From 6b170d105775048b9913e85e699d244c5e004b5c Mon Sep 17 00:00:00 2001 From: Benjamin Dos Santos Date: Wed, 21 Oct 2026 10:59:01 +0200 Subject: [PATCH 1/4] chore: update ca-certificates --- dockerfiles/dnscrypt-proxy/Dockerfile | 18 +++++++++--------- dockerfiles/paperless-ngx/Dockerfile | 2 +- dockerfiles/pingdom-exporter/Dockerfile | 8 ++++---- dockerfiles/pint/Dockerfile | 8 ++++---- dockerfiles/resec/Dockerfile | 2 +- dockerfiles/thumbor/Dockerfile | 4 ++-- dockerfiles/tor/Dockerfile | 4 ++-- 7 files changed, 23 insertions(+), 23 deletions(-) diff --git a/dockerfiles/dnscrypt-proxy/Dockerfile b/dockerfiles/dnscrypt-proxy/Dockerfile index 7753d70c..d8ace7fc 100644 --- a/dockerfiles/dnscrypt-proxy/Dockerfile +++ b/dockerfiles/dnscrypt-proxy/Dockerfile @@ -18,16 +18,16 @@ COPY domains-allowlist.txt . RUN set -x \ && python3 /go/dnscrypt-proxy//utils/generate-domains-blocklist/generate-domains-blocklist.py \ - --config /tmp/domains-blocklist.conf \ - --allowlist /tmp/domains-allowlist.txt \ - --time-restricted /tmp/domains-time-restricted.txt \ - --timeout 120 \ - --output-file /etc/dnscrypt-proxy-blocklist.txt \ + --config /tmp/domains-blocklist.conf \ + --allowlist /tmp/domains-allowlist.txt \ + --time-restricted /tmp/domains-time-restricted.txt \ + --timeout 120 \ + --output-file /etc/dnscrypt-proxy-blocklist.txt \ && wget -q https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling/hosts \ - -O /etc/hosts.tmp + -O /etc/hosts.tmp # Run -FROM debian:12-slim +FROM debian:13-slim ARG BUILD_DATE ARG VCS_REF @@ -55,8 +55,8 @@ ENV DEBIAN_FRONTEND=noninteractive RUN set -x \ && apt-get update \ && apt-get install -y --no-install-recommends \ - ca-certificates=20250419~deb12u1 \ - dnsutils=1:9.18.49-1~deb12u2 \ + ca-certificates=20250419+deb13u1 \ + bind9-dnsutils=1:9.20.29-1~deb13u1 \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* diff --git a/dockerfiles/paperless-ngx/Dockerfile b/dockerfiles/paperless-ngx/Dockerfile index bfc36d9a..4a1c5ed4 100644 --- a/dockerfiles/paperless-ngx/Dockerfile +++ b/dockerfiles/paperless-ngx/Dockerfile @@ -26,7 +26,7 @@ RUN --mount=type=cache,target=/root/.cache/uv,id=pip-cache \ && apt-get install -y --no-install-recommends \ automake \ build-essential=12.12 \ - ca-certificates=20250419 \ + ca-certificates=20250419+deb13u1 \ curl \ default-libmysqlclient-dev \ gettext \ diff --git a/dockerfiles/pingdom-exporter/Dockerfile b/dockerfiles/pingdom-exporter/Dockerfile index afd26d96..7b7effcd 100644 --- a/dockerfiles/pingdom-exporter/Dockerfile +++ b/dockerfiles/pingdom-exporter/Dockerfile @@ -1,7 +1,7 @@ # Build -FROM golang:1.20-bookworm AS builder +FROM golang:1.22-bookworm AS builder -ENV VERSION=v1.4.0 +ENV VERSION=v1.4.2 # hadolint ignore=DL3003 RUN set -x \ @@ -11,7 +11,7 @@ RUN set -x \ && make # Run -FROM debian:12-slim +FROM debian:13-slim ARG BUILD_DATE ARG VCS_REF @@ -39,7 +39,7 @@ ENV DEBIAN_FRONTEND=noninteractive RUN set -x \ && apt-get update \ && apt-get install -y --no-install-recommends \ - ca-certificates=20250419~deb12u1 \ + ca-certificates=20250419+deb13u1 \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* diff --git a/dockerfiles/pint/Dockerfile b/dockerfiles/pint/Dockerfile index fbf44b1c..06ce1ab6 100644 --- a/dockerfiles/pint/Dockerfile +++ b/dockerfiles/pint/Dockerfile @@ -1,7 +1,7 @@ # Build -FROM golang:1.20-bookworm