<main>
        daemon                      off
        chroot                      on
        logpath                     "/var/log/yadifa"
        pidfile                     "/run/yadifa/yadifad.pid"
        datapath                    "/var/lib/yadifa"
        keyspath                    "/var/lib/yadifa/keys"
        xfrpath                     "/var/lib/yadifa/xfr"
        # hostname                  "server-yadifad"
        # serverid                   "yadifad-01"
        # version                   "2.2.0"
        edns0-max-size              4096
        max-tcp-queries             100
        uid                         yadifa
        gid                         yadifa
        port                        53
        listen                      0.0.0.0
        statistics                  on
        queries-log-type            1
        answer-formerr-packets    off
        # axfr-maxrecordbypacket    0
        allow-query                 any
        allow-update                none
        allow-transfer              none
        allow-notify                none
        allow-control               controller
</main>
<nsid>
        ascii "ns1"
</nsid>
<control>
        enabled true
</control>
<rrl>
        enabled true
        log_only false
        responses_per_second 5
        errors_per_second 5
        window 15
        slip 2
        min_table_size 1024
        max_table_size 16384
        ipv4_prefix_length 24
#        ipv6_prefix_length 56
        exempted none
</rrl>
<channels>
        database    database.log    0644
        dnssec      dnssec.log      0644
        server      server.log      0644
        statistics  statistics.log  0644
        system      system.log      0644
        zone        zone.log        0644
        queries     queries.log     0644
        all         all.log         0644
        syslog      syslog          USER,CRON,PID
        stderr      STDERR
        stdout      STDOUT
</channels>
<loggers>
        database        EMERG,ALERT,CRIT,ERR,WARNING,NOTICE database,all
        dnssec          EMERG,ALERT,CRIT,ERR,WARNING,NOTICE dnssec,all
        server          EMERG,ALERT,CRIT,ERR,WARNING,NOTICE server,all
        stats           *                                   statistics
        system          EMERG,ALERT,CRIT,ERR,WARNING,NOTICE system,all
        zone            EMERG,ALERT,CRIT,ERR,WARNING,NOTICE zone,all
#        queries         *                                   queries
</loggers>
#include "keys.conf"
#<key>
#        name        master-slave
#        algorithm   hmac-md5
#        secret      MasterAndSlavesTSIGKey==
#</key>
#<acl>
#        transferer  key master-slave
#        admins      192.0.2.0/24, 2001:db8::74
#        master      192.0.2.53
#        controller  key abroad-admin-key
#</acl>
<acl>
         controller 127.0.0.0/8, ::1
</acl>
<zone>
        type                    master
        domain                  localhost
        file                    masters/localhost.zone
        allow-transfer          none
        allow-update            none
        allow-update-forwarding none
</zone>
<zone>
        type                    master
        domain                  0.0.127.in-addr.arpa
        file                    masters/0.0.127.in-addr.arpa.zone
        allow-transfer          none
        allow-update            none
        allow-update-forwarding none
</zone>
<zone>
        type                    master
        domain                  solipsists.org
        file                    masters/solipsists.org.zone
        allow-transfer          96.126.96.118,172.104.125.227,172.104.165.223,139.162.176.183,45.56.110.60,45.79.215.191,176.58.103.36,185.70.105.134,114.142.160.48,118.89.221.146,217.182.128.77,54.36.54.14,85.17.15.147,129.232.222.82,145.239.149.66,145.239.2.154,145.239.1.3,91.90.42.178,164.132.206.84,66.11.121.31,174.128.229.130,163.172.35.98,104.219.168.143,174.128.229.131,37.228.129.89
        allow-update            none
        allow-update-forwarding none
</zone>
<dnssec-policy>
    id                      "normal-policy"
    description             "Example of a policy with ZSK and KSK"
    denial                  "nsec3-fixed"
    key-suite               "zsk-1024"
    key-suite               "ksk-2048"
</dnssec-policy>
<key-suite>
    id                      "zsk-1024"
    key-template            "zsk-rsa-sha256-1024"
    key-roll                "monthly-diary"
</key-suite>
<key-suite>
    id                      "ksk-2048"
    key-template            "ksk-rsa-sha256-2048"
    key-roll                "yearly-diary"
</key-suite>
<key-template>
    id                  "zsk-rsa-sha512-1024"
    algorithm           RSASHA512
    size                1024
</key-template>
<key-template>
    id                  "zsk-rsa-sha512-2048"
    algorithm           RSASHA512
    size                2048
</key-template>
<key-template>
    id                  "zsk-rsa-sha256-1024"
    algorithm           RSASHA256
    size                1024
</key-template>
<key-template>
    id                  "zsk-rsa-sha256-2048"
    algorithm           RSASHA256
    size                2048
</key-template>
<key-template>
    id                  "ksk-rsa-sha512-1024"
    ksk                 1
    algorithm           RSASHA512
    size                1024
</key-template>
<key-template>
    id                  "ksk-rsa-sha512-2048"
    ksk                 1
    algorithm           RSASHA512
    size                2048
</key-template>
<key-template>
