Set up SpamAssassin

Scan incoming and outgoing email for spam. Use a local Unbound for DNS, so we don't run into blocks for RBL queries.
2023-12-06 12:12:00 +01:00 · 2023-12-06 12:12:00 +01:00 · b3f2ca415e
commit b3f2ca415e
parent 05ccbcc58f
40 changed files with 2145 additions and 4 deletions
--- a/1
+++ b/1
@ -37,6 +37,7 @@ cookbook 'timezone_iii',           '= 1.0.4'
 cookbook 'ulimit',                 '~> 1.0.0'
 cookbook 'users',                  '~> 5.3.1'
 cookbook 'zerotier',               '~> 1.0.7'
+cookbook 'unbound',                '~> 3.0.2'

 # openresty dependency
 cookbook 'jemalloc',               '~> 0.1.7'
--- a/Berksfile.lock
+++ b/Berksfile.lock
@ -33,6 +33,7 @@ DEPENDENCIES
  ruby_build (~> 2.5.0)
  timezone_iii (= 1.0.4)
  ulimit (~> 1.0.0)
+  unbound (~> 3.0.2)
  users (~> 5.3.1)
  yum
  zerotier (~> 1.0.7)
@ -99,6 +100,7 @@ GRAPH
  seven_zip (4.2.2)
  timezone_iii (1.0.4)
  ulimit (1.0.0)
+  unbound (3.0.2)
  users (5.3.1)
  windows (7.0.2)
  yum (7.4.13)
--- a/cookbooks/unbound/CHANGELOG.md
+++ b/cookbooks/unbound/CHANGELOG.md
@ -0,0 +1,64 @@
+# CHANGELOG
+
+This file is used to list changes made in each version of the unbound cookbook.
+
+## 3.0.2 - *2023-10-02*
+
+- Update Ci files and remove CircleCI config
+
+## 3.0.1 - *2022-09-30*
+
+- Add missing `fallback-enable` setting to `config_authority_zone`
+
+## 3.0.0 - *2022-04-04*
+
+- Add separate configuration resources
+- Default recipe now only runs installation
+- Refactor configuration template to be Hash driven
+
+## 2.0.3 - *2022-03-04*
+
+- resolved cookstyle error: .delivery/project.toml:2:8 convention: `Style/StringLiterals`
+- resolved cookstyle error: .delivery/project.toml:4:10 convention: `Style/StringLiterals`
+- resolved cookstyle error: .delivery/project.toml:5:13 convention: `Style/StringLiterals`
+- resolved cookstyle error: .delivery/project.toml:6:10 convention: `Style/StringLiterals`
+- resolved cookstyle error: .delivery/project.toml:7:9 convention: `Style/StringLiterals`
+- resolved cookstyle error: .delivery/project.toml:8:14 convention: `Style/StringLiterals`
+- resolved cookstyle error: .delivery/project.toml:9:11 convention: `Style/StringLiterals`
+
+## 2.0.2 - *2021-08-31*
+
+- Standardise files with files in sous-chefs/repo-management
+
+## 2.0.1 - *2021-06-01*
+
+- Updated tests folder to match other cookbooks
+- Updated spec platform to supported version
+
+## 2.0.0 - 2020-05-05
+
+- Upgraded to circleci for testing
+- Minimum Chef Infra Client version is now **13.0**
+- Removed unused long_description metadata.rb field
+- Simplify overly complex platform logic
+- Migrate to actions for testing
+
+## [1.0.1]
+
+- Simplify logic with root_group
+- Fix `root_group` not using new_resource
+- Use strings for file modes
+- Resolve foodcritic warnings in the `rr` resource
+- Fix platform_family logic on the service Update platforms.
+- Use dokken images for travis testing.
+- Don't test on debian-8/9 and centos-6 as these services don't currently start.
+- Account for a list of forward-addrs / effectively disable remote control (#27)
+
+## [1.0.0]
+
+- Add new custom resources `unbound_install` & `unbound_configure`
+
+## [0.1.1]
+
+- Adding support and kitchen testing for forward_zone generation
+- Updating to use Sous Chefs guidelines
--- a/cookbooks/unbound/LICENSE
+++ b/cookbooks/unbound/LICENSE
@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
--- a/cookbooks/unbound/README.md
+++ b/cookbooks/unbound/README.md
@ -0,0 +1,78 @@
+# Unbound Cookbook
+
+[![Cookbook Version](https://img.shields.io/cookbook/v/unbound.svg)](https://supermarket.chef.io/cookbooks/unbound)
+[![Build Status](https://img.shields.io/circleci/project/github/sous-chefs/unbound/master.svg)](https://circleci.com/gh/sous-chefs/unbound)
+[![OpenCollective](https://opencollective.com/sous-chefs/backers/badge.svg)](#backers)
+[![OpenCollective](https://opencollective.com/sous-chefs/sponsors/badge.svg)](#sponsors)
+[![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](https://opensource.org/licenses/Apache-2.0)
+
+Installs and manages the unbound DNS server.
