{
  "_comment": "Ariadne / BCNR resolver settings. CLI flags override these values. Edit and restart the daemon (or the 'BNS Resolver Daemon' service) to apply. A settings UI will edit this file.",
  "upstream": "1.1.1.1",
  "dnsPort": 53,
  "httpPort": 80,
  "httpsPort": 443,
  "gateway": "https://navigate.st",

  "_bind": "Listen address for the HTTP/HTTPS gateway. Loopback by default: on an end-user machine this is a LOCAL resolver, and binding every interface exposes it to the whole LAN. A public gateway sets this to 0.0.0.0 deliberately.",
  "bind": "127.0.0.1",

  "_dnsBind": "Listen address for the DNS server, kept separate from 'bind' on purpose. A recursive resolver reachable from the internet is a DDoS amplification relay, so opening the gateway must never open DNS as a side effect. Leave this on loopback.",
  "dnsBind": "127.0.0.1",

  "_tlds": "TLDs the local CA may issue TLS certificates for. Resolution stays TLD-agnostic; only issuance is enumerated, because the root CA is name-constrained and X.509 constraints need a finite list. CHANGING THIS REQUIRES REGENERATING THE ROOT CA and re-importing it on every machine (uninstall.ps1 -> delete ca/ -> install.ps1); until then clients reject certificates for the added TLDs. Never add an ICANN-delegated TLD. This is now a fallback/debug-override: install.ps1 sources the authoritative list from the per-TLD registry via fetchTldList (Decentralized.DNS/DESIGN-tld-registry.md §8). Omit the key to use the built-in default in src/lib/tlds.js.",
  "tlds": ["bch", "p2p", "bit", "nav", "test", "x"]
}