install: fc-cache doesn't need to freeze my terminal

etc/dnscrypt-proxy/README.md

@@ -1,19 +0,0 @@
-<!-- @format -->
-
-My configs for [dnscrypt-proxy]
-
-At the time of writing, hosts-mikaela.txt is intended for not having to
-remember or trust the DNS for all of the domains or the hypothetical scenario
-where I have no access to DNS, but for some reason having access to
-[Yggdrasil] and/or [Hyperboria] or just to answer the question, why to rely on
-centralized technology on decentralized web.
-
-Mosts of the domains in hosts-mikaela.txt should also work without the file
-when mikaela.internal is replaced with mikaela.info, however relying on DNS,
-but that way you must trust DNSSEC, CloudFlare and wherever the CNAME points
-to who may not have DNSSEC. If you are using this file (you shouldn't), you
-are already trusting me.
-
-[dnscrypt-proxy]: https://github.com/jedisct1/dnscrypt-proxy
-[hyperboria]: https://hyperboria.net/
-[yggdrasil]: https://yggdrasil-network.github.io/

etc/dnscrypt-proxy/dnscrypt-proxy.toml

@@ -1,108 +1,791 @@
-# Empty listen_addresses to use systemd socket activation (Debian)
+##############################################
-listen_addresses = []
+#                                            #
-# When not using socket activation (Arch), 127.0.2.1:53 is what the Debian
+#        dnscrypt-proxy configuration        #
-# socket seems to give for all of my systems so I want to listen on it for
+#                                            #
-# compatibility + I want to run Unbound in front of DNSCrypt-proxy
+##############################################
-# (see etc/unbound/unbound.conf.d/dnscrypt-proxy.conf)
-#listen_addresses = ['127.0.2.1:53']
 
-# mikaela.internal / my hosts file
+## This is an example configuration file.
-#cloaking_rules = '/etc/dnscrypt-proxy/hosts-mikaela.txt'
+## You should adjust it to your needs, and save it as "dnscrypt-proxy.toml"
+##
+## Online documentation is available here: https://dnscrypt.info/doc
 
-# Disable cache in case of another server caching resolver in front of
+##################################
-# DNSCrypt-proxy (Unbound)
+#         Global settings        #
-cache = true
+##################################
 
-# When server_names isn't specified the criteria below disabled_server_names
+## List of servers to use
-# gets used, if it's specified, this overrides the criteria.
+##
+## Servers from the "public-resolvers" source (see down below) can
+## be viewed here: https://dnscrypt.info/public-servers
+##
+## The proxy will automatically pick working servers from this list.
+## Note that the require_* filters do NOT apply when using this setting.
+##
+## By default, this list is empty and all registered servers matching the
+## require_* filters will be used instead.
+##
+## Remove the leading # first to enable this; lines starting with # are ignored.
 
-# Quad9, I had this line on one family computer which regardless of bad
+# server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare']
-# network conditions (Huawei router forgetting IPv6 + CGN + NAT) failed less
+server_names = [
-# queries than another, so I decided this is worth having noted somewhere.
+	'quad9-doh-ip6-port443-filter-ecs-pri',
-#server_names = ['public-quad9-dnscrypt-ip4-filter-pri', 'public-quad9-dnscrypt-ip4-filter-alt', 'public-quad9-dnscrypt-ip6-filter-pri', 'public-quad9-dnscrypt-ip6-filter-alt', 'public-quad9-doh-ip4-filter-pri', 'public-quad9-doh-ip4-filter-alt', 'public-quad9-doh-ip6-filter-pri', 'public-quad9-doh-ip6-filter-alt']
+	'quad9-doh-ip4-port443-filter-ecs-pri',
+]
 
-# Server names to never use even if they match the criteria below. I think
+## List of local addresses and ports to listen to. Can be IPv4 and/or IPv6.
-# Cloudflare is too big and as it gets selected by default everywhere other
+## Example with both IPv4 and IPv6:
-# resolvers won't even get attempted. There is also Mozilla planning to send
+## listen_addresses = ['127.0.0.1:53', '[::1]:53']
-# all Firefox DNS queries to them.
+##
-# However through Tor Cloudflare never seems to be the fastest so I am
+## To listen to all IPv4 addresses, use `listen_addresses = ['0.0.0.0:53']`
-# leaving this commented.
+## To listen to all IPv4+IPv6 addresses, use `listen_addresses = ['[::]:53']`
-# This is unsupported in the Debian's version 2.0.19.
-#disabled_server_names = ['public-cloudflare-ipv6', 'public-cloudflare']
 
