apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: unbound
  name: unbound-config
  namespace: network-tools
data:
  unbound.conf: |-
    server:
      verbosity: 1
      statistics-interval: 0
      shm-enable: yes
      statistics-cumulative: yes
      extended-statistics: yes
      num-threads: 1
      interface: 0.0.0.0
      port: 8053
      prefer-ip6: no
      so-reuseport: yes
      msg-cache-size: 32m
      msg-cache-slabs: 4
      rrset-cache-size: 4m
      rrset-cache-slabs: 4
      cache-min-ttl: 0
      cache-max-ttl: 86400
      cache-max-negative-ttl: 10
      infra-host-ttl: 900
      infra-cache-min-rtt: 50
      infra-cache-slabs: 4
      infra-cache-numhosts: 10000
      do-ip4: yes
      do-ip6: no
      do-udp: yes
      do-tcp: yes
      # tcp-upstream: no
      # udp-upstream-without-downstream: no
      use-systemd: no
      do-daemonize: no
      access-control: 0.0.0.0/0 allow
      root-hints: /etc/unbound/root.hints
      hide-identity: yes
      hide-version: yes
      hide-trustanchor: yes
      prefetch: yes
      # prefetch-key: no
      rrset-roundrobin: yes
      minimal-responses: yes
      serve-expired: yes
      serve-expired-ttl: 0
      serve-expired-ttl-reset: no
      key-cache-size: 4m
      key-cache-slabs: 4
      neg-cache-size: 1m
    remote-control:
      control-enable: yes
      control-interface: /control/unbound.control.sock
      # control-interface: 127.0.0.1
      # control-port: 8953
      control-use-cert: "yes"
      server-key-file: "/control/unbound_server.key"
      server-cert-file: "/control/unbound_server.pem"
      control-key-file: "/control/unbound_control.key"
      control-cert-file: "/control/unbound_control.pem"
    forward-zone:
      name: "."
      # Cloudflare
      forward-addr: 1.1.1.1@853
      forward-addr: 1.0.0.1@853
      # forward-addr: 2606:4700:4700::1111@853
      # forward-addr: 2606:4700:4700::1001@853
      # Quad9
      forward-addr: 9.9.9.9@853
      forward-addr: 149.112.112.112@853
      # forward-addr: 2620:fe::fe@853
      # forward-addr: 2620:fe::9@853
      forward-ssl-upstream: yes
