/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * SPDX-License-Identifier: MPL-2.0
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0.  If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

// NS8

{% if FEATURE_FIPS_DH == "1" %}
tls tls-forward-secrecy {
	protocols { TLSv1.2; };
	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
	prefer-server-ciphers yes;
	key-file "../CA/certs/srv01.crt01.example.com.key";
	cert-file "../CA/certs/srv01.crt01.example.com.pem";
	dhparam-file "../dhparam3072.pem";
};
{% endif %}

options {
	{% include_indented "_common/options.conf.j2" %}
	allow-transfer { any; };
	recursion no;
	dnssec-validation no;

{% if FEATURE_FIPS_DH == "1" %}
	tls-port @TLSPORT@;
	listen-on tls tls-forward-secrecy { 10.53.0.8; };
{% endif %}
};

{% include "_common/controls.conf.j2" %}

zone "ns2" {
	type secondary;
	primaries source @ns.ip@ { 10.53.0.2 port @PORT@; };
	file "ns2.db";
};

zone "ns2-4" {
	type secondary;
	primaries source @ns.ip@ { 10.53.0.2 port @PORT@; };
	file "ns2-4.db";
};

zone "ns2-4-5" {
	type secondary;
	primaries source @ns.ip@ { 10.53.0.2 port @PORT@; };
	file "ns2-4-5.db";
};

zone "ns2-4-6" {
	type secondary;
	primaries source @ns.ip@ { 10.53.0.2 port @PORT@; };
	file "ns2-4-6.db";
};

zone "ns2-5-7" {
	type secondary;
	primaries source @ns.ip@ { 10.53.0.2 port @PORT@; };
	file "ns2-5-7.db";
};

zone "ns5" {
	type secondary;
	primaries source @ns.ip@ { 10.53.0.2 port @PORT@; };
	file "ns5.db";
};

zone "ns5-6-7" {
	type secondary;
	primaries source @ns.ip@ { 10.53.0.2 port @PORT@; };
	file "ns5-6-7.db";
};

zone "ns5-7" {
	type secondary;
	primaries source @ns.ip@ { 10.53.0.2 port @PORT@; };
	file "ns5-7.db";
};

zone "ns6" {
	type secondary;
	primaries source @ns.ip@ { 10.53.0.2 port @PORT@; };
	file "ns6.db";
};