Skip to content

Commit a39fa2f

Browse files
johannt-spjohannt-sp
committed
feat: add unbound 1.24.2
1 parent af15165 commit a39fa2f

6 files changed

Lines changed: 629 additions & 122 deletions

File tree

‎1.24.2/Dockerfile‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
FROM debian:trixie AS openssl
2+
LABEL maintainer="Securepoint GmbH"
3+
4+
ENV VERSION_OPENSSL=openssl-3.6.0 \
5+
SHA256_OPENSSL=b6a5f44b7eb69e3fa35dbf15524405b44837a481d43d81daddde3ff21fcbb8e9 \
6+
SOURCE_OPENSSL=https://www.openssl.org/source/ \
7+
# OpenSSL OMC
8+
OPGP_OPENSSL_1=EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5 \
9+
# Richard Levitte
10+
OPGP_OPENSSL_2=7953AC1FBC3DC8B3B292393ED5E9E43F7DF9EE8C \
11+
# Matt Caswell
12+
OPGP_OPENSSL_3=8657ABB260F056B1E5190839D9C4D26D0E604491 \
13+
# Paul Dale
14+
OPGP_OPENSSL_4=B7C1C14360F353A36862E4D5231C84CDDCC69C45 \
15+
# Tomas Mraz
16+
OPGP_OPENSSL_5=A21FAB74B0088AA361152586B8EF1A6BA9DA2D5C \
17+
# Tim Hudson
18+
OPGP_OPENSSL_6=C1F33DD8CE1D4CC613AF14DA9195C48241FBF7DD \
19+
# Kurt Roeckx
20+
OPGP_OPENSSL_7=E5E52560DD91C556DDBDA5D02064C53641C25E5D \
21+
# OpenSSL
22+
OPGP_OPENSSL_8=BA5473A2B0587B07FB27CF2D216094DFD0CB81EF
23+
24+
WORKDIR /tmp/src
25+
26+
RUN set -e -x && \
27+
build_deps="build-essential ca-certificates curl dirmngr gnupg libidn2-0-dev libssl-dev" && \
28+
DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y --no-install-recommends \
29+
$build_deps && \
30+
curl -L $SOURCE_OPENSSL$VERSION_OPENSSL.tar.gz -o openssl.tar.gz && \
31+
echo "${SHA256_OPENSSL} ./openssl.tar.gz" | sha256sum -c - && \
32+
curl -L $SOURCE_OPENSSL$VERSION_OPENSSL.tar.gz.asc -o openssl.tar.gz.asc && \
33+
GNUPGHOME="$(mktemp -d)" && \
34+
export GNUPGHOME && \
35+
gpg --no-tty --keyserver keyserver.ubuntu.com --recv-keys "$OPGP_OPENSSL_1" "$OPGP_OPENSSL_2" "$OPGP_OPENSSL_3" "$OPGP_OPENSSL_4" "$OPGP_OPENSSL_5" "$OPGP_OPENSSL_6" "$OPGP_OPENSSL_7" "$OPGP_OPENSSL_8" && \
36+
gpg --batch --verify openssl.tar.gz.asc openssl.tar.gz && \
37+
tar xzf openssl.tar.gz && \
38+
cd $VERSION_OPENSSL && \
39+
./config \
40+
--prefix=/opt/openssl \
41+
--openssldir=/opt/openssl \
42+
no-weak-ssl-ciphers \
43+
no-ssl3 \
44+
no-shared \
45+
enable-ec_nistp_64_gcc_128 \
46+
-DOPENSSL_NO_HEARTBEATS \
47+
-fstack-protector-strong && \
48+
make depend && \
49+
nproc | xargs -I % make -j% && \
50+
make install_sw && \
51+
apt-get purge -y --auto-remove \
52+
$build_deps && \
53+
rm -rf \
54+
/tmp/* \
55+
/var/tmp/* \
56+
/var/lib/apt/lists/*
57+
58+
FROM debian:trixie AS unbound
59+
LABEL maintainer="Securepoint GmbH"
60+
61+
ENV NAME=unbound \
62+
UNBOUND_VERSION=1.24.2 \
63+
UNBOUND_SHA256=44e7b53e008a6dcaec03032769a212b46ab5c23c105284aa05a4f3af78e59cdb \
64+
UNBOUND_DOWNLOAD_URL=https://nlnetlabs.nl/downloads/unbound/unbound-1.24.2.tar.gz
65+
66+
WORKDIR /tmp/src
67+
68+
COPY --from=openssl /opt/openssl /opt/openssl
69+
70+
RUN build_deps="curl gcc libc-dev libevent-dev libexpat1-dev libnghttp2-dev make" && \
71+
set -x && \
72+
DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y --no-install-recommends \
73+
$build_deps \
