# /etc/unbound/unbound.conf 关键片段
server:
    verbosity: 2
    log-queries: no
    # 用 statistics 接口而非逐条日志采集画像，开销更低
    statistics-interval: 60
    statistics-cumulative: yes

# collect_dns_profile.py
import requests, json
from collections import defaultdict

STATS = 'http://localhost:8953/stats'  # unbound-control 导出

def get_counters():
    return requests.get(STATS, timeout=5).json()

# 简化：维护一张 domain -> metrics 的表（可由 unbound 日志或自研计数器填充）
# 这里示意：从 /var/log/dns_query.log 解析
profiles = defaultdict(lambda: {'qps': 0.0, 'hits': 0, 'misses': 0,
                                 'ttl_p50': 0, 'ttl_p95': 0,
                                 'nx': 0, 'avg_ms': 0.0, 'hits_total': 0})

# 每行: ts|domain|code|ttl|ms|hit(0/1)
with open('/var/log/dns_query.log') as f:
    lines = [l for l in f.readlines()][-50000:]
for line in lines:
    ts, dom, code, ttl, ms, hit = line.strip().split('|')
    p = profiles[dom]
    p['hits_total'] += 1
    p['qps'] = p['hits_total'] / (7 * 86400)      # 7 天均值
    p['ttl_p50'] = max(p['ttl_p50'], int(ttl))
    p['avg_ms'] = (p['avg_ms'] + int(ms)) / p['hits_total']
    if code == '3':                                  # NXDOMAIN
        p['nx'] += 1
    if hit == '1':
        p['hits'] += 1
    else:
        p['misses'] += 1
    p['hit_rate'] = p['hits'] / p['hits_total'] if p['hits_total'] else 0

out = {d: {k: round(v, 3) for k, v in m.items()} for d, m in profiles.items()}
with open('data/dns_profiles.json', 'w') as f:
    json.dump(out, f, indent=2, ensure_ascii=False)
print(f"Profiled {len(out)} domains, hit-rate top3: "
      + ', '.join(sorted(out, key=lambda d: out[d]['hit_rate'], reverse=True)[:3]))

# llm_dns_policy.py
import json, requests

SYSTEM = """你是 DNS 解析性能专家。根据解析画像和业务标签，为每个域名输出：
1. dynamic_ttl: 建议的本地缓存 TTL（秒）。热域名/上游TTL短→适度放大(如 300-3600)；
   冷域名→保持上游TTL；失败域名(nx>0)→进 negative_cache。
2. negative_cache: 0/1。1 表示该域名失败多，应启用短负缓存(如 30-60s)。
3. egress: "local" | "upstream" | "anycast"。本地可自答的走 local；
   高频重复的走 anycast 收敛；其余 upstream。
4. reason: 一句话说明（≤30字）。
输出严格 JSON，不要 markdown。"""

with open('data/dns_profiles.json') as f:
    profiles = json.load(f)

# 附业务标签（示例）：标记哪些域名是业务关键（API 网关、对象存储、内部服务）
tagged = {
    d: {**p, 'business': tag}
    for d, p, tag in [
        ('api.internal.example.com', profiles.get('api.internal.example.com', {}), '内部API网关'),
        ('s3.example.com',           profiles.get('s3.example.com', {}), '对象存储'),
        ('pypi.org',                 profiles.get('pypi.org', {}), '包索引'),
        ('example-cdn.edge.com',     profiles.get('example-cdn.edge.com', {}), 'CDN'),
    ]
}

r = requests.post('http://localhost:11434/api/generate', json={
    'model': 'qwen2.5:7b',
    'prompt': f"{SYSTEM}\n\n数据：\n{json.dumps(tagged, ensure_ascii=False)}\n\n输出："
}, timeout=120)
resp = r.json()['response'].strip()
policy = json.loads(resp[resp.index('{'):])
with open('data/dns_policy.json', 'w') as f:
    json.dump(policy, f, indent=2, ensure_ascii=False)
print(json.dumps(policy, ensure_ascii=False, indent=2))

{
  "api.internal.example.com": {"dynamic_ttl": 3600, "negative_cache": 0,
                               "egress": "local",   "reason": "内部API，A记录固定，长缓存"},
  "s3.example.com":           {"dynamic_ttl": 300,  "negative_cache": 0,
                               "egress": "anycast", "reason": "高频重复，收敛到anycast"},
  "pypi.org":                 {"dynamic_ttl": 60,   "negative_cache": 1,
                               "egress": "upstream", "reason": "索引更新快，短TTL+负缓存"}
}

# apply_unbound_policy.py
import json

with open('data/dns_policy.json') as f:
    policy = json.load(f)

lines = []
for dom, p in policy.items():
    zone = dom.rstrip('.')
    # 热域名 + 内部记录固定 → 用 local-zone 直接覆盖 TTL（local 可自答，不再出站）
    if p['egress'] == 'local':
        lines.append(f"local-zone: \"{zone}\" static")   # 配合 local-data 提供固定记录
    # 负缓存收紧：失败域名短负缓存，避免反复递归
    if p['negative_cache']:
        lines.append(f"# negative cache for {zone}")
        lines.append(f"local-zone: \"{zone}\" nodefault")
    if p['egress'] == 'anycast':
        lines.append(f"# {zone} → egress 收敛到 anycast 上游")

with open('/etc/unbound/dynamic_local_zones.conf', 'w') as f:
    f.write("\n".join(lines) + "\n")
print(f"Wrote {len(lines)} directive lines to dynamic_local_zones.conf")

# /etc/unbound/unbound.conf 补充
server:
    cache-max-size: 64            # MB，按需调大
    negative-cache-ttl: 30        # 全局默认短负缓存
    edns-ttl-enable: yes
    # egress 收敛：把重复递归合并，优先选延迟最低的上游
    prefer-system-time: yes
remote-control:
    control-enable: yes

# dns_metrics.py（暴露给 Prometheus 抓取）
import requests

def snap():
    s = requests.get('http://localhost:8953/stats', timeout=5).json()
    return {
        'unbound_cache_hits': s.get('cache_hits', 0),
        'unbound_cache_misses': s.get('cache_misses', 0),
        'unbound_total_queries': s.get('total_queries', 0),
        'unbound_recursive_qps': s.get('num_recursive_described', 0),
    }

# dns_report.py
def estimate(before, after):
    bh = before['cache_hits'] / max(before['cache_hits'] + before['cache_misses'], 1)
    ah = after['cache_hits'] / max(after['cache_hits'] + after['cache_misses'], 1)
    egress_drop = (1 - after['recursive_qps'] / max(before['recursive_qps'], 1)) * 100
    return bh, ah, egress_drop