<?xml version="1.0" encoding="UTF-8"?>

<Configuration>

	<RepositoryList>

		<Repository name="SoftHSM">
			<Module>/usr/pkg/lib/softhsm/libsofthsm2.so</Module>
			<TokenLabel>OpenDNSSEC</TokenLabel>
			<PIN>1234</PIN>
			<SkipPublicKey/>
			<!--
			<AllowExtraction/>
			-->
		</Repository>

<!--
		<Repository name="sca6000">
			<Module>/usr/lib/libpkcs11.so</Module>
			<TokenLabel>Sun Metaslot</TokenLabel>
			<PIN>test:1234</PIN>
			<Capacity>255</Capacity>
			<RequireBackup/>
			<SkipPublicKey/>
		</Repository>
-->

	</RepositoryList>

	<Common>
		<Logging>
			<!-- Command line verbosity will overwrite configure file -->
			<Verbosity>3</Verbosity>
			<Syslog><Facility>local0</Facility></Syslog>
		</Logging>
		
		<PolicyFile>/usr/pkg/etc/opendnssec/kasp.xml</PolicyFile>
		<ZoneListFile>/usr/pkg/etc/opendnssec/zonelist.xml</ZoneListFile>
	</Common>

	<Enforcer>
<?xmlif if condition privdrop="user|group|both"?>		<Privileges>
<?xmlif fi?><?xmlif if condition privdrop="user|both"?>			<User></User>
<?xmlif fi?><?xmlif if condition privdrop="group|both"?>			<Group></Group>
<?xmlif fi?><?xmlif if condition privdrop="user|group|both"?>		</Privileges><?xmlif fi?>

		<Datastore><SQLite>/var/opendnssec/kasp.db</SQLite></Datastore>
		<!-- <ManualKeyGeneration/> -->
		<AutomaticKeyGenerationPeriod>P1Y</AutomaticKeyGenerationPeriod>
		<!-- <RolloverNotification>P14D</RolloverNotification> -->
		
		<!-- the <DelegationSignerSubmitCommand> will get all current
		     DNSKEYs (as a RRset) on standard input (with optional CKA_ID) -->
		<!-- <DelegationSignerSubmitCommand>/usr/pkg/sbin/simple-dnskey-mailer.sh</DelegationSignerSubmitCommand> -->

		<WorkingDirectory>/var/opendnssec/enforcer</WorkingDirectory>

		<!--<WorkerThreads>4</WorkerThreads>-->
	</Enforcer>

	<Signer>
<?xmlif if condition privdrop="user|group|both"?>		<Privileges>
<?xmlif fi?><?xmlif if condition privdrop="user|both"?>			<User></User>
<?xmlif fi?><?xmlif if condition privdrop="group|both"?>			<Group></Group>
<?xmlif fi?><?xmlif if condition privdrop="user|group|both"?>		</Privileges><?xmlif fi?>

		<WorkingDirectory>/var/opendnssec/signer</WorkingDirectory>
		<WorkerThreads>4</WorkerThreads>
<!--
		<SignerThreads>4</SignerThreads>
-->

<!-- Multiple interfaces can be specified in the <Listener> section. OpenDNSSEC
     will bind() to the first interface. I.e. outgoing packets will have the
     source address of the first mentioned interface. -->
<!--
		<Listener>
			<Interface><Port>53</Port></Interface>
		</Listener>
-->

		<!-- the <NotifyCommmand> will expand the following variables:

		     %zone      the name of the zone that was signed
		     %zonefile  the filename of the signed zone
		-->
<!--
		<NotifyCommand>/usr/local/bin/my_nameserver_reload_command</NotifyCommand>
-->
<!--
		<NotifyCommand>/usr/sbin/rndc reload %zone</NotifyCommand>
-->
	</Signer>

</Configuration>
