Skip to content

(feat) DNS Authority #236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mattv8 wants to merge 7 commits into
base: dev
Choose a base branch
from
Open

(feat) DNS Authority #236

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0db25c2
DNS authority management and features
mattv8 Feb 5, 2026
0d1c29b
Add support for updating TLS certificates in auth proxy
mattv8 Feb 18, 2026
705f4e0
Add multi-target, path routing, and proxy settings to auth config
mattv8 Feb 19, 2026
d031126
Add backward compatibility for single target URL in resource auth config
mattv8 Feb 19, 2026
ef8755b
feat(dns): add sticky session affinity
mattv8 Feb 19, 2026
896abb1
feat(dns): blend intelligent scoring with health latency
mattv8 Feb 19, 2026
d9f1ec4
fix(healthcheck): publish status every check for latency telemetry
mattv8 Feb 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,32 @@ When Newt receives WireGuard control messages, it will use the information encod

When Newt receives WireGuard control messages, it will use the information encoded to create a local low level TCP and UDP proxies attached to the virtual tunnel in order to relay traffic to programmed targets.

### DNS Authority

Newt includes an authoritative DNS server that can serve customized DNS records for specific domains (zones) managed by Pangolin. This allows for intelligent routing and high-availability setups where Newt can respond with the healthiest target IPs for a given service.

The DNS server runs on port 53 (UDP/TCP). By default, it binds to `0.0.0.0`, but this can be customized using the `--dns-bind` flag or `DNS_BIND_ADDR` environment variable.

#### systemd-resolved Conflict

On many modern Linux distributions, `systemd-resolved` binds to `127.0.0.53:53`, which prevents Newt from binding to `0.0.0.0:53`. To resolve this, you can:
1. Disable `systemd-resolved`: `sudo systemctl disable --now systemd-resolved`
2. Or bind Newt to a specific public IP that doesn't conflict with the loopback address used by resolved: `--dns-bind 1.2.3.4`
3. Or disable the DNS Authority feature entirely if you don't need it: `--disable-dns-authority`

## Configuration

Newt can be configured via environment variables or command-line flags.

| Environment Variable | Flag | Description | Default |
|----------------------|------|-------------|---------|
| `PANGOLIN_ENDPOINT` | `--endpoint` | Pangolin server endpoint | |
| `NEWT_ID` | `--id` | Newt Site ID | |
| `NEWT_SECRET` | `--secret` | Newt Site Secret | |
| `DNS_BIND_ADDR` | `--dns-bind` | Bind address for DNS Authority | `0.0.0.0` |
| `DISABLE_DNS_AUTHORITY` | `--disable-dns-authority` | Disable the DNS Authority server | `false` |
| `LOG_LEVEL` | `--log-level` | Logging level (DEBUG, INFO, WARN, ERROR, FATAL) | `INFO` |

## Build

### Binary
Expand Down
Loading