Unbound listening on all interfaces

[Mohammed Naser]

By default, unbound is listening on all interfaces which means on a metal deployment with containers along side it, it will try to listen on the interface which is managed by dnsmasq-lxc and fail

[Benoît Knecht (benoit-knecht)]

It also makes deployments in Ubuntu 18.04 containers fail, because systemd-resolved is already listening on 127.0.0.53:53:

RUNNING HANDLER [unbound : Restart unbound] ***********************************************************************************************************************************************************************************************************************************************************************************
fatal: [controller-dc1r02n01_unbound_container-fbb6fb41]: FAILED! => {"changed": false, "msg": "Unable to restart service unbound: Job for unbound.service failed because the control process exited with error code.\nSee \"systemctl status unbound.service\" and \"journalctl -xe\" for details.\n"}
fatal: [controller-dc1r02n02_unbound_container-dcf7247c]: FAILED! => {"changed": false, "msg": "Unable to restart service unbound: Job for unbound.service failed because the control process exited with error code.\nSee \"systemctl status unbound.service\" and \"journalctl -xe\" for details.\n"}
fatal: [controller-dc1r02n03_unbound_container-b04165bc]: FAILED! => {"changed": false, "msg": "Unable to restart service unbound: Job for unbound.service failed because the control process exited with error code.\nSee \"systemctl status unbound.service\" and \"journalctl -xe\" for details.\n"}

root@controller-dc1r02n01-unbound-container-fbb6fb41:~# journalctl -eu unbound.service
Nov 27 16:06:42 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: Starting Unbound DNS server...
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 package-helper[1047]: /var/lib/unbound/root.key has content
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 package-helper[1047]: success: the anchor is ok
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 unbound[1051]: [1543334803] unbound[1051:0] error: can't bind socket: Address already in use fo
r 0.0.0.0
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 unbound[1051]: [1543334803] unbound[1051:0] fatal error: could not open ports
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: unbound.service: Main process exited, code=exited, status=1
/FAILURE
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: unbound.service: Failed with result 'exit-code'.
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: Failed to start Unbound DNS server.
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: unbound.service: Service hold-off time over, scheduling restart.
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: unbound.service: Scheduled restart job, restart counter is at 5.
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: Stopped Unbound DNS server.
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: unbound.service: Start request repeated too quickly.
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: unbound.service: Failed with result 'exit-code'.
Nov 27 16:06:43 controller-dc1r02n01-unbound-container-fbb6fb41 systemd[1]: Failed to start Unbound DNS...

[Jonathan Senecal (jsenecal)]

I encountered the same issue and fixed it by setting ```unbound_listen_interface: "{{ ansible_eth1.ipv4.address }}"``` in user_variables.yml as well to be able to install in Ubuntu 18.04 containers, because systemd-resolved was already listening on 127.0.0.53:53.

This is, I think, the only place where this issue is documented as I couldn't find any other workaround.

This needs to either:
a) be documented
b) have better default settings

[Antoine Thys (thystips)]

For me usage of ```unbound_listen_interface: "{{ ansible_eth1.ipv4.address }}"``` doesn't work. Instead you can use ```unbound_listen_interface: "{{ hostvars[inventory_hostname]['management_address'] }}"``` to listen on unbound container management interface (eth1).

[Dmitriy Rabotyagov (noonedeadpunk)]

Since Victoria you can use unbound_listen_interface: "{{ openstack_service_bind_address }}". I'm not sure what release you're running though.

[Dmitriy Rabotyagov (noonedeadpunk)]

So finally close this bug report, I've pushed PR:
https://github.com/noonedeadpunk/ansible-role-unbound/pull/9