{% for zone in item.zones %}

zone "{{ zone.name }}" {
{% filter indent(bind9_config_indent, true) %}
{% for key, value in zone.items() %}
{% set conf_key = key | replace('_', '-') %}

{% if key == 'name' %}
{# Skip name as it is in the zone header #}

{# --- COMPLEX BLOCKS --- #}
{% elif key == 'update_policy' %}
{% if value == 'local' %}
update-policy local;
{% else %}
update-policy {
{% filter indent(bind9_config_indent, true) %}
{% for policy in value %}
{{ policy.permission -}}
{{ ' ' + policy.identity -}}
{{ ' ' + policy.ruletype -}}
{{ ' ' + policy.name if policy.name is defined -}}
{{ ' ' + policy.types -}};
{% endfor %}
{% endfilter %}};
{% endif %}

{% elif key == 'sig_validity_interval' %}
sig-validity-interval
{{- (' ' + value.upper | string) }}
{{- (' ' + value.lower | string) if value.lower is defined and value.lower -}};

{% elif key in ['server_names', 'server_addresses'] %}
{{ conf_key }} {
{{ functions.simple_item_list(value) }}};

{% elif key in ['also_notify', 'primaries', 'parental_agents'] %}
{{ functions.parent_address_key_tls(conf_key, value) -}}

{% elif key == 'forwarders' %}
{{ functions.parent_address_port_dscp('forwarders', value) -}}

{% elif key == 'allow_transfer' and value is not string and value is mapping %}
allow-transfer
{{- (' port ' + value.port | string) if value.port is defined and value.port -}}
{{- (' transport ' + value.transport) if value.transport is defined and value.transport }} {
{{ functions.simple_item_list(value.addresses) }}};

{% elif key in ['transfer_source', 'transfer_source_v6', 'alt_transfer_source', 'alt_transfer_source_v6', 'notify_source', 'notify_source_v6', 'parental_source', 'parental_source_v6'] %}
{{ conf_key }} {{ value.address -}}
{{- (' port ' + value.port | string) if value.port is defined and value.port -}}
{{- (' dscp ' + value.dscp | string) if value.dscp is defined and value.dscp }};

{# --- SIMPLE LISTS --- #}
{% elif key in ['allow_notify', 'allow_query', 'allow_query_on', 'allow_update', 'allow_update_forwarding'] %}
{{ conf_key }} {
{{ functions.simple_item_list(value) }}};

{# --- BOOLEANS --- #}
{% elif key in ['check_integrity', 'check_sibling', 'check_wildcard', 'delegation_only', 'dnssec_dnskey_kskonly', 'dnssec_secure_to_insecure', 'inline_signing', 'ixfr_from_differences', 'multi_master', 'notify_to_soa', 'request_expire', 'request_ixfr', 'try_tcp_refresh', 'update_check_ksk', 'use_alt_transfer_source', 'zero_no_soa_ttl'] %}
{{ (functions.boolean_option(conf_key, value)) }}

{# --- BOOLEAN OR STRING --- #}
{% elif key in ['dialup', 'notify', 'zone_statistics'] %}
{{ conf_key }} {{ functions.boolean_or_string(value) }};

{# --- QUOTED STRINGS --- #}
{% elif key in ['file', 'journal', 'key_directory'] %}
{{ conf_key }} "{{ value }}";

{# --- DEPRECATED --- #}
{% elif key == 'auto_dnssec' %}
/* WARN: auto-dnssec is removed in BIND 9.20 */
{{ conf_key }} {{ value }};

{# --- FALLTHROUGH --- #}
{% else %}
{# Strict mode: Ignore unknown keys #}
{% endif %}

{% endfor %}
{% endfilter %}
};
{% endfor %}