unbound: Only launch one process

[ipfire-2.x.git] / src / initscripts / system / unbound

diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound
index 7df50e9d4632d48bc04d27984eec4f8477a854c1..1cf26ec0e5df089c4d20c27d8dd906d1e80a3835 100644 (file)
--- a/src/initscripts/system/unbound
+++ b/src/initscripts/system/unbound
@@ -162,34 +162,35 @@ write_forward_conf() {
                        done
                fi
 
-               echo "forward-zone:"
-               echo "  name: \".\""
+               # Read name servers.
+               nameservers=$(read_name_servers)
 
-               # Force using TLS only
-               if [ "${PROTO}" = "TLS" ]; then
-                       echo "  forward-tls-upstream: yes"
+               # Only write forward zones if any nameservers are configured.
+               #
+               # Otherwise fall-back into recursor mode.
+               if [ -n "${nameservers}" ]; then
+
+                       echo "forward-zone:"
+                       echo "  name: \".\""
+
+                       # Force using TLS only
+                       if [ "${PROTO}" = "TLS" ]; then
+                               echo "  forward-tls-upstream: yes"
+                       fi
+
+                       # Add upstream name servers
+                       local ns
+                       for ns in ${nameservers}; do
+                               echo "  forward-addr: ${ns}"
+                       done
                fi
 
-               # Add upstream name servers
-               local ns
-               for ns in $(read_name_servers); do
-                       echo "  forward-addr: ${ns}"
-               done
        ) > /etc/unbound/forward.conf
 }
 
 write_tuning_conf() {
        # https://www.unbound.net/documentation/howto_optimise.html
 
-       # Determine number of online processors
-       local processors=$(getconf _NPROCESSORS_ONLN)
-
-       # Determine number of slabs
-       local slabs=1
-       while [ ${slabs} -lt ${processors} ]; do
-               slabs=$(( ${slabs} * 2 ))
-       done
-
        # Determine amount of system memory
        local mem=$(get_memory_amount)
 
@@ -224,16 +225,6 @@ write_tuning_conf() {
        (
                config_header
 
-               # We run one thread per processor
-               echo "num-threads: ${processors}"
-               echo "so-reuseport: yes"
-
-               # Adjust number of slabs
-               echo "infra-cache-slabs: ${slabs}"
-               echo "key-cache-slabs: ${slabs}"
-               echo "msg-cache-slabs: ${slabs}"
-               echo "rrset-cache-slabs: ${slabs}"
-
                # Slice up the cache
                echo "rrset-cache-size: $(( ${mem} / 2 ))m"
                echo "msg-cache-size: $(( ${mem} / 4 ))m"
@@ -276,14 +267,18 @@ fix_time_if_dns_fails() {
 
 resolve() {
        local hostname="${1}"
+       local found=1
 
        local answer
        for answer in $(dig +short A "${hostname}"); do
                # Filter out non-IP addresses
                if [[ ! "${answer}" =~ \.$ ]]; then
+                       found=0
                        echo "${answer}"
                fi
        done
+
+       return ${found}
 }
 
 # Sets up Safe Search for various search engines
@@ -518,7 +513,7 @@ update_safe_search() {
        for domain in ${google_tlds[@]}; do
                unbound-control local_zone "${domain}" transparent >/dev/null
                for address in ${addresses}; do
-                       unbound-control local_data: "www.${domain} ${LOCAL_TTL} IN A ${address}"
+                       unbound-control local_data "www.${domain} ${LOCAL_TTL} IN A ${address}"
                done >/dev/null
        done
 
@@ -571,37 +566,38 @@ case "$1" in
                sleep 1
                $0 start
                ;;
-       reload|remove-forwarders)
+       reload|update-forwarders)
                # Update configuration files
                write_forward_conf
                write_hosts_conf
 
+               # Call unbound-control and perform the reload
+               /usr/sbin/unbound-control -q reload
+
+               # Dummy Resolve to wait for unbound
+               resolve "ping.ipfire.org" &>/dev/null
+
+               if [ "$1" = "update-forwarders" ]; then
+                       # Make sure DNS works at this point
+                       fix_time_if_dns_fails
+               fi
+
                # Update Safe Search rules if the system is online.
                if [ -e "/var/ipfire/red/active" ]; then
                        update_safe_search
                fi
-
-               # Call unbound-control and perform the reload
-               /usr/sbin/unbound-control -q reload
                ;;
 
        status)
                statusproc /usr/sbin/unbound
                ;;
 
-       update-forwarders)
-               $0 reload
-
-               # Make sure DNS works at this point
-               fix_time_if_dns_fails
-               ;;
-
        resolve)
-               resolve "${2}"
+               resolve "${2}" || exit $?
                ;;
 
        *)
-               echo "Usage: $0 {start|stop|restart|reload|status|resolve|update-forwarders|remove-forwarders}"
+               echo "Usage: $0 {start|stop|restart|reload|status|resolve|update-forwarders}"
                exit 1
                ;;
 esac