Merge remote-tracking branch 'ms/next-dns-ng' into next

config/unbound/unbound-dhcp-leases-bridge

@@ -28,6 +28,7 @@ import logging.handlers
 import os
 import re
 import signal
+import stat
 import subprocess
 import tempfile
 
@@ -528,6 +529,9 @@ class UnboundConfigWriter(object):
 				for rr in l.rrset:
 					f.write("local-data: \"%s\"\n" % " ".join(rr))
 
+			# Make file readable for everyone
+			os.fchmod(f.fileno(), stat.S_IRUSR|stat.S_IWUSR|stat.S_IRGRP|stat.S_IROTH)
+
 		os.rename(filename, self.path)
 
 	def _control(self, *args):

config/unbound/unbound.conf

@@ -61,6 +61,13 @@ server:
 	harden-algo-downgrade: no
 	use-caps-for-id: yes
 	aggressive-nsec: yes
+	qname-minimisation: yes
+
+	# TLS
+	tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt
+
+	# EDNS Buffer Size (#12240)
+	edns-buffer-size: 1232
 
 	# Harden against DNS cache poisoning
 	unwanted-reply-threshold: 1000000
@@ -78,6 +85,9 @@ server:
 	# Include DHCP leases
 	include: "/etc/unbound/dhcp-leases.conf"
 
+	# Include hosts
+	include: "/etc/unbound/hosts.conf"
+
 	# Include any forward zones
 	include: "/etc/unbound/forward.conf"