}
-- SERVER section
--- server.hostname
-hostname('{{ cfg.server.hostname }}')
-
-{% if cfg.server.nsid %}
--- server.nsid
-modules.load('nsid')
-nsid.name('{{ cfg.server.nsid }} ' .. worker.id)
-{% endif %}
-
-{% if cfg.server.webmgmt %}
--- server.webmgmt
-modules.load('http')
-http.config({
- tls = {{ 'true' if cfg.server.webmgmt.tls else 'false'}},
- {{ "cert = '"+cfg.server.webmgmt.cert_file+"'," if cfg.server.webmgmt.cert_file }}
- {{ "key = '"+cfg.server.webmgmt.key_file+"'," if cfg.server.webmgmt.key_file }}
-}, 'webmgmt')
-net.listen(
-{% if cfg.server.webmgmt.listen.ip %}
- '{{ cfg.server.webmgmt.listen.ip }}',
-{% elif cfg.server.webmgmt.listen.unix_socket %}
- '{{ cfg.server.webmgmt.listen.unix_socket }}',
-{% elif cfg.server.webmgmt.listen.interface %}
- net.{{ cfg.server.webmgmt.listen.interface }},
-{% endif %}
- {{ cfg.server.webmgmt.listen.port|string if cfg.server.webmgmt.listen.port else 'nil' }},
- { kind = 'webmgmt' })
-{% endif %}
+{% include "server.lua.j2" %}
-- NETWORK section
--- network.do-ipv4/6
-net.ipv4 = {{ 'true' if cfg.network.do_ipv4 else 'false' }}
-net.ipv6 = {{ 'true' if cfg.network.do_ipv6 else 'false' }}
-
--- network.out-interface-v4/v6
-{% if cfg.network.out_interface_v4 %}
-net.outgoing_v4('{{ cfg.network.out_interface_v4 }}')
-{% endif %}
-{% if cfg.network.out_interface_v6 %}
-net.outgoing_v6('{{ cfg.network.out_interface_v6 }}')
-{% endif %}
-
--- network.tcp-pipeline
-net.tcp_pipeline({{ cfg.network.tcp_pipeline }})
-
--- network.edns-keep-alive
-{% if cfg.network.edns_keep_alive %}
-modules.load('edns_keepalive')
-{% else %}
-modules.unload('edns_keepalive')
-{% endif %}
-
--- network.edns-buffer-size
-net.bufsize({{ cfg.network.edns_buffer_size.upstream.bytes() }}, {{ cfg.network.edns_buffer_size.downstream.bytes() }})
-
-{% if cfg.network.tls.cert_file and cfg.network.tls.key_file %}
--- network.tls
-net.tls('{{ cfg.network.tls.cert_file }}', '{{ cfg.network.tls.key_file }}')
-{% endif %}
-
-{% if cfg.network.tls.sticket_secret %}
--- network.tls.sticket-secret
-net.tls_sticket_secret('{{ cfg.network.tls.sticket_secret }}')
-{% endif %}
-
-{% if cfg.network.tls.sticket_secret_file %}
--- network.tls.sticket-secret-file
-net.tls_sticket_secret_file('{{ cfg.network.tls.sticket_secret_file }}')
-{% endif %}
-
-{% if cfg.network.tls.auto_discovery %}
--- network.tls.auto-discovery
-modules.load('experimental_dot_auth')
-{% else %}
--- modules.unload('experimental_dot_auth')
-{% endif %}
-
--- network.tls.padding
-net.tls_padding({{ cfg.network.tls.padding }})
-
--- network.interfaces
-{% for item in cfg.network.interfaces %}
