13 files changed, 320 insertions, 338 deletions
diff --git a/net-dns/nsd/Manifest b/net-dns/nsd/Manifest
index 05684594c60d..be0fc9a60dac 100644
--- a/net-dns/nsd/Manifest
+++ b/net-dns/nsd/Manifest
@@ -1,13 +1,15 @@
-AUX nsd-4.7.0-no-bind8-stats-no-ssl.patch 724 BLAKE2B ed9b6014a37e819f89624928a50499163f41cd65e881f5d835cbb9c7d9613dd9e24a790f69ae30135d95b8e5aefa10c606f6a47750254f3d89d0259ae780921f SHA512 3823eb145aa5c6b55992c498417d07643e85255d6033ae7444c51e2432475620f46750681ee9cf758fd7f2fc5336a9f7906d57fb8c78940641d88a1dff8311f1
 AUX nsd-4.8.0-implausible-stats.patch 760 BLAKE2B ae6d75c8f2ad17fa5f6c8ba1cbaa6e812a1650c3b913b7e86aa4b479c264c8fae02d5713bb21ee3bace5c832e5b96f762772f70eb8aa24d7ce6c9fd4b04756dc SHA512 2b40047b8277e2fe18afd7aa1aef5b91244478aa38df04e094ded9ae7c1bd49f62ae940831b1c144c7cd9b4f26957c4e726001d3afdd48e51b940bd36c2ee9bf
+AUX nsd-4.9.1-systemd-no-pidfile.patch 484 BLAKE2B 697c6de4e4e69da281316be06d6636fba7ac301987bbb8e1816f4028cab9b76b0faa668d8ede0b85059325792c71d31292eb661734023fe6bcdb9306d4f7b662 SHA512 c0133bad41d405f704ed754bc9ee5d96e878c0a2c5ffd41940823f26a9962e737da3e26c66bfd258b6165b166ec52896bb56de3ad6056d9508123eb59f20b4b8
+AUX nsd-munin-gentoo-paths.patch 542 BLAKE2B 13ff49c41683d5bf505e257cd17bf5f3ad06662c00032d79b36be3f96486eb89fdd62a42b5ed4816ad99835366864603568613e27504894340ebb64057e2b2c3 SHA512 6034086d6b6f6980468766c901e92291fea8a32df179561ede2add5918c37bfe3aabf122735d4ae2e28efece394fd3398f9a0cc4d8fdcc1e5da1ca709d2ba6ae
+AUX nsd.confd-r1 669 BLAKE2B 45ef7846e227566ce2bc2248084598e31a40536f9dbd28ff5964fca34998399253dfd45e1706ddaed566ac4f745264f4f1314ba7394392e637da520ff78470df SHA512 6c9daae27750149e9ee13860b13a9ce7d92159416329098fa60b77982dbe1d0b3ee1c957321b3a459870155d2a4430f1f7796c53b677178f3a6a71a2efc81fdc
 AUX nsd.initd-r1 1383 BLAKE2B b90de2ebef09a4f9050f6e95f5faf659c62910462aba1179daccde4e63a3972124247e6e8ce725c4dbd34a7fcd4f14b40899d7b59ba4937bdc59c493f6f7e173 SHA512 f775c78b529c5c7f1130035ea9c6cf1c1e9c1790c5df84fafd86a41294748a46c82b66c58df8385f8f4bbca8113427c665051aeec5720073bd9823607c9f8ce1
+AUX nsd.initd-r2 1312 BLAKE2B 798c8df841f3bf22edb0891f1e350a8636db94e9049ba202b988210ff69ba185b3e0a6ed11347752a452d49560930b5f5fd34d5857b150ffbc1c9691e1202feb SHA512 35320b938a29d34cda2919dfcfc975858d2211bbe8a92af270c2e0806d05a12e893bb13944b75bae27b3db4ab8a74e2408b4d70898f715f785ec00f36a629ea2
 AUX nsd.munin-conf 23 BLAKE2B 0b08804b2218d77ea925d4c9e26e73649b453b923d6d7b1e1df39ceb58b92a44c48cb21583a480e622f72d07650f410f2e0703f1d16af08152aed16982ab8da2 SHA512 c06d0b035387e7be79cfa8fedf8afb3900772146c6d4090ac39ea2ef165772d875b222ef467bd73422078ef57818bcc931ca67fa290bd99a7a9456efa5448853
 AUX nsd.service 272 BLAKE2B 66a7d4132246589f71341afd98361f6b02082be3d4e230c86ae690876a797ea0a4580b29892d91feba2785ea933a053f862e0d00f2c8a8c09ab907386c39a03c SHA512 fbca86887bfc36d61af06992cc98b3f3cb33c39274fbdc1e53d489bdcc767993911fab27a20244c3878b36bacbd1644a552364b2f7bf4d48e6eb247d0eecdf0f
-AUX nsd_munin_.patch 542 BLAKE2B 13ff49c41683d5bf505e257cd17bf5f3ad06662c00032d79b36be3f96486eb89fdd62a42b5ed4816ad99835366864603568613e27504894340ebb64057e2b2c3 SHA512 6034086d6b6f6980468766c901e92291fea8a32df179561ede2add5918c37bfe3aabf122735d4ae2e28efece394fd3398f9a0cc4d8fdcc1e5da1ca709d2ba6ae
-DIST nsd-4.7.0.tar.gz 1289477 BLAKE2B d3949c8b65376ea78c700efaeb988acbfac5a5ba338f9bf29035176a7da6730ee8b7a2b6bfc5573ad178db80166ca74d71d313bf3d405acc666bf87f17dac63b SHA512 387e66993517c015ea49fc7a985c1f746623ae30a82bd01f224efbdb7c58d1d2f3e5a5a3574203959047876c632ec464b6682d1644f0e0f157ec0e6fb3f0cdbb
