@%@UCRWARNING=# @%@

controls{
	inet 127.0.0.1
	allow { @%@dns/master/address@%@; };
};
options {
	tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";
	listen-on { any; };
@!@
dnssec_val = configRegistry.is_true('dns/sec/validation', True)
if not dnssec_val:
    print('\tdnssec-validation no;')
dns_allow_query = configRegistry.get('dns/allow/query')
if dns_allow_query:
    print('\tallow-query { %s; };' % dns_allow_query)

dns_allow_query_cache = configRegistry.get('dns/allow/query/cache')
if dns_allow_query_cache:
    print('\tallow-recursion { %s; };' % dns_allow_query_cache)
    print('\tallow-query-cache { %s; };' % dns_allow_query_cache)

dns_allow_transfer = configRegistry.get('dns/allow/transfer')
if dns_allow_transfer:
    print('\tallow-transfer { %s; };' % dns_allow_transfer)

val = 'any' if configRegistry.is_true('dns/ipv6', True) else 'none'
print('\tlisten-on-v6 { %s; };' % val)
@!@};

logging {
	category default{ default_syslog; };
	channel default_syslog {
		syslog daemon;		# send to syslog's daemon facility
		severity dynamic;	# log at the server's current debug level
	};
};


@!@
if configRegistry.get('dns/forwarder1') or configRegistry.get('dns/forwarder2') or configRegistry.get('dns/forwarder3'):
    print('\n# Found a forwarder in ucr variables, using forwarder in zone ".".')
    print('# Ignoring any setting of dns/fakeroot.')
    print('zone "." {')
    print('\ttype forward;')
    print('\tforwarders {')
    if configRegistry['dns/forwarder1']:
        print('\t\t%s;' % configRegistry['dns/forwarder1'])
    if configRegistry['dns/forwarder2']:
        print('\t\t%s;' % configRegistry['dns/forwarder2'])
    if configRegistry['dns/forwarder3']:
        print('\t\t%s;' % configRegistry['dns/forwarder3'])
    print('\t};')
    print('};')
elif configRegistry.is_true('dns/fakeroot', True):
    print('\n# Found no forwarder in ucr variables.')
    print('# dns/fakeroot is either missing or set to True.')
    print('zone "." {')
    print('\ttype master;')
    print('\tfile "/etc/bind/db.root.fake";')
    print('};')
else:
    print('\n# Found no forwarder in ucr variables.')
    print('# dns/fakeroot is set to False.')
    print('# So setting a root zone "." of type "hint" with default root servers.')
    print('zone "." {')
    print('\ttype hint;')
    print('\tfile "/etc/bind/db.root";')
    print('};')
@!@

include "/etc/bind/local-predlz.conf.samba4";

@!@
# flake8: noqa
print('''dlz "samba4.zone" {
	database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_18.so -d %(dns/dlz/debug/level)s {
			/*
			 * update-policy {
			 * 		grant %(kerberos/realm)s ms-self * A AAAA;
			 * 		grant Administrator@%(kerberos/realm)s wildcard * A AAAA SRV CNAME;
			 * 		grant %(hostname)s$@%(domainname)s wildcard * A AAAA SRV CNAME;
			 * 	};
			 */

			/*
			 * the list of principals and what they can change is created
			 * dynamically by Samba, based on the membership of the domain controllers
			 * group. The provision just creates this file as an empty file.
			 */
			include /var/lib/samba/bind-dns/named.conf.update;

			/* we need to use check-names ignore so _msdcs A records can be created */
			check-names ignore;
		};
	";
};''' % configRegistry)  # noqa: E101
@!@

include "/etc/bind/local.conf.samba4";
