add NEWS + docs around doh2-insecure

diff --git a/NEWS b/NEWS
index d2b8aa2d2e6cd38ce6175560fc2965ced63b896d..b360b0ed9a0012f75b4275791cf783b3fa3007b5 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,10 @@ Bugfixes
 - cache: avoid excessive logging introduced in the last release (!1869)
 - /options/serve-stale: avoid SIGSEGV from a LuaJIT bug (#957)
 
+Improvements
+------------
+- DoH: add unencrypted mode for reverese proxies (alpha, !1877)
+
 
 Knot Resolver 6.4.1 (2026-07-22)
 ================================

diff --git a/doc/user/config-network-server-tls.rst b/doc/user/config-network-server-tls.rst
index 8f395d416472132ee6d995672409673945140d39..7911a2de591ce519cd8d72c27df6539d7aeb4067 100644 (file)
--- a/doc/user/config-network-server-tls.rst
+++ b/doc/user/config-network-server-tls.rst
@@ -87,6 +87,23 @@ the following status codes:
    ``GET``, ``POST``, or ``HEAD``
 
 
+.. _dns-over-http:
+
+Insecure DoH
+""""""""""""
+
+This is a special mode not intended to be exposed to users.
+The main use case is to avoid useless encryption between resolver and a reverse TLS-stripping proxy.
+
+You can configure it by selecting ``doh2-insecure`` kind in
+:option:`network/listen <network/listen: <list>>`.
+
+.. warning::
+
+   Currently this is offered only as an alpha feature,
+   but the code diff from normal (encrypted) DoH is very small.
+
+
 .. _dot-doh-doq-config-options:
 
 Configuration options for DoT, DoH and DoQ

diff --git a/doc/user/config-network-server.rst b/doc/user/config-network-server.rst
index a3b5a9bf7b79b227f69b17c2be021dc968ae21dd..f87600cfe2e60371309b6cfc3d114503f1fe0f67 100644 (file)
--- a/doc/user/config-network-server.rst
+++ b/doc/user/config-network-server.rst
@@ -20,12 +20,14 @@ First, you need to decide what type of service should be available on a given IP
 address + port combination.
 
 .. csv-table::
-   :header: "Protocol/service", :option:`kind <kind: dns|xdp|dot|doh2|doh-legacy>`
+   :header: "Protocol/service", :option:`kind <kind: dns|xdp|dot|doq|doh2|doh2-insecure|doh-legacy>`
 
    "DNS (unencrypted UDP+TCP, :rfc:`1034`)","``dns``"
    "DNS (unencrypted UDP, `using XDP Linux API <./dev/daemon-bindings-net_xdpsrv.html#dns-over-xdp>`_)","``xdp``"
    ":ref:`dns-over-tls`","``dot``"
+   ":ref:`dns-over-quic`","``doq``"
    ":ref:`dns-over-https`","``doh2``"
+   ":ref:`dns-over-http`","``doh2-insecure``"
    "`Legacy DNS-over-HTTPS (DoH) <./dev/modules-http.html#mod-http-doh>`_","``doh-legacy``"
 
 .. option:: network/listen: <list>
@@ -55,7 +57,7 @@ address + port combination.
 
       Port number to listen on.
 
-   .. option:: kind: dns|xdp|dot|doh2|doh-legacy|doq
+   .. option:: kind: dns|xdp|dot|doq|doh2|doh2-insecure|doh-legacy
 
       :default: dns