From caa3963c1bf21778234b35e8694644406e65e614 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vladimir.cunat@nic.cz>
Date: Mon, 27 May 2024 10:57:58 +0200
Subject: [PATCH] datamodel: unbreak `dnssec: false`

It was causing an incorrect Lua line
  trust_anchors.keep_removed =

Reported on gitter a couple days ago.
---
 NEWS                                                          | 4 ++++
 .../knot_resolver_manager/datamodel/templates/dnssec.lua.j2   | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/NEWS b/NEWS
index 6ed72b263..b07e8d904 100644
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,10 @@ Incompatible changes
   <https://www.knot-resolver.cz/documentation/latest/config-cache-predict.html>`_
   for more.
 
+Bugfixes
+--------
+- fix startup with `dnssec: false` (!1548)
+
 
 Knot Resolver 6.0.7 (2024-03-27)
 ================================
diff --git a/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2 b/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2
index 31a29beac..05d1fa688 100644
--- a/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2
+++ b/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2
@@ -26,8 +26,10 @@ modules.load('detect_time_skew')
 modules.unload('detect_time_skew')
 {% endif %}
 
+{% if cfg.dnssec.keep_removed %}
 -- dnssec.keep-removed
 trust_anchors.keep_removed = {{ cfg.dnssec.keep_removed }}
+{% endif %}
 
 {% if cfg.dnssec.refresh_time %}
 -- dnssec.refresh-time