-net.listen('{{ item.listen.ip }}', {{ item.listen.port }}, {
- kind = '{{ item.kind if item.kind != 'dot' else 'tls' }}',
- freebind = {{ 'true' if item.freebind else 'false'}}
-})
-{% endfor %}
+{% include "network.lua.j2" %}
-- OPTIONS section
-mode('{{ cfg.options.glue_checking }}')
-option('NO_MINIMIZE', {{ 'false' if cfg.options.qname_minimisation else 'true' }})
-option('ALLOW_LOCAL', {{ 'true' if cfg.options.query_loopback else 'false' }})
-option('REORDER_RR', {{ 'true' if cfg.options.reorder_rrset else 'false' }})
-option('NO_0X20', {{ 'false' if cfg.options.query_case_randomization else 'true' }})
-{{ "modules.unload('priming')" if not cfg.options.query_priming }}
-{{ "modules.unload('detect_time_jump')" if not cfg.options.time_jump_detection }}
-{{ "modules.unload('refuse_nord')" if not cfg.options.refuse_no_rd }}
+{% include "options.lua.j2" %}
-- STATIC-HINTS section
-{{ "hints.ttl("+cfg.static_hints.ttl.seconds()|string+")" if cfg.static_hints.ttl }}
-hints.use_nodata({{ 'true' if cfg.static_hints.no_data else 'false' }})
-{{ "hints.add_hosts()" if cfg.static_hints.etc_hosts }}
-{{ "hints.root_file('"+cfg.static_hints.root_hints_file+"')" if cfg.static_hints.root_hints_file }}
-
--- static-hints.hints-files
-{% if cfg.static_hints.hints_files %}
-{% for item in cfg.static_hints.hints_files %}
-hints.add_hosts('{{ item }}')
-{% endfor %}
-{% endif %}
-
--- static-hints.root-hints
-{% if cfg.static_hints.root_hints %}
-hints.root({
-{% for name, addrs in cfg.static_hints.root_hints.items() %}
-['{{ name }}'] = {
-{% for addr in addrs %}
- '{{ addr }}',
-{% endfor %}
- },
-{% endfor %}
-})
-{% endif %}
-
--- static-hints.hints
-{% if cfg.static_hints.hints %}
-{% for name, addrs in cfg.static_hints.hints.items() %}
-{% for addr in addrs %}
-hints.set('{{ name }} {{ addr }}')
-{% endfor %}
-{% endfor %}
-{% endif %}
-
--- POLICY section
-{{ path }}
+{% include "static_hints.lua.j2" %}
-- CACHE section
-cache.open({{ cfg.cache.size_max.bytes() }}, 'lmdb://{{ cfg.cache.storage }}')
-cache.min_ttl({{ cfg.cache.ttl_min.seconds() }})
-cache.max_ttl({{ cfg.cache.ttl_max.seconds() }})
-cache.ns_tout({{ cfg.cache.ns_timeout.millis() }})
-
--- cache.prefill
-{% if cfg.cache.prefill %}
-modules.load('prefill')
-prefill.config({
-{% for item in cfg.cache.prefill %}
- ['{{ item.domain }}'] = {
- url = '{{ item.url }}',
- interval = {{ item.refresh_interval.seconds() }}
- {{ "ca_file = '"+item.ca_file+"'," if item.ca_file }}
- }
-{% endfor %}
-})
-{% endif %}
+{% include "cache.lua.j2" %}
-- DNSSEC section
-{% if not cfg.dnssec %}
-trust_anchors.remove('.')
