{{define "content"}}
{{$s := .Data.S}}

<h1 class="page-title mb-1">Settings</h1>
<p class="text-body-secondary mb-4">Server configuration, stored in the database.</p>

{{template "settingsnav" .}}

<form method="post" action="/settings/resolver">
  <input type="hidden" name="_csrf" value="{{.CSRF}}">

  <div class="row g-3">
    <div class="col-12 col-xl-8">
      <div class="card">
        <div class="card-header">Recursive resolution</div>
        <div class="card-body">

          <div class="form-section">
            <div class="form-section-title">Upstream servers</div>
            <label class="form-label" for="upstreams">Resolvers, one per line</label>
            <textarea class="form-control list-input" id="upstreams" name="upstreams" rows="5"
placeholder="1.1.1.1:53
9.9.9.9:53
[2606:4700:4700::1111]:53">{{joinLines $s.Resolver.Upstreams}}</textarea>
            <div class="form-text">
              Literal IP addresses only — a host name here could not be resolved, because
              this is the resolver that would have to resolve it. Port 53 is assumed if
              omitted; bracket IPv6 addresses when specifying a port.
            </div>
          </div>

          <div class="form-section">
            <div class="form-section-title">Selection and timing</div>
            <div class="row g-3">
              <div class="col-12 col-md-6">
                <label class="form-label" for="strategy">Server selection</label>
                <select class="form-select" id="strategy" name="strategy">
                  {{range .Data.Strategies}}
                  <option value="{{.}}" {{if eq . $s.Resolver.Strategy}}selected{{end}}>
                    {{if eq . "fastest"}}Fastest — prefer the lowest observed latency
                    {{else if eq . "sequential"}}Sequential — always try the first server first
                    {{else if eq . "round_robin"}}Round robin — spread queries evenly
                    {{else}}Random — pick one at random{{end}}
                  </option>
                  {{end}}
                </select>
                <div class="form-text">
                  A server that fails repeatedly is rested briefly and moved to the back of
                  the order, whichever strategy is chosen.
                </div>
              </div>
              <div class="col-6 col-md-3">
                <label class="form-label" for="timeoutMS">Timeout</label>
                <input type="number" class="form-control" id="timeoutMS" name="timeout_ms"
                       value="{{$s.Resolver.TimeoutMS}}" min="100" max="30000">
                <div class="form-text">Milliseconds per attempt</div>
              </div>
              <div class="col-6 col-md-3">
                <label class="form-label" for="retries">Retries</label>
                <input type="number" class="form-control" id="retries" name="retries"
                       value="{{$s.Resolver.Retries}}" min="0" max="10">
                <div class="form-text">Extra servers to try</div>
              </div>
              <div class="col-12 col-md-6">
                <label class="form-label" for="maxConcurrent">Maximum concurrent queries</label>
                <input type="number" class="form-control" id="maxConcurrent" name="max_concurrent"
                       value="{{$s.Resolver.MaxConcurrent}}" min="1" max="10000">
                <div class="form-text">
                  Bounds how many upstream exchanges are in flight at once.
                </div>
              </div>
            </div>
          </div>

          <div class="form-section">
            <div class="form-section-title">Protocol preferences</div>
            <div class="form-check form-switch mb-2">
              <input type="hidden" name="dnssec" value="false">
              <input class="form-check-input" type="checkbox" role="switch" id="dnssec"
                     name="dnssec" value="true" {{if $s.Resolver.DNSSEC}}checked{{end}}>
              <label class="form-check-label" for="dnssec">Request DNSSEC records from upstreams</label>
            </div>
            <div class="form-text mb-3">
              Sets the DO bit so signatures are returned and passed through to clients that
              ask for them. Validation itself is performed by the upstream resolver.
            </div>
            <div class="form-check form-switch">
              <input type="hidden" name="prefer_ipv6" value="false">
              <input class="form-check-input" type="checkbox" role="switch" id="preferIPv6"
                     name="prefer_ipv6" value="true" {{if $s.Resolver.PreferIPv6}}checked{{end}}>
              <label class="form-check-label" for="preferIPv6">Prefer IPv6 upstreams</label>
            </div>
          </div>

          <div class="form-actions">
            <button type="submit" class="btn btn-primary">
              <i class="bi bi-check-lg me-1"></i>Save resolver settings
            </button>
          </div>
        </div>
      </div>
    </div>

    <div class="col-12 col-xl-4">
      <div class="card mb-3 border-warning-subtle">
        <div class="card-header bg-warning-subtle">
          <i class="bi bi-shield-lock me-1"></i>Recursion access control
        </div>
        <div class="card-body">
          <div class="alert alert-warning small">
            An empty allow list denies recursion to everyone. A list that is too broad turns
            this server into an open resolver, which will be abused for amplification
            attacks. Keep it to networks you control.
          </div>

          <div class="mb-3">
            <label class="form-label" for="allowNetworks">Allowed networks</label>
            <textarea class="form-control list-input" id="allowNetworks" name="allow_networks" rows="7"
placeholder="192.168.0.0/16
10.0.0.0/8">{{joinLines $s.Resolver.AllowNetworks}}</textarea>
            <div class="form-text">One CIDR block or address per line.</div>
          </div>

          <div>
            <label class="form-label" for="denyNetworks">Denied networks</label>
            <textarea class="form-control list-input" id="denyNetworks" name="deny_networks" rows="4"
placeholder="192.168.99.0/24">{{joinLines $s.Resolver.DenyNetworks}}</textarea>
            <div class="form-text">
              Evaluated before the allow list, so you can exclude a range from a broader
              allowance.
            </div>
          </div>
        </div>
      </div>

      <div class="card">
        <div class="card-header">Current upstream health</div>
        <div class="card-body p-0">
          <table class="table table-sm table-compact mb-0">
            <tbody>
              {{range .Data.Upstreams}}
              <tr>
                <td class="mono small">{{.Address}}</td>
                <td>
                  {{if .Healthy}}<span class="badge text-bg-success">ok</span>
                  {{else}}<span class="badge text-bg-danger">down</span>{{end}}
                </td>
                <td class="text-end small">{{ms .LatencyMS}}</td>
              </tr>
              {{else}}
              <tr><td class="text-body-secondary small p-3">No upstreams configured.</td></tr>
              {{end}}
            </tbody>
          </table>
        </div>
      </div>
    </div>
  </div>
</form>
{{end}}