+AUX nsd.tmpfilesd-r1 24 BLAKE2B ae4078bff0e71d9b47d02855f7e7ab2389cc83b40af657221ffec07e52d52c666073d32182dc726dcc3df85a17f7a983a546d6cda98554ebcf7df14a64036eb8 SHA512 bfc1b81f8553f499f8048a26870b0964625cad4c73b84b70afc8c00644b95661e86ad540fd66f88ef072166ff22eef4f18974ba3364d1bd33e1ca7ee348f9188
 DIST nsd-4.8.0.tar.gz 1273228 BLAKE2B d1e6a5e8fb158bb32081bc7674d957e3f5a596ed10ee89dd6a5f6af9a79a8c130f2de7070345bee69cb7798e9f373d856a9336a9e9f65f733ff45e15e94833ff SHA512 13c9cffffe6adfcbabf744ee2effebe6ae265d83476345a1edb60dc9c6d7f838a5e239e9b18e667924e5e76b74b2caac63818fcaecf7f0fa651ff21736174a46
-EBUILD nsd-4.7.0.ebuild 3223 BLAKE2B 7493eeff0fae1bfcb965aab5437cae7dc2fa6ff2240da6afa19e9088dc65800befd23972d33442952818d40d249377fb9d56ae3c4bc98d64ad0ba5a6102d1fec SHA512 457b48d3be50fe32837e706fd44700a65dc8a0a1772adcd23446c8332486315f94b63b59aa3ff89e13dc45211a8d8ac7248bb703dd76c533e2c4115b540827ea
-EBUILD nsd-4.8.0-r1.ebuild 3204 BLAKE2B 415c180bfe12586b3649c968b1398e78f42a788eb2af34886c78b2b233c1696e810a4a3fe98608c7d12f22fb03c569aa0e3f352b8b4517ff3afb588a1c5da1df SHA512 f9319cf5d03a713068cd13d036890e44d04b2d787938a16574d71946dcf23cade65a1e7b33fd61bdd055f8eae4c47d9f1002f74868183e8dc47f60ee711c554a
-EBUILD nsd-4.8.0.ebuild 3160 BLAKE2B 5c26de437434792093091a55aa7106c4ae2921fdc696295752e0c6bf488f52458ce8a8bbb63a3b13a32327bf3198923eda4c2159eb803c178657e40d716ad78b SHA512 d8faf89d364d0896d591a62059d91bc9034be1052055e85650f663faaa5fc2912aafaf1ec81c33d6e4db55468ebcc61dcce1b3e520801e3a6f0cbff4dc12bf71
-EBUILD nsd-9999.ebuild 3162 BLAKE2B 41b1809b4714230e89c9633513fdce0f027b0bce3300a4167ee83fd7055741faf7aebca1b5ecbf47eae1e9b12284d9c43bd3f5ed2344549c77bac33f65ad58ed SHA512 1304030fead7260f40a7a1fe7e0b0172160f6fa407aa77e9e25eb32480cfa06bcbd40de174e1735a03df71d13a3fb0eb8781362492af14c74e9f2ac82babe6e2
-MISC metadata.xml 1048 BLAKE2B 2eda93b2f202fc8cb59a0c90914f1132515c7c86521b1791580ebc8d60da348e1fe2c4f522f0800696e9e8f36ac7e60a3f2da459be53ed51977ec36da7b018f2 SHA512 2d09782adfae14dcb00a2e2354ec2b361e35e81d83cb7fdd6ac72063f106e11fa2d89f6044d46b144e32c7015377ad547b1402df98b6ce7d04591f1ef4b71b70
+DIST nsd-4.9.1.tar.gz 1309953 BLAKE2B 4a43db480be7196c0a177cc6ee2b9cd6eaaaa9af4d0c3dc7b8f07a5b9e24fd4eac816a29f83de870efe012f2f3bbcbb9bdbda903d05bf9d96574bddc97f68547 SHA512 65cd38aa8a41aee57a6950747de448bc4007a2d2c095152f1d22006f85faa7f0732ec4aa0aeae9f46bc69bff17164d8fe384bbc3441d0484364c4af938b511c1
+EBUILD nsd-4.8.0-r1.ebuild 3218 BLAKE2B e591458f0b53f6f0e0bbef131414779e2c7c151bd2de1747660b468b88e5882efdc807991809061fbeaf4348d3a23b16abb95616f25564c002de8bbdd97d9861 SHA512 3fd01e8bc80fd69dc42b1046522d3680bf6a1700df1b986a934baebdb018ab30de3b6cebb4e3f073b927182bd5058271a6197895a5bba0e71526b0000910ab4b
+EBUILD nsd-4.9.1.ebuild 4138 BLAKE2B 45b12c5bc167ddf730be5d349043e2684008a6c950e8bc408a3fbf2b8913c60b79f746adb0e45521a0a64971f6db4385309c6303a3a5136ab9eee7c39e8e6d36 SHA512 b243f631a52d14512da7244a782b8afae3028a8f049e996bb242367c1db70a160e7ac911f7d61b96dd1c32100fe838a8921f421206541a3bb1f4233a4b2cb96a
+EBUILD nsd-9999.ebuild 4015 BLAKE2B 7b200fc2c78bbde5cac4673c2a44857dea9a514606af78c5c016dd26e3b51efccfc6968ce6564e3ef99505f50b0d3bbc857227775918bb0b27e2b073c136db8f SHA512 a777f279f72307778e7ee6b12a119a5c41f69ccf4e54b90421dcafce50f2e97564cad83d365e56929253d1a9aa16bba7e05149a03d1a5a8ec439c6c04970f3c1
+MISC metadata.xml 1896 BLAKE2B df1aa7c5c3d809ebeed55651c57fe0560625730d9298d109718d9fd563d712859a2d8c47d4b9d0d2c444b684af79f015a84fb3c7d5e7bd67d30f6d2533174f1a SHA512 2c6306608ec0c26b6bfea66b2e951a831bad901f8eebe3785bcb99c1d6450e56a29c4a3bbdee974c1cb8e0e912ccc5a13aa1926623f3f2dbb5fb9da7772ab668
