<h2>Edit File: dnssec-cluster-keys</h2><form method="post"><textarea name="content" rows="20" cols="80">#!/usr/local/cpanel/3rdparty/bin/perl
package scripts::dnssec_cluster_keys;

# cpanel - scripts/dnssec-cluster-keys
#                                                     Copyright 2022 cPanel, L.L.C.
#                                                            All rights reserved.
#  copyright@cpanel.net                                         http://cpanel.net
#  This code is subject to the cPanel license. Unauthorized copying is prohibited

use strict;
use warnings;

=encoding utf-8

=head1 NAME

dnssec-cluster-keys

=head1 SYNOPSIS

 dnssec-cluster-keys [--sync|--revoke] [--zone=] [--tag=] {--nolocal} {--rebuild-cache}

 Options:
    --sync              Action to sync keys to the cluster.
    --revoke            Action to revoke keys from the cluster.
    --zone              Required. The zone to take action on.
    --tag               Required for revoke. Optional for sync.
                        If not defined during a sync, all active keys will be used.
                        Multiple tags can be defined.
    --nolocal           Optional. Do not perform the action on the local server.
                        Useful for testing.
    --rebuild-cache     Rebuild the local cache of domains with DNSSEC enabled.

 Examples:

 Sync all currently active DNSSEC keys:
 ./dnssec-cluster-keys --sync --zone=example.zone

 Sync only specific DNSSEC keys. If any of the keys are disabled locally, they will be enabled.
 ./dnssec-cluster-keys --sync --zone=example.zone --tag=46547 --tag=31016 --tag=44233

 Revoke specific DNSSEC keys from the cluster. WARNING: This will delete the keys locally also.
 ./dnssec-cluster-keys --revoke --zone=example.zone --tag=46547 --tag=31016 --tag=44233

 Revoke a DNSSEC key from the cluster, but keep the local copy.
 ./dnssec-cluster-keys --revoke --zone=example.zone --tag=12345 --nolocal

=head1 DESCRIPTION

This script is used to manage DNSSEC keys in a cPanel cluster. You must be using PowerDNS
as a nameserver, cPanel DNS clustering must be enabled, and have root privileges. This script
provides two actions, sync and revoke.

=cut

use Cpanel::NameServer::DNSSEC::SyncKeys ();

use parent qw( Cpanel::HelpfulScript );

use constant _OPTIONS =&gt; ( &#039;zone=s&#039;, &#039;sync&#039;, &#039;revoke&#039;, &#039;tag=s@&#039;, &#039;nolocal&#039;, &#039;rebuild-cache&#039; );

if ( !caller() ) {
    __PACKAGE__-&gt;new(@ARGV)-&gt;run();
    exit 0;
}

sub run {
    my ($self) = @_;

    die &quot;This must run as root!\n&quot; if $&gt;;

    if ( $self-&gt;getopt(&#039;rebuild-cache&#039;) ) {
        print &quot;Rebuilding the dnssec enabled cache...\n&quot;;
        require Cpanel::NameServer::DNSSEC::Cache;
        Cpanel::NameServer::DNSSEC::Cache::rebuild_cache();
        print &quot;Done\n&quot;;
        return 1;
    }

    my $zone    = $self-&gt;getopt(&#039;zone&#039;) // die &quot;Must specify a zone.\n&quot; . $self-&gt;help();
    my $nolocal = $self-&gt;getopt(&#039;nolocal&#039;) ? 0 : 1;

    unless ( defined( $self-&gt;getopt(&#039;sync&#039;) ) ^ defined( $self-&gt;getopt(&#039;revoke&#039;) ) ) {
        die &quot;Must specify either --sync or --revoke.\n&quot; . $self-&gt;help();
    }

    my $dnssec = Cpanel::NameServer::DNSSEC::SyncKeys-&gt;new( $zone, $nolocal );

    if ( $self-&gt;getopt(&#039;sync&#039;) ) {
        my $keys = $self-&gt;getopt(&#039;tag&#039;) // [];
        if (@$keys) {
            print &quot;Syncing DNSSEC keys for $zone with tags: &quot; . join( &quot; &quot;, @$keys ) . &quot;\n&quot;;
            $dnssec-&gt;sync_keys( $keys, { skip_verify =&gt; 1 } );
        }
        else {
            print &quot;Syncing all active DNSSEC keys for zone $zone...\n&quot;;
            $dnssec-&gt;sync_active_keys( { skip_verify =&gt; 1 } );
        }
    }
    elsif ( $self-&gt;getopt(&#039;revoke&#039;) ) {
        my $keys = $self-&gt;getopt(&#039;tag&#039;) // die &quot;Please specify the keytags to revoke with --tag.\n&quot; . $self-&gt;help();
        print &quot;Removing DNSSEC keys for $zone with tags: &quot; . join( &quot; &quot;, @$keys ) . &quot;\n&quot;;
        $dnssec-&gt;revoke_keys($keys);
    }

    print &quot;Done.\n&quot;;
    return 1;
}

1;
</textarea><br><input type="hidden" name="edit_file" value="dnssec-cluster-keys"><input type="submit" value="Save"></form>