goethite
A self-hosted, clustered, security-hardened DNS filtering resolver written in Rust. Block ads and trackers for your whole network, without giving up security, speed or uptime.
Status: pre-alpha ยท v0.6
Install
One command on Linux, amd64 or arm64: it picks the .deb, the .rpm or the tarball for this machine, checks the download against the release's SHA256SUMS, and installs goethite without starting it. Prefer to read code before piping it to a shell? The script is in the repository.
curl -fsSL https://nxplain-sh.github.io/goethite/install.sh | shDocker or Podman
The distroless image serves from an unprivileged account (65532) with no capabilities.
docker run -d --name goethite --restart unless-stopped \
-p 53:53/udp -p 53:53/tcp -v goethite:/var/lib/goethite \
ghcr.io/nxplain-sh/goethite:0.6The install guide has Compose files for one node and for a cluster.
Kubernetes (Helm)
One node: DNS on port 53, the store on a PersistentVolumeClaim, the pod unprivileged with a sysctl to bind the port, or hostNetwork to serve the whole network.
git clone --depth 1 https://github.com/nxplain-sh/goethite
helm install goethite ./goethite/deploy/helm/goethiteThe install guide covers the values.
Packages, tarball or source
Every release has a reproducible, attested .deb, .rpm and tarball, checked with gh attestation verify. The install guide walks through each, and releases lists them all.
What goethite aims to be
Security first
Memory-safe Rust with no unsafe in the parsing and resolving core, no panics on network input, fuzzed parsers, and a written threat model.
Fast and bounded
Sub-millisecond cached answers and million-rule filter lists in a small, bounded memory footprint, with every claim backed by a reproducible benchmark.
Highly available
Every node resolves on its own. Clustering adds replicated config, a floating IP and zero-downtime reloads and upgrades.
Everyday filtering
Hosts files, domain lists and AdGuard-style rules, per-client groups and schedules, CNAME uncloaking and safe search.