YuruC3/kube-manifests
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Unbound depoloyment

Browse Source
This commit is contained in:
YuruC3
2025-12-22 10:23:44 +01:00
parent a92339adcd
commit 2553d21306
4 changed files with 524 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

408
Unbound/Deployment.yaml Normal file
View File

@@ -0,0 +1,408 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: cronjobber-sh-config
labels:
service: unbound-combo
data:
updateBlockList.sh: |
#!/bin/sh
apk add curl > /dev/null
DL_LOCATION=/blocklists
mkdir -p $DL_LOCATION
# LINKS="${LINKS:-https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt
# https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/fake.txt
# https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/tif.txt
# https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/doh-vpn-proxy-bypass.txt
# https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/gambling.txt
# }"
if [ "$(find $DL_LOCATION/ -mmin +240)" ] || ! [ "$( ls -A $DL_LOCATION/ )" ]
then
# Pro
curl -fsSL -o rpz.hagezi.fake.zone --output-dir $DL_LOCATION/ https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt
# Fake
curl -fsSL -o rpz.hagezi.pro.zone --output-dir $DL_LOCATION/ https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/fake.txt
# Tif
curl -fsSL -o rpz.hagezi.tif.zone --output-dir $DL_LOCATION/ https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/tif.txt
# DoH
curl -fsSL -o rpz.hagezi.doh-vpn-proxy-bypass.zone --output-dir $DL_LOCATION/ https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/doh-vpn-proxy-bypass.txt
# Gacha
curl -fsSL -o rpz.hagezi.gambling.zone --output-dir $DL_LOCATION/ https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/gambling.txt
# for i in $LINKS
# do
# curl -fsSL -O --output-dir $DL_LOCATION $i
# done
fi
chown -R 1500:1500 $DL_LOCATION
---
apiVersion: batch/v1
kind: CronJob
metadata:
name: unbound-combo-blocklist-cronjob
labels:
project: unbound-combo
spec:
schedule: "30 */1 * * *"
concurrencyPolicy: Forbid
timeZone: Europe/Stockholm
jobTemplate:
metadata:
labels:
pod-project: unbound-combo-blocklist-cron
project-ns-name: private-srvc
spec:
# selector:
# matchLabels:
# pod-project: unbound-combo-blocklist-cron
template:
spec:
automountServiceAccountToken: false # Container doesn't need service account token
securityContext:
appArmorProfile:
type: RuntimeDefault
# runAsNonRoot: true
fsGroup: 1500
# runAsGroup: 1500
# runAsUser: 1500
restartPolicy: OnFailure
containers:
- name: cronjobber
image: alpine:3.23.2
imagePullPolicy: IfNotPresent
env:
- name: DL_LOCATION
value: /blocklists/
volumeMounts:
- name: cronjobber-blocklists
mountPath: /blocklists
readOnly: false
- name: cronjobber-update-sh
mountPath: /updateBlockList.sh
subPath: updateBlockList.sh
readOnly: true
command: ["/bin/sh", "/updateBlockList.sh"]
volumes:
- name: cronjobber-blocklists
persistentVolumeClaim:
claimName: unbound-combo-blocklist-pvc
readOnly: false
- name: cronjobber-update-sh
configMap:
name: cronjobber-sh-config
---
apiVersion: v1
kind: ConfigMap
metadata:
name: unbound-conf-configmap
labels:
service: unbound-combo
data:
unbound.conf: |
server:
# listen on
interface: 0.0.0.0
port: 53
do-udp: yes
do-tcp: yes
# ACL
# Basicaly allow whole RFC1918
access-control: 10.0.0.0/8 allow
access-control: 172.16.0.0/12 allow
access-control: 192.168.0.0/16 allow
access-control: 127.0.0.0/8 allow
module-config: "respip validator iterator"
do-not-query-localhost: no
# If running IPv6 change these
do-ip6: no
do-ip4: yes
do-udp: yes
do-tcp: yes
# Cache/perf
num-threads: 1
msg-cache-size: 64m
rrset-cache-size: 128m
cache-min-ttl: 0
cache-max-ttl: 86400
prefetch: yes
prefetch-key: yes
outgoing-range: 950
# best practice or something
qname-minimisation: yes
# hide-identity: yes
hide-version: yes
# loggning
verbosity: 1
logfile: ""
log-queries: yes
log-replies: no
# local domains
# example for a local domain with redirect for all subdomains
local-zone: "example.me." redirect
local-data: "int.example.me. 60 IN A 1.2.3.4"
# Forwad to
forward-zone:
name: "."
forward-addr: 127.0.0.1@5053
forward-addr: 127.0.0.1@5052
#forward-addr: 127.0.0.1@5051
rpz:
name: "rpz.hagezi.fake.local."
zonefile: "/zonefiles/rpz.hagezi.fake.zone"
url: "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/fake.txt"
rpz:
name: "rpz.hagezi.pro.local."
zonefile: "/zonefiles/rpz.hagezi.pro.zone"
url: "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt"
rpz:
name: "rpz.hagezi.tif.local."
zonefile: "/zonefiles/rpz.hagezi.tif.zone"
