#!/bin/sh
if [ "$(uci -q get openmptcprouter.settings.version)" = "" ]; then
	if [ "$(uci -q get unbound.@unbound[-1].listen_port | grep 5353)" = "" ]; then
		uci -q batch <<-EOF >/dev/null
			set unbound.@unbound[-1].listen_port=5353
			set unbound.@unbound[-1].protocol="ip4_only"
			set unbound.@unbound[-1].enabled=1
			set unbound.@unbound[-1].recursion="aggressive"
			set unbound.@unbound[-1].validator='1'
			set unbound.@unbound[-1].validator_ntp='1'
			del unbound.@unbound[-1].dns64_prefix
			del unbound.@unbound[-1].iface_wan
			del unbound.@unbound[-1].dhcp4_slaac6
			del unbound.@unbound[-1].query_minimize
			del unbound.@unbound[-1].query_min_strict
			commit unbound
		EOF
	fi
	if [ "$(uci -q show dhcp | grep 127.0.0.1#5353)" = "" ]; then
		uci -q batch <<-EOF >/dev/null
			add_list dhcp.@dnsmasq[-1].server="127.0.0.1#5353"
			add_list dhcp.@dnsmasq[-1].server="/lan/"
			commit dhcp
		EOF
	fi
fi
if [ -z "$(uci -q get unbound.ub_main)" ]; then
	uci -q batch <<-EOF >/dev/null
		rename unbound.@unbound[-1]=ub_main
		commit unbound
	EOF
fi
# Make unbound listen on loopback only
if [ -z "$(uci -q get unbound.ub_main.interface)" ]; then
	uci -q batch <<-EOF >/dev/null
		set unbound.ub_main.interface_auto='0'
		set unbound.ub_main.interface='loopback'
		commit unbound
	EOF
fi
# ub_main.dhcp_link: "unbound.ub_dhcp_link" is no section, and every upgrade
# deleted the user's unbound domain options again
if [ -z "$(uci -q get unbound.ub_main.dhcp_link)" ]; then
	uci -q batch <<-EOF >/dev/null
		set unbound.ub_main.dhcp_link='dnsmasq'
		del unbound.ub_main.domain_type
		del unbound.ub_main.add_local_fqdn
		del unbound.ub_main.add_wan_fqdn
		del unbound.ub_main.add_extra_dns
		commit unbound
	EOF

fi
if [ "$(uci -q show dhcp | grep 'use-application-dns.net')" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		add_list dhcp.@dnsmasq[-1].server="/use-application-dns.net/"
		commit dhcp
	EOF
fi

if [ "$(uci -q get dhcp.@dnsmasq[0].rebind_domain)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set dhcp.@dnsmasq[-1].noresolv=1
		set dhcp.@dnsmasq[-1].nonegcache=1
		del dhcp.@dnsmasq[-1].interface
		add_list dhcp.@dnsmasq[-1].rebind_domain="plex.direct"
		commit dhcp
	EOF
fi
if [ "$(uci -q get dhcp.@dnsmasq[0].dnsforwardmax)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set dhcp.@dnsmasq[-1].dnsforwardmax='1500'
		commit dhcp
	EOF
fi
# DHCP option 252 (WPAD) with an empty URL: clients don't go looking for a
# proxy auto-config. It checked "dhcp_options", which doesn't exist, and the
# batch line started with "uci", which batch rejects: the option was never
# set. Leave a 252 option the user set alone.
if [ -n "$(uci -q get dhcp.lan)" ]; then
	case " $(uci -q get dhcp.lan.dhcp_option) " in
		*" 252,"*) ;;
		*)
			uci -q batch <<-EOF >/dev/null
				add_list dhcp.lan.dhcp_option='252,"\n"'
				commit dhcp
			EOF
			;;
	esac
fi

if [ -n "$(uci -q get dhcp.@dnsmasq[0].server | grep 127.0.0.1)" ] && [ -z "$(uci -q get dhcp.@dnsmasq[0].server | grep 127.0.0.1#5353)" ]; then
	/etc/init.d/https-dns-proxy start
	/etc/init.d/https-dns-proxy enable
else
	/etc/init.d/https-dns-proxy stop
	/etc/init.d/https-dns-proxy disable
fi

