// NS5

{% include "_common/controls.conf.j2" %}

key "sha1" {
	algorithm "hmac-sha1";
	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
};

key "sha224" {
	algorithm "hmac-sha224";
	secret "hXfwwwiag2QGqblopofai9NuW28q/1rH4CaTnA==";
};

key "sha256" {
	algorithm "hmac-sha256";
	secret "R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY=";
};

dnssec-policy "test" {
	keys {
		csk key-directory lifetime 0 algorithm 14;
	};
};

options {
	query-source address 10.53.0.5;
	port @PORT@;
	pid-file "named.pid";
	listen-on { 10.53.0.5; };
	listen-on-v6 { none; };
	allow-transfer { any; };
	recursion no;
	dnssec-policy "none";
	dnssec-validation no;
};

view "inherit" {
	match-clients { key "sha1"; };

	/* Inherit dnssec-policy 'none' */
	zone "inherit.inherit.unsigned" {
		type primary;
		file "inherit.inherit.unsigned.db";
	};

	/* Override dnssec-policy */
	zone "override.inherit.unsigned" {
		type primary;
		file "override.inherit.unsigned.db";
		dnssec-policy "default";
	};

	/* Unset dnssec-policy */
	zone "none.inherit.unsigned" {
		type primary;
		file "none.inherit.unsigned.db";
		dnssec-policy "none";
	};
};

view "override" {
	match-clients { key "sha224"; };
	dnssec-policy "default";

	/* Inherit dnssec-policy 'default' */
	zone "inherit.override.unsigned" {
		type primary;
		file "inherit.override.unsigned.db";
	};

	/* Override dnssec-policy */
	zone "override.override.unsigned" {
		type primary;
		file "override.override.unsigned.db";
		dnssec-policy "test";
	};

	/* Unset dnssec-policy */
	zone "none.override.unsigned" {
		type primary;
		file "none.override.unsigned.db";
		dnssec-policy "none";
	};
};

view "none" {
	match-clients { key "sha256"; };
	dnssec-policy "none";

	/* Inherit dnssec-policy 'none' */
	zone "inherit.none.unsigned" {
		type primary;
		file "inherit.none.unsigned.db";
	};

	/* Override dnssec-policy */
	zone "override.none.unsigned" {
		type primary;
		file "override.none.unsigned.db";
		dnssec-policy "test";
	};

	/* Unset dnssec-policy */
	zone "none.none.unsigned" {
		type primary;
		file "none.none.unsigned.db";
		dnssec-policy "none";
	};
};
