# secrets.conf.example -> /etc/knot/secrets.conf   (0640 root:knot)
#
# NEVER COMMIT THE RENDERED FILE. It is in .gitignore.
# Generate a secret with:  keymgr -t <keyname> hmac-sha256
#
# knot.conf includes this before every file that references these key ids.

key:
  - id: authortive-tsig            # DNS-1 <-> DNS-2 replication (AXFR/IXFR + NOTIFY)
    algorithm: hmac-sha256
    secret: REPLACE_ME

  - id: admin-tsig                 # read-only AXFR for CI drift-checking and admins
    algorithm: hmac-sha256
    secret: REPLACE_ME