+
+- [http://unbound.net](http://unbound.net)
+
+## Maintainers
+
+This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of Chef cookbook maintainers working together to maintain important cookbooks. If you’d like to know more please visit [sous-chefs.org](https://sous-chefs.org/) or come chat with us on the Chef Community Slack in [#sous-chefs](https://chefcommunity.slack.com/messages/C2V7B88SF).
+
+## Requirements
+
+### Platform
+
+A platform with unbound available as a native package. The following platforms have unbound packaged, but note that the filesystem locations are not consistent and at this time only Linux + FHS is supported.
+
+- Ubuntu/Debian
+- Red Hat/CentOS/Fedora (requires EPEL)
+- FreeBSD
+
+### Chef
+
+- Chef 16
+
+## Resources
+
+- [unbound_config_authority_zone](documentation/unbound_config_authority_zone.md)
+- [unbound_config_cachedb](documentation/unbound_config_cachedb.md)
+- [unbound_config_dns64](documentation/unbound_config_dns64.md)
+- [unbound_config_dnscrypt](documentation/unbound_config_dnscrypt.md)
+- [unbound_config_dnstap](documentation/unbound_config_dnstap.md)
+- [unbound_config_dynamic_library](documentation/unbound_config_dynamic_library.md)
+- [unbound_config_forward_zone](documentation/unbound_config_forward_zone.md)
+- [unbound_config_python_script](documentation/unbound_config_python_script.md)
+- [unbound_config_remote_control](documentation/unbound_config_remote_control.md)
+- [unbound_config_rpz_zone](documentation/unbound_config_rpz_zone.md)
+- [unbound_config_server](documentation/unbound_config_server.md)
+- [unbound_config_stub_zone](documentation/unbound_config_stub_zone.md)
+- [unbound_config_view](documentation/unbound_config_view.md)
+- [unbound_package](documentation/unbound_package.md)
+- [unbound_service](documentation/unbound_service.md)
+
+## Recipes
+
+### default
+
+Installs unbound using defaults.
+
+## Contributors
+
+This project exists thanks to all the people who [contribute.](https://opencollective.com/sous-chefs/contributors.svg?width=890&button=false)
+
+### Backers
+
+Thank you to all our backers!
+
+![https://opencollective.com/sous-chefs#backers](https://opencollective.com/sous-chefs/backers.svg?width=600&avatarHeight=40)
+
+### Sponsors
+
+Support this project by becoming a sponsor. Your logo will show up here with a link to your website.
+
+![https://opencollective.com/sous-chefs/sponsor/0/website](https://opencollective.com/sous-chefs/sponsor/0/avatar.svg?avatarHeight=100)
+![https://opencollective.com/sous-chefs/sponsor/1/website](https://opencollective.com/sous-chefs/sponsor/1/avatar.svg?avatarHeight=100)
+![https://opencollective.com/sous-chefs/sponsor/2/website](https://opencollective.com/sous-chefs/sponsor/2/avatar.svg?avatarHeight=100)
+![https://opencollective.com/sous-chefs/sponsor/3/website](https://opencollective.com/sous-chefs/sponsor/3/avatar.svg?avatarHeight=100)
+![https://opencollective.com/sous-chefs/sponsor/4/website](https://opencollective.com/sous-chefs/sponsor/4/avatar.svg?avatarHeight=100)
+![https://opencollective.com/sous-chefs/sponsor/5/website](https://opencollective.com/sous-chefs/sponsor/5/avatar.svg?avatarHeight=100)
+![https://opencollective.com/sous-chefs/sponsor/6/website](https://opencollective.com/sous-chefs/sponsor/6/avatar.svg?avatarHeight=100)
+![https://opencollective.com/sous-chefs/sponsor/7/website](https://opencollective.com/sous-chefs/sponsor/7/avatar.svg?avatarHeight=100)
+![https://opencollective.com/sous-chefs/sponsor/8/website](https://opencollective.com/sous-chefs/sponsor/8/avatar.svg?avatarHeight=100)
+![https://opencollective.com/sous-chefs/sponsor/9/website](https://opencollective.com/sous-chefs/sponsor/9/avatar.svg?avatarHeight=100)
--- a/cookbooks/unbound/chefignore
+++ b/cookbooks/unbound/chefignore
@ -0,0 +1,115 @@
+# Put files/directories that should be ignored in this file when uploading
+# to a Chef Infra Server or Supermarket.
