// NS5

{% set revoked_key = revoked_key | default(False) %}
{% set broken_key = broken_key | default(False) %}
{% set many_anchors = many_anchors | default(False) %}
options {
	query-source address 10.53.0.5;
	notify-source 10.53.0.5;
	transfer-source 10.53.0.5;
	port @PORT@;
	pid-file "named.pid";
	listen-on { 10.53.0.5; 127.0.0.1; };
	listen-on-v6 { none; };
	minimal-any no;
	recursion yes;
	minimal-responses no;
	servfail-ttl 0;

{% if many_anchors %}
	dnssec-validation yes;
	disable-algorithms "disabled.managed." { @DISABLED_ALGORITHM@; };
	disable-algorithms "disabled.trusted." { @DISABLED_ALGORITHM@; };
{% endif %}
};

key rndc_key {
	secret "1234abcd8765";
	algorithm @DEFAULT_HMAC@;
};

controls {
	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};

{% if revoked_key %}
	view root {
		match-destinations { 127.0.0.1; };
		dnssec-validation no;

		zone "." {
			type primary;
			file "root.db.signed";
		};
	};

	view other {
		dnssec-validation yes;
		include "revoked.conf";

		zone "." {
			type static-stub;
			server-addresses { 127.0.0.1; };
		};
	};
{% elif broken_key %}
	zone "." {
		type hint;
		file "../../_common/root.hint";
	};

	include "broken.conf";
{% elif many_anchors %}
	zone "." {
		type hint;
		file "../../_common/root.hint";
	};

	include "many-managed.conf";
	include "many-trusted.conf";
{% else %}
	zone "." {
		type hint;
		file "../../_common/root.hint";
	};

	include "trusted.conf";
{% endif %}
