infra/tofu/flatcar-resolver2.bu

variant: flatcar
version: 1.1.0

passwd:
  users:
    - name: core
      ssh_authorized_keys:
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLyVSEEAEbGZZqwPwEup0XrlTpu3x3iF9ExvvQPA4xN
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOzrDMNn3nINGdIogzRxY05fkn05LSYi98BGW1Bz5yXD
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIER/8suIKcrT3a/NZHjvOpRosPC5uX4kcznIJHt/98qj
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEEKtgXwoW8HZGqC+KJok9iNpI/lK4glvoryL4Ng/AL+
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFghGMnDdkfNC6JPEhMxrKhYDmNcXjHXp/y/mf3uLtzb

storage:
  files:
    - path: /etc/hostname
      mode: 0644
      overwrite: true
      contents:
        inline: flatcar-resolver2
    - path: /etc/resolv.conf
      mode: 0644
      overwrite: true
      contents:
        inline: |
          nameserver 1.1.1.1
          nameserver 9.9.9.9
    - path: /etc/systemd/resolved.conf.d/no-stub.conf
      mode: 0644
      contents:
        inline: |
          [Resolve]
          DNSStubListener=no
    - path: /etc/systemd/network/00-eth0.network
      mode: 0644
      contents:
        inline: |
          [Match]
          Name=eth0

          IPv6AcceptRA=yes

          [Network]
          Address=204.110.191.250/26
          Gateway=204.110.191.254
          DNS=1.1.1.1
          DNS=9.9.9.9

          [Address]
          Address=2606:1c80::250/64
    - path: /etc/unbound/unbound.conf
      mode: 0644
      contents:
        local: unbound.conf
    - path: /etc/unbound/blocklist.rpz
      mode: 0644
      contents:
        local: blocklist.rpz
    - path: /etc/caddy/Caddyfile
      mode: 0644
      contents:
        inline: |
          {
              admin off
              persist_config off
          }

          resolver2.vntx.net {
              @allowed remote_ip 127.0.0.0/8 204.110.188.0/22 10.0.0.0/8 172.1.0.0/15 100.64.0.0/10 192.168.0.0/16 ::1 2606:1c80::/32

              handle /dns-query {
                  handle @allowed {
                      reverse_proxy 127.0.0.1:8080 {
                          transport http {
                              versions h2c 2
                          }
                      }
                  }
                  respond "Forbidden" 403
              }

              handle {
                  respond "DNS-over-HTTPS endpoint: /dns-query" 200
              }

              log {
                  output file /var/log/caddy/resolver2.log
                  format json
              }
          }
    - path: /etc/telegraf/telegraf.conf
      mode: 0644
      contents:
        inline: |
          [agent]
            interval = "30s"

          [[inputs.exec]]
            commands = ["/etc/telegraf/unbound-stats.sh"]
            data_format = "influx"
            timeout = "10s"

          [[outputs.prometheus_client]]
            listen = ":9273"
            metric_version = 2
            path = "/metrics"
            expiration_interval = "60s"
    - path: /etc/telegraf/unbound-stats.sh
      mode: 0755
      contents:
        inline: |
          #!/bin/sh
          OUT=$(/usr/bin/docker exec unbound /opt/unbound/sbin/unbound-control stats_noreset 2>/dev/null)
          [ $? -ne 0 ] && exit 1
          echo "$OUT" | while IFS="=" read -r k v; do
            [ -z "$k" ] && continue
            case "$k" in histogram.*) continue ;; esac
            m=$(echo "$k" | tr "." "_" | tr "-" "_")
            case "$v" in
              *.*) echo "unbound $${m}=$v" ;;
              *)   echo "unbound $${m}=$${v}i" ;;
            esac
          done

systemd:
  units:
    - name: docker.service
      enabled: true
    - name: unbound.service
      enabled: true
      contents: |
        [Unit]
        Description=Unbound DNS Resolver
        After=docker.service network-online.target
        Requires=docker.service
        Wants=network-online.target

        [Service]
        ExecStartPre=-/usr/bin/docker stop unbound
        ExecStartPre=-/usr/bin/docker rm unbound
        ExecStartPre=/usr/bin/docker pull mvance/unbound:latest
        ExecStart=/usr/bin/docker run \
          --name unbound \
          --network host \
          -v /etc/unbound:/opt/unbound/etc/unbound:ro \
          mvance/unbound:latest
        ExecStop=/usr/bin/docker stop unbound
        ExecStopPost=-/usr/bin/docker rm unbound
        Restart=always
        RestartSec=10

        [Install]
        WantedBy=multi-user.target
    - name: telegraf.service
      enabled: true
      contents: |
        [Unit]
        Description=Telegraf Metrics Collector
        After=docker.service network-online.target unbound.service
        Requires=docker.service
        BindsTo=unbound.service

        [Service]
        ExecStartPre=-/usr/bin/docker stop telegraf
        ExecStartPre=-/usr/bin/docker rm telegraf
        ExecStartPre=/usr/bin/docker pull telegraf:latest
        ExecStart=/usr/bin/docker run \
          --name telegraf \
          --entrypoint /usr/bin/telegraf \
          --user 0:0 \
          --network host \
          -v /var/run/docker.sock:/var/run/docker.sock:ro \
          -v /usr/bin/docker:/usr/bin/docker:ro \
          -v /etc/telegraf:/etc/telegraf:ro \
          telegraf:latest --config /etc/telegraf/telegraf.conf
        ExecStop=/usr/bin/docker stop telegraf
        ExecStopPost=-/usr/bin/docker rm telegraf
        Restart=always
        RestartSec=10

        [Install]
        WantedBy=multi-user.target
    - name: caddy.service
      enabled: true
      contents: |
        [Unit]
        Description=Caddy Web Server (DoH)
        After=docker.service network-online.target unbound.service
        Requires=docker.service
        Wants=network-online.target

        [Service]
        ExecStartPre=-/usr/bin/docker stop caddy
        ExecStartPre=-/usr/bin/docker rm caddy
        ExecStartPre=/usr/bin/docker pull caddy:latest
        ExecStartPre=-/usr/bin/mkdir -p /var/lib/caddy /var/log/caddy
        ExecStart=/usr/bin/docker run \
          --name caddy \
          --network host \
          -v /etc/caddy/Caddyfile:/etc/caddy/Caddyfile:ro \
          -v /var/lib/caddy:/data \
          -v /var/log/caddy:/var/log/caddy \
          caddy:latest /usr/bin/caddy run --config /etc/caddy/Caddyfile
        ExecStop=/usr/bin/docker stop caddy
        ExecStopPost=-/usr/bin/docker rm caddy
        Restart=always
        RestartSec=10

        [Install]
        WantedBy=multi-user.target