NextDNS

Recent Commits

• Raymoz101 (12 Jul 26)

  feat: make the nextdns command available on PATH on Firewalla (#1118) install.sh places the Firewalla binary at /home/pi/.firewalla/config/nextdns/nextdns (bin_location) and, unlike other platforms, creates no symlink in a PATH directory, so the documented 'nextdns status/log/...' commands do not work as typed. A one-time symlink would not help either: /usr/local on Firewalla is a memory-backed overlay cleared at every reboot, so the link must be refreshed from the run script's start action, which executes at every boot via post_main.d. Also remove the pidfile left behind by pre-systemd versions of this script; nothing reads it anymore and it is misleading when debugging. Co-authored-by: Claude Fable 5 <[email protected]>

• dependabot[bot] (11 Jul 26)

  chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 (#1115) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.56.0 to 0.57.0. - [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Raymoz101 (11 Jul 26)

  bug: fix Firewalla service killed at boot and left unsupervised (#1113) On Firewalla, the generated run script started the daemon as a detached background process tracked by a pidfile. This had three failure modes: - At boot the script is executed from firewalla.service (Type=oneshot, KillMode=control-group, RemainAfterExit=no), so the daemon started inside that unit's control group and was killed by systemd's cgroup cleanup as soon as the unit's start-up run exited, leaving the daemon down after every reboot. With the router-mode dnsmasq snippet (which uses no-resolv) this is a total DNS outage. Reproduction on a Firewalla Gold (systemd 249): systemd-run --unit=t -p Type=oneshot -p KillMode=control-group \ /bin/sh -c 'sleep 300 </dev/null >/dev/null 2>&1 &' # seconds later the sleep process is gone - The pidfile lives under /home/pi/firewalla/run on persistent storage and survives reboots. is_running() only checked that some process with the stored PID existed, so a recycled PID made start report "Already started" without starting anything, and stop could kill an unrelated process. - A crashed daemon was never restarted. Run the daemon as a transient systemd unit instead: systemd-run escapes the oneshot unit's control group, Restart=on-failure provides crash recovery, and no pidfile is needed. Firewalla is Ubuntu-based, so systemd is always present. The script keeps the same interface and output contract ("Already started"/"Running"/"Stopped", exit codes), so the Go Status/Start/Stop/Restart implementations are unchanged. Co-authored-by: Claude Fable 5 <[email protected]>

• dependabot[bot] (11 Jul 26)

  chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 (#1116) Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.46.0 to 0.47.0. - [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (11 Jul 26)

  chore(deps): bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2 (#1117) Bumps [github.com/dgraph-io/ristretto/v2](https://github.com/dgraph-io/ristretto) from 2.4.0 to 2.4.2. - [Release notes](https://github.com/dgraph-io/ristretto/releases) - [Changelog](https://github.com/dgraph-io/ristretto/blob/main/CHANGELOG.md) - [Commits](https://github.com/dgraph-io/ristretto/compare/v2.4.0...v2.4.2) --- updated-dependencies: - dependency-name: github.com/dgraph-io/ristretto/v2 dependency-version: 2.4.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Raymoz101 (10 Jul 26)

  feat: add Firewalla dnsmasq lease file to DHCP discovery (#1114) Firewalla's firerouter writes dnsmasq DHCP leases to /home/pi/.router/run/dhcp/dnsmasq.leases, which is not in the probed lease file list, so lease-based client-name discovery never engages on Firewalla and naming relies solely on the redis-based discovery's 5-minute refresh. The path cannot exist on other platforms, so the entry is inert elsewhere. Co-authored-by: Claude Fable 5 <[email protected]>

• Sean Floyd (09 Jul 26)

  fix(endpoint): serve queries lock-free during endpoint tests (#1111) Manager held m.mu.Lock() across blocking DoH I/O in findBestEndpointLocked (endpoint discovery/probing) while getActiveEndpoint, the per-query hot path, took m.mu.RLock(). A hung endpoint test therefore blocked every DNS query for up to DefaultBackgroundTestTimeout (30s) -- a total DNS blackout, cached names included -- with the daemon still alive and status OK, recoverable only by restart. Likely the root cause behind #196, #699 and #737. Make Manager.activeEndpoint an atomic.Pointer and read it lock-free in getActiveEndpoint so queries keep using the current endpoint while a test runs. The write lock still serializes tests but no longer gates queries. Also: - bound the cold-start bootstrap with the caller context (cancellable lock + bounded test) so a first-query hang can't block forever; - switch mu to sync.Mutex now that nothing RLocks it, with a comment guarding against reintroducing the stall; - guard DOHEndpoint's lazy transport init/close, a data race the lock-free read newly exposes (go test -race flags it on master); - fix a latent lock leak on the bootstrap error path. Verified: TestManager_QueryNotBlockedByBackgroundTest and TestDOHEndpoint_ConcurrentRoundTripAndClose fail on master and pass with the fix; go test -race -count=10 ./resolver/endpoint/ is green. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Nitish Agarwal (18 Jun 26)

  feat: add dinit init system support (#1105) Detect dinit as PID 1 via /proc/1/comm and write a dinit service description to /etc/dinit.d/<name>. Environment is passed via an env-file sidecar (/etc/dinit.d/<name>.env) since dinit service descriptions do not support inline env directives. Enable/disable at boot and drive start/stop/restart/status via dinitctl.

