@%@UCRWARNING=# @%@

controls{
	inet 127.0.0.1
	port 55555
	allow { 127.0.0.1; };
};
options {
	directory "/var/cache/bind";
	also-notify {
		127.0.0.1;
	};
	listen-on { any; };
	allow-transfer { 127.0.0.1; ::1; };
@!@
val = 'any' if configRegistry.is_true('dns/ipv6', True) else 'none'
print('\tlisten-on-v6 { %s; };' % val)
@!@};

logging {
	category default{ default_syslog; };
	channel default_syslog {
		syslog daemon;		# send to syslog's daemon facility
		severity dynamic;	# log at the server's current debug level
	};
};

include "/etc/bind/univention.conf";
include "/etc/bind/local.conf";

@!@
from urllib.parse import quote


def ldap_url(server, port, base, binddn, bindpw):
    return 'ldap://%s:%s/%s????!bindname=%s,!x-bindpw=%s,x-allow-xfr=true' % (
        server, port, base, quote(binddn), quote(bindpw),
    )


dns_backend = configRegistry.get('dns/backend', 'ldap')
if dns_backend == 'ldap':
    server = configRegistry.get('bind/ldap/server/ip', '127.0.0.1')
    port = configRegistry.get('ldap/server/port', '7389')
    ldap_base = configRegistry.get('ldap/base', '')
    base = configRegistry.get('dns/ldap/base', 'cn=dns,%s' % ldap_base if ldap_base else '')
    binddn = configRegistry.get('bind/binddn', configRegistry.get('ldap/hostdn', ''))
    pwfile = configRegistry.get('bind/bindpw', '/etc/machine.secret')
    ttl = configRegistry.get('dns/ldap/dlz/ttl', '172800')

    bindpw = ''
    try:
        with open(pwfile) as fd:
            bindpw = fd.readline().rstrip()
    except OSError:
        pass

    if base and binddn and bindpw:
        print('dlz "ucs-ldap" {')
        print('    database "dlopen /usr/lib/bind9/ucs-ldapdb.so %s %s";' % (ldap_url(server, port, base, binddn, bindpw), ttl))
        print('    search yes;')
        print('};')
    else:
        print('// dns/backend=ldap but bind credentials/base not yet configured;')
        print('// no DLZ block emitted. Re-run "ucr commit /etc/bind/named.conf" after join.')
@!@
