elektrine/elektrine
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(vpn): stop defaulting client DNS to Cloudflare
All checks were successful
Deploy Docker Images / Build, push, and deploy (push) Successful in 16m21s
Details

Browse source 
Prefer Elektrine DNS when configured. Last-resort resolvers use Quad9.
This commit is contained in:
maxfield 2026-08-02 23:29:54 -04:00
parent 1a7be85be9
commit 79650306c1
8 changed files with 21 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

7
.env.example
View file

@ -263,7 +263,12 @@ ACME_EMAIL=admin@example.com
# VPN_SELFHOST_ENDPOINT_PORT=51820
# VPN_SELFHOST_PUBLIC_KEY=optional override; normally derived automatically from the private key
# VPN_SELFHOST_INTERNAL_IP_RANGE=10.8.0.0/24
# VPN_SELFHOST_DNS_SERVERS=1.1.1.1, 1.0.0.1
# Prefer Elektrine DNS for WireGuard clients when the dns module is on:
# VPN_USE_ELEKTRINE_DNS=true
# VPN_CLIENT_DNS_SERVERS=203.0.113.10
# PUBLIC_DNS_BIND_IP=203.0.113.10
# Fallback self-host DNS field (not Cloudflare):
# VPN_SELFHOST_DNS_SERVERS=9.9.9.9, 149.112.112.112
# VPN_SELFHOST_WG_INTERFACE=wg0
# Multi-server fleet bootstrap:

4
apps/elektrine_vpn/lib/elektrine/vpn.ex
View file

@ -298,7 +298,7 @@ defmodule Elektrine.VPN do
|> Map.put_new(:minimum_trust_level, 0)
|> Map.put_new(:endpoint_port, default_endpoint_port(protocol))
|> maybe_put_default_client_mtu(protocol)
|> Map.put_new(:dns_servers, "1.1.1.1, 1.0.0.1")
|> Map.put_new(:dns_servers, "9.9.9.9, 149.112.112.112")
|> Map.put_new_lazy(:internal_ip_range, fn -> allocate_internal_ip_range(protocol) end)
|> ensure_default_shadowsocks_metadata(protocol)
@ -1078,7 +1078,7 @@ defmodule Elektrine.VPN do
internal_ip_range:
env_value(env, "VPN_SELFHOST_INTERNAL_IP_RANGE") ||
default_internal_ip_range(protocol),
dns_servers: env_value(env, "VPN_SELFHOST_DNS_SERVERS") || "1.1.1.1, 1.0.0.1",
dns_servers: env_value(env, "VPN_SELFHOST_DNS_SERVERS") || "9.9.9.9, 149.112.112.112",
metadata: self_host_metadata(env, protocol)
}
|> Enum.reject(fn {_key, value} -> is_nil(value) end)

7
apps/elektrine_vpn/lib/elektrine/vpn/client_dns.ex
View file

@ -5,12 +5,15 @@ defmodule Elektrine.VPN.ClientDNS do
Preference order:
1. Explicit `VPN_CLIENT_DNS_SERVERS` / `:vpn, :client_dns_servers`
2. When Elektrine DNS is enabled and preferred, the platform DNS bind / public IP
3. The per-server `dns_servers` field (legacy Cloudflare defaults)
3. The per-server `dns_servers` field
4. Quad9 public resolvers (never Cloudflare)
"""
alias Elektrine.Platform.Modules
@default_public_resolvers "1.1.1.1, 1.0.0.1"
# Last-resort public resolvers when platform DNS is not configured.
# Do not use Cloudflare (1.1.1.1).
@default_public_resolvers "9.9.9.9, 149.112.112.112"
@doc """
DNS line value for a WireGuard client config on this server.

2
apps/elektrine_vpn/lib/elektrine/vpn/server.ex
View file

@ -17,7 +17,7 @@ defmodule Elektrine.VPN.Server do
field :endpoint_port, :integer, default: 51_820
field :client_mtu, :integer, default: 1280
field :internal_ip_range, :string
field :dns_servers, :string, default: "1.1.1.1, 1.0.0.1"
field :dns_servers, :string, default: "9.9.9.9, 149.112.112.112"
field :status, :string, default: "active"
field :max_users, :integer, default: 100
field :current_users, :integer, default: 0

3
docs/self-hosting/vpn.md
View file

@ -27,7 +27,8 @@ Defaults:
- `VPN_SELFHOST_LISTEN_PORT=51820`
- `VPN_SELFHOST_ENDPOINT_PORT=<same as listen port by default>`
- `VPN_SELFHOST_INTERNAL_IP_RANGE=10.8.0.0/24`
- `VPN_SELFHOST_DNS_SERVERS=1.1.1.1, 1.0.0.1`
- `VPN_SELFHOST_DNS_SERVERS=9.9.9.9, 149.112.112.112` (fallback only; prefer Elektrine DNS)
- `VPN_USE_ELEKTRINE_DNS=true` and `PUBLIC_DNS_BIND_IP` / `VPN_CLIENT_DNS_SERVERS` for platform DNS
Optional labels:

2
env/core.env.example vendored
View file

@ -134,7 +134,7 @@ MESSAGING_FEDERATION_PEERS_JSON='[]'
# VPN_SELFHOST_LISTEN_PORT=51820
# VPN_SELFHOST_PUBLIC_KEY=
# VPN_SELFHOST_INTERNAL_IP_RANGE=10.8.0.0/24
# VPN_SELFHOST_DNS_SERVERS=1.1.1.1, 1.0.0.1
# VPN_SELFHOST_DNS_SERVERS=9.9.9.9, 149.112.112.112
# VPN_SELFHOST_WG_INTERFACE=wg0
# VPN_FLEET_REGISTRATION_KEY=

2
env/presets/vpn.env vendored
View file

@ -8,7 +8,7 @@
# VPN_SELFHOST_LISTEN_PORT=51820
# VPN_SELFHOST_ENDPOINT_PORT=51820
# VPN_SELFHOST_INTERNAL_IP_RANGE=10.8.0.0/24
# VPN_SELFHOST_DNS_SERVERS=1.1.1.1,1.0.0.1
# VPN_SELFHOST_DNS_SERVERS=9.9.9.9,149.112.112.112
# Optional; omitted private/public keys are generated or derived by the vpn container.
# VPN_SELFHOST_PRIVATE_KEY=

4
env/vpn.env.example vendored
View file

@ -13,7 +13,9 @@ ELEKTRINE_ENABLED_MODULES=chat,social,nerve,vpn,atomine
# VPN_SELFHOST_ENDPOINT_PORT=51820
# VPN_SELFHOST_PUBLIC_KEY=
# VPN_SELFHOST_INTERNAL_IP_RANGE=10.8.0.0/24
# VPN_SELFHOST_DNS_SERVERS=1.1.1.1, 1.0.0.1
# VPN_SELFHOST_DNS_SERVERS=9.9.9.9,149.112.112.112
# VPN_USE_ELEKTRINE_DNS=true
# VPN_CLIENT_DNS_SERVERS=
# VPN_SELFHOST_WG_INTERFACE=wg0
# Multi-server fleet bootstrap: