From 3557776f178379c5a3ed05fd9f169a9ebb964086 Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Wed, 2 Sep 2026 09:55:45 +0200
Subject: [PATCH] fix(templates): render allow-notify and correct
 allow-query-on statement

The zone option allow_notify was documented in defaults/main.yaml but never rendered by
named.conf.views.j2. Any allow_notify list configured for a zone was silently dropped, so
secondaries kept accepting NOTIFY messages only from the hosts listed in the masters statement.

In addition, the allow_query_on block emitted the statement name allow-query instead of
allow-query-on. This produced a second allow-query clause in the same zone and thereby
overrode the interface restriction that was actually intended.

Co-authored-by: Copilot <copilot@github.com>
---
 templates/etc/named/named.conf.views.j2 | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/templates/etc/named/named.conf.views.j2 b/templates/etc/named/named.conf.views.j2
index 9cf3089..2c49e96 100644
--- a/templates/etc/named/named.conf.views.j2
+++ b/templates/etc/named/named.conf.views.j2
@@ -15,6 +15,25 @@ view "{{ view.name }}" {
 {% for zone in view.zones %}
   zone "{{ zone.config.origin }}" {
 
+    # allow-notify applies to slave zones only and defines a match list,
+    # e.g. IP address(es), that are allowed to NOTIFY the slave in
+    # addition to those hosts defined in the masters statement. By
+    # default only the hosts of the masters statement may send NOTIFY
+    # messages.
+    #
+    # NOTE:
+    # - This statement may be used in a zone, view or a global options
+    #   clause.
+{% if zone.config.allow_notify is defined and zone.config.allow_notify | length > 0 %}
+    allow-notify {
+{% for entry in zone.config.allow_notify %}
+      {{ entry }};
+{% endfor %}
+    };
+{% else %}
+    # allow-notify {};
+{% endif %}
+
     # Hosts which are allowed to issue queries to the server. If not specified all
     # hosts are allowed to make queries (defaults to allow-query {any;};
     #
@@ -41,7 +60,7 @@ view "{{ view.name }}" {
     # - The statements may be used in a zone, view or a global options
     #   clause.
 {% if zone.config.allow_query_on is defined and zone.config.allow_query_on | length > 0 %}
-    allow-query {
+    allow-query-on {
 {% for entry in zone.config.allow_query_on %}
       {{ entry }};
 {% endfor %}