74+
bsdmainutils \
75+
ca-certificates \
76+
ldnsutils \
77+
libevent-2.1-7 \
78+
libhiredis-dev \
79+
libexpat1 \
80+
libprotobuf-c-dev \
81+
protobuf-c-compiler && \
82+
curl -sSL $UNBOUND_DOWNLOAD_URL -o unbound.tar.gz && \
83+
echo "${UNBOUND_SHA256} *unbound.tar.gz" | sha256sum -c - && \
84+
tar xzf unbound.tar.gz && \
85+
rm -f unbound.tar.gz && \
86+
cd unbound-1.24.2 && \
87+
groupadd _unbound && \
88+
useradd -g _unbound -s /dev/null -d /etc _unbound && \
89+
./configure \
90+
--disable-dependency-tracking \
91+
--prefix=/opt/unbound \
92+
--with-pthreads \
93+
--with-username=_unbound \
94+
--with-ssl=/opt/openssl \
95+
--with-libevent \
96+
--with-libhiredis \
97+
--with-libnghttp2 \
98+
--enable-dnstap \
99+
--enable-tfo-server \
100+
--enable-cachedb \
101+
--enable-tfo-client \
102+
--enable-event-api \
103+
--enable-subnet && \
104+
make install && \
105+
mv /opt/unbound/etc/unbound/unbound.conf /opt/unbound/etc/unbound/unbound.conf.example && \
106+
apt-get purge -y --auto-remove \
107+
$build_deps && \
108+
rm -rf \
109+
/opt/unbound/share/man \
110+
/tmp/* \
111+
/var/tmp/* \
112+
/var/lib/apt/lists/*
113+
114+
115+
FROM debian:trixie
116+
LABEL maintainer="Securepoint GmbH"
117+
118+
ENV NAME=unbound \
119+
SUMMARY="${NAME} is a validating, recursive, and caching DNS resolver." \
120+
DESCRIPTION="${NAME} is a validating, recursive, and caching DNS resolver."
121+
122+
WORKDIR /tmp/src
123+
124+
COPY --from=unbound /opt /opt
125+
126+
RUN set -x && \
127+
DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y --no-install-recommends \
128+
bsdmainutils \
129+
ca-certificates \
130+
ldnsutils \
131+
libevent-2.1-7 \
132+
libhiredis1.1.0 \
133+
libnghttp2-14 \
134+
libexpat1 \
135+
libprotobuf-c1 && \
136+
groupadd _unbound && \
137+
useradd -g _unbound -s /dev/null -d /etc _unbound && \
138+
apt-get purge -y --auto-remove \
139+
$build_deps && \
140+
rm -rf \
141+
/opt/unbound/share/man \
142+
/tmp/* \
143+
/var/tmp/* \
144+
/var/lib/apt/lists/*
145+
146+
COPY data/ /
147+
148+
RUN chmod +x /unbound.sh
149+
150+
WORKDIR /opt/unbound/
151+
152+
ENV PATH /opt/unbound/sbin:"$PATH"
153+
154+
LABEL org.opencontainers.image.version=${UNBOUND_VERSION} \
155+
org.opencontainers.image.title="securepoint/unbound-docker" \
156+
org.opencontainers.image.description="a validating, recursive, and caching DNS resolver" \
157+
org.opencontainers.image.url="https://github.com/Securepoint/unbound-docker" \
158+
org.opencontainers.image.vendor="Securepoint GmbH" \
159+
org.opencontainers.image.licenses="MIT" \
160+
org.opencontainers.image.source="https://github.com/Securepoint/unbound-docker"
161+
162+
EXPOSE 53/tcp
163+
EXPOSE 53/udp
164+
165+
HEALTHCHECK --interval=30s --timeout=30s --start-period=10s --retries=3 CMD drill @127.0.0.1 cloudflare.com || exit 1
166+
167+
CMD ["/unbound.sh"]

‎1.24.2/data/opt/unbound/etc/unbound/a-records.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# A Record
2+
#local-data: "somecomputer.local. A 192.168.1.1"
3+
4+
# PTR Record
5+
#local-data-ptr: "192.168.1.1 somecomputer.local."

