{% from 'macros/common_macros.lua.j2' import boolean %}

{% if cfg.dnssec.enable %}

-- dnssec.logging-bogus
{% if cfg.dnssec.log_bogus %}
modules.load('bogus_log')
{% else %}
-- modules.unload('bogus_log')
{% endif %}

-- dnssec.sentinel
{% if cfg.dnssec.sentinel %}
modules.load('ta_sentinel')
{% else %}
modules.unload('ta_sentinel')
{% endif %}

-- dnssec.signal-query
{% if cfg.dnssec.signal_query %}
modules.load('ta_signal_query')
{% else %}
modules.unload('ta_signal_query')
{% endif %}

{% if cfg.dnssec.trust_anchors %}
-- dnssec.trust-anchors
{% for ta in cfg.dnssec.trust_anchors %}
trust_anchors.add('{{ ta }}')
{% endfor %}
{% endif %}

{% if cfg.dnssec.negative_trust_anchors %}
-- dnssec.negative-trust-anchors
trust_anchors.set_insecure({
{% for nta in cfg.dnssec.negative_trust_anchors %}
    '{{ nta }}',
{% endfor %}
})
{% endif %}

{% if cfg.dnssec.trust_anchors_files %}
-- dnssec.trust-anchors-files
{% for taf in cfg.dnssec.trust_anchors_files %}
trust_anchors.add_file('{{ taf.file }}', {{ boolean(taf.read_only) }})
{% endfor %}
{% endif %}

{% else %}

-- Disable DNSSEC
trust_anchors.remove('.')

{% endif %}
