modules/unbound/templates/unbound.conf.erb

   1 ##
   2 ## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
   3 ## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
   4 ##
   5
   6 server:
   7         verbosity: 1
   8
   9 <%=
  10         out = []
  11         if nodeinfo['misc']['resolver-recursive'] and nodeinfo['hoster']['allow_dns_query']
  12                 out << "        interface: 0.0.0.0"
  13                 out << "        interface: ::0"
  14                 out << ""
  15                 out << "        interface-automatic: yes"
  16
  17                 out << "        access-control: 0.0.0.0/0 refuse"
  18                 out << "        access-control: ::0/0 refuse"
  19                 out << "        access-control: 127.0.0.0/8 allow"
  20                 out << "        access-control: ::0/0 refuse"
  21                 out << "        access-control: ::1 allow"
  22                 out << "        access-control: ::ffff:127.0.0.1 allow"
  23                 nodeinfo['hoster']['allow_dns_query'].each do |net|
  24                         out << "        access-control: #{net} allow"
  25                 end
  26         end
  27         out.join("\n")
  28 %>
  29
  30         #chroot: ""
  31
  32         hide-identity: yes
  33         hide-version: yes
  34
  35         use-caps-for-id: yes
  36
  37         # Do not query the following addresses. No DNS queries are sent there.
  38         # List one address per entry. List classless netblocks with /size,
  39         # do-not-query-address: 127.0.0.1/8
  40         # do-not-query-address: ::1
  41
  42         # if yes, the above default do-not-query-address entries are present.
  43         # if no, localhost can be queried (for testing and debugging).
  44         # do-not-query-localhost: yes
  45
  46         # File with trusted keys, kept uptodate using RFC5011 probes,
  47         # initial file like trust-anchor-file, then it stores metadata.
  48         # Use several entries, one per domain name, to track multiple zones.
  49         # auto-trust-anchor-file: ""
  50         auto-trust-anchor-file: "/var/lib/unbound/root.key"
  51         auto-trust-anchor-file: "/var/lib/unbound/debian.org.key"
  52
  53 <%=
  54         out = []
  55         if not nodeinfo['misc']['resolver-recursive'] and not nodeinfo['hoster']['nameservers_break_dnssec']
  56                 forwarders = nodeinfo['hoster']['nameservers']
  57                 forwarders ||= []
  58
  59                 out << 'forward-zone:'
  60                 out << '        name: "."'
  61                 forwarders.each do |ns|
  62                         out << "        forward-addr: #{ns}"
  63                 end
  64         end
  65         out.join("\n")
  66 %>