nixos-config/services/unbound.nix

{ config, ... }:

{
  services.unbound = {
    enable = true;
    localControlSocketPath = "/run/unbound/unbound.socket";
    settings.server = {
      so-rcvbuf = "1m";
      prefetch = true;
      access-control = "10.0.0.0/8 allow";
      interface = [ "127.0.0.1" ];
      private-address = [
        "192.168.0.0/16"
        "169.254.0.0/16"
        "172.16.0.0/16"
        "10.0.0.0/8"
        "fd00::/8"
        "fe80::/10"
      ];
    };
  };

  services.prometheus.exporters.unbound = {
    inherit (config.services.unbound) group;
    enable = true;
    openFirewall = true;
    port = 9090;
    controlInterface = config.services.unbound.localControlSocketPath;
  };
}