90 lines
3.0 KiB
Plaintext
90 lines
3.0 KiB
Plaintext
# Unbound — caching resolver + conditional forwarder for AD zones.
|
|
# ${TROCH_DC1_IP}-style tokens are rendered from .env at container start.
|
|
|
|
server:
|
|
verbosity: 1
|
|
username: "unbound"
|
|
do-daemonize: no
|
|
chroot: ""
|
|
|
|
# Listen ONLY on loopback and tunnel-facing IPs — never the public IP.
|
|
# ip-freebind lets us bind 172.31.8.1 even before OpenVPN brings up tun0.
|
|
interface: 127.0.0.1
|
|
interface: 172.31.8.1
|
|
interface: 172.31.255.1
|
|
ip-freebind: yes
|
|
port: 53
|
|
do-ip6: no
|
|
|
|
access-control: 0.0.0.0/0 refuse
|
|
access-control: 127.0.0.0/8 allow
|
|
access-control: 172.31.8.0/24 allow # OpenVPN clients
|
|
access-control: 172.31.255.0/24 allow # WireGuard transfer net
|
|
access-control: 192.168.20.0/24 allow # Trochalakis LAN (optional use)
|
|
access-control: 192.168.7.0/24 allow # Oswald LAN (optional use)
|
|
|
|
hide-identity: yes
|
|
hide-version: yes
|
|
harden-glue: yes
|
|
harden-dnssec-stripped: yes
|
|
qname-minimisation: yes
|
|
prefetch: yes
|
|
msg-cache-size: 64m
|
|
rrset-cache-size: 128m
|
|
|
|
auto-trust-anchor-file: "/etc/unbound/root.key"
|
|
|
|
# AD zones return RFC1918 answers and are unsigned — exempt them from
|
|
# rebind protection and DNSSEC validation.
|
|
private-address: 10.0.0.0/8
|
|
private-address: 172.16.0.0/12
|
|
private-address: 192.168.0.0/16
|
|
private-domain: "ad.atlashorizon.net"
|
|
private-domain: "ad.calliecorner.net"
|
|
private-domain: "ad.oswaldtheotter.net"
|
|
private-domain: "ad.trochalakis.net"
|
|
domain-insecure: "ad.atlashorizon.net"
|
|
domain-insecure: "ad.calliecorner.net"
|
|
domain-insecure: "ad.oswaldtheotter.net"
|
|
domain-insecure: "ad.trochalakis.net"
|
|
domain-insecure: "20.168.192.in-addr.arpa"
|
|
domain-insecure: "7.168.192.in-addr.arpa"
|
|
local-zone: "20.168.192.in-addr.arpa." nodefault
|
|
local-zone: "7.168.192.in-addr.arpa." nodefault
|
|
|
|
# ── Conditional forwarding: AD zones → DCs over the WireGuard tunnel. ──
|
|
# Everything not listed below is resolved publicly by normal recursion.
|
|
|
|
forward-zone:
|
|
name: "ad.atlashorizon.net." # also covers _msdcs.ad.atlashorizon.net
|
|
forward-addr: ${TROCH_DC1_IP} # AHDC01
|
|
forward-addr: ${TROCH_DC2_IP} # AHDC03
|
|
|
|
forward-zone:
|
|
name: "ad.calliecorner.net."
|
|
forward-addr: ${TROCH_DC1_IP}
|
|
forward-addr: ${TROCH_DC2_IP}
|
|
|
|
forward-zone:
|
|
name: "ad.trochalakis.net."
|
|
forward-addr: ${TROCH_DC1_IP}
|
|
forward-addr: ${TROCH_DC2_IP}
|
|
|
|
forward-zone:
|
|
name: "ad.oswaldtheotter.net."
|
|
forward-addr: ${OSWALD_DC_IP} # AH-OSWLDC
|
|
# Root DCs as fallback — keep ONLY if this zone replicates forest-wide
|
|
# (ForestDnsZones); remove these two lines otherwise.
|
|
forward-addr: ${TROCH_DC1_IP}
|
|
forward-addr: ${TROCH_DC2_IP}
|
|
|
|
# Reverse zones so PTR lookups for site hosts work
|
|
forward-zone:
|
|
name: "20.168.192.in-addr.arpa."
|
|
forward-addr: ${TROCH_DC1_IP}
|
|
forward-addr: ${TROCH_DC2_IP}
|
|
|
|
forward-zone:
|
|
name: "7.168.192.in-addr.arpa."
|
|
forward-addr: ${OSWALD_DC_IP}
|