fix: resolve tls issue

4 files changed, 8 insertions, 7 deletions

diff --git a/src/unbound-adblock/Dockerfile b/src/unbound-adblock/Dockerfile
index 849feb3..f55d7df 100644
--- a/src/unbound-adblock/Dockerfile
+++ b/src/unbound-adblock/Dockerfile
@@ -1,9 +1,8 @@
-ARG BASE_VER=latest                           
-FROM public.ecr.aws/x2w2w0z4/base:${BASE_VER} 
+ARG BASE_VER=latest
+FROM public.ecr.aws/x2w2w0z4/base:${BASE_VER}
 
 RUN install_deb unbound unbound-anchor
 COPY bin/entrypoint.sh /usr/bin/entrypoint.sh
-COPY etc/unbound.base.conf /etc/unbound/unbound.conf.d/unbound.base.conf
-COPY etc/zones/ /etc/unbound/unbound.conf.d/
+COPY etc/*.conf /etc/unbound/unbound.conf.d/
 
 ENTRYPOINT ["/usr/bin/entrypoint.sh"]
diff --git a/src/unbound-adblock/bin/entrypoint.sh b/src/unbound-adblock/bin/entrypoint.sh
index c2577fb..d5f344d 100755
--- a/src/unbound-adblock/bin/entrypoint.sh
+++ b/src/unbound-adblock/bin/entrypoint.sh
@@ -26,4 +26,4 @@ fi
 
 # Start unbound in debug mode
 log "Starting unbound daemon..."
-exec /usr/sbin/unbound -d -p $DOPTS
+exec /usr/sbin/unbound -d -p $DOPTS "$@"
diff --git a/src/unbound-adblock/etc/zones/ad-zones.conf b/src/unbound-adblock/etc/ad-zones.conf
index 66b7b54..66b7b54 100644
--- a/src/unbound-adblock/etc/zones/ad-zones.conf
+++ b/src/unbound-adblock/etc/ad-zones.conf
diff --git a/src/unbound-adblock/etc/unbound.base.conf b/src/unbound-adblock/etc/unbound.base.conf
index c0f29a1..92c76db 100644
--- a/src/unbound-adblock/etc/unbound.base.conf
+++ b/src/unbound-adblock/etc/unbound.base.conf
@@ -1,5 +1,3 @@
-include: "/etc/unbound/unbound.conf.d/ad-zones.conf"
-
 server:
     port: 5353
     interface: 0.0.0.0
@@ -16,6 +14,10 @@ server:
     qname-minimisation: yes
     use-caps-for-id: yes
 
+    # Required for forward-tls-upstream: without a CA bundle unbound cannot
+    # verify the upstream auth-names and every DoT handshake fails -> SERVFAIL
+    tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
+
     num-threads: 1
     msg-cache-size: 16m
     rrset-cache-size: 32m