claude generated first pass

2026-07-15 17:58:23 -07:00
1 parent 81553590df
commit 911b1f8c5d
@@ -0,0 +1,89 @@
+# Unbound — caching resolver + conditional forwarder for AD zones.
+# ${TROCH_DC1_IP}-style tokens are rendered from .env at container start.
+
+server:
+    verbosity: 1
+    username: "unbound"
+    do-daemonize: no
+    chroot: ""
+
+    # Listen ONLY on loopback and tunnel-facing IPs — never the public IP.
+    # ip-freebind lets us bind 172.31.8.1 even before OpenVPN brings up tun0.
+    interface: 127.0.0.1
+    interface: 172.31.8.1
+    interface: 172.31.255.1
+    ip-freebind: yes
+    port: 53
+    do-ip6: no
+
+    access-control: 0.0.0.0/0 refuse
+    access-control: 127.0.0.0/8 allow
+    access-control: 172.31.8.0/24 allow      # OpenVPN clients
+    access-control: 172.31.255.0/24 allow    # WireGuard transfer net
+    access-control: 192.168.20.0/24 allow    # Trochalakis LAN (optional use)
+    access-control: 192.168.7.0/24 allow     # Oswald LAN (optional use)
+
+    hide-identity: yes
+    hide-version: yes
+    harden-glue: yes
+    harden-dnssec-stripped: yes
+    qname-minimisation: yes
+    prefetch: yes
+    msg-cache-size: 64m
+    rrset-cache-size: 128m
+
+    auto-trust-anchor-file: "/etc/unbound/root.key"
+
+    # AD zones return RFC1918 answers and are unsigned — exempt them from
+    # rebind protection and DNSSEC validation.
+    private-address: 10.0.0.0/8
+    private-address: 172.16.0.0/12
+    private-address: 192.168.0.0/16
+    private-domain: "ad.atlashorizon.net"
+    private-domain: "ad.calliecorner.net"
+    private-domain: "ad.oswaldtheotter.net"
+    private-domain: "ad.trochalakis.net"
+    domain-insecure: "ad.atlashorizon.net"
+    domain-insecure: "ad.calliecorner.net"
+    domain-insecure: "ad.oswaldtheotter.net"
+    domain-insecure: "ad.trochalakis.net"
+    domain-insecure: "20.168.192.in-addr.arpa"
+    domain-insecure: "7.168.192.in-addr.arpa"
+    local-zone: "20.168.192.in-addr.arpa." nodefault
+    local-zone: "7.168.192.in-addr.arpa." nodefault
+
+# ── Conditional forwarding: AD zones → DCs over the WireGuard tunnel. ──
+# Everything not listed below is resolved publicly by normal recursion.
+
+forward-zone:
+    name: "ad.atlashorizon.net."          # also covers _msdcs.ad.atlashorizon.net
+    forward-addr: ${TROCH_DC1_IP}         # AHDC01
+    forward-addr: ${TROCH_DC2_IP}         # AHDC03
+
+forward-zone:
+    name: "ad.calliecorner.net."
+    forward-addr: ${TROCH_DC1_IP}
+    forward-addr: ${TROCH_DC2_IP}
+
+forward-zone:
+    name: "ad.trochalakis.net."
+    forward-addr: ${TROCH_DC1_IP}
+    forward-addr: ${TROCH_DC2_IP}
+
+forward-zone:
+    name: "ad.oswaldtheotter.net."
+    forward-addr: ${OSWALD_DC_IP}         # AH-OSWLDC
+    # Root DCs as fallback — keep ONLY if this zone replicates forest-wide
+    # (ForestDnsZones); remove these two lines otherwise.
+    forward-addr: ${TROCH_DC1_IP}
+    forward-addr: ${TROCH_DC2_IP}
+
+# Reverse zones so PTR lookups for site hosts work
+forward-zone:
+    name: "20.168.192.in-addr.arpa."
+    forward-addr: ${TROCH_DC1_IP}
+    forward-addr: ${TROCH_DC2_IP}
+
+forward-zone:
+    name: "7.168.192.in-addr.arpa."
+    forward-addr: ${OSWALD_DC_IP}