{% if unbound.allow_lan_dns %}include: "/etc/unbound/resolvconf.conf"
{% endif %}

server:
  interface: 127.0.0.1
  use-syslog: yes
  do-daemonize: no
  username: "unbound"
  directory: "/etc/unbound"
  do-not-query-localhost: no
  access-control: 0.0.0.0/8 allow
  trust-anchor-file: trusted-key.key
  {% if unbound.tls %}tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
  {% endif %}

  # Set root DNS servers.
  root-hints: "/etc/unbound/root.hints"

  # RFC1918 networks are private and should not be returned.
  private-address: 10.0.0.0/8
  private-address: 172.16.0.0/12
  private-address: 192.168.0.0/16
  private-address: 169.254.0.0/16
  private-address: fd00::/8
  private-address: fe80::/10

{% if unbound.private_domains %}
  # Allow private domains.
  {% for domain in unbound.private_domains %}private-domain: "{{ domain }}"
  {% endfor %}

  # Do not filter reverse lookups for private address space.
  unblock-lan-zones: yes

  # Do not validate reverse lookups for private address space.
  insecure-lan-zones: yes

  # Disable DNSSEC for private domains.
  {% for domain in unbound.private_domains %}domain-insecure: "{{ domain }}"
  {% endfor %}
{% endif %}

{% if unbound.nameservers %}
  # Define DNS servers to forward queries to.
  forward-zone:
    name: "."
    {% for nameserver in unbound.nameservers %}
    forward-addr: {{ nameserver }}
    {% endfor %}
    {% if unbound.tls %}forward-tls-upstream: yes{% endif %}
{% endif %}