diff --git a/net-dns/nsd/files/nsd-4.7.0-no-bind8-stats-no-ssl.patch b/net-dns/nsd/files/nsd-4.7.0-no-bind8-stats-no-ssl.patch
deleted file mode 100644
index 402a42e19e0c..000000000000
--- a/net-dns/nsd/files/nsd-4.7.0-no-bind8-stats-no-ssl.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-https://bugs.gentoo.org/907997
-https://github.com/NLnetLabs/nsd/issues/283
-https://github.com/NLnetLabs/nsd/commit/f31d31ab1d45d615ebd192beaacac66746e0ff80
-
-From f31d31ab1d45d615ebd192beaacac66746e0ff80 Mon Sep 17 00:00:00 2001
-From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
-Date: Wed, 7 Jun 2023 13:07:53 +0200
-Subject: [PATCH] - Fix #283: Compile failure in remote.c when
- --disable-bind8-stats
-
---- a/remote.c
-+++ b/remote.c
-@@ -1246,7 +1246,9 @@ do_stats(struct daemon_remote* rc, int peek, struct rc_state* rs)
- 	xfrd_set_reload_now(xfrd);
- #else
- 	RES res;
-+#ifdef HAVE_SSL
- 	res.ssl = rs->ssl;
-+#endif
- 	res.fd = rs->fd;
- 	(void)rc; (void)peek;
- 	(void)ssl_printf(&res, "error no stats enabled at compile time\n");
-
diff --git a/net-dns/nsd/files/nsd-4.9.1-systemd-no-pidfile.patch b/net-dns/nsd/files/nsd-4.9.1-systemd-no-pidfile.patch
new file mode 100644
index 000000000000..49528723e35b
--- /dev/null
+++ b/net-dns/nsd/files/nsd-4.9.1-systemd-no-pidfile.patch
@@ -0,0 +1,16 @@
+# See:
+# https://github.com/NLnetLabs/nsd/issues/317
+
+diff --git a/contrib/nsd.service b/contrib/nsd.service
+index f45359f91..0cc12cc3c 100644
+--- a/contrib/nsd.service
++++ b/contrib/nsd.service
+@@ -4,7 +4,7 @@ After=syslog.target network-online.target
+ 
+ [Service]
+ Type=notify
+-ExecStart=/usr/sbin/nsd -d -c /etc/nsd/nsd.conf $NSD_EXTRA_OPTS
++ExecStart=/usr/sbin/nsd -d -P "" -c /etc/nsd/nsd.conf $NSD_EXTRA_OPTS
+ ExecReload=/bin/kill -HUP $MAINPID
+ KillMode=mixed
+ PrivateTmp=true
diff --git a/net-dns/nsd/files/nsd_munin_.patch b/net-dns/nsd/files/nsd-munin-gentoo-paths.patch
index 36162f9a8fb2..36162f9a8fb2 100644
--- a/net-dns/nsd/files/nsd_munin_.patch
+++ b/net-dns/nsd/files/nsd-munin-gentoo-paths.patch
diff --git a/net-dns/nsd/files/nsd.confd-r1 b/net-dns/nsd/files/nsd.confd-r1
new file mode 100644
index 000000000000..7c9a7effb844
--- /dev/null
+++ b/net-dns/nsd/files/nsd.confd-r1
@@ -0,0 +1,16 @@
+# /etc/conf.d/nsd
+
+# NSD_ARGS is set by default to run in the foreground (-d) and to not
+# create its own PID file (-P ''), as we let OpenRC handle that instead.
+# It is recommended to keep these defaults and append additional flags
+# to them.
+NSD_ARGS="-d -P ''"
+
+# NSD_CONFBASE sets the base configuration directory for nsd's
+# configuration and, by default, uses the standard '/etc/nsd' path.
+NSD_CONFBASE="/etc/nsd"
+
+# NSD_CONFNAME sets the first part of the nsd config file name to be that
+# of the calling service script name.  This allows you to create symlinks
+# that point at '/etc/init.d/nsd' for different instances of nsd.
+NSD_CONFNAME="${RC_SVCNAME}.conf"
diff --git a/net-dns/nsd/files/nsd.initd-r2 b/net-dns/nsd/files/nsd.initd-r2
new file mode 100644
index 000000000000..e1825433ac3b
--- /dev/null
+++ b/net-dns/nsd/files/nsd.initd-r2
@@ -0,0 +1,52 @@
+#!/sbin/openrc-run
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="NSD is an authoritative-only, high performance, open source name server"
+extra_commands="configtest"
+extra_started_commands="reload"
+
+# These can be overridden in /etc/conf.d/nsd if necessary.
+NSD_ARGS="${NSD_ARGS:--d -P ''}"
+NSD_CONFBASE="${NSD_CONFBASE:-/etc/nsd}"
+NSD_CONFNAME="${NSD_CONFNAME:-${RC_SVCNAME}.conf}"
+
+# The conf.d defaults shipped with nsd-4.9.1+ will run it in the foreground
