# LibrePortal drop-in for Unbound.
#
# Loaded by the image's own unbound.conf via
#   include-toplevel: "/usr/local/unbound/conf.d/*.conf"
# so this ADDS to the upstream defaults rather than replacing them. That
# matters: the base config is a working recursive resolver maintained by the
# image author, and anything we replace wholesale we would then own forever.
#
# Recursive by design. Unbound here talks to the root and authoritative
# servers directly, so no third-party resolver ever sees your queries — that is
# the entire reason to run it in front of a blocker. If you would rather forward
# to an encrypted upstream instead, see the forward-zone block at the bottom.

server:
    # Listen on all interfaces INSIDE the container; Docker decides what is
    # exposed. The image already runs unprivileged on 5335, which is why this
    # can sit alongside Pi-hole or AdGuard without fighting over port 53.
    interface: 0.0.0.0@5335

    # Answer only for private networks. Docker's own bridge ranges are included
    # because a query from Pi-hole arrives via the docker gateway, not from the
    # blocker's own address. Everything else is refused: an open resolver on a
    # public IP gets conscripted into DNS amplification attacks within hours.
    access-control: 127.0.0.0/8 allow
    access-control: 10.0.0.0/8 allow
    access-control: 172.16.0.0/12 allow
    access-control: 192.168.0.0/16 allow
    access-control: 0.0.0.0/0 refuse

    # Validate DNSSEC and refuse to answer if validation fails.
    harden-dnssec-stripped: yes
    harden-glue: yes
    harden-below-nxdomain: yes
    harden-referral-path: yes

    # Do not leak anything about the resolver or the queries it has seen.
    hide-identity: yes
    hide-version: yes
    qname-minimisation: yes
    rrset-roundrobin: yes

    # Modest, predictable footprint — this commonly runs on a small VPS
    # alongside everything else, so it is deliberately not tuned for a
    # thousand-client network.
    num-threads: 1
    msg-cache-size: 32m
    rrset-cache-size: 64m
    cache-min-ttl: 300
    cache-max-ttl: 86400
    prefetch: yes
    serve-expired: yes

    # Private addresses must never be returned for public names (DNS rebinding).
    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: fd00::/8
    private-address: fe80::/10

# ---------------------------------------------------------------------------
# OPTIONAL: forward instead of recurse.
#
# Uncommenting this turns Unbound from a recursive resolver into an encrypted
# forwarder — queries go to Quad9 over TLS rather than to the root servers.
# That is a real trade: you gain a filtered, fast upstream and you give up the
# "nobody sees my queries" property that is the point of recursion. Pick one
# deliberately; do not run both expecting the benefits of each.
# ---------------------------------------------------------------------------
#forward-zone:
#    name: "."
#    forward-tls-upstream: yes
#    forward-addr: 9.9.9.9@853#dns.quad9.net
#    forward-addr: 149.112.112.112@853#dns.quad9.net