    id                  "ksk-rsa-sha256-1024"
    ksk                 1
    algorithm           RSASHA256
    size                1024
</key-template>
<key-template>
    id                  "ksk-rsa-sha256-2048"
    ksk                 1
    algorithm           RSASHA256
    size                2048
</key-template>
<denial>
    type NSEC3
    id            "nsec3-random"
    salt-length   32
    iterations    10
    optout        off
</denial>
<denial>
    type NSEC3
    id            "nsec3-fixed"
    salt          "BA5EBA11"      # if nsec3-resalting is off 
    iterations    5           # the number of additional times the hash function has been performe
    optout        off
</denial>
<key-roll>
    id                 "yearly-diary"
    generate            5          0           15                  6            *                 * # this year   (2016) 15/06 at 00:05
    publish             10         0           15                  6            *                 * #                             00:10
    activate            15         0           16                  6            *                 * #                    16/06 at 00:15
    inactive            15         0           17                  6            *                 * #             (2017) 17/06 at 00:15
    remove              15        11           18                  6            *                 * #             (2017) 18/06 at 11:15
</key-roll>
<key-roll>
    id                 "monthly-diary"
    generate            5          0           *                   *            tue               0 # 1 tuesday   of the month at 00:05
    publish             10         0           *                   *            tue               0 #                             00:10
    activate            15         0           *                   *            wed               0 # 1 wednesday of the month at 00:15
    inactive            15         0           *                   *            thu               0 # 1 thursday  of the month at 00:15
    remove              15        11           *                   *            fri               0 # 1 friday    of the month at 11:15
</key-roll>
<key-roll>
    id                 "weekly-diary"
    generate            25         0           *                   *            sun               * # every sunday of the month at 00:25
    publish             30         0           *                   *            sun               * #                           at 00:30
    activate            35         0           *                   *            sun               * #                           at 00:35
    inactive            35         0           *                   *            sun               * #                           at 00:35
    remove              35        11           *                   *            sun               * #                           at 11:35
</key-roll>
<key-roll>
    id                 "daily-diary"
    generate            5          0           *                   *            *               *   # at 00:05
    publish             10         0           *                   *            *               *   # at 00:10
    activate            15         0           *                   *            *               *   # at 00:15
    inactive            15         0           *                   *            *               *   # at 00:15
    remove              15        11           *                   *            *               *   # at 11:15
</key-roll>
<key-roll>
    id                 "hourly-diary"
    generate            1          *           *                   *            *                 *
    publish             5          *           *                   *            *                 *
    activate            10         *           *                   *            *                 *
    inactive            15         *           *                   *            *                 *
    remove              20         *           *                   *            *                 *
</key-roll>
<key-roll>
    id                 "half-hourly-diary"
    generate            0,30       *           *                   *            *                 *
    publish             1,31       *           *                   *            *                 *
    activate            2,32       *           *                   *            *                 *
    inactive            34,04      *           *                   *            *                 *
    remove              38,08      *           *                   *            *                 *
</key-roll>
<key-roll>
    id                  "insane-diary"
    generate   * * * * * *
    publish    * * * * * *
    activate   * * * * * *
    inactive   * * * * * *
    remove     * * * * * *
</key-roll>
<key-roll>
    id                  "monthly-relative"
    generate            +31d
    publish             +60
    activate            +120          
    inactive            +33d # must be bigger than generate, to avoid a gap
    remove              +1d
</key-roll>
<key-roll>
    id                  "insane-relative"
    generate            +60
    publish             +0
    activate            +0
    inactive            +60
    remove              +0
</key-roll>
<key-roll>
    id                  "less-insane-relative"
    generate            +120
    publish             +0
    activate            +0
    inactive            +160
    remove              +0
</key-roll>
