unbound is started with the wrong conf file

[Tankdoz]

unbound should be started with the /etc/unbound/unbound.conf file which tells unbound (include-toplevel: "/etc/unbound/unbound.conf.d/*.conf") to combine all .conf files in /etc/unbound/unbound.conf.d. (pi-hole.conf, remote-control.conf and root-auto-trust-anchor-file.conf) In the current setup unbound is started only with pi-hole.conf, so will for example not be able to do DNSSEC which is set in root-auto-trust-anchor-file.conf

[FlavioB79]

Hi
Newbie and I came here to ask about DNSSEC not being verified (I'm following the instructions found here)
Probably I'm hitting the same issue as @Tankdoz ?

[Tankdoz]

It took me a long time to repair the image enough to get it working. To be honest in its current state you might be better off building a stack with two separate containers, one for pihole and one for unbound. I took the klutchell image for unbound which is in a much better state.
The core problem with dnssec in this image is that the file that contains the settings for dnssec is not being read. As a workaround you could add the required lines to the one conf file that is being read: pi-hole.conf in the /etc/unbound/unbound.conf.d directory

[FlavioB79]

Thanks for your reply.
Does it really make sense to have 2 different containers running? Ain't that too much resource wasting?
Anyway: if I'd be choosing to go that route, would you recommend to use the pihole image from the original pi-hole/pi-hole source?
And what about unbound's source?

TBH: I'd of course prefer it this mpgirro/docker-pihole-unbound would be fixed accordingly... is this project still active at all? I didn't verify...

[Tankdoz]

Originally the idea of having unbound and pihole in one container seemed attractive to me too. However after trying some combined images that were not working (anymore) and diving into the details I gained a bit more understanding of the complexities of combining two different pieces of software with different release schedules, different developers and different distribution methods into one container. It requires the image to be well maintained in order to keep the two working together seamlessly. Currently I choose to use two well maintained images and make them talk to each other using a robust compose file. The pihole/pihole image is very easy to deploy and well documented, the klutchell image for unbound has the advantage of being distroless (very small footprint), uses the latest version of unbound, can be configured with additional .conf files in the way the unbound developers intend (for example DNSSEC, remote control,statistics) and can easily be combined with Redis as well. Happy to share my compose.yaml, directory structure and .conf files in case you're interested.

[FlavioB79]

Hi @Tankdoz and thanks for your offer. I will probably decommission the pihole-unbound docker ASAP and start fresh with the original pihole/pihole image to get at least this part running (without unbound).
Afterwards I'd be trying to add unbound as you suggested.
I'll be happy to get your config files - I think they might help for sure! Let me know how/where we want to exchange those files. I think there's no direct way of contacting you through github, right?!

[Tankdoz]

I’m uploading my docker compose and conffiles soon under the PUREstack project (pihole,unbound,redis,exporters), then you can have a look at them and incorporate what you need iin your build.

[FlavioB79]

I’m uploading my docker compose and conffiles soon under the PUREstack project (pihole,unbound,redis,exporters), then you can have a look at them and incorporate what you need iin your build.

Thanks - just let me know when done and I'll take a look.

[Tankdoz]

have a look at https://github.com/Virgil-TD/PUREstack

[FlavioB79]

have a look at https://github.com/Virgil-TD/PUREstack

Should I find this as a docker? On my Synology NAS it doesn't show up:

[Tankdoz]

I'm sorry but I don't know how to deploy on Synology

[FlavioB79]

I'm sorry but I don't know how to deploy on Synology

Maybe that's irrelevant... is the purestack you're offering one single docker container, which can be launched and contains all the software (pihole, unbound, etc.)?

[Tankdoz]

Purestack is a stack of 5 containers, you might be able to recreate that on your synology. The hardest part was setting the permissions and finding the right conffiles, but you can reuse what I found. For just Pihole and unbound you can skip 3 containers. Redis is an in memory database but mostly for fun because I don’t think I will get a real benefit from it given the low number of queries I do. Unbound exporter is for exporting unbound metrics and promtail is for exporting info from unbound logfiles. With that information you can build a nice dashboard like ar51an has done. So if you dont want a dashboard just take those containers out of the compose.yaml. Oh and loose just delete the conffiles that you dont need in unbound.conf.d. (Keep the trust-anchore one because that is for dnssec)