/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * SPDX-License-Identifier: MPL-2.0
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0.  If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

// NS5

key rndc_key {
	secret "1234abcd8765";
	algorithm hmac-sha256;
};

controls {
	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};

key "sha1" {
	algorithm "hmac-sha1";
	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
};

key "sha224" {
	algorithm "hmac-sha224";
	secret "hXfwwwiag2QGqblopofai9NuW28q/1rH4CaTnA==";
};

key "sha256" {
	algorithm "hmac-sha256";
	secret "R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY=";
};

dnssec-policy "test" {
	keys {
		csk key-directory lifetime 0 algorithm 14;
	};
};

options {
	query-source address 10.53.0.5;
	port @PORT@;
	pid-file "named.pid";
	listen-on { 10.53.0.5; };
	listen-on-v6 { none; };
	recursion no;
	dnssec-policy "none";
};

view "inherit" {
	match-clients { key "sha1"; };

	/* Inherit dnssec-policy 'none' */
	zone "inherit.inherit.unsigned" {
		type primary;
		file "inherit.inherit.unsigned.db";
	};

	/* Override dnssec-policy */
	zone "override.inherit.unsigned" {
		type primary;
		file "override.inherit.unsigned.db";
		inline-signing yes;
		dnssec-policy "default";
	};

	/* Unset dnssec-policy */
	zone "none.inherit.unsigned" {
		type primary;
		file "none.inherit.unsigned.db";
		dnssec-policy "none";
	};
};

view "override" {
	match-clients { key "sha224"; };
	dnssec-policy "default";

	/* Inherit dnssec-policy 'default' */
	zone "inherit.override.unsigned" {
		type primary;
		file "inherit.override.unsigned.db";
		inline-signing yes;
	};

	/* Override dnssec-policy */
	zone "override.override.unsigned" {
		type primary;
		file "override.override.unsigned.db";
		inline-signing yes;
		dnssec-policy "test";
	};

	/* Unset dnssec-policy */
	zone "none.override.unsigned" {
		type primary;
		file "none.override.unsigned.db";
		dnssec-policy "none";
	};
};

view "none" {
	match-clients { key "sha256"; };
	dnssec-policy "none";

	/* Inherit dnssec-policy 'none' */
	zone "inherit.none.unsigned" {
		type primary;
		file "inherit.none.unsigned.db";
	};

	/* Override dnssec-policy */
	zone "override.none.unsigned" {
		type primary;
		file "override.none.unsigned.db";
		inline-signing yes;
		dnssec-policy "test";
	};

	/* Unset dnssec-policy */
	zone "none.none.unsigned" {
		type primary;
		file "none.none.unsigned.db";
		dnssec-policy "none";
	};
};