This file is generated from plugin struct tags, so manual edits are
overwritten. After changing a plugin configuration, run go generate ./....
For a configuration to start from, copy dnspatch.toml.example.
Base URL of the service; change it to use a self-hosted instance
proxy
no
direct
URL of a proxy to send requests through: socks5, socks5h, http or https, optionally with user:pass@ (percent-encode special characters). The default, direct, connects without a proxy and ignores the proxy environment variables. Behind a proxy the service reports the address the proxy connects from, not the address of this host, so set it only when that is the address you want
Base URL of the service; icanhazip.com is dual-stack and replies over whichever IP family the request arrives on
family
no
ipv4
IP family to ask for: ipv4, ipv6, or dual to fetch both with two requests. Without a proxy each request is sent over its family; with a proxy the family of the connection is up to the proxy, and the reply is only checked to be of the right family
proxy
no
direct
URL of a proxy to send requests through: socks5, socks5h, http or https, optionally with user:pass@ (percent-encode special characters). The default, direct, connects without a proxy and ignores the proxy environment variables. Behind a proxy the service reports the address the proxy connects from, not the address of this host, so set it only when that is the address you want
Base URL of the service; ident.me is dual-stack and replies over whichever IP family the request arrives on
family
no
ipv4
IP family to ask for: ipv4, ipv6, or dual to fetch both with two requests. Without a proxy each request is sent over its family; with a proxy the family of the connection is up to the proxy, and the reply is only checked to be of the right family
proxy
no
direct
URL of a proxy to send requests through: socks5, socks5h, http or https, optionally with user:pass@ (percent-encode special characters). The default, direct, connects without a proxy and ignores the proxy environment variables. Behind a proxy the service reports the address the proxy connects from, not the address of this host, so set it only when that is the address you want
Base URL of the service; change it to use a self-hosted instance
family
no
ipv4
IP family to ask for: ipv4, ipv6, or dual to fetch both with two requests. Without a proxy each request is sent over its family; with a proxy the family of the connection is up to the proxy, and the reply is only checked to be of the right family
proxy
no
direct
URL of a proxy to send requests through: socks5, socks5h, http or https, optionally with user:pass@ (percent-encode special characters). The default, direct, connects without a proxy and ignores the proxy environment variables. Behind a proxy the service reports the address the proxy connects from, not the address of this host, so set it only when that is the address you want
Name of the network interface to read, for example eth0, wan or Ethernet. Of the addresses on it, only public ones are considered: loopback, link-local, private (10/8, 172.16/12, 192.168/16, fc00::/7) and shared CGNAT (100.64/10) addresses are skipped. If several remain, the numerically lowest one is used, so the choice is stable; narrow it down with network
family
no
ipv6
IP family to read: ipv4, ipv6, or dual to read both. dual fails when the interface has no suitable address of either family
network
no
—
Optional CIDR prefix, for example 2001:db8:1234::/64: only addresses inside it are considered. Use it to pick one of several prefixes on the interface, such as a delegated prefix, or to tell a stable address from a temporary one
Base URL of the service; api64.ipify.org is dual-stack and replies over whichever IP family the request arrives on
family
no
ipv4
IP family to ask for: ipv4, ipv6, or dual to fetch both with two requests. Without a proxy each request is sent over its family; with a proxy the family of the connection is up to the proxy, and the reply is only checked to be of the right family
proxy
no
direct
URL of a proxy to send requests through: socks5, socks5h, http or https, optionally with user:pass@ (percent-encode special characters). The default, direct, connects without a proxy and ignores the proxy environment variables. Behind a proxy the service reports the address the proxy connects from, not the address of this host, so set it only when that is the address you want
Record name relative to the zone: @ for the apex, * for a wildcard, or a label such as home
username
yes
—
Beget account login used for API calls
password
yes
—
Beget account password
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
ID of the zone, shown on the zone's Overview page in the Cloudflare dashboard
zone
yes
—
Domain name of the zone, for example example.com
rr_name
yes
—
Record name relative to the zone: @ for the apex, * for a wildcard, or a label such as home
ttl
no
300
TTL in seconds for a record this provider creates; an existing record keeps its own TTL. 1 means automatic
proxied
no
—
Whether a record this provider creates is proxied through Cloudflare (the orange cloud); an existing record keeps its own setting
token
yes
—
Cloudflare API token, scoped to Zone:DNS:Edit on this zone only
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Subdomain registered at DuckDNS, without the .duckdns.org suffix
token
yes
—
DuckDNS account token, shown on the DuckDNS dashboard
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Full domain name of the host to update, for example home.example.com
username
yes
—
Login of the Dyn account
password
yes
—
