Torjus Håkestad
f16bc8b5b5
The tcp-reuse-timeout=15 and infra-host-ttl=120 changes from 5c111c8
caused unbound to fail resolving external domains via DNS-over-TLS.
Reverting to defaults (tcp-reuse-timeout=60, infra-host-ttl=900).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
68 lines
1.6 KiB
Nix
68 lines
1.6 KiB
Nix
{ pkgs, ... }: {
|
|
homelab.monitoring.scrapeTargets = [{
|
|
job_name = "unbound";
|
|
port = 9167;
|
|
}];
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
53
|
|
];
|
|
networking.firewall.allowedUDPPorts = [
|
|
53
|
|
];
|
|
|
|
services.prometheus.exporters.unbound = {
|
|
enable = true;
|
|
unbound.host = "unix:///run/unbound/unbound.ctl";
|
|
};
|
|
|
|
# Grant exporter access to unbound socket
|
|
systemd.services.prometheus-unbound-exporter.serviceConfig.SupplementaryGroups = [ "unbound" ];
|
|
|
|
services.unbound = {
|
|
enable = true;
|
|
|
|
settings = {
|
|
server = {
|
|
access-control = [
|
|
"127.0.0.0/8 allow"
|
|
"0.0.0.0/0 allow"
|
|
];
|
|
local-zone = "home.2rjus.net nodefault";
|
|
domain-insecure = "home.2rjus.net";
|
|
interface = "0.0.0.0";
|
|
do-not-query-localhost = "no";
|
|
port = "53";
|
|
do-ip4 = "yes";
|
|
do-ip6 = "no";
|
|
do-udp = "yes";
|
|
do-tcp = "yes";
|
|
extended-statistics = true;
|
|
};
|
|
remote-control = {
|
|
control-enable = true;
|
|
control-interface = "/run/unbound/unbound.ctl";
|
|
};
|
|
stub-zone = {
|
|
name = "home.2rjus.net";
|
|
stub-addr = [
|
|
"127.0.0.1@8053" # Local NSD
|
|
"10.69.13.5@8053" # ns1
|
|
"10.69.13.6@8053" # ns2
|
|
];
|
|
};
|
|
forward-zone = {
|
|
name = ".";
|
|
forward-tls-upstream = "yes";
|
|
# forward-addr = "1.1.1.1@853#cloudflare-dns.com";
|
|
forward-addr = [
|
|
"1.1.1.1@853#cloudflare-dns.com"
|
|
"1.0.0.1@853#cloudflare-dns.com"
|
|
"8.8.8.8@853#dns.google"
|
|
"8.8.4.4@853#dns.google"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|