28 lines
1.8 KiB
Markdown
28 lines
1.8 KiB
Markdown
# Unbound DNS resolver
|
|
|
|
Role for a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/).
|
|
It is designed to be fast and lean and incorporates modern features based on open standards.
|
|
|
|
- [Documentation](https://unbound.docs.nlnetlabs.nl/en/latest/)
|
|
|
|
## Role Customization
|
|
|
|
The following variables can be used to customize this role:
|
|
|
|
- `unbound_install_prometheus_exporter`: Boolean of whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format.
|
|
Defaults to `true`.
|
|
- `unbound_bind_interfaces`: List of interface names or IP addresseson which unbound will listen for dns queries.
|
|
Defaults to `[0.0.0.0, ::]`.
|
|
- `unbound_enable_unbound_control`: Boolean of whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured.
|
|
Defaults to `true`.
|
|
- `unbound_enable_dnssec`: Boolean of whether dnssec validation should be enabled.
|
|
Defaults to `true`.
|
|
- `unbound_access_control`: **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E).
|
|
Defaults to `[]`.
|
|
- `unbound_disable_systemd_networkd`: Boolean if true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver.
|
|
Defaults to `true`.
|
|
- `unbound_thread_count`: The number of threads unbound uses.
|
|
Defaults to max vCPU Count.
|
|
- `unbound_private_domain`: List of domains from witch unbound for the domain and its subdomains to allows resolving of RFC1918 addresses. (Not relevent on Debian)
|
|
Defaults to `[]`
|
|
|