DietPi-Software | DNS proxy 0xERR0R/blocky

[glonmpo]

Creating a software request

Formal software information

• Software title | blocky
• Short description | Blocky is a DNS proxy and ad-blocker for the local network written in Go
• Official URL (if available) | https://0xerr0r.github.io/blocky/installation/
• GitHub URL (if available) | https://github.com/0xERR0R/blocky
• (Official) install documentation | https://0xerr0r.github.io/blocky/installation/

Are there similar/alternative software titles available with DietPi-Software?

• pi-hole

What makes your requested software better than the above solutions, if available?

• Blocky is much smaller than pi-hole and can be configured via a single file.
• It keeps all data in RAM and is therefore perfectly suited for a small Raspberry Pi Nano 2.
• It has many interfaces e.g. for Grafana, Prometheus and so on.

How can DietPi make the installation easier or compatible, than following the install instructions or do APT installation, if available?

• I, as a Linux newbie, got it running on my Raspberry pi Nano 2 with DietPi 8.1. (Without root)
  But it would certainly be easier to maintain if it was integrated directly into Dietpi (install, service, backup).

Can you provide the installation steps that you would suggest DietPi-Software to do?

1. Download the latest binary from Github.
2. Creating a directory for the persistent data (e.g. /mnt/dietpie_userdate/blocky/)
3. Creating a basic configuration (config.yaml)
4. Use CAP_NET_BIND_SERVICE to make the DNS proxy run without root rights.
5. Create a Systemd service and isolate it from the rest of the system.
6. Set up autostart.

Are you willing to help maintaining the software installation, e.g. in case of needed setup changes due to updates etc.? This is not needed, but could speed up our decision to implement it, as man power is always a topic 😉.

• Being fairly new to the Linux world, I'm not sure if I'm really being helpful. :(

[MichaIng]

Many thanks for your request.

Since you mention systemd service sandboxing, could you provide the one you use, so we have a working example to start with? CAP_NET_BIND_SERVICE can also be granted via systemd unit:

[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE

[glonmpo]

Hello,

here is my service config.

[Unit]
Description=blocky
After=network-online.target
Wants=network-online.target
AssertFileNotEmpty=/opt/blocky/config.yml

[Service]
Type=simple
User=blocky
SyslogIdentifier=blocky
WorkingDirectory=/opt/blocky
ExecStart=/opt/blocky/blocky
RemainAfterExit=true
Restart=always
Nice=-20

[Install]
WantedBy=multi-user.target

I don't use sandboxing yet, but while browsing other config files I noticed that it seems to be possible.

E.g. the config of Vaultwarden. Some of this can certainly be adopted.

# Set reasonable connection and process limits
LimitNOFILE=1048576
LimitNPROC=64
# Isolate vaultwarden from the rest of the system
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
# Only allow writes to the following directory and set it to the working directory (user and password data are stored here)
WorkingDirectory=/mnt/dietpi_userdata/vaultwarden
ReadWritePaths=-/mnt/dietpi_userdata/vaultwarden
# Allow vaultwarden to bind ports in the range of 0-1024
AmbientCapabilities=CAP_NET_BIND_SERVICE

[MichaIng]

Ah thanks. Yes it should be definitely possible to add some of not all of these sandboxing options, given that blockly only needs to listen on port 53 and read (or also write?) on /opt/blocky.

[glonmpo]

By default, blocky listens on port 53, but it is also possible that it listens on other ports, depending on the settings in config.yml. (DNS-over-TLS [853], http[s] -> prometheus metrics, pprof, REST API, DoH).

In my minimal configuration, I actually only use port 53 and do not use prometheus or grafana. There is also no writing to /opt/bocky.

[MichaIng]

There is also no writing to /opt/bocky.

Then it shouldn't require any write permissions at all, that is great.