# Unbound — caching resolver + conditional forwarder for AD zones.
# ${TROCH_DC1_IP}-style tokens are rendered from .env at container start.

server:
    verbosity: 1
    username: "unbound"
    do-daemonize: no
    chroot: ""

    # Listen ONLY on loopback and tunnel-facing IPs — never the public IP.
    # ip-freebind lets us bind 172.31.8.1 even before OpenVPN brings up tun0.
    interface: 127.0.0.1
    interface: 172.31.8.1
    interface: 172.31.255.1
    ip-freebind: yes
    port: 53
    do-ip6: no

    access-control: 0.0.0.0/0 refuse
    access-control: 127.0.0.0/8 allow
    access-control: 172.31.8.0/24 allow      # OpenVPN clients
    access-control: 172.31.255.0/24 allow    # WireGuard transfer net
    access-control: 192.168.20.0/24 allow    # Trochalakis LAN (optional use)
    access-control: 192.168.7.0/24 allow     # Oswald LAN (optional use)

    hide-identity: yes
    hide-version: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    qname-minimisation: yes
    prefetch: yes
    msg-cache-size: 64m
    rrset-cache-size: 128m

    auto-trust-anchor-file: "/etc/unbound/root.key"

    # AD zones return RFC1918 answers and are unsigned — exempt them from
    # rebind protection and DNSSEC validation.
    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12
    private-address: 192.168.0.0/16
    private-domain: "ad.atlashorizon.net"
    private-domain: "ad.calliecorner.net"
    private-domain: "ad.oswaldtheotter.net"
    private-domain: "ad.trochalakis.net"
    domain-insecure: "ad.atlashorizon.net"
    domain-insecure: "ad.calliecorner.net"
    domain-insecure: "ad.oswaldtheotter.net"
    domain-insecure: "ad.trochalakis.net"
    domain-insecure: "20.168.192.in-addr.arpa"
    domain-insecure: "7.168.192.in-addr.arpa"
    local-zone: "20.168.192.in-addr.arpa." nodefault
    local-zone: "7.168.192.in-addr.arpa." nodefault

# ── Conditional forwarding: AD zones → DCs over the WireGuard tunnel. ──
# Everything not listed below is resolved publicly by normal recursion.

forward-zone:
    name: "ad.atlashorizon.net."          # also covers _msdcs.ad.atlashorizon.net
    forward-addr: ${TROCH_DC1_IP}         # AHDC01
    forward-addr: ${TROCH_DC2_IP}         # AHDC03

forward-zone:
    name: "ad.calliecorner.net."
    forward-addr: ${TROCH_DC1_IP}
    forward-addr: ${TROCH_DC2_IP}

forward-zone:
    name: "ad.trochalakis.net."
    forward-addr: ${TROCH_DC1_IP}
    forward-addr: ${TROCH_DC2_IP}

forward-zone:
    name: "ad.oswaldtheotter.net."
    forward-addr: ${OSWALD_DC_IP}         # AH-OSWLDC
    # Root DCs as fallback — keep ONLY if this zone replicates forest-wide
    # (ForestDnsZones); remove these two lines otherwise.
    forward-addr: ${TROCH_DC1_IP}
    forward-addr: ${TROCH_DC2_IP}

# Reverse zones so PTR lookups for site hosts work
forward-zone:
    name: "20.168.192.in-addr.arpa."
    forward-addr: ${TROCH_DC1_IP}
    forward-addr: ${TROCH_DC2_IP}

forward-zone:
    name: "7.168.192.in-addr.arpa."
    forward-addr: ${OSWALD_DC_IP}