+# Lines that start with '# ' are comments.
+
+# OS generated files #
+######################
+.DS_Store
+ehthumbs.db
+Icon?
+nohup.out
+Thumbs.db
+.envrc
+
+# EDITORS #
+###########
+.#*
+.project
+.settings
+*_flymake
+*_flymake.*
+*.bak
+*.sw[a-z]
+*.tmproj
+*~
+\#*
+REVISION
+TAGS*
+tmtags
+.vscode
+.editorconfig
+
+## COMPILED ##
+##############
+*.class
+*.com
+*.dll
+*.exe
+*.o
+*.pyc
+*.so
+*/rdoc/
+a.out
+mkmf.log
+
+# Testing #
+###########
+.circleci/*
+.codeclimate.yml
+.delivery/*
+.foodcritic
+.kitchen*
+.mdlrc
+.overcommit.yml
+.rspec
+.rubocop.yml
+.travis.yml
+.watchr
+.yamllint
+azure-pipelines.yml
+Dangerfile
+examples/*
+features/*
+Guardfile
+kitchen.yml*
+mlc_config.json
+Procfile
+Rakefile
+spec/*
+test/*
+
+# SCM #
+#######
+.git
+.gitattributes
+.gitconfig
+.github/*
+.gitignore
+.gitkeep
+.gitmodules
+.svn
+*/.bzr/*
+*/.git
+*/.hg/*
+*/.svn/*
+
+# Berkshelf #
+#############
+Berksfile
+Berksfile.lock
+cookbooks/*
+tmp
+
+# Bundler #
+###########
+vendor/*
+Gemfile
+Gemfile.lock
+
+# Policyfile #
+##############
+Policyfile.rb
+Policyfile.lock.json
+
+# Documentation #
+#############
+CODE_OF_CONDUCT*
+CONTRIBUTING*
+documentation/*
+TESTING*
+UPGRADING*
+
+# Vagrant #
+###########
+.vagrant
+Vagrantfile
--- a/cookbooks/unbound/kitchen.dokken.yml
+++ b/cookbooks/unbound/kitchen.dokken.yml
@ -0,0 +1,56 @@
+---
+driver:
+  name: dokken
+  privileged: true
+  chef_version: <%= ENV['CHEF_VERSION'] || 'current' %>
+
+transport:
+  name: dokken
+
+provisioner:
+  name: dokken
+
+platforms:
+  - name: centos-7
+    driver:
+      image: dokken/centos-7
+      pid_one_command: /usr/lib/systemd/systemd
+
+  - name: centos-stream-8
+    driver:
+      image: dokken/centos-stream-8
+      pid_one_command: /usr/lib/systemd/systemd
+
+  - name: fedora-latest
+    driver:
+      image: dokken/fedora-latest
+      pid_one_command: /usr/lib/systemd/systemd
+
+  - name: ubuntu-18.04
+    driver:
+      image: dokken/ubuntu-18.04
+      pid_one_command: /bin/systemd
+      intermediate_instructions:
+        - RUN /usr/bin/apt-get update
+
+  - name: ubuntu-20.04
+    driver:
+      image: dokken/ubuntu-20.04
+      pid_one_command: /bin/systemd
+      intermediate_instructions:
+        - RUN /usr/bin/apt-get update
+
+  - name: debian-10
+    driver:
+      image: dokken/debian-10
+      pid_one_command: /bin/systemd
+      intermediate_instructions:
+        - RUN /usr/bin/apt-get update
+
+  - name: debian-11
+    driver:
+      image: dokken/debian-11
+      pid_one_command: /bin/systemd
+      intermediate_instructions:
+        - RUN /usr/bin/apt-get update
+...