+# and tell it not to create a PID file, as we allow OpenRC to handle those
+# details.
+config_file="${NSD_CONFBASE}/${NSD_CONFNAME}"
+checkconf="/usr/sbin/nsd-checkconf"
+command="/usr/sbin/nsd"
+command_args="-c ${config_file} ${NSD_ARGS}"
+command_background=true
+pidfile="/run/${RC_SVCNAME}.pid"
+required_files="${config_file}"
+
+depend() {
+	use logger
+}
+
+checkconfig() {
+	if ! "${checkconf}" "${config_file}"; then
+		eerror "You have errors in your configfile (${config_file})"
+		return $?
+	fi
+	return 0
+}
+
+configtest() {
+	ebegin "Checking ${RC_SVCNAME} configuration"
+	checkconfig
+	eend $?
+}
+
+start_pre() {
+	checkconfig || return $?
+}
+
+reload() {
+	checkconfig || return $?
+	ebegin "Reloading config and zone files"
+	start-stop-daemon --signal HUP --pidfile "${pidfile}"
+	eend $?
+}
diff --git a/net-dns/nsd/files/nsd.tmpfilesd-r1 b/net-dns/nsd/files/nsd.tmpfilesd-r1
new file mode 100644
index 000000000000..0e2211770cd2
--- /dev/null
+++ b/net-dns/nsd/files/nsd.tmpfilesd-r1
@@ -0,0 +1 @@
+d /run/nsd 0750 nsd nsd
diff --git a/net-dns/nsd/metadata.xml b/net-dns/nsd/metadata.xml
index a1842bb7c035..b674d51d0880 100644
--- a/net-dns/nsd/metadata.xml
+++ b/net-dns/nsd/metadata.xml
@@ -6,20 +6,23 @@
 		<name>Joshua Kinard</name>
 	</maintainer>
 	<use>
-		<flag name="bind8-stats">Enables BIND8 like NSTATS and XSTATS</flag>
+		<flag name="bind8-stats">Enables BIND8 like NSTATS and XSTATS and statistics in nsd-control</flag>
+		<flag name="default-znow">Enable full relocation binding at load-time (RELRO NOW, to protect GOT and .dtor areas)</flag>
 		<flag name="dnstap">Enable the structured binary log format</flag>
-		<flag name="libevent">Use libevent or libev, useful when zone
-			count is high</flag>
-		<flag name="minimal-responses">If minimal responses are disabled,
-			responses are more likely to get truncated, resulting in TCP
-			fallback</flag>
+		<flag name="ipv6">Enable IPv6 support</flag>
+		<flag name="largefile">Enables support for large files</flag>
+		<flag name="libevent">Use libevent or libev, useful when zone count is high</flag>
+		<flag name="memclean">Cleanup memory (at exit) for eg. valgrind, memcheck</flag>
+		<flag name="minimal-responses">If minimal responses are disabled, responses are more likely to get truncated, resulting in TCP fallback</flag>
+		<flag name="munin">Install a plugin for <pkg>net-analyzer/munin</pkg> to graph statistical data from nsd</flag>
 		<flag name="nsec3">Enable NSEC3 support</flag>
-		<flag name="ratelimit">Enables ratelimiting, based on query name,
-			type and source</flag>
-		<flag name="root-server">Configure NSD as a root server</flag>
-		<flag name="munin">
-			Install a plugin for <pkg>net-analyzer/munin</pkg> to graph
-			statistical data from nsd.</flag>
+		<flag name="packed">Enable packed structure alignment; uses less memory but has unaligned reads</flag>
+		<flag name="radix-tree">Use a red-black tree for main lookups; uses less memory at the expense of more CPU</flag>
+		<flag name="ratelimit">Enables ratelimiting, based on query name, type and source</flag>
+		<flag name="recvmmsg">Enable recvmmsg and sendmmsg compilation, faster but some kernel versions may have implementation problems for IPv6</flag>
+		<flag name="root-server">Configure NSD as a root server (OBSOLETE: removed in >=4.9.x)</flag>
+		<flag name="tfo">Enable TCP Fast Open</flag>
+		<flag name="year2038">Support timestamps after 2038 (glibc only!)</flag>
 	</use>
 	<upstream>
 		<remote-id type="github">NLnetLabs/nsd</remote-id>
diff --git a/net-dns/nsd/nsd-4.7.0.ebuild b/net-dns/nsd/nsd-4.7.0.ebuild
