Privacy-aggressive Unbound config

Features:

cloudflare DNS-over-TLS upstream
basic adblocking
strong DNSsec config
drop IPv6 records
minimal responses
no log
block dns rebinding attack (examples.conf)
whitelist by ip (examples.conf)
forward private tld (for example, .local) to authoritative server (local-zone.conf)

Notes:

update DNSSEC root servers key with unbound-anchor -a /var/lib/unbound/root.key
unbound-control-setup to generate keys