diff --git a/README.md b/README.md
index fb73509..1d89538 100644
--- a/README.md
+++ b/README.md
@@ -71,6 +71,7 @@ some of which have modules:
 * [tunnel_server](#tunnel_server)
 * [tunnel_client](#tunnel)
 * [mdns](#mdns)
+* [socks5](#socks5)
 * api
 
 All modules require a `type` and an `id`, and any modules not defined inside the
diff --git a/etc/goldilocks/goldilocks.example.yml b/etc/goldilocks/goldilocks.example.yml
index 38ec6b5..77bb321 100644
--- a/etc/goldilocks/goldilocks.example.yml
+++ b/etc/goldilocks/goldilocks.example.yml
@@ -4,11 +4,87 @@ tcp:
     - 80
     - 443
   modules:
-    - name: forward
+    - type: forward
       ports:
         - 22
       address: '127.0.0.1:8022'
 
+udp:
+  bind:
+    - 53
+  modules:
+    - type: forward
+      ports:
+        - 53
+      port: 5353
+      # default host is localhost
+
+
+tls:
+  modules:
+    - type: proxy
+      domains:
+        - localhost.bar.daplie.me
+        - localhost.foo.daplie.me
+      address: '127.0.0.1:5443'
+    - type: acme
+      domains:
+        - '*.localhost.daplie.me'
+      email: 'guest@example.com'
+      challenge_type: 'http-01'
+
+http:
+  trust_proxy: true
+  allow_insecure: false
+  primary_domain: localhost.daplie.me
+
+  modules:
+    - type: redirect
+      domains:
+        - localhost.beta.daplie.me
+      status: 301
+      from: /old/path/*/other/*
+      to: /path/new/:2/something/:1
+    - type: proxy
+      domains:
+        - localhost.daplie.me
+      host: localhost
+      port: 4000
+    - type: static
+      domains:
+        - '*.localhost.daplie.me'
+      root: '/srv/www/:hostname'
+
+domains:
+  - names:
+      - localhost.gamma.daplie.me
+    modules:
+      tls:
+        - type: proxy
+          port: 6443
+  - names:
+      - beta.localhost.daplie.me
+      - baz.localhost.daplie.me
+    modules:
+      tls:
+        - type: acme
+          email: 'owner@example.com'
+          challenge_type: 'tls-sni-01'
+          # default server is 'https://acme-v01.api.letsencrypt.org/directory'
+      http:
+        - type: redirect
+          from: /nowhere/in/particular
+          to: /just/an/example
+        - type: proxy
+          address: '127.0.0.1:3001'
+
+
+mdns:
+  disabled: false
+  port: 5353
+  broadcast: '224.0.0.251'
+  ttl: 300
+
 # tunnel: jwt
 # tunnel:
 #   - jwt1
@@ -18,76 +94,3 @@ tunnel_server:
   secret: abc123
   servernames:
     - 'tunnel.localhost.com'
-
-tls:
-  acme:
-    email: 'joe.shmoe@example.com'
-    server: 'https://acme-staging.api.letsencrypt.org/directory'
-    challenge_type: 'http-01'
-    approved_domains:
-      - localhost.baz.daplie.me
-      - localhost.beta.daplie.me
-  domains:
-    - names:
-        - localhost.gamma.daplie.me
-      modules:
-        - name: proxy
-          address: '127.0.0.1:6443'
-    - names:
-        - beta.localhost.daplie.me
-        - baz.localhost.daplie.me
-      modules:
-        - name: acme
-          email: 'owner@example.com'
-          challenge_type: 'tls-sni-01'
-          # default server is 'https://acme-v01.api.letsencrypt.org/directory'
-  modules:
-    - name: proxy
-      domains:
-        - localhost.bar.daplie.me
-        - localhost.foo.daplie.me
-      address: '127.0.0.1:5443'
-    - name: acme
-      email: 'guest@example.com'
-      challenge_type: 'http-01'
-      domains:
-        - foo.localhost.daplie.me
-        - gamma.localhost.daplie.me
-
-
-http:
-  trust_proxy: true
-  allow_insecure: false
-  primary_domain: localhost.foo.daplie.me
-  domains:
-    - names:
-        - localhost.baz.daplie.me
-      modules:
-        - name: redirect
-          from: /nowhere/in/particular
-          to: /just/an/example
-        - name: proxy
-          port: 3001
-
-  modules:
-    - name: redirect
-      domains:
-        - localhost.beta.daplie.me
-      status: 301
-      from: /old/path/*/other/*
-      to: /path/new/:2/something/:1
-    - name: proxy
-      domains:
-        - localhost.daplie.me
-      host: localhost
-      port: 4000
-    - name: static
-      domains:
-        - '*.localhost.daplie.me'
-      root: '/srv/www/:hostname'
-
-mdns:
-  disabled: false
-  port: 5353
-  broadcast: '224.0.0.251'
-  ttl: 300