    FROM scratch container image holding the binary, a CA bundle and the licence
    files, assembled by a builder stage pinned to alpine:3.22 by digest. Nothing
    from Alpine ships in the published image except that CA bundle.
  • Releases. Tags publish five assets — static musl tarballs for
    x86_64-linux-musl and aarch64-linux-musl, IMAGE-DIGEST.txt naming the
    multi-architecture container image by digest, SHA256SUMS.txt over those
    three, and SHA256SUMS.txt.asc, a detached signature over the checksum file.
    zig build dist and zig build verify-dist produce and check the same
    artifacts on a laptop.
  • Licensing. EUPL-1.2, with a THIRD-PARTY-NOTICES file in every tarball and
    image assembled from a reviewed inventory of what the artifacts contain.
  • Documentation. A Diátaxis split — tutorial, how-to, reference, explanation —
    with drift guards that fail the build when the reference pages fall behind the
    code.

  Artifacts

  119a0f6fb4fb984cf2cdbb64d9182aca72a3d1f36e875287670e97faa94433a9  nxdns-0.0.1-x86_64-linux-musl.tar.gz
  bbfc148313e55080fd9776419207ccd5de9ea5db5ad90e133f2d03b09a78798e  nxdns-0.0.1-aarch64-linux-musl.tar.gz
  6be30347e352bfbbc326044f6ae3566dc6e46c03fa0c5a35f40524a721421089  IMAGE-DIGEST.txt
  

  git.mial.net/mokhtar/nxdns:0.0.1@sha256:f2945fbf6c1e16509f0e33e3d62da9a9cd7dc706718d333ce4edf95c80dbb00e
  

  All commits up to v0.0.1

  3c2d0d4 changelog: 0.0.1 releases today
  31a6f0c changelog and spec: dry run complete, restore 0.0.1, record deviations 25 and 26
  51d8281 release: name the image by the public registry host, not the internal server url
  266dde7 release: move publication orchestration into tools/release.zig, pin rotated subkey
  32cd9b8 release: refetch the annotated tag object that checkout replaces
  e14a29c changelog: temporary 0.0.0 section for the release dry run
  da4441b release: pin the artifact-signing subkey fingerprint
  004092a delete TECH_DEBT.md: all 71 findings closed by milestones 15-19
  cdacc56 milestone 14: build, package, sign and publish releases
  6c50799 milestone 19: hygiene sweep - dead ecs surface, single-source constants, tls classification, frontend state hazards, docker smoke network fix
  6f67940 milestone 18: collapse duplicated infrastructure into shared listener core, crud list helper, resource shells, transport race, name and line helpers, ui modules
  c50c6d2 milestone 17: real deadlines, validator holes, upstream editor, trusted proxies, contract samples, badvers
  9b12dba ci: deliver the smoke-test config via docker cp instead of a bind mount
  ee342c1 ci: create the zig fetch tmp dir the package fetcher assumes
  25455e5 milestone 16: behavioral fixes for silent failures, locks, counters and the query log
  5802148 record milestone 15 outcomes in spec and tech debt report
  9f8a5cd milestone 15: make a green run mean a real pass
  f289847 zig fmt src/safe_url.zig
  f47967e tech debt audit and cleanup specs for milestones 15-19
  8c33285 milestone 13 discrepancies: redact credentials from urls in logs, metrics and cli output
  1ff727f milestone 14 spec: build, package and publish releases
  16c9de2 milestone 13: restructure docs to diataxis, tutorial, every command executed
  35f2324 fix blocklist fetcher aborting the process on a buffered read
  d522b1f milestone 12: performance bench harness, measured docs, aarch64 tests under qemu and no-dist size assert
  bdb6ffa milestone 11: systemd and docker packaging, operator and architecture docs, config and api reference, docs drift guards
  a589df7 milestone 10: doh and dot listeners, cert store with hot reload and cert reload api
  617cc96 milestone 9: react spa admin ui, frontend ci and embedded dist
  5253c47 milestone 8: web server, rest api, sse, auth, metrics and static assets
  a8092bb milestone 7: serving pipeline, client tracking, pause and lifecycle
  8c50b66 milestone 6: dns cache, rate limiting, query logging, disk monitoring and retention
  59d94df milestone 5: blocklist filtering, local records and conditional forwarding
  3baf5d6 dot upstreams: per-upstream tls_name for sni and cert verification by dns name
  70bff22 storage and config: sqlite wrapper, migrations, querylog policy, repositories, zon config with import/export/check cli
  17d0401 resolver transport: udp/tcp servers, doh/dot clients, pool failover with health
  346f2dc milestone-2 spec and api notes: as-built sync
  5e7fbfe dns fuzz targets: smith corpus, llvm-backed fuzz artifact
  7429b96 dns core: wire-format parse/encode, iterators, response builder
  bf02f83 sync milestone-1 spec and api notes with as-built findings
  b960413 gitea ci: blocking test + cross jobs, manual live-tls workflow
  506ab8e platform layer: address types, stdlib tls client wrapper, mbedtls tls server
  1fa8266 build baseline: pinned sqlite + mbedtls, static musl cross targets, cli stub
  b609176 project plan, values, milestone 1 spec, zig 0.16 api research
  

  Downloads

  • IMAGE-DIGEST.txt
    105 B

    2026-08-08 23:26:44 +00:00
  • SHA256SUMS.txt
    290 B

    2026-08-08 23:26:44 +00:00
  • SHA256SUMS.txt.asc
    228 B

    2026-08-08 23:26:44 +00:00
  • nxdns-0.0.1-aarch64-linux-musl.tar.gz
    2.6 MiB

    2026-08-08 23:26:44 +00:00
  • nxdns-0.0.1-x86_64-linux-musl.tar.gz
    2.7 MiB

    2026-08-08 23:26:44 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)