7 Manually updating your DNSCrypt server

Frank Denis edited this page 2019-09-24 17:54:11 +02:00

Table of Contents

• Manually updating dnscrypt-server

This guide assumes you're using the jedisct1/dnscrypt-server docker image to run the server.

If you prefer to automate this you can use v2tec/watchtower.

Manually updating dnscrypt-server

1. Back up the keys if you haven't already done so:

docker cp dnscrypt-server:/opt/dnscrypt-wrapper/etc/keys ~
# We don't need the short-term keys
rm -rf ~/keys/short-term

2. Pull the new images:

docker pull jedisct1/dnscrypt-server

3. Stop the current dnscrypt-server container (and make sure to switch from this server in dnscrypt-proxy if you're using it):

docker stop dnscrypt-server
# Check that it's not running
docker ps

4. Run a new dnscrypt-server container (called dnscrypt-server-new):

export SERVER="$(cat ~/keys/provider_name | cut -d. -f3-)"
export SERVER_IP="<replace with your external server IP address without the port>"
docker run --ulimit nofile=90000:90000 --name=dnscrypt-server-new -p 443:443/udp -p 443:443/tcp --net=host jedisct1/dnscrypt-server init -N $SERVER -E $SERVER_IP:443
docker update --restart=unless-stopped dnscrypt-server-new

5. Restore the keys to the new container (first deleting the short-term keys):

docker start dnscrypt-server-new
docker exec dnscrypt-server-new rm -rf /opt/dnscrypt-wrapper/etc/keys/short-term
docker cp ~/keys/. dnscrypt-server-new:/opt/dnscrypt-wrapper/etc/keys
docker restart dnscrypt-server-new

6. Now check that it's working:

docker ps 
docker logs dnscrypt-server-new

7. After testing that it's working properly you can remove the old container, images and volume, and then rename the new one:

# This command will ask for confirmation
docker system prune -a --volumes
# Check that dnscrypt-server-new is the only container
docker ps -a
docker rename dnscrypt-server-new dnscrypt-server

• Home
• Installation
  • Windows
  • macOS
  • Linux
  • pfsense
  • Pi-hole
  • OpenWrt
  • Synology
  • OPNsense
  • EdgeOS
• Configuration
  • Getting started
  • Configuring sources
  • Making things go fast
  • Filtering
  • Cloaking
  • Forwarding
  • Load-balancing options
  • Logging
  • Anonymized DNS
  • ODoH (Oblivious DNS-over-HTTPS)
  • Built-in DoH server / Firefox ESNI
• Checking that your DNS traffic is encrypted
• Automatic Updates
• Server sources
• Combining blocklists
• Public Blocklist and other configuration files
• Building from source
  • Building the Android version on non Android OS
  • Building dnscrypt proxy for jailbroken iOS
• Run your own DNSCrypt server in under 10 minutes
  • Using a standalone proxy
  • Using Docker
  • Installation example on Scaleway
  • Installation example on Vultr
• DNS stamps specifications
• Windows Tips
  • Network Connectivity Status Indicator (NCSI)
• dnscrypt-proxy in the media
• Planned Features

In somecases if you want to run dnscrypt-proxy as a non-root user you'll get the error "[FATAL] listen udp 0.0.0.0:53: bind: permission denied"

to solve this problem you can run the following command and allow dnscrypt to have access to a low level port :

sudo setcap cap_net_bind_service=+ep $(which dnscrypt-proxy)