#!/bin/mkpkg
# description: Validating, recursive, caching DNS resolver with DNSSEC support
# url: https://nlnetlabs.nl/projects/unbound/about/

name=unbound
version=1.26.1
release=1
depends=(libressl expat)
makedeps=(flex bison)
groups=(unbound:user:unbound:/var/lib/unbound:750:904:904)
services=(unbound)
permissions=(
    /usr/bin/unbound:root:unbound:750
    /usr/bin/unbound-anchor:root:unbound:4750
    /usr/bin/unbound-checkconf:root:unbound:750
    /usr/bin/unbound-control:root:unbound:750
    /usr/bin/unbound-host:root:unbound:750
    /etc/unbound/unbound.conf:root:unbound:640
)
source=(https://nlnetlabs.nl/downloads/unbound/$name-$version.tar.gz)
sha256sums=(
    "35a6dc0e425a9282c3426d9a3043144011bf0534aed4b73ab62c52aee0af1503"
)

build() {
    cd $name-$version
    ./configure \
        --prefix=/usr \
        --sysconfdir=/etc \
        --localstatedir=/var \
        --sbindir=/usr/bin \
        --disable-rpath \
        --disable-shared \
        --enable-pie \
        --enable-relro-now \
        --enable-tfo-client \
        --enable-tfo-server \
        --enable-aggressive-nsec \
        --with-ssl=/ \
        --with-conf-file=/etc/unbound/unbound.conf \
        --with-pidfile=/run/unbound/unbound.pid \
        --with-chroot-dir=/var/lib/unbound \
        --with-username=unbound \
        --with-rootkey-file=/var/lib/unbound/root.key \
        --with-libevent=no \
        --without-pyunbound \
        --without-pythonmodule \
        --disable-flto
    make
    make DESTDIR=$PKG install

    # Remove docs and static lib noise
    rm -rf $PKG/usr/share/doc
    rm -f $PKG/usr/lib/libunbound.la

    # Config directory
    install -d -m 750 $PKG/etc/unbound

    # Hardened default config
    printf '%s\n' \
        'server:' \
        '    # Network' \
        '    interface: 127.0.0.1' \
        '    port: 53' \
        '    do-ip4: yes' \
        '    do-ip6: no' \
        '    do-udp: yes' \
        '    do-tcp: yes' \
        '' \
        '    # Access control' \
        '    access-control: 127.0.0.0/8 allow' \
        '    access-control: 0.0.0.0/0 refuse' \
        '' \
        '    # Privilege separation' \
        '    username: "unbound"' \
        '    directory: "/var/lib/unbound"' \
        '    chroot: "/var/lib/unbound"' \
        '    pidfile: "/run/unbound/unbound.pid"' \
        '' \
        '    # DNSSEC validation' \
        '    auto-trust-anchor-file: "/var/lib/unbound/root.key"' \
        '    val-clean-additional: yes' \
        '' \
        '    # Hardening' \
        '    hide-identity: yes' \
        '    hide-version: yes' \
        '    harden-glue: yes' \
        '    harden-dnssec-stripped: yes' \
        '    harden-referral-path: yes' \
        '    harden-algo-downgrade: yes' \
        '    harden-below-nxdomain: yes' \
        '    harden-large-queries: yes' \
        '    harden-short-bufsize: yes' \
        '    use-caps-for-id: yes' \
        '    qname-minimisation: yes' \
        '    aggressive-nsec: yes' \
        '' \
        '    # Privacy' \
        '    minimal-responses: yes' \
        '    rrset-roundrobin: yes' \
        '' \
        '    # Resource limits' \
        '    num-threads: 1' \
        '    msg-cache-size: 8m' \
        '    rrset-cache-size: 16m' \
        '    key-cache-size: 8m' \
        '    neg-cache-size: 4m' \
        '    unwanted-reply-threshold: 10000' \
        '' \
        '    # Logging (minimal)' \
        '    verbosity: 1' \
        '    use-syslog: no' \
        '    logfile: ""' \
        '    log-queries: no' \
        '    log-replies: no' \
        '    log-servfail: yes' \
        > $PKG/etc/unbound/unbound.conf

    # chroot bind-mount targets
    install -d -m 750 $PKG/var/lib/unbound
}

post_build() {
    # runit service
    install -d $PKG/etc/sv/unbound/log

    printf '%s\n' \
        '#!/bin/sh' \
        'exec 2>&1' \
        '' \
        '# Prepare runtime directories' \
        'install -d -m 750 -o unbound -g unbound /run/unbound' \
        'install -d -m 750 -o unbound -g unbound /var/lib/unbound' \
        '' \
        '# Copy TLS certs into chroot for DNSSEC anchor fetch' \
        'install -d -m 755 /var/lib/unbound/etc/ssl' \
        'cp /etc/ssl/cert.pem /var/lib/unbound/etc/ssl/ 2>/dev/null || true' \
        '' \
        '# Fetch/update DNSSEC root trust anchor' \
        '# unbound-anchor returns 1 if the anchor was updated (not an error)' \
        'unbound-anchor -a /var/lib/unbound/root.key || true' \
        'chown unbound:unbound /var/lib/unbound/root.key' \
        '' \
        '# Validate config before starting' \
        'unbound-checkconf /etc/unbound/unbound.conf || exit 1' \
        '' \
        '# Start unbound in foreground (-d) without forking (-v for stderr)' \
        'exec unbound -d -c /etc/unbound/unbound.conf' \
        > $PKG/etc/sv/unbound/run

    printf '%s\n' \
        '#!/bin/sh' \
        'rm -rf /run/unbound' \
        > $PKG/etc/sv/unbound/finish

    printf '%s\n' \
        '#!/bin/sh' \
        'mkdir -p /var/log/unbound' \
        'exec svlogd -tt /var/log/unbound' \
        > $PKG/etc/sv/unbound/log/run

    chmod 755 $PKG/etc/sv/unbound/run
    chmod 755 $PKG/etc/sv/unbound/finish
    chmod 755 $PKG/etc/sv/unbound/log/run
}

signify() {
    untrusted comment: public key
    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}

# vim: filetype=sh