From a36ffe0b6856ed1a2e4fd869f1d094f44a3b0cc9 Mon Sep 17 00:00:00 2001
From: Ken Schiano <w4itey@gmail.com>
Date: Fri, 7 Aug 2026 23:03:52 -0400
Subject: [PATCH] feat: add DNS-over-TLS (853), DNS-over-HTTPS (443), HTTPS web
 console (53443)

- config.yaml: add ports for DoT, DoH (tcp+udp), HTTPS console with descriptions
- add TLS cert options schema (enable_https, pfx path/password) mapped to HA ssl dir
- Dockerfile: set HTTPS env defaults, fix symlink to -sf
- README: document DoT/DoH setup using HA ACME certs via openssl pfx export
- bump version to 1.1.0
---
 technitium_dns/Dockerfile  | 10 ++++------
 technitium_dns/README.md   | 37 ++++++++++++++++++++++++++++++++++++-
 technitium_dns/config.yaml | 17 +++++++++++++++++
 3 files changed, 57 insertions(+), 7 deletions(-)

diff --git a/technitium_dns/Dockerfile b/technitium_dns/Dockerfile
index eb09d18..82fdf9f 100644
--- a/technitium_dns/Dockerfile
+++ b/technitium_dns/Dockerfile
@@ -1,14 +1,12 @@
 ARG BUILD_FROM=ghcr.io/hassio-addons/base:latest
 FROM technitium/dns-server:latest
 
-# Home Assistant add-on requirements
-ENV DATA_DIR="/data/dns"
+ENV DATA_DIR="/data/dns" \
+    DNS_SERVER_WEB_SERVICE_HTTPS_PORT=53443 \
+    DNS_SERVER_WEB_SERVICE_ENABLE_HTTPS=false
 
-# Technitium stores its config in /etc/dns by default; use the add-on data
-# directory so settings persist across restarts.
 RUN mkdir -p /data/dns && \
-    ln -s /data/dns /etc/dns
+    ln -sf /data/dns /etc/dns
 
-# Home Assistant expects a run command via S6/entrypoint; Technitium ships its own.
 ENTRYPOINT []
 CMD ["dotnet", "DnsServerApp.dll"]
\ No newline at end of file
diff --git a/technitium_dns/README.md b/technitium_dns/README.md
index 37c835f..c9b01ac 100644
--- a/technitium_dns/README.md
+++ b/technitium_dns/README.md
@@ -5,6 +5,7 @@ Runs the [Technitium DNS Server](https://technitium.com/dns/) inside Home Assist
 ## Features
 - Ad-blocking DNS server with web console on port 5380
 - Local DNS records, conditional forwarding, DNS-over-TLS/HTTPS
+- DNS-over-TLS (853/tcp), DNS-over-HTTPS (443/tcp + 443/udp), HTTPS web console (53443/tcp)
 - Persists config to the add-on config volume
 - Designed to act as **secondary** to a primary Technitium instance via DNS Replication
 
@@ -17,7 +18,41 @@ Runs the [Technitium DNS Server](https://technitium.com/dns/) inside Home Assist
    ```
 2. Refresh the add-on store, then install **Technitium DNS**.
 3. Set `admin_password` and `timezone` in the add-on config.
-4. Start the add-on and open the web UI at `http://homeassistant.local:5380`.
+4. (Optional) For DoT/DoH/HTTPS console, set `enable_https: true` and provide a TLS `.pfx` cert path + password (see below).
+5. Start the add-on and open the web UI at `http://homeassistant.local:5380`.
+
+## TLS / DNS-over-TLS / DNS-over-HTTPS
+
+Technitium can serve DoT (853/tcp), DoH (443/tcp + 443/udp, HTTP/1.1, HTTP/2, HTTP/3), and an HTTPS web console (53443/tcp). All three share one TLS certificate.
+
+### Using the HA `ssl` map (recommended)
+The add-on maps the HA `ssl` directory, so certs issued by the HA ACME add-on are available.
+
+1. Convert your cert to `.pfx` (Technitium requires PFX):
+   ```bash
+   openssl pkcs12 -export -out /ssl/technitium.pfx \
+     -inkey /ssl/privkey.pem -in /ssl/fullchain.pem \
+     -password pass:YOUR_PASSWORD
+   ```
+2. In the add-on config:
+   ```yaml
+   enable_https: true
+   tls_cert_pfx_path: /ssl/technitium.pfx
+   tls_cert_pfx_password: YOUR_PASSWORD
+   ```
+3. Restart the add-on. Technitium will use the cert for DoT, DoH, and the HTTPS web console.
+
+### Verifying
+```bash
+# DoT
+kdig @homeassistant.local +tls example.com
+# DoH
+kdig @homeassistant.local +https example.com
+# HTTPS console
+https://homeassistant.local:53443/
+```
+
+> **Note:** Technitium reads the cert path from its internal config. The first time you enable HTTPS, do it in the web console under **Settings → Options → Web Service** so the path is saved, then it will persist across restarts via replication.
 
 ## Failover / Replication setup
 
diff --git a/technitium_dns/config.yaml b/technitium_dns/config.yaml
index bf58329..53c3551 100644
--- a/technitium_dns/config.yaml
+++ b/technitium_dns/config.yaml
@@ -12,15 +12,32 @@ webui: http://[HOST]:[PORT:5380]/
 ports:
   53/udp: 53
   53/tcp: 53
+  853/tcp: 853
+  443/tcp: 443
+  443/udp: 443
   5380/tcp: 5380
   53443/tcp: 53443
+ports_description:
+  53/udp: DNS service (UDP)
+  53/tcp: DNS service (TCP)
+  853/tcp: DNS-over-TLS (DoT)
+  443/tcp: DNS-over-HTTPS (DoH, HTTP/1.1 + HTTP/2)
+  443/udp: DNS-over-HTTPS (DoH, HTTP/3)
+  5380/tcp: Web console (HTTP)
+  53443/tcp: Web console (HTTPS)
 map:
   - addon_config:rw
   - ssl
 options:
   admin_password: CHANGE_ME
   timezone: UTC
+  enable_https: false
+  tls_cert_pfx_path: null
+  tls_cert_pfx_password: null
 schema:
   admin_password: password
   timezone: str
+  enable_https: bool
+  tls_cert_pfx_path: str?
+  tls_cert_pfx_password: password?
 image: technitium/dns-server
\ No newline at end of file