unbound.conf

server:
  verbosity: 1
  module-config: "validator cachedb iterator"

  statistics-interval: 600
  statistics-cumulative: yes

  # set to 0 to avoid warning message when cachedb module is loaded.
  # warning: cachedb: serve-expired-reply-ttl is set but not working for data originating from the external cache; 0 TLL is used for those.
  serve-expired-reply-ttl: 0

  interface: 0.0.0.0@5053
  do-ip4: yes
  do-ip6: no
  do-udp: yes
  do-tcp: yes

  do-daemonize: no

  access-control: 10.0.0.0/8 allow
  access-control: 127.0.0.0/8 allow
  access-control: 172.16.0.0/12 allow
  access-control: 192.168.0.0/16 allow

  private-address: 10.0.0.0/8
  private-address: 169.254.0.0/16
  private-address: 172.16.0.0/12
  private-address: 192.168.0.0/16

  directory: "/etc/unbound"
  logfile: ""
  pidfile: "/var/run/unbound/unbound.pid"

  identity: "docker-unbound"
  auto-trust-anchor-file: "/var/run/unbound/root.key"
  
  tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt

  include: "/config/*.conf"