datamodel/templates: fix `dnssec: false`

diff --git a/NEWS b/NEWS
index d17bc1f958daf6ba24e5c8531fffd4bdd910a12d..b9fd76c42543c4812650a71e1b35b04586f48382 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,11 @@
+Knot Resolver 6.0.13 (2025-05-dd)
+=================================
+
+Bugfixes
+--------
+- fix `dnssec: false` (!1687)
+
+
 Knot Resolver 6.0.12 (2025-04-24)
 =================================
 

diff --git a/python/knot_resolver/datamodel/templates/dnssec.lua.j2 b/python/knot_resolver/datamodel/templates/dnssec.lua.j2
index 05d1fa688667c74230e38fbc1aa3999e95f4f3b5..d6aed17157c6bf086a46c42af09eb3e985a387ea 100644 (file)
--- a/python/knot_resolver/datamodel/templates/dnssec.lua.j2
+++ b/python/knot_resolver/datamodel/templates/dnssec.lua.j2
@@ -3,7 +3,8 @@
 {% if not cfg.dnssec %}
 -- disable dnssec
 trust_anchors.remove('.')
-{% endif %}
+{% else %}
+
 
 -- options.trust-anchor-sentinel
 {% if cfg.dnssec.trust_anchor_sentinel %}
@@ -57,4 +58,7 @@ trust_anchors.set_insecure({
 {% for taf in cfg.dnssec.trust_anchors_files %}
 trust_anchors.add_file('{{ taf.file }}',  readonly = {{ boolean(taf.read_only) }})
 {% endfor %}
-{% endif %}
\ No newline at end of file
+{% endif %}
+
+
+{% endif %}{# cfg.dnssec #}