--- a/cookbooks/unbound/libraries/helpers.rb
+++ b/cookbooks/unbound/libraries/helpers.rb
@ -0,0 +1,59 @@
+#
+# Cookbook:: unbound
+# Library:: helpers
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+module Unbound
+  module Cookbook
+    module Helpers
+      def default_config_dir
+        return '/etc/unbound' if %i(unbound_config unbound_configure unbound_config_server).include?(declared_type)
+
+        return '/etc/unbound/unbound.conf.d' if platform?('debian', 'ubuntu')
+
+        case declared_type
+        when :unbound_config_local
+          '/etc/unbound/local.d'
+        when :unbound_config_key
+          '/etc/unbound/keys.d'
+        else
+          '/etc/unbound/conf.d'
+        end
+      end
+
+      def default_includes_dir
+        case node['platform_family']
+        when 'rhel', 'fedora'
+          %w(/etc/unbound/conf.d/*.conf /etc/unbound/local.d/*.conf)
+        when 'debian'
+          %w(/etc/unbound/unbound.conf.d/*.conf)
+        else
+          raise "Unsupported platform family #{node['platform_family']}"
+        end
+      end
+
+      def unbound_yes_no?(value)
+        case value
+        when true
+          'yes'
+        when false
+          'no'
+        when 'yes', 'YES', 'no', 'NO'
+          value.downcase
+        end
+      end
+    end
+  end
+end
--- a/cookbooks/unbound/libraries/template.rb
+++ b/cookbooks/unbound/libraries/template.rb
@ -0,0 +1,26 @@
+#
+# Cookbook:: unbound
+# Library:: template
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+module Unbound
+  module Cookbook
+    module TemplateHelpers
+      def template_partial_indent(output, level, spaces = 2)
+        output.split("\n").each { |l| l.prepend(' ' * (level * spaces)) }.join("\n")
+      end
+    end
+  end
+end
--- a/cookbooks/unbound/metadata.json
+++ b/cookbooks/unbound/metadata.json
@ -0,0 +1,42 @@
+{
+  "name": "unbound",
+  "description": "Manages unbound DNS resolver",
+  "long_description": "",
+  "maintainer": "Sous Chefs",
+  "maintainer_email": "help@sous-chefs.org",
+  "license": "Apache-2.0",
+  "platforms": {
+    "debian": ">= 0.0.0",
+    "ubuntu": ">= 0.0.0",
+    "centos": ">= 0.0.0",
+    "redhat": ">= 0.0.0",
+    "scientific": ">= 0.0.0",
+    "oracle": ">= 0.0.0",
+    "amazon": ">= 0.0.0"
+  },
+  "dependencies": {
+
+  },
+  "providing": {
+
+  },
+  "recipes": {
+
+  },
+  "version": "3.0.2",
+  "source_url": "https://github.com/sous-chefs/unbound",
+  "issues_url": "https://github.com/sous-chefs/unbound/issues",
+  "privacy": false,
+  "chef_versions": [
+    [
+      ">= 16"
+    ]
+  ],
+  "ohai_versions": [
+
+  ],
+  "gems": [
+
+  ],
+  "eager_load_libraries": true
+}
--- a/cookbooks/unbound/metadata.rb
+++ b/cookbooks/unbound/metadata.rb
@ -0,0 +1,13 @@
+name             'unbound'
+maintainer       'Sous Chefs'
+maintainer_email 'help@sous-chefs.org'
+license          'Apache-2.0'
+description      'Manages unbound DNS resolver'
+version          '3.0.2'
+issues_url       'https://github.com/sous-chefs/unbound/issues'
+source_url       'https://github.com/sous-chefs/unbound'
+chef_version     '>= 16'
+
+%w(debian ubuntu centos redhat scientific oracle amazon).each do |os|
+  supports os
+end
--- a/cookbooks/unbound/recipes/default.rb
+++ b/cookbooks/unbound/recipes/default.rb
@ -0,0 +1,25 @@
+#
+# Cookbook:: unbound
+# Recipe:: default
+#
+# Copyright:: 2011, Joshua Timberman
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+log 'v3_warning' do
+  message 'Version 3.0.0 of this cookbook removed all configuration actions from the default recipe'
+  level :warn
+end
+
+unbound_package 'unbound'
--- a/cookbooks/unbound/renovate.json
+++ b/cookbooks/unbound/renovate.json
@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base"
+  ]
+}
--- a/cookbooks/unbound/resources/config_authority_zone.rb
+++ b/cookbooks/unbound/resources/config_authority_zone.rb
@ -0,0 +1,93 @@
+#
+# Cookbook:: unbound
+# Resource:: config_authority_zone
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+provides :unbound_config_auth_zone
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/authority-zone-#{name}.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :zone_name, String,
+          default: lazy { name }
+
+property :primary, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :master, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :url, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :allow_notify, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :fallback_enabled, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :for_downstream, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :for_upstream, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :zonemd_check, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :zonemd_reject_absence, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :zonefile, String