Updater client key of the account, created in the account settings; it is not the account password
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Update URL of the service, for example https://api.nic.ru/dyndns/update for NIC.RU or https://updates.dnsomatic.com/nic/update for DNS-O-Matic
hostname
yes
—
Full domain name of the record to update. NIC.RU changes the A records with this name in every zone of the contract
ip_param
no
myip
Query parameter that carries the IPv4 address
ipv6_param
no
ipv6
Query parameter that carries the IPv6 address; both addresses go in one request, so the service must know this parameter to update an AAAA record. Set it to the same name as ip_param for a service that takes both addresses in one parameter, separated by a comma. A family the retrievers did not report is not sent, and the service may then fall back to the address the request came from
username
yes
—
Login for HTTP Basic authentication; for NIC.RU the login of the contract or of the account allowed to use Dynamic DNS
password
yes
—
Password for HTTP Basic authentication; some services issue a separate update password
user_agent
no
dnspatch
User-Agent header; the protocol asks clients to identify themselves, and some services refuse a request without one
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Full domain name of the record to update, for example home.example.com
username
yes
—
Dynu account login
password
yes
—
Password of the account, or the separate IP update password that Dynu lets you set in the account, which is the safer choice
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Full build only. The lightweight build rejects a config that uses it. Use the -full image or binary, or build with the namecheap or full tag; see Installation.
Parameter
Required
Default
Description
base_url
no
https://dynamicdns.park-your-domain.com/update
Update URL of the Namecheap Dynamic DNS API
host
yes
—
Host to update: @ for the bare domain, or the host record's name
domain
yes
—
Domain registered at Namecheap, exactly as it appears in the account (the API is case-sensitive)
password
yes
—
Dynamic DNS Password from the domain's Advanced DNS tab, not the account password
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Full domain name of the record to update. NIC.RU changes the A records with this name in every zone of the contract, not only in the zone the domain belongs to
username
yes
—
Login of the NIC.RU account or contract that may update the domain; the Dynamic DNS service must be switched on for it
password
yes
—
Password for that login
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Full domain name of the host to update, for example home.example.com or a name under ddns.net
username
yes
—
Login for the update: a DDNS key of the host, or the No-IP account itself
password
yes
—
Password for that login
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Record name relative to the zone: @ for the apex, * for a wildcard, or a label such as home
username
yes
—
REG.RU account login used for API calls
password
yes
—
API password; set an alternative password for the API in the REG.RU account and allow the address dnspatch runs from
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Full build only. The lightweight build rejects a config that uses it. Use the -full image or binary, or build with the rfc2136 or full tag; see Installation.
Parameter
Required
Default
Description
server
yes
—
Address of the name server that accepts updates, as host or host:port. The port defaults to 53. It must be the primary (master) server of the zone or one that forwards updates to it
zone
yes
—
Domain name of the zone the server is authoritative for, for example example.com
rr_name
yes
—
Record name relative to the zone: @ for the apex, * for a wildcard, or a label such as home
ttl
no
300
TTL in seconds of the record this provider writes
key_name
no
—
Name of the TSIG key used to sign updates, as configured on the server. Leave empty (together with key_secret) to send unsigned updates, which only fits a server that authorizes by client address
key_algorithm
no
hmac-sha256
TSIG algorithm of the key: hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 or hmac-sha512
key_secret
no
—
Base64-encoded secret of the TSIG key, as printed by tsig-keygen
protocol
no
tcp
Transport of the update: tcp or udp. There is no fallback from one to the other
timeout
no
10s
How long to wait for the server to answer an update
Record name relative to the zone: @ for the apex, * for a wildcard, or a label such as home
ttl
no
60
TTL in seconds for a record this provider creates; an existing record keeps its own TTL. Selectel accepts 60 to 604800
project_name
yes
—
Name of the project the DNS zone belongs to
account_id
yes
—
Selectel account ID (the domain name used for API auth), shown in the top right corner of the Control panel
username
yes
—
Name of the service user used for API calls
password
yes
—
Password of the service user
auth_url
no
https://cloud.api.selcloud.ru/identity/v3
Base URL of the identity (Keystone) API used to obtain a project IAM token
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Record name relative to the zone: @ for the apex, * for a wildcard, or a label such as home
ttl
no
300
TTL in seconds for a record this provider creates; an existing record keeps its own TTL
token
yes
—
Timeweb Cloud API JWT token, from the control panel under API keys
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Full build only. The lightweight build rejects a config that uses it. Use the -full image or binary, or build with the yandexcloud or full tag; see Installation.
