net-dns/nsd: Add an ebuild for nsd-4.9.1 w/ many improvements

The ebuild for nsd-4.9.1 that includes a number of cleanups,
including adding in more USE flags to support additional switches
to nsd's configure script.  Other fixes include:
  - Significant input from @mjo to revamp the OpenRC initscript
    to be smarter about things
  - Added a /etc/conf.d/nsd file with sane defaults
  - Added the use of tmpfiles.d for nsd-control's socket in /run
  - Switching to use of the upstream-provided systemd service unit

In addition, the ebuilds for nsd-4.7.0 and nsd-4.8.0-r0 are dropped.

Closes: https://bugs.gentoo.org/927552
Signed-off-by: Joshua Kinard <kumba@gentoo.org>

13 files changed, 311 insertions, 331 deletions

diff --git a/net-dns/nsd/Manifest b/net-dns/nsd/Manifest
index 26d35df9b207..96c7c9e4d347 100644
--- a/net-dns/nsd/Manifest
+++ b/net-dns/nsd/Manifest
@@ -1,2 +1,2 @@
-DIST nsd-4.7.0.tar.gz 1289477 BLAKE2B d3949c8b65376ea78c700efaeb988acbfac5a5ba338f9bf29035176a7da6730ee8b7a2b6bfc5573ad178db80166ca74d71d313bf3d405acc666bf87f17dac63b SHA512 387e66993517c015ea49fc7a985c1f746623ae30a82bd01f224efbdb7c58d1d2f3e5a5a3574203959047876c632ec464b6682d1644f0e0f157ec0e6fb3f0cdbb
 DIST nsd-4.8.0.tar.gz 1273228 BLAKE2B d1e6a5e8fb158bb32081bc7674d957e3f5a596ed10ee89dd6a5f6af9a79a8c130f2de7070345bee69cb7798e9f373d856a9336a9e9f65f733ff45e15e94833ff SHA512 13c9cffffe6adfcbabf744ee2effebe6ae265d83476345a1edb60dc9c6d7f838a5e239e9b18e667924e5e76b74b2caac63818fcaecf7f0fa651ff21736174a46
+DIST nsd-4.9.1.tar.gz 1309953 BLAKE2B 4a43db480be7196c0a177cc6ee2b9cd6eaaaa9af4d0c3dc7b8f07a5b9e24fd4eac816a29f83de870efe012f2f3bbcbb9bdbda903d05bf9d96574bddc97f68547 SHA512 65cd38aa8a41aee57a6950747de448bc4007a2d2c095152f1d22006f85faa7f0732ec4aa0aeae9f46bc69bff17164d8fe384bbc3441d0484364c4af938b511c1
diff --git a/net-dns/nsd/files/nsd-4.7.0-no-bind8-stats-no-ssl.patch b/net-dns/nsd/files/nsd-4.7.0-no-bind8-stats-no-ssl.patch
deleted file mode 100644
index 402a42e19e0c..000000000000
--- a/net-dns/nsd/files/nsd-4.7.0-no-bind8-stats-no-ssl.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-https://bugs.gentoo.org/907997
-https://github.com/NLnetLabs/nsd/issues/283
-https://github.com/NLnetLabs/nsd/commit/f31d31ab1d45d615ebd192beaacac66746e0ff80
-
-From f31d31ab1d45d615ebd192beaacac66746e0ff80 Mon Sep 17 00:00:00 2001
-From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
-Date: Wed, 7 Jun 2023 13:07:53 +0200
-Subject: [PATCH] - Fix #283: Compile failure in remote.c when
- --disable-bind8-stats
-
---- a/remote.c
-+++ b/remote.c
-@@ -1246,7 +1246,9 @@ do_stats(struct daemon_remote* rc, int peek, struct rc_state* rs)
- 	xfrd_set_reload_now(xfrd);
- #else
- 	RES res;
-+#ifdef HAVE_SSL
- 	res.ssl = rs->ssl;
-+#endif
- 	res.fd = rs->fd;
- 	(void)rc; (void)peek;
- 	(void)ssl_printf(&res, "error no stats enabled at compile time\n");
-
diff --git a/net-dns/nsd/files/nsd-4.9.1-systemd-no-pidfile.patch b/net-dns/nsd/files/nsd-4.9.1-systemd-no-pidfile.patch
new file mode 100644
index 000000000000..49528723e35b
--- /dev/null
+++ b/net-dns/nsd/files/nsd-4.9.1-systemd-no-pidfile.patch
@@ -0,0 +1,16 @@
+# See:
+# https://github.com/NLnetLabs/nsd/issues/317
+
+diff --git a/contrib/nsd.service b/contrib/nsd.service
+index f45359f91..0cc12cc3c 100644
+--- a/contrib/nsd.service
++++ b/contrib/nsd.service
+@@ -4,7 +4,7 @@ After=syslog.target network-online.target
+ 
+ [Service]
+ Type=notify
+-ExecStart=/usr/sbin/nsd -d -c /etc/nsd/nsd.conf $NSD_EXTRA_OPTS
++ExecStart=/usr/sbin/nsd -d -P "" -c /etc/nsd/nsd.conf $NSD_EXTRA_OPTS
+ ExecReload=/bin/kill -HUP $MAINPID
+ KillMode=mixed
+ PrivateTmp=true
diff --git a/net-dns/nsd/files/nsd_munin_.patch b/net-dns/nsd/files/nsd-munin-gentoo-paths.patch
index 36162f9a8fb2..36162f9a8fb2 100644
--- a/net-dns/nsd/files/nsd_munin_.patch
+++ b/net-dns/nsd/files/nsd-munin-gentoo-paths.patch
diff --git a/net-dns/nsd/files/nsd.confd-r1 b/net-dns/nsd/files/nsd.confd-r1
new file mode 100644
index 000000000000..7c9a7effb844
--- /dev/null
+++ b/net-dns/nsd/files/nsd.confd-r1
@@ -0,0 +1,16 @@
+# /etc/conf.d/nsd
+
+# NSD_ARGS is set by default to run in the foreground (-d) and to not
+# create its own PID file (-P ''), as we let OpenRC handle that instead.