url: "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/tif.txt"
rpz:
name: "rpz.hagezi.doh-vpn-proxy-bypass.local."
zonefile: "/zonefiles/rpz.hagezi.doh-vpn-proxy-bypass.zone"
url: "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/doh-vpn-proxy-bypass.txt"
rpz:
name: "rpz.hagezi.gambling.local."
zonefile: "/zonefiles/rpz.hagezi.gambling.zone"
url: "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/gambling.txt"
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: unbound-combo-deployment
labels:
project: unbound-combo
spec:
replicas: 4
selector:
matchLabels:
pod-project: unbound-combo
# serviceName: pihole-statefulsets-webgui-service
minReadySeconds: 10
template:
metadata:
labels:
pod-project: unbound-combo
project-ns-name: private-srvc
# pod-project: doh
spec:
# terminationGracePeriodSeconds: 10
automountServiceAccountToken: false # Container doesn't need service account token
securityContext:
appArmorProfile:
type: RuntimeDefault
runAsNonRoot: true
fsGroup: 1500
runAsGroup: 1500
runAsUser: 1500
initContainers:
- name: startupper
image: alpine:3.23.2
imagePullPolicy: IfNotPresent
securityContext:
appArmorProfile:
type: RuntimeDefault
runAsNonRoot: false
readOnlyRootFilesystem: false
# fsGroup: 1500
runAsGroup: 0
runAsUser: 0
env:
- name: DL_LOCATION
value: /blocklists/
volumeMounts:
- name: cronjobber-blocklists
mountPath: /blocklists
readOnly: false
- name: cronjobber-update-sh
mountPath: /updateBlockList.sh
subPath: updateBlockList.sh
readOnly: true
command: ["/bin/sh", "/updateBlockList.sh"]
containers:
- name: unbound
image: mvance/unbound:latest
imagePullPolicy: IfNotPresent
# command: ["unbound", "-c", "/etc/unbound.conf"]
securityContext:
appArmorProfile:
type: RuntimeDefault
runAsNonRoot: false
readOnlyRootFilesystem: false
# fsGroup: 1500
runAsGroup: 0
runAsUser: 0
volumeMounts:
- name: cronjobber-blocklists
mountPath: /opt/unbound/etc/unbound/zonefiles
readOnly: false
- name: unbound-config
mountPath: /opt/unbound/etc/unbound/unbound.conf # mount a single key as a file
subPath: unbound.conf
# readOnly: true
ports:
- name: dns-tcp
containerPort: 53
protocol: TCP
- name: dns-udp
containerPort: 53
protocol: UDP
startupProbe:
tcpSocket:
port: 53
# exec:
# command: ["sh","-c","nslookup -timeout=2 google.com 127.0.0.1 >/dev/null"]
initialDelaySeconds: 5
periodSeconds: 5
failureThreshold: 60
livenessProbe:
tcpSocket:
port: 53
# exec:
# command: ["sh","-c","nslookup -timeout=2 google.com 127.0.0.1 >/dev/null"]
periodSeconds: 5
failureThreshold: 4
readinessProbe:
tcpSocket:
port: 53
# exec:
# command: ["sh","-c","nslookup -timeout=2 google.com 127.0.0.1 >/dev/null"]
periodSeconds: 10
failureThreshold: 6
resources:
requests:
memory: "256Mi"
cpu: "200m"
limits:
memory: "1536Mi"
# cpu: "550m"
# https://github.com/eko/pihole-exporter
# https://github.com/letsencrypt/unbound_exporter
# - name: prom-exporter?
# image: ekofr/pihole-exporter:v1.2.0
# imagePullPolicy: IfNotPresent
# ports:
# - name: prom-export
# containerPort: 50934
# protocol: TCP
- name: cloudflare-1-1-1-1
image: visibilityspots/cloudflared:v2025.7.0
imagePullPolicy: IfNotPresent
ports:
- name: doh-unseiso-udp
containerPort: 5051
protocol: UDP
- name: doh-unseiso-tcp
containerPort: 5051
protocol: TCP
env:
- name: PORT
value: "5051"
- name: UPSTREAM1
value: https://1.1.1.1/dns-query
- name: UPSTREAM2
value: https://1.0.0.1/dns-query
- name: METRICS
value: "127.0.0.1:8081"
resources:
requests:
memory: "48Mi"
cpu: "100m"
- name: cloudflare-1-1-1-2
image: visibilityspots/cloudflared:v2025.7.0
imagePullPolicy: IfNotPresent
ports:
- name: doh-nov-tcp
containerPort: 5052
protocol: TCP
- name: doh-nov-udp
containerPort: 5052
protocol: UDP
env:
- name: PORT
value: "5052"
- name: UPSTREAM1
value: https://1.1.1.2/dns-query
- name: UPSTREAM2
value: https://1.0.0.2/dns-query
- name: METRICS
value: "127.0.0.1:8082"
resources:
requests:
memory: "48Mi"
cpu: "100m"
- name: cloudflare-1-1-1-3
image: visibilityspots/cloudflared:v2025.7.0
imagePullPolicy: IfNotPresent
ports:
- name: doh-unseiso-udp
containerPort: 5053
protocol: UDP
- name: doh-unseiso-tcp
containerPort: 5053
protocol: TCP
env:
- name: PORT
value: "5053"
- name: UPSTREAM1
value: https://1.1.1.3/dns-query
- name: UPSTREAM2
value: https://1.0.0.3/dns-query
- name: METRICS
value: "127.0.0.1:8083"
resources:
requests:
memory: "48Mi"
cpu: "100m"
volumes:
- name: cronjobber-blocklists
persistentVolumeClaim:
claimName: unbound-combo-blocklist-pvc
- name: cronjobber-update-sh
configMap:
name: cronjobber-sh-config
- name: unbound-config
configMap:
name: unbound-conf-configmap