# Cette configuration BIND est celle recommandée par Samba.org
# Elle diffère donc de la configuration Amon

acl transfer_acl {
%if %%getVar('ad_allow_transfer_network', None)
 %import IPy
   %set %%allowed_network = [IPy.IP('{}/{}'.format(ip, ip.ad_allow_transfer_netmask), make_net=True) for ip in %%getVar('ad_allow_transfer_network')]
 %if IPy.IP('0.0.0.0/0.0.0.0', make_net=True) in %%allowed_network
    any;
 %else
    %%custom_join(%%allowed_network, ';\n    ');
 %end if
%else
    none;
%end if
};

options {
	directory "/var/cache/bind";

	// If there is a firewall between you and nameservers you want
	// to talk to, you may need to fix the firewall to allow multiple
	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113

	// If your ISP provided one or more IP addresses for stable
	// nameservers, you probably want to use them as forwarders.
	// Uncomment the following block, and insert the addresses replacing
	// the all-0's placeholder.
%if not %%is_empty(%%adresse_ip_dns)
	forwarders {
%for %%variable_iter in %%adresse_ip_dns
                %%variable_iter;
%end for
	};
	forward only;
%end if

	dnssec-validation no;
	//dnssec-lookaside no;

%if %%activer_cookie_bind == 'non'
    send-cookie no;
%end if


	empty-zones-enable no;

	allow-query {any;};
	notify no;

	allow-transfer {transfer_acl;};

	auth-nxdomain yes;
%if %%activer_ipv6 == 'non'
	listen-on-v6 { none; };
%else
	listen-on-v6 { any; };
%end if
%if %%getVar('ad_ro_dc', 'non') == 'non'
	tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";

    # https://wiki.samba.org/index.php?title=BIND9_DLZ_DNS_Back_End&diff=prev&oldid=15767
    minimal-responses yes;
%end if
%if %%getVar('dns_moderate', 'non') == 'oui'
    response-policy { zone "safesearch"; };
%end if
};

