# /var/unbound/etc/unbound.conf - fw.internal
server:
	interface: 127.0.0.1
	interface: 192.168.1.1
	interface: 192.168.2.1
	interface: 192.168.3.1
	interface: 192.168.4.1
	interface: 192.168.5.1
	interface: 192.168.10.1
	interface: 192.168.20.1
	interface: 192.168.30.1
	do-ip6: no

	access-control: 0.0.0.0/0 refuse
	access-control: 127.0.0.0/8 allow
	access-control: 192.168.1.0/24 allow
	access-control: 192.168.2.0/24 allow
	access-control: 192.168.3.0/24 allow
	access-control: 192.168.4.0/24 allow
	access-control: 192.168.5.0/24 allow
	access-control: 192.168.10.0/24 allow
	access-control: 192.168.20.0/24 allow
	access-control: 192.168.30.0/24 allow

	# Hardening and privacy
	hide-identity: yes
	hide-version: yes
	harden-glue: yes
	harden-dnssec-stripped: yes
	qname-minimisation: yes
	aggressive-nsec: yes
	prefetch: yes

	# DNSSEC validation
	auto-trust-anchor-file: "/var/unbound/db/root.key"
	val-log-level: 1

	# DNS rebinding protection: public names may not resolve to internal addresses
	private-address: 10.0.0.0/8
	private-address: 100.64.0.0/10
	private-address: 169.254.0.0/16
	private-address: 172.16.0.0/12
	private-address: 192.168.0.0/16
	private-domain: "internal."

	# Tell Firefox not to switch to DNS over HTTPS on its own
	local-zone: "use-application-dns.net." always_nxdomain

	# iCloud Private Relay: switch it off for this network (Apple's documented method),
	# so Safari uses unbound and the VPN's DNS instead of Apple's DNS partners
	local-zone: "mask.icloud.com." always_nxdomain
	local-zone: "mask-h2.icloud.com." always_nxdomain

	# Local names
	local-zone: "internal." static
	local-data: "fw.internal.            IN A 192.168.1.1"
	local-data: "laptop.internal.          IN A 192.168.1.10"
	local-data: "unifi-ap.internal.      IN A 192.168.2.2"
	local-data: "ps5.internal.           IN A 192.168.3.10"
	local-data: "kodi.internal.          IN A 192.168.4.10"
	local-data: "k8s-cp1.internal.       IN A 192.168.5.10"
	local-data: "k8s-cp2.internal.       IN A 192.168.5.20"
	local-data: "k8s-cp3.internal.       IN A 192.168.5.30"
	local-data: "k8s-worker1.internal.   IN A 192.168.5.40"
	local-data: "k8s-worker2.internal.   IN A 192.168.5.50"
	local-data: "unifi.internal.         IN A 192.168.5.60"
	local-data: "k8s-api.internal.       IN A 192.168.5.100"
	local-data: "homeassistant.internal. IN A 192.168.5.140"
	local-data: "siem.internal.          IN A 192.168.5.200"
	local-data: "ingress.internal.       IN A 192.168.5.201"

	# Every *.apps.internal name goes to the ingress (Traefik on .201)
	local-zone: "apps.internal." redirect
	local-data: "apps.internal. IN A 192.168.5.201"
	local-data: "laptop-wifi.internal.     IN A 192.168.10.10"
	local-data: "phone.internal.        IN A 192.168.10.11"
	local-data: "watch.internal.   IN A 192.168.10.12"
	local-data: "vacuum.internal. IN A 192.168.20.10"

	# Reverse lookups (so logs and tools show names instead of IPs)
	local-data-ptr: "192.168.1.1 fw.internal."
	local-data-ptr: "192.168.1.10 laptop.internal."
	local-data-ptr: "192.168.2.2 unifi-ap.internal."
	local-data-ptr: "192.168.3.10 ps5.internal."
	local-data-ptr: "192.168.4.10 kodi.internal."
	local-data-ptr: "192.168.5.10 k8s-cp1.internal."
	local-data-ptr: "192.168.5.20 k8s-cp2.internal."
	local-data-ptr: "192.168.5.30 k8s-cp3.internal."
	local-data-ptr: "192.168.5.40 k8s-worker1.internal."
	local-data-ptr: "192.168.5.50 k8s-worker2.internal."
	local-data-ptr: "192.168.5.60 unifi.internal."
	local-data-ptr: "192.168.5.100 k8s-api.internal."
	local-data-ptr: "192.168.5.140 homeassistant.internal."
	local-data-ptr: "192.168.5.200 siem.internal."
	local-data-ptr: "192.168.5.201 ingress.internal."
	local-data-ptr: "192.168.10.10 laptop-wifi.internal."
	local-data-ptr: "192.168.10.11 phone.internal."
	local-data-ptr: "192.168.10.12 watch.internal."
	local-data-ptr: "192.168.20.10 vacuum.internal."

remote-control:
	control-enable: yes
	control-interface: /var/run/unbound.sock

# All lookups go to the VPN provider's DNS resolver inside the tunnel. If it offers
# ad and tracker blocking, use the address for the blocking you want.
# (Many providers intercept queries to other DNS servers inside the tunnel anyway.)
forward-zone:
	name: "."
	forward-addr: @VPN_DNS_ADDRESS@