CCCHH/ansible-infra
CCCHH/ansible-infra
2
2
Fork 1
Code Issues 9 Pull requests 10 Wiki Activity Actions

WIP: new z9 ccchh router #98

Draft
bitwhisker wants to merge 15 commits from new_ccchh_router into main
pull from: new_ccchh_router
merge into: CCCHH:main
Conversation 2 Commits 15 Files changed 44 +35 -40
1 changed files with 35 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 960315d182 - Show all commits

unbound(role): reformat config template and use all vcpus
Some checks failed
/ build (pull_request) Failing after 2m41s
Details
/ Ansible Lint (push) Failing after 2m44s
Details
/ Ansible Lint (pull_request) Failing after 2m44s
Details

Prev Next
bitwhisker 2026-05-26 10:19:42 +02:00
commit 960315d182
Signed by: bitwhisker
SSH key fingerprint: SHA256:KybIk/tusSKao6eLGY+ILlFa1rCrzwx66/acBAcKUqE

75
roles/unbound/templates/unbound.conf.j2
View file

@ -1,22 +1,18 @@
# ref: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html # ref: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html
# unbound.conf(5) man page # unbound.conf(5) man page
server: server:
{% if unbound_enable_dnssec -%} {% if unbound_enable_dnssec -%}
# disable chroot because unbound is the only thing running on the VM # location of the trust anchor file that enables DNSSEC
# and because it has issues with how archlinux configures the systemd units write protection regarding the anchor file # this file is generated by the `unbound-anchor` command
bitwhisker marked this conversation as resolved Outdated
june commented 2026-05-24 18:44:00 +02:00
Outdated
Copy link

Is this still relevant on Debian? Again, we don't use Arch Linux in our infra.

Is this still relevant on Debian? Again, we don't use Arch Linux in our infra.
chroot: "" auto-trust-anchor-file: "/etc/unbound/trusted-key.key"
{% endif -%}
# location of the trust anchor file that enables DNSSEC
# this file is generated by the `unbound-anchor` command
auto-trust-anchor-file: "/etc/unbound/trusted-key.key"
{% endif -%}
# use all CPUs # use all CPUs
num-threads: 2 num-threads: {{ ansible_facts['processor_vcpus'] }}
# more cache memory # more cache memory
rrset-cache-size: 60m rrset-cache-size: 60m
msg-cache-size: 30m msg-cache-size: 30m
bitwhisker marked this conversation as resolved Outdated
june commented 2026-05-24 18:44:30 +02:00
Outdated
Copy link

Are those all the CPUs we use? Might it make sense to have this configurable or at least change the comment?

Are those all the CPUs we use? Might it make sense to have this configurable or at least change the comment?
# prefetch to keep the cache up to date # prefetch to keep the cache up to date
prefetch: yes prefetch: yes
@ -25,49 +21,48 @@ server:
prefetch-key: yes prefetch-key: yes
# Faster UDP with multithreading (only on Linux). # Faster UDP with multithreading (only on Linux).
so-reuseport: yes so-reuseport: yes
# disable special large send buffer handling and just use kernel defaults # disable special large send buffer handling and just use kernel defaults
so-sndbuf: 0 so-sndbuf: 0
# send minimal amount of information to upstream servers to enhance privacy # send minimal amount of information to upstream servers to enhance privacy
qname-minimisation: yes qname-minimisation: yes
# specify the interface to answer queries from by ip-address. # specify the interface to answer queries from by ip-address.
{% for i in unbound_bind_interfaces -%} {% for i in unbound_bind_interfaces -%}
interface: "{{ i }}" interface: "{{ i }}"
{% endfor %} {% endfor %}
# addresses from the IP range that are allowed to connect to the resolver # addresses from the IP range that are allowed to connect to the resolver
{% for i in unbound_access_control -%} {% for i in unbound_access_control -%}
access-control: {{ i }} access-control: {{ i }}
{% endfor -%} {% endfor -%}
{% for i in unbound_private_domain -%} {% for i in unbound_private_domain -%}
private-domain: {{ i }} private-domain: {{ i }}
{% endfor -%} {% endfor -%}
# The number of seconds between printing statistics to the log for every thread. # The number of seconds between printing statistics to the log for every thread.
statistics-interval: 0 statistics-interval: 0
# Extended statistics are printed, Keeping track of more statistics takes time. # Extended statistics are printed, Keeping track of more statistics takes time.
extended-statistics: yes extended-statistics: yes
remote-control: remote-control:
control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }}
control-interface: /run/unbound-control.sock control-interface: /run/unbound-control.sock
# configure some zones for which this resolver will act authoritatively # configure some zones for which this resolver will act authoritatively
# https://www.dns.icann.org/services/axfr/ # https://www.dns.icann.org/services/axfr/
{% for i in [ ".", "in-addr.arpa.", "arpa.", "root-servers.net.", "ip6.arpa.", "ip6-servers.arpa.", "mcast.net." ] %} {% for i in [ ".", "in-addr.arpa.", "arpa.", "root-servers.net.", "ip6.arpa.", "ip6-servers.arpa.", "mcast.net." ] %}
auth-zone: auth-zone:
name: "{{ i }}" name: "{{ i }}"
primary: "lax.xfr.dns.icann.org" primary: "lax.xfr.dns.icann.org"
primary: "iad.xfr.dns.icann.org" primary: "iad.xfr.dns.icann.org"
fallback-enabled: yes fallback-enabled: yes
for-downstream: no for-downstream: no
for-upstream: yes for-upstream: yes
{% endfor %} {% endfor %}