deleted file mode 100644
index e821654c0b57..000000000000
--- a/net-dns/nsd/nsd-4.7.0.ebuild
+++ /dev/null
@@ -1,129 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools systemd
-
-DESCRIPTION="An authoritative only, high performance, open source name server"
-HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
-
-if [[ ${PV} == *9999 ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
-else
-	# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
-	MY_PV="${PV/_beta/b}"
-	MY_PV="${MY_PV/_rc/rc}"
-	MY_P="${PN}-${MY_PV}"
-
-	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
-		SRC_URI="https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
-		S="${WORKDIR}"/${MY_P}
-
-		KEYWORDS="amd64 x86"
-	fi
-fi
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="bind8-stats debug dnstap libevent minimal-responses mmap munin +nsec3 ratelimit root-server ssl systemd"
-
-RDEPEND="
-	acct-group/nsd
-	acct-user/nsd
-	dnstap? (
-		dev-libs/fstrm
-		dev-libs/protobuf-c
-	)
-	libevent? ( dev-libs/libevent )
-	munin? ( net-analyzer/munin )
-	ssl? ( dev-libs/openssl:0= )
-	systemd? ( sys-apps/systemd )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	app-alternatives/lex
-	app-alternatives/yacc
-	systemd? ( virtual/pkgconfig )
-"
-
-PATCHES=(
-	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
-	# bug #907997
-	"${FILESDIR}"/${P}-no-bind8-stats-no-ssl.patch
-)
-
-src_prepare() {
-	default
-
-	# Required to get correct pkg-config macros with USE="systemd"
-	# See bugs #663618 and #758050
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--enable-ipv6
-		--enable-largefile
-		--enable-pie
-		--enable-relro-now
-		--enable-tcp-fastopen
-
-		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
-		--with-logfile="${EPREFIX}"/var/log/nsd.log
-		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
-		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
-		--with-xfrdir="${EPREFIX}"/var/db/nsd
-		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
-		--with-zonesdir="${EPREFIX}"/var/lib/nsd
-
-		$(use_enable bind8-stats)
-		$(use_enable bind8-stats zone-stats)
-		$(use_enable debug checking)
-		$(use_enable dnstap)
-		$(use_enable minimal-responses)
-		$(use_enable mmap)
-		$(use_enable nsec3)
-		$(use_enable ratelimit)
-		$(use_enable root-server)
-		$(use_enable systemd)
-		$(use_with libevent)
-		$(use_with ssl)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	emake DESTDIR="${D}" install
-
-	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
-
-	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
-
-	# Install munin plugin and config
-	if use munin ; then
-		exeinto /usr/libexec/munin/plugins
-		doexe contrib/nsd_munin_
-		insinto /etc/munin/plugin-conf.d
-		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
-	fi
-
-	systemd_dounit "${FILESDIR}"/nsd.service
-
-	# Remove the /run directory that usually resides on tmpfs and is
-	# being taken care of by the nsd init script anyway (checkpath)
-	rm -r "${ED}"/run || die "Failed to remove /run"
-
-	keepdir /var/db/${PN}
-}
-
-pkg_postinst() {
-	# database directory, writable by nsd for database updates and zone transfers
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
-
-	# zones directory, writable by nsd for zone file updates (nsd-control write)
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
-}
diff --git a/net-dns/nsd/nsd-4.8.0-r1.ebuild b/net-dns/nsd/nsd-4.8.0-r1.ebuild
index fc6955f83a99..654f972468e3 100644
--- a/net-dns/nsd/nsd-4.8.0-r1.ebuild
+++ b/net-dns/nsd/nsd-4.8.0-r1.ebuild
@@ -50,8 +50,8 @@ BDEPEND="
 
