Merge remote-tracking branch 'origin/6.0' into daemon-refactor-2

109 files changed, 217 insertions, 797 deletions

diff --git a/modules/bogus_log/.packaging/test.config b/modules/bogus_log/.packaging/test.config
deleted file mode 100644
index bf1c8219..00000000
--- a/modules/bogus_log/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('bogus_log')
-assert(bogus_log)
-quit()
diff --git a/modules/daf/.packaging/test.config b/modules/daf/.packaging/test.config
deleted file mode 100644
index 2fa1d8cb..00000000
--- a/modules/daf/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('daf')
-assert(daf)
-quit()
diff --git a/modules/daf/daf.test.lua b/modules/daf/daf.test.lua
index 2a46393b..557c1a99 100644
--- a/modules/daf/daf.test.lua
+++ b/modules/daf/daf.test.lua
@@ -37,7 +37,9 @@ local function test_basic_actions()
 	daf.add('qname = deny. deny')
 	daf.add('qname = drop. drop')
 
-	check_answer('daf pass action', 'pass.', kres.type.A, kres.rcode.NOERROR)
+	-- This one won't work anymore, as PASS(THRU) now also skips hints.
+	--check_answer('daf pass action', 'pass.', kres.type.A, kres.rcode.NOERROR)
+
 	check_answer('daf deny action', 'deny.', kres.type.A, kres.rcode.NXDOMAIN)
 	check_answer('daf drop action', 'drop.', kres.type.A, kres.rcode.SERVFAIL)
 end
diff --git a/modules/detect_time_jump/.packaging/test.config b/modules/detect_time_jump/.packaging/test.config
deleted file mode 100644
index 7ed0e602..00000000
--- a/modules/detect_time_jump/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('detect_time_jump')
-assert(detect_time_jump)
-quit()
diff --git a/modules/detect_time_skew/.packaging/test.config b/modules/detect_time_skew/.packaging/test.config
deleted file mode 100644
index 3a379071..00000000
--- a/modules/detect_time_skew/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('detect_time_skew')
-assert(detect_time_skew)
-quit()
diff --git a/modules/dns64/.packaging/test.config b/modules/dns64/.packaging/test.config
deleted file mode 100644
index 5abf524c..00000000
--- a/modules/dns64/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('dns64')
-assert(dns64)
-quit()
diff --git a/modules/dns64/dns64.test.lua b/modules/dns64/dns64.test.lua
index 45956a4c..0686ecc0 100644
--- a/modules/dns64/dns64.test.lua
+++ b/modules/dns64/dns64.test.lua
@@ -3,9 +3,9 @@ local condition = require('cqueues.condition')
 
 -- setup resolver
 modules = { 'hints', 'dns64' }
-hints['dns64.example'] = '192.168.1.1'
 hints.use_nodata(true) -- Respond NODATA to AAAA query
 hints.ttl(60)
+hints['dns64.example'] = '192.168.1.1'
 dns64.config('fe80::21b:77ff:0:0')
 
 -- helper to wait for query resolution
diff --git a/modules/dnstap/.packaging/centos/7/builddeps b/modules/dnstap/.packaging/centos/7/builddeps
deleted file mode 100644
index d3ab3547..00000000
--- a/modules/dnstap/.packaging/centos/7/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-fstrm-devel
-protobuf-c-devel
-protobuf-c-compiler
diff --git a/modules/dnstap/.packaging/centos/7/rundeps b/modules/dnstap/.packaging/centos/7/rundeps
deleted file mode 100644
index 06c2792f..00000000
--- a/modules/dnstap/.packaging/centos/7/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-fstrm
-protobuf-c
diff --git a/modules/dnstap/.packaging/centos/8/builddeps b/modules/dnstap/.packaging/centos/8/builddeps
deleted file mode 100644
index d3ab3547..00000000
--- a/modules/dnstap/.packaging/centos/8/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-fstrm-devel
-protobuf-c-devel
-protobuf-c-compiler
diff --git a/modules/dnstap/.packaging/centos/8/rundeps b/modules/dnstap/.packaging/centos/8/rundeps
deleted file mode 100644
index 06c2792f..00000000
--- a/modules/dnstap/.packaging/centos/8/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-fstrm
-protobuf-c
diff --git a/modules/dnstap/.packaging/debian/10/builddeps b/modules/dnstap/.packaging/debian/10/builddeps