-# Requirements for which servers to use
+listen_addresses = ['127.0.2.1:53']
+
+## Maximum number of simultaneous client connections to accept
+
+max_clients = 250
+
+## Switch to a different system user after listening sockets have been created.
+## Note (1): this feature is currently unsupported on Windows.
+## Note (2): this feature is not compatible with systemd socket activation.
+## Note (3): when using -pidfile, the PID file directory must be writable by the new user
+
+# user_name = 'nobody'
+
+## Require servers (from remote sources) to satisfy specific properties
+
+# Use servers reachable over IPv4
 ipv4_servers = true
+
+# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity
 ipv6_servers = true
-block_ipv6 = false
+
-require_dnssec = true
+# Use servers implementing the DNSCrypt protocol
-require_nofilter = true
+dnscrypt_servers = true
+
+# Use servers implementing the DNS-over-HTTPS protocol
+doh_servers = true
+
+# Use servers implementing the Oblivious DoH protocol
+odoh_servers = false
+
+## Require servers defined by remote sources to satisfy specific properties
+
+# Server must support DNS security extensions (DNSSEC)
+require_dnssec = false
+
+# Server must not log user queries (declarative)
 require_nolog = true
 
-# Resolver to use for the initial queries, DNSSEC capable one recommended.
+# Server must not enforce its own blocklist (for parental control, ads blocking...)
-# China: 114.114.114.114:53 according to the example file. Default is
+require_nofilter = true
-# currently 9.9.9.9 and I can follow the defaults.
+
-#fallback_resolver = '149.112.112.112:53'
+# Server names to avoid even if they match all criteria
+disabled_server_names = []
+
+## Always use TCP to connect to upstream servers.
+## This can be useful if you need to route everything through Tor.
+## Otherwise, leave this to `false`, as it doesn't improve security
+## (dnscrypt-proxy will always encrypt everything even using UDP), and can
+## only increase latency.
+
+force_tcp = false
+
+## SOCKS proxy
+## Uncomment the following line to route all TCP connections to a local Tor node
+## Tor doesn't support UDP, so set `force_tcp` to `true` as well.
+
+# proxy = 'socks5://127.0.0.1:9050'
+
+## HTTP/HTTPS proxy
+## Only for DoH servers
+
+# http_proxy = 'http://127.0.0.1:8888'
+
+## How long a DNS query will wait for a response, in milliseconds.
+## If you have a network with *a lot* of latency, you may need to
+## increase this. Startup may be slower if you do so.
+## Don't increase it too much. 10000 is the highest reasonable value.
+
+timeout = 5000
+
+## Keepalive for HTTP (HTTPS, HTTP/2) queries, in seconds
+
+keepalive = 30
+
+## Add EDNS-client-subnet information to outgoing queries
+##
+## Multiple networks can be listed; they will be randomly chosen.
+## These networks don't have to match your actual networks.
+
+# edns_client_subnet = ["0.0.0.0/0", "2001:db8::/32"]
+
+## Response for blocked queries. Options are `refused`, `hinfo` (default) or
+## an IP response. To give an IP response, use the format `a:<IPv4>,aaaa:<IPv6>`.
+## Using the `hinfo` option means that some responses will be lies.
+## Unfortunately, the `hinfo` option appears to be required for Android 8+
+
+# blocked_query_response = 'refused'
+
+## Load-balancing strategy: 'p2' (default), 'ph', 'p<n>', 'first' or 'random'
+## Randomly choose 1 of the fastest 2, half, n, 1 or all live servers by latency.
+## The response quality still depends on the server itself.
+
+# lb_strategy = 'p2'
+
+## Set to `true` to constantly try to estimate the latency of all the resolvers
+## and adjust the load-balancing parameters accordingly, or to `false` to disable.
+## Default is `true` that makes 'p2' `lb_strategy` work well.
+
+# lb_estimator = true
+
+## Log level (0-6, default: 2 - 0 is very verbose, 6 only contains fatal errors)
+
+# log_level = 2
+
+## Log file for the application, as an alternative to sending logs to
+## the standard system logging service (syslog/Windows event log).
+##
+## This file is different from other log files, and will not be
+## automatically rotated by the application.
+
+# log_file = '/var/log/dnscrypt-proxy/dnscrypt-proxy.log'
+
+## When using a log file, only keep logs from the most recent launch.
+
+# log_file_latest = true
+
+## Use the system logger (syslog on Unix, Event Log on Windows)
 
-# Ensure syslog
 use_syslog = true
 
-# Cert reload time in minutes (see refresh_delay under sources for them)
+## Delay, in minutes, after which certificates are reloaded
+
 cert_refresh_delay = 240
 
-# Shouldn't take that much MEM and I imagine it's subject to TTL anyway.
+## DNSCrypt: Create a new, unique key for every single DNS query
-cache_size = 10000
+## This may improve privacy but can also have a significant impact on CPU usage
-# cache for 5 minutes even if the TTL wass shorter
+## Only enable if you don't have a lot of network load
-cache_min_ttl = 300
 
-# Load-balancing
+# dnscrypt_ephemeral_keys = false
-# fastest (first in 2.0.24+)= always fastest, p2 = random between two fastest, ph = random
-# from the fastest half of the configured list, random = any random
-# https://github.com/jedisct1/dnscrypt-proxy/wiki/Load-Balancing-Options
-lb_strategy = 'p2'
 
