On Fri, Sep 02, 2022 at 11:25:20AM +0200, Sebastian Benoit wrote: > Mikolaj Kucharski([email protected]) on 2022.09.02 08:07:01 +0000: > > On Fri, Sep 02, 2022 at 09:53:54AM +0200, Sebastian Benoit wrote: > > > Mikolaj Kucharski([email protected]) on 2022.09.02 06:47:00 +0000: > > > > Hi, > > > > > > > > I have a question, could or should unbound in base be delivered with: > > > > > > > > # cat /etc/login.conf.d/unbound > > > > unbound:\ > > > > :openfiles-cur=4096:\ > > > > :openfiles-max=8192:\ > > > > :tc=daemon: > > > > > > > > or the like? Above is taken from dovecot. I was able to trigger via > > > > rcctl reload unbound following warnings in logs: > > > > > > > > Sep 2 06:37:21 x1c unbound: [32940:0] notice: Restart of unbound > > > > 1.16.0. > > > > Sep 2 06:37:21 x1c unbound: [32940:0] warning: setrlimit: Operation > > > > not permitted > > > > Sep 2 06:37:21 x1c unbound: [32940:0] warning: cannot increase max > > > > open fds from 512 to 4152 > > > > Sep 2 06:37:21 x1c unbound: [32940:0] warning: continuing with less > > > > udp ports: 460 > > > > Sep 2 06:37:21 x1c unbound: [32940:0] warning: increase ulimit or > > > > decrease threads, ports in config to remove this warning > > > > Sep 2 06:37:21 x1c unbound: [32940:0] notice: init module 0: validator > > > > Sep 2 06:37:21 x1c unbound: [32940:0] notice: init module 1: iterator > > > > > > > > After placing above login.conf.d login class capability file above > > > > warnings go away: > > > > > > > > Sep 2 06:39:58 x1c unbound: [14264:0] notice: Restart of unbound > > > > 1.16.0. > > > > Sep 2 06:39:58 x1c unbound: [14264:0] notice: init module 0: validator > > > > Sep 2 06:39:58 x1c unbound: [14264:0] notice: init module 1: iterator > > > > > > As far as i understand, the number of fds that unbound is asking for is > > > based on the num-threads, outgoing-num-tcp, interface and some other > > > setting > > > in the unbound config. > > > > Those particular settings mentioned I did not modified. However the > > values are not that important. I expected /etc/login.conf.d/unbound to > > be present on a fresh install. More on that below. > > It would still be interesting why it wants to increase the limit to 4152. > My list of settings is probably not complete. Show your config if you can.
Sure. Modified a bit to change domain and IP address. # /var/unbound/etc/unbound.conf server: interface: 127.0.0.1 interface: ::1 qname-minimisation: yes access-control: 0.0.0.0/0 refuse access-control: 127.0.0.0/8 allow access-control: ::0/0 refuse access-control: ::1 allow auto-trust-anchor-file: "/var/unbound/db/root.key" val-log-level: 2 aggressive-nsec: yes local-zone: "local." static local-zone: "10.in-addr.arpa." transparent domain-insecure: "10.in-addr.arpa." remote-control: control-enable: yes control-interface: /var/run/unbound.sock forward-zone: name: "example.com." forward-addr: 10.123.123.10 forward-first: no forward-zone: name: "10.in-addr.arpa." forward-addr: 10.123.123.10 forward-first: no forward-zone: name: "." forward-addr: 8.8.4.4 forward-addr: 8.8.8.8 forward-addr: 208.67.222.222 forward-addr: 208.67.220.220 forward-addr: 1.0.0.1 forward-addr: 1.1.1.1 forward-first: yes > Support for login.conf.d was added mostly to support ports that need to make > modifications to drop files in there. > > I dont expect that the base system will ship with files in login.conf.d > anytime soon. Yeah, make sense. > /B. > > > > > > > > > Did you change any? > > > > > > We already ship with this > > > > > > unbound:\ > > > :openfiles=512:\ > > > :tc=daemon: > > > > Ah, in the main file. I didn't expect this. I started this email thread > > as I expected daemon which has rc.d script to have separated login class > > capability file: > > > > # ls -1A /etc/login.conf.d/ | wc -l > > 0 > > > > # tar -zvvtf /var/sysmerge/etc.tgz | grep -c login.conf.d > > 0 > > > > > It is expected that you change login.conf yourself when you tune unbound > > > to > > > your needs. > > > > Yes, I'm aware. That's what I did, but were surprised that there is no > > pre-existing /etc/login.conf.d/unbound > > > > However now looking again at this, maybe missing /etc/login.conf.d/ > > from base is by design. > > -- Regards, Mikolaj
