On 12/10/16 19:06, Anand Buddhdev wrote: I just tested this, and discovered that an acl: declaration in the "zone" section does not add to acls in the template, but replaces them. Regards, Anand

On 13/10/16 09:22, Daniel Salzman wrote: Good morning Daniel, I do understand this, and it makes sense, of course. However, it can be a little confusing, because of the simpler YAML syntax that Knot 2 has adopted. For example, within a single template or zone element, multiple "acl:" lines are concatenated, eg: acl: one acl: two acl: three is the same as: acl: [ one, two, three ] However, acl: statements in the "zone" section do not add to acl: statements in the "template" section. That would make it impossible to override an ACL fully. So I do understand the logic, but it takes some thinking. Therefore, clearer documentation would help all users :) I still strongly wish that Knot 2 had adopted YAML fully, rather than partially. Now I have to remember every time that Knot's YAML is not the same as regular YAML, and I keep running into issues where Knot's config parser complains at me for using regular YAML syntax. Well, we're not quite there yet. We have one server running Knot 2 now: $ dig @ns1.cz-prg.k.ripe.net ch txt version.server +norec +short "Knot DNS 2" We will be observing this for a while, and once I'm happy that everything is fine, and I'm not observing any issues, we can do a phased upgrade across our entire Knot server cluster. Regards, Anand