Public Consortium.
Free public infrastructure — DNS, time, mirrors, and more. No signup, no client logging, no paywall.
Public services.
Each service runs on its own host with its own privacy posture. Pick the one you need — setup instructions live on each site.
What this is.
Public Consortium is a volunteer-run project operating a family of free public-* infrastructure services. DNS queries, NTP packets, and package downloads each run on dedicated machines — not on this page's host.
Behind the scenes, a management node (root.public-common.com) handles the plumbing that keeps everything running:
- Issuing and renewing TLS certificates for every
public-*domain via ACME (Let's Encrypt, DNS-01). - Distributing configuration changes to the service nodes.
- Hosting this index so people can find the projects and reach the operator.
Everything user-visible lives on the per-service sites. Separate domains mean each service can publish an independent privacy posture without one host silently seeing another's traffic.
Principles.
- Free. No charge, no signup, no API key, no premium tier.
- No client logging. Each user-facing service explicitly does not log query / request data to disk. Operational logs cover the daemon, not the user.
- Encrypted at rest. ZFS native encryption is used on every host, including the management node.
- No analytics, no cookies, no third-party content. All public sites are static HTML served by nginx.
- Open standards only. RFC 8915 (NTS), DoH/DoT, DNSSEC ECDSAP256SHA256, ACME. No proprietary extensions, no client lock-in.
- Independent boxes. Each service runs on its own host with its own address space, so a compromise of one cannot quietly tap traffic on another.
Privacy.
Privacy claims that matter live on the per-service pages — what counts is what the service that talks to you logs.
| Service | Client data |
|---|---|
| public-rdns.com | DNS queries are not written to disk. QNAME minimisation reduces upstream exposure. |
| public-adns.com | Individual queries are not written to disk; ANY refused; identity / version hidden. |
| public-utc.com | NTP requests are not written to disk; NTS provides authentication. |
| public-repo.com | HTTP download requests are not written to disk. |
| public-consortium.com | Static HTML, no analytics, no cookies. Only GET requests for these pages. |
Across all hosts: ZFS native encryption at rest, no shell history retained, headless servers with no public remote-console exposure.
Operations.
The public-* family is operated as a single project. Concrete shape:
- One management host that holds the ACME account and pushes out renewed certificates.
- Per-service hosts that run only the daemon they advertise —
nsdon the authoritative DNS box,unbound+nginxon the recursive box,chronydon the time box,nginx+ a continuousrsyncloop on the mirror box,nginxfor the static sites. - Service-specific configuration is checked into a private repo and synced down; this site mirrors the publishable subset.
- Method limits at the web tier: only HTTP
GETis allowed on the public sites — everything else is denied atnginx.
TLS & ACME.
All public-* domains use Let's Encrypt certificates issued via ACME with the DNS-01 challenge:
| CA | Let's Encrypt (acme-v02 directory) |
| Challenge | DNS-01 — _acme-challenge.<domain> TXT published programmatically, validated, then removed |
| Key type | ECC P-256 (prime256v1 / ec-256) |
| Coverage | Apex plus wildcard (*.<domain>) per certificate |
| Renewal | Continuous loop; acme.sh re-issues only within the renewal window |
| DH parameters | Mozilla ffdhe2048, refreshed from upstream Mozilla SSL config |
| Tooling | acme.sh |
Certificates are deployed to the service nodes out of band; private keys never leave the host that owns them.
Infrastructure.
| Operating system | FreeBSD across all nodes |
| Web server | nginx with HTTP/2 on every public site |
| Filesystem | ZFS with native encryption everywhere |
| Hardening headers | X-Content-Type-Options: nosniff · X-Frame-Options: DENY |
| HTTP methods | GET only on public sites |
| Remote console | Not exposed beyond documented services |
| Operator hygiene | No shell history retained |
Status & reliability.
All public-* services are operated as a public good, best-effort. There is no paid SLA. If your use case needs strict availability:
- DNS: always configure several resolvers (or several authoritatives) from independent operators. public-rdns.com exposes two IPv4 and two IPv6 addresses; pair it with another provider. For authoritative hosting see public-adns.com.
- NTP/NTS: configure at least three independent time sources. The client picks a healthy majority, so a single one going offline cannot move your clock. public-utc.com is one such source.
- Mirrors: use the project's mirror pool, not a hardcoded host. public-repo.com is one entry in those pools.
Outages are reachable by emailing the operator (below).
Abuse reports.
For abuse complaints relating to any public-* service:
- DNS abuse — if a domain hosted on
public-adns.comis being used for malware, phishing, or scams, send the domain and evidence to the address below. Hosting will be terminated. - Resolver / mirror abuse — DDoS amplification attempts, excessive scraping, or other misuse of
public-rdns.com,public-repo.com, orpublic-utc.comcan be reported with source IP and timestamps. - Please include UTC timestamps and as much identifying detail as you can; logs are intentionally minimal, so context from the reporter is what makes a report actionable.
Responsible-disclosure security reports are also welcome at the same address.
FAQ.
Who runs this?
A single operator. The project is run as a public good — there is no company, no funding round, no upsell.
Why all the separate domains?
Each service has its own privacy posture and its own host. Splitting them across distinct domains makes that posture auditable from outside and prevents one service from silently aggregating data about another's users.
Can I donate?
Yes — Bitcoin, see Contact. Donations are appreciated but never required to use any of the services.
Can I help operate this?
Independent mirrors / resolvers / time servers help the broader internet far more than another contributor on this one. Run your own — the configurations behind these services are intentionally simple precisely so they can be reproduced.
Is there a status page?
Not currently. Each service exposes its own freshness signal — e.g. mirror lastsync files, DNS responses, NTP chronyc tracking against the host. If something looks broken, email.
Can I host my project under public-*?
The naming convention is reserved for first-party services run from this management node, so no — but if your project would benefit from one of the existing services (e.g. authoritative DNS hosting on public-adns.com), email and ask.
How are certificates issued?
ACME DNS-01 against Let's Encrypt with ECC P-256 keys, apex plus wildcard. See TLS & ACME.
Why FreeBSD?
ZFS, jails, a small kernel surface, and stable long-term behaviour. The services here don't need anything Linux-specific, and FreeBSD's defaults align with the operational hygiene this project cares about.
Contact.
For questions, abuse reports, security disclosures, or operational issues across any public-* service —
| dennis@public-consortium.com | |
| Discord | Public Consortium |
| GitHub | PublicConsortium |
