__unbound: wire remote control configuration

type/__unbound/files/unbound.conf.sh

@@ -857,14 +857,14 @@ python:
 remote-control:
 	# Enable remote control with unbound-control(8) here.
 	# set up the keys and certificates with unbound-control-setup.
-	# control-enable: no
+	control-enable: $RC_ENABLE
 
 	# what interfaces are listened to for remote control.
 	# give 0.0.0.0 and ::0 to listen to all interfaces.
 	# set to an absolute path to use a unix local name pipe, certificates
 	# are not used for that, so key and cert files need not be present.
 	# control-interface: 127.0.0.1
-	# control-interface: ::1
+	control-interface: $RC_INTERFACE
 
 	# port number for remote control operations.
 	# control-port: 8953
@@ -874,16 +874,16 @@ remote-control:
 	# control-use-cert: "yes"
 
 	# unbound server key file.
-	# server-key-file: "/unbound_server.key"
+	server-key-file: "$RC_SERVER_KEY_FILE"
 
 	# unbound server certificate file.
-	# server-cert-file: "/unbound_server.pem"
+	server-cert-file: "$RC_SERVER_CERT_FILE"
 
 	# unbound-control key file.
-	# control-key-file: "/unbound_control.key"
+	control-key-file: "$RC_CONTROL_KEY_FILE"
 
 	# unbound-control certificate file.
-	# control-cert-file: "/unbound_control.pem"
+	control-cert-file: "$RC_CONTROL_CERT_FILE"
 
 # Stub zones.
 # Create entries like below, to make all queries for 'example.com' and

type/__unbound/gencode-remote

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+UNBOUND_CERTS_DIR=/etc/unbound
+
+if [ -f "$__object/parameter/enable_rc" ]; then
+	echo "unbound-control-setup -d $UNBOUND_CERTS_DIR"
+	echo "chown unbound:unbound $UNBOUND_CERTS_DIR/*.pem $UNBOUND_CERTS_DIR/*.key"
+fi

type/__unbound/man.rst

@@ -31,6 +31,9 @@ access_control
   but localhost is refused by default), can be provided multiple times. The
   format is described in unbound.conf(5).
 
+rc_interface
+  Address or path to socket used for remote control (see `--enable_control`. Defaults to `127.0.0.1`).
+
 BOOLEAN PARAMETERS
 ------------------
 disable-ip4
@@ -41,6 +44,9 @@ disable-ip6
   Do not answer or issue queries over IPv6. Cannot be used alongside the
   `--disable-ip4` flag.
 
+enable_rc
+  Enable remote control (see `unbound-control(8)`).
+
 EXAMPLES
 --------
 

type/__unbound/manifest

@@ -49,6 +49,11 @@ if [ -f "$__object/parameter/access_control" ]; then
    export ACCESS_CONTROLS
 fi
 
+if [ -f "$__object/parameter/rc_interface" ]; then
+   RC_INTERFACE=$(cat "$__object/parameter/rc_interface")
+   export RC_INTERFACE
+fi
+
 # Boolean parameters:
 if [ -f "$__object/parameter/disable_ip4" ] && \
    [ -f "$__object/parameter/disable_ip6" ]; then
@@ -68,6 +73,18 @@ else
     export DO_IP6='yes'
 fi
 
+if [ -f "$__object/parameter/enable_rc" ]; then
+    export RC_ENABLE='yes'
+else
+    export RC_ENABLE='no'
+fi
+
+# Certs for remote control:
+export RC_SERVER_KEY_FILE='/etc/unbound/unbound_server.key'
+export RC_SERVER_CERT_FILE='/etc/unbound/unbound_server.pem'
+export RC_CONTROL_KEY_FILE='/etc/unbound/unbound_control.key'
+export RC_CONTROL_CERT_FILE='/etc/unbound/unbound_control.pem'
+
 # Generate and deploy configuration files.
 source_file="$__object/files/unbound.conf"
 target_file="/etc/unbound/unbound.conf"

type/__unbound/parameter/boolean

@@ -1,2 +1,3 @@
 disable_ip6
 disable_ip4
+enable_rc

type/__unbound/parameter/default/rc_interface

@@ -0,0 +1 @@
+127.0.0.1

type/__unbound/parameter/optional

@@ -0,0 +1 @@
+rc_interface