servers/mermet/unbound.nix

   1 { pkgs, lib, config, ... }:
   2 let inherit (config) users; in
   3 {
   4   networking.resolvconf.useLocalResolver = true;
   5   services.unbound = {
   6     enable = true;
   7     # DOC: https://calomel.org/unbound_dns.html
   8     extraConfig = ''
   9       port: 53
  10       verbosity: 1
  11
  12       server:
  13         log-queries: no
  14
  15       # The file which contains the listing of primary root DNS servers.
  16       # To be updated once every six months.
  17       root-hints: /var/lib/unbound/named.root
  18
  19       # Do no answer id.server and hostname.bind queries.
  20       hide-identity: yes
  21       # Do not answer version.server and version.bind queries.
  22       hide-version: yes
  23
  24       # Will trust glue only if it is within the servers authority.
  25       # Harden against out of zone rrsets, to avoid spoofing attempts.
  26       # Hardening queries multiple name servers for the same data to make
  27       # spoofing significantly harder and does not mandate dnssec.
  28       harden-glue: yes
  29
  30       # Require DNSSEC data for trust-anchored zones, if such data is absent, the
  31       # zone becomes  bogus.  Harden against receiving dnssec-stripped data. If you
  32       # turn it off, failing to validate dnskey data for a trustanchor will trigger
  33       # insecure mode for that zone (like without a trustanchor).  Default on,
  34       # which insists on dnssec data for trust-anchored zones.
  35       harden-dnssec-stripped: yes
  36
  37       # Use 0x20-encoded random bits in the query to foil spoof attempts.
  38       # http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
  39       #
  40       # When Unbound sends a query to a remote server it sends the hostname
  41       # string in random upper and lower characters. The remote server must
  42       # resolve the hostname as if all the characters were lower case. The remote
  43       # server must then send the query back to Unbound in the same random upper
  44       # and lower characters that Unbound sent. If the characters of the hostname
  45       # in the response are in the same format as the query then the dns-0x20
  46       # check is satisfied.
  47       # Attackers hoping to poison a Unbound DNS cache must therefore guess the
  48       # mixed-case encoding of the query and the timing of the return dns answer
  49       # in addition to all other fields required in a DNS poisoning attack.
  50       # dns-0x20 increases the difficulty of the attack significantly.
  51       #
  52       # It may result in maybe 0.4% of domains getting no answers
  53       # due to no support on the authoritative server side
  54       use-caps-for-id: yes
  55
  56       #cache-min-ttl: 3600
  57       cache-max-ttl: 86400
  58
  59       # Perform prefetching of close to expired message cache entries.  If a client
  60       # requests the dns lookup and the TTL of the cached hostname is going to
  61       # expire in less than 10% of its TTL, unbound will (1st) return the IP of the
  62       # host to the client and (2nd) pre-fetch the DNS request from the remote DNS server.
  63       # This method has been shown to increase the amount of cached hits by
  64       # local clients by 10% on average.
  65       prefetch: yes
  66
  67       # Number of threads to create. 1 disables threading.
  68       # This should equal the number of CPU cores in the machine.
  69       num-threads: ${toString config.nix.maxJobs}
  70
  71       # The number of slabs to use for cache and must be a power of 2 times the
  72       # number of num-threads set above. more slabs reduce lock contention,
  73       # but fragment memory usage.
  74       msg-cache-slabs: 8
  75       rrset-cache-slabs: 8
  76       infra-cache-slabs: 8
  77       key-cache-slabs: 8
  78
  79       # Increase the memory size of the cache. Use roughly twice as much rrset cache
  80       # memory as you use msg cache memory. Due to malloc overhead, the total memory
  81       # usage is likely to rise to double (or 2.5x) the total cache memory.
  82       rrset-cache-size: 32m
  83       msg-cache-size: 16m
  84
  85       # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets
  86       # the kernel buffer larger so that no messages are lost in spikes in the traffic.
  87       so-rcvbuf: 1m
  88
  89       # Enforce privacy of these addresses. Strips them away from answers.
  90       # It may cause DNSSEC validation to additionally mark it as bogus.
  91       # Protects against 'DNS Rebinding' (uses browser as network proxy).
  92       #  Only 'private-domain' and 'local-data' names are allowed
  93       # to have these private addresses. No default.
  94       private-address: 192.168.0.0/16
  95       private-address: 172.16.0.0/12
  96       private-address: 10.0.0.0/8
  97
  98       # Allow the domain (and its subdomains) to contain private addresses.
  99       # local-data statements are allowed to contain private addresses too.
 100       #private-domain: "home.lan"
 101
 102       # If nonzero, unwanted replies are not only reported in statistics, but also
 103       # a running total is kept per thread. If it reaches the threshold, a warning
 104       # is printed and a defensive action is taken, the cache is cleared to flush
 105       # potential poison out of it.  A suggested value is 10000000, the default is
 106       # 0 (turned off). calomel.org thinks 10K is a good value.
 107       unwanted-reply-threshold: 10000
 108
 109       # IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND on
 110       # localhost you will want to allow the resolver to send queries to localhost.
 111       # Make sure to set do-not-query-localhost: yes.
 112       do-not-query-localhost: yes
 113
 114       # Should additional section of secure message also be kept clean of unsecure
 115       # data. Useful to shield the users of this validator from potential bogus
 116       # data in the additional section. All unsigned data in the additional section
 117       # is removed from secure messages.
 118       val-clean-additional: yes
 119     '';
 120   };
 121   systemd.services.unbound.preStart = ''
 122     install -m 444 -o unbound -g nogroup \
 123      ${../../config/dns/named.root} \
 124      /var/lib/unbound/named.root
 125   '';
 126 }