deleted file mode 100644
index 417dc04a..00000000
--- a/modules/dnstap/.packaging/debian/10/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-libfstrm-dev
-libprotobuf-c-dev
-protobuf-c-compiler
diff --git a/modules/dnstap/.packaging/debian/10/rundeps b/modules/dnstap/.packaging/debian/10/rundeps
deleted file mode 100644
index a726e120..00000000
--- a/modules/dnstap/.packaging/debian/10/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-libfstrm0
-libprotobuf-c1
diff --git a/modules/dnstap/.packaging/debian/9/builddeps b/modules/dnstap/.packaging/debian/9/builddeps
deleted file mode 100644
index 417dc04a..00000000
--- a/modules/dnstap/.packaging/debian/9/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-libfstrm-dev
-libprotobuf-c-dev
-protobuf-c-compiler
diff --git a/modules/dnstap/.packaging/debian/9/rundeps b/modules/dnstap/.packaging/debian/9/rundeps
deleted file mode 100644
index a726e120..00000000
--- a/modules/dnstap/.packaging/debian/9/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-libfstrm0
-libprotobuf-c1
diff --git a/modules/dnstap/.packaging/fedora/31/builddeps b/modules/dnstap/.packaging/fedora/31/builddeps
deleted file mode 100644
index d3ab3547..00000000
--- a/modules/dnstap/.packaging/fedora/31/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-fstrm-devel
-protobuf-c-devel
-protobuf-c-compiler
diff --git a/modules/dnstap/.packaging/fedora/31/rundeps b/modules/dnstap/.packaging/fedora/31/rundeps
deleted file mode 100644
index 06c2792f..00000000
--- a/modules/dnstap/.packaging/fedora/31/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-fstrm
-protobuf-c
diff --git a/modules/dnstap/.packaging/fedora/32/builddeps b/modules/dnstap/.packaging/fedora/32/builddeps
deleted file mode 100644
index d3ab3547..00000000
--- a/modules/dnstap/.packaging/fedora/32/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-fstrm-devel
-protobuf-c-devel
-protobuf-c-compiler
diff --git a/modules/dnstap/.packaging/fedora/32/rundeps b/modules/dnstap/.packaging/fedora/32/rundeps
deleted file mode 100644
index 06c2792f..00000000
--- a/modules/dnstap/.packaging/fedora/32/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-fstrm
-protobuf-c
diff --git a/modules/dnstap/.packaging/leap/15.2/builddeps b/modules/dnstap/.packaging/leap/15.2/builddeps
deleted file mode 100644
index 30f8d9e1..00000000
--- a/modules/dnstap/.packaging/leap/15.2/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-fstrm-devel
-libprotobuf-c-devel
-protobuf-c
diff --git a/modules/dnstap/.packaging/leap/15.2/rundeps b/modules/dnstap/.packaging/leap/15.2/rundeps
deleted file mode 100644
index 06c2792f..00000000
--- a/modules/dnstap/.packaging/leap/15.2/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-fstrm
-protobuf-c
diff --git a/modules/dnstap/.packaging/test.config b/modules/dnstap/.packaging/test.config
deleted file mode 100644
index 5966860f..00000000
--- a/modules/dnstap/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('dnstap')
-assert(dnstap)
-quit()
diff --git a/modules/dnstap/.packaging/ubuntu/16.04/builddeps b/modules/dnstap/.packaging/ubuntu/16.04/builddeps
deleted file mode 100644
index 417dc04a..00000000
--- a/modules/dnstap/.packaging/ubuntu/16.04/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-libfstrm-dev
-libprotobuf-c-dev
-protobuf-c-compiler
diff --git a/modules/dnstap/.packaging/ubuntu/16.04/rundeps b/modules/dnstap/.packaging/ubuntu/16.04/rundeps
deleted file mode 100644
index a726e120..00000000
--- a/modules/dnstap/.packaging/ubuntu/16.04/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-libfstrm0
-libprotobuf-c1
diff --git a/modules/dnstap/.packaging/ubuntu/18.04/builddeps b/modules/dnstap/.packaging/ubuntu/18.04/builddeps
deleted file mode 100644
index 417dc04a..00000000
--- a/modules/dnstap/.packaging/ubuntu/18.04/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-libfstrm-dev
