initial commit

internal/database/migrations/0002_seed_defaults.sql

@@ -0,0 +1,31 @@
+-- Baseline data that makes a fresh install immediately useful without
+-- creating an open resolver: a private-network ACL, an empty malware
+-- blacklist, and a default policy bound to RFC1918 / ULA space.
+
+INSERT INTO domain_lists (kind, name, description) VALUES
+    ('blacklist', 'Malware',                 'Known malware and command-and-control domains.'),
+    ('blacklist', 'Advertising',             'Advertising and tracking domains.'),
+    ('blacklist', 'Adult Content',           'Adult content domains.'),
+    ('blacklist', 'Gambling',                'Gambling and betting domains.'),
+    ('blacklist', 'Guest Network Custom Blocks', 'Locally maintained blocks for guest networks.'),
+    ('allowlist', 'Global Allowlist',        'Domains that must never be blocked.');
+
+INSERT INTO policies (name, description, block_action) VALUES
+    ('Default Protection', 'Malware blocking applied to local networks.', 'nxdomain');
+
+INSERT INTO policy_lists (policy_id, list_id)
+SELECT p.id, l.id
+FROM policies p, domain_lists l
+WHERE p.name = 'Default Protection'
+  AND l.name IN ('Malware', 'Global Allowlist');
+
+INSERT INTO networks (name, cidr, description) VALUES
+    ('Private IPv4 10.0.0.0/8',     '10.0.0.0/8',     'RFC1918 private address space.'),
+    ('Private IPv4 172.16.0.0/12',  '172.16.0.0/12',  'RFC1918 private address space.'),
+    ('Private IPv4 192.168.0.0/16', '192.168.0.0/16', 'RFC1918 private address space.'),
+    ('Loopback IPv4',               '127.0.0.0/8',    'Local host.'),
+    ('Loopback IPv6',               '::1/128',        'Local host.'),
+    ('Unique Local IPv6',           'fc00::/7',       'RFC4193 unique local addresses.');
+
+INSERT INTO network_policies (network_id, policy_id)
+SELECT n.id, p.id FROM networks n, policies p WHERE p.name = 'Default Protection';