+# It is recommended to keep these defaults and append additional flags
+# to them.
+NSD_ARGS="-d -P ''"
+
+# NSD_CONFBASE sets the base configuration directory for nsd's
+# configuration and, by default, uses the standard '/etc/nsd' path.
+NSD_CONFBASE="/etc/nsd"
+
+# NSD_CONFNAME sets the first part of the nsd config file name to be that
+# of the calling service script name.  This allows you to create symlinks
+# that point at '/etc/init.d/nsd' for different instances of nsd.
+NSD_CONFNAME="${RC_SVCNAME}.conf"
diff --git a/net-dns/nsd/files/nsd.initd-r2 b/net-dns/nsd/files/nsd.initd-r2
new file mode 100644
index 000000000000..e1825433ac3b
--- /dev/null
+++ b/net-dns/nsd/files/nsd.initd-r2
@@ -0,0 +1,52 @@
+#!/sbin/openrc-run
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="NSD is an authoritative-only, high performance, open source name server"
+extra_commands="configtest"
+extra_started_commands="reload"
+
+# These can be overridden in /etc/conf.d/nsd if necessary.
+NSD_ARGS="${NSD_ARGS:--d -P ''}"
+NSD_CONFBASE="${NSD_CONFBASE:-/etc/nsd}"
+NSD_CONFNAME="${NSD_CONFNAME:-${RC_SVCNAME}.conf}"
+
+# The conf.d defaults shipped with nsd-4.9.1+ will run it in the foreground
+# and tell it not to create a PID file, as we allow OpenRC to handle those
+# details.
+config_file="${NSD_CONFBASE}/${NSD_CONFNAME}"
+checkconf="/usr/sbin/nsd-checkconf"
+command="/usr/sbin/nsd"
+command_args="-c ${config_file} ${NSD_ARGS}"
+command_background=true
+pidfile="/run/${RC_SVCNAME}.pid"
+required_files="${config_file}"
+
+depend() {
+	use logger
+}
+
+checkconfig() {
+	if ! "${checkconf}" "${config_file}"; then
+		eerror "You have errors in your configfile (${config_file})"
+		return $?
+	fi
+	return 0
+}
+
+configtest() {
+	ebegin "Checking ${RC_SVCNAME} configuration"
+	checkconfig
+	eend $?
+}
+
+start_pre() {
+	checkconfig || return $?
+}
+
+reload() {
+	checkconfig || return $?
+	ebegin "Reloading config and zone files"
+	start-stop-daemon --signal HUP --pidfile "${pidfile}"
+	eend $?
+}
diff --git a/net-dns/nsd/files/nsd.tmpfilesd-r1 b/net-dns/nsd/files/nsd.tmpfilesd-r1
new file mode 100644
index 000000000000..0e2211770cd2
--- /dev/null
+++ b/net-dns/nsd/files/nsd.tmpfilesd-r1
@@ -0,0 +1 @@
+d /run/nsd 0750 nsd nsd
diff --git a/net-dns/nsd/metadata.xml b/net-dns/nsd/metadata.xml
index a1842bb7c035..b674d51d0880 100644
--- a/net-dns/nsd/metadata.xml
+++ b/net-dns/nsd/metadata.xml
@@ -6,20 +6,23 @@
 		<name>Joshua Kinard</name>
 	</maintainer>
 	<use>
-		<flag name="bind8-stats">Enables BIND8 like NSTATS and XSTATS</flag>
+		<flag name="bind8-stats">Enables BIND8 like NSTATS and XSTATS and statistics in nsd-control</flag>
+		<flag name="default-znow">Enable full relocation binding at load-time (RELRO NOW, to protect GOT and .dtor areas)</flag>
 		<flag name="dnstap">Enable the structured binary log format</flag>
-		<flag name="libevent">Use libevent or libev, useful when zone
-			count is high</flag>
-		<flag name="minimal-responses">If minimal responses are disabled,
-			responses are more likely to get truncated, resulting in TCP
-			fallback</flag>
+		<flag name="ipv6">Enable IPv6 support</flag>
+		<flag name="largefile">Enables support for large files</flag>
+		<flag name="libevent">Use libevent or libev, useful when zone count is high</flag>
+		<flag name="memclean">Cleanup memory (at exit) for eg. valgrind, memcheck</flag>
+		<flag name="minimal-responses">If minimal responses are disabled, responses are more likely to get truncated, resulting in TCP fallback</flag>
+		<flag name="munin">Install a plugin for <pkg>net-analyzer/munin</pkg> to graph statistical data from nsd</flag>
 		<flag name="nsec3">Enable NSEC3 support</flag>
-		<flag name="ratelimit">Enables ratelimiting, based on query name,
-			type and source</flag>
-		<flag name="root-server">Configure NSD as a root server</flag>
-		<flag name="munin">
-			Install a plugin for <pkg>net-analyzer/munin</pkg> to graph
-			statistical data from nsd.</flag>
+		<flag name="packed">Enable packed structure alignment; uses less memory but has unaligned reads</flag>
+		<flag name="radix-tree">Use a red-black tree for main lookups; uses less memory at the expense of more CPU</flag>
