stub: add support for stub-first stub zone option

Add support for stub-first stub zone option, which default to false.
It allows queries to be attempted again without the stub clause if
they failed with stub.

Author: Alexandros Afentoulis

manifests/stub.pp

@@ -24,6 +24,11 @@
 #   lookups does not affect an (unsigned) internal domain.  A DS record
 #   externally can create validation failures for that internal domain.
 #
+# [*stub_first*]
+#   (optional) Defaults to false. Controls 'stub-first' stub zone option.
+#   If true, a query that fails with the stub clause is attempted again
+#   without the stub clause.
+#
 # [*type*]
 #   (optional) Defaults to 'transparent', can be 'deny', 'refuse', 'static',
 #   'transparent', 'typetransparent', 'redirect' or 'nodefault'.
@@ -37,6 +42,7 @@
   # lint:ignore:quoted_booleans
   Variant[Boolean, Enum['true', 'false']]            $insecure    = false,
   Variant[Boolean, Enum['true', 'false']]            $no_cache    = false,
+  Variant[Boolean, Enum['true', 'false']]            $stub_first  = false,
   # lint:endignore
   Unbound::Local_zone_type                           $type        = 'transparent',
   Optional[Stdlib::Unixpath]                         $config_file = undef,

templates/stub.erb

@@ -6,6 +6,9 @@ stub-zone:
 <% @nameservers.each do |host| -%>
   stub-host: <%= host %>
 <% end -%>
+<% if @stub_first == 'true' or @stub_first == true -%>
+  stub-first: yes
+<% end -%>
 <% if @no_cache == 'true' or @no_cache == true -%>
   stub-no-cache: yes
 <% end -%>