Parameter
Required
Default
Description
base_url
no
https://dns.api.cloud.yandex.net/dns/v1
Base URL of the Cloud DNS API
zone_id
yes
—
ID of the DNS zone, shown in the Cloud DNS console or by yc dns zone list
rr_name
yes
—
Record name relative to the zone: @ for the apex, * for a wildcard, or a label such as home
ttl
no
300
TTL in seconds for a record this provider creates; an existing record keeps its own TTL
key
yes
—
Authorized key of the service account as JSON, the file that yc iam key create writes. The account needs the dns.editor role on the folder of the zone
iam_url
no
https://iam.api.cloud.yandex.net/iam/v1/tokens
URL of the IAM API endpoint that exchanges a signed JWT for an IAM token
proxy
no
—
URL of a proxy to send API requests through, for example socks5://user:pass@203.0.113.5:1080. Schemes: socks5 and socks5h (the proxy resolves the API host name), http and https. Percent-encode special characters in the login and password. Use it when the API only accepts requests from a fixed address. The word direct connects without a proxy and ignores the proxy environment variables. Empty: connect directly, or through HTTP_PROXY/HTTPS_PROXY from the environment. The address retriever has its own proxy parameter and does not use this one
Full build only. The lightweight build rejects a config that uses it. Use the -full image or binary, or build with the mqtt or full tag; see Installation.
Parameter
Required
Default
Description
address
yes
—
A mqtt://, mqtts://, tcp://, ssl://, ws:// or wss:// URL: it carries the host and an optional user name and password
client_id
no
—
The client identifier the notifier connects with; by default a random one, so that several daemons never take each other's session over
qos
no
1
The delivery guarantee: 0 at most once, 1 at least once, 2 exactly once
retain
no
false
Ask the broker to keep the last event of each topic and hand it to a subscriber that joins later
topic_prefix
no
dnspatch.events.
Prepended to the instance name to form the channel, topic or routing key an event is published under
Full build only. The lightweight build rejects a config that uses it. Use the -full image or binary, or build with the rabbitmq or full tag; see Installation.
Parameter
Required
Default
Description
address
yes
—
An amqp:// or amqps:// URL: it carries the host, the credentials and the virtual host
exchange
no
dnspatch
The durable topic exchange events are published to; it is declared on connect if it does not exist
topic_prefix
no
dnspatch.events.
Prepended to the instance name to form the channel, topic or routing key an event is published under
Full build only. The lightweight build rejects a config that uses it. Use the -full image or binary, or build with the redis or full tag; see Installation.
Parameter
Required
Default
Description
address
yes
—
A redis:// or rediss:// URL, as accepted by go-redis: it carries the host, an optional password and the database index
topic_prefix
no
dnspatch.events.
Prepended to the instance name to form the channel, topic or routing key an event is published under
Full build only. The lightweight build rejects a config that uses it. Use the -full image or binary, or build with the shoutrrr or full tag; see Installation.
Parameter
Required
Default
Description
urls
yes
—
Shoutrrr service URLs, one per destination, such as telegram://token@telegram?chats=@channel or ntfy://ntfy.sh/topic: every event goes to all of them. Write the token or password of a URL as ${NAME}, the rest can stay in the file. The services and their URL formats are described at https://shoutrrr.nickfedor.com/services/overview/
topic_prefix
no
dnspatch.events.
Prepended to the instance name to form the channel, topic or routing key an event is published under