 PATCHES=(
 	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
-	"${FILESDIR}"/${P}-implausible-stats.patch
+	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
+	"${FILESDIR}/${P}-implausible-stats.patch"
 )
 
 src_prepare() {
diff --git a/net-dns/nsd/nsd-4.8.0.ebuild b/net-dns/nsd/nsd-4.8.0.ebuild
deleted file mode 100644
index ce4bcaba54e0..000000000000
--- a/net-dns/nsd/nsd-4.8.0.ebuild
+++ /dev/null
@@ -1,127 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools systemd
-
-DESCRIPTION="An authoritative only, high performance, open source name server"
-HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
-
-if [[ ${PV} == *9999 ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
-else
-	# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
-	MY_PV="${PV/_beta/b}"
-	MY_PV="${MY_PV/_rc/rc}"
-	MY_P="${PN}-${MY_PV}"
-
-	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
-		SRC_URI="https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
-		S="${WORKDIR}"/${MY_P}
-
-		KEYWORDS="amd64 x86"
-	fi
-fi
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="bind8-stats debug dnstap libevent minimal-responses mmap munin +nsec3 ratelimit root-server ssl systemd"
-
-RDEPEND="
-	acct-group/nsd
-	acct-user/nsd
-	dnstap? (
-		dev-libs/fstrm
-		dev-libs/protobuf-c
-	)
-	libevent? ( dev-libs/libevent )
-	munin? ( net-analyzer/munin )
-	ssl? ( dev-libs/openssl:0= )
-	systemd? ( sys-apps/systemd )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	app-alternatives/lex
-	app-alternatives/yacc
-	systemd? ( virtual/pkgconfig )
-"
-
-PATCHES=(
-	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
-)
-
-src_prepare() {
-	default
-
-	# Required to get correct pkg-config macros with USE="systemd"
-	# See bugs #663618 and #758050
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--enable-ipv6
-		--enable-largefile
-		--enable-pie
-		--enable-relro-now
-		--enable-tcp-fastopen
-
-		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
-		--with-logfile="${EPREFIX}"/var/log/nsd.log
-		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
-		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
-		--with-xfrdir="${EPREFIX}"/var/db/nsd
-		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
-		--with-zonesdir="${EPREFIX}"/var/lib/nsd
-
-		$(use_enable bind8-stats)
-		$(use_enable bind8-stats zone-stats)
-		$(use_enable debug checking)
-		$(use_enable dnstap)
-		$(use_enable minimal-responses)
-		$(use_enable mmap)
-		$(use_enable nsec3)
-		$(use_enable ratelimit)
-		$(use_enable root-server)
-		$(use_enable systemd)
-		$(use_with libevent)
-		$(use_with ssl)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	emake DESTDIR="${D}" install
-
-	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
-
-	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
-
-	# Install munin plugin and config
-	if use munin ; then
-		exeinto /usr/libexec/munin/plugins
-		doexe contrib/nsd_munin_
-		insinto /etc/munin/plugin-conf.d
-		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
-	fi
-
-	systemd_dounit "${FILESDIR}"/nsd.service
-
-	# Remove the /run directory that usually resides on tmpfs and is
-	# being taken care of by the nsd init script anyway (checkpath)
-	rm -r "${ED}"/run || die "Failed to remove /run"
-
-	keepdir /var/db/${PN}
-}
-
-pkg_postinst() {
-	# database directory, writable by nsd for database updates and zone transfers
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
-
-	# zones directory, writable by nsd for zone file updates (nsd-control write)
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
-}
diff --git a/net-dns/nsd/nsd-4.9.1.ebuild b/net-dns/nsd/nsd-4.9.1.ebuild
new file mode 100644
index 000000000000..eb62a90576fc
--- /dev/null
+++ b/net-dns/nsd/nsd-4.9.1.ebuild
@@ -0,0 +1,149 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit autotools systemd tmpfiles
+
+DESCRIPTION="An authoritative only, high performance, open source name server"
+HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
+else
+	# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
