nginx-doh.conf

#
# This config has bits of DNS/DoT/DoH all over it. See the examples folder for more targeted examples.
#

user  nginx;
worker_processes  auto;

load_module modules/ngx_stream_js_module.so;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;

  # logging directives
  log_format  doh   '$remote_addr - $remote_user [$time_local] "$request" '
                    '[ $msec, $request_time, $upstream_response_time $pipe ] '
                    '$status $body_bytes_sent "$http_x_forwarded_for" '
                    '$upstream_http_x_dns_question $upstream_http_x_dns_type '
                    '$upstream_http_x_dns_result '
                    '$upstream_http_x_dns_ttl $upstream_http_x_dns_answers '
                    '$upstream_cache_status';

  access_log  /var/log/nginx/doh-access.log doh;

  # This upstream connects to a local Stream service which converts HTTP -> DNS
  upstream dohloop {
    zone dohloop 64k;
    server 127.0.0.1:8053;
    keepalive_timeout 60s;
    keepalive_requests 100;
    keepalive 10;
  }

  # Proxy Cache storage - so we can cache the DoH response from the upstream
  proxy_cache_path /var/cache/nginx/doh_cache levels=1:2 keys_zone=doh_cache:10m;

  # The DoH server block
  server {
  
    # Listen on standard HTTPS port, and accept HTTP2, with SSL termination
    listen 443 ssl http2;
    ssl_certificate /etc/nginx/ssl/certs/doh.local.pem;
    ssl_certificate_key /etc/nginx/ssl/private/doh.local.pem;
    ssl_session_cache shared:ssl_cache:10m;
    ssl_session_timeout 10m;

    # DoH may use GET or POST requests, Cache both
    proxy_cache_methods GET POST;

    # Return 404 to all responses, except for those using our published DoH URI
    location / {
      return 404 "404 Not Found\n";
    }

    # This is our published DoH URI 
    location /dns-query {

      # Proxy HTTP/1.1, clear the connection header to enable Keep-Alive
      proxy_http_version 1.1;
      proxy_set_header Connection "";

      # Enable Cache, and set the cache_key to include the request_body
      proxy_cache doh_cache;
      proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;

      # proxy pass to the dohloop upstream
      proxy_pass http://dohloop;
    }

  }

  # enable API
  server {
    listen 8080;
    location /api {
      api write=on;
      allow 127.0.0.1;
      allow 192.168.64.1;
      deny all;
    }
  }

}

# DNS Stream Services
stream {

  # KeyValue store for blocking domains (NGINX Plus only)
  keyval_zone zone=dns_config:64k state=/etc/nginx/zones/dns_config.zone; 
  keyval "blocked_domains" $blocked_domains zone=dns_config;
  keyval "blackhole_domains" $blackhole_domains zone=dns_config;
  keyval $dns_qname $scrub_action zone=dns_config;

  # DNS logging
  log_format  dns   '$remote_addr [$time_local] $protocol "$dns_qname" "$upstream_pool"';
  access_log /var/log/nginx/dns-access.log dns;

  # Import the NJS DNS module
  js_import /etc/nginx/njs.d/dns/dns.js;

  # The $dns_qname variable can be populated by preread calls, and can be used for DNS routing
  js_set $dns_qname dns.get_qname;
  
  # The DNS response packet, if we're blocking the domain, this will be set.
  js_set $dns_response dns.get_response;

  # When doing DNS routing, use $dns_qname to map the questions to the upstream pools.
  map $dns_qname $upstream {
    hostnames;
    *.nginx dnsmasq;
    *.k8s dnsmasq;
    default google;
  }

  # Set upstream to be the pool defined above if dns_response is empty, else pass to the @block location
  map $dns_response $upstream_pool {
    "blocked" blocked;
    "blackhole" blackhole;
    default $upstream;
  }

  # upstream pool for blocked requests
  upstream blocked {
    zone blocked 64k;
    server 127.0.0.1:9953;
  }

  upstream blackhole {
    zone blackhole 64k;
    server 127.0.0.1:9853;
  }

  # upstream pools (google DNS)
  upstream google {
    zone dns 64k;
    server 8.8.8.8:53;
  }

  # upstream pools (another DNS)
  upstream dnsmasq {
    zone dns 64k;
    server 192.168.64.1:5353;
  }

  # DNS upstream pool.
  upstream dns {
    zone dns 64k;
    server 8.8.8.8:53;
  }

  # DNS over TLS upstream pool
  upstream dot {
    zone dot 64k;
    server 8.8.8.8:853;
  }

  # DNS(TCP) and DNS over TLS (DoT) Server
  # Upstream can be either DNS(TCP) or DoT. If upstream is DNS, proxy_ssl should be off.
  server {
    listen 553;
    listen 853 ssl;
    ssl_certificate /etc/nginx/ssl/certs/doh.local.pem;
    ssl_certificate_key /etc/nginx/ssl/private/doh.local.pem;
    js_preread dns.preread_dns_request;
    #proxy_ssl on;
    proxy_pass $upstream_pool;
  }

  # DNS(UDP) Server
  # Upstream can only be another DNS(UDP) server.
  server {
    listen 553 udp;
    js_preread dns.preread_dns_request;
    proxy_responses 1;
    proxy_pass $upstream_pool;
  }

  # DNS over HTTPS (gateway) Service
  # Upstream can be either DNS(TCP) or DoT. If upstream is DNS, proxy_ssl should be off.
  server {
    listen 127.0.0.1:8053;
    js_filter dns.filter_doh_request;
    proxy_ssl on;
    proxy_pass dot;
  }

  # Server for sending blackhole/blocked responses
  server {
    listen 127.0.0.1:9953;
    listen 127.0.0.1:9853;
    listen 127.0.0.1:9953 udp;
    listen 127.0.0.1:9853 udp;
    js_preread dns.preread_dns_request;
    return $dns_response;
  }

}