razvandimescu/numa v0.24.0

on GitHub

Mostly fixes for Linux home networks and IPv6 upstreams, a tighter dashboard auth check, and an easier way to find the dashboard token.

⚠️ Check before upgrading

Loopback requests now need the token unless Host is local. A page that DNS-rebinds its domain to 127.0.0.1 could previously read the query log and add overrides without a token. The loopback exemption now only applies when Host is localhost, *.localhost, an IP literal or a .numa name. If you front the dashboard with a same-host reverse proxy that passes the original Host through (Caddy and Traefik do by default), it will get a 401: send the token upstream or rewrite Host to the upstream address. Opening the dashboard as http://<hostname>:5380 now asks for the token too. (#420)

🏠 Linux home networks

• Search domains from resolv.conf (lan, fritz.box) forward to the system resolver instead of a hardcoded AWS VPC address that returned SERVFAIL everywhere else. Thanks @hb9eue (#414, #415)
• Without systemd-resolved (Raspberry Pi OS, minimal Debian), the resolv.conf backup moves to /var/lib/numa so the unprivileged service can read it; existing backups migrate automatically (#418)

🌐 IPv6 upstreams

Plain-UDP IPv6 upstreams never worked, in forward or recursive mode, because the socket was always bound to 0.0.0.0. They do now. (#417)

📦 Smaller responses

Repeated names are written as compression pointers, so an 8-record answer fits in 512 bytes again instead of coming back truncated. Thanks @Guara92 (#404, #405)

🔑 numa token

Prints the dashboard token the way the daemon resolves it, with where it came from. numa install also shows the token path. With Docker: docker exec numa numa token. Thanks @robogeek for the nudge (#408, #412, #416)

🩺 numa service status shows the OS resolver

It now prints the nameserver the OS actually uses, so a Numa that silently stopped being the system resolver is visible. (#406)

Also notable

• A taken API port (Technitium defaults to 5380) no longer takes the dashboard down silently: DNS keeps serving and the API retries every 5 s (#411, #423)
• The ODoH relay caps target responses while streaming instead of after buffering the whole body (#419)
• README: running Numa as primary DNS, network-wide setup recipe, ODoH threat model and service privileges (#401-#403, #409, #410)