+	MY_PV="${PV/_beta/b}"
+	MY_PV="${MY_PV/_rc/rc}"
+	MY_P="${PN}-${MY_PV}"
+
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
+		SRC_URI="https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
+		S="${WORKDIR}"/${MY_P}
+
+		KEYWORDS="~amd64 ~x86"
+	fi
+fi
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="bind8-stats debug +default-znow dnstap +ipv6 +largefile libevent +lto memclean minimal-responses mmap munin +nsec3 packed +pie +radix-tree ratelimit recvmmsg ssl systemd +tfo year2038"
+
+RDEPEND="
+	acct-group/nsd
+	acct-user/nsd
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	libevent? ( dev-libs/libevent )
+	munin? ( net-analyzer/munin )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? ( sys-apps/systemd )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-alternatives/lex
+	app-alternatives/yacc
+	systemd? ( virtual/pkgconfig )
+"
+
+PATCHES=(
+	"${FILESDIR}/${P}-systemd-no-pidfile.patch"
+	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
+)
+
+NSD_CONFD_VER="1"		# Cur version of NSD's OpenRC conf.d file.
+NSD_INITD_VER="2"		# Cur version of NSD's OpenRC init.d script.
+NSD_TMPFILESD_VER="1"		# Cur version of NSD's tmpfiles.d config.
+
+NSD_DBDIR="/var/db/nsd"		# Default dir for NSD's databases.
+NSD_ZNDIR="/var/lib/nsd"	# Default dir for NSD's zone files.
+
+src_prepare() {
+	default
+
+	# Required to get correct pkg-config macros with USE="systemd".
+	# See bugs #663618 & #758050.
+	eautoreconf
+}
+
+src_configure() {
+	local myconf=(
+		$(use_enable bind8-stats)
+		$(use_enable bind8-stats zone-stats)
+		$(use_enable debug checking)
+		$(use_enable default-znow relro-now)
+		$(use_enable dnstap)
+		$(use_enable ipv6)
+		$(use_enable largefile)
+		$(use_enable lto flto)
+		$(use_enable memclean)
+		$(use_enable minimal-responses)
+		$(use_enable mmap)
+		$(use_enable nsec3)
+		$(use_enable packed)
+		$(use_enable pie)
+		$(use_enable radix-tree)
+		$(use_enable ratelimit)
+		$(use_enable recvmmsg)
+		$(use_enable systemd)
+		$(use_enable tfo tcp-fastopen)
+		$(use_with libevent)
+		$(use_with ssl)
+
+		--with-dbfile="${EPREFIX}/${NSD_DBDIR}/nsd.db"
+		--with-logfile="${EPREFIX}/var/log/nsd.log"
+		--with-pidfile="${EPREFIX}/run/nsd.pid"
+		--with-xfrdfile="${EPREFIX}/${NSD_DBDIR}/xfrd.state"
+		--with-xfrdir="${EPREFIX}/${NSD_DBDIR}"
+		--with-zonelistfile="${EPREFIX}/${NSD_DBDIR}/zone.list"
+		--with-zonesdir="${EPREFIX}/${NSD_ZNDIR}"
+	)
+
+	# This configure switch is only available on a glibc-based system.
+	if use elibc_glibc; then
+		myconf+=( $(use_enable year2038) )
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
+	newinitd "${FILESDIR}/nsd.initd-r${NSD_INITD_VER}" nsd
+	newconfd "${FILESDIR}/nsd.confd-r${NSD_CONFD_VER}" nsd
+	newtmpfiles "${FILESDIR}/nsd.tmpfilesd-r${NSD_TMPFILESD_VER}" nsd.conf
+
+	# Install munin plugin and config, if requested.
+	if use munin ; then
+		exeinto "/usr/libexec/munin/plugins"
+		doexe contrib/nsd_munin_
+		insinto "/etc/munin/plugin-conf.d"
+		newins "${FILESDIR}/nsd.munin-conf nsd_munin"
+	fi
+
+	# Use the upstream-provided systemd service file.
+	systemd_dounit "contrib/nsd.service"
+
+	# Remove the /run directory that usually resides on tmpfs and is
+	# being taken care of by the nsd init script anyway (checkpath).
+	rm -r "${ED}/run" || die "Failed to remove /run"
+
+	keepdir "${NSD_DBDIR}"
+}
+
+pkg_postinst() {
+	# See eclass/tmpfiles.eclass for info.
+	tmpfiles_process nsd.conf
+
+	# Database directory
+	# Writable by nsd:nsd for database updates and zone transfers.
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_DBDIR}"
+
+	# Zones directory
+	# Writable by nsd:nsd for zone file updates (via 'nsd-control write').
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_ZNDIR}"
+}
diff --git a/net-dns/nsd/nsd-9999.ebuild b/net-dns/nsd/nsd-9999.ebuild
index abbd21ab799f..77ea73ae7afc 100644
--- a/net-dns/nsd/nsd-9999.ebuild
+++ b/net-dns/nsd/nsd-9999.ebuild
@@ -1,9 +1,9 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=8
+EAPI="8"
 