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    zone_config = {
+      'name' => new_resource.zone_name,
+      'primary' => new_resource.primary.dup,
+      'master' => new_resource.master.dup,
+      'url' => new_resource.url.dup,
+      'allow-notify' => new_resource.allow_notify.dup,
+      'fallback-enabled' => new_resource.fallback_enabled,
+      'for-downstream' => new_resource.for_downstream,
+      'for-upstream' => new_resource.for_upstream,
+      'zonemd-check' => new_resource.zonemd_check,
+      'zonemd-reject-absence' => new_resource.zonemd_reject_absence,
+      'zonefile' => new_resource.zonefile,
+    }.compact
+
+    config = {
+      'auth-zone' => zone_config,
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_cachedb.rb
+++ b/cookbooks/unbound/resources/config_cachedb.rb
@ -0,0 +1,67 @@
+#
+# Cookbook:: unbound
+# Resource:: config_cachedb
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/cachedb.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :backend, String
+
+property :secret_seed, String
+
+property :redis_server_host, String
+
+property :redis_server_port, Integer
+
+property :redis_timeout, Integer
+
+property :redis_expire_records, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    cachedb_config = {
+      'backend' => new_resource.backend,
+      'secret-seed' => new_resource.secret_seed,
+      'redis-server-host' => new_resource.redis_server_host,
+      'redis-server-port' => new_resource.redis_server_port,
+      'redis-timeout' => new_resource.redis_timeout,
+      'redis-expire-records' => new_resource.redis_expire_records,
+    }.compact
+
+    config = {
+      'cachedb' => cachedb_config,
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_dns64.rb
+++ b/cookbooks/unbound/resources/config_dns64.rb
@ -0,0 +1,58 @@
+#
+# Cookbook:: unbound
+# Resource:: config_dns64
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/dns64.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :dns64_prefix, String
+
+property :dns64_synthall, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dns64_ignore_aaaa, String
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    dns64_config = {
+      'dns64-prefix' => new_resource.dns64_prefix,
+      'dns64-synthall' => new_resource.dns64_synthall,
+      'dns64-ignore-aaaa' => new_resource.dns64_ignore_aaaa,
+    }.compact
+
+    config = {
+      'server' => dns64_config,
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_dnscrypt.rb
+++ b/cookbooks/unbound/resources/config_dnscrypt.rb
@ -0,0 +1,80 @@
+#
+# Cookbook:: unbound
+# Resource:: config_dnscrypt
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/dnscrypt.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :dnscrypt_enable, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnscrypt_port, Integer
+
+property :dnscrypt_provider, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :dnscrypt_secret_key, String
+
+property :dnscrypt_provider_cert, String
+
+property :dnscrypt_provider_cert_rotated, String
+
+property :dnscrypt_shared_secret_cache_size, String
+
+property :dnscrypt_shared_secret_cache_slabs, Integer
+
+property :dnscrypt_nonce_cache_size, String
+
+property :dnscrypt_nonce_cache_slabs, Integer
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    dnscrypt_config = {
+      'dnscrypt-enable' => new_resource.dnscrypt_enable,
+      'dnscrypt-port' => new_resource.dnscrypt_port,
+      'dnscrypt-provider' => new_resource.dnscrypt_provider.dup,
+      'dnscrypt-secret-key' => new_resource.dnscrypt_secret_key,
+      'dnscrypt-provider-cert' => new_resource.dnscrypt_provider_cert,
+      'dnscrypt-provider-cert-rotated' => new_resource.dnscrypt_provider_cert_rotated,
+      'dnscrypt-shared-secret-cache-size' => new_resource.dnscrypt_shared_secret_cache_size,
+      'dnscrypt-shared-secret-cache-slabs' => new_resource.dnscrypt_shared_secret_cache_slabs,
+      'dnscrypt-nonce-cache-size' => new_resource.dnscrypt_nonce_cache_size,
+      'dnscrypt-nonce-cache-slabs' => new_resource.dnscrypt_nonce_cache_slabs,
+    }.compact
+
+    config = {
+      'dnscrypt' => dnscrypt_config,
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_dnstap.rb
+++ b/cookbooks/unbound/resources/config_dnstap.rb
@ -0,0 +1,116 @@
+#
+# Cookbook:: unbound
+# Resource:: config_dnstap
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/dnstap.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :dnstap_enable, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_bidirectional, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_socket_path, String
+
+property :dnstap_ip, String
+
+property :dnstap_tls, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_tls_server_name, String
