setup/start/unbound.conf

# Unbound is used primarily for RBL queries (host 2.0.0.127.zen.spamhaus.org)
# We cannot use dnsmasq because it is not a recursive resolver and defaults to the value in the interfaces file (which is Google DNS!)

server:
        port: 53
        interface: 127.0.0.1
        interface: 172.18.0.1
        ip-freebind: yes
        do-ip6: yes
        access-control: 127.0.0.1 allow
        access-control: 172.18.0.1/16 allow
        cache-max-negative-ttl: 30
        cache-max-ttl: 300
        # enable below for logging to journalctl -u unbound
        # verbosity: 5
        # log-queries: yes

# https://github.com/NLnetLabs/unbound/issues/806
remote-control:
    control-enable: no
move comment to unbound.conf 2022-02-09 17:49:41 -08:00			`# Unbound is used primarily for RBL queries (host 2.0.0.127.zen.spamhaus.org)`
			`# We cannot use dnsmasq because it is not a recursive resolver and defaults to the value in the interfaces file (which is Google DNS!)`

move unbound config to separate file 2019-11-13 14:48:56 -08:00			`server:`
bring back resolvconf and unbound DNS bd9c664b1ad2500a01bfd0bedb2679adf68f62b9 tried to remove it and use the system resolver. However, we found that debian has a quirk that it adds it adds the fqdn as 127.0.1.1. This means that the docker containers resolve the my.example.com domain to that and can't connect. This affects any apps doing a turn test (CLOUDRON_TURN/STUN_SERVER) and also apps like SOGo which use the mail server hostname directly (since they require proper certs). https://www.debian.org/doc/manuals/debian-reference/ch05.en.html#_the_hostname_resolution So, the solution is to go back to unbound, now that port 53 binding is specially handled anyway in docker.js 2020-11-25 10:02:43 -08:00			`port: 53`
Free up port 53 It's all very complicated. Approach 1: Simple move unbound to not listen on 0.0.0.0 and only the internal ones. However, docker has no way to bind only to the "public" interface. Approach 2: Move the internal unbound to some other port. This required a PR for haraka - https://github.com/haraka/Haraka/pull/2863 . This works and we use systemd-resolved by default. However, it turns out systemd-resolved with hog the lo and thus docker cannot bind again to port 53. Approach 3: Get rid of systemd-resolved and try to put the dns server list in /etc/resolv.conf. This is surprisingly hard because the DNS listing can come from DHCP or netplan or wherever. We can hardcode some public DNS servers but this seems not a good idea for privacy. Approach 4: So maybe we don't move the unbound away to different port after all. However, all the work for approach 2 is done and it's quite nice that the default resolver is used with the default dns server of the network (probably a caching server + also maybe has some home network firewalled dns). So, the final solution is to bind to the make docker bind to the IP explicity. It's unclear what will happen if the IP changes, maybe it needs a restart. 2020-11-18 11:43:28 -08:00			`interface: 127.0.0.1`
			`interface: 172.18.0.1`
Make unbound listen also on future devices The local network for docker containers might not be up yet https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#term-ip-freebind-yes-or-no 2022-01-26 16:31:30 +01:00			`ip-freebind: yes`
unbound: enable ip6 2022-08-01 12:59:50 +02:00			`do-ip6: yes`
move unbound config to separate file 2019-11-13 14:48:56 -08:00			`access-control: 127.0.0.1 allow`
			`access-control: 172.18.0.1/16 allow`
			`cache-max-negative-ttl: 30`
			`cache-max-ttl: 300`
			`# enable below for logging to journalctl -u unbound`
			`# verbosity: 5`
			`# log-queries: yes`
unbound: disable controller interface explicitly https://github.com/NLnetLabs/unbound/issues/806 2022-12-12 22:57:18 +01:00
			`# https://github.com/NLnetLabs/unbound/issues/806`
			`remote-control:`
			`control-enable: no`