AS builder +FROM golang:1.27-trixie AS builder -ENV VERSION=v0.22.2 +ENV VERSION=v0.89.3 # hadolint ignore=DL3003 RUN set -x \ @@ -11,7 +11,7 @@ RUN set -x \ && make # Run -FROM debian:12-slim +FROM debian:13-slim ARG BUILD_DATE ARG VCS_REF @@ -39,7 +39,7 @@ ENV DEBIAN_FRONTEND=noninteractive RUN set -x \ && apt-get update \ && apt-get install -y --no-install-recommends \ - ca-certificates=20250419~deb12u1 \ + ca-certificates=20250419+deb13u1 \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* diff --git a/dockerfiles/resec/Dockerfile b/dockerfiles/resec/Dockerfile index 2be34b63..2083de68 100644 --- a/dockerfiles/resec/Dockerfile +++ b/dockerfiles/resec/Dockerfile @@ -39,7 +39,7 @@ ENV DEBIAN_FRONTEND=noninteractive RUN set -x \ && apt-get update \ && apt-get install -y --no-install-recommends \ - ca-certificates=20250419 \ + ca-certificates=20250419+deb13u1 \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* diff --git a/dockerfiles/thumbor/Dockerfile b/dockerfiles/thumbor/Dockerfile index 33dee16a..55e588f6 100644 --- a/dockerfiles/thumbor/Dockerfile +++ b/dockerfiles/thumbor/Dockerfile @@ -13,7 +13,7 @@ RUN set -x \ && apt-get update \ && apt-get install -y --no-install-recommends \ build-essential=12.12 \ - ca-certificates=20250419 \ + ca-certificates=20250419+deb13u1 \ cairosvg=2.7.1-2 \ ffmpeg=7:7.1.5-0+deb13u1 \ graphicsmagick=1.4+really1.3.45+hg17696-1 \ @@ -80,7 +80,7 @@ LABEL org.label-schema.build-date="$BUILD_DATE" \ RUN set -x \ && apt-get update \ && apt-get install -y --no-install-recommends \ - ca-certificates=20250419 \ + ca-certificates=20250419+deb13u1 \ cairosvg=2.7.1-2 \ ffmpeg=7:7.1.5-0+deb13u1 \ gifsicle=1.96-1 \ diff --git a/dockerfiles/tor/Dockerfile b/dockerfiles/tor/Dockerfile index 9fdfcea3..ca46a2d3 100644 --- a/dockerfiles/tor/Dockerfile +++ b/dockerfiles/tor/Dockerfile @@ -12,7 +12,7 @@ RUN set -x \ autoconf=2.72-3.1 \ automake=1:1.17-4 \ build-essential=12.12 \ - ca-certificates=20250419 \ + ca-certificates=20250419+deb13u1 \ dirmngr=2.4.7-21+deb13u1+b5 \ gnupg=2.4.7-21+deb13u1 \ libevent-dev=2.1.13-stable-1~deb13u1 \ @@ -98,7 +98,7 @@ LABEL org.label-schema.build-date="$BUILD_DATE" \ RUN set -x \ && apt-get update \ && apt-get install -y --no-install-recommends \ - ca-certificates=20250419 \ + ca-certificates=20250419+deb13u1 \ libevent-2.1-7t64=2.1.13-stable-1~deb13u1 \ libtorsocks=2.5.0-1+deb13u1 \ libssl-dev=3.5.7-1~deb13u3 \ From 5adfc5ff5939bb6faf7a6d2ee8fb13ae22f60bbc Mon Sep 17 00:00:00 2001 From: Benjamin Dos Santos Date: Wed, 21 Oct 2026 11:19:47 +0200 Subject: [PATCH 2/4] chore: decomission dnscrypt-proxy image --- Makefile | 1 - docker-compose.ci.yml | 10 +- docker-compose.yml | 15 +- dockerfiles/dnscrypt-proxy/Dockerfile | 83 --------- .../dnscrypt-proxy/dnscrypt-proxy.toml | 79 --------- .../dnscrypt-proxy/domains-allowlist.txt | 14 -- .../domains-blocklist-local-additions.txt | 19 --- .../dnscrypt-proxy/domains-blocklist.conf | 160 ------------------ .../domains-time-restricted.txt | 12 -- tests/dnscrypt-proxy.yaml | 35 ---- 10 files changed, 3 insertions(+), 425 deletions(-) delete mode 100644 dockerfiles/dnscrypt-proxy/Dockerfile delete mode 100644 dockerfiles/dnscrypt-proxy/dnscrypt-proxy.toml delete mode 100644 dockerfiles/dnscrypt-proxy/domains-allowlist.txt delete mode 100644 dockerfiles/dnscrypt-proxy/domains-blocklist-local-additions.txt