claude generated first pass

unbound/entrypoint.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+: "${TROCH_DC1_IP:?TROCH_DC1_IP must be set in .env}"
+: "${TROCH_DC2_IP:?TROCH_DC2_IP must be set in .env}"
+: "${OSWALD_DC_IP:?OSWALD_DC_IP must be set in .env}"
+
+envsubst '${TROCH_DC1_IP} ${TROCH_DC2_IP} ${OSWALD_DC_IP}' \
+  < /etc/unbound/unbound.conf.template \
+  > /etc/unbound/unbound.conf
+
+# DNSSEC root trust anchor for public resolution (exit 1 just means "updated")
+unbound-anchor -a /etc/unbound/root.key || true
+chown unbound:unbound /etc/unbound/root.key
+
+unbound-checkconf /etc/unbound/unbound.conf
+exec unbound -d -c /etc/unbound/unbound.conf