/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * SPDX-License-Identifier: MPL-2.0
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0.  If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

// NS11


{% set managed_key = managed_key | default(False) %}
{% set accept_expired = accept_expired | default(False) %}
{% set multi_view = multi_view | default(False) %}

options {
	query-source address 10.53.0.4;
	notify-source 10.53.0.4;
	transfer-source 10.53.0.4;
	port @PORT@;
	pid-file "named.pid";
	listen-on { 10.53.0.4; };
	listen-on-v6 { none; };
	recursion yes;
	minimal-responses no;

	{% if accept_expired %}
		dnssec-accept-expired yes;
	{% endif %}

	{% if managed_key %}
		dnssec-validation auto;
	{% else %}
		dnssec-validation yes;
	{% endif %}

	disable-algorithms "digest-alg-unsupported.example." { ECDSAP384SHA384; };
	disable-ds-digests "digest-alg-unsupported.example." { "SHA384"; "SHA-384"; };
	disable-ds-digests "ds-unsupported.example." { "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
	disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
	disable-algorithms "z.secure.example." { ECDSAP256SHA256; };
	disable-algorithms "ent.secure.example." { ECDSAP256SHA256; };
};

{% if not managed_key %}
include "trusted.conf";
{% endif %}

key rndc_key {
	secret "1234abcd8765";
	algorithm @DEFAULT_HMAC@;
};

controls {
	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};

{% if multi_view %}
	view rec {
		match-recursive-only yes;
		recursion yes;
		dnssec-accept-expired yes;
		minimal-responses no;
		dnssec-validation yes;

		include "trusted.conf";

		zone "." {
			type hint;
			file "../../_common/root.hint";
		};

		zone secure.example {
			type static-stub;
			server-addresses { 10.53.0.4; };
		};

		zone insecure.secure.example {
			type static-stub;
			server-addresses { 10.53.0.4; };
		};
	};

	view auth {
		recursion no;
		allow-recursion { none; };
		dnssec-validation no;

		zone "." {
			type hint;
			file "../../_common/root.hint";
		};

		zone secure.example {
			type secondary;
			primaries { 10.53.0.3; };
		};

		zone insecure.secure.example {
			type secondary;
			primaries { 10.53.0.2; };
		};
	};
{% else %}
	zone "." {
		type hint;
		file "../../_common/root.hint";
	};
{% endif %}
