iframe-proxy | Sunbelt Computer Software

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

#! /usr/bin/env bash

KEYS_DIR="/opt/encrypted-dns/etc/keys"

ZONES_DIR="/opt/unbound/etc/unbound/zones"

reserved=134217728

availableMemory=$((1024 * $( (grep -F MemAvailable /proc/meminfo || grep -F MemTotal /proc/meminfo) | sed 's/[^0-9]//g')))

if [ $availableMemory -le $((reserved * 2)) ]; then

echo "Not enough memory" >&2

exit 1

availableMemory=$((availableMemory - reserved))

msg_cache_size=$((availableMemory / 4))

rr_cache_size=$((availableMemory / 3))

nproc=$(nproc)

if [ "$nproc" -gt 1 ]; then

threads=$((nproc - 1))

else

threads=1

if [ -z "${OPENNIC:-}" ] && [ -f /etc/opennic-env ]; then

OPENNIC=$(cat /etc/opennic-env)

opennic_enabled=0

case "${OPENNIC:-}" in

1 | true | yes | on) opennic_enabled=1 ;;

esac

provider_name=$(cat "$KEYS_DIR/provider_name")

sed \

-e "s/@MSG_CACHE_SIZE@/${msg_cache_size}/" \

-e "s/@PROVIDER_NAME@/${provider_name}/" \

-e "s/@RR_CACHE_SIZE@/${rr_cache_size}/" \

-e "s/@THREADS@/${threads}/" \

-e "s#@ZONES_DIR@#${ZONES_DIR}#" \

>/opt/unbound/etc/unbound/unbound.conf <<EOT

server:

verbosity: 1

num-threads: @THREADS@

interface: 127.0.0.1@553

so-reuseport: yes

edns-buffer-size: 1232

delay-close: 10000

cache-min-ttl: 3600

cache-max-ttl: 86400

do-daemonize: no

username: "_unbound"

log-queries: no

hide-version: yes

identity: "DNSCrypt"

harden-short-bufsize: yes

harden-large-queries: yes

harden-glue: yes

harden-dnssec-stripped: yes

harden-below-nxdomain: yes

harden-referral-path: no

do-not-query-localhost: no

prefetch: yes

prefetch-key: yes

qname-minimisation: yes

rrset-roundrobin: yes

minimal-responses: yes

udp-connect: no

chroot: "/opt/unbound/etc/unbound"

directory: "/opt/unbound/etc/unbound"

num-queries-per-thread: 4096

outgoing-range: 8192

msg-cache-size: @MSG_CACHE_SIZE@

rrset-cache-size: @RR_CACHE_SIZE@

neg-cache-size: 4M

serve-expired: yes

serve-expired-ttl: 86400

serve-expired-ttl-reset: yes

access-control: 0.0.0.0/0 allow

access-control: ::0/0 allow

tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"

aggressive-nsec: yes

val-bogus-ttl: 600

local-zone: "1." static

local-zone: "10.in-addr.arpa." static

local-zone: "127.in-addr.arpa." static

local-zone: "16.172.in-addr.arpa." static

local-zone: "168.192.in-addr.arpa." static

local-zone: "f.f.ip6.arpa." static

local-zone: "8.e.f.ip6.arpa." static

local-zone: "airdream." static

local-zone: "api." static

local-zone: "bbrouter." static

local-zone: "belkin." static

local-zone: "blinkap." static

local-zone: "corp." static

local-zone: "davolink." static

local-zone: "dearmyrouter." static

local-zone: "dhcp." static

local-zone: "dlink." static

local-zone: "domain." static

local-zone: "envoy." static

local-zone: "example." static

local-zone: "grp." static

local-zone: "gw==." static

local-zone: "home." static

local-zone: "hub." static

local-zone: "internal." static

local-zone: "intra." static

local-zone: "intranet." static

local-zone: "invalid." static

local-zone: "ksyun." static

local-zone: "lan." static

local-zone: "loc." static

local-zone: "local." static

local-zone: "localdomain." static

local-zone: "localhost." static

local-zone: "localnet." static

local-zone: "modem." static

local-zone: "mynet." static

local-zone: "myrouter." static

local-zone: "novalocal." static

local-zone: "onion." static

local-zone: "openstacklocal." static

local-zone: "priv." static

local-zone: "private." static

local-zone: "prv." static

local-zone: "router." static

local-zone: "telus." static

local-zone: "test." static

local-zone: "totolink." static

local-zone: "wlan_ap." static

local-zone: "workgroup." static

local-zone: "zghjccbob3n0." static

local-zone: "@PROVIDER_NAME@." refuse

include: "@ZONES_DIR@/*.conf"

remote-control:

control-enable: yes

control-interface: 127.0.0.1

EOT

if [ "$opennic_enabled" = 1 ]; then

cat >>/opt/unbound/etc/unbound/unbound.conf <<EOT

server:

# OpenNIC root: no ICANN root servers, internic.net, or IANA involved

root-hints: "opennic.hints"

auto-trust-anchor-file: "var/opennic.key"

EOT

else

cat >>/opt/unbound/etc/unbound/unbound.conf <<EOT

server:

auto-trust-anchor-file: "var/root.key"

auth-zone:

name: "."

url: "https://www.internic.net/domain/root.zone"

fallback-enabled: yes

for-downstream: no

for-upstream: yes

zonefile: "var/root.zone"

EOT

mkdir -p /opt/unbound/etc/unbound/dev &&

cp -a /dev/random /dev/urandom /opt/unbound/etc/unbound/dev/

mkdir -p -m 700 /opt/unbound/etc/unbound/var &&

chown _unbound:_unbound /opt/unbound/etc/unbound/var &&

if [ "$opennic_enabled" = 1 ]; then

if [ ! -f /opt/unbound/etc/unbound/var/opennic.key ]; then

cp /opt/unbound/etc/unbound/opennic.key /opt/unbound/etc/unbound/var/opennic.key

fi &&

chown _unbound:_unbound /opt/unbound/etc/unbound/var/opennic.key

else

/opt/unbound/sbin/unbound-anchor -a /opt/unbound/etc/unbound/var/root.key

if [ ! -f /opt/unbound/etc/unbound/unbound_control.pem ]; then

/opt/unbound/sbin/unbound-control-setup 2>/dev/null || :

mkdir -p /opt/unbound/etc/unbound/zones

exec /opt/unbound/sbin/unbound

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

unbound.sh

unbound.sh

Sunbelt Computer Software

PL/B Language Development and Support

FilesExpand file tree

unbound.sh

Latest commit

History

unbound.sh

File metadata and controls