v0.6.7

addon

.gitea/workflows/ci.yml

@@ -14,8 +14,8 @@
 # sources of the branch main are downloaded and dist/ is published as a
 # single commit on the branch dist (force-pushed: no history). The daily
 # run and the run by hand start from the default branch of the repository
-# (develop or main): the build always checks out main. The Warda boxes
-# download
+# (develop or main): their checks and the build always check out main. The
+# Warda boxes download
 #   https://gitea.tips-of-mine.com/warda-dns/warda-lists/raw/branch/dist/<file>
 #
 # Security (job "security", beside the tests): secrets committed by mistake
@@ -65,8 +65,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
+      # The daily run and the run by hand check main, the branch the build
+      # publishes (they start from the default branch, maybe develop): what
+      # is published is what was checked.
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'main' || '' }}
 
       # The tests of the builder: names read as Warda reads them, the three
       # plain formats, a UT1-style archive, exceptions, allow.txt,
@@ -111,8 +116,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
+      # main on the daily run and the run by hand, as the job test.
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'main' || '' }}
 
       # The files committed go to the container on its standard input (the
       # daemon is the one of the host: no bind mount); a finding shows the

allow.txt

@@ -7,3 +7,10 @@
 #
 # Example:
 # example.com
+
+# The names of the Warda boxes (<10 random letters>.warda-dns.net): a list
+# of suspicious or newly seen domains may take them for generated names, and
+# a box that blocks its own name breaks its encrypted DNS for its devices.
+# protect.txt protects warda-dns.net and its parents, never its subdomains:
+# the zone and all its names are here.
+warda-dns.net

protect.txt

@@ -13,10 +13,15 @@
 # Not the public encrypted DNS services: the category bypass must keep
 # them (Warda reaches its upstreams by address).
 
-# Warda
+# Warda: every name of the tunnel of Warda (warda-terraform-cloudflare).
+# The names of the boxes (<10 letters>.warda-dns.net) are subdomains, not
+# protected here: allow.txt keeps them out of every list.
 warda-dns.com
 www.warda-dns.com
 cloud.warda-dns.com
+docs.warda-dns.com
+support.warda-dns.com
+bimi.warda-dns.com
 warda-dns.net
 warda-dns.fr
 warda-dns.eu