Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 1 | # unbound templates/unbound.conf.j2 - {{ ansible_managed }} |
Zack Williams | 8914f9e | 2022-06-02 16:44:44 -0700 | [diff] [blame] | 2 | # docs: https://www.nlnetlabs.nl/documentation/unbound/unbound.conf |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 3 | {# |
| 4 | SPDX-FileCopyrightText: © 2020 Open Networking Foundation <support@opennetworking.org> |
| 5 | SPDX-License-Identifier: Apache-2.0 |
| 6 | #} |
| 7 | |
| 8 | # general config |
| 9 | server: |
| 10 | port: 53 |
| 11 | do-ip4: yes |
| 12 | do-ip6: no |
| 13 | do-udp: yes |
| 14 | do-tcp: yes |
| 15 | |
| 16 | # logging |
| 17 | verbosity: 1 |
| 18 | |
Zack Williams | 8914f9e | 2022-06-02 16:44:44 -0700 | [diff] [blame] | 19 | # caching overrides |
| 20 | # Cache SERVFAIL for less time (normally 900s) |
| 21 | infra-host-ttl: 10 |
Zack Williams | 67cbcac | 2022-11-29 11:00:15 -0700 | [diff] [blame] | 22 | {% if ansible_distribution_version not in ["18.04", "20.04"] %} |
Zack Williams | 8914f9e | 2022-06-02 16:44:44 -0700 | [diff] [blame] | 23 | # keep probing failed hosts, in case of network issues |
| 24 | infra-keep-probing: yes |
| 25 | {% endif %} |
| 26 | # Maximum TTL on NXDOMAIN queries (normally set by upstream) |
| 27 | cache-max-negative-ttl: 60 |
| 28 | |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 29 | # RFC7816 query name minimization |
| 30 | qname-minimisation: yes |
| 31 | |
| 32 | # access control |
| 33 | {% if unbound_allow_all %} |
| 34 | # allow queries from everywhere |
| 35 | access-control: 0.0.0.0/0 allow |
| 36 | {% else %} |
| 37 | # allow queries from localhost |
| 38 | access-control: 127.0.0.0/24 allow |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 39 | {% if unbound_allow_ips %} |
| 40 | # listen on specific IPs |
| 41 | {% for ip in unbound_allow_ips %} |
Zack Williams | 546a788 | 2021-06-28 12:46:07 -0700 | [diff] [blame] | 42 | access-control: {{ ip }} allow |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 43 | {% endfor %} |
| 44 | {% endif %} |
| 45 | {% endif %} |
| 46 | |
| 47 | # listening interfaces |
| 48 | {% if unbound_listen_default %} |
| 49 | # listen on default IPv4 Address |
| 50 | interface: {{ ansible_default_ipv4.address }} |
| 51 | |
| 52 | {% endif %} |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 53 | {% if unbound_listen_ips %} |
| 54 | # listen on specific IPs |
| 55 | {% for ip in unbound_listen_ips %} |
| 56 | interface: {{ ip | ipaddr('address') }} |
Zack Williams | 8296e47 | 2021-03-23 21:13:07 -0700 | [diff] [blame] | 57 | {% endfor %} |
Zack Williams | 8914f9e | 2022-06-02 16:44:44 -0700 | [diff] [blame] | 58 | |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 59 | {% endif %} |
Zack Williams | 8296e47 | 2021-03-23 21:13:07 -0700 | [diff] [blame] | 60 | # disable DNS-over-HTTP (DoH) as it breaks split horizon |
| 61 | # https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https |
| 62 | # https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet |
| 63 | local-zone: "use-application-dns.net" always_nxdomain |
| 64 | |
| 65 | {% if dns_reverse_zones %} |
| 66 | # allow reverse queries for RFC1918 addresses, per dns_reverse_zones |
Zack Williams | 8668a55 | 2022-12-13 17:22:01 -0700 | [diff] [blame] | 67 | {% for key, value in dns_reverse_zones.items() -%} |
Zack Williams | 8296e47 | 2021-03-23 21:13:07 -0700 | [diff] [blame] | 68 | local-zone: "{{ key | ipaddr('network') | unbound_revdns }}" nodefault |
| 69 | {% endfor %} |
| 70 | {% endif %} |
| 71 | {% if unbound_reverse_zones %} |
| 72 | # allow reverse queries for RFC1918 addresses, per unbound_reverse_zones |
Zack Williams | 8668a55 | 2022-12-13 17:22:01 -0700 | [diff] [blame] | 73 | {% for urz in unbound_reverse_zones -%} |
Zack Williams | 8296e47 | 2021-03-23 21:13:07 -0700 | [diff] [blame] | 74 | local-zone: "{{ urz | ipaddr('network') | unbound_revdns }}" nodefault |
| 75 | {% endfor %} |
| 76 | {% endif %} |
| 77 | |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 78 | # allow unbound to query localhost, where authoritative DNS might be listening |
| 79 | do-not-query-localhost: no |
| 80 | |
Zack Williams | 8296e47 | 2021-03-23 21:13:07 -0700 | [diff] [blame] | 81 | # zone definitions |
| 82 | {% if dns_reverse_zones %} |
| 83 | # reverse zones created by dns_reverse_zones |
| 84 | {% for key, value in dns_reverse_zones.items() %} |
| 85 | stub-zone: |
| 86 | name: "{{ key | ipaddr('network') | unbound_revdns }}" |
| 87 | stub-addr: {{ unbound_authoritative_server_ip }} |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 88 | |
| 89 | {% endfor %} |
Zack Williams | 8296e47 | 2021-03-23 21:13:07 -0700 | [diff] [blame] | 90 | {% endif %} |
| 91 | {% if dns_forward_zones %} |
| 92 | # forward zones created by dns_forward_zones |
| 93 | {% for key, value in dns_forward_zones.items() %} |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 94 | stub-zone: |
| 95 | name: "{{ key }}" |
| 96 | stub-addr: {{ unbound_authoritative_server_ip }} |
| 97 | |
Zack Williams | 142f2b5 | 2020-11-22 19:35:44 -0700 | [diff] [blame] | 98 | {% endfor %} |
| 99 | {% endif %} |
Zack Williams | 8296e47 | 2021-03-23 21:13:07 -0700 | [diff] [blame] | 100 | |
Zack Williams | a1c8974 | 2020-12-14 11:01:57 -0700 | [diff] [blame] | 101 | {% if unbound_forward_zones %} |
Zack Williams | 8296e47 | 2021-03-23 21:13:07 -0700 | [diff] [blame] | 102 | # Forward zones created by: unbound_forward_zones |
Zack Williams | a1c8974 | 2020-12-14 11:01:57 -0700 | [diff] [blame] | 103 | {% for fz in unbound_forward_zones %} |
| 104 | forward-zone: |
| 105 | name: "{{ fz.name | default('.') }}" |
| 106 | {% for fza in fz.servers %} |
| 107 | forward-addr: {{ fza }} |
| 108 | {% endfor %} |
| 109 | {% endfor %} |
Zack Williams | a1c8974 | 2020-12-14 11:01:57 -0700 | [diff] [blame] | 110 | {% endif %} |