nginx-doh-and-dot-to-dot.conf

user  nginx;
worker_processes  auto;

load_module modules/ngx_stream_js_module.so;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;

  # logging directives
  log_format  doh   '$remote_addr - $remote_user [$time_local] "$request" '
                    '[ $msec, $request_time, $upstream_response_time $pipe ] '
                    '$status $body_bytes_sent "$http_x_forwarded_for" '
                    '$upstream_http_x_dns_question $upstream_http_x_dns_type '
                    '$upstream_http_x_dns_result '
                    '$upstream_http_x_dns_ttl $upstream_http_x_dns_answers '
                    '$upstream_cache_status';

  access_log  /var/log/nginx/doh-access.log doh;

  # This upstream connects to a local Stream service which converts HTTP -> DNS
  upstream dohloop {
    zone dohloop 64k;
    server 127.0.0.1:8053;
    keepalive_timeout 60s;
    keepalive_requests 100;
    keepalive 10;
  }

  # Proxy Cache storage - so we can cache the DoH response from the upstream
  proxy_cache_path /var/cache/nginx/doh_cache levels=1:2 keys_zone=doh_cache:10m;

  # The DoH server block
  server {
  
    # Listen on standard HTTPS port, and accept HTTP2, with SSL termination
    listen 443 ssl http2;
    ssl_certificate /etc/nginx/ssl/certs/doh.local.pem;
    ssl_certificate_key /etc/nginx/ssl/private/doh.local.pem;
    ssl_session_cache shared:ssl_cache:10m;
    ssl_session_timeout 10m;

    # DoH may use GET or POST requests, Cache both
    proxy_cache_methods GET POST;

    # Return 404 to all responses, except for those using our published DoH URI
    location / {
      return 404 "404 Not Found\n";
    }

    # This is our published DoH URI 
    location /dns-query {

      # Proxy HTTP/1.1, clear the connection header to enable Keep-Alive
      proxy_http_version 1.1;
      proxy_set_header Connection "";

      # Enable Cache, and set the cache_key to include the request_body
      proxy_cache doh_cache;
      proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;

      # proxy pass to the dohloop upstream
      proxy_pass http://dohloop;
    }

  }

}

# DNS Stream Services
stream {

  # DNS logging
  log_format  dns   '$remote_addr [$time_local] $protocol "$dns_qname"';
  access_log /var/log/nginx/dns-access.log dns;

  # Import the NJS module
  js_import /etc/nginx/njs.d/dns/dns.js;

  # The $dns_qname variable can be populated by preread calls, and can be used for DNS routing
  js_set $dns_qname dns.get_qname;

  # DNS over TLS upstream pool
  upstream dot {
    zone dot 64k;
    server 8.8.8.8:853;
  }

  # DNS(TCP) and DNS over TLS (DoT) Server
  # Upstream can be either DNS(TCP) or DoT. If upstream is DNS, proxy_ssl should be off.
  server {

    # DNS TCP
    listen 53;

    # DNS DoT
    listen 853 ssl;
    ssl_certificate /etc/nginx/ssl/certs/doh.local.pem;
    ssl_certificate_key /etc/nginx/ssl/private/doh.local.pem;

    # This is used to pull out question for logging
    js_preread dns.preread_dns_request;

    # Enable SSL re-encryption for DoT connection upstream
    proxy_ssl on;
    proxy_pass dot;
  }

  # DNS over HTTPS (gateway) Service
  # Upstream can be either DNS(TCP) or DoT. If upstream is DNS, proxy_ssl should be off.
  server {
    listen 127.0.0.1:8053;
    js_filter dns.filter_doh_request;
    proxy_ssl on;
    proxy_pass dot;
  }

}