f30747d10b
This adds a 'dnssec' parameter to the bind::zone define which causes the module to generate keys and sign the zone. Some caveats and breaking changes: 1) Existing non-signed zones will have to be manually moved and signed 2) Signed zones are treated as dynamic
36 lines
796 B
Plaintext
36 lines
796 B
Plaintext
|
|
# This file managed by puppet - changes will be lost
|
|
zone "<%= _domain %>" {
|
|
type <%= zone_type %>;
|
|
<%- if has_zone_file -%>
|
|
<%- if dnssec -%>
|
|
auto-dnssec maintain;
|
|
key-directory "<%= cachedir %>/<%= name %>";
|
|
file "<%= cachedir %>/<%= name %>/<%= _domain %>.signed";
|
|
<%- else -%>
|
|
file "<%= cachedir %>/<%= name %>/<%= _domain %>";
|
|
<%- end -%>
|
|
<%- end -%>
|
|
<%- if not masters.empty? -%>
|
|
masters {
|
|
<%- masters.each do |master| -%>
|
|
<%= master %>;
|
|
<%- end -%>
|
|
};
|
|
<%- end -%>
|
|
<%- if not allow_updates.empty? -%>
|
|
allow-update {
|
|
<%- allow_updates.each do |allow_update| -%>
|
|
<%= allow_update %>;
|
|
<%- end -%>
|
|
};
|
|
<%- end -%>
|
|
<%- if not allow_transfers.empty? -%>
|
|
allow-transfer {
|
|
<%- allow_transfers.each do |allow_transfer| -%>
|
|
<%= allow_transfer %>;
|
|
<%- end -%>
|
|
};
|
|
<%- end -%>
|
|
};
|