# Mountaineer unbound: local validating, recursive, caching DNS resolver
# on 127.0.0.1 and ::1. Forwards upstream over DNS-over-TLS to a documented
# pair (Quad9 and Cloudflare). Validates DNSSEC.
#
# /etc/resolv.conf points at 127.0.0.1 and the operator does not edit it.
# Per-domain stub zones (e.g. for a Nebula mesh) go in
# /etc/unbound/unbound.conf.d/*.conf.

server:
    # Bind only on loopback. Mountaineer hosts do not run an authoritative
    # resolver for the network.
    interface: 127.0.0.1
    interface: ::1
    port: 53

    # Privacy and hygiene.
    do-ip4: yes
    do-ip6: yes
    do-udp: yes
    do-tcp: yes
    prefetch: yes
    prefetch-key: yes
    qname-minimisation: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    harden-below-nxdomain: yes
    harden-referral-path: yes
    use-caps-for-id: yes

    # DNSSEC validation. Trust anchor is installed by the unbound-anchor
    # tool at install time; this path is Alpine's convention.
    auto-trust-anchor-file: "/var/lib/unbound/root.key"

    # Cache and threading sized for a typical Mountaineer host.
    num-threads: 2
    msg-cache-size: 32m
    rrset-cache-size: 64m
    cache-min-ttl: 60
    cache-max-ttl: 86400

    # Access control: localhost only.
    access-control: 127.0.0.0/8 allow
    access-control: ::1 allow
    access-control: 0.0.0.0/0 refuse
    access-control: ::/0 refuse

    # Hide identity and version from outside queries.
    hide-identity: yes
    hide-version: yes

    # Logging — minimal by default. Per-incident debug is via unbound-control.
    verbosity: 1
    log-queries: no
    log-replies: no

    # Run unprivileged.
    username: "unbound"
    directory: "/etc/unbound"
    chroot: ""
    pidfile: "/run/unbound.pid"

# Forward to DoT upstreams. Quad9 and Cloudflare picked as the documented
# default pair; operators with a preferred resolver edit a drop-in in
# /etc/unbound/unbound.conf.d/.
forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 9.9.9.9@853#dns.quad9.net
    forward-addr: 149.112.112.112@853#dns.quad9.net
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
    forward-addr: 1.0.0.1@853#cloudflare-dns.com
    forward-addr: 2620:fe::fe@853#dns.quad9.net
    forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com

# Drop-in directory for operator additions (stub zones, custom forwards,
# additional access-control entries, etc.).
include: "/etc/unbound/unbound.conf.d/*.conf"

remote-control:
    control-enable: yes
    control-interface: 127.0.0.1
    control-use-cert: no
