diff options
Diffstat (limited to 'opt/unbound/MAKEPKG')
| -rw-r--r-- | opt/unbound/MAKEPKG | 172 |
1 files changed, 172 insertions, 0 deletions
diff --git a/opt/unbound/MAKEPKG b/opt/unbound/MAKEPKG new file mode 100644 index 0000000..b21edf5 --- /dev/null +++ b/opt/unbound/MAKEPKG @@ -0,0 +1,172 @@ +#!/bin/mkpkg +# description: Validating, recursive, caching DNS resolver with DNSSEC support +# url: https://nlnetlabs.nl/projects/unbound/about/ + +name=unbound +version=1.26.1 +release=1 +depends=(libressl expat) +makedeps=(flex bison) +groups=(unbound:user:unbound:/var/lib/unbound:750:904:904) +services=(unbound) +permissions=( + /usr/bin/unbound:root:unbound:750 + /usr/bin/unbound-anchor:root:unbound:4750 + /usr/bin/unbound-checkconf:root:unbound:750 + /usr/bin/unbound-control:root:unbound:750 + /usr/bin/unbound-host:root:unbound:750 + /etc/unbound/unbound.conf:root:unbound:640 +) +source=(https://nlnetlabs.nl/downloads/unbound/$name-$version.tar.gz) +sha256sums=( + "35a6dc0e425a9282c3426d9a3043144011bf0534aed4b73ab62c52aee0af1503" +) + +build() { + cd $name-$version + ./configure \ + --prefix=/usr \ + --sysconfdir=/etc \ + --localstatedir=/var \ + --sbindir=/usr/bin \ + --disable-rpath \ + --disable-shared \ + --enable-pie \ + --enable-relro-now \ + --enable-tfo-client \ + --enable-tfo-server \ + --enable-aggressive-nsec \ + --with-ssl=/ \ + --with-conf-file=/etc/unbound/unbound.conf \ + --with-pidfile=/run/unbound/unbound.pid \ + --with-chroot-dir=/var/lib/unbound \ + --with-username=unbound \ + --with-rootkey-file=/var/lib/unbound/root.key \ + --with-libevent=no \ + --without-pyunbound \ + --without-pythonmodule \ + --disable-flto + make + make DESTDIR=$PKG install + + # Remove docs and static lib noise + rm -rf $PKG/usr/share/doc + rm -f $PKG/usr/lib/libunbound.la + + # Config directory + install -d -m 750 $PKG/etc/unbound + + # Hardened default config + printf '%s\n' \ + 'server:' \ + ' # Network' \ + ' interface: 127.0.0.1' \ + ' port: 53' \ + ' do-ip4: yes' \ + ' do-ip6: no' \ + ' do-udp: yes' \ + ' do-tcp: yes' \ + '' \ + ' # Access control' \ + ' access-control: 127.0.0.0/8 allow' \ + ' access-control: 0.0.0.0/0 refuse' \ + '' \ + ' # Privilege separation' \ + ' username: "unbound"' \ + ' directory: "/var/lib/unbound"' \ + ' chroot: "/var/lib/unbound"' \ + ' pidfile: "/run/unbound/unbound.pid"' \ + '' \ + ' # DNSSEC validation' \ + ' auto-trust-anchor-file: "/var/lib/unbound/root.key"' \ + ' val-clean-additional: yes' \ + '' \ + ' # Hardening' \ + ' hide-identity: yes' \ + ' hide-version: yes' \ + ' harden-glue: yes' \ + ' harden-dnssec-stripped: yes' \ + ' harden-referral-path: yes' \ + ' harden-algo-downgrade: yes' \ + ' harden-below-nxdomain: yes' \ + ' harden-large-queries: yes' \ + ' harden-short-bufsize: yes' \ + ' use-caps-for-id: yes' \ + ' qname-minimisation: yes' \ + ' aggressive-nsec: yes' \ + '' \ + ' # Privacy' \ + ' minimal-responses: yes' \ + ' rrset-roundrobin: yes' \ + '' \ + ' # Resource limits' \ + ' num-threads: 1' \ + ' msg-cache-size: 8m' \ + ' rrset-cache-size: 16m' \ + ' key-cache-size: 8m' \ + ' neg-cache-size: 4m' \ + ' unwanted-reply-threshold: 10000' \ + '' \ + ' # Logging (minimal)' \ + ' verbosity: 1' \ + ' use-syslog: no' \ + ' logfile: ""' \ + ' log-queries: no' \ + ' log-replies: no' \ + ' log-servfail: yes' \ + > $PKG/etc/unbound/unbound.conf + + # chroot bind-mount targets + install -d -m 750 $PKG/var/lib/unbound +} + +post_build() { + # runit service + install -d $PKG/etc/sv/unbound/log + + printf '%s\n' \ + '#!/bin/sh' \ + 'exec 2>&1' \ + '' \ + '# Prepare runtime directories' \ + 'install -d -m 750 -o unbound -g unbound /run/unbound' \ + 'install -d -m 750 -o unbound -g unbound /var/lib/unbound' \ + '' \ + '# Copy TLS certs into chroot for DNSSEC anchor fetch' \ + 'install -d -m 755 /var/lib/unbound/etc/ssl' \ + 'cp /etc/ssl/cert.pem /var/lib/unbound/etc/ssl/ 2>/dev/null || true' \ + '' \ + '# Fetch/update DNSSEC root trust anchor' \ + '# unbound-anchor returns 1 if the anchor was updated (not an error)' \ + 'unbound-anchor -a /var/lib/unbound/root.key || true' \ + 'chown unbound:unbound /var/lib/unbound/root.key' \ + '' \ + '# Validate config before starting' \ + 'unbound-checkconf /etc/unbound/unbound.conf || exit 1' \ + '' \ + '# Start unbound in foreground (-d) without forking (-v for stderr)' \ + 'exec unbound -d -c /etc/unbound/unbound.conf' \ + > $PKG/etc/sv/unbound/run + + printf '%s\n' \ + '#!/bin/sh' \ + 'rm -rf /run/unbound' \ + > $PKG/etc/sv/unbound/finish + + printf '%s\n' \ + '#!/bin/sh' \ + 'mkdir -p /var/log/unbound' \ + 'exec svlogd -tt /var/log/unbound' \ + > $PKG/etc/sv/unbound/log/run + + chmod 755 $PKG/etc/sv/unbound/run + chmod 755 $PKG/etc/sv/unbound/finish + chmod 755 $PKG/etc/sv/unbound/log/run +} + +signify() { + untrusted comment: public key + RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3 +} + +# vim: filetype=sh |