-# Tor if necessary
+## DoH: Disable TLS session tickets - increases privacy but also latency
-#force_tcp = true
-# Experience: this port shouldn't have IsolateDestAddr/IsolateDestPort or
-# Tor may be unhappy due to the amount of circuits opened. Different ports
-# are already isolated from each other and I think dnscrypt-proxy should
-# mostly be connecting to the top fastest servers with lb_strategy p2
-#proxy = "socks5://dnscrypt-proxy:randompasswordhere123613413671@127.0.0.1:9052"
 
-# Logging to be enabled by hand on systems needing them
+# tls_disable_session_tickets = false
-#[query_log]
+
-#	file = '/var/log/dnscrypt-proxy/query.log'
+## DoH: Use a specific cipher suite instead of the server preference
-#[nx_log]
+## 49199 = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-#	file = '/var/log/dnscrypt-proxy/nx.log'
+## 49195 = TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+## 52392 = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+## 52393 = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+##  4865 = TLS_AES_128_GCM_SHA256
+##  4867 = TLS_CHACHA20_POLY1305_SHA256
+##
+## On non-Intel CPUs such as MIPS routers and ARM systems (Android, Raspberry Pi...),
+## the following suite improves performance.
+## This may also help on Intel CPUs running 32-bit operating systems.
+##
+## Keep tls_cipher_suite empty if you have issues fetching sources or
+## connecting to some DoH servers. Google and Cloudflare are fine with it.
+
+# tls_cipher_suite = [52392, 49199]
+
+## Bootstrap resolvers
+##
+## These are normal, non-encrypted DNS resolvers, that will be only used
+## for one-shot queries when retrieving the initial resolvers list and if
+## the system DNS configuration doesn't work.
+##
+## No user queries will ever be leaked through these resolvers, and they will
+## not be used after IP addresses of DoH resolvers have been found (if you are
+## using DoH).
+##
+## They will never be used if lists have already been cached, and if the stamps
+## of the configured servers already include IP addresses (which is the case for
+## most of DoH servers, and for all DNSCrypt servers and relays).
+##
+## They will not be used if the configured system DNS works, or after the
+## proxy already has at least one usable secure resolver.
+##
+## Resolvers supporting DNSSEC are recommended, and, if you are using
+## DoH, bootstrap resolvers should ideally be operated by a different entity
+## than the DoH servers you will be using, especially if you have IPv6 enabled.
+##
+## People in China may want to use 114.114.114.114:53 here.
+## Other popular options include 8.8.8.8, 9.9.9.9 and 1.1.1.1.
+##
+## If more than one resolver is specified, they will be tried in sequence.
+##
+## TL;DR: put valid standard resolver addresses here. Your actual queries will
+## not be sent there. If you're using DNSCrypt or Anonymized DNS and your
+## lists are up to date, these resolvers will not even be used.
+
+bootstrap_resolvers = ['9.9.9.9:53', '8.8.8.8:53']
+
+## Always use the bootstrap resolver before the system DNS settings.
+
+ignore_system_dns = true
+
+## Maximum time (in seconds) to wait for network connectivity before
+## initializing the proxy.
+## Useful if the proxy is automatically started at boot, and network
+## connectivity is not guaranteed to be immediately available.
+## Use 0 to not test for connectivity at all (not recommended),
+## and -1 to wait as much as possible.
+
+netprobe_timeout = 60
+
+## Address and port to try initializing a connection to, just to check
+## if the network is up. It can be any address and any port, even if
+## there is nothing answering these on the other side. Just don't use
+## a local address, as the goal is to check for Internet connectivity.
+## On Windows, a datagram with a single, nul byte will be sent, only
+## when the system starts.
+## On other operating systems, the connection will be initialized
+## but nothing will be sent at all.
+
+netprobe_address = '9.9.9.9:53'
+
+## Offline mode - Do not use any remote encrypted servers.
+## The proxy will remain fully functional to respond to queries that
+## plugins can handle directly (forwarding, cloaking, ...)
+
+# offline_mode = false
+
+## Additional data to attach to outgoing queries.
+## These strings will be added as TXT records to queries.
+## Do not use, except on servers explicitly asking for extra data
+## to be present.
+## encrypted-dns-server can be configured to use this for access control
+## in the [access_control] section
+
+# query_meta = ['key1:value1', 'key2:value2', 'token:MySecretToken']
+
+## Automatic log files rotation
+
+# Maximum log files size in MB - Set to 0 for unlimited.
+log_files_max_size = 10
+
+# How long to keep backup files, in days
+log_files_max_age = 7
+
+# Maximum log files backups to keep (or 0 to keep all backups)
+log_files_max_backups = 1
+
+#########################
+#        Filters        #
+#########################
+
+## Note: if you are using dnsmasq, disable the `dnssec` option in dnsmasq if you