-libprotobuf-c-dev
-protobuf-c-compiler
diff --git a/modules/dnstap/.packaging/ubuntu/18.04/rundeps b/modules/dnstap/.packaging/ubuntu/18.04/rundeps
deleted file mode 100644
index a726e120..00000000
--- a/modules/dnstap/.packaging/ubuntu/18.04/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-libfstrm0
-libprotobuf-c1
diff --git a/modules/dnstap/.packaging/ubuntu/20.04/builddeps b/modules/dnstap/.packaging/ubuntu/20.04/builddeps
deleted file mode 100644
index 417dc04a..00000000
--- a/modules/dnstap/.packaging/ubuntu/20.04/builddeps
+++ /dev/null
@@ -1,3 +0,0 @@
-libfstrm-dev
-libprotobuf-c-dev
-protobuf-c-compiler
diff --git a/modules/dnstap/.packaging/ubuntu/20.04/rundeps b/modules/dnstap/.packaging/ubuntu/20.04/rundeps
deleted file mode 100644
index a726e120..00000000
--- a/modules/dnstap/.packaging/ubuntu/20.04/rundeps
+++ /dev/null
@@ -1,2 +0,0 @@
-libfstrm0
-libprotobuf-c1
diff --git a/modules/edns_keepalive/.packaging/test.config b/modules/edns_keepalive/.packaging/test.config
deleted file mode 100644
index 5c71c797..00000000
--- a/modules/edns_keepalive/.packaging/test.config
+++ /dev/null
@@ -1,10 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('edns_keepalive')
-
-for _,item in ipairs(modules.list()) do
-	if item == "edns_keepalive" then
-		os.exit(0)
-	end
-end
-
-os.exit(1)
diff --git a/modules/etcd/.packaging/centos/7/pre-test.sh b/modules/etcd/.packaging/centos/7/pre-test.sh
deleted file mode 100755
index 4df79d99..00000000
--- a/modules/etcd/.packaging/centos/7/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks install etcd --from=https://mah0x211.github.io/rocks/
diff --git a/modules/etcd/.packaging/centos/7/rundeps b/modules/etcd/.packaging/centos/7/rundeps
deleted file mode 100644
index 795a3c44..00000000
--- a/modules/etcd/.packaging/centos/7/rundeps
+++ /dev/null
@@ -1,6 +0,0 @@
-openssl-devel
-lua-devel
-luarocks
-git
-gcc
-make
diff --git a/modules/etcd/.packaging/centos/8/NOTSUPPORTED b/modules/etcd/.packaging/centos/8/NOTSUPPORTED
deleted file mode 100644
index e69de29b..00000000
--- a/modules/etcd/.packaging/centos/8/NOTSUPPORTED
+++ /dev/null
diff --git a/modules/etcd/.packaging/debian/10/pre-test.sh b/modules/etcd/.packaging/debian/10/pre-test.sh
deleted file mode 100755
index 20073dc8..00000000
--- a/modules/etcd/.packaging/debian/10/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks --lua-version 5.1 install etcd --from=https://mah0x211.github.io/rocks/
diff --git a/modules/etcd/.packaging/debian/10/rundeps b/modules/etcd/.packaging/debian/10/rundeps
deleted file mode 100644
index 02d3fcf5..00000000
--- a/modules/etcd/.packaging/debian/10/rundeps
+++ /dev/null
@@ -1,4 +0,0 @@
-libssl-dev
-luarocks
-git
-make
diff --git a/modules/etcd/.packaging/debian/9/pre-test.sh b/modules/etcd/.packaging/debian/9/pre-test.sh
deleted file mode 100755
index 4df79d99..00000000
--- a/modules/etcd/.packaging/debian/9/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks install etcd --from=https://mah0x211.github.io/rocks/
diff --git a/modules/etcd/.packaging/debian/9/rundeps b/modules/etcd/.packaging/debian/9/rundeps
deleted file mode 100644
index 02d3fcf5..00000000
--- a/modules/etcd/.packaging/debian/9/rundeps
+++ /dev/null
@@ -1,4 +0,0 @@
-libssl-dev
-luarocks
-git
-make
diff --git a/modules/etcd/.packaging/fedora/31/NOTSUPPORTED b/modules/etcd/.packaging/fedora/31/NOTSUPPORTED
deleted file mode 100644
index b912289a..00000000
--- a/modules/etcd/.packaging/fedora/31/NOTSUPPORTED
+++ /dev/null
@@ -1,16 +0,0 @@
-Error installing etcd using luarocks:
-
-
-
-Missing dependencies for process 1.9.0-1:
-   luarocks-fetch-gitrec >= 0.2 (not installed)
-
-process 1.9.0-1 depends on luarocks-fetch-gitrec >= 0.2 (not installed)
-Installing https://luarocks.org/luarocks-fetch-gitrec-0.2-1.src.rock
-
-No existing manifest. Attempting to rebuild...
