From cdca603ff501146692f69b29ebb907af55a191ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9?= <andre.peters@servercow.de>
Date: Sun, 30 Sep 2018 14:43:18 +0200
Subject: [PATCH] [Unbound] Fix logging, fixes #585 [Rspamd] Fix permissions of
 controller password file [Unbound] Enable unbound-control

---
 data/Dockerfiles/rspamd/docker-entrypoint.sh  |  1 +
 data/Dockerfiles/unbound/Dockerfile           |  1 +
 data/Dockerfiles/unbound/docker-entrypoint.sh |  5 ++++-
 data/conf/unbound/unbound.conf                | 11 ++++++++++-
 4 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/data/Dockerfiles/rspamd/docker-entrypoint.sh b/data/Dockerfiles/rspamd/docker-entrypoint.sh
index 4972124c..a606e96f 100755
--- a/data/Dockerfiles/rspamd/docker-entrypoint.sh
+++ b/data/Dockerfiles/rspamd/docker-entrypoint.sh
@@ -3,6 +3,7 @@
 chown -R _rspamd:_rspamd /var/lib/rspamd
 chmod 755 /var/lib/rspamd
 [[ ! -f /etc/rspamd/override.d/worker-controller-password.inc ]] && echo '# Placeholder' > /etc/rspamd/override.d/worker-controller-password.inc
+chown _rspamd:_rspamd /etc/rspamd/override.d/worker-controller-password.inc
 [[ ! -f /etc/rspamd/custom/sa-rules-heinlein ]] && echo '# to be auto-filled by dovecot-mailcow' > /etc/rspamd/custom/sa-rules-heinlein
 
 exec "$@"
diff --git a/data/Dockerfiles/unbound/Dockerfile b/data/Dockerfiles/unbound/Dockerfile
index 72e86bc0..4f443b88 100644
--- a/data/Dockerfiles/unbound/Dockerfile
+++ b/data/Dockerfiles/unbound/Dockerfile
@@ -10,6 +10,7 @@ RUN apk add --update --no-cache \
 	drill \
 	&& curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cache \
 	&& chown root:unbound /etc/unbound \
+  && adduser unbound tty \
 	&& chmod 775 /etc/unbound
 
 EXPOSE 53/udp 53/tcp
diff --git a/data/Dockerfiles/unbound/docker-entrypoint.sh b/data/Dockerfiles/unbound/docker-entrypoint.sh
index b458cd8a..d179eaca 100755
--- a/data/Dockerfiles/unbound/docker-entrypoint.sh
+++ b/data/Dockerfiles/unbound/docker-entrypoint.sh
@@ -1,8 +1,11 @@
 #!/bin/bash
 
+echo "Setting console permissions..."
+chown root:tty /dev/console
+chmod g+rw /dev/console
 echo "Receiving anchor key..."
 /usr/sbin/unbound-anchor -a /etc/unbound/trusted-key.key
 echo "Receiving root hints..."
 curl -#o /etc/unbound/root.hints https://www.internic.net/domain/named.cache
-
+/usr/sbin/unbound-control-setup
 exec "$@"
diff --git a/data/conf/unbound/unbound.conf b/data/conf/unbound/unbound.conf
index b3c77671..6d7f1f04 100644
--- a/data/conf/unbound/unbound.conf
+++ b/data/conf/unbound/unbound.conf
@@ -2,7 +2,7 @@ server:
   verbosity: 1
   interface: 0.0.0.0
   interface: ::0
-  logfile: /dev/stdout
+  logfile: /dev/console
   do-ip4: yes
   do-ip6: yes
   do-udp: yes
@@ -27,3 +27,12 @@ server:
   hide-version: yes
   max-udp-size: 4096
   msg-buffer-size: 65552
+
+remote-control:
+    control-enable: yes
+    control-interface: 127.0.0.1
+    control-port: 8953
+    server-key-file: "/etc/unbound/unbound_server.key"
+    server-cert-file: "/etc/unbound/unbound_server.pem"
+    control-key-file: "/etc/unbound/unbound_control.key"
+    control-cert-file: "/etc/unbound/unbound_control.pem"