v0.1.0

First MVP release of BNS — caching DNS forwarder with ad-block, intended for small private networks (Raspberry Pi-class hardware).

Features

• UDP + TCP listeners (single shared resolver chain)
• In-memory LRU cache with TTL-aware expiry and negative caching
• Singleflight upstream coalescing
• Blocklist matcher (exact + subdomain wildcard) with hot-reload on SIGHUP
• Prometheus /metrics, /healthz, /readyz
• Configurable upstream pool with primary + fallback
• Multi-arch container image (linux/amd64, linux/arm64) — see below

Container

Image published at ghcr.io/bcrisp4/bns:0.1.0 (also 0.1 and latest).

docker run -d \
  -p 53:5354/udp -p 53:5354/tcp -p 9090:9090 \
  --name bns ghcr.io/bcrisp4/bns:0.1.0

Built on gcr.io/distroless/static-debian12:nonroot. Hagezi pro.txt (~459K domains) baked in at /etc/bns/blocklists/pro.txt. Override config via bind-mount, BNS_* env vars, or trailing CLI flags.

Caveats

• Container listens on :5354 (nonroot can't bind privileged ports). Map host :53 at run time.
• Blocklist refresh requires image rebuild (URL fetcher source not yet implemented).
• DoH/DoT/DoQ upstream not yet implemented — UDP plaintext only.