- name: copy private key
  copy:
    dest: '/etc/bind/keys/K{{ item.0 }}.+{{ "00{}".format(bind_dnssec[item.0][item.1].algorithm)[-3:] }}+{{ bind_dnssec[item.0][item.1].tag }}.private'
    content: '{{ bind_dnssec[item.0][item.1].private_key }}'
    owner: root
    group: bind
    mode: 0640
#  no_log: true
  with_nested:
    - '{{ bind_dnssec }}'
    - [ 'ksk', 'zsk' ]

- name: copy public key
  template:
    src: public.key.j2
    dest: '/etc/bind/keys/K{{ item.0 }}.+{{ "00{}".format(bind_dnssec[item.0][item.1].algorithm)[-3:] }}+{{ bind_dnssec[item.0][item.1].tag }}.key'
    owner: root
    group: bind
    mode: 0640
#  no_log: true
  with_nested:
    - '{{ bind_dnssec }}'
    - [ 'ksk', 'zsk' ]