certFile: {{ blocky_cert_file }}
keyFile: {{blocky_key_file }}
upstreams:
  groups:
    default: [1.1.1.1, 8.8.8.8]
blocking:
  denylists:
    ads: [https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts]
    fakenews: [
      https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts,
    ]
    gambling: [
      https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts,
    ]
    porn: [
      https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts,
    ]

  # allowlists:
  #   ads:
  #     - https://raw.githubusercontent.com/m0zgen/dns-hole/master/whitelist.txt
  #     - https://raw.githubusercontent.com/m0zgen/dns-hole/master/vendors-wl/microsoft.txt
  #     - https://raw.githubusercontent.com/m0zgen/dns-hole/master/vendors-wl/google.txt
  #     - https://raw.githubusercontent.com/m0zgen/dns-hole/master/regex/common-wl.txt
  clientGroupsBlock:
    default: [ads, fakenews, gambling, porn]
{% if blocky_tailscale_bound_domains is defined and blocky_tailscale_bound_domains | length > 0 and blocky_tailscale_ipv4 is defined and blocky_tailscale_ipv4 | length > 0 %}
customDNS:
  mapping:
{% for fqdn in blocky_tailscale_bound_domains %}
    {{ fqdn }}: {{ blocky_tailscale_ipv4 }}
{% endfor %}
{% endif %}
ports:
  dns:
    - 5353
{% if blocky_tailscale_ipv4 is defined and blocky_tailscale_ipv4 | length > 0 %}
    - {{ blocky_tailscale_ipv4 }}:53
{% endif %}
  tls: {{ blocky_dot_port }}
bootstrapDns: 1.1.1.1
