## Example configuration for supported OpenSSL DNSSEC signing options.

## Default zones, these should be present on all nameservers, except in rare
##  configuration cases
[[zones]]
zone = "localhost"
zone_type = "Primary"
file = "default/localhost.zone"

[[zones]]
zone = "0.0.127.in-addr.arpa"
zone_type = "Primary"
file = "default/127.0.0.1.zone"

[[zones]]
zone = "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
zone_type = "Primary"
file = "default/ipv6_1.zone"

[[zones]]
zone = "255.in-addr.arpa"
zone_type = "Primary"
file = "default/255.zone"

[[zones]]
zone = "0.in-addr.arpa"
zone_type = "Primary"
file = "default/0.zone"

[[zones]]
## zone: this is the ORIGIN of the zone, aka the base name, '.' is implied on the end
zone = "example.com"

## zone_type: Primary, Secondary, Hint, Forward
zone_type = "Primary"

## file: this is relative to the directory above
file = "example.com.zone"

enable_dnssec = true

[[zones.keys]]
key_path = "../tests/test-data/test_configs/dnssec/rsa_2048.pem"
## the password used to encrypt/decrypt the file (must be PEM), blank for none
password = "123456"
## specify the algorithm
algorithm = "RSASHA256"
## this key should be used to sign the zone
is_zone_signing_key = true
## this key is authorized for dynamic update access to the zone via SIG0
# is_zone_update_auth = true
## create the key if it is not found
# create_if_absent = false

[[zones.keys]]
key_path = "../tests/test-data/test_configs/dnssec/rsa_2048.pem"
password = "123456"
algorithm = "RSASHA512"
is_zone_signing_key = true

[[zones.keys]]
key_path = "../tests/test-data/test_configs/dnssec/ecdsa_p256.pem"
# password = "123456"
algorithm = "ECDSAP256SHA256"
is_zone_signing_key = true

[[zones.keys]]
key_path = "../tests/test-data/test_configs/dnssec/ecdsa_p384.pem"
# password = "123456"
algorithm = "ECDSAP384SHA384"
is_zone_signing_key = true