+
+property :dnstap_tls_cert_bundle, String
+
+property :dnstap_tls_client_key_file, String
+
+property :dnstap_tls_client_cert_file, String
+
+property :dnstap_send_identity, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_send_version, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_identity, String
+
+property :dnstap_version, String
+
+property :dnstap_log_resolver_query_messages, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_log_resolver_response_messages, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_log_client_query_messages, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_log_client_response_messages, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_log_forwarder_query_messages, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :dnstap_log_forwarder_response_messages, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    zone_config = {
+      'dnstap-enable' => new_resource.dnstap_enable,
+      'dnstap-bidirectional' => new_resource.dnstap_bidirectional,
+      'dnstap-socket-path' => new_resource.dnstap_socket_path,
+      'dnstap-ip' => new_resource.dnstap_ip,
+      'dnstap-tls' => new_resource.dnstap_tls,
+      'dnstap-tls-server-name' => new_resource.dnstap_tls_server_name,
+      'dnstap-tls-cert-bundle' => new_resource.dnstap_tls_cert_bundle,
+      'dnstap-tls-client-key-file' => new_resource.dnstap_tls_client_key_file,
+      'dnstap-tls-client-cert-file' => new_resource.dnstap_tls_client_cert_file,
+      'dnstap-send-identity' => new_resource.dnstap_send_identity,
+      'dnstap-send-version' => new_resource.dnstap_send_version,
+      'dnstap-identity' => new_resource.dnstap_identity,
+      'dnstap-version' => new_resource.dnstap_version,
+      'dnstap-log-resolver-query-messages' => new_resource.dnstap_log_resolver_query_messages,
+      'dnstap-log-resolver-response-messages' => new_resource.dnstap_log_resolver_response_messages,
+      'dnstap-log-client-query-messages' => new_resource.dnstap_log_client_query_messages,
+      'dnstap-log-client-response-messages' => new_resource.dnstap_log_client_response_messages,
+      'dnstap-log-forwarder-query-messages' => new_resource.dnstap_log_forwarder_query_messages,
+      'dnstap-log-forwarder-response-messages' => new_resource.dnstap_log_forwarder_response_messages,
+    }.compact
+
+    config = {
+      'dnstap' => zone_config,
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_dynamic_library.rb
+++ b/cookbooks/unbound/resources/config_dynamic_library.rb
@ -0,0 +1,48 @@
+#
+# Cookbook:: unbound
+# Resource:: config_dynamic_library
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/dyn-lib-#{name}.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :dynlib_file, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    config = {
+      'dynlib-file' => new_resource.dynlib_file.dup,
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_forward_zone.rb
+++ b/cookbooks/unbound/resources/config_forward_zone.rb
@ -0,0 +1,80 @@
+#
+# Cookbook:: unbound
+# Resource:: config_forward_zone
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/forward-zone-#{name}.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :zone_name, String,
+          default: lazy { name }
+
+property :forward_host, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :forward_addr, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :forward_first, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :forward_tls_upstream, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :forward_ssl_upstream, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :forward_tcp_upstream, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :forward_no_cache, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    zone_config = {
+      'name' => new_resource.zone_name,
+      'forward-host' => new_resource.forward_host.dup,
+      'forward-addr' => new_resource.forward_addr.dup,
+      'forward-first' => new_resource.forward_first,
+      'forward-tls-upstream' => new_resource.forward_tls_upstream,
+      'forward-ssl-upstream' => new_resource.forward_ssl_upstream,
+      'forward-tcp-upstream' => new_resource.forward_tcp_upstream,
+      'forward-no-cache' => new_resource.forward_no_cache,
+    }.compact
+
+    config = {
+      'forward-zone' => zone_config,
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_python_script.rb
+++ b/cookbooks/unbound/resources/config_python_script.rb
@ -0,0 +1,53 @@
+#
+# Cookbook:: unbound
+# Resource:: config_python_script
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/python-script-#{name}.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :python_script, [String, Array],
+          coerce: proc { |p| Array(p) },
