A Privacy-First Recursive Resolver You
Actually Own.

$ cargo install unified-dns
    Updating crates.io index
  Downloaded unified-dns v1.1.1
   Compiling unified-dns v1.1.1
    Finished release [optimized] target(s)
  Installing ~/.cargo/bin/unified-dns

$ unified-dns --help
Unified Recursive DNS Server
A multi-protocol iterative recursive resolver with DNSSEC
validation and geo-aware GSLB steering.

[Unit]
Description=Unified Recursive DNS Server
After=network.target
Wants=network-online.target

[Service]
Type=simple
User=unified-dns
Group=unified-dns
WorkingDirectory=/var/lib/unified-dns
ExecStart=/usr/local/bin/unified-dns

# ─── Listener ports ─────────────────────────────────────────────
Environment="HOST=0.0.0.0"
Environment="DNS_PORT=53"
Environment="DOT_PORT=853"
Environment="DOQ_PORT=853"
Environment="DOH_PORT=443"
Environment="DOH3_PORT=443"
Environment="DOH_NO_TLS=0"

# ─── DNSSEC enforcement ─────────────────────────────────────────
Environment="DNSSEC_ENFORCE=1"

# ─── Rate limits and stale serving ──────────────────────────────
Environment="MAX_STALE_SECS=300"
Environment="RATE_LIMIT_BURST=300"
Environment="RATE_LIMIT_PER_SEC=60"

# ─── TLS ────────────────────────────────────────────────────────
Environment="CERT_PATH=/etc/letsencrypt/live/dns.example.com/fullchain.pem"
Environment="KEY_PATH=/etc/letsencrypt/live/dns.example.com/privkey.pem"

# ─── Cache (relative paths resolve against WorkingDirectory) ────
Environment="CACHE_FILE=cache.json"
Environment="CACHE_MAX_ENTRIES=500000"
Environment="CACHE_PREFETCH=1"
Environment="CACHE_PREFETCH_THRESHOLD_PCT=15"
Environment="CACHE_PREFETCH_MIN_HITS=5"

# ─── Root zone (relative paths resolve against WorkingDirectory) ─
#Environment="ROOT_ZONE_FILE=root.zone"
#Environment="ROOT_ZONE_REFRESH_HOURS=168"

# ─── Pre-warming (optional) ─────────────────────────────────────
#Environment="WARM_LIMIT=20000"
#Environment="WARM_CONCURRENCY=6"

# ─── Geo-aware GSLB ─────────────────────────────────────────────
Environment="GEO_ROUTING_ENABLED=1"
Environment="GEO_AUTHORITATIVE_NAMES=dns.example.com"
Environment="GEOIP_DATABASE=GeoLite2-City.mmdb"
Environment="GEO_ROUTING_TTL=10"
Environment="GEO_HEALTH_INTERVAL=10"
Environment="GEO_IP_FAILOVER_IP=3"

# ─── Peer mesh (all nodes share the same secret and node list) ──
#Environment="GEO_SELF_NODE=europe-1"
#Environment="GEO_PEER_SECRET=<64-char hex from: openssl rand -hex 32>"
#Environment="GEO_PEER_HEARTBEAT_INTERVAL=3"

# ─── Node list (identical on every node) ────────────────────────
#Environment="NODE1_NAME=asia-1"
#Environment="NODE1_IPV4=203.0.113.10"
#Environment="NODE1_DOH_URL=https://dns1.example.com:3053"
#Environment="NODE1_LOCATION=asia"
#Environment="NODE1_LAT=1.3521"
#Environment="NODE1_LON=103.8198"
#Environment="NODE1_ENABLED=true"

#Environment="NODE2_NAME=europe-1"
#Environment="NODE2_IPV4=198.51.100.20"
#Environment="NODE2_DOH_URL=https://dns2.example.com:3053"
#Environment="NODE2_LOCATION=europe"
#Environment="NODE2_LAT=52.5200"
#Environment="NODE2_LON=13.4050"
#Environment="NODE2_ENABLED=true"

#Environment="NODE3_NAME=usa-1"
#Environment="NODE3_IPV4=192.0.2.30"
#Environment="NODE3_DOH_URL=https://dns3.example.com:3053"
#Environment="NODE3_LOCATION=north_america"
#Environment="NODE3_LAT=40.7128"
#Environment="NODE3_LON=-74.0060"
#Environment="NODE3_ENABLED=true"

# ─── Logging ────────────────────────────────────────────────────
Environment="RUST_LOG=info,unified_dns=info"

Restart=always
RestartSec=3
LimitNOFILE=65535

# Hardening (optional but recommended)
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/unified-dns

[Install]
WantedBy=multi-user.target