I will update this for 2.8.0 over the coming weeks and will also add some more advanced patches, including the option to toggle IPv6 support in Unbound for those who prefer to force single stack either for troubleshooting or operational purposes.
These more advanced patches have multiple parts on my system, but will try to merge to one patch file for the wiki. Some of them actually add their own extra configuration variables stored in the pfsense xml for additional functionality.
I will also be adding a serve expired/serve stale toggle, I will try to submit this one to pfSense directly, but in the mean time it will be available as a custom patch. With the help of another kitz community member I did get the serve expired feature added to pfSense officially some years ago, however the next time pfSense does a Unbound update, it will be to a build which changes the default behaviour of serve expired to serve stale. The patch will add an option in the GUI to toggle between serve expired and serve stale (serve stale is really just a reliability option of using a expired cache entry if a DNS lookup fails, it will offer no performance benefit, whilst serve expired is a huge performance win).