lumathieu/cantal.luc-geo.fr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 1 Wiki Activity

Tweaks + explicit no log directives added

Browse Source
This commit is contained in:
Lucas MATHIEU
2025-07-17 22:48:31 +02:00
parent f8b323cbb2
commit 3dc353f058
1 changed files with 25 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
etc/unbound/unbound.conf
View File

@@ -1,7 +1,7 @@
# /etc/unbound/unbound.conf : unbound conf. file for cantal # /etc/unbound/unbound.conf : unbound conf. file for cantal
# #
# Last edition : 2025-07-06 # Last edition : 2025-07-17
# Last editor : @Campanu # Last editor : Lucas MATHIEU
# #
server: server:
@@ -31,7 +31,7 @@ server:
## Root hints file ## Root hints file
root-hints: "/etc/unbound/root.hints" root-hints: "/etc/unbound/root.hints"
# Security & privacy # Security & privacy
harden-algo-downgrade: yes harden-algo-downgrade: yes
harden-glue: yes harden-glue: yes
@@ -39,23 +39,26 @@ server:
hide-version: yes hide-version: yes
qname-minimisation: yes qname-minimisation: yes
val-clean-additional: yes val-clean-additional: yes
# DNSSEC # DNSSEC
harden-below-nxdomain: yes harden-below-nxdomain: yes
harden-dnssec-stripped: yes harden-dnssec-stripped: yes
auto-trust-anchor-file: "/etc/unbound/dnssec/root.key" auto-trust-anchor-file: "/etc/unbound/dnssec/root.key"
## Disabling capitalization randomization to avoid DNSSEC issues ## Disabling capitalization randomization to avoid DNSSEC issues
use-caps-for-id: no use-caps-for-id: no
## RFC 8198: Aggressive Use of DNSSEC-Validated Cache ## RFC 8198: Aggressive Use of DNSSEC-Validated Cache
aggressive-nsec: yes aggressive-nsec: yes
# Tweaks # Tweaks
num-threads: 2 num-threads: 2
so-reuseport: yes so-reuseport: yes
so-rcvbuf: 4m
so-sndbuf: 4m
prefetch: yes prefetch: yes
prefetch-key: yes prefetch-key: yes
@@ -66,34 +69,38 @@ server:
rrset-cache-slabs: 2 rrset-cache-slabs: 2
infra-cache-slabs: 2 infra-cache-slabs: 2
key-cache-slabs: 2 key-cache-slabs: 2
neg-cache-size: 4m neg-cache-size: 4m
key-cache-size: 16m key-cache-size: 16m
msg-cache-size: 128m msg-cache-size: 64m
rrset-cache-size: 256m rrset-cache-size: 128m
infra-cache-numhosts: 100000 infra-cache-numhosts: 100000
## TTL ## TTL
cache-min-ttl: 60 cache-min-ttl: 60
cache-max-ttl: 86400 cache-max-ttl: 86400
# RFC 8914: Extended DNS Errors # RFC 8914: Extended DNS Errors
ede: yes ede: yes
ede-serve-expired: yes ede-serve-expired: yes
# RFC 8767: Serving Stale Data # RFC 8767: Serving Stale Data
serve-expired: yes serve-expired: yes
serve-expired-ttl: 86400 serve-expired-ttl: 86400
serve-expired-ttl-reset: no serve-expired-ttl-reset: no
serve-expired-reply-ttl: 30 serve-expired-reply-ttl: 30
serve-expired-client-timeout: 1800 serve-expired-client-timeout: 1800
# Logging # Logging
use-syslog: no
logfile: "/var/log/unbound.log" logfile: "/var/log/unbound.log"
verbosity: 1 verbosity: 1
log-time-ascii: yes log-time-ascii: yes
log-queries: no
log-replies: no
log-servfail: no
log-local-actions: no
remote-control: remote-control:
control-enable: no control-enable: no