New Package: DNSCrypt Proxy

[nopoz]

Adds DNSCrypt Proxy as a new pfSense package with a full web GUI for managing an encrypted DNS proxy supporting DNSCrypt v2, DNS-over-HTTPS (DoH), Oblivious DoH (ODoH), and Anonymized DNS protocols.

Bundles DNSCrypt Proxy version 2.1.15 (FreeBSD amd64/arm64).

Features

• 8 configuration tabs (General, Server Selection, Cache & Filtering, Logging, Lists, Advanced, Query Log, Config)
• Manual or automatic server selection from popular providers (Cloudflare, Quad9, Google, AdGuard, NextDNS, Mullvad, OpenDNS, CleanBrowsing) or custom resolvers via DNS stamps
• Anonymized DNS with relay routing
• Domain blocking/allowing, forwarding rules, and cloaking rules
• Query log viewer with filtering by domain, type, and client IP
• Config export (copy/download), import (paste/upload TOML), and reset to defaults
• Custom TOML options with validation via dnscrypt-proxy -check
• Service management integration (Status > Services)
• Architecture auto-detection (amd64/arm64)

Fulfills Redmine #9315

Standalone repo: https://github.com/nopoz/pfsense-dnscrypt-proxy

Screenshots

View screenshots

General Settings:

Server Selection:

Cache & Filtering:

Logging:

Lists:

Advanced:

Query Log:

Config:

[marcos-ng]

Binaries should come from upstream rather than be bundled in PRs.

[nopoz]

@marcos-ng

I have reworked the port.

The two binaries are gone from the tree. The port now fetches upstream's released FreeBSD builds as distfiles, pinned by SHA256 and SIZE in distinfo:

MASTER_SITES=	https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/${DNSCRYPT_VERSION}/
DISTFILES=	dnscrypt-proxy-freebsd_${DNSCRYPT_ARCH}-${DNSCRYPT_VERSION}${EXTRACT_SUFX}
ONLY_FOR_ARCHS=	amd64 aarch64

That takes the package directory from about 25 MB down to under 140 KB, and the pinned checksums are reviewable in a diff in a way a committed binary never was.

On provenance: the daemon version is tracked by a scheduled job that verifies upstream's minisign signatures against the official release key before touching anything, and it regenerates distinfo from those same verified tarballs, so the pinned checksums derive from signed artifacts rather than from whatever the network handed back.