#uci -q batch <<-EOF >/dev/null
#	set unbound.@unbound[-1].add_local_fqdn=0
#	set unbound.@unbound[-1].localservice=1
#	set unbound.@unbound[-1].rebind_localhost=0
#	set unbound.@unbound[-1].rebind_protection=1
#	set unbound.@unbound[-1].unbound_control=1
#	commit unbound
#EOF

if [ -z "$(uci -q show unbound.auth_icann)" ]; then
	uci -q batch <<-EOF >/dev/null
		del unbound.auth_icann
		set unbound.auth_icann=zone
		set unbound.auth_icann.fallback='1'
		set unbound.auth_icann.url_dir='https://www.internic.net/domain/'
		set unbound.auth_icann.zone_type='auth_zone'
		add_list unbound.auth_icann.server='lax.xfr.dns.icann.org'
		add_list unbound.auth_icann.server='iad.xfr.dns.icann.org'
		add_list unbound.auth_icann.zone_name='.'
		add_list unbound.auth_icann.zone_name='arpa.'
		add_list unbound.auth_icann.zone_name='in-addr.arpa.'
		add_list unbound.auth_icann.zone_name='ip6.arpa.'
		set unbound.auth_icann.enabled='1'
		del unbound.fwd_isp
		set unbound.fwd_isp=zone
		set unbound.fwd_isp.enabled='0'
		set unbound.fwd_isp.fallback='1'
		set unbound.fwd_isp.resolv_conf='1'
		set unbound.fwd_isp.zone_type='forward_zone'
		add_list unbound.fwd_isp.zone_name='isp-bill.example.com.'
		add_list unbound.fwd_isp.zone_name='isp-mail.example.net.'
		del unbound.fwd_google
		set unbound.fwd_google=zone
		set unbound.fwd_google.enabled='0'
		set unbound.fwd_google.fallback='1'
		set unbound.fwd_google.tls_index='dns.google'
		set unbound.fwd_google.tls_upstream='1'
		set unbound.fwd_google.zone_type='forward_zone'
		add_list unbound.fwd_google.server='8.8.4.4'
		add_list unbound.fwd_google.server='8.8.8.8'
		add_list unbound.fwd_google.server='2001:4860:4860::8844'
		add_list unbound.fwd_google.server='2001:4860:4860::8888'
		set unbound.fwd_google.zone_name='.'
		del unbound.fwd_cloudflare
		set unbound.fwd_cloudflare=zone
		set unbound.fwd_cloudflare.enabled='0'
		set unbound.fwd_cloudflare.fallback='1'
		set unbound.fwd_cloudflare.tls_index='cloudflare-dns.com'
		set unbound.fwd_cloudflare.tls_upstream='1'
		set unbound.fwd_cloudflare.zone_type='forward_zone'
		add_list unbound.fwd_cloudflare.server='1.1.1.1'
		add_list unbound.fwd_cloudflare.server='1.0.0.1'
		add_list unbound.fwd_cloudflare.server='2606:4700:4700::1111'
		add_list unbound.fwd_cloudflare.server='2606:4700:4700::1001'
		set unbound.fwd_cloudflare.zone_name='.'
	EOF
fi