+		<flag name="ratelimit">Enables ratelimiting, based on query name, type and source</flag>
+		<flag name="recvmmsg">Enable recvmmsg and sendmmsg compilation, faster but some kernel versions may have implementation problems for IPv6</flag>
+		<flag name="root-server">Configure NSD as a root server (OBSOLETE: removed in >=4.9.x)</flag>
+		<flag name="tfo">Enable TCP Fast Open</flag>
+		<flag name="year2038">Support timestamps after 2038 (glibc only!)</flag>
 	</use>
 	<upstream>
 		<remote-id type="github">NLnetLabs/nsd</remote-id>
diff --git a/net-dns/nsd/nsd-4.7.0.ebuild b/net-dns/nsd/nsd-4.7.0.ebuild
deleted file mode 100644
index e821654c0b57..000000000000
--- a/net-dns/nsd/nsd-4.7.0.ebuild
+++ /dev/null
@@ -1,129 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools systemd
-
-DESCRIPTION="An authoritative only, high performance, open source name server"
-HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
-
-if [[ ${PV} == *9999 ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
-else
-	# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
-	MY_PV="${PV/_beta/b}"
-	MY_PV="${MY_PV/_rc/rc}"
-	MY_P="${PN}-${MY_PV}"
-
-	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
-		SRC_URI="https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
-		S="${WORKDIR}"/${MY_P}
-
-		KEYWORDS="amd64 x86"
-	fi
-fi
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="bind8-stats debug dnstap libevent minimal-responses mmap munin +nsec3 ratelimit root-server ssl systemd"
-
-RDEPEND="
-	acct-group/nsd
-	acct-user/nsd
-	dnstap? (
-		dev-libs/fstrm
-		dev-libs/protobuf-c
-	)
-	libevent? ( dev-libs/libevent )
-	munin? ( net-analyzer/munin )
-	ssl? ( dev-libs/openssl:0= )
-	systemd? ( sys-apps/systemd )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	app-alternatives/lex
-	app-alternatives/yacc
-	systemd? ( virtual/pkgconfig )
-"
-
-PATCHES=(
-	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
-	# bug #907997
-	"${FILESDIR}"/${P}-no-bind8-stats-no-ssl.patch
-)
-
-src_prepare() {
-	default
-
-	# Required to get correct pkg-config macros with USE="systemd"
-	# See bugs #663618 and #758050
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--enable-ipv6
-		--enable-largefile
-		--enable-pie
-		--enable-relro-now
-		--enable-tcp-fastopen
-
-		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
-		--with-logfile="${EPREFIX}"/var/log/nsd.log
-		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
-		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
-		--with-xfrdir="${EPREFIX}"/var/db/nsd
-		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
-		--with-zonesdir="${EPREFIX}"/var/lib/nsd
-
-		$(use_enable bind8-stats)
-		$(use_enable bind8-stats zone-stats)
-		$(use_enable debug checking)
-		$(use_enable dnstap)
-		$(use_enable minimal-responses)
-		$(use_enable mmap)
-		$(use_enable nsec3)
-		$(use_enable ratelimit)
-		$(use_enable root-server)
-		$(use_enable systemd)
-		$(use_with libevent)
-		$(use_with ssl)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	emake DESTDIR="${D}" install
-
-	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
-
-	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
-
-	# Install munin plugin and config
-	if use munin ; then
-		exeinto /usr/libexec/munin/plugins
-		doexe contrib/nsd_munin_
-		insinto /etc/munin/plugin-conf.d
-		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
-	fi
-
-	systemd_dounit "${FILESDIR}"/nsd.service
-
-	# Remove the /run directory that usually resides on tmpfs and is
-	# being taken care of by the nsd init script anyway (checkpath)
-	rm -r "${ED}"/run || die "Failed to remove /run"
-
-	keepdir /var/db/${PN}
-}
-
-pkg_postinst() {
-	# database directory, writable by nsd for database updates and zone transfers
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
-
-	# zones directory, writable by nsd for zone file updates (nsd-control write)
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
-}
diff --git a/net-dns/nsd/nsd-4.8.0-r1.ebuild b/net-dns/nsd/nsd-4.8.0-r1.ebuild
index fc6955f83a99..654f972468e3 100644
--- a/net-dns/nsd/nsd-4.8.0-r1.ebuild
+++ b/net-dns/nsd/nsd-4.8.0-r1.ebuild
@@ -50,8 +50,8 @@ BDEPEND="
 