-{% endif %}
-
-{{ "modules.unload('ta_sentinel')" if not cfg.dnssec.trust_anchor_sentinel }}
-{{ "modules.unload('ta_signal_query')" if not cfg.dnssec.trust_anchor_signal_query }}
-{{ "modules.unload('detect_time_skew')" if not cfg.dnssec.time_skew_detection }}
-
-trust_anchors.keep_removed = {{ cfg.dnssec.keep_removed }}
-{{ "trust_anchors.refresh_time = "+cfg.dnssec.refresh_time.seconds()|string if cfg.dnssec.refresh_time }}
-
--- dnssec.trust-anchors
-{% if cfg.dnssec.trust_anchors %}
-{% for ta in cfg.dnssec.trust_anchors %}
-trust_anchors.add('{{ ta }}')
-{% endfor %}
-{% endif %}
-
--- dnssec.negative-trust-anchors
-{% if cfg.dnssec.negative_trust_anchors %}
-trust_anchors.set_insecure({
-{% for nta in cfg.dnssec.negative_trust_anchors %}
- '{{ nta }}',
-{% endfor %}
-})
-{% endif %}
-
--- dnssec.trust-anchors-files
-{% if cfg.dnssec.trust_anchors_files %}
-{% for taf in cfg.dnssec.trust_anchors_files %}
-trust_anchors.add_file('{{ taf.file }}', readonly = {{ 'true' if taf.read_only else 'false' }})
-{% endfor %}
-{% endif %}
+{% include "dnssec.lua.j2" %}
-- LOGGING section
-log_level('{{ cfg.logging.level }}')
-{{ "log_target('"+cfg.logging.target+"')" if cfg.logging.target }}
-{% if cfg.logging.groups %}
-log_groups({
-{% for g in cfg.logging.groups %}
-{% if g != "manager" %}
- '{{ g }}',
-{% endif %}
-{% endfor %}
-})
-{% endif %}
+{% include "logging.lua.j2" %}
{% endif %}
+
-- LUA section
{% if cfg.lua.script_file %}
{% import cfg.lua.script_file as script_file %}
--- /dev/null
+-- network.do-ipv4/6
+net.ipv4 = {{ 'true' if cfg.network.do_ipv4 else 'false' }}
+net.ipv6 = {{ 'true' if cfg.network.do_ipv6 else 'false' }}
+
+{% if cfg.network.out_interface_v4 %}
+-- network.out-interface-v4
+net.outgoing_v4('{{ cfg.network.out_interface_v4 }}')
+{% endif %}
+{% if cfg.network.out_interface_v6 %}
+-- network.out-interface-v6
+net.outgoing_v6('{{ cfg.network.out_interface_v6 }}')
+{% endif %}
+
+-- network.tcp-pipeline
+net.tcp_pipeline({{ cfg.network.tcp_pipeline }})
+
+-- network.edns-keep-alive
+{% if cfg.network.edns_keep_alive %}
+modules.load('edns_keepalive')
+{% else %}
+modules.unload('edns_keepalive')
+{% endif %}
+
+-- network.edns-buffer-size
+net.bufsize({{ cfg.network.edns_buffer_size.upstream.bytes() }}, {{ cfg.network.edns_buffer_size.downstream.bytes() }})
+
+{% if cfg.network.tls.cert_file and cfg.network.tls.key_file %}
+-- network.tls
+net.tls('{{ cfg.network.tls.cert_file }}', '{{ cfg.network.tls.key_file }}')
+{% endif %}
+
+{% if cfg.network.tls.sticket_secret %}
+-- network.tls.sticket-secret
+net.tls_sticket_secret('{{ cfg.network.tls.sticket_secret }}')
+{% endif %}
+
+{% if cfg.network.tls.sticket_secret_file %}
+-- network.tls.sticket-secret-file
+net.tls_sticket_secret_file('{{ cfg.network.tls.sticket_secret_file }}')
+{% endif %}
+
+{% if cfg.network.tls.auto_discovery %}
+-- network.tls.auto-discovery
+modules.load('experimental_dot_auth')
+{% else %}
+-- modules.unload('experimental_dot_auth')
+{% endif %}
+
+-- network.tls.padding
+net.tls_padding({{ cfg.network.tls.padding }})
+
+-- network.interfaces
+{% for item in cfg.network.interfaces %}
+net.listen('{{ item.listen.ip }}', {{ item.listen.port }}, {
+ kind = '{{ item.kind if item.kind != 'dot' else 'tls' }}',
+ freebind = {{ 'true' if item.freebind else 'false'}}
+})
+{% endfor %}
\ No newline at end of file
projects / thirdparty / knot-resolver.git / commitdiff