+## configure dnscrypt-proxy to do any kind of filtering (including the filters
+## below and blocklists).
+## You can still choose resolvers that do DNSSEC validation.
+
+## Immediately respond to IPv6-related queries with an empty response
+## This makes things faster when there is no IPv6 connectivity, but can
+## also cause reliability issues with some stub resolvers.
+
+block_ipv6 = false
+
+## Immediately respond to A and AAAA queries for host names without a domain name
+
+block_unqualified = true
+
+## Immediately respond to queries for local zones instead of leaking them to
+## upstream resolvers (always causing errors or timeouts).
+
+block_undelegated = true
+
+## TTL for synthetic responses sent when a request has been blocked (due to
+## IPv6 or blocklists).
+
+reject_ttl = 10
+
+##################################################################################
+#        Route queries for specific domains to a dedicated set of servers        #
+##################################################################################
+
+## See the `example-forwarding-rules.txt` file for an example
+
+# forwarding_rules = '/etc/dnscrypt-proxy/forwarding-rules.txt'
+
+###############################
+#        Cloaking rules       #
+###############################
+
+## Cloaking returns a predefined address for a specific name.
+## In addition to acting as a HOSTS file, it can also return the IP address
+## of a different name. It will also do CNAME flattening.
+##
+## See the `example-cloaking-rules.txt` file for an example
+
+# cloaking_rules = '/etc/dnscrypt-proxy/cloaking-rules.txt'
+
+## TTL used when serving entries in cloaking-rules.txt
+
+# cloak_ttl = 600
+
+###########################
+#        DNS cache        #
+###########################
+
+## Enable a DNS cache to reduce latency and outgoing traffic
+
+cache = true
+
+## Cache size
+
+cache_size = 4096
+
+## Minimum TTL for cached entries
+
+cache_min_ttl = 2400
+
+## Maximum TTL for cached entries
+
+cache_max_ttl = 86400
+
+## Minimum TTL for negatively cached entries
+
+cache_neg_min_ttl = 60
+
+## Maximum TTL for negatively cached entries
+
+cache_neg_max_ttl = 600
+
+########################################
+#        Captive portal handling       #
+########################################
+
+[captive_portals]
+
+## A file that contains a set of names used by operating systems to
+## check for connectivity and captive portals, along with hard-coded
+## IP addresses to return.
+
+# map_file = '/etc/dnscrypt-proxy/example-captive-portals.txt'
+
+##################################
+#        Local DoH server        #
+##################################
+
+[local_doh]
+
+## dnscrypt-proxy can act as a local DoH server. By doing so, web browsers
+## requiring a direct connection to a DoH server in order to enable some
+## features will enable these, without bypassing your DNS proxy.
+
+## Addresses that the local DoH server should listen to
+
+# listen_addresses = ['127.0.0.1:3000']
+
+## Path of the DoH URL. This is not a file, but the part after the hostname
+## in the URL. By convention, `/dns-query` is frequently chosen.
+## For each `listen_address` the complete URL to access the server will be:
+## `https://<listen_address><path>` (ex: `https://127.0.0.1/dns-query`)
+
+# path = '/dns-query'
+
+## Certificate file and key - Note that the certificate has to be trusted.
+## See the documentation (wiki) for more information.
+
+# cert_file = 'localhost.pem'
+# cert_key_file = 'localhost.pem'
+
+###############################
+#        Query logging        #
+###############################
+
+## Log client queries to a file
+
+[query_log]
+
+## Path to the query log file (absolute, or relative to the same directory as the config file)
+## Can be set to /dev/stdout in order to log to the standard output.
+
+# file = '/var/log/dnscrypt-proxy/query.log'
+
+## Query log format (currently supported: tsv and ltsv)
+
+format = 'tsv'
+
+## Do not log these query types, to reduce verbosity. Keep empty to log everything.
+
+# ignored_qtypes = ['DNSKEY', 'NS']
+
+############################################
+#        Suspicious queries logging        #
+############################################
+
+## Log queries for nonexistent zones
+## These queries can reveal the presence of malware, broken/obsolete applications,
+## and devices signaling their presence to 3rd parties.
+
+[nx_log]
+
+## Path to the query log file (absolute, or relative to the same directory as the config file)
+
+# file = '/var/log/dnscrypt-proxy/nx.log'
+
+## Query log format (currently supported: tsv and ltsv)
+
+format = 'tsv'
+
+######################################################
+#        Pattern-based blocking (blocklists)        #
+######################################################
+
+## Blocklists are made of one pattern per line. Example of valid patterns:
+##
+##   example.com
+##   =example.com
+##   *sex*
+##   ads.*
+##   ads*.example.*
+##   ads*.example[0-9]*.com
+##
