From fa8404441ac0124878d52eaad07c0ac974a72fbc Mon Sep 17 00:00:00 2001
From: Ruben Herold <ruben@puettmann.net>
Date: Sun, 9 Aug 2026 22:01:25 +0200
Subject: dns: T9175: make PowerDNS security status poll opt-in

The PowerDNS recursor periodically polls secpoll.powerdns.com to check
for known security issues, but VyOS ships a patched/backported package
that is never updated in-place, so the check result is meaningless and
only produces log noise.

Add a new `service dns forwarding options security-poll-suffix` option,
disabled by default. Users who still want the check (e.g. against
PowerDNS' own poll domain, or a custom one) can opt back in.
---
 interface-definitions/service_dns_forwarding.xml.in | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/service_dns_forwarding.xml.in b/interface-definitions/service_dns_forwarding.xml.in
index 1cb1e4083..a316552bd 100644
--- a/interface-definitions/service_dns_forwarding.xml.in
+++ b/interface-definitions/service_dns_forwarding.xml.in
@@ -889,6 +889,22 @@
                       <multi/>
                     </properties>
                   </leafNode>
+                  <leafNode name="security-poll-suffix">
+                    <properties>
+                      <help>Domain suffix for the periodic PowerDNS security status poll (default: disabled)</help>
+                      <valueHelp>
+                        <format>secpoll.powerdns.com</format>
+                        <description>Use PowerDNS' own security status poll domain</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>txt</format>
+                        <description>Custom domain suffix to poll instead</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="fqdn"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
                 </children>
               </node>
               <tagNode name="zone-cache">
-- 
cgit v1.2.3