sync 2026-09-26 18:19 UTC

 1672 files changed, 151396 insertions(+)

1 files changed, 172 insertions, 0 deletions

diff --git a/opt/unbound/MAKEPKG b/opt/unbound/MAKEPKG
new file mode 100644
index 0000000..b21edf5
--- /dev/null
+++ b/opt/unbound/MAKEPKG
@@ -0,0 +1,172 @@
+#!/bin/mkpkg
+# description: Validating, recursive, caching DNS resolver with DNSSEC support
+# url: https://nlnetlabs.nl/projects/unbound/about/
+
+name=unbound
+version=1.26.1
+release=1
+depends=(libressl expat)
+makedeps=(flex bison)
+groups=(unbound:user:unbound:/var/lib/unbound:750:904:904)
+services=(unbound)
+permissions=(
+    /usr/bin/unbound:root:unbound:750
+    /usr/bin/unbound-anchor:root:unbound:4750
+    /usr/bin/unbound-checkconf:root:unbound:750
+    /usr/bin/unbound-control:root:unbound:750
+    /usr/bin/unbound-host:root:unbound:750
+    /etc/unbound/unbound.conf:root:unbound:640
+)
+source=(https://nlnetlabs.nl/downloads/unbound/$name-$version.tar.gz)
+sha256sums=(
+    "35a6dc0e425a9282c3426d9a3043144011bf0534aed4b73ab62c52aee0af1503"
+)
+
+build() {
+    cd $name-$version
+    ./configure \
+        --prefix=/usr \
+        --sysconfdir=/etc \
+        --localstatedir=/var \
+        --sbindir=/usr/bin \
+        --disable-rpath \
+        --disable-shared \
+        --enable-pie \
+        --enable-relro-now \
+        --enable-tfo-client \
+        --enable-tfo-server \
+        --enable-aggressive-nsec \
+        --with-ssl=/ \
+        --with-conf-file=/etc/unbound/unbound.conf \
+        --with-pidfile=/run/unbound/unbound.pid \
+        --with-chroot-dir=/var/lib/unbound \
+        --with-username=unbound \
+        --with-rootkey-file=/var/lib/unbound/root.key \
+        --with-libevent=no \
+        --without-pyunbound \
+        --without-pythonmodule \
+        --disable-flto
+    make
+    make DESTDIR=$PKG install
+
+    # Remove docs and static lib noise
+    rm -rf $PKG/usr/share/doc
+    rm -f $PKG/usr/lib/libunbound.la
+
+    # Config directory
+    install -d -m 750 $PKG/etc/unbound
+
+    # Hardened default config
+    printf '%s\n' \
+        'server:' \
+        '    # Network' \
+        '    interface: 127.0.0.1' \
+        '    port: 53' \
+        '    do-ip4: yes' \
+        '    do-ip6: no' \
+        '    do-udp: yes' \
+        '    do-tcp: yes' \
+        '' \
+        '    # Access control' \
+        '    access-control: 127.0.0.0/8 allow' \
+        '    access-control: 0.0.0.0/0 refuse' \
+        '' \
+        '    # Privilege separation' \
+        '    username: "unbound"' \
+        '    directory: "/var/lib/unbound"' \
+        '    chroot: "/var/lib/unbound"' \
+        '    pidfile: "/run/unbound/unbound.pid"' \
+        '' \
+        '    # DNSSEC validation' \
+        '    auto-trust-anchor-file: "/var/lib/unbound/root.key"' \
+        '    val-clean-additional: yes' \
+        '' \
+        '    # Hardening' \
+        '    hide-identity: yes' \
+        '    hide-version: yes' \
+        '    harden-glue: yes' \
+        '    harden-dnssec-stripped: yes' \
+        '    harden-referral-path: yes' \
+        '    harden-algo-downgrade: yes' \
+        '    harden-below-nxdomain: yes' \
+        '    harden-large-queries: yes' \
+        '    harden-short-bufsize: yes' \
+        '    use-caps-for-id: yes' \
+        '    qname-minimisation: yes' \
+        '    aggressive-nsec: yes' \
+        '' \
+        '    # Privacy' \
+        '    minimal-responses: yes' \
+        '    rrset-roundrobin: yes' \
+        '' \
+        '    # Resource limits' \
+        '    num-threads: 1' \
+        '    msg-cache-size: 8m' \
+        '    rrset-cache-size: 16m' \
+        '    key-cache-size: 8m' \
+        '    neg-cache-size: 4m' \
+        '    unwanted-reply-threshold: 10000' \
+        '' \
+        '    # Logging (minimal)' \
+        '    verbosity: 1' \
+        '    use-syslog: no' \
+        '    logfile: ""' \
+        '    log-queries: no' \
+        '    log-replies: no' \
+        '    log-servfail: yes' \
+        > $PKG/etc/unbound/unbound.conf
+
+    # chroot bind-mount targets
+    install -d -m 750 $PKG/var/lib/unbound
+}
+
+post_build() {
+    # runit service
+    install -d $PKG/etc/sv/unbound/log
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'exec 2>&1' \
+        '' \
+        '# Prepare runtime directories' \
+        'install -d -m 750 -o unbound -g unbound /run/unbound' \
+        'install -d -m 750 -o unbound -g unbound /var/lib/unbound' \
+        '' \
+        '# Copy TLS certs into chroot for DNSSEC anchor fetch' \
+        'install -d -m 755 /var/lib/unbound/etc/ssl' \
+        'cp /etc/ssl/cert.pem /var/lib/unbound/etc/ssl/ 2>/dev/null || true' \
+        '' \
+        '# Fetch/update DNSSEC root trust anchor' \
+        '# unbound-anchor returns 1 if the anchor was updated (not an error)' \
+        'unbound-anchor -a /var/lib/unbound/root.key || true' \
+        'chown unbound:unbound /var/lib/unbound/root.key' \
+        '' \
+        '# Validate config before starting' \
+        'unbound-checkconf /etc/unbound/unbound.conf || exit 1' \
+        '' \
+        '# Start unbound in foreground (-d) without forking (-v for stderr)' \
+        'exec unbound -d -c /etc/unbound/unbound.conf' \
+        > $PKG/etc/sv/unbound/run
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'rm -rf /run/unbound' \
+        > $PKG/etc/sv/unbound/finish
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'mkdir -p /var/log/unbound' \
+        'exec svlogd -tt /var/log/unbound' \
+        > $PKG/etc/sv/unbound/log/run
+
+    chmod 755 $PKG/etc/sv/unbound/run
+    chmod 755 $PKG/etc/sv/unbound/finish
+    chmod 755 $PKG/etc/sv/unbound/log/run
+}
+
+signify() {
+    untrusted comment: public key
+    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
+}
+
+# vim: filetype=sh