delete mode 100644 dockerfiles/dnscrypt-proxy/domains-blocklist.conf delete mode 100644 dockerfiles/dnscrypt-proxy/domains-time-restricted.txt delete mode 100644 tests/dnscrypt-proxy.yaml diff --git a/Makefile b/Makefile index 4eb96b13..937ae998 100644 --- a/Makefile +++ b/Makefile @@ -50,7 +50,6 @@ pre-commit: ## Run pre-commit tests container-structure-test: ## Run container-structure-test $(info --> Run container-structure-test) - @$(CWD)/bin/container-structure-test test --image bdossantos/dnscrypt-proxy --config tests/dnscrypt-proxy.yaml @$(CWD)/bin/container-structure-test test --image bdossantos/paperless-ngx --config tests/paperless-ngx.yaml @$(CWD)/bin/container-structure-test test --image bdossantos/php-lol --config tests/php-lol.yaml @$(CWD)/bin/container-structure-test test --image bdossantos/pint --config tests/pint.yaml diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml index b53a94d6..537b7233 100644 --- a/docker-compose.ci.yml +++ b/docker-compose.ci.yml @@ -1,18 +1,12 @@ --- version: "3" services: - dnscrypt-proxy: &default + paperless-ngx: &default build: - context: dockerfiles/dnscrypt-proxy + context: dockerfiles/paperless-ngx args: BUILD_DATE: ${BUILD_DATE} VCS_REF: ${VCS_REF} - image: bdossantos/dnscrypt-proxy - container_name: dnscrypt-proxy - paperless-ngx: - <<: *default - build: - context: dockerfiles/paperless-ngx dockerfile: Dockerfile image: bdossantos/paperless-ngx container_name: paperless-ngx diff --git a/docker-compose.yml b/docker-compose.yml index c73b6376..9b635223 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,19 +1,6 @@ --- - -version: '3' +version: "3" services: - dnscrypt-proxy: - build: dockerfiles/dnscrypt-proxy - image: bdossantos/dnscrypt-proxy - container_name: dnscrypt-proxy - read_only: true - shm_size: 8M - environment: - - TZ=Europe/Paris - ports: - - 127.0.0.1:53:53/tcp - - 127.0.0.1:53:53/udp - restart: always tor: build: dockerfiles/tor image: bdossantos/tor diff --git a/dockerfiles/dnscrypt-proxy/Dockerfile b/dockerfiles/dnscrypt-proxy/Dockerfile deleted file mode 100644 index d8ace7fc..00000000 --- a/dockerfiles/dnscrypt-proxy/Dockerfile +++ /dev/null @@ -1,83 +0,0 @@ -# Build -FROM golang:1.20-bookworm AS builder - -ENV VERSION=2.1.5 - -# hadolint ignore=DL3003 -RUN set -x \ - && git clone https://github.com/DNSCrypt/dnscrypt-proxy \ - && cd /go/dnscrypt-proxy/dnscrypt-proxy \ - && git checkout "tags/${VERSION}" \ - && env CGO_ENABLED=0 GOOS=linux go build -ldflags='-s -w -extldflags "-static"' - -WORKDIR /tmp -COPY domains-blocklist-local-additions.txt . -COPY domains-blocklist.conf . -COPY domains-time-restricted.txt . -COPY domains-allowlist.txt . - -RUN set -x \ - && python3 /go/dnscrypt-proxy//utils/generate-domains-blocklist/generate-domains-blocklist.py \ - --config /tmp/domains-blocklist.conf \ - --allowlist /tmp/domains-allowlist.txt \ - --time-restricted /tmp/domains-time-restricted.txt \ - --timeout 120 \ - --output-file /etc/dnscrypt-proxy-blocklist.txt \ - && wget -q https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling/hosts \ - -O /etc/hosts.tmp - -# Run -FROM debian:13-slim - -ARG BUILD_DATE -ARG VCS_REF - -LABEL org.label-schema.build-date="$BUILD_DATE" \ - org.label-schema.name="dnscrypt-proxy" \ - org.label-schema.schema-version="1.0" \ - org.label-schema.url="https://github.com/DNSCrypt/dnscrypt-proxy" \ - org.label-schema.usage="https://github.com/DNSCrypt/dnscrypt-proxy/wiki" \ - org.label-schema.vcs-ref="$VCS_REF" \ - org.label-schema.vcs-url="https://github.com/bdossantos/dockerfiles" \ - org.label-schema.vendor="DNSCrypt" \ - org.label-schema.version="$VERSION" \ - org.opencontainers.image.created="$BUILD_DATE" \ - org.opencontainers.image.documentation="https://github.com/DNSCrypt/dnscrypt-proxy/wiki" \ - org.opencontainers.image.revision="$VCS_REF" \ - org.opencontainers.image.source="https://github.com/DNSCrypt/dnscrypt-proxy" \ - org.opencontainers.image.title="dnscrypt-proxy" \ - org.opencontainers.image.url="https://github.com/bdossantos/dockerfiles" \ - org.opencontainers.image.vendor="DNSCrypt" \ - org.opencontainers.image.version="$VERSION" - -ENV DEBIAN_FRONTEND=noninteractive - -RUN set -x \ - && apt-get update \ - && apt-get install -y --no-install-recommends \ - ca-certificates=20250419+deb13u1 \ - bind9-dnsutils=1:9.20.29-1~deb13u1 \ - && apt-get clean \ - && rm -rf /var/lib/apt/lists/* - -COPY --from=builder \ - /go/dnscrypt-proxy/dnscrypt-proxy/dnscrypt-proxy \ - /usr/local/bin/dnscrypt-proxy -COPY --from=builder \ - /etc/dnscrypt-proxy-blocklist.txt \ - /etc/dnscrypt-proxy-blocklist.txt -COPY --from=builder \ - /etc/hosts.tmp \ - /etc/hosts -COPY dnscrypt-proxy.toml /etc/dnscrypt-proxy.toml - -RUN set -x \ - && chmod 0444 /etc/dnscrypt-proxy.toml /etc/dnscrypt-proxy-blocklist.txt - -HEALTHCHECK --interval=30s --timeout=5s --start-period=30s \ - CMD dig +time=5 +tries=1 @127.0.0.1 -p 53 localhost - -EXPOSE 53/tcp 53/udp - -ENTRYPOINT ["/usr/local/bin/dnscrypt-proxy"] -CMD ["-config", "/etc/dnscrypt-proxy.toml"] diff --git a/dockerfiles/dnscrypt-proxy/dnscrypt-proxy.toml b/dockerfiles/dnscrypt-proxy/dnscrypt-proxy.toml deleted file mode 100644 index e315d15b..00000000 --- a/dockerfiles/dnscrypt-proxy/dnscrypt-proxy.toml +++ /dev/null @@ -1,79 +0,0 @@ -block_ipv6 = false -block_undelegated = true -block_unqualified = true -bootstrap_resolvers = ['1.1.1.1:53', '9.9.9.9:53'] -cache = true -cache_max_ttl = 86400 -cache_min_ttl = 3600 -cache_neg_max_ttl = 600 -cache_neg_ttl = 60 -cache_size = 16000 -cert_refresh_delay = 240 -dnscrypt_ephemeral_keys = false -dnscrypt_servers = true -doh_servers = true -force_tcp = false -ignore_system_dns = true -ipv4_servers = true -ipv6_servers = false -keepalive = 30 -lb_strategy = 'p2' -listen_addresses = ['0.0.0.0:53'] -max_clients = 1024 -netprobe_address = '1.1.1.1:53' -netprobe_timeout = 30 -reject_ttl = 600 -require_dnssec = false -require_nofilter = true -require_nolog = true -timeout = 3000 -tls_cipher_suite = [52392, 49199] -tls_disable_session_tickets = false - -[query_log] - file = "/dev/null" - format = "tsv" - -[blocked_names] - blocked_names_file = '/etc/dnscrypt-proxy-blocklist.txt' - log_file = '/dev/null' - -[sources] - [sources.'public-resolvers'] - urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/public-resolvers.md', 'https://download.dnscrypt.net/resolvers-list/v3/public-resolvers.md'] - cache_file = '/dev/shm/public-resolvers.md' - minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' - prefix = '' - - [sources.'relays'] - urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/relays.