Good Morning from my Robotics Lab! This is Shadow_8472 with a side project on my home server. Let\u2019s get started!<\/p>\n\n\n\n
In the greater context of setting up Pi-Hole (network ad blocker) on my home server, ButtonMash, I\u2019ve learned a thing or two about how the Domain Name Service (DNS) works and what happens when I break it locally. Normally, when a device connects to a network, a DHCP server (often on the router) advertises a DNS server. When resolving a URL, this DNS server either has the answer cached or ask another DNS server until a match is found or the system gives up.<\/p>\n\n\n\n
My Internet Service Provider (ISP) has been having some trouble with its site (including our main e-mail). Not once, but twice my family asked if I was doing something with the Internet. Both times, I used a terminal application called \u201ctraceroute\u201d to display [most of] the hops my requests went. Ones handled by ButtonMash were very short \u2013 (I tested buttonmash.lan and a known entry on my blocklist), while others took up to 30 hops. My ISP\u2019s site fell in the later category.<\/p>\n\n\n\n
However: one cell phone in the family was still reaching our ISP\u2019s site while on cell data. This meant that the site was fine, but the failure was with the larger DNS system (or most of their servers were down behind their reverse proxy, but I thought of that later). In either case, I looked at a couple \u201cIs it down?\u201d type sites, and concluded the outage was most certainly not my problem.<\/p>\n\n\n\n
But I had a project to try. Unbound is a tool for increasing digital privacy by setting up a recursive DNS server. Every domain is registered at its authoritative DNS server. When Unbound receives a request, it finds the domain\u2019s authoritative DNS server and caches it for later. This reduces digital footprints in DNS server logs, making you harder to track and reducing your vulnerability to a hacked\/confused DNS servers.<\/p>\n\n\n\n
I\u2019ve been interested in building my own Unbound OCI \u201cDocker\u201d container for a while as there\u2019s no officially maintained one, but I went ahead and downloaded an image from docker.io based on the quality of documentation. I spun up a container in Podman and pointed Pi-Hole at it. It worked first try with no special configuration.<\/p>\n\n\n\n
It just so happened that when I brought the fix online, we were on a call with tech support, and I was able to pass my diagnosis back to our ISP to help them restore service to their customers in my community \u2013 however large or small that number may be.<\/p>\n\n\n\n
What\u2019s with no persistence volumes on this container? If it resets, it will have to start over on caching. If\/when I come back in a few months, I may take a closer look. Otherwise, this has been a big shortcut I can live with.<\/p>\n\n\n\n
Have you worked with Unbound before? Would it even benefit from a persistence volume?<\/p>\n\n\n\n