if [ -z "$(uci -q get unbound.fwd_adguard_family)" ]; then
	uci -q batch <<-EOF >/dev/null
		set unbound.fwd_adguard_family=zone
		set unbound.fwd_adguard_family.enabled='0'
		set unbound.fwd_adguard_family.fallback='1'
		set unbound.fwd_adguard_family.tls_index='dns-family.adguard.com'
		set unbound.fwd_adguard_family.tls_upstream='1'
		set unbound.fwd_adguard_family.zone_type='forward_zone'
		add_list unbound.fwd_adguard_family.server='176.103.130.132'
		add_list unbound.fwd_adguard_family.server='176.103.130.134'
		set unbound.fwd_adguard_family.zone_name='.'
		set unbound.fwd_adguard_standard=zone
		set unbound.fwd_adguard_standard.enabled='0'
		set unbound.fwd_adguard_standard.fallback='1'
		set unbound.fwd_adguard_standard.tls_index='dns.adguard.com'
		set unbound.fwd_adguard_standard.tls_upstream='1'
		set unbound.fwd_adguard_standard.zone_type='forward_zone'
		add_list unbound.fwd_adguard_standard.server='176.103.130.130'
		add_list unbound.fwd_adguard_standard.server='176.103.130.131'
		set unbound.fwd_adguard_standard.zone_name='.'
		set unbound.fwd_cloudflare_family=zone
		set unbound.fwd_cloudflare_family.enabled='0'
		set unbound.fwd_cloudflare_family.fallback='1'
		set unbound.fwd_cloudflare_family.tls_index='family.cloudflare-dns.com'
		set unbound.fwd_cloudflare_family.tls_upstream='1'
		set unbound.fwd_cloudflare_family.zone_type='forward_zone'
		add_list unbound.fwd_cloudflare_family.server='1.1.1.3'
		add_list unbound.fwd_cloudflare_family.server='1.0.0.3'
		set unbound.fwd_cloudflare_family.zone_name='.'
		set unbound.fwd_cloudflare_malware=zone
		set unbound.fwd_cloudflare_malware.enabled='0'
		set unbound.fwd_cloudflare_malware.fallback='1'
		set unbound.fwd_cloudflare_malware.tls_index='security.cloudflare-dns.com'
		set unbound.fwd_cloudflare_malware.tls_upstream='1'
		set unbound.fwd_cloudflare_malware.zone_type='forward_zone'
		add_list unbound.fwd_cloudflare_malware.server='1.1.1.2'
		add_list unbound.fwd_cloudflare_malware.server='1.0.0.2'
		set unbound.fwd_cloudflare_malware.zone_name='.'
		set unbound.fwd_odvr=zone
		set unbound.fwd_odvr.enabled='0'
		set unbound.fwd_odvr.fallback='1'
		set unbound.fwd_odvr.tls_index='odvr.nic.cz'
		set unbound.fwd_odvr.tls_upstream='1'
		set unbound.fwd_odvr.zone_type='forward_zone'
		add_list unbound.fwd_odvr.server='193.17.47.1'
		add_list unbound.fwd_odvr.server='185.43.135.1'
		set unbound.fwd_odvr.zone_name='.'
		set unbound.fwd_libredns=zone
		set unbound.fwd_libredns.enabled='0'
		set unbound.fwd_libredns.fallback='1'
		set unbound.fwd_libredns.tls_index='doh.libredns.gr'
		set unbound.fwd_libredns.tls_upstream='1'
		set unbound.fwd_libredns.zone_type='forward_zone'
		add_list unbound.fwd_libredns.server='116.202.176.26'
		set unbound.fwd_libredns.zone_name='.'
		set unbound.fwd_quad9_recommended=zone
		set unbound.fwd_quad9_recommended.enabled='0'
		set unbound.fwd_quad9_recommended.fallback='1'
		set unbound.fwd_quad9_recommended.tls_index='dns.quad9.net'
		set unbound.fwd_quad9_recommended.tls_upstream='1'
		set unbound.fwd_quad9_recommended.zone_type='forward_zone'
		add_list unbound.fwd_quad9_recommended.server='9.9.9.9'
		add_list unbound.fwd_quad9_recommended.server='149.112.112.112'
		set unbound.fwd_quad9_recommended.zone_name='.'
		set unbound.fwd_quad9_unsecured=zone
		set unbound.fwd_quad9_unsecured.enabled='0'
		set unbound.fwd_quad9_unsecured.fallback='1'
		set unbound.fwd_quad9_unsecured.tls_index='dns10.quad9.net'
		set unbound.fwd_quad9_unsecured.tls_upstream='1'
		set unbound.fwd_quad9_unsecured.zone_type='forward_zone'
		add_list unbound.fwd_quad9_unsecured.server='9.9.9.10'
		add_list unbound.fwd_quad9_unsecured.server='149.112.112.10'
		set unbound.fwd_quad9_unsecured.zone_name='.'
		set unbound.fwd_quad9_ecs=zone
		set unbound.fwd_quad9_ecs.enabled='0'
		set unbound.fwd_quad9_ecs.fallback='1'
		set unbound.fwd_quad9_ecs.tls_index='dns11.quad9.net'
		set unbound.fwd_quad9_ecs.tls_upstream='1'
		set unbound.fwd_quad9_ecs.zone_type='forward_zone'
		add_list unbound.fwd_quad9_ecs.server='9.9.9.11'
		add_list unbound.fwd_quad9_ecs.server='149.112.112.11'
		set unbound.fwd_quad9_ecs.zone_name='.'
		set unbound.fwd_quad9_secured=zone
		set unbound.fwd_quad9_secured.enabled='0'
		set unbound.fwd_quad9_secured.fallback='1'
		set unbound.fwd_quad9_secured.tls_index='dns9.quad9.net'
		set unbound.fwd_quad9_secured.tls_upstream='1'
		set unbound.fwd_quad9_secured.zone_type='forward_zone'
		add_list unbound.fwd_quad9_secured.server='9.9.9.9'
		add_list unbound.fwd_quad9_secured.server='149.112.112.9'
		set unbound.fwd_quad9_secured.zone_name='.'
	EOF
fi

