server:
  interface: 127.0.0.1
  username: "unbound"
  directory: "/etc/unbound"
  use-syslog: yes
  do-not-query-localhost: no
  access-control: 0.0.0.0/8 allow
  {% if unbound.tls %}tls-upstream: yes{% endif %}

  # Set root DNS servers.
  root-hints: "/etc/unbound/root.hints"

  # RFC1918 networks are private and should not be returned.
  private-address: 10.0.0.0/8
  private-address: 172.16.0.0/12
  private-address: 192.168.0.0/16
  private-address: 169.254.0.0/16
  private-address: fd00::/8
  private-address: fe80::/10

{% if unbound.nameservers %}
  # Define DNS servers to forward queries to.
  forward-zone:
    name: "."
    {% for nameserver in unbound.nameservers %}
    forward-addr: {{ nameserver }}
    {% endfor %}
{% endif %}
