Wiki — 0druid.cc

A privacy and security focused provider. Debian 13. 0druid.cc. Maintained by Druid520.

Overview

This server runs a curated set of open-source services. Every service is chosen for simplicity, wide adoption, and strong security defaults. No proprietary software, no third-party tracking, no forwarded DNS.

The server is hardened at every layer: kernel, network, SSH, firewall, TLS, DNS, NTP, and application. Post-quantum key exchange on all encrypted services. Automated maintenance on timers. AppArmor mandatory access control profiles restrict every service (9 profiles, all enforcing).

The DNS-over-TLS proxy (dot-proxy) is a custom C program — Zero runtime dependencies beyond libssl/libc. TLS 1.3 only, drops root, per-child resource limits, no session tracking. Diagnostics page shows your connection details.

Services

DNS — Ad/Malware Blocker port 53

dnsmasq blocks ads, trackers, and malware domains (2.9M+ entries). Forwards to Unbound on port 5335.

Blocklists: StevenBlack (ads+malware), BlockProject (ads), malware domains
Cache: 5,000 entries, 24h max TTL
Auto-update: blocklists refresh weekly via systemd timer
Address: 0druid.cc:53 / 23.191.184.49:53 (may be blocked by cloud providers/ISPs — use :5335 or DoT instead)

DNS — Recursive Resolver port 5335

Unbound performs recursive DNS resolution directly with root servers — no third party sees your queries.

DNSSEC enabled with automated trust anchor maintenance
QNAME minimisation (strict), aggressive NSEC, hide-identity, hide-version
256MB RRset cache + 128MB message cache, serve-expired enabled
No query logging (verbosity 0, log-queries/log-replies off)
Address: 0druid.cc:5335 / 23.191.184.49:5335

DNS-over-TLS ports 853, 8535

dot-proxy — 23KB C binary. TLS 1.3 termination with PQ key exchange. Forks per connection.

Port 853: dnsmasq:53 — ad/malware blocked, DNSSEC via Unbound
Port 8535: Unbound:5335 — raw recursive, DNSSEC, no blocking
Key exchange: offers X25519MLKEM768 (PQ), falls back to X25519, P-256, P-384
PQ-strict mode: optionally reject non-PQ (DOT_PROXY_PQ_STRICT=1 in service file)
No session tickets, no session caching, TCP_NODELAY, keepalive
Drops root, runs as dot-proxy user, AppArmor confined

client compatibility

Client	PQ	Connects	Notes
OpenSSL 3.5+	yes	yes	openssl s_client -connect 0druid.cc:853
BoringSSL (Android, Chrome)	yes	yes	Android Private DNS = 0druid.cc
GnuTLS < 3.8.10	no	yes	kdig, wget, chrony — falls back to X25519
systemd-resolved	yes	yes	Uses OpenSSL on most distros
unbound (forwarder)	yes	yes	Linked against OpenSSL/LibreSSL; use forward-tls-upstream

VPN / WireGuard port 51820

WireGuard with pre-shared key (PSK). ChaCha20-Poly1305 symmetric encryption is quantum-resistant. Full-tunnel — routes all client traffic through hardened Debian 13 KVM nodes.

Encryption: ChaCha20-Poly1305 + PSK (quantum-resistant symmetric)
DNS: All client queries routed through 0druid.cc DoT (:853)
NTP: All clients synced to 0druid.cc
No logs — no traffic, connection, or DNS logs kept

VPN Nodes

Node	IP	Specs	Config
Node 1	`65.75.201.47`	2 vCPU, 4GB RAM, 40GB NVMe, KVM	download

NTP + NTS Server ports 123 + 4460

Chrony provides accurate time using encrypted NTS with privacy-focused servers only.

NTS (encrypted, authenticated) with AEAD-AES-256-GCM-SHA256
Upstreams: smear.public-utc.com, nts.netnod.se, 1.nts.nothingtohide.nl, ptbtime1.ptb.de, nts.teambelgium.net
No Cloudflare, Google, or AWS servers. No logging.
Public NTS server — serves on 0.0.0.0:123 + NTS-KE on 0.0.0.0:4460
Client config: server 0druid.cc iburst nts

Security

Post-Quantum Cryptography

Protocol	Algorithm	Status
SSH	`mlkem768x25519-sha256`	active
TLS	`X25519MLKEM768`	active
DNS-over-TLS	`X25519MLKEM768`	active (OpenSSL clients)
NTP	NTS (AEAD-AES256-GCM) — client + server	active
DNS	DNSSEC (ECDSA P-256)	active

SSH port 3447

Key-only auth, no password login
PQ KEX: mlkem768x25519-sha256, sntrup761x25519-sha512@openssh.com
Host key: Ed25519 only (RSA and ECDSA removed)
Max auth tries: 2, login grace: 20s, max sessions: 3
All forwarding disabled

Firewall (UFW)

Port	Proto	Rule	Service
3447	TCP	LIMIT	SSH
9090	TCP	ALLOW	Cockpit
80,443	TCP	ALLOW	Caddy HTTP/HTTPS
53	TCP+UDP	ALLOW	dnsmasq DNS
5335	TCP+UDP	ALLOW	Unbound DNS
123	UDP	ALLOW	Chrony NTP
4460	TCP	ALLOW	Chrony NTS-KE
853	TCP	ALLOW	DNS-over-TLS (blocked)
8535	TCP	ALLOW	DNS-over-TLS (raw)

AppArmor 9 profiles enforcing

Mandatory access control restricts every service: caddy, dnsmasq, unbound, dot-proxy, chrony, fail2ban, monit, sshd, cockpit-tls.

Kernel Hardening

ASLR full (randomize_va_space=2), kptr_restrict=2, dmesg_restrict=1
YAMA ptrace_scope=2, io_uring disabled, BPF JIT hardened
TCP: SYN cookies, RFC 1337, SACK/DSACK/FACK off, timestamps off
Lockdown confidentiality, init_on_alloc/free, page_poison, slab_nomerge

Maintenance

7 systemd timers: cleanup (weekly), security-audit (daily), health-check (daily), disk-monitor (6h), blocklist-update (weekly), cert-sync (12h), logrotate (daily). Journal capped at 50MB / 30 days. Swap: 2GB.