include "/etc/bind/acme.key";

options {
        directory "/var/cache/bind";

        listen-on port 53 { {{ hostvars['fw']['network']['bind']['ipv4']['server'] }}; };
        listen-on-v6 port 53 { {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}; };

        // Authoritative DNS setting
        allow-recursion { none; };
        allow-transfer { none; };
        allow-update { none; };

        dnssec-validation no;

        check-names master warn;
};

zone "{{ domain['internal'] }}." {
        type primary;
        file "/var/lib/bind/db.{{ domain['internal'] }}";
        notify yes;
        // ACME-01 challenge policy. It allows only TXT record of subdomain update.
        update-policy {
                grant acme-key subdomain {{ domain['internal'] }}. TXT;
        };
};

zone "{{ domain['public'] }}." {
        //split horizon dns
        type primary;
        file "/var/lib/bind/db.{{ domain['public'] }}";
        notify yes;
};

{% for net, zone in network['reverse_zone']['ipv4'].items() %}
zone "{{ zone }}" {
        type primary;
        file "/var/lib/bind/db.{{ net }}.ipv4.rev";
        notify yes;
};
{% endfor %}

{% for net, zone in network['reverse_zone']['ipv6'].items() %}
zone "{{ zone }}" {
        type primary;
        file "/var/lib/bind/db.{{ net }}.ipv6.rev";
        notify yes;
};
{% endfor %}

logging {
        channel default_log {
                stderr;
                severity info;
        };
        category default { default_log; };
        category config { default_log; };
        category queries { default_log; };
};