• Nitish Agarwal (17 Jun 26)

  feat: warn when client discovery is disabled by loopback-only listen (#1104) When report-client-info is enabled but nextdns listens only on a loopback address, client discovery is silently skipped. Devices then appear in the NextDNS dashboard with random IDs and no hostnames, with nothing in the logs to explain why. Add a Warningf log line in that branch so the misconfiguration is visible at startup.

• Nitish Agarwal (17 Jun 26)

  feat: add shell completion command (#1106) Add `nextdns completion <bash|zsh|fish>` that emits a shell completion script for the given shell. Covers top-level commands (derived from the commands table) and config subcommands (list, set, edit, wizard). - completion.go: pure completionScript() generator + thin command wrapper - completion_test.go: unit tests for all three shells and error cases - main.go: register completion command; move commands slice to init() to avoid an initialization cycle - README.md: document how to install the completion script

• dependabot[bot] (14 Jun 26)

  chore(deps): bump golang.org/x/net from 0.53.0 to 0.56.0 (#1103) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.53.0 to 0.56.0. - [Commits](https://github.com/golang/net/compare/v0.53.0...v0.56.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Olivier Poitrey (03 Jun 26)

  chore: upgrade go verson to 1.26.4

• dependabot[bot] (18 Apr 26)

  chore(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 (#1084) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.52.0 to 0.53.0. - [Commits](https://github.com/golang/net/compare/v0.52.0...v0.53.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Olivier Poitrey (18 Apr 26)

  bug: strip CIDR from OpenWrt DHCP option DNS address (#1082)

• Olivier Poitrey (13 Apr 26)

  bug: reset endpoint probe timeouts per candidate Create and cancel a fresh timeout context for each endpoint probe so one candidate cannot leak its expired deadline into later probes.

• Olivier Poitrey (13 Apr 26)

  bug: synchronize netstatus checker state Synchronize checker startup and shared state updates so Notify and Stop cannot race on the global cancel function or previous interface snapshot.

• Olivier Poitrey (13 Apr 26)

  bug: refresh DHCP data under a write lock Move DHCP cache refresh onto a write-locked path so concurrent lookups no longer mutate shared maps while only holding an RLock.

• Olivier Poitrey (13 Apr 26)

  bug: guard zero inflight request limits Treat a configured inflight limit of zero as the default limit so the proxy does not create an unbuffered semaphore channel and deadlock on the first request.

• Olivier Poitrey (13 Apr 26)

  bug: bound idle TCP client reads Set a read deadline before consuming each TCP DNS query so an idle or slow client cannot hold an inflight slot indefinitely and starve the proxy.

• Olivier Poitrey (09 Apr 26)

  chore: pin CI Go setup action to 1.26.2

• Olivier Poitrey (06 Apr 26)

  Disable openwrt 24 backport

• Olivier Poitrey (16 Mar 26)

  chore: use apk for OpenWrt 25.12 installs Fixes #1073

• Olivier Poitrey (16 Mar 26)

  Add reconcile backport CI check

• Olivier Poitrey (16 Mar 26)

  Add reconcile script for OpenWRT

• dependabot[bot] (15 Mar 26)

  chore(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 (#1078) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.51.0 to 0.52.0. - [Commits](https://github.com/golang/net/compare/v0.51.0...v0.52.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot] (14 Mar 26)

  chore(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 (#1077) Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.41.0 to 0.42.0. - [Commits](https://github.com/golang/sys/compare/v0.41.0...v0.42.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Olivier Poitrey (28 Feb 26)

  ci: enhance binary size reporting workflow with PR detection and separate reports for Linux/Windows and Darwin - Added a job to find the pull request associated with the branch. - Created separate jobs for generating binary size reports for Linux/Windows and Darwin. - Updated the comment step to include detailed reports for both platforms. - Improved output handling and error checking for the reporting steps.

• dependabot[bot] (28 Feb 26)

  chore(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#1070) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.50.0 to 0.51.0. - [Commits](https://github.com/golang/net/compare/v0.50.0...v0.51.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Olivier Poitrey (22 Feb 26)

  ci: fix binary-size-report action syntax

• Olivier Poitrey (22 Feb 26)

  ci: add binary size report on PR