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/relays.md', 'https://download.dnscrypt.net/resolvers-list/v3/relays.md'] - cache_file = '/dev/shm/relays.md' - minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' - refresh_delay = 72 - prefix = '' - -[broken_implementations] - -# Cisco servers currently cannot handle queries larger than 1472 bytes, and don't -# truncate reponses larger than questions as expected by the DNSCrypt protocol. -# This prevents large responses from being received, and breaks relaying. -# A workaround for the first issue will be applied to servers in list below. -# Do not change that list until the bugs are fixed server-side. - -fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'cleanbrowsing-adult', 'cleanbrowsing-adult-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-security', 'cleanbrowsing-security-ipv6'] - -[schedules] - [schedules.'time-to-sleep'] - mon = [{after='23:00', before='7:00'}] - tue = [{after='23:00', before='7:00'}] - wed = [{after='23:00', before='7:00'}] - thu = [{after='23:00', before='7:00'}] - fri = [{after='00:00', before='7:00'}] - sat = [{after='00:00', before='7:00'}] - sun = [{after='23:00', before='7:00'}] - [schedules.'work'] - mon = [{after='9:00', before='18:00'}] - tue = [{after='9:00', before='18:00'}] - wed = [{after='9:00', before='18:00'}] - thu = [{after='9:00', before='18:00'}] - fri = [{after='9:00', before='17:00'}] diff --git a/dockerfiles/dnscrypt-proxy/domains-allowlist.txt b/dockerfiles/dnscrypt-proxy/domains-allowlist.txt deleted file mode 100644 index 9567d2ea..00000000 --- a/dockerfiles/dnscrypt-proxy/domains-allowlist.txt +++ /dev/null @@ -1,14 +0,0 @@ -amazon.com -azure.com -elasticbeanstalk.com -github.com -github.io -home -lan -local -localdomain -my.pingdom.com -ovh.net -spotify.com -tagcommander.com -tracker.debian.org diff --git a/dockerfiles/dnscrypt-proxy/domains-blocklist-local-additions.txt b/dockerfiles/dnscrypt-proxy/domains-blocklist-local-additions.txt deleted file mode 100644 index b2be644c..00000000 --- a/dockerfiles/dnscrypt-proxy/domains-blocklist-local-additions.txt +++ /dev/null @@ -1,19 +0,0 @@ -*.lan -*.local -*.localdomain -*.workgroup -ad.* -ads.* -banner.* -banners.* -creatives.* -eth0.me -eth0.me -ibpxl.com -internetbrands.com -motd.ubuntu.com -oas.* -oascentral.* -tag.* -telemetry.* -tracker.* diff --git a/dockerfiles/dnscrypt-proxy/domains-blocklist.conf b/dockerfiles/dnscrypt-proxy/domains-blocklist.conf deleted file mode 100644 index b22071ac..00000000 --- a/dockerfiles/dnscrypt-proxy/domains-blocklist.conf +++ /dev/null @@ -1,160 +0,0 @@ -################################################################################## -# # -# Generate a block list of domains using public data sources, and the local # -# domains-blocklist-local-additions.txt file. # -# # -# The default configuration is just indicative, and corresponds to the one # -# used to produce the public "mybase" set. # -# # -# Comment out the URLs of the sources you wish to disable, leave the ones # -# you would like enabled uncommented. Then run the script to build the # -# dnscrypt-blocklist-domains.txt file: # -# # -# $ generate-domains-blocklist.py -o dnscrypt-blocklist-domains.txt # -# # -# Domains that should never be blocked can be put into a file named # -# domains-allowlist.txt. # -# # -# That blocklist file can then be used in the dnscrypt-proxy.toml