ScriptMania/unbound-server at master · pgram1/ScriptMania · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
[your-server]:~ # cat /etc/unbound/unbound.conf
server:
    interface: 0.0.0.0@53
    interface: ::0@53

    interface: 0.0.0.0@853
    interface: ::0@853
    tls-port: 853

    interface: 0.0.0.0@443
    interface: ::0@443
    https-port: 443

    access-control: 0.0.0.0/0 allow
    access-control: ::0/0 allow

    do-ip4: yes
    do-ip6: yes
    do-tcp: yes
    do-udp: yes

    udp-upstream-without-downstream: yes

    module-config: "iterator"

    hide-identity: yes
    hide-version: yes

    qname-minimisation: yes

    tls-service-key: "/etc/unbound/certs/privkey.pem"
    tls-service-pem: "/etc/unbound/certs/fullchain.pem"


[your-server]:~ # cat /etc/letsencrypt/renewal-hooks/deploy/unbound.sh
#!/bin/bash
# /etc/letsencrypt/renewal-hooks/deploy/unbound.sh
mkdir -p /etc/unbound/certs
cp /etc/letsencrypt/live/[your-domain-here]/privkey.pem   /etc/unbound/certs/privkey.pem
cp /etc/letsencrypt/live/[your-domain-here]/fullchain.pem /etc/unbound/certs/fullchain.pem
chown unbound:unbound /etc/unbound/certs/*.pem
chmod 640 /etc/unbound/certs/*.pem
systemctl restart unbound


[your-server]:~ # crontab -l
0 * * * * certbot renew