{"id":27116533,"url":"https://github.com/0xsharkboy/dns-fortress","last_synced_at":"2026-05-16T08:39:26.306Z","repository":{"id":286490796,"uuid":"937372656","full_name":"0xsharkboy/dns-fortress","owner":"0xsharkboy","description":"A secure, self-hosted DNS filtering and DoH solution using Pi-hole, Unbound, Caddy, and dnsproxy.","archived":false,"fork":false,"pushed_at":"2025-06-09T11:31:32.000Z","size":19,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-09T12:36:45.083Z","etag":null,"topics":["caddy","dns-over-https","dnsproxy","docker","doh","pi-hole","self-hosted-dns","unbound"],"latest_commit_sha":null,"homepage":"","language":"Dockerfile","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xsharkboy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-02-22T22:18:29.000Z","updated_at":"2025-06-09T11:30:35.000Z","dependencies_parsed_at":"2025-04-06T20:20:56.169Z","dependency_job_id":"8ebcf70e-c910-470f-8fb5-11761fcbb044","html_url":"https://github.com/0xsharkboy/dns-fortress","commit_stats":null,"previous_names":["0xsharkboy/dns-fortress"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/0xsharkboy/dns-fortress","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xsharkboy%2Fdns-fortress","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xsharkboy%2Fdns-fortress/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xsharkboy%2Fdns-fortress/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xsharkboy%2Fdns-fortress/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xsharkboy","download_url":"https://codeload.github.com/0xsharkboy/dns-fortress/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xsharkboy%2Fdns-fortress/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267400736,"owners_count":24081189,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-27T02:00:11.917Z","response_time":82,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["caddy","dns-over-https","dnsproxy","docker","doh","pi-hole","self-hosted-dns","unbound"],"created_at":"2025-04-07T05:29:00.132Z","updated_at":"2026-05-16T08:39:21.287Z","avatar_url":"https://github.com/0xsharkboy.png","language":"Dockerfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🔒 DNS Fortress\n\n*A secure, self-hosted DNS filtering and DoH solution using Pi-hole, Unbound, Caddy, and dnsproxy.*\n\n---\n\n## 🚀 Introduction\n\n**DNS Fortress** is a fully Dockerized DNS stack designed for privacy-conscious users who want to block ads and trackers, encrypt their DNS queries with DoH (DNS-over-HTTPS), and maintain full control over their DNS infrastructure.\n\nThis setup integrates:\n\n- **Pi-hole** – Network-wide ad blocking and DNS filtering\n- **Unbound** – Local recursive DNS resolver for privacy and speed\n- **Caddy** – Automated HTTPS and reverse proxy for the Pi-hole web interface\n- **dnsproxy (AdGuard)** – Lightweight DNS-over-HTTPS forwarder\n\nBy running everything locally in Docker containers, this project provides a powerful and private DNS solution ideal for home networks, labs, or self-hosted environments.\n\n---\n\n## ✨ Features\n\n- ✅ Network-wide ad/tracker blocking with Pi-hole\n- 🔒 Encrypted DNS queries using DoH via `dnsproxy`\n- 🔁 Secure DNS recursion with Unbound\n- 🌐 Auto HTTPS with Caddy reverse proxy\n- 🐳 Simple deployment with Docker Compose\n- 🧩 Modular and easily customizable\n\n---\n\n## ⚠️ Security Considerations\n\nRunning your own DNS-over-HTTPS server gives you full control but comes with responsibilities:\n\n- **Trust:** You're now the DNS provider. Devices using your DoH endpoint will rely on you to resolve DNS privately and securely.\n- **Logging:** Make sure to disable or rotate logs if privacy is a concern. Logs can inadvertently expose browsing habits.\n- **Exposure:** Exposing Pi-hole or dnsproxy publicly increases the attack surface. Use strong firewall rules, secure your Docker host, and avoid opening ports unless needed.\n- **HTTPS:** Caddy automates HTTPS, but ensure your domain points to the correct IP and renewals are working.\n\n---\n\n## 🛠 Installation Guide\n\n### Prerequisites\n\n- Docker and Docker Compose installed\n- A domain name (if using HTTPS with Caddy)\n- (Optional) Port 443 open to the internet if accessing remotely\n\n### 1. Clone the repository\n\n```bash\ngit clone https://github.com/0xsharkboy/dns-fortress.git\ncd dns-fortress\n```\n\n### 2. Configure Your Domain Name for HTTPS\n\nStart by creating a `.env` file from the example provided:\n\n```bash\ncp .env.example .env\n```\n\nNext, open the `.env` file and update the `FQDN` variable to reflect your actual domain name (e.g., `FQDN=dns.example.com`).\n\n\u003e ⚠️ **Important:** Before proceeding, ensure your domain's **A record** is correctly pointing to your server's **public IP address**.  \n\u003e This is required for **Caddy** to successfully issue HTTPS certificates via **Let's Encrypt**.\n\n### 3. Run the stack\n\n```bash\ndocker compose up -d\n```\n\n\u003e 🚀 That’s it! You should now have a working DNS setup.\n\n---\n\n## 🔐 Changing the Pi-hole Admin Password\n\nTo change the password manually inside the container:\n\n```bash\ndocker exec -it pihole bash\npihole -a -p\n```\n\nYou’ll be prompted to set a new password. Use an empty password to disable login.\n\n---\n\n## ⚙️ Configuring Pi-hole to Use Unbound\n\nOnce the containers are up:\n\n1. Access the Pi-hole admin panel at `https://your-domain.com/admin` (or `http://localhost:8080/admin`)\n2. Log in using the default password (or your custom one)\n3. Go to **Settings** → **DNS**\n4. Under \"Custom DNS servers\", clear all the entries and enter:\n   ```\n   unbound#5335\n   ```\n5. Click **Save \u0026 Apply**\n\nThis configures Pi-hole to use the Unbound resolver inside the container.\n\n---\n\n## 🧩 Optional Configuration Tips\n\n### Custom Domain with Caddy\n\n1. Ensure your domain A record points to your server IP\n2. Set your domain in the Caddyfile file\n3. Caddy will automatically issue and renew HTTPS certificates\n\n### Persisting Pi-hole Settings\n\nBy default, volumes are mounted to retain Pi-hole configs across restarts. You can customize volumes in the `docker-compose.yml`.\n\n---\n\n## 🙏 Credits \u0026 License\n\n- [Pi-hole](https://pi-hole.net/)\n- [Unbound](https://nlnetlabs.nl/projects/unbound/about/)\n- [Caddy](https://caddyserver.com/)\n- [dnsproxy by AdGuard](https://github.com/AdguardTeam/dnsproxy)\n\nThanks to the open-source community for making privacy tools accessible.\n\n**License:** [MIT License](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xsharkboy%2Fdns-fortress","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xsharkboy%2Fdns-fortress","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xsharkboy%2Fdns-fortress/lists"}