is there a reason why dnsconfd is not used to configure unbound? It needs just fixed IP and host, optionally with cert bundle, right? Should we add some indication into dnsconfd that unbound were modified manually and should not try to change the configuration?

We want to avoid an extra layer and also keep the implementation similar in upstream and downstream. After we get to implement BIND 9.20+ we'll be able to stop depending on Unbound in the server, and we can reconsider the implementation then.

We are expecting to handle named by dnsconfd too, once it is able to forward over TLS. What I wanted supported somehow was querying global configured forwarders in kind of semi standard way across different configurations. I think getting forwarders by IPA managed is possible only by ipa dnsconfig-show command. With unbound it is possible by unbound-control list_forwarders. In named there is no common way to print just forwarders via remote control. It can be extracted from named.conf only by named-checkconf -px, which does not work with freeipa. resolvectl status works only with systemd-resolved. Kind of simple question "what are my configured DNS recursive servers" is currently varying a lot and implementation dependent. When we forward over TLS channel, how can application on the system receive that information? I hoped we could unify basic querying of configuration by dnsconfd implementation.

But either it would require configuring it via dnsconfd exclusively or at least dnsconfd would have to know what implementation configured it and how to query it for details.

Maybe we could implement plugin to fetch this information from IPA. Is there any file presence, which we could use in dnsconfd to assume DNS is configured by ipa and it should not try to autoconfigure system itself?

Maybe we could implement plugin to fetch this information from IPA. Is there any file presence, which we could use in dnsconfd to assume DNS is configured by ipa and it should not try to autoconfigure system itself?

We create the zzz-ipa.conf file in /etc/unbound/conf.d/ with all our configuration.

PR https://github.com/freeipa/freeipa/pull/7969

master:

• 68cc47a3e430fd4717aa60934677898afb95a961 eDNS: disable dnsconfd before configuring Unbound

ipa-4-12:

• 3623d46f2eb61ba3be76ad861c489bdaab59e5a4 eDNS: disable dnsconfd before configuring Unbound