unbound(role): fix unbound config template

- fix some indentation problems
- fix access control
- fix remote control unix socket and thrust anchor file (because debain
appamour ist annoying)
  - add unbound-anchor package

roles/unbound/tasks/main.yml

@@ -6,6 +6,11 @@
       ansible.builtin.package:
         name: unbound
 
+    - name: install unbound-anchor
+      become: true
+      ansible.builtin.package:
+        name: unbound-anchor
+
      - dnsutils
      - dnsutils
     - name: ensure correct directory permissions
       become: true
       ansible.builtin.file:

roles/unbound/templates/unbound.conf.j2

@@ -4,7 +4,7 @@ server:
   {% if unbound_enable_dnssec -%}
   # location of the trust anchor file that enables DNSSEC
   # this file is generated by the `unbound-anchor` command
-  auto-trust-anchor-file: "/etc/unbound/trusted-key.key"
+  trust-anchor-file: "/usr/share/dns/root.key"
   {% endif -%}
 
   # num of threads
@@ -36,7 +36,7 @@ server:
 
   # addresses from the IP range that are allowed to connect to the resolver
   {% for i in unbound_access_control -%}
-  access-control: {{ i }}
+  access-control: {{ i }} allow
   {% endfor -%}
 
   {% for i in unbound_private_domain -%}
@@ -51,7 +51,8 @@ server:
 
 remote-control:
   control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }}
-  control-interface: /run/unbound-control.sock
+  control-interface: "/run/unbound.ctl"   # debian appamour does not allow any other path!!!
+  control-use-cert: no
 
 
 # configure some zones for which this resolver will act authoritatively