Corefile

# this file demonstrates reference production settings.
# for local development use: ./p2p-forge -conf Corefile.local-dev
libp2p.direct {
    log
    errors
    any # RFC 8482
    prometheus localhost:9253
    denylist {
        # Spamhaus DROP: hijacked IP ranges used for spam and malware
        # Spamhaus recommends once per day; 12h is a reasonable compromise
        feed https://www.spamhaus.org/drop/drop.txt format=ip refresh=12h name=spamhaus-drop
        feed https://www.spamhaus.org/drop/dropv6.txt format=ip refresh=12h name=spamhaus-dropv6
        # URLhaus: malware distribution URLs (IPs extracted)
        # URLhaus updates every 5 minutes; use their stated minimum
        feed https://urlhaus.abuse.ch/downloads/text/ format=url refresh=5m name=urlhaus
        # Local allowlist: bypasses all denylists (own infrastructure, feed false positives)
        # file ip-allowlist.txt type=allow
        # Local denylist: quick blocks without waiting for feed updates
        # file ip-denylist.txt
    }
    ipparser libp2p.direct
    file zones/libp2p.direct
    acme libp2p.direct {
        # HTTP API at /v1/_acme-challenge
        # production settings: TLS is terminated elsewhere:
        registration-domain registration.libp2p.direct listen-address=:80 external-tls=true
        # to handle tls termination as well, use: listen-address=:443 external-tls=false
        #
        # DNS-01 challenge cache
        # production settings: DynamoDB shared across all instances
        database-type dynamo libp2p-direct-challenges
        # for local dev with badger: database-type badger badger.libp2p-direct-challenges
    }
}