+## Example blocklist files can be found at https://download.dnscrypt.info/blocklists/
+## A script to build blocklists from public feeds can be found in the
+## `utils/generate-domains-blocklists` directory of the dnscrypt-proxy source code.
+
+[blocked_names]
+
+## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)
+
+# blocked_names_file = '/etc/dnscrypt-proxy/blocked-names.txt'
+
+## Optional path to a file logging blocked queries
+
+# log_file = '/var/log/dnscrypt-proxy/blocked-names.log'
+
+## Optional log format: tsv or ltsv (default: tsv)
+
+# log_format = 'tsv'
+
+###########################################################
+#        Pattern-based IP blocking (IP blocklists)        #
+###########################################################
+
+## IP blocklists are made of one pattern per line. Example of valid patterns:
+##
+##   127.*
+##   fe80:abcd:*
+##   192.168.1.4
+
+[blocked_ips]
+
+## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)
+
+# blocked_ips_file = '/etc/dnscrypt-proxy/blocked-ips.txt'
+
+## Optional path to a file logging blocked queries
+
+# log_file = '/var/log/dnscrypt-proxy/blocked-ips.log'
+
+## Optional log format: tsv or ltsv (default: tsv)
+
+# log_format = 'tsv'
+
+######################################################
+#   Pattern-based allow lists (blocklists bypass)   #
+######################################################
+
+## Allowlists support the same patterns as blocklists
+## If a name matches an allowlist entry, the corresponding session
+## will bypass names and IP filters.
+##
+## Time-based rules are also supported to make some websites only accessible at specific times of the day.
+
+[allowed_names]
+
+## Path to the file of allow list rules (absolute, or relative to the same directory as the config file)
+
+# allowed_names_file = '/etc/dnscrypt-proxy/allowed-names.txt'
+
+## Optional path to a file logging allowed queries
+
+# log_file = '/var/log/dnscrypt-proxy/allowed-names.log'
+
+## Optional log format: tsv or ltsv (default: tsv)
+
+# log_format = 'tsv'
+
+#########################################################
+#   Pattern-based allowed IPs lists (blocklists bypass) #
+#########################################################
+
+## Allowed IP lists support the same patterns as IP blocklists
+## If an IP response matches an allow ip entry, the corresponding session
+## will bypass IP filters.
+##
+## Time-based rules are also supported to make some websites only accessible at specific times of the day.
+
+[allowed_ips]
+
+## Path to the file of allowed ip rules (absolute, or relative to the same directory as the config file)
+
+# allowed_ips_file = '/etc/dnscrypt-proxy/allowed-ips.txt'
+
+## Optional path to a file logging allowed queries
+
+# log_file = '/var/log/dnscrypt-proxy/allowed-ips.log'
+
+## Optional log format: tsv or ltsv (default: tsv)
+
+# log_format = 'tsv'
+
+##########################################
+#        Time access restrictions        #
+##########################################
+
+## One or more weekly schedules can be defined here.
+## Patterns in the name-based blocked_names file can optionally be followed with @schedule_name
+## to apply the pattern 'schedule_name' only when it matches a time range of that schedule.
+##
+## For example, the following rule in a blocklist file:
+## *.youtube.* @time-to-sleep
+## would block access to YouTube during the times defined by the 'time-to-sleep' schedule.
+##
+## {after='21:00', before= '7:00'} matches 0:00-7:00 and 21:00-0:00
+## {after= '9:00', before='18:00'} matches 9:00-18:00
+
+[schedules]
+
+# [schedules.'time-to-sleep']
+# mon = [{after='21:00', before='7:00'}]
+# tue = [{after='21:00', before='7:00'}]
+# wed = [{after='21:00', before='7:00'}]
+# thu = [{after='21:00', before='7:00'}]
+# fri = [{after='23:00', before='7:00'}]
+# sat = [{after='23:00', before='7:00'}]
+# sun = [{after='21:00', before='7:00'}]
+
+# [schedules.'work']
+# mon = [{after='9:00', before='18:00'}]
+# tue = [{after='9:00', before='18:00'}]
+# wed = [{after='9:00', before='18:00'}]
+# thu = [{after='9:00', before='18:00'}]
+# fri = [{after='9:00', before='17:00'}]
+
+#########################
+#        Servers        #
+#########################
+
+## Remote lists of available servers
+## Multiple sources can be used simultaneously, but every source
+## requires a dedicated cache file.
+##
+## Refer to the documentation for URLs of public sources.
+##
+## A prefix can be prepended to server names in order to
+## avoid collisions if different sources share the same for
+## different servers. In that case, names listed in `server_names`
+## must include the prefixes.
+##
+## If the `urls` property is missing, cache files and valid signatures
+## must already be present. This doesn't prevent these cache files from
+## expiring after `refresh_delay` hours.
+## Cache freshness is checked every 24 hours, so values for 'refresh_delay'
+## of less than 24 hours will have no effect.
+## A maximum delay of 168 hours (1 week) is imposed to ensure cache freshness.
 
