Why not permit systemd-resolved to act as the local resolver along with resolved.conf? You can use Unbound listening on whatever is free on (ipv4)127.0.0.0/8 and (ipv6)[:1]:9953 (or any other free port), and configure resolved.conf to use that local address as the "upstream" DNS= option.
You're probably going to still need Unbound to talk to an encrypted DNS server on the Internet (DoH or DoT), or else your ISP will be capable of intercepting and manipulating your queries.
https://www.freedesktop.org/software/systemd/man/systemd-res...
https://www.freedesktop.org/software/systemd/man/resolved.co...
Re:Wikimedia DNS
by 0cf8612b2e1e on Wednesday September 06, 2023 @10:18PM
(#37413940)
That feels like a brilliant strategy. Theoretically only ever requiring a one line configuration change if I ever need to reverse it.
It would be a lot better if systemd would play nicely, but this is pretty minimal jank.
You can make /etc/resolv.conf immutable using chattr +i and then nothing can mess with your DNS. Of course if your apps aren't using /etc/resolv.conf and going direct to systemd-resolved then you'll have to deal with that instead of unbound/kresd/etc.
Re:Wikimedia DNS
by 0cf8612b2e1e on Wednesday September 06, 2023 @10:02PM
(#37413835)
See, that feels like bandaging over the problem. A solution that is probably fine, until it is not.
If there was a bulletproof, straightforward way to run it, I am there (not Nix). I probably gave up too early, but my initial attempts with Unbound broke all internet access until I was able to reverse my configuration.