Add unbound to mail server

container-config/unbound/unbound.conf

@@ -1,13 +1,6 @@
 server:
   interface: 0.0.0.0
   interface: ::
-  access-control: 192.168.0.0/16 allow
-  access-control: fe80::/10 allow
-  tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
-  trust-anchor-file: /opt/unbound/etc/unbound/var/root.key
-forward-zone:
-  name: .
-  forward-tls-upstream: yes
-  forward-addr: 2620:fe::10#dns10.quad9.net
-  forward-addr: 9.9.9.10#dns10.quad9.net
-include: /opt/unbound/etc/unbound/local.conf
+  access-control: 0.0.0.0/0 allow
+  access-control: ::/0 allow
+  trust-anchor-file: /usr/share/dnssec-root/trusted-key.key

k8s/talos.yaml

@@ -1,6 +1,6 @@
 machine:
   install:
-    image: factory.talos.dev/installer-secureboot/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515:v1.7.3
+    image: factory.talos.dev/installer-secureboot/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515:v1.7.6
   systemDiskEncryption:
     state:
       provider: luks2

vps/etc/containers/systemd/postfix.container

@@ -1,6 +1,6 @@
 [Unit]
-Requires=dovecot.service rspamd.service
-After=dovecot.service rspamd.service
+Requires=dovecot.service rspamd.service unbound.service
+After=dovecot.service rspamd.service unbound.service
 [Container]
 Image=git.strypsteen.com/mathieu/postfix
 UserNS=host

vps/etc/containers/systemd/redis.container

@@ -1,6 +1,6 @@
 [Container]
 Image=cgr.dev/chainguard/valkey
-Network=redis.network
+Network=mail.network
 Volume=redis.volume:/data:U,Z
 AutoUpdate=registry
 [Install]

vps/etc/containers/systemd/redis.network

@@ -1,3 +0,0 @@
-[Network]
-IPv6=true
-Options=isolate=true

vps/etc/containers/systemd/rspamd.container

@@ -1,10 +1,9 @@
 [Unit]
-Requires=redis.service
-After=redis.service
+Requires=redis.service unbound.service
+After=redis.service unbound.service
 [Container]
 Image=docker.io/rspamd/rspamd
 Network=mail.network
-Network=redis.network
 Volume=/var/lib/system-config/container-config/rspamd:/etc/rspamd/local.d:z,ro
 Volume=rspamd.volume:/var/lib/rspamd:U,Z
 Secret=dkim.key

vps/etc/containers/systemd/unbound.container

@@ -0,0 +1,8 @@
+[Container]
+Image=docker.io/alpinelinux/unbound
+Network=mail.network
+Volume=/var/lib/system-config/container-config/unbound/unbound.conf:/etc/unbound/unbound.conf:z,ro
+Tmpfs=/etc/unbound
+AutoUpdate=registry
+[Install]
+WantedBy=multi-user.target