Properly configure unbound to reply authoritatively

templates/nsd-satellite.conf.j2

@@ -3,6 +3,7 @@ zone:
   name: {{ zone.name }}.
   allow-notify: {{ star.vpn.address }} NOKEY
   request-xfr: AXFR {{ star.vpn.address }}@{{ star.nsd_port }} NOKEY
+  provide-xfr: 127.0.0.1 NOKEY
 {% endfor -%}
 
 # vim: set ft=yaml:

templates/nsd-star.conf.j2

@@ -6,6 +6,7 @@ zone:
   {% for satellite in satellites -%}
   notify: {{ satellite.vpn.address }}@{{ satellite.nsd_port }} NOKEY
   provide-xfr: {{ satellite.vpn.address }} NOKEY
+  provide-xfr: 127.0.0.1 NOKEY
   {% endfor %}
 
 {% endfor -%}

templates/unbound.conf.j2

@@ -23,11 +23,12 @@ server:
   {% if server.verbosity is defined -%}
   verbosity: {{ server.verbosity }}
   {% endif -%}
+  tls-win-cert: yes
 
   {% for zone in zones -%}
-  forward-zone:
+  auth-zone:
     name: {{ zone.name }}.
-    forward-addr: {{ server.nsd_addr }}@{{ server.nsd_port }}
+    master: {{ server.nsd_addr }}@{{ server.nsd_port }}
   {% endfor %}
 
 # vim: set syntax=yaml et sw=0 ts=2 sts=0: