From 07924fe8925706cba6113bfec59d628b333b2020 Mon Sep 17 00:00:00 2001
From: Bram <info@bramkelchtermans.be>
Date: Sun, 30 Aug 2026 23:00:48 +0200
Subject: [PATCH] dns proxy

---
 Dockers/dns-proxy/Dockerfile                 | 13 +++++
 Dockers/dns-proxy/docker-compose.example.yml | 15 +++++
 Dockers/dns-proxy/entrypoint.sh              | 59 ++++++++++++++++++++
 3 files changed, 87 insertions(+)
 create mode 100644 Dockers/dns-proxy/Dockerfile
 create mode 100644 Dockers/dns-proxy/docker-compose.example.yml
 create mode 100755 Dockers/dns-proxy/entrypoint.sh

diff --git a/Dockers/dns-proxy/Dockerfile b/Dockers/dns-proxy/Dockerfile
new file mode 100644
index 0000000..4c93175
--- /dev/null
+++ b/Dockers/dns-proxy/Dockerfile
@@ -0,0 +1,13 @@
+FROM caddy:2-alpine
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENV LISTEN_PORT=8080 \
+    TARGET_URL="" \
+    PROXY_INSECURE_TLS=0 \
+    PRESERVE_HOST=0
+
+EXPOSE 8080
+
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/Dockers/dns-proxy/docker-compose.example.yml b/Dockers/dns-proxy/docker-compose.example.yml
new file mode 100644
index 0000000..a7e0ae2
--- /dev/null
+++ b/Dockers/dns-proxy/docker-compose.example.yml
@@ -0,0 +1,15 @@
+services:
+  dns-proxy:
+    build: .
+    ports:
+      - "8080:8080"
+    environment:
+      TARGET_URL: "https://internal.example.com"
+      # PROXY_INSECURE_TLS: "1"   # if upstream uses a self-signed cert
+      # PRESERVE_HOST: "1"       # keep the client's Host header instead of the upstream host
+    dns:
+      - 10.0.0.53   # custom DNS required to resolve TARGET_URL
+    # Extra hosts are also an option instead of / alongside custom DNS:
+    # extra_hosts:
+    #   - "internal.example.com:10.0.0.10"
+    restart: unless-stopped
diff --git a/Dockers/dns-proxy/entrypoint.sh b/Dockers/dns-proxy/entrypoint.sh
new file mode 100755
index 0000000..fb04e42
--- /dev/null
+++ b/Dockers/dns-proxy/entrypoint.sh
@@ -0,0 +1,59 @@
+#!/bin/sh
+set -eu
+
+TARGET_URL="${TARGET_URL:-}"
+LISTEN_PORT="${LISTEN_PORT:-8080}"
+PROXY_INSECURE_TLS="${PROXY_INSECURE_TLS:-0}"
+PRESERVE_HOST="${PRESERVE_HOST:-0}"
+
+if [ -z "$TARGET_URL" ]; then
+  echo "TARGET_URL is required (e.g. https://internal.example.com)" >&2
+  exit 1
+fi
+
+case "$TARGET_URL" in
+  http://*|https://*) ;;
+  *)
+    echo "TARGET_URL must start with http:// or https://" >&2
+    exit 1
+    ;;
+esac
+
+# Strip trailing slash so paths concatenate cleanly
+TARGET_URL="${TARGET_URL%/}"
+
+CADDYFILE="/etc/caddy/Caddyfile"
+mkdir -p /etc/caddy
+
+EXTRA_DIRECTIVES=""
+
+if [ "$PRESERVE_HOST" = "1" ]; then
+  EXTRA_DIRECTIVES="${EXTRA_DIRECTIVES}
+		header_up Host {http.request.host}"
+fi
+
+if [ "$PROXY_INSECURE_TLS" = "1" ]; then
+  EXTRA_DIRECTIVES="${EXTRA_DIRECTIVES}
+		transport http {
+			tls_insecure_skip_verify
+		}"
+fi
+
+cat > "$CADDYFILE" <<EOF
+{
+	admin off
+	auto_https off
+}
+
+:${LISTEN_PORT} {
+	reverse_proxy ${TARGET_URL} {${EXTRA_DIRECTIVES}
+	}
+}
+EOF
+
+echo "Proxying :${LISTEN_PORT} -> ${TARGET_URL}"
+if [ "$PROXY_INSECURE_TLS" = "1" ]; then
+  echo "TLS verification disabled for upstream"
+fi
+
+exec caddy run --config "$CADDYFILE" --adapter caddyfile