#
# DNSSEC-Tools Configuration
#

#
# Settings for DNSSEC-Tools administration.
#
admin-email     dnssec-tools@example.com


#
# Paths to needed programs.  These may need adjusting for individual hosts.
#
keyarch		/usr/bin/keyarch
keygen		/opt/bind9.7/sbin/dnssec-keygen
rndc		/usr/sbin/rndc
zonecheck	/usr/sbin/named-checkzone
zonecheck-opts  -i local
zonesign	/usr/sbin/dnssec-signzone
rollchk		/usr/bin/rollchk
zonesigner	/usr/bin/zonesigner

#
# Settings for dnssec-keygen.
#
algorithm	rsasha1
ksklength	2048
zsklength	1024
random		/dev/urandom


;
; Settings for dnssec-signzone.
;
endtime		+2592000		# RRSIGs good for thirty days.

#
# Life-times for keys.  These defaults indicate how long a key has
# between roll-overs.  The values are measured in seconds.
#
# Sample values:
#	3600		1 hour
#	86400		1 day
#	604800		1 week
#	2592000		30-day month
#	7884000		13 weeks, 6 hours
#	15768000	1 half-year
#	31536000	1 year
#	94608000	3 years, 3 days
#
ksklife		60
zsklife	    2592000	
lifespan-max	94608000
lifespan-min	3600


#
# Settings that will be noticed by zonesigner.
#
# default_keyrec        output.krf
archivedir      /var/dnssec-tools/KEY-SAFE
entropy_msg	1
savekeys        1
kskcount	1
zskcount	1

#
# Settings for rollover-manager.
#
roll_loadzone	1
roll_logfile	/var/log/dnssec-tools/log-rollerd
roll_loglevel	info
roll_phasemsg	long
roll_sleeptime	60
# roll_username	some_user
zone_errors	3

log_tz		gmt

#
# GUI-usage flag.
#
usegui		0
