Unbound for server installs

Signed-off-by: Tommy <contact@tommytran.io>

etc/unbound/unbound.conf

@@ -0,0 +1,34 @@
+server:
+  trust-anchor-file: "/etc/unbound/trusted-key.key"
+  root-key-sentinel: yes
+  tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
+
+  hide-http-user-agent: yes
+  hide-identity: yes
+  hide-trustanchor: yes
+  hide-version: yes
+
+  deny-any: yes
+  harden-algo-downgrade: yes
+  harden-large-queries: yes
+  harden-referral-path: yes
+  harden-short-bufsize: yes
+  ignore-cd-flag: yes
+  max-udp-size: 3072
+  module-config: "validator iterator"
+  qname-minimisation-strict: yes
+  unwanted-reply-threshold: 10000000
+  use-caps-for-id: yes
+
+  outgoing-port-permit: 1024-65535
+
+  prefetch: yes
+  prefetch-key: yes
+
+forward-zone:
+  name: "."
+  forward-tls-upstream: yes
+  forward-addr: 1.1.1.2@853#security.cloudflare-dns.com
+  forward-addr: 1.0.0.2@853#security.cloudflare-dns.com
+  forward-addr: 2606:4700:4700::1112@853#security.cloudflare-dns.com
+  forward-addr: 2606:4700:4700::1002@853#security.cloudflare-dns.com

install.sh

@@ -344,7 +344,7 @@ fi
 if [ "${install_mode}" = 'desktop' ]; then
     pacstrap /mnt nautilus gdm gnome-console gnome-control-center flatpak pipewire-alsa pipewire-pulse pipewire-jack
 elif [ "${install_mode}" = 'server' ]; then
-    pacstrap /mnt openssh
+    pacstrap /mnt openssh unbound
 fi
 
 if [ "${virtualization}" = 'none' ]; then
@@ -490,6 +490,12 @@ fi
 ## ZRAM configuration
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/zram-generator.conf | tee /mnt/etc/systemd/zram-generator.conf
 
+## Setup unbound
+
+if [ "${install_mode}" = 'server' ]; then
+    unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/unbound/unbound.conf | tee /mnt/etc/unbound/unbound.conf
+fi
+
 ## Setup Networking
 
 if [ "${install_mode}" = 'desktop' ]; then
@@ -568,7 +574,6 @@ systemctl enable reflector.timer --root=/mnt
 systemctl enable snapper-timeline.timer --root=/mnt
 systemctl enable snapper-cleanup.timer --root=/mnt
 systemctl enable systemd-oomd --root=/mnt
-systemctl enable systemd-resolved --root=/mnt
 systemctl disable systemd-timesyncd --root=/mnt
 
 if [ "${network_daemon}" = 'networkmanager' ]; then
@@ -579,10 +584,12 @@ fi
 
 if [ "${install_mode}" = 'desktop' ]; then
     systemctl enable gdm --root=/mnt
+    systemctl enable systemd-resolved --root=/mnt
 fi
 
 if [ "${install_mode}" = 'server' ]; then
     systemctl enable sshd.socket --root=/mnt
+    systemctl enable unbound --root=/mnt
 fi
 
 ## Set umask to 077.