skills.rest
erfianugrah
erfianugrahCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

gloryhole

Runs a policy-driven DNS server with ad blocking and conditional forwarding.

1|Updated Mar 18, 2024
Search Tags:#telemetry#dns#policy engine#unbound#ad-blocking#doH#doT
One-click install
npx skills add https://github.com/erfianugrah/dotfiles --skill gloryhole
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gloryhole
Source: https://github.com/erfianugrah/dotfiles/tree/main/.pi/agent/skills/gloryhole
Command: npx skills add https://github.com/erfianugrah/dotfiles --skill gloryhole

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It provides fast, controllable DNS resolution with ad-blocking and fine-grained policy, without relying on untrusted upstreams for recursive behavior.

Core Features & Use Cases

  • Policy-driven DNS handling: Uses an expr-based engine to decide BLOCK / ALLOW / REDIRECT / FORWARD actions, including domain and IP/CIDR matchers.
  • Local authoritative records + CNAME resolution: Serves authoritative records and resolves CNAME chains locally for your internal hostnames.
  • Pi-hole-style blocklists with safe updates: Downloads blocklists, applies them via lock-free atomic swaps, and overrides TTL behavior for blocked answers.
  • Conditional forwarding with resilient round-robin: Evaluates priority-sorted conditional forwarding rules and forwards to upstreams using a round-robin strategy with circuit breaking and upstream health tracking.
  • Embedded Unbound recursion topology: Bundles Unbound recursor in the same runtime (supervised child on loopback) to provide DNSSEC-validated recursion for DoT/DoH use cases.
  • Built-in observability and audit trail: Exposes Prometheus metrics, uses OpenTelemetry meter patterns, and logs queries into SQLite asynchronously.

Quick Start

Configure your forwarder/policy/blocklist rules in ~/gloryhole/AGENTS.md, then run the glory-hole binary deployed under ~/gloryhole/ for your chosen home or public DoT/DoH profile.

Frequently Asked Questions about gloryhole

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a secure DNS server with policy-driven ad blocking and DoT/DoH?▼

To set up a secure DNS server, configure your forwarder, policy, and blocklist rules in the AGENTS.md file, then run the binary to apply Pi-hole-style ad blocking, expr-driven rules, and conditional forwarding for LAN or public DoT/DoH deployments.

What is the best way to apply Pi-hole-style blocklists safely without downtime?▼

The best way to apply Pi-hole-style blocklists safely is downloading them and applying changes via lock-free atomic swaps, which overrides TTL behavior for blocked answers without interrupting active DNS resolution.

Can I use Unbound for DNSSEC-validated recursion inside my DoT/DoH deployment?▼

Yes, you can use Unbound for DNSSEC-validated recursion by running it as a supervised child process on loopback, providing recursive DNS resolution directly within your DoT/DoH runtime.

Does this DNS policy engine support conditional forwarding with upstream health tracking?▼

Yes, the DNS policy engine supports conditional forwarding by evaluating priority-sorted rules and forwarding upstream using a round-robin strategy with circuit breaking and upstream health tracking.

How does the DNS server handle observability and query logging?▼

The DNS server handles observability by exposing Prometheus metrics, using OpenTelemetry meter patterns, and logging queries asynchronously into SQLite to maintain an audit trail without blocking resolution.

Why are SERVFAIL pass-through semantics important in a DNS forwarder?▼

SERVFAIL pass-through semantics are important because they ensure upstream resolution failures are transparently passed back to the client rather than masked, maintaining honest error reporting across the packet path flow.

Related Skills

Explore More Software Engineering Skills→
L3DigitalNetL3DigitalNet
6

dnsmasq

Administer dnsmasq DNS forwarding, DHCP, configuration, and troubleshooting.

Official
Intermediate
davidrrowleydavidrrowley

azure-monitor-opentelemetry-exporter-java

Export OpenTelemetry traces, metrics, and logs from Java applications to Azure Monitor.

Community
Intermediate
shepard-systemshepard-system
70

obs-alerts

Retrieve active alerts, silences, and Prometheus rule states via Alertmanager and Prometheus APIs.

Official
Intermediate
L3DigitalNetL3DigitalNet
6

pihole

Manage Pi-hole installation, configuration, blocklist updates, and troubleshooting.

Official
Intermediate