Mostly so I remember what I did. Someone might also want it.
- fetch.sh pulls three hosts lists, strips comments, dedupes with sort -u
- writes /etc/unbound/blocklist.conf as local-zone lines
- runs nightly from root's crontab, then unbound-control reload
- allowlist.txt gets removed with grep -vxFf before writing
Not done:
- nothing validates the download, a truncated list would just apply. Should refuse if line count drops by more than half
- no logging of what got blocked
- my partner's work VPN does not like it, and I've just been turning it off when asked