Skip to content

Commit b4d19c2

Browse files
hagezihagezi
committed
update
0 parents  commit b4d19c2

21 files changed

Lines changed: 4219 additions & 0 deletions

‎.github/workflows/auto-assign.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: Auto-assign new issues
2+
3+
on:
4+
issues:
5+
types: [opened]
6+
7+
jobs:
8+
assign:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
issues: write
12+
steps:
13+
- name: Assign issue to user
14+
uses: actions-ecosystem/action-add-assignees@v1
15+
with:
16+
github_token: ${{ secrets.github_token }}
17+
assignees: ${{ github.repository_owner }}

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
gitPush.sh
2+
gitInit.sh

‎CHEATSHEET.md‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# HaGeZi DNS: Cheat Sheet
2+
3+
> [!TIP]
4+
> Just want to get connected? Pick a server below, set it up, and you're done. Full background, security details, and legal/privacy info are in [README](README.md) and [PRIVACY](PRIVACY.md).
5+
6+
## 1. Pick a server by country and protection level <a id="pick-server"></a>
7+
8+
**Full protection (ads, trackers, and threats blocked), recommended for most users:**
9+
10+
| Server | Location | Best for (country) |
11+
|---|---|---|
12+
| `root.hagezi.org` | Germany, Falkenstein | AT, BA, BE, BG, CH, CZ, DE, DK, FR, GB, HU, IE, IT, LU, NL, PL, RO, SI, SK |
13+
| `wurzn.hagezi.org` | Germany, Nuremberg | AT, BA, BE, BG, CH, CZ, DE, DK, ES, FR, GB, GR, HR, HU, IE, IT, LU, MD, MK, MT, NL, PL, PT, RO, RS, SI, SK, TR, UA |
14+
| `juuri.hagezi.org` | Finland, Helsinki | DK, EE, FI, LT, LV, NO, SE |
15+
16+
**Threats only (phishing, malware, scam), no ad/tracker blocking:**
17+
18+
| Server | Location | Best for (country) |
19+
|---|---|---|
20+
| `ctif.hagezi.org` | Germany, Nuremberg | AT, BA, BE, BG, CH, CZ, DE, DK, ES, FR, GB, GR, HR, HU, IE, IT, LU, MD, MK, MT, NL, PL, PT, RO, RS, SI, SK, TR, UA |
21+
22+
Limited coverage from current locations: AD, CY, GE, IS, LI, MC, ME, SM. Any server still works, just with higher latency.
23+
24+
## 2. Connect (recommended: encrypted) <a id="connect"></a>
25+
26+
| Protocol | Format | Example |
27+
|---|---|---|
28+
| DoH/DoH3 | `https://<server>/dns-query` | `https://root.hagezi.org/dns-query` |
29+
| DoT | `<server>`, port 853 | `root.hagezi.org` |
30+
| DoQ | `<server>`, port 853 | `root.hagezi.org` |
31+
32+
Use the [DNS Stamps](README.md#dns-stamps) for compatible apps (auto-configuration), or set it up per platform below.
33+
34+
> [!WARNING]
35+
> Don't enable DoH, DoT, and DoQ against the same server at the same time. It doesn't add protection, only wastes your rate-limit allowance and can slow things down.
36+
37+
## 3. Platform setup <a id="platform-setup"></a>
38+
39+
**Apple (iOS, iPadOS, macOS):** manual DoH/DoT entry isn't supported in system settings. Use the official mobileconfig profile instead:
40+
41+
| Server | Apple Config |
42+
|---|---|
43+
| `root.hagezi.org` | [Profile](mobileconfig/root-hagezi-org.mobileconfig) · [QR](mobileconfig/root-hagezi-org.mobileconfig.png) |
44+
| `wurzn.hagezi.org` | [Profile](mobileconfig/wurzn-hagezi-org.mobileconfig) · [QR](mobileconfig/wurzn-hagezi-org.mobileconfig.png) |
45+
| `juuri.hagezi.org` | [Profile](mobileconfig/juuri-hagezi-org.mobileconfig) · [QR](mobileconfig/juuri-hagezi-org.mobileconfig.png) |
46+
| `ctif.hagezi.org` | [Profile](mobileconfig/ctif-hagezi-org.mobileconfig) · [QR](mobileconfig/ctif-hagezi-org.mobileconfig.png) |
47+
48+
Install the profile via Settings, or scan the QR code with your camera.
49+
50+
**Android (9+):** Settings → Network & internet → Private DNS → Private DNS provider hostname → enter the server, e.g. `root.hagezi.org`. This uses DoT.
51+
52+
**Windows (11):**
53+
54+
1. Go to **Settings → Network & internet → [your Wi-Fi/Ethernet connection] → Hardware properties → DNS server assignment → Edit**.
55+
2. Change the dropdown to **Manual**, and turn on **IPv4** (and/or IPv6).
