initial commit

docker-compose.yml

@@ -0,0 +1,46 @@
+version: '3'
+ 
+networks:
+  dns_net:
+    driver: bridge
+    ipam:
+        config:
+        - subnet: 172.20.0.0/16
+ 
+services:
+  pihole:
+    container_name: pihole
+    hostname: pihole
+    image: pihole/pihole:latest
+    networks:
+      dns_net:
+        ipv4_address: 172.20.0.6
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+      - "80:80/tcp"
+      #- "443:443/tcp"
+    environment:
+      TZ: "America/New_York"
+      WEBPASSWORD: "password"
+      DNS1: "172.20.0.7#5053"
+      DNS2: "no"
+    volumes:
+      - "$PWD/etc-pihole/:/etc/pihole/"
+      - "$PWD/etc-dnsmasq.d/:/etc/dnsmasq.d/"
+    restart: always
+
+  unbound:
+    container_name: unbound
+    image: mvance/unbound:latest
+    networks:
+      dns_net:
+        ipv4_address: 172.20.0.7
+    volumes:
+      - $PWD/unbound/unbound.conf:/opt/unbound/etc/unbound/unbound.conf
+    #ports:
+     # - "5053:5053/tcp"
+     # - "5053:5053/udp"
+    healthcheck:
+      disable: true
+    restart: always

unbound/unbound.conf

@@ -0,0 +1,64 @@
+server:
+# If no logfile is specified, syslog is used
+# logfile: /var/log/unbound/unbound.log
+verbosity: 0
+ 
+access-control: 172.16.0.0/12 allow
+access-control: 127.0.0.0/8 allow
+access-control: 10.0.0.0/8 allow
+access-control: 192.168.0.0/16 allow
+interface: 0.0.0.0
+port: 5053
+do-ip4: yes
+do-udp: yes
+do-tcp: yes
+ 
+# May be set to yes if you have IPv6 connectivity
+do-ip6: no
+ 
+# You want to leave this to no unless you have *native* IPv6. With 6to4 and
+# Terredo tunnels your web browser should favor IPv4 for the same reasons
+prefer-ip6: no
+ 
+# Use this only when you downloaded the list of primary root servers!
+# If you use the default dns-root-data package, unbound will find it automatically
+# I have to quote out this root-hints, as it causing container endless restarting for a new installation. You can add root-hints back after first run. 
+#root-hints: “/opt/unbound/etc/unbound/root.hints”
+ 
+# Trust glue only if it is within the server's authority
+harden-glue: yes
+ 
+# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
+harden-dnssec-stripped: yes
+ 
+# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
+# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
+use-caps-for-id: no
+ 
+# Reduce EDNS reassembly buffer size.
+# Suggested by the unbound man page to reduce fragmentation reassembly problems
+edns-buffer-size: 1472
+ 
+# Perform prefetching of close to expired message cache entries
+# This only applies to domains that have been frequently queried
+prefetch: yes
+ 
+# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
+num-threads: 1
+ 
+# Ensure kernel buffer is large enough to not lose messages in traffic spikes
+so-rcvbuf: 1m
+ 
+# Ensure privacy of local IP ranges
+private-address: 192.168.0.0/16
+private-address: 169.254.0.0/16
+private-address: 172.16.0.0/12
+private-address: 10.0.0.0/8
+private-address: fd00::/8
+private-address: fe80::/10
+
+forward-zone:
+	name: "."
+	forward-addr: 1.1.1.1
+	forward-addr: 1.0.0.1
+	forward-addr: 9.9.9.9