file: # -# # -# [blocked_names] # -# # -# blocked_names_file = 'dnscrypt-blocklist-domains.txt' # -# # -################################################################################## - -# Local additions -file:domains-blocklist-local-additions.txt - -# AdAway is an open source ad blocker for Android using the hosts file. -# https://raw.githubusercontent.com/AdAway/adaway.github.io/master/hosts.txt - -# EasyList -# https://easylist-downloads.adblockplus.org/easylist_noelemhide.txt - -# EasyList China -# https://easylist-downloads.adblockplus.org/easylistchina.txt - -# RU AdList -# https://easylist-downloads.adblockplus.org/advblock.txt - -# Peter Lowe's Ad and tracking server list -https://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml - -# Spam404 -# https://raw.githubusercontent.com/Spam404/lists/master/main-blacklist.txt - -# Malvertising filter list by Disconnect -# https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt - -# Ads filter list by Disconnect -# https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt - -# Basic tracking list by Disconnect -# https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt - -# KAD host file (fraud/adware) -# https://raw.githubusercontent.com/PolishFiltersTeam/KADhosts/master/KADomains.txt - -# BarbBlock list (spurious and invalid DMCA takedowns) -https://paulgb.github.io/BarbBlock/blacklists/domain-list.txt - -# Dan Pollock's hosts list -# https://someonewhocares.org/hosts/hosts - -# NoTracking's list - blocking ads, trackers and other online garbage -https://raw.githubusercontent.com/notracking/hosts-blocklists/master/dnscrypt-proxy/dnscrypt-proxy.blacklist.txt - -# NextDNS CNAME cloaking list -https://raw.githubusercontent.com/nextdns/cname-cloaking-blocklist/master/domains - -# AdGuard Simplified Domain Names filter -# https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt - -# Geoffrey Frogeye's block list of first-party trackers - https://hostfiles.frogeye.fr/ -https://hostfiles.frogeye.fr/firstparty-trackers.txt - -# CoinBlockerLists: blocks websites serving cryptocurrency miners - https://gitlab.com/ZeroDot1/CoinBlockerLists/ - Contains false positives -# https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list_browser.txt - -# Websites potentially publishing fake news -# https://raw.githubusercontent.com/marktron/fakenews/master/fakenews - -# Quidsup NoTrack Blocklist - Contains too many false positives to be enabled by default -# https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-blocklist.txt - -# Quidsup Malware Blocklist - Contains too many false positives to be enabled by default -# https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-malware.txt - -# AntiSocial Blacklist is an extensive collection of potentially malicious domains -# https://theantisocialengineer.com/AntiSocial_Blacklist_Community_V1.txt - -# Steven Black hosts file -# https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts - -# A list of adserving and tracking sites maintained by @lightswitch05 -https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt - -# A list of adserving and tracking sites maintained by @anudeepND -https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt - -# Anudeep's Blacklist (CoinMiner) - Blocks cryptojacking sites -# https://raw.githubusercontent.com/anudeepND/blacklist/master/CoinMiner.txt - -### Spark < Blu Go < Blu < Basic < Ultimate -### (With pornware blocking) Porn < Unified -# Energized Ultimate -# https://block.energized.pro/ultimate/formats/domains.txt - -# Energized Basic -# https://block.energized.pro/basic/formats/domains.txt - -# Energized BLU -# https://block.energized.pro/blu/formats/domains.txt - -# OISD.NL - Blocks ads, phishing, malware, tracking and more. WARNING: this is a huge list. -# https://dblw.oisd.nl/ - -# OISD.NL (smaller subset) - Blocks ads, phishing, malware, tracking and more. Tries to miminize false positives. -https://dblw.oisd.nl/basic/ - -# OISD.NL (extra) - Blocks ads, phishing, malware, tracking and more. Protection over functionality. -# https://dblw.oisd.nl/extra/ - -# Captain Miao ad list - Block ads and trackers, especially Chinese and Android trackers -# https://raw.githubusercontent.com/jdlingyu/ad-wars/master/sha_ad_hosts - -# Phishing Army - https://phishing.army/ -# https://phishing.army/download/phishing_army_blocklist.txt - -# Block pornography -# https://raw.githubusercontent.com/Clefspeare13/pornhosts/master/0.0.0.0/hosts -# https://raw.githubusercontent.com/Sinfonietta/hostfiles/master/pornography-hosts -# https://raw.githubusercontent.com/cbuijs/shallalist/master/porn/domains -# https://raw.githubusercontent.com/olbat/ut1-blacklists/master/blacklists/adult/domains -# https://block.energized.pro/porn/formats/domains.txt -# https://raw.githubusercontent.com/mhxion/pornaway/master/hosts/porn_sites.txt -# https://dblw.oisd.nl/nsfw/ - -# Block gambling sites -# https://raw.githubusercontent.com/Sinfonietta/hostfiles/master/gambling-hosts -# https://raw.githubusercontent.com/olbat/ut1-blacklists/master/blacklists/gambling/domains - -# Block dating websites -# https://raw.githubusercontent.com/olbat/ut1-blacklists/master/blacklists/dating/domains -# https://www.github.developerdan.com/hosts/lists/dating-services-extended.txt - -# Block social media sites -# https://raw.githubusercontent.com/Sinfonietta/hostfiles/master/social-hosts -# https://block.energized.pro/extensions/social/formats/domains.txt -# https://raw.githubusercontent.com/olbat/ut1-blacklists/master/blacklists/social_networks/domains -# https://www.github.developerdan.com/hosts/lists/facebook-extended.txt - -# Goodbye Ads - Specially designed for mobile ad protection -# https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master/Hosts/GoodbyeAds.txt - -# NextDNS BitTorrent blocklist -# https://raw.githubusercontent.com/nextdns/bittorrent-blocklist/master/domains - -# Block spying and tracking on Windows -# https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/dnscrypt/spy.txt diff --git a/dockerfiles/dnscrypt-proxy/domains-time-restricted.txt b/dockerfiles/dnscrypt-proxy/domains-time-restricted.txt deleted file mode 100644 index 84e8c20a..00000000 --- a/dockerfiles/dnscrypt-proxy/domains-time-restricted.txt +++ /dev/null @@ -1,12 +0,0 @@ -*.netflix.* @time-to-sleep -*.netflix.* @work -*.youtube.* @time-to-sleep -*.youtube.