unbound: hardening

seb4itik/byow/roles/unbound/templates/unbound.conf

@@ -1,4 +1,12 @@
 server:
+  do-ip4: yes
+  do-ip6: no
+  do-udp: yes
+  do-tcp: yes
+  hide-identity: yes
+  hide-version: yes
+  harden-glue: yes
+  use-caps-for-id: yes
   do-not-query-localhost: no
 {% for interface in unbound_listen_interfaces %}
   interface: {{ interface }}
@@ -6,15 +14,18 @@ server:
 {% for access in unbound_access_control %}
   access-control: {{ access }}
 {% endfor %}
-{% for zone in unbound_stub_zones %}
 
+  # Consul ne supporte pas DNSSEC
+  # FIXME: domain-insecure: "consul"
+
+{% for zone in unbound_stub_zones %}
 stub-zone:
   name: "{{ zone.name }}"
   stub-addr: {{ zone.stub_to }}
   stub-no-cache: {{ zone.no_cache | default('yes') }}
 {% endfor %}
-{% for zone in unbound_forward_zones %}
 
+{% for zone in unbound_forward_zones %}
 forward-zone:
   name: "{{ zone.name }}"
   forward-addr: {{ zone.forward_to }}