+          required: true
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    declare_resource(:package, 'python3-unbound')
+
+    config = {
+      'python' => {
+        'python-script' => new_resource.python_script.dup,
+      },
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_remote_control.rb
+++ b/cookbooks/unbound/resources/config_remote_control.rb
@ -0,0 +1,77 @@
+#
+# Cookbook:: unbound
+# Resource:: config_remote_control
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/remote-control.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :control_enable, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :control_interface, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :control_port, Integer
+
+property :control_use_cert, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :control_key_file, String
+
+property :control_cert_file, String
+
+property :server, String
+
+property :server_key_file, String
+
+property :server_cert_file, String
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    remote_control = {
+      'control-enable' => new_resource.control_enable,
+      'control-interface' => new_resource.control_interface.dup,
+      'control-port' => new_resource.control_port,
+      'control-use-cert' => new_resource.control_use_cert,
+      'control-key-file' => new_resource.control_key_file,
+      'control-cert-file' => new_resource.control_cert_file,
+      'server-key-file' => new_resource.server_key_file,
+      'server-cert-file' => new_resource.server_cert_file,
+    }.compact
+
+    config = {
+      'remote-control' => remote_control,
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_rpz_zone.rb
+++ b/cookbooks/unbound/resources/config_rpz_zone.rb
@ -0,0 +1,98 @@
+#
+# Cookbook:: unbound
+# Resource:: config_rpz_zone
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/rpz-zone-#{name}.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :zone_name, String,
+          default: lazy { name }
+
+property :primary, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :master, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :url, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :allow_notify, [String, Array],
+          coerce: proc { |p| Array(p) }
+
+property :zonefile, String
+
+property :rpz_action_override, [String, Symbol],
+          equal_to: %w(nxdomain nodata passthru drop disabled cname),
+          coerce: proc { |p| p.to_s }
+
+property :rpz_cname_override, String
+
+property :rpz_log, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :rpz_log_name, String
+
+property :rpz_signal_nxdomain_ra, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :for_downstream, [String, true, false],
+          coerce: proc { |p| unbound_yes_no?(p) }
+
+property :tags, [String, Array],
+          coerce: proc { |p| "\"#{p.to_a.join(' ')} \"" }
+
+load_current_value do |new_resource|
+  current_value_does_not_exist! unless ::File.exist?(new_resource.config_file)
+
+  if ::File.exist?(new_resource.config_file)
+    owner ::Etc.getpwuid(::File.stat(new_resource.config_file).uid).name
+    group ::Etc.getgrgid(::File.stat(new_resource.config_file).gid).name
+    mode ::File.stat(new_resource.config_file).mode.to_s(8)[-4..-1]
+  end
+end
+
+action_class do
+  def do_template_action
+    zone_config = {
+      'name' => new_resource.zone_name,
+      'primary' => new_resource.primary.dup,
+      'master' => new_resource.master.dup,
+      'url' => new_resource.url.dup,
+      'allow-notify' => new_resource.allow_notify.dup,
+      'zonefile' => new_resource.zonefile,
+      'rpz-action-override' => new_resource.rpz_action_override,
+      'rpz-cname-override' => new_resource.rpz_cname_override,
+      'rpz-log' => new_resource.rpz_log,
+      'rpz-log-name' => new_resource.rpz_log_name,
+      'rpz-signal-nxfomain-ra' => new_resource.rpz_signal_nxdomain_ra,
+      'for-downstream' => new_resource.for_downstream,
+      'tags' => new_resource.tags.dup,
+    }.compact
+
+    config = {
+      'rpz' => zone_config,
+    }
+
+    perform_config_action(config)
+  end
+end
--- a/cookbooks/unbound/resources/config_server.rb
+++ b/cookbooks/unbound/resources/config_server.rb
@ -0,0 +1,58 @@
+#
+# Cookbook:: unbound
+# Resource:: config_server
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unified_mode true
+
+provides :unbound_config_server
+provides :unbound_configure
+provides :unbound_config
+
+use 'partials/_config_file'
+
+property :config_file, String,
+          default: lazy { "#{config_dir}/unbound.conf" },
+          desired_state: false,
+          description: 'Set to override unbound configuration file.'
+
+property :include, [String, Array],
+          default: lazy { default_includes_dir },
+          coerce: proc { |p| Array(p) }
+