21 Releases 21 Tags

RSS Feed

• v0.0.1 31d8baad15

  Compare

  v0.0.1 Stable

  mokhtar released this 2026-08-11 23:19:09 +00:00 | 135 commits to master since this release

  First release. Everything below is new.

  Added

  • Forwarding DNS server. UDP and TCP listeners with a wire-format parser and encoder written against RFC 1035 and EDNS(0), a bounded worker model, per-client rate limiting and a pause control that stops filtering without stopping resolution.
  • Encrypted upstreams. DNS-over-HTTPS and DNS-over-TLS clients over a pool that tracks per-upstream health and fails over, with SNI and certificate verification driven by a per-upstream TLS name.
  • DoH and DoT endpoints. nxdns also answers as an encrypted resolver, with a certificate store that reloads on disk changes and through the API, so renewals do not need a restart.
  • Blocklist filtering. Subscriptions in hosts, plain-domain and Adblock-Plus-style formats, compiled into a compact matcher; per-group allow and block rules with wildcards; safe-search enforcement.
  • Per-client policy groups. Clients are identified by address and assigned to groups, so the filtering a device gets depends on which device it is.
  • Local DNS. Local A/AAAA/CNAME/PTR records and conditional forwarding of internal zones to another resolver.
  • Cache. A bounded in-memory cache that respects upstream TTLs and expires entries rather than serving them stale.
  • Query log. Queries land in SQLite under a retention policy in both rows and days, with disk-full self-protection that degrades instead of corrupting, and a live SSE stream of the same events.
  • Web UI and REST API. A React single-page admin UI embedded in the binary, a REST API with a served OpenAPI document, session authentication, API rate limiting and Prometheus-style /metrics.
  • Configuration. A ZON configuration file seeds the database on first boot; after that the database is the truth, and nxdns export / nxdns import move configuration in and out. nxdns check validates a file without starting.
  • CLI. run, check, export, import, version and help.
  • Packaging. A hardened systemd unit with a sysusers fragment, and a FROM scratch container image holding the binary, a CA bundle and the licence files, assembled by a builder stage pinned to alpine:3.22 by digest. Nothing from Alpine ships in the published image except that CA bundle.
  • Releases. Tags publish five assets — static musl tarballs for x86_64-linux-musl and aarch64-linux-musl, IMAGE-DIGEST.txt naming the multi-architecture container image by digest, SHA256SUMS.txt over those three, and SHA256SUMS.txt.asc, a detached signature over the checksum file. zig build dist and zig build verify-dist produce and check the same artifacts on a laptop.
  • Licensing. EUPL-1.2, with a THIRD-PARTY-NOTICES file in every tarball and image assembled from a reviewed inventory of what the artifacts contain.
  • Documentation. A Diátaxis split — tutorial, how-to, reference, explanation — with drift guards that fail the build when the reference pages fall behind the code.

  Downloads

  • IMAGE-DIGEST.txt
    105 B

    2026-08-11 23:19:09 +00:00
  • SHA256SUMS.txt
    290 B

    2026-08-11 23:19:09 +00:00
  • SHA256SUMS.txt.asc
    228 B

    2026-08-11 23:19:09 +00:00
  • nxdns-0.0.1-aarch64-linux-musl.tar.gz
    2.6 MiB

    2026-08-11 23:19:09 +00:00
  • nxdns-0.0.1-x86_64-linux-musl.tar.gz
    2.7 MiB

    2026-08-11 23:19:09 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)