if [ -z "$(grep nameserver /etc/resolv.conf)" ]; then
	echo "nameserver 127.0.0.1" > /etc/resolv.conf
fi

if [ -z "$(grep unknown-server-time-limit /etc/unbound/unbound_srv.conf)" ]; then
	echo "unknown-server-time-limit: 2500" > /etc/unbound/unbound_srv.conf
fi
# A server unbound saw time out during an outage was left alone for
# infra-host-ttl (900 s): keep probing it, one query at a time
if ! grep -q "infra-keep-probing" /etc/unbound/unbound_srv.conf 2>/dev/null; then
	echo "infra-keep-probing: yes" >> /etc/unbound/unbound_srv.conf && _unbound_restart=1
fi

# Remote control on 127.0.0.1/::1 without certificates: dns_flush() in
# omr-tracker runs unbound-control after each WAN down and up, and with the
# package's 0 nothing was flushed. A 0 chosen by hand looks the same, so it
# is set only once: unbound_control_migrated keeps a later 0 from being undone
# by the next sysupgrade, which runs the uci-defaults again.
if [ -n "$(uci -q get unbound.ub_main)" ] && [ "$(uci -q get openmptcprouter.settings.unbound_control_migrated)" != "1" ]; then
	_unbound_control="$(uci -q get unbound.ub_main.unbound_control)"
	if [ -z "$_unbound_control" ] || [ "$_unbound_control" = "0" ]; then
		uci -q batch <<-EOF >/dev/null
			set unbound.ub_main.unbound_control='1'
			commit unbound
		EOF
		_unbound_restart=1
	fi
	uci -q batch <<-EOF >/dev/null
		set openmptcprouter.settings=settings
		set openmptcprouter.settings.unbound_control_migrated='1'
		commit openmptcprouter
	EOF
fi
[ "$_unbound_restart" = "1" ] && pidof unbound >/dev/null && /etc/init.d/unbound restart >/dev/null 2>&1

# Root KSK rollover of 2026-10-11: the root DNSKEY set is signed by KSK-2024
# (38696) only. The unbound package ships the 2017 anchors, and RFC 5011
# trusts a new key only 30 days after it first sees it: a router installed or
# reset less than 30 days before the rollover failed to validate the root and
# answered SERVFAIL for every name. Start again from the two anchors of IANA's
# root-anchors.xml, RFC 5011 tracking goes on from there.
if [ -f /etc/unbound/root.key ] && \
   ! grep -q "DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16" /etc/unbound/root.key && \
   ! grep -q "id = 38696 (ksk).*state=2 \[  VALID  \]" /etc/unbound/root.key; then
	# tmp + mv: a truncated root.key stops unbound
	cat > /etc/unbound/root.key.tmp <<-EOF
		. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
		. IN DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16
	EOF
	mv -f /etc/unbound/root.key.tmp /etc/unbound/root.key
	# unbound's start keeps a /var/lib copy that has VALID keys over the
	# /etc one
	rm -f /var/lib/unbound/root.key
	pidof unbound >/dev/null && /etc/init.d/unbound restart
fi

rm -f /tmp/luci-indexcache

exit 0
