unbound.config (Adguard + Unbound + Redis)

server:
  interface: 127.0.0.1
  port: 5335
  do-ip6: no
  do-ip4: yes
  do-udp: yes
  do-tcp: yes

  # Enable the cachedb module with validator and iterator
  module-config: "validator cachedb iterator"

  # Adjust cache settings for better performance with Redis
  cache-min-ttl: 0
  cache-max-ttl: 86400
  serve-expired: yes
  serve-expired-ttl: 86400

  # Hide DNS Server info
  hide-identity: yes
  hide-version: yes

  # DNSSEC validation
  auto-trust-anchor-file: "/var/lib/unbound/root.key"
  val-permissive-mode: no

  # Limit DNS Fraud and use DNSSEC
  aggressive-nsec: yes
  answer-cookie: yes
  deny-any: yes
  do-not-query-localhost: no
  harden-algo-downgrade: yes
  harden-dnssec-stripped: yes
  harden-glue: yes
  harden-referral-path: yes
  hide-trustanchor: yes
  qname-minimisation: yes
  rrset-roundrobin: yes
  use-caps-for-id: yes

  # Performance Tuning via NLNetLabs
  # https://unbound.docs.nlnetlabs.nl/en/latest/topics/core/performance.html
  num-queries-per-thread: 225
  num-threads: 2
  outgoing-range: 450
  so-reuseport: yes

  # Caching
  cache-min-negative-ttl: 30
  infra-cache-max-rtt: 60000
  infra-cache-min-rtt: 25
  infra-cache-numhosts: 100000
  infra-host-ttl: 450
  infra-keep-probing: no
  key-cache-size: 32m
  msg-cache-size: 128m
  neg-cache-size: 16m
  rrset-cache-size: 256m
  serve-expired-client-timeout: 0

  # Optimizations
  edns-buffer-size: 1232
  fast-server-num: 9
  fast-server-permil: 768
  infra-cache-slabs: 8
  key-cache-slabs: 8
  msg-cache-slabs: 8
  prefetch-key: yes
  prefetch: yes
  rrset-cache-slabs: 8
  unwanted-reply-threshold: 10000000

  # increase buffer size so that no messages are lost in traffic spikes
  so-rcvbuf: 8m
  so-sndbuf: 8m
  private-address: 192.168.0.0/16
  private-address: 169.254.0.0/16
  private-address: 172.16.0.0/12
  private-address: 10.0.0.0/8
  private-address: fd00::/8
  private-address: fe80::/10
  root-hints: "/etc/unbound/root.hints"

  # Use BIND9 style prefetching (only query what's needed)
  # BIND8: "-1 -1 -1 -1 -1" (prefetch EVERYTHING)
  # Default: "3 2 1 0 0"
  # https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-target-fetch-policy
  target-fetch-policy: "3 2 1 0 0"

  # HTTPS
  http-max-streams: 150
  http-query-buffer-size: 8m
  http-response-buffer-size: 8m

  incoming-num-tcp: 96
  outgoing-num-tcp: 96


# Get data for all TLDs from root servers (by IXFR or AXFR)
#
# Run a ping test on each to determine which servers respond the fastest
# Use only the fastest root servers
auth-zone:
    name: "."
    primary: 202.12.27.33         # m.root-servers.net 3.4ms
    primary: 192.5.5.241          # f.root-servers.net 3.6ms
    primary: 192.58.128.30        # j.root-servers.net 4ms
    primary: 192.203.230.10       # e.root-servers.net 4ms
    primary: 170.247.170.2        # b.root-servers.net 11.6ms
    primary: 198.41.0.4           # a.root-servers.net 13.3ms
    primary: 192.0.32.132         # lax.xfr.dns.icann.org 13.6ms
    primary: 192.33.4.12          # c.root-servers.net 15.9ms
    #primary: 199.7.91.13          # d.root-servers.net 14ms
    #primary: 192.112.36.4         # g.root-servers.net TIMEOUT
    #primary: 198.97.190.53        # h.root-servers.net 23ms
    #primary: 192.36.148.17        # i.root-servers.net 44ms
    #primary: 193.0.14.129         # k.root-servers.net 73ms
    #primary: 199.7.83.42          # l.root-servers.net 67ms
    #primary: 192.0.47.132         # iad.xfr.dns.icann.org 67ms

    # IPv6 ? Uncomment if you use IPv6!
    #primary: 2001:503:ba3e::2:30  # a.root-servers.net 16ms
    #primary: 2801:1b8:10::b       # b.root-servers.net 72ms
    #primary: 2001:500:2::c        # c.root-servers.net 15ms
    #primary: 2001:500:2d::d       # d.root-servers.net 18ms
    #primary: 2001:500:a8::e       # e.root-servers.net 17ms
    #primary: 2001:500:2f::f       # f.root-servers.net 14ms
    #primary: 2001:500:12::d0d     # g.root-servers.net 69ms
    #primary: 2001:500:1::53       # h.root-servers.net 21ms
    #primary: 2001:7fe::53         # i.root-servers.net 20ms
    #primary: 2001:503:c27::2:30   # j.root-servers.net 15ms
    #primary: 2001:7fd::1          # k.root-servers.net 75ms
    #primary: 2001:500:9f::42      # l.root-servers.net 71ms
    #primary: 2001:dc3::35         # m.root-servers.net 23ms
    #primary: 2620:0:2d0:202::132  # lax.xfr.dns.icann.org 25ms
    #primary: 2620:0:2830:202::132 # iad.xfr.dns.icann.org 74ms

    fallback-enabled: yes
    for-downstream: no
    for-upstream: yes

    zonemd-check: yes
    zonefile: /etc/unbound/root.zone

cachedb:
    backend: "redis"

    # Redis connection settings
    redis-server-host: 127.0.0.1
    redis-server-port: 6379

    # Optional: Set password if Redis is configured with one
    # redis-server-password: "your_password_here"

    # Timeout for Redis operations (in milliseconds)
    redis-timeout: 100

    # Expire cached entries in Redis after this time (in seconds)
    # This should match or exceed cache-max-ttl
    redis-expire-records: yes

remote-control:
    control-enable: yes
    control-interface: 127.0.0.1
    control-port: 8953

    # These will be auto-generated if they don't exist
    server-key-file: "/etc/unbound/unbound_server.key"
    server-cert-file: "/etc/unbound/unbound_server.pem"
    control-key-file: "/etc/unbound/unbound_control.key"
    control-cert-file: "/etc/unbound/unbound_control.pem"