From e40e0be43a85cb1f68ee829675fd8db33ca552ab Mon Sep 17 00:00:00 2001 From: Ximon Eighteen <3304436+ximon18@users.noreply.github.com> Date: Mon, 3 Aug 2026 06:40:23 +0200 Subject: [PATCH] Document the default values for `keyset set` subcommands. (#184) --- doc/manual/build/man/dnst-keyset.1 | 60 ++++++++++++++++++++------- doc/manual/source/man/dnst-keyset.rst | 50 ++++++++++++++++++---- 2 files changed, 86 insertions(+), 24 deletions(-) diff --git a/doc/manual/build/man/dnst-keyset.1 b/doc/manual/build/man/dnst-keyset.1 index 4931353..e17fb84 100644 --- a/doc/manual/build/man/dnst-keyset.1 +++ b/doc/manual/build/man/dnst-keyset.1 @@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. -.TH "DNST-KEYSET" "1" "May 15, 2026" "0.2.0-alpha2" "dnst" +.TH "DNST-KEYSET" "1" "Jul 31, 2026" "0.2.0-alpha3" "dnst" .SH NAME dnst-keyset \- Manage DNSSEC signing keys for a domain .SH SYNOPSIS @@ -35,7 +35,7 @@ dnst-keyset \- Manage DNSSEC signing keys for a domain \fBdnst keyset\fP \fB\-c \fP \fB[OPTIONS]\fP \fB\fP \fB[ARGS]\fP .SH DESCRIPTION .sp -The \fBkeyset\fP subcommand manages a set of DNSSEC (\fI\%RFC 9364\fP) signing keys +The \fBkeyset\fP subcommand manages a set of DNSSEC (\X'tty: link https://www.rfc-editor.org/rfc/rfc9364'\fI\%RFC 9364\fP\X'tty: link') signing keys and generates a signed DNSKEY RRset. This subcommand is meant to be part of a DNSSEC signing solution. A separate zone signer (not part of dnst) is expected to use the zone @@ -712,22 +712,29 @@ use\-csk .sp When true, new keys will be created as CSK otherwise a KSK and a ZSK will be created. +.sp +Default: \fBfalse\fP\&. .IP \(bu 2 autoremove .sp When true, keys that are stale will be removed automatically. +.sp +Default: \fBfalse\fP\&. .IP \(bu 2 autoremove\-delay .sp Set the delay between the time keys become stale and automatic removal. +.sp +Default: 7 days. .IP \(bu 2 algorithm .sp Set the algorithm to be used when creating new keys. Supported values -are RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, -and ED448. -Not all values are supported for KMIP keys. +are \fBRSASHA256\fP, \fBRSASHA512\fP, \fBECDSAP256SHA256\fP, \fBECDSAP384SHA384\fP, +\fBED25519\fP, and \fBED448\fP\&. Not all values are supported for KMIP keys. +.sp +Default: \fBECDSAP256SHA256\fP\&. .INDENT 2.0 .TP .B \-b @@ -736,13 +743,19 @@ For RSA keys, the length of the key in bits. .IP \(bu 2 ksk\-roll\-type .sp -The type of KSK roll to use. Possible values are double\-signature\-ksk\-roll -and double\-ds\-ksk\-roll. +The type of KSK roll to use. Possible values are +\fBdouble\-signature\-ksk\-roll\fP (RFC 7583 Double\-KSK) and +\fBdouble\-ds\-ksk\-roll\fP (RFC 7583 Double\-DS). +.sp +Default: \fBdouble\-signature\-ksk\-roll\fP\&. .IP \(bu 2 zsk\-roll\-type .sp -The type of ZSK roll to use. Possible values are pre\-publish\-zsk\-roll -and double\-signature\-zsk\-roll. +The type of ZSK roll to use. Possible values are \fBpre\-publish\-zsk\-roll\fP +(RFC 7583 Pre\-Publication) and \fBdouble\-signature\-zsk\-roll\fP (RFC 7583 +Double\-Signature). +.sp +Default: \fBpre\-publish\-zsk\-roll\fP\&. .IP \(bu 2 auto\-ksk, auto\-zsk, auto\-csk, auto\-algorithm .sp @@ -754,11 +767,13 @@ For example, \fBauto\-csk true false true false\fP means that CSK rolls will start automatically, that the propagation1\-complete, propagation2\-complete, and roll\-done need to be executed manually. The cache\-expired1 and cache\-expired2 steps are executed automatically. +.sp +Default: All arguments are set to \fBfalse\fP\&. .IP \(bu 2 ds\-algorithm .sp Set the hash algorithm to be used for generating DS records. -Possible values are \fBSHA\-256\fP and \fBSHA\-384\fP\&. +Possible values are \fBSHA\-256\fP and \fBSHA\-384\fP\&. Default: \fBSHA\-256\fP\&. .IP \(bu 2 dnskey\-lifetime , cds\-lifetime .sp @@ -766,7 +781,10 @@ When a DNSKEY RRset is signed (dnskey\-lifetime) or when CDS or CDNSKEY RRsets are signed (cds\-lifetime), how far in the future are the signatures set to expire. The duration is an integer followed by a suffix, \fBs\fP or \fBsecs\fP for -seconds, \fBm\fP or \fBmins\fP for minutes, \fBh\fP or \fBhours\fP, \fBd\fP or \fBdays\fP, \fBw\fP or \fBweeks\fP\&. +seconds, \fBm\fP or \fBmins\fP for minutes, \fBh\fP or \fBhours\fP, \fBd\fP or +\fBdays\fP, \fBw\fP or \fBweeks\fP\&. +.sp +Default: 4 weeks. .IP \(bu 2 dnskey\-remain\-time , cds\-remain\-time .sp @@ -776,6 +794,8 @@ to be valid. New signatures are generated when the remaining time drops below the specified duration. For the syntax of see \fBdnskey\-lifetime\fP\&. +.sp +Default: 2 weeks. .IP \(bu 2 dnskey\-inception\-offset , cds\-inception\-offset .sp @@ -784,6 +804,8 @@ or the CDS and CDNSKEY RRsets (cds\-inception\-offset), set the inception timestamp this amount in the past to compensate for clocks that are a bit off or in the wrong time zone. For the syntax of see \fBdnskey\-lifetime\fP\&. +.sp +Default: 1 day. .IP \(bu 2 ksk\-validity | \fBoff\fP, zsk\-validity | \fBoff\fP, csk\-validity | \fBoff\fP .sp @@ -797,6 +819,8 @@ next invocation of the cron command. .sp The status command shows which keys are no longer valid or when their validity will end. +.sp +Default: \fBoff\fP .IP \(bu 2 update\-ds\-command .sp @@ -804,6 +828,8 @@ Set a command to to run when the DS records in the parent zone need to be updated. This command can, for example, alert the operator or use an API provided by the parent zone to update the DS records automatically. +.sp +Default: None. .IP \(bu 2 tsig\-store\-path .sp @@ -833,8 +859,7 @@ base64 encoded secret. .INDENT 2.0 .INDENT 3.5 .sp -.nf -.ft C +.EX { \(dqversion\(dq: \(dqv1\(dq, \(dqmap\(dq: { @@ -844,10 +869,11 @@ base64 encoded secret. } } } -.ft P -.fi +.EE .UNINDENT .UNINDENT +.sp +Default: None. .IP \(bu 2 publication\-nameservers .sp @@ -863,12 +889,16 @@ arguments, each nameserver being one argument in the form: :[^] .UNINDENT .UNINDENT +.sp +Default: None. .IP \(bu 2 fake\-time .sp Set the \(aqwall clock\(aq time to be used for testing. The argument is either the Unix time as seconds since Epoch or the string \(aqoff\(aq to disable fake\-time. +.sp +Default: \fBoff\fP .UNINDENT .IP \(bu 2 show diff --git a/doc/manual/source/man/dnst-keyset.rst b/doc/manual/source/man/dnst-keyset.rst index aaa1774..62b579e 100644 --- a/doc/manual/source/man/dnst-keyset.rst +++ b/doc/manual/source/man/dnst-keyset.rst @@ -694,21 +694,28 @@ The keyset subcommand provides the following commands: When true, new keys will be created as CSK otherwise a KSK and a ZSK will be created. + Default: ``false``. + * autoremove When true, keys that are stale will be removed automatically. + Default: ``false``. + * autoremove-delay Set the delay between the time keys become stale and automatic removal. + Default: 7 days. + * algorithm Set the algorithm to be used when creating new keys. Supported values - are RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, - and ED448. - Not all values are supported for KMIP keys. + are ``RSASHA256``, ``RSASHA512``, ``ECDSAP256SHA256``, ``ECDSAP384SHA384``, + ``ED25519``, and ``ED448``. Not all values are supported for KMIP keys. + + Default: ``ECDSAP256SHA256``. .. option:: -b @@ -716,13 +723,19 @@ The keyset subcommand provides the following commands: * ksk-roll-type - The type of KSK roll to use. Possible values are double-signature-ksk-roll - and double-ds-ksk-roll. + The type of KSK roll to use. Possible values are + ``double-signature-ksk-roll`` (RFC 7583 Double-KSK) and + ``double-ds-ksk-roll`` (RFC 7583 Double-DS). + + Default: ``double-signature-ksk-roll``. * zsk-roll-type - The type of ZSK roll to use. Possible values are pre-publish-zsk-roll - and double-signature-zsk-roll. + The type of ZSK roll to use. Possible values are ``pre-publish-zsk-roll`` + (RFC 7583 Pre-Publication) and ``double-signature-zsk-roll`` (RFC 7583 + Double-Signature). + + Default: ``pre-publish-zsk-roll``. * auto-ksk, auto-zsk, auto-csk, auto-algorithm @@ -735,10 +748,12 @@ The keyset subcommand provides the following commands: propagation2-complete, and roll-done need to be executed manually. The cache-expired1 and cache-expired2 steps are executed automatically. + Default: All arguments are set to ``false``. + * ds-algorithm Set the hash algorithm to be used for generating DS records. - Possible values are ``SHA-256`` and ``SHA-384``. + Possible values are ``SHA-256`` and ``SHA-384``. Default: ``SHA-256``. * dnskey-lifetime , cds-lifetime @@ -746,7 +761,10 @@ The keyset subcommand provides the following commands: RRsets are signed (cds-lifetime), how far in the future are the signatures set to expire. The duration is an integer followed by a suffix, ``s`` or ``secs`` for - seconds, ``m`` or ``mins`` for minutes, ``h`` or ``hours``, ``d`` or ``days``, ``w`` or ``weeks``. + seconds, ``m`` or ``mins`` for minutes, ``h`` or ``hours``, ``d`` or + ``days``, ``w`` or ``weeks``. + + Default: 4 weeks. * dnskey-remain-time , cds-remain-time @@ -757,6 +775,8 @@ The keyset subcommand provides the following commands: specified duration. For the syntax of see ``dnskey-lifetime``. + Default: 2 weeks. + * dnskey-inception-offset , cds-inception-offset When generating signatures for the DNSKEY RRset (dnskey-inception-offset) @@ -765,6 +785,8 @@ The keyset subcommand provides the following commands: bit off or in the wrong time zone. For the syntax of see ``dnskey-lifetime``. + Default: 1 day. + * ksk-validity | ``off``, zsk-validity | ``off``, csk-validity | ``off`` Set how long a KSK, ZSK, or CSK is considered valid. @@ -778,6 +800,8 @@ The keyset subcommand provides the following commands: The status command shows which keys are no longer valid or when their validity will end. + Default: ``off`` + * update-ds-command Set a command to to run when the DS records in the parent zone need @@ -785,6 +809,8 @@ The keyset subcommand provides the following commands: This command can, for example, alert the operator or use an API provided by the parent zone to update the DS records automatically. + Default: None. + * tsig-store-path Set the path to a TSIG key store file to use. @@ -814,6 +840,8 @@ The keyset subcommand provides the following commands: } } + Default: None. + * publication-nameservers Set the nameservers to transfer from when checking a zone. @@ -826,12 +854,16 @@ The keyset subcommand provides the following commands: :[^] + Default: None. + * fake-time Set the 'wall clock' time to be used for testing. The argument is either the Unix time as seconds since Epoch or the string 'off' to disable fake-time. + Default: ``off`` + * show Show all configuration variables.