# Knot Resolver Configuration File for IPFire
# DO NOT EDIT as any changes will be overwritten

# Enable logging
logging:
  level: info
  target: syslog

# Listen on all interfaces
network:
  listen:
    - interface: 0.0.0.0@53

  do-ipv4: true
  do-ipv6: false

# Start as many workers as we have CPU threads
workers: auto

# Enable a persistent cache
cache:
  storage: /var/cache/knot-resolver
  size-max: 256M

  # Enable prefetching
  prefetch:
    expiring: true

options:
  # Minimise all queries
  minimize: true

  # Apply workarounds for broken domains
  violators-workarounds: true

  # Detect time jumps
  time-jump-detection: true

# Load our policy
lua:
  script: |
    -- Load config helpers
    local config = require("config")

    -- Reset the minimum UDP source port
    config.reset_min_udp_source_port()

    -- Load the settings
    local settings = config.load_settings("/var/ipfire/dns/settings")

    -- Load DHCP Leases Lookup
    config.load_leases()

    -- Load custom RPZ allowlist workaround
    config.load_rpz_workaround()

    -- Load Forwarders
    config.load_forwarders(settings)

  # Load policies - MODIFIED: Skip ONLY filtering when XDP is active
  policy-script: |
    -- Load config helpers
    local config = require("config")

    -- Load the settings
    local settings = config.load_settings("/var/ipfire/dns/settings")

    -- Load hosts (needed for both modes)
    config.load_hosts()

    -- Check if filtering is disabled (XDP mode active)
    local filter_disabled = io.open("/var/ipfire/dns/filter-disabled")
    if filter_disabled then
        filter_disabled:close()
        -- Log that filtering is disabled
        log_info("DNS filtering is DISABLED - XDP mode active")
        -- Still load forwarders (needed for resolution)
        config.load_forwarders(settings)
        return  -- Skip ONLY filtering policies below
    end

    -- Filtering is enabled, load all policies
    log_info("DNS filtering is ENABLED")

    -- Load RPZs
    config.load_rpzs()

    -- Load SafeSearch
    config.load_safesearch(settings)

    -- Load Forwarding Rules
    config.load_forwarding()

    -- Load Forwarders
    config.load_forwarders(settings)
