Raw diagnostics JSON
Для следующего инженера обычно достаточно этого JSON плюс конфиг app.env, чтобы понять, чего не хватает до реального DNS leak теста.
{
"request": {
"host": "cpa.tg",
"scheme": "https",
"http_version": "HTTP/1.1",
"client_ip": "216.73.216.171",
"observed_at": "2026-04-17T16:40:46+00:00"
},
"dns_diagnostics": {
"status": "configured",
"config": {
"probe_domain": "probe.cpa.tg",
"probe_endpoint": "/check/dns-session.php",
"provider": "self-hosted",
"results_path": "/var/www/cpa-tg/shared/checker-dns",
"results_path_label": "shared/checker-dns/hits.ndjson",
"ingest_secret_configured": true,
"session_ttl_seconds": 3600,
"bind_host": "135.181.253.143",
"bind_port": 53,
"forward_url": "https://cpa.tg/check/dns-ingest.php",
"forward_secret_configured": true,
"forward_timeout_seconds": 2,
"response_a": "127.0.0.1",
"response_aaaa": "::1"
},
"contract": [
{
"name": "Probe domain",
"field": "probe_domain",
"description": "Dedicated domain or subdomain delegated for resolver probing",
"present": true,
"value": "probe.cpa.tg"
},
{
"name": "Probe endpoint",
"field": "probe_endpoint",
"description": "HTTP endpoint that issues or coordinates DNS probe sessions",
"present": true,
"value": "/check/dns-session.php"
},
{
"name": "Results storage",
"field": "results_path",
"description": "Shared storage or service that keeps observed resolver hits",
"present": true,
"value": "shared/checker-dns/hits.ndjson"
},
{
"name": "Ingest secret",
"field": "ingest_secret_configured",
"description": "Optional secret for HTTP ingest endpoint used by resolver logging backends",
"present": true,
"value": "configured"
}
],
"missing_requirements": [],
"sample_probe_token": "1ee87231c25927e0",
"sample_probe_host": "1ee87231c25927e0.probe.cpa.tg",
"session_endpoints": {
"create": "/check/dns-session.php",
"status": "/check/dns-session-status.php?token=1ee87231c25927e0",
"recent": "/check/dns-sessions.php",
"report": "/check/dns-session-report.php?token=1ee87231c25927e0",
"ingest": "/check/dns-ingest.php"
},
"ingest_contract": {
"header": "X-CPA-DNS-INGEST-SECRET",
"body_fields": [
"token",
"observed_at",
"resolver_ip",
"resolver_asn",
"resolver_provider",
"country_code",
"country",
"source",
"raw"
],
"payload_example": {
"token": "1ee87231c25927e0",
"observed_at": "2026-04-17T16:40:46+00:00",
"resolver_ip": "8.8.8.8",
"resolver_asn": "AS15169",
"resolver_provider": "Google Public DNS",
"country_code": "US",
"country": "United States",
"source": "resolver_logger",
"raw": {
"qname": "1ee87231c25927e0.probe.cpa.tg",
"transport": "udp"
}
}
},
"recommendations": [],
"notes": [
"DNS leak checks cannot be inferred honestly from browser JS alone. They require a resolver-probing backend.",
"The checker can already create local DNS probe sessions and store observed hits; what is missing is a real resolver-side signal source.",
"Example probe hostname for the current request: 1ee87231c25927e0.probe.cpa.tg",
"The self-hosted DNS backend scaffold is implemented in scripts/runtime/dns_probe_daemon.php and can write directly into the checker results store."
]
}
}