 [sources]
+
+## An example of a remote source from https://github.com/DNSCrypt/dnscrypt-resolvers
+
 [sources.'public-resolvers']
-#url = 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md'
 urls = [
-	'https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md',
+	'https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md',
-	'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md',
+	'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md',
-	'https://cdn.staticaly.com/gh/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md',
+	'https://ipv6.download.dnscrypt.info/resolvers-list/v3/public-resolvers.md',
-	'https://evilvibes.com/list/public-resolvers.md',
+	'https://download.dnscrypt.net/resolvers-list/v3/public-resolvers.md',
 ]
 cache_file = '/var/cache/dnscrypt-proxy/public-resolvers.md'
 minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
 refresh_delay = 72
-prefix = 'public-'
+prefix = ''
 
-[sources.'opennic']
+## Anonymized DNS relays
+
+[sources.'relays']
 urls = [
-	'https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/opennic.md',
+	'https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/relays.md',
-	'https://download.dnscrypt.info/resolvers-list/v2/opennic.md',
+	'https://download.dnscrypt.info/resolvers-list/v3/relays.md',
+	'https://ipv6.download.dnscrypt.info/resolvers-list/v3/relays.md',
+	'https://download.dnscrypt.net/resolvers-list/v3/relays.md',
 ]
+cache_file = '/var/cache/dnscrypt-proxy/relays.md'
 minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
 refresh_delay = 72
-cache_file = '/var/cache/dnscrypt-proxy/opennic.md'
+prefix = ''
-prefix = 'opennic-'
 
-# 2.0.23 recommended so onions won't be attempted without proxy enabled
+## ODoH (Oblivious DoH) servers and relays
-# (5c9edfccfe67474bee2836ada67f955f10e43357)
+
-# I won't uncomment this until I have updated version everywhere.
+# [sources.'odoh-servers']
-#[sources.'onion-services']
+#   urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-servers.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-servers.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/odoh-servers.md', 'https://download.dnscrypt.net/resolvers-list/v3/odoh-servers.md']
-#	urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/onion-services.md', 'https://download.dnscrypt.info/resolvers-list/v2/onion-services.md']
+#   cache_file = '/var/cache/dnscrypt-proxy/odoh-servers.md'
-#	minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+#   minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
-#	cache_file = '/var/cache/dnscrypt-proxy/onion-services.md'
+#   refresh_delay = 24
-#	prefix = 'onion-'
+#   prefix = ''
+# [sources.'odoh-relays']
+#   urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-relays.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/odoh-relays.md', 'https://download.dnscrypt.net/resolvers-list/v3/odoh-relays.md']
+#   cache_file = '/var/cache/dnscrypt-proxy/odoh-relays.md'
+#   minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+#   refresh_delay = 24
+#   prefix = ''
+
+## Quad9
+
+# [sources.quad9-resolvers]
+#   urls = ['https://www.quad9.net/quad9-resolvers.md']
+#   minisign_key = 'RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN'
+#   cache_file = '/var/cache/dnscrypt-proxy/quad9-resolvers.md'
+#   prefix = 'quad9-'
+
+## Another example source, with resolvers censoring some websites not appropriate for children
+## This is a subset of the `public-resolvers` list, so enabling both is useless
+
+#  [sources.'parental-control']
+#    urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/parental-control.md', 'https://download.dnscrypt.info/resolvers-list/v3/parental-control.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/parental-control.md', 'https://download.dnscrypt.net/resolvers-list/v3/parental-control.md']
+#    cache_file = '/var/cache/dnscrypt-proxy/parental-control.md'
+#    minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+
+#########################################
+#        Servers with known bugs        #
+#########################################
+
+[broken_implementations]
+
+# Cisco servers currently cannot handle queries larger than 1472 bytes, and don't
+# truncate reponses larger than questions as expected by the DNSCrypt protocol.
+# This prevents large responses from being received over UDP and over relays.
+#
+# Older versions of the `dnsdist` server software had a bug with queries larger
+# than 1500 bytes. This is fixed since `dnsdist` version 1.5.0, but
+# some server may still run an outdated version.
+#
+# The list below enables workarounds to make non-relayed usage more reliable
+# until the servers are fixed.
+
+fragments_blocked = [
+	'cisco',
+	'cisco-ipv6',
+	'cisco-familyshield',
+	'cisco-familyshield-ipv6',
+	'cleanbrowsing-adult',
+	'cleanbrowsing-adult-ipv6',
+	'cleanbrowsing-family',
+	'cleanbrowsing-family-ipv6',
+	'cleanbrowsing-security',
+	'cleanbrowsing-security-ipv6',
+]
+
+#################################################################
+#        Certificate-based client authentication for DoH        #
+#################################################################
+
+# Use a X509 certificate to authenticate yourself when connecting to DoH servers.
+# This is only useful if you are operating your own, private DoH server(s).
+# 'creds' maps servers to certificates, and supports multiple entries.
+# If you are not using the standard root CA, an optional "root_ca"
+# property set to the path to a root CRT file can be added to a server entry.
+
+[doh_client_x509_auth]
+
+#
+# creds = [
+#    { server_name='*', client_cert='client.crt', client_key='client.key' }
+# ]
+
+################################
+#        Anonymized DNS        #
+################################
+
+[anonymized_dns]
+
+## Routes are indirect ways to reach DNSCrypt servers.
+##
+## A route maps a server name ("server_name") to one or more relays that will be
+## used to connect to that server.
+##
+## A relay can be specified as a DNS Stamp (either a relay stamp, or a
+## DNSCrypt stamp) or a server name.
+##
+## The following example routes "example-server-1" via `anon-example-1` or `anon-example-2`,
+## and "example-server-2" via the relay whose relay DNS stamp is
+## "sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM".
+##
+## !!! THESE ARE JUST EXAMPLES !!!
+##
+## Review the list of available relays from the "relays.md" file, and, for each
+## server you want to use, define the relays you want connections to go through.
+##
+## Carefully choose relays and servers so that they are run by different entities.
+##
+## "server_name" can also be set to "*" to define a default route, for all servers:
+## { server_name='*', via=['anon-example-1', 'anon-example-2'] }
+##
+## If a route is ["*"], the proxy automatically picks a relay on a distinct network.
+## { server_name='*', via=['*'] } is also an option, but is likely to be suboptimal.
+##
+## Manual selection is always recommended over automatic selection, so that you can
+## select (relay,server) pairs that work well and fit your own criteria (close by or
+## in different countries, operated by different entities, on distinct ISPs...)
+
+# routes = [
+#    { server_name='example-server-1', via=['anon-example-1', 'anon-example-2'] },
+#    { server_name='example-server-2', via=['sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM'] }
+# ]
+
+# Skip resolvers incompatible with anonymization instead of using them directly
+
+skip_incompatible = false
+
+# If public server certificates for a non-conformant server cannot be
+# retrieved via a relay, try getting them directly. Actual queries
+# will then always go through relays.
+
+# direct_cert_fallback = false
+
+###############################
+#            DNS64            #
+###############################
+
+## DNS64 is a mechanism for synthesizing AAAA records from A records.
+## It is used with an IPv6/IPv4 translator to enable client-server
+## communication between an IPv6-only client and an IPv4-only server,
+## without requiring any changes to either the IPv6 or the IPv4 node,
+## for the class of applications that work through NATs.
+##
+## There are two options to synthesize such records:
+## Option 1: Using a set of static IPv6 prefixes;
+## Option 2: By discovering the IPv6 prefix from DNS64-enabled resolver.
+##
+## If both options are configured - only static prefixes are used.
+## (Ref. RFC6147, RFC6052, RFC7050)
+##
+## Do not enable unless you know what DNS64 is and why you need it, or else
+## you won't be able to connect to anything at all.
+
+[dns64]
+
+## (Option 1) Static prefix(es) as Pref64::/n CIDRs.
+# prefix = ['64:ff9b::/96']
+
+## (Option 2) DNS64-enabled resolver(s) to discover Pref64::/n CIDRs.
+## These resolvers are used to query for Well-Known IPv4-only Name (WKN) "ipv4only.arpa." to discover only.
+## Set with your ISP's resolvers in case of custom prefixes (other than Well-Known Prefix 64:ff9b::/96).
+## IMPORTANT: Default resolvers listed below support Well-Known Prefix 64:ff9b::/96 only.
+# resolver = ['[2606:4700:4700::64]:53', '[2001:4860:4860::64]:53']
+
+########################################
+#            Static entries            #
+########################################
+
+## Optional, local, static list of additional servers
+## Mostly useful for testing your own servers.
+
+[static]
+
+# [static.'myserver']
+# stamp = 'sdns://AQcAAAAAAAAAAAAQMi5kbnNjcnlwdC1jZXJ0Lg'

