$OpenBSD: README,v 1.2 2017/07/05 17:03:58 jasper Exp $

+-----------------------------------------------------------------------
| Running opendnssec-1.4.14-sqlite3 on OpenBSD
+-----------------------------------------------------------------------

Getting started
===============
This is a summary of steps needed to get OpenDNSSEC up and running in a
basic state using SoftHSM as the key backend. Make sure you have
installed the softhsm package before proceeding.

Initial setup of SoftHSM
------------------------
Configure SoftHSM to store its token in
/var/opendnssec/softhsm/:
# vi /etc/softhsm.conf

Initialize the SoftHSM token (here assuming you used slot 0).
The user PIN code has to match the <PIN> configured in
/etc/opendnssec/conf.xml:
# softhsm --init-token --slot 0 --label OpenDNSSEC

Make sure the token is writeable by the _opendnssec user:
# chown _opendnssec /var/opendnssec/softhsm/slot0.db

Bootstrapping OpenDNSSEC
------------------------
Create an initial KASP database (if you are running the mysql flavor you
will first need to configure mariadb-server and modify <Datastore> in
/etc/opendnssec/conf.xml):
# ods-ksmutil setup

Start the OpenDNSSEC system:
# rcctl start opendnssec

Copy an unsigned zone file into the unsigned/ directory:
# cp <somewhere>/example.com /var/opendnssec/unsigned/

Add the zone:
# ods-ksmutil zone add --zone example.com --policy default

Notify the enforcer of the updated database:
# ods-control enforcer notify

You now have a signed version of example.com in the signed/ directory:
# cat /var/opendnssec/signed/example.com

List the keys for the zone:
# ods-ksmutil key list -v
