datamodel: unbreak `dnssec: false`

It was causing an incorrect Lua line
  trust_anchors.keep_removed =

Reported on gitter a couple days ago.

diff --git a/NEWS b/NEWS
index 6ed72b2639156877a7fb179911a7384f5f6cc108..b07e8d904a4454546a9181bf1bc3a4c801a5aadc 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,10 @@ Incompatible changes
   <https://www.knot-resolver.cz/documentation/latest/config-cache-predict.html>`_
   for more.
 
+Bugfixes
+--------
+- fix startup with `dnssec: false` (!1548)
+
 
 Knot Resolver 6.0.7 (2024-03-27)
 ================================

diff --git a/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2 b/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2
index 31a29beac75b162ac36a69a40ffd0c8fa0003bc8..05d1fa688667c74230e38fbc1aa3999e95f4f3b5 100644 (file)
--- a/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2
+++ b/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2
@@ -26,8 +26,10 @@ modules.load('detect_time_skew')
 modules.unload('detect_time_skew')
 {% endif %}
 
+{% if cfg.dnssec.keep_removed %}
 -- dnssec.keep-removed
 trust_anchors.keep_removed = {{ cfg.dnssec.keep_removed }}
+{% endif %}
 
 {% if cfg.dnssec.refresh_time %}
 -- dnssec.refresh-time