etc/dnscrypt-proxy/hosts-mikaela.txt

@@ -1,35 +0,0 @@
-# Last edit 2018-12-15 20:57
-cloudberry.fr1.servers.devices.y.cwinfo.internal	201:a635:d55c:109e:1f54:d9cc:387e:7963
-fr2.servers.devices.y.cwinfo.internal	200:c00f:c8a1:2e17:b7b3:b90:3a72:ffed
-h.jolly-roger.mikaela.internal	fcc1:488:a266:f968:9183:9be5:f6f1:f6f6
-h.relpda.mikaela.internal	fc5a:c8f7:2098:55b8:5309:12c4:cbc6:7b5b
-h.sedric.mikaela.internal	fc84:4044:d916:8ec0:d93d:9c7c:70b6:ecba
-h.vietnam.mikaela.internal	fc1e:19d6:b227:64e0:7b2:b12:b625:151b
-itwjyg.mikaela.internal	200:ef41:edac:11b2:5b4e:e28b:c423:e4d8
-jolly-roger.mikaela.internal	203:b53c:86b8:880f:d049:7e63:8d7c:e270
-korsin.do.mikaela.internal	203:c73f:c4ee:903:2cc0:ad22:ff88:57ea
-korsin.mikaela.internal	203:c73f:c4ee:903:2cc0:ad22:ff88:57ea
-nxdomain.mikaela.internal	::1
-rbtpzn.mikaela.internal	201:b2f9:b5ad:194:8d45:6f23:1a23:61c8
-relpda.mikaela.internal	201:ef0c:cebe:f000:183c:9326:cbba:8fe1
-roubaix-fr.mikaela.internal	201:677d:1809:c5eb:202a:d39:e598:305
-sedric.mikaela.internal	201:b060:d3fe:dbef:8f6d:561d:6892:9cd4
-silta.mikaela.internal	201:11e5:29f8:f846:e407:e003:a681:98d2
-tezagm.mikaela.internal	200:20b5:708:caf2:2e20:de8b:6816:7ee3
-vietnam.mikaela.internal	200:5d18:baf6:667b:80f6:ed96:f800:3bce
-y.invictus.umbrellix.internal	202:8fb5:1490:594d:7e29:98fd:8d79:953f
-y.itwjyg.mikaela.internal	200:ef41:edac:11b2:5b4e:e28b:c423:e4d8
-y.jolly-roger.mikaela.internal	203:b53c:86b8:880f:d049:7e63:8d7c:e270
-y.korsin.do.mikaela.internal	203:c73f:c4ee:903:2cc0:ad22:ff88:57ea
-y.korsin.mikaela.internal	203:c73f:c4ee:903:2cc0:ad22:ff88:57ea
-y.rbtpzn.mikaela.internal	201:b2f9:b5ad:194:8d45:6f23:1a23:61c8
-y.relpda.mikaela.internal	201:ef0c:cebe:f000:183c:9326:cbba:8fe1
-y.roubaix-fr.mikaela.internal	201:677d:1809:c5eb:202a:d39:e598:305
-y.sedric.mikaela.internal	201:b060:d3fe:dbef:8f6d:561d:6892:9cd4
-y.silta.mikaela.internal	201:11e5:29f8:f846:e407:e003:a681:98d2
-y.tezagm.mikaela.internal	200:20b5:708:caf2:2e20:de8b:6816:7ee3
-y.unknown.ano.internal	 209:8224:a:2199:b02a:15ce:b1f4:30bd
-y.unknown.jasan.internal	201:44a5:3cd0:16c9:9346:8786:58d1:2f4
-y.vietnam.mikaela.internal	200:5d18:baf6:667b:80f6:ed96:f800:3bce
-y.zaldaryn.mikaela.internal	204:d9ee:e6d7:175d:c9b8:184b:931e:ae77
-zaldaryn.mikaela.internal	204:d9ee:e6d7:175d:c9b8:184b:931e:ae77