-inherit autotools systemd
+inherit autotools systemd tmpfiles
 
 DESCRIPTION="An authoritative only, high performance, open source name server"
 HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
@@ -27,7 +27,7 @@ fi
 
 LICENSE="BSD"
 SLOT="0"
-IUSE="bind8-stats debug dnstap libevent minimal-responses mmap munin +nsec3 ratelimit root-server ssl systemd"
+IUSE="bind8-stats debug +default-znow dnstap +ipv6 +largefile libevent +lto memclean minimal-responses mmap munin +nsec3 packed +pie +radix-tree ratelimit recvmmsg ssl systemd +tfo year2038"
 
 RDEPEND="
 	acct-group/nsd
@@ -49,49 +49,63 @@ BDEPEND="
 "
 
 PATCHES=(
-	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
+	"${FILESDIR}/${P}-systemd-no-pidfile.patch"
+	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
 )
 
+NSD_INITD_VER="2"		# Current version of NSD's OpenRC init.d script.
+NSD_TMPFILESD_VER="1"		# Current version of NSD's tmpfiles.d config.
+
+NSD_DBDIR="/var/db/nsd"		# Default dir for NSD's databases.
+NSD_ZNDIR="/var/lib/nsd"	# Default dir for NSD's zone files.
+
 src_prepare() {
 	default
 
-	# Required to get correct pkg-config macros with USE="systemd"
-	# See bugs #663618 and #758050
+	# Required to get correct pkg-config macros with USE="systemd".
+	# See bugs #663618 & #758050.
 	eautoreconf
 }
 
 src_configure() {
-	local myeconfargs=(
-		--enable-ipv6
-		--enable-largefile
-		--enable-pie
-		--enable-relro-now
-		--enable-tcp-fastopen
-
-		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
-		--with-logfile="${EPREFIX}"/var/log/nsd.log
-		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
-		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
-		--with-xfrdir="${EPREFIX}"/var/db/nsd
-		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
-		--with-zonesdir="${EPREFIX}"/var/lib/nsd
-
+	local myconf=(
 		$(use_enable bind8-stats)
 		$(use_enable bind8-stats zone-stats)
 		$(use_enable debug checking)
+		$(use_enable default-znow relro-now)
 		$(use_enable dnstap)
+		$(use_enable ipv6)
+		$(use_enable largefile)
+		$(use_enable lto flto)
+		$(use_enable memclean)
 		$(use_enable minimal-responses)
 		$(use_enable mmap)
 		$(use_enable nsec3)
+		$(use_enable packed)
+		$(use_enable pie)
+		$(use_enable radix-tree)
 		$(use_enable ratelimit)
-		$(use_enable root-server)
+		$(use_enable recvmmsg)
 		$(use_enable systemd)
+		$(use_enable tfo tcp-fastopen)
 		$(use_with libevent)
 		$(use_with ssl)
+
+		--with-dbfile="${EPREFIX}/${NSD_DBDIR}/nsd.db"
+		--with-logfile="${EPREFIX}/var/log/nsd.log"
+		--with-pidfile="${EPREFIX}/run/nsd/nsd.pid"
+		--with-xfrdfile="${EPREFIX}/${NSD_DBDIR}/xfrd.state"
+		--with-xfrdir="${EPREFIX}/${NSD_DBDIR}"
+		--with-zonelistfile="${EPREFIX}/${NSD_DBDIR}/zone.list"
+		--with-zonesdir="${EPREFIX}/${NSD_ZNDIR}"
 	)
 
-	econf "${myeconfargs[@]}"
+	# This configure switch is only available on a glibc-based system.
+	if use elibc_glibc; then
+		myconf+=( $(use_enable year2038) )
+	fi
+
+	econf "${myconf[@]}"
 }
 
 src_install() {
@@ -99,29 +113,37 @@ src_install() {
 
 	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
 
-	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
+	newinitd "${FILESDIR}/nsd.initd-r${NSD_INITD_VER}" nsd
 
-	# Install munin plugin and config
+	newtmpfiles "${FILESDIR}/nsd.tmpfilesd-r1" nsd.conf
+
+	# Install munin plugin and config, if requested.
 	if use munin ; then
-		exeinto /usr/libexec/munin/plugins
+		exeinto "/usr/libexec/munin/plugins"
 		doexe contrib/nsd_munin_
-		insinto /etc/munin/plugin-conf.d
-		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
+		insinto "/etc/munin/plugin-conf.d"
+		newins "${FILESDIR}/nsd.munin-conf nsd_munin"
 	fi
 
-	systemd_dounit "${FILESDIR}"/nsd.service
+	# Use the upstream-provided systemd service file.
+	systemd_dounit "contrib/nsd.service"
 
 	# Remove the /run directory that usually resides on tmpfs and is
-	# being taken care of by the nsd init script anyway (checkpath)
-	rm -r "${ED}"/run || die "Failed to remove /run"
+	# being taken care of by the nsd init script anyway (checkpath).
+	rm -r "${ED}/run" || die "Failed to remove /run"
 
-	keepdir /var/db/${PN}
+	keepdir "${NSD_DBDIR}"
 }
 
 pkg_postinst() {
-	# database directory, writable by nsd for database updates and zone transfers
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
+	# See eclass/tmpfiles.eclass for info.
+	tmpfiles_process nsd.conf
+
+	# Database directory
+	# Writable by nsd:nsd for database updates and zone transfers.
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_DBDIR}"
 
-	# zones directory, writable by nsd for zone file updates (nsd-control write)
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
+	# Zones directory
+	# Writable by nsd:nsd for zone file updates (via 'nsd-control write').
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_ZNDIR}"
 }