-luarocks-fetch-gitrec 0.2-1 is now installed in /root/.luarocks (license: MIT)
-
-
-Error: Unknown protocol gitrec
-
diff --git a/modules/etcd/.packaging/fedora/32/NOTSUPPORTED b/modules/etcd/.packaging/fedora/32/NOTSUPPORTED
deleted file mode 100644
index b912289a..00000000
--- a/modules/etcd/.packaging/fedora/32/NOTSUPPORTED
+++ /dev/null
@@ -1,16 +0,0 @@
-Error installing etcd using luarocks:
-
-
-
-Missing dependencies for process 1.9.0-1:
-   luarocks-fetch-gitrec >= 0.2 (not installed)
-
-process 1.9.0-1 depends on luarocks-fetch-gitrec >= 0.2 (not installed)
-Installing https://luarocks.org/luarocks-fetch-gitrec-0.2-1.src.rock
-
-No existing manifest. Attempting to rebuild...
-luarocks-fetch-gitrec 0.2-1 is now installed in /root/.luarocks (license: MIT)
-
-
-Error: Unknown protocol gitrec
-
diff --git a/modules/etcd/.packaging/leap/15.2/pre-test.sh b/modules/etcd/.packaging/leap/15.2/pre-test.sh
deleted file mode 100755
index 20073dc8..00000000
--- a/modules/etcd/.packaging/leap/15.2/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks --lua-version 5.1 install etcd --from=https://mah0x211.github.io/rocks/
diff --git a/modules/etcd/.packaging/leap/15.2/rundeps b/modules/etcd/.packaging/leap/15.2/rundeps
deleted file mode 100644
index e8df59ba..00000000
--- a/modules/etcd/.packaging/leap/15.2/rundeps
+++ /dev/null
@@ -1,6 +0,0 @@
-libopenssl-devel
-lua51-devel
-lua51-luarocks
-git
-gcc
-make
diff --git a/modules/etcd/.packaging/test.config b/modules/etcd/.packaging/test.config
deleted file mode 100644
index 1cc7e5aa..00000000
--- a/modules/etcd/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('etcd')
-assert(etcd)
-quit()
diff --git a/modules/etcd/.packaging/ubuntu/16.04/pre-test.sh b/modules/etcd/.packaging/ubuntu/16.04/pre-test.sh
deleted file mode 100755
index 4df79d99..00000000
--- a/modules/etcd/.packaging/ubuntu/16.04/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks install etcd --from=https://mah0x211.github.io/rocks/
diff --git a/modules/etcd/.packaging/ubuntu/16.04/rundeps b/modules/etcd/.packaging/ubuntu/16.04/rundeps
deleted file mode 100644
index a355a9f8..00000000
--- a/modules/etcd/.packaging/ubuntu/16.04/rundeps
+++ /dev/null
@@ -1,3 +0,0 @@
-libssl-dev
-luarocks
-git
diff --git a/modules/etcd/.packaging/ubuntu/18.04/pre-test.sh b/modules/etcd/.packaging/ubuntu/18.04/pre-test.sh
deleted file mode 100755
index 4df79d99..00000000
--- a/modules/etcd/.packaging/ubuntu/18.04/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks install etcd --from=https://mah0x211.github.io/rocks/
diff --git a/modules/etcd/.packaging/ubuntu/18.04/rundeps b/modules/etcd/.packaging/ubuntu/18.04/rundeps
deleted file mode 100644
index a355a9f8..00000000
--- a/modules/etcd/.packaging/ubuntu/18.04/rundeps
+++ /dev/null
@@ -1,3 +0,0 @@
-libssl-dev
-luarocks
-git
diff --git a/modules/etcd/.packaging/ubuntu/20.04/pre-test.sh b/modules/etcd/.packaging/ubuntu/20.04/pre-test.sh
deleted file mode 100755
index 20073dc8..00000000
--- a/modules/etcd/.packaging/ubuntu/20.04/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks --lua-version 5.1 install etcd --from=https://mah0x211.github.io/rocks/
diff --git a/modules/etcd/.packaging/ubuntu/20.04/rundeps b/modules/etcd/.packaging/ubuntu/20.04/rundeps