* @work -facebook.com @time-to-sleep -facebook.com @work -instagram.com @time-to-sleep -instagram.com @work -strava.com @time-to-sleep -strava.com @work -twitter.com @time-to-sleep -twitter.com @work diff --git a/tests/dnscrypt-proxy.yaml b/tests/dnscrypt-proxy.yaml deleted file mode 100644 index d9c102e3..00000000 --- a/tests/dnscrypt-proxy.yaml +++ /dev/null @@ -1,35 +0,0 @@ -schemaVersion: '2.0.0' - -fileExistenceTests: - - name: 'dnscrypt-proxy binary exists' - path: '/usr/local/bin/dnscrypt-proxy' - shouldExist: true - permissions: '-rwxr-xr-x' - uid: 0 - gid: 0 - - - name: 'dnscrypt-proxy config file exists' - path: '/etc/dnscrypt-proxy.toml' - shouldExist: true - uid: 0 - gid: 0 - -commandTests: - - name: 'dnscrypt-proxy binary checksum' - command: 'sha256sum' - args: ['/usr/local/bin/dnscrypt-proxy'] - expectedOutput: - - '429d8a21f51ac65cdaa89adc725098ff217153643aa126e1c946d914db48c2e4' - - - name: 'dnscrypt-proxy config checksum' - command: 'sha256sum' - args: ['/etc/dnscrypt-proxy.toml'] - expectedOutput: - - 'aaccd14d8cbbdc92f3d81eb862959b518dcb3878d3c7691a6458486fc23fa2ff' - - - name: 'dnscrypt-proxy version check' - command: '/usr/local/bin/dnscrypt-proxy' - args: ['-version'] - exitCode: 0 - expectedOutput: - - '2.1.5' From 99131c43523e843955359328812c3dbf35ebf61e Mon Sep 17 00:00:00 2001 From: Benjamin Dos Santos Date: Wed, 21 Oct 2026 11:28:59 +0200 Subject: [PATCH 3/4] chore(paperless-ngx): update to 3.3.3 --- dockerfiles/paperless-ngx/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dockerfiles/paperless-ngx/Dockerfile b/dockerfiles/paperless-ngx/Dockerfile index 4a1c5ed4..95077bd5 100644 --- a/dockerfiles/paperless-ngx/Dockerfile +++ b/dockerfiles/paperless-ngx/Dockerfile @@ -9,7 +9,7 @@ ENV \ PATH=/app/bin/:/app/.venv/bin/:$PATH \ PYTHONUSERBASE=/app \ PYTHONDONTWRITEBYTECODE=1 \ - VERSION=3.3.0 + VERSION=3.3.3 SHELL ["/bin/bash", "-o", "pipefail", "-c"] From abdd75a63bfdf46603385bb0a08459a7e34f4513 Mon Sep 17 00:00:00 2001 From: Benjamin Dos Santos Date: Wed, 21 Oct 2026 11:50:43 +0200 Subject: [PATCH 4/4] refactor(paperless-ngx): remove nltk https://github.com/paperless-ngx/paperless-ngx/commit/530059c5c0be4e6ac2c5022ea00871b46988a5d5 --- dockerfiles/paperless-ngx/Dockerfile | 4 ---- 1 file changed, 4 deletions(-) diff --git a/dockerfiles/paperless-ngx/Dockerfile b/dockerfiles/paperless-ngx/Dockerfile index 95077bd5..fc0f1612 100644 --- a/dockerfiles/paperless-ngx/Dockerfile +++ b/dockerfiles/paperless-ngx/Dockerfile @@ -62,9 +62,6 @@ RUN --mount=type=cache,target=/root/.cache/uv,id=pip-cache \ --index-strategy unsafe-best-match \ --requirements requirements.txt \ && pushd /app \ - && python3 -W ignore::RuntimeWarning -m nltk.downloader -d '/tmp/nltk_data' snowball_data \ - && python3 -W ignore::RuntimeWarning -m nltk.downloader -d '/tmp/nltk_data' stopwords \ - && python3 -W ignore::RuntimeWarning -m nltk.downloader -d '/tmp/nltk_data' punkt_tab \ && PAPERLESS_SECRET_KEY=build-time-dummy python3 manage.py collectstatic --clear --no-input --link \ && PAPERLESS_SECRET_KEY=build-time-dummy python3 manage.py compilemessages \ && apt-get clean \ @@ -184,7 +181,6 @@ COPY --from=build "$PYTHONUSERBASE" "$PYTHONUSERBASE" COPY --from=build /tmp/jbig2enc/src/*.h /usr/local/include/ COPY --from=build /tmp/jbig2enc/src/.libs/libjbig2enc* /usr/local/lib/ COPY --from=build /tmp/jbig2enc/src/jbig2 /usr/local/bin/ -COPY --from=build /tmp/nltk_data /usr/share/nltk_data COPY --from=build /usr/local/src/paperless-ngx/docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml COPY entrypoint.sh /entrypoint.sh COPY copy-to-consumption-dir /app/copy-to-consumption-dir