{ pkgs, lib, config, host, ... }: let inherit (config.services) unbound; inherit (config.users) users; stateDir = "/var/lib/unbound"; in { networking.resolvconf.useLocalResolver = true; services.unbound = { enable = true; # DOC: https://calomel.org/unbound_dns.html settings = { remote-control = { control-enable = true; control-interface = "/run/unbound/unbound.socket"; }; server = { log-queries = false; verbosity = 1; interface = [ "127.0.0.1" "::1" ]; access-control = [ "0.0.0.0/0 refuse" "::0/0 refuse" "127.0.0.0/8 allow" "::1 allow" ]; prefer-ip4 = !config.networking.enableIPv6; port = 53; # The file which contains the listing of primary root DNS servers. # To be updated once every six months. root-hints = "/var/lib/unbound/named.root"; # Do no answer id.server and hostname.bind queries. hide-identity = true; # Do not answer version.server and version.bind queries. hide-version = true; # Will trust glue only if it is within the servers authority. # Harden against out of zone rrsets, to avoid spoofing attempts. # Hardening queries multiple name servers for the same data to make # spoofing significantly harder and does not mandate dnssec. harden-glue = true; # Require DNSSEC data for trust-anchored zones, if such data is absent, the # zone becomes bogus. Harden against receiving dnssec-stripped data. If you # turn it off, failing to validate dnskey data for a trustanchor will trigger # insecure mode for that zone (like without a trustanchor). Default on, # which insists on dnssec data for trust-anchored zones. harden-dnssec-stripped = true; # Use 0x20-encoded random bits in the query to foil spoof attempts. # http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 # # When Unbound sends a query to a remote server it sends the hostname # string in random upper and lower characters. The remote server must # resolve the hostname as if all the characters were lower case. The remote # server must then send the query back to Unbound in the same random upper # and lower characters that Unbound sent. If the characters of the hostname # in the response are in the same format as the query then the dns-0x20 # check is satisfied. # Attackers hoping to poison a Unbound DNS cache must therefore guess the # mixed-case encoding of the query and the timing of the return dns answer # in addition to all other fields required in a DNS poisoning attack. # dns-0x20 increases the difficulty of the attack significantly. # # It may result in maybe 0.4% of domains getting no answers # due to no support on the authoritative server side use-caps-for-id = true; #cache-min-ttl = 3600; cache-max-ttl = 86400; # Perform prefetching of close to expired message cache entries. If a client # requests the dns lookup and the TTL of the cached hostname is going to # expire in less than 10% of its TTL, unbound will (1st) return the IP of the # host to the client and (2nd) pre-fetch the DNS request from the remote DNS server. # This method has been shown to increase the amount of cached hits by # local clients by 10% on average. prefetch = true; # Number of threads to create. 1 disables threading. # This should equal the number of CPU cores in the host. num-threads = host.CPUs; # The number of slabs to use for cache and must be a power of 2 times the # number of num-threads set above. more slabs reduce lock contention, # but fragment memory usage. msg-cache-slabs = 8; rrset-cache-slabs = 8; infra-cache-slabs = 8; key-cache-slabs = 8; # Increase the memory size of the cache. Use roughly twice as much rrset cache # memory as you use msg cache memory. Due to malloc overhead, the total memory # usage is likely to rise to double (or 2.5x) the total cache memory. rrset-cache-size = "32m"; msg-cache-size = "16m"; # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets # the kernel buffer larger so that no messages are lost in spikes in the traffic. so-rcvbuf = "1m"; # Enforce privacy of these addresses. Strips them away from answers. # It may cause DNSSEC validation to additionally mark it as bogus. # Protects against 'DNS Rebinding' (uses browser as network proxy). # Only 'private-domain' and 'local-data' names are allowed # to have these private addresses. No default. private-address = [ "192.168.0.0/16" "172.16.0.0/12" "10.0.0.0/8" ]; # Allow the domain (and its subdomains) to contain private addresses. # local-data statements are allowed to contain private addresses too. #private-domain = "home.lan"; # If nonzero, unwanted replies are not only reported in statistics, but also # a running total is kept per thread. If it reaches the threshold, a warning # is printed and a defensive action is taken, the cache is cleared to flush # potential poison out of it. A suggested value is 10000000, the default is # 0 (turned off). calomel.org thinks 10K is a good value. unwanted-reply-threshold = 10000; # IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND on # localhost you will want to allow the resolver to send queries to localhost. # Make sure to set do-not-query-localhost = true;. do-not-query-localhost = true; # Should additional section of secure message also be kept clean of unsecure # data. Useful to shield the users of this validator from potential bogus # data in the additional section. All unsigned data in the additional section # is removed from secure messages. val-clean-additional = true; }; }; }; networking.nftables.ruleset = '' table inet filter { chain output-net { meta l4proto { udp, tcp } \ th dport domain \ skuid ${users.unbound.name} \ counter accept comment "unbound" } } ''; systemd.services.unbound = { serviceConfig = { RuntimeDirectory = "unbound"; RuntimeDirectoryMode = "0700"; }; preStart = '' install -m 444 \ ${../../networking/named.root} \ /var/lib/unbound/named.root ''; }; }