diff --git a/doc/example.conf.in b/doc/example.conf.in index 5396029..cbb51ec 100644 --- a/doc/example.conf.in +++ b/doc/example.conf.in @@ -1,9 +1,10 @@ -# -# Example configuration file. -# -# See unbound.conf(5) man page, version 1.6.4. -# -# this is a comment. +############################################################################## +# MEMORY CONTROL EXAMPLE +# In the example config settings below memory usage is reduced. Some ser- +# vice levels are lower, notable very large data and a high TCP load are +# no longer supported ... are exceptional for the DNS. +# (http://unbound.net/documentation/unbound.conf.html) +############################################################################## #Use this to include other text into the file. #include: "otherfile.conf" @@ -12,9 +13,71 @@ server: # whitespace is not necessary, but looks cleaner. - # verbosity number, 0 is least verbose. 1 is default. + # verbosity 1 is default verbosity: 1 + # Self jail Unbound with user "unbound" to /var/lib/unbound + # The script /etc/init.d/unbound will setup the location + username: "unbound" + directory: "/var/lib/unbound" + chroot: "/var/lib/unbound" + + # The pid file is created before privleges drop so no concern + pidfile: "/var/run/unbound.pid" + + # no threads and no memory slabs for threads + num-threads: 1 + msg-cache-slabs: 1 + rrset-cache-slabs: 1 + infra-cache-slabs: 1 + key-cache-slabs: 1 + + # don't be picky about interfaces but consider your firewall + interface: 0.0.0.0 + interface: ::0 + access-control: 0.0.0.0/0 allow + access-control: ::0/0 allow + + # this limits TCP service but uses less buffers + outgoing-num-tcp: 1 + incoming-num-tcp: 1 + + # use somewhat higher port numbers versus possible NAT issue + outgoing-port-permit: "10240-65335" + + # uses less memory but less performance + outgoing-range: 60 + num-queries-per-thread: 30 + + # exclude large responses + msg-buffer-size: 8192 + + # tiny memory cache + infra-cache-numhosts: 200 + msg-cache-size: 100k + rrset-cache-size: 100k + key-cache-size: 100k + neg-cache-size: 10k + + # gentle on recursion + target-fetch-policy: "2 1 0 0 0 0" + harden-large-queries: yes + harden-short-bufsize: yes + + # DNSSEC enable by removing comments on "module-config:" and "auto-trust- + # -anchor-file:" The init script will copy root key to /var/lib/unbound. + # See package documentation for crontab entry to copy RFC5011 results back. + #module-config: "validator iterator" + #auto-trust-anchor-file: "/var/lib/unbound/root.key" + + # DNSSEC needs real time to validate signatures. If your device does not + # have power off clock (reboot), then you may need this work around. + #domain-insecure: "pool.ntp.org" + +############################################################################## +# Resume Stock example.conf.in +############################################################################## + # print statistics to the log (for every thread) every N seconds. # Set to "" or 0 to disable. Default is disabled. # statistics-interval: 0