 PATCHES=(
 	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
-	"${FILESDIR}"/${P}-implausible-stats.patch
+	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
+	"${FILESDIR}/${P}-implausible-stats.patch"
 )
 
 src_prepare() {
diff --git a/net-dns/nsd/nsd-4.8.0.ebuild b/net-dns/nsd/nsd-4.8.0.ebuild
deleted file mode 100644
index ce4bcaba54e0..000000000000
--- a/net-dns/nsd/nsd-4.8.0.ebuild
+++ /dev/null
@@ -1,127 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools systemd
-
-DESCRIPTION="An authoritative only, high performance, open source name server"
-HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
-
-if [[ ${PV} == *9999 ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
-else
-	# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
-	MY_PV="${PV/_beta/b}"
-	MY_PV="${MY_PV/_rc/rc}"
-	MY_P="${PN}-${MY_PV}"
-
-	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
-		SRC_URI="https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
-		S="${WORKDIR}"/${MY_P}
-
-		KEYWORDS="amd64 x86"
-	fi
-fi
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="bind8-stats debug dnstap libevent minimal-responses mmap munin +nsec3 ratelimit root-server ssl systemd"
-
-RDEPEND="
-	acct-group/nsd
-	acct-user/nsd
-	dnstap? (
-		dev-libs/fstrm
-		dev-libs/protobuf-c
-	)
-	libevent? ( dev-libs/libevent )
-	munin? ( net-analyzer/munin )
-	ssl? ( dev-libs/openssl:0= )
-	systemd? ( sys-apps/systemd )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	app-alternatives/lex
-	app-alternatives/yacc
-	systemd? ( virtual/pkgconfig )
-"
-
-PATCHES=(
-	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
-)
-
-src_prepare() {
-	default
-
-	# Required to get correct pkg-config macros with USE="systemd"
-	# See bugs #663618 and #758050
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--enable-ipv6
-		--enable-largefile
-		--enable-pie
-		--enable-relro-now
-		--enable-tcp-fastopen
-
-		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
-		--with-logfile="${EPREFIX}"/var/log/nsd.log
-		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
-		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
-		--with-xfrdir="${EPREFIX}"/var/db/nsd
-		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
-		--with-zonesdir="${EPREFIX}"/var/lib/nsd
-
-		$(use_enable bind8-stats)
-		$(use_enable bind8-stats zone-stats)
-		$(use_enable debug checking)
-		$(use_enable dnstap)
-		$(use_enable minimal-responses)
-		$(use_enable mmap)
-		$(use_enable nsec3)
-		$(use_enable ratelimit)
-		$(use_enable root-server)
-		$(use_enable systemd)
-		$(use_with libevent)
-		$(use_with ssl)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	emake DESTDIR="${D}" install
-
-	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
-
-	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
-
-	# Install munin plugin and config
-	if use munin ; then
-		exeinto /usr/libexec/munin/plugins
-		doexe contrib/nsd_munin_
-		insinto /etc/munin/plugin-conf.d
-		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
-	fi
-
-	systemd_dounit "${FILESDIR}"/nsd.service
-
-	# Remove the /run directory that usually resides on tmpfs and is
-	# being taken care of by the nsd init script anyway (checkpath)
-	rm -r "${ED}"/run || die "Failed to remove /run"
-
-	keepdir /var/db/${PN}
-}
-
-pkg_postinst() {
-	# database directory, writable by nsd for database updates and zone transfers
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
-
-	# zones directory, writable by nsd for zone file updates (nsd-control write)
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
-}
diff --git a/net-dns/nsd/nsd-4.9.1.ebuild b/net-dns/nsd/nsd-4.9.1.ebuild
new file mode 100644
index 000000000000..eb62a90576fc
--- /dev/null
+++ b/net-dns/nsd/nsd-4.9.1.ebuild
@@ -0,0 +1,149 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit autotools systemd tmpfiles
+
+DESCRIPTION="An authoritative only, high performance, open source name server"
+HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
+else
+	# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
