{% set policy = policy | default("unsigning") %}

include "kasp.conf";
include "named.common.conf";

zone "step1.going-insecure.kasp" {
	type primary;
	file "step1.going-insecure.kasp.db";
	dnssec-policy @policy@;
};

{% if policy == "insecure" %}
zone "step2.going-insecure.kasp" {
	type primary;
	file "step2.going-insecure.kasp.db";
	dnssec-policy insecure;
};
{% endif %}

zone "step1.going-insecure-dynamic.kasp" {
	type primary;
	file "step1.going-insecure-dynamic.kasp.db";
	dnssec-policy @policy@;
	inline-signing no;
	allow-update { any; };
};

{% if policy == "insecure" %}
zone "step2.going-insecure-dynamic.kasp" {
	type primary;
	file "step2.going-insecure-dynamic.kasp.db";
	dnssec-policy insecure;
	inline-signing no;
	allow-update { any; };
};
{% endif %}
