unbound: disable controller interface explicitly

https://github.com/NLnetLabs/unbound/issues/806

CHANGES

@@ -2579,6 +2579,7 @@
 * Start with a default to not fail if no swap is present
 * Fix bug in cert cleanup logic causing it to repeatedly cleanup
 * Fix crash in RBL check
+* unbound: disable controller interface explicitly
 
 [7.4.0]
 * Update base image to jammy

scripts/init-ubuntu.sh

@@ -179,8 +179,8 @@ systemctl disable systemd-resolved || true
 # on vultr, ufw is enabled by default. we have our own firewall
 ufw disable || true
 
-# we need unbound to work as this is required for installer.sh to do any DNS requests
+# we need unbound to work as this is required for installer.sh to do any DNS requests. control-enable is for https://github.com/NLnetLabs/unbound/issues/806
-echo -e "server:\n\tinterface: 127.0.0.1\n" > /etc/unbound/unbound.conf.d/cloudron-network.conf
+echo -e "server:\n\tinterface: 127.0.0.1\n\nremote-control:\n\tcontrol-enable: no\n" > /etc/unbound/unbound.conf.d/cloudron-network.conf
 systemctl restart unbound
 
 # Ubuntu 22 has private home directories by default (https://discourse.ubuntu.com/t/private-home-directories-for-ubuntu-21-04-onwards/)

setup/start/unbound.conf

@@ -14,3 +14,8 @@ server:
         # enable below for logging to journalctl -u unbound
         # verbosity: 5
         # log-queries: yes
+
+# https://github.com/NLnetLabs/unbound/issues/806
+remote-control:
+    control-enable: no
+