move coredns image under docker/

docker/coredns/Corefile

@@ -0,0 +1,53 @@
+# CoreDNS as a plain forwarding resolver with selective AAAA suppression.
+#
+# Background: the ISP provides no native IPv6, only a Hurricane Electric tunnel.
+# HE addresses are flagged as datacenter ranges by some sites (endless CAPTCHAs,
+# bot detection). To avoid this, IPv6 (AAAA) resolution is suppressed by default
+# so clients use IPv4, while a whitelist keeps AAAA for domains where native
+# IPv6 is wanted (our own services reachable over the HE prefix, and any domain
+# explicitly trusted over IPv6).
+#
+# NAT64/DNS64 was tried and removed: it forced most traffic through a userspace
+# Tayga translator, capping throughput at ~250 Mbps on the RB-class CPU (line
+# rate is 1 Gbps) and adding two containers as a SPOF — all to avoid IPv6 egress
+# we don't want in the first place. Plain AAAA suppression achieves the same
+# IPv4-preferred outcome with zero datapath overhead.
+#
+# TODO: replace the global template suppression + whitelist with a plugin that
+# suppresses AAAA only when the domain has no A record (so IPv6-only
+# destinations still work). No such in-tree plugin exists yet.
+
+# Whitelist: domains that keep AAAA resolution (native IPv6 via HE tunnel).
+(aaaa_allowed) {
+    forward . 1.1.1.1 8.8.8.8 {
+        prefer_udp
+    }
+    cache 300
+    errors
+    log . {
+        class error
+    }
+}
+
+# Our own zone: services have native IPv6 on the HE prefix, keep AAAA.
+lumpiasty.xyz:53 {
+    import aaaa_allowed
+}
+
+# Default: forward everything, but suppress AAAA so clients use IPv4 and
+# avoid the HE tunnel's datacenter-flagged egress.
+.:53 {
+    template IN AAAA {
+        rcode NOERROR
+    }
+    forward . 1.1.1.1 8.8.8.8 {
+        prefer_udp
+    }
+    cache 300
+    errors
+    log . {
+        class error
+    }
+    reload
+    health :8080
+}

docker/coredns/Dockerfile

@@ -0,0 +1,32 @@
+# Stage 1: build CoreDNS with minimal plugin set
+FROM golang:1.26-alpine AS build
+
+RUN apk add --no-cache git make bash
+
+WORKDIR /src
+RUN git clone --depth 1 --branch v1.12.1 \
+    https://github.com/coredns/coredns .
+
+# Overwrite plugin.cfg with our trimmed list before compilation
+COPY plugin.cfg .
+
+RUN go generate && make
+
+# Stage 2: extract CA certificates from a full image
+FROM debian:stable-slim AS certs
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates && rm -rf /var/lib/apt/lists/*
+
+# Stage 3: minimal runtime — scratch + binary + certs only
+FROM scratch
+
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=build /src/coredns /coredns
+COPY Corefile /Corefile
+
+# 53:  DNS (UDP + TCP)
+# 8080: health endpoint
+EXPOSE 53/udp 53/tcp 8080/tcp
+
+# RouterOS requires root to bind port 53 — no USER directive
+ENTRYPOINT ["/coredns", "-conf", "/Corefile"]

docker/coredns/plugin.cfg

@@ -0,0 +1,7 @@
+errors:errors
+log:log
+health:health
+template:template
+cache:cache
+forward:forward
+reload:reload