+	MY_PV="${PV/_beta/b}"
+	MY_PV="${MY_PV/_rc/rc}"
+	MY_P="${PN}-${MY_PV}"
+
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
+		SRC_URI="https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
+		S="${WORKDIR}"/${MY_P}
+
+		KEYWORDS="~amd64 ~x86"
+	fi
+fi
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="bind8-stats debug +default-znow dnstap +ipv6 +largefile libevent +lto memclean minimal-responses mmap munin +nsec3 packed +pie +radix-tree ratelimit recvmmsg ssl systemd +tfo year2038"
+
+RDEPEND="
+	acct-group/nsd
+	acct-user/nsd
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	libevent? ( dev-libs/libevent )
+	munin? ( net-analyzer/munin )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? ( sys-apps/systemd )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-alternatives/lex
+	app-alternatives/yacc
+	systemd? ( virtual/pkgconfig )
+"
+
+PATCHES=(
+	"${FILESDIR}/${P}-systemd-no-pidfile.patch"
+	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
+)
+
+NSD_CONFD_VER="1"		# Cur version of NSD's OpenRC conf.d file.
+NSD_INITD_VER="2"		# Cur version of NSD's OpenRC init.d script.
+NSD_TMPFILESD_VER="1"		# Cur version of NSD's tmpfiles.d config.
+
+NSD_DBDIR="/var/db/nsd"		# Default dir for NSD's databases.
+NSD_ZNDIR="/var/lib/nsd"	# Default dir for NSD's zone files.
+
+src_prepare() {
+	default
+
+	# Required to get correct pkg-config macros with USE="systemd".
+	# See bugs #663618 & #758050.
+	eautoreconf
+}
+
+src_configure() {
+	local myconf=(
+		$(use_enable bind8-stats)
+		$(use_enable bind8-stats zone-stats)
+		$(use_enable debug checking)
+		$(use_enable default-znow relro-now)
+		$(use_enable dnstap)
+		$(use_enable ipv6)
+		$(use_enable largefile)
+		$(use_enable lto flto)
+		$(use_enable memclean)
+		$(use_enable minimal-responses)
+		$(use_enable mmap)
+		$(use_enable nsec3)
+		$(use_enable packed)
+		$(use_enable pie)
+		$(use_enable radix-tree)
+		$(use_enable ratelimit)
+		$(use_enable recvmmsg)
+		$(use_enable systemd)
+		$(use_enable tfo tcp-fastopen)
+		$(use_with libevent)
+		$(use_with ssl)
+
+		--with-dbfile="${EPREFIX}/${NSD_DBDIR}/nsd.db"
+		--with-logfile="${EPREFIX}/var/log/nsd.log"
+		--with-pidfile="${EPREFIX}/run/nsd.pid"
+		--with-xfrdfile="${EPREFIX}/${NSD_DBDIR}/xfrd.state"
+		--with-xfrdir="${EPREFIX}/${NSD_DBDIR}"
+		--with-zonelistfile="${EPREFIX}/${NSD_DBDIR}/zone.list"
+		--with-zonesdir="${EPREFIX}/${NSD_ZNDIR}"
+	)
+
+	# This configure switch is only available on a glibc-based system.
+	if use elibc_glibc; then
+		myconf+=( $(use_enable year2038) )
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
+	newinitd "${FILESDIR}/nsd.initd-r${NSD_INITD_VER}" nsd
+	newconfd "${FILESDIR}/nsd.confd-r${NSD_CONFD_VER}" nsd
+	newtmpfiles "${FILESDIR}/nsd.tmpfilesd-r${NSD_TMPFILESD_VER}" nsd.conf
+
+	# Install munin plugin and config, if requested.
+	if use munin ; then
+		exeinto "/usr/libexec/munin/plugins"
+		doexe contrib/nsd_munin_
+		insinto "/etc/munin/plugin-conf.d"
+		newins "${FILESDIR}/nsd.munin-conf nsd_munin"
+	fi
+
+	# Use the upstream-provided systemd service file.
+	systemd_dounit "contrib/nsd.service"
+
+	# Remove the /run directory that usually resides on tmpfs and is
+	# being taken care of by the nsd init script anyway (checkpath).
+	rm -r "${ED}/run" || die "Failed to remove /run"
+
+	keepdir "${NSD_DBDIR}"
+}
+
+pkg_postinst() {
+	# See eclass/tmpfiles.eclass for info.
+	tmpfiles_process nsd.conf
+
+	# Database directory
+	# Writable by nsd:nsd for database updates and zone transfers.
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_DBDIR}"
+
+	# Zones directory
+	# Writable by nsd:nsd for zone file updates (via 'nsd-control write').
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_ZNDIR}"
+}
diff --git a/net-dns/nsd/nsd-9999.ebuild b/net-dns/nsd/nsd-9999.ebuild
index abbd21ab799f..77ea73ae7afc 100644
--- a/net-dns/nsd/nsd-9999.ebuild
+++ b/net-dns/nsd/nsd-9999.ebuild
@@ -1,9 +1,9 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=8
+EAPI="8"
 
-inherit autotools systemd
+inherit autotools systemd tmpfiles
 
 DESCRIPTION="An authoritative only, high performance, open source name server"
 HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
@@ -27,7 +27,7 @@ fi
 
 LICENSE="BSD"
 SLOT="0"
-IUSE="bind8-stats debug dnstap libevent minimal-responses mmap munin +nsec3 ratelimit root-server ssl systemd"
+IUSE="bind8-stats debug +default-znow dnstap +ipv6 +largefile libevent +lto memclean minimal-responses mmap munin +nsec3 packed +pie +radix-tree ratelimit recvmmsg ssl systemd +tfo year2038"
 
 RDEPEND="
 	acct-group/nsd
@@ -49,49 +49,63 @@ BDEPEND="
 "
 
 PATCHES=(
-	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
+	"${FILESDIR}/${P}-systemd-no-pidfile.patch"
+	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
 )
 
+NSD_INITD_VER="2"		# Current version of NSD's OpenRC init.d script.
+NSD_TMPFILESD_VER="1"		# Current version of NSD's tmpfiles.d config.
+
+NSD_DBDIR="/var/db/nsd"		# Default dir for NSD's databases.
+NSD_ZNDIR="/var/lib/nsd"	# Default dir for NSD's zone files.
+
 src_prepare() {
 	default
 