etc/firefox/policies/policies.json

@@ -385,6 +385,11 @@
 				"Type": "boolean",
 				"Value": false
 			},
+			"browser.quitShortcut.disabled ": {
+				"Status": "locked",
+				"Type": "boolean",
+				"Value": false
+			},
 			"browser.safebrowsing.blockedURIs.enabled": {
 				"Status": "locked",
 				"Type": "boolean",
@@ -436,6 +441,11 @@
 			"browser.safebrowsing.provider.mozilla.updateURL": {
 				"Status": "clear"
 			},
+			"browser.sessionstore.warnOnQuit": {
+				"Status": "locked",
+				"Type": "boolean",
+				"Value": false
+			},
 			"browser.tabs.closeWindowWithLastTab": {
 				"Status": "default",
 				"Type": "boolean",
@@ -451,6 +461,16 @@
 				"Type": "boolean",
 				"Value": true
 			},
+			"browser.tabs.warnOnClose": {
+				"Status": "locked",
+				"Type": "boolean",
+				"Value": false
+			},
+			"browser.tabs.warnOnCloseOtherTabs": {
+				"Status": "locked",
+				"Type": "boolean",
+				"Value": false
+			},
 			"browser.translation.neverForLanguages": {
 				"Status": "default",
 				"Type": "string",
@@ -471,6 +491,11 @@
 				"Type": "boolean",
 				"Value": false
 			},
+			"browser.warnOnQuit": {
+				"Status": "locked",
+				"Type": "boolean",
+				"Value": false
+			},
 			"cookiebanners.bannerClicking.enabled": {
 				"Comment": "Preference not allowed for stability reasons. :(",
 				"Status": "locked",

etc/systemd/system/dnscrypt-proxy.service.d/.gitignore

@@ -0,0 +1 @@
+never-fail.conf

etc/systemd/system/dnscrypt-proxy.service.d/never-fail.conf

@@ -0,0 +1 @@
+../service.d/never-fail.conf

install

@@ -142,6 +142,25 @@ if [ "$(id -u)" == "0" ]; then
 	if hash updatedb 2> /dev/null; then
 		(updatedb &)
 	fi
+
+	# If LaTeX fonts are available, make them available for the rest of the
+	# system too.
+	if [ -d "/usr/share/texlive/texmf-dist/fonts/" ]; then
+		mkdir -p /usr/local/share/fonts
+		ln -nsfv /usr/share/texlive/texmf-dist/fonts /usr/local/share/fonts/texlive
+	fi
+fi
+
+# Make the submoduled fonts available to the system
+if [ -d "$HOME/.shell-things" ]; then
+	mkdir -p $HOME/.local/share/fonts
+	ln -nsfv $HOME/.shell-things/submodules/comicneue/Fonts $HOME/.local/share/fonts/comicneue
+	ln -nsfv $HOME/.shell-things/submodules/comic-shanns-mono/fonts $HOME/.local/share/fonts/comic-shanns-mono
+	ln -nsfv $HOME/.shell-things/submodules/opendyslexic/compiled $HOME/.local/share/fonts/opendyslexic
+	ln -nsfv $HOME/.shell-things/submodules/serious-sans/SeriousShanns $HOME/.local/share/fonts/
+fi
+if hash fc-cache 2> /dev/null; then
+	(fc-cache &)
 fi
 
 # If the previously mentioned marker is present, include the even more