AdGuardDNS/doc/environment.md

AdGuard DNS Environment Configuration

AdGuard DNS uses environment variables to store some of the more sensitive configuration. All other configuration is stored in the configuration file.

Contents

• BACKEND_ENDPOINT
• BLOCKED_SERVICE_INDEX_URL
• CONSUL_ALLOWLIST_URL
• CONSUL_DNSCHECK_KV_URL
• CONSUL_DNSCHECK_SESSION_URL
• CONFIG_PATH
• DNSDB_PATH
• FILTER_INDEX_URL
• FILTER_CACHE_PATH
• GENERAL_SAFE_SEARCH_URL
• GEOIP_ASN_PATH and GEOIP_COUNTRY_PATH
• LISTEN_ADDR
• LISTEN_PORT
• LOG_TIMESTAMP
• QUERYLOG_PATH
• RULESTAT_URL
• SENTRY_DSN
• SSL_KEY_LOG_FILE
• VERBOSE
• YOUTUBE_SAFE_SEARCH_URL

BACKEND_ENDPOINT

The base backend URL to which API paths are appended. The backend endpoints apart from the /ddns/and /linkip/ ones must reply with a 200 status code on success.

Default: No default value, the variable is required.

BLOCKED_SERVICE_INDEX_URL

The URL of the blocked service index file server. See the external HTTP API requirements section on the expected format of the response.

Default: No default value, the variable is required.

CONFIG_PATH

The path to the configuration file.

Default: ./config.yml.

CONSUL_ALLOWLIST_URL

The URL of the Consul instance serving the dynamic part of the rate-limit allowlist. See the external HTTP API requirements section on the expected format of the response.

Default: No default value, the variable is required.

CONSUL_DNSCHECK_KV_URL

The URL of the KV API of the Consul instance used as a key-value database for the DNS server checking. It must end with /kv/<NAMESPACE> where <NAMESPACE> is any non-empty namespace. If not specified, the CONSUL_DNSCHECK_SESSION_URL is also omitted.

Default: Unset.

Example: http://localhost:8500/v1/kv/test

CONSUL_DNSCHECK_SESSION_URL

The URL of the session API of the Consul instance used as a key-value database for the DNS server checking. If not specified, the CONSUL_DNSCHECK_KV_URL is also omitted.

Default: Unset.

Example: http://localhost:8500/v1/session/create

DNSDB_PATH

The path to the DNSDB BoltDB database. If empty or unset, DNSDB statistics collection is disabled.

Default: Unset.

Example: ./dnsdb.bolt.

FILTER_CACHE_PATH

The path to the directory with the filter lists cache.

Default: ./filters/.

FILTER_INDEX_URL

The URL of the filtering rule index file server. See the external HTTP API requirements section on the expected format of the response.

Default: No default value, the variable is required.

GENERAL_SAFE_SEARCH_URL

The URL of the list of general safe search rewriting rules. See the external HTTP API requirements section on the expected format of the response.

Default: No default value, the variable is required.

GEOIP_ASN_PATH and GEOIP_COUNTRY_PATH

Paths to the files containing MaxMind GeoIP databases: for ASNs and for countries and continents respectively.

Default: ./asn.mmdb and ./country.mmdb.

LOG_TIMESTAMP

If 1, show timestamps in the plain text logs. If 0, don't show the timestamps.

Default: 1.

LISTEN_ADDR

The IP address on which to bind the debug HTTP API.

Default: 127.0.0.1.

LISTEN_PORT

The port on which to bind the debug HTTP API, which includes the health check, Prometheus, pprof, and other endpoints.

Default: 8181.

QUERYLOG_PATH

The path to the file into which the query log is going to be written.

Default: ./querylog.jsonl.

RULESTAT_URL

The URL to send filtering rule list statistics to. If empty or unset, the collection of filtering rule statistics is disabled. See the external HTTP API requirements section on the expected format of the response.

Default: Unset.

Example: https://stats.example.com/db

SENTRY_DSN

Sentry error collector address. The special value stderr makes AdGuard DNS print these errors to standard error.

Default: stderr.

SSL_KEY_LOG_FILE

If set, TLS key logs are written to this file to allow other programs (i.e. Wireshark) to decrypt packets. Must only be used for debug purposes.

Default: Unset.

VERBOSE

When set to 1, enable verbose logging. When set to 0, disable it.

Default: 0.

YOUTUBE_SAFE_SEARCH_URL

The URL of the list of YouTube-specific safe search rewriting rules. See the external HTTP API requirements section on the expected format of the response.

Default: No default value, the variable is required.