‎1.24.2/data/opt/unbound/etc/unbound/forward-records.conf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
forward-zone:
2+
# Forward all queries (except those in cache and local zone) to
3+
# upstream recursive servers
4+
name: "."
5+
# Queries to this forward zone use TLS
6+
forward-tls-upstream: yes
7+
8+
# https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers
9+
10+
## Cloudflare
11+
forward-addr: 1.1.1.1@853#cloudflare-dns.com
12+
forward-addr: 1.0.0.1@853#cloudflare-dns.com
13+
#forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
14+
#forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com
15+
16+
## Cloudflare Malware
17+
# forward-addr: 1.1.1.2@853#security.cloudflare-dns.com
18+
# forward-addr: 1.0.0.2@853#security.cloudflare-dns.com
19+
# forward-addr: 2606:4700:4700::1112@853#security.cloudflare-dns.com
20+
# forward-addr: 2606:4700:4700::1002@853#security.cloudflare-dns.com
21+
22+
## Cloudflare Malware and Adult Content
23+
# forward-addr: 1.1.1.3@853#family.cloudflare-dns.com
24+
# forward-addr: 1.0.0.3@853#family.cloudflare-dns.com
25+
# forward-addr: 2606:4700:4700::1113@853#family.cloudflare-dns.com
26+
# forward-addr: 2606:4700:4700::1003@853#family.cloudflare-dns.com
27+
28+
## CleanBrowsing Security Filter
29+
# forward-addr: 185.228.168.9@853#security-filter-dns.cleanbrowsing.org
30+
# forward-addr: 185.228.169.9@853#security-filter-dns.cleanbrowsing.org
31+
# forward-addr: 2a0d:2a00:1::2@853#security-filter-dns.cleanbrowsing.org
32+
# forward-addr: 2a0d:2a00:2::2@853#security-filter-dns.cleanbrowsing.org
33+
34+
## CleanBrowsing Adult Filter
35+
# forward-addr: 185.228.168.10@853#adult-filter-dns.cleanbrowsing.org
36+
# forward-addr: 185.228.169.11@853#adult-filter-dns.cleanbrowsing.org
37+
# forward-addr: 2a0d:2a00:1::1@853#adult-filter-dns.cleanbrowsing.org
38+
# forward-addr: 2a0d:2a00:2::1@853#adult-filter-dns.cleanbrowsing.org
39+
40+
## CleanBrowsing Family Filter
41+
# forward-addr: 185.228.168.168@853#family-filter-dns.cleanbrowsing.org
42+
# forward-addr: 185.228.169.168@853#family-filter-dns.cleanbrowsing.org
43+
# forward-addr: 2a0d:2a00:1::@853#family-filter-dns.cleanbrowsing.org
44+
# forward-addr: 2a0d:2a00:2::@853#family-filter-dns.cleanbrowsing.org
45+
46+
## Quad9
47+
# forward-addr: 9.9.9.9@853#dns.quad9.net
48+
# forward-addr: 149.112.112.112@853#dns.quad9.net
49+
# forward-addr: 2620:fe::fe@853#dns.quad9.net
50+
# forward-addr: 2620:fe::9@853#dns.quad9.net
51+
52+
## getdnsapi.net
53+
# forward-addr: 185.49.141.37@853#getdnsapi.net
54+
# forward-addr: 2a04:b900:0:100::37@853#getdnsapi.net

‎1.24.2/data/opt/unbound/etc/unbound/srv-records.conf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# SRV records
2+
# _service._proto.name. | TTL | class | SRV | priority | weight | port | target.

0 commit comments

Comments
 (0)