-	# Required to get correct pkg-config macros with USE="systemd"
-	# See bugs #663618 and #758050
+	# Required to get correct pkg-config macros with USE="systemd".
+	# See bugs #663618 & #758050.
 	eautoreconf
 }
 
 src_configure() {
-	local myeconfargs=(
-		--enable-ipv6
-		--enable-largefile
-		--enable-pie
-		--enable-relro-now
-		--enable-tcp-fastopen
-
-		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
-		--with-logfile="${EPREFIX}"/var/log/nsd.log
-		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
-		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
-		--with-xfrdir="${EPREFIX}"/var/db/nsd
-		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
-		--with-zonesdir="${EPREFIX}"/var/lib/nsd
-
+	local myconf=(
 		$(use_enable bind8-stats)
 		$(use_enable bind8-stats zone-stats)
 		$(use_enable debug checking)
+		$(use_enable default-znow relro-now)
 		$(use_enable dnstap)
+		$(use_enable ipv6)
+		$(use_enable largefile)
+		$(use_enable lto flto)
+		$(use_enable memclean)
 		$(use_enable minimal-responses)
 		$(use_enable mmap)
 		$(use_enable nsec3)
+		$(use_enable packed)
+		$(use_enable pie)
+		$(use_enable radix-tree)
 		$(use_enable ratelimit)
-		$(use_enable root-server)
+		$(use_enable recvmmsg)
 		$(use_enable systemd)
+		$(use_enable tfo tcp-fastopen)
 		$(use_with libevent)
 		$(use_with ssl)
+
+		--with-dbfile="${EPREFIX}/${NSD_DBDIR}/nsd.db"
+		--with-logfile="${EPREFIX}/var/log/nsd.log"
+		--with-pidfile="${EPREFIX}/run/nsd/nsd.pid"
+		--with-xfrdfile="${EPREFIX}/${NSD_DBDIR}/xfrd.state"
+		--with-xfrdir="${EPREFIX}/${NSD_DBDIR}"
+		--with-zonelistfile="${EPREFIX}/${NSD_DBDIR}/zone.list"
+		--with-zonesdir="${EPREFIX}/${NSD_ZNDIR}"
 	)
 
-	econf "${myeconfargs[@]}"
+	# This configure switch is only available on a glibc-based system.
+	if use elibc_glibc; then
+		myconf+=( $(use_enable year2038) )
+	fi
+
+	econf "${myconf[@]}"
 }
 
 src_install() {
@@ -99,29 +113,37 @@ src_install() {
 
 	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
 
-	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
+	newinitd "${FILESDIR}/nsd.initd-r${NSD_INITD_VER}" nsd
 
-	# Install munin plugin and config
+	newtmpfiles "${FILESDIR}/nsd.tmpfilesd-r1" nsd.conf
+
+	# Install munin plugin and config, if requested.
 	if use munin ; then
-		exeinto /usr/libexec/munin/plugins
+		exeinto "/usr/libexec/munin/plugins"
 		doexe contrib/nsd_munin_
-		insinto /etc/munin/plugin-conf.d
-		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
+		insinto "/etc/munin/plugin-conf.d"
+		newins "${FILESDIR}/nsd.munin-conf nsd_munin"
 	fi
 
-	systemd_dounit "${FILESDIR}"/nsd.service
+	# Use the upstream-provided systemd service file.
+	systemd_dounit "contrib/nsd.service"
 
 	# Remove the /run directory that usually resides on tmpfs and is
-	# being taken care of by the nsd init script anyway (checkpath)
-	rm -r "${ED}"/run || die "Failed to remove /run"
+	# being taken care of by the nsd init script anyway (checkpath).
+	rm -r "${ED}/run" || die "Failed to remove /run"
 
-	keepdir /var/db/${PN}
+	keepdir "${NSD_DBDIR}"
 }
 
 pkg_postinst() {
-	# database directory, writable by nsd for database updates and zone transfers
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
+	# See eclass/tmpfiles.eclass for info.
+	tmpfiles_process nsd.conf
+
+	# Database directory
+	# Writable by nsd:nsd for database updates and zone transfers.
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_DBDIR}"
 
-	# zones directory, writable by nsd for zone file updates (nsd-control write)
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
+	# Zones directory
+	# Writable by nsd:nsd for zone file updates (via 'nsd-control write').
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_ZNDIR}"
 }