56+
3. Under **Preferred DNS**, enter the server's IP address, e.g. `188.34.161.210` for `root.hagezi.org` (see the [Do53 table](#do53-fallback) for other servers).
57+
4. Under **DNS over HTTPS**, select **On (manual template)**.
58+
5. In the **DNS over HTTPS template** field that appears, enter the matching DoH URL, e.g. `https://root.hagezi.org/dns-query`.
59+
6. Leave **Fallback to plaintext** off, so queries always stay encrypted.
60+
7. Optionally repeat steps 3 to 6 under **Alternate DNS** with a second server, or leave it empty.
61+
8. Select **Save**.
62+
63+
> [!NOTE]
64+
> On some Windows 11 builds, the manual template field may stay greyed out for servers not in Windows' built-in list (Cloudflare, Google, Quad9). If that happens, register the server first via an elevated PowerShell prompt: `Add-DnsClientDohServerAddress -ServerAddress '188.34.161.210' -DohTemplate 'https://root.hagezi.org/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True`, then repeat the steps above.
65+
66+
**Router or other OS/app:** most consumer routers only support classic, unencrypted DNS (Do53). In that case, enter the IPv4/IPv6 addresses from the table below directly as your router's DNS servers, so every device on your network is protected automatically, no per-device setup needed.
67+
68+
If your router or firmware supports encrypted DNS, use the DoH URL or DoT hostname instead of the Do53 IPs:
69+
70+
- **OpenWrt:** configure via `https-dns-proxy` (DoH) or `stubby` (DoT) in LuCI.
71+
- **pfSense / OPNsense:** set up as a DoT forwarder in the Unbound DNS Resolver settings.
72+
- **FRITZ!Box, ASUS, and other consumer routers with encrypted DNS support:** look for a "DNS-over-HTTPS", "DNS-over-TLS", or "Encrypted DNS" field in the router's DNS or internet settings and enter the DoH URL or DoT hostname there.
73+
- **Not sure your router supports it?** Stick with the Do53 IPs below, they work everywhere and protect the whole network with zero per-device configuration.
74+
75+
## 4. Unencrypted fallback (Do53), only if nothing else works <a id="do53-fallback"></a>
76+
77+
| Server | IPv4 | IPv6 |
78+
|---|---|---|
79+
| `root.hagezi.org` | `188.34.161.210` | `2a01:4f8:c17:1c66::1` |
80+
| `wurzn.hagezi.org` | `159.69.155.94` | `2a01:4f8:1c1c:d363::1` |
81+
| `juuri.hagezi.org` | `95.217.163.17` | `2a01:4f9:c013:dc4e::1` |
82+
| `ctif.hagezi.org` | `162.55.58.40` | `2a01:4f8:1c19:6c19::1` |
83+
84+
## 5. Verify it's working <a id="verify"></a>
85+
86+
Run a [DNS leak test](https://dnscheck.tools). If it shows an IP address other than the ones above, your device or network is bypassing this DNS setup.
87+
88+
## 6. Something not working? <a id="troubleshooting"></a>
89+
90+
Check the server status pages first: [`root.hagezi.org`](https://root.hagezi.org/stats.txt) · [`wurzn.hagezi.org`](https://wurzn.hagezi.org/stats.txt) · [`juuri.hagezi.org`](https://juuri.hagezi.org/stats.txt) · [`ctif.hagezi.org`](https://ctif.hagezi.org/stats.txt). If the server looks healthy but you still can't connect, then reach out via [support@hagezi.org](mailto:support@hagezi.org) or the [Matrix chat](https://matrix.to/#/#hagezi-support:tchncs.de?via=tchncs.de).
91+
92+
## 5 things to know <a id="things-to-know"></a>
93+
94+
1. Free, non-commercial, no account, no data sold, EU-hosted only.
95+
2. No logging of individual queries; only short-lived, anonymized stats (max. 1 hour, RAM only).
96+
3. A domain wrongly blocked or missed? Report it via [support@hagezi.org](mailto:support@hagezi.org) or the [Matrix chat](https://matrix.to/#/#hagezi-support:tchncs.de?via=tchncs.de).
97+
4. This is one layer of protection, not a replacement for antivirus, a firewall, or your own judgment.
98+
5. Full legal disclaimer, privacy policy, and DSA compliance info live in [PRIVACY](PRIVACY.md), not required reading to just use the service.

0 commit comments

Comments
 (0)