# /var/unbound/etc/unbound.conf — recursive DNS resolver
#
# Listens on:
#   127.0.0.1:53          — for local apps (acme-client, relayd)
#   10.10.10.1:53         — for nullstone over WG tunnel
#   192.168.0.50:53       — for LAN clients (LAN IP of T5600; adjust)
#
# Pi-hole stays on the Pi for LAN ad-blocking; Pi-hole's upstream is set
# to THIS unbound instance (10.10.10.1 via tunnel OR LAN IP direct).
#
# Reload: rcctl reload unbound
# Test:   dig @127.0.0.1 example.com

server:
    interface: 127.0.0.1
    interface: 10.10.10.1
    interface: 192.168.0.50

    # Restrict who can query
    access-control: 127.0.0.0/8 allow
    access-control: 10.10.10.0/29 allow      # WG mesh
    access-control: 192.168.0.0/24 allow     # LAN
    access-control: 0.0.0.0/0 refuse         # block public recursive abuse

    # Hide identity
    hide-identity: yes
    hide-version: yes

    # Cache + perf
    msg-cache-size: 64m
    rrset-cache-size: 128m
    cache-min-ttl: 60
    cache-max-ttl: 86400
    prefetch: yes
    prefetch-key: yes

    # DNSSEC validation
    auto-trust-anchor-file: "/var/unbound/db/root.key"
    val-clean-additional: yes

    # Privacy
    qname-minimisation: yes
    aggressive-nsec: yes
    minimal-responses: yes
    do-not-query-localhost: no   # allow forwarding to local Pi-hole if you do that later

    # Drop common bogus
    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12
    private-address: 192.168.0.0/16
    # ... but allow our own ranges to be returned in answers
    private-domain: "s8n.ru"
    private-domain: "veilor.uk"

    # Local zone for internal hosts (nullstone, edge, etc.) — fill from /etc/hosts
    local-zone: "s8n.ru." typetransparent
    local-data: "edge.s8n.ru.   IN A 10.10.10.1"
    local-data: "nullstone.s8n.ru. IN A 10.10.10.2"

    # Logs
    use-syslog: yes
    log-queries: no
    log-replies: no

remote-control:
    control-enable: yes
    control-interface: /var/run/unbound.sock