a4f23e52bf
Unbound UCI tries to protect embedded flash from excess use. Unbound RFC5011 KSK tracking can rewrite root.key every few minutes to an hour. It also writes and destroys files in the same directory during the process. Recommended UCI delays for copying busy work in /var/ back to /etc/ may be too conservative. These are all changed from 28 to 9 days. The RFC5011 KSK results were also destroyed by an init.d restart, even if /var/ is mounted on persistent storage like USB drive. /var/lib/unbound/root.key is now preserved during this process, unless a newer key is installed in /etc/ manually or package update. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
28 lines
685 B
Text
28 lines
685 B
Text
config unbound
|
|
option add_local_fqdn '1'
|
|
option add_wan_fqdn '0'
|
|
option dhcp_link 'none'
|
|
option dhcp4_slaac6 '0'
|
|
option dns64 '0'
|
|
option dns64_prefix '64:ff9b::/96'
|
|
option domain 'lan'
|
|
option domain_type 'static'
|
|
option edns_size '1280'
|
|
option hide_binddata '1'
|
|
option listen_port '53'
|
|
option localservice '1'
|
|
option manual_conf '0'
|
|
option protocol 'mixed'
|
|
option query_minimize '0'
|
|
option query_min_strict '0'
|
|
option rebind_localhost '0'
|
|
option rebind_protection '1'
|
|
option recursion 'passive'
|
|
option resource 'small'
|
|
option root_age '9'
|
|
option ttl_min '120'
|
|
option unbound_control '0'
|
|
option validator '0'
|
|
option validator_ntp '1'
|
|
#list domain_insecure ''
|
|
|