unbound: separate config and forwards