one unbound config for all OS, fix #602

[HenryNe]

Fix for #602
Create config /etc/unbound/unbound.conf.d/openvpn.conf,
include this config into /etc/unbound/unbound.conf,
do it for all OS.

On uninstall simple remove the include, if if was injected by openvpn-install.

edit:
tested on Debian 9 and Arch Linux 1.4

[randshell]

@angristan I think in Arch we can remove the following code because they are defaults.

openvpn-install/openvpn-install.sh

Line 116 in e5f169a

curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cache

openvpn-install/openvpn-install.sh

Lines 120 to 128 in e5f169a

	echo 'server:
	use-syslog: yes
	do-daemonize: no
	username: "unbound"
	directory: "/etc/unbound"
	trust-anchor-file: trusted-key.key
	root-hints: root.hints
	port: 53
	num-threads: 2' >/etc/unbound/unbound.conf

The non defaults are the root-hints option because they are built in and so downloading them isn't necessary and the num-threads: 2 option that defaults to 1 (see https://wiki.archlinux.org/index.php/Unbound#Issues_concerning_num-threads)

[randshell]

https://wiki.archlinux.org/index.php/Unbound#Issues_concerning_num-threads

num-threads is 4 on Centos 7. In this case we can keep the default value that comes with the package on each distro or maybe overwrite it to 2 if it defaults to 1.

As a note, we specify qname-minimisation: yes for privacy reasons but it seems that it falls back to no sending all QNAME if the nameservers are broken and don't accept the minimsation. See https://www.nlnetlabs.nl/documentation/unbound/unbound.conf/#qname-minimisation

[randshell]

Can you update the path to our config in the questions please?

openvpn-install/openvpn-install.sh

Line 270 in e5f169a

echo "We will simply add a second server to /etc/unbound/unbound.conf for the OpenVPN subnet."

[randshell]

@HenryNe Looks good.
Now I'm waiting for feedback from @angristan to resolve my previous comments.

[HenryNe]

username: unbound is default. Testet on Arch Linux:

1. Removed the "username: ..." from /etc/unbound/unbound.conf
2. systemctl restart unbound
3. Get Current UID ps l -p pidof unbound``
   F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND
   4 976 1569 1 20 0 92292 15012 - Ssl ? 0:00 /usr/bin/unbound -d -p
4. Check user ID id 976
   uid=976(unbound) gid=976(unbound) groups=976(unbound)

[randshell]

@HenryNe these are defaults too #604 (comment).

You can use unbound.conf.txt to see them

[HenryNe]

"directory: /etc/unbound" is default on Arch Linux.

1. Removed the "directory: ..." from /etc/unbound/unbound.conf
2. systemctl restart unbound
3. Get Current Working Directory from running daemon:

ls -l /proc/`pidof unbound`/cwd
lrwxrwxrwx 1 root root 0 Apr  4 19:24 /proc/1569/cwd -> /etc/unbound

[randshell]

ls -l /proc/pidof unbound/cwd

Or you can use unbound-checkconf -o directory. See https://www.nlnetlabs.nl/documentation/unbound/unbound-checkconf/

[HenryNe]

unbound is started with /usr/bin/unbound -d -p under Arch Linux.
So the do-daemonize: no not need.ed.

[HenryNe]

The only last would be num-threads: 2, which is 1 default.

[HenryNe]

I changed the PR into ready for pull now, because this change uses the same options as before. Only the include and config file was movoed.