deleted file mode 100644
index 02d3fcf5..00000000
--- a/modules/etcd/.packaging/ubuntu/20.04/rundeps
+++ /dev/null
@@ -1,4 +0,0 @@
-libssl-dev
-luarocks
-git
-make
diff --git a/modules/experimental_dot_auth/.packaging/centos/7/rundeps b/modules/experimental_dot_auth/.packaging/centos/7/rundeps
deleted file mode 100644
index 36b83e18..00000000
--- a/modules/experimental_dot_auth/.packaging/centos/7/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-basexx
diff --git a/modules/experimental_dot_auth/.packaging/centos/8/rundeps b/modules/experimental_dot_auth/.packaging/centos/8/rundeps
deleted file mode 100644
index 984c7cec..00000000
--- a/modules/experimental_dot_auth/.packaging/centos/8/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua5.1-basexx
diff --git a/modules/experimental_dot_auth/.packaging/debian/10/rundeps b/modules/experimental_dot_auth/.packaging/debian/10/rundeps
deleted file mode 100644
index 36b83e18..00000000
--- a/modules/experimental_dot_auth/.packaging/debian/10/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-basexx
diff --git a/modules/experimental_dot_auth/.packaging/debian/9/rundeps b/modules/experimental_dot_auth/.packaging/debian/9/rundeps
deleted file mode 100644
index 36b83e18..00000000
--- a/modules/experimental_dot_auth/.packaging/debian/9/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-basexx
diff --git a/modules/experimental_dot_auth/.packaging/fedora/31/rundeps b/modules/experimental_dot_auth/.packaging/fedora/31/rundeps
deleted file mode 100644
index 984c7cec..00000000
--- a/modules/experimental_dot_auth/.packaging/fedora/31/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua5.1-basexx
diff --git a/modules/experimental_dot_auth/.packaging/fedora/32/rundeps b/modules/experimental_dot_auth/.packaging/fedora/32/rundeps
deleted file mode 100644
index 984c7cec..00000000
--- a/modules/experimental_dot_auth/.packaging/fedora/32/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua5.1-basexx
diff --git a/modules/experimental_dot_auth/.packaging/leap/15.2/NOTSUPPORTED b/modules/experimental_dot_auth/.packaging/leap/15.2/NOTSUPPORTED
deleted file mode 100644
index 682eff05..00000000
--- a/modules/experimental_dot_auth/.packaging/leap/15.2/NOTSUPPORTED
+++ /dev/null
@@ -1,6 +0,0 @@
-
-ERROR:test_packaging:Installing https://luarocks.org/basexx-0.4.1-1.rockspec
-Error: Failed extracting v0.4.1.tar.gz
-
-Doesn't works on GitLab CI/CD, but works on localhost.
-gzip and tar packages are installed, all packages has same version as packages on localhost's docker container.
diff --git a/modules/experimental_dot_auth/.packaging/leap/15.2/pre-test.sh b/modules/experimental_dot_auth/.packaging/leap/15.2/pre-test.sh
deleted file mode 100755
index df5d7845..00000000
--- a/modules/experimental_dot_auth/.packaging/leap/15.2/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks --lua-version 5.1 install basexx --from=https://mah0x211.github.io/rocks/
diff --git a/modules/experimental_dot_auth/.packaging/leap/15.2/rundeps b/modules/experimental_dot_auth/.packaging/leap/15.2/rundeps
deleted file mode 100644
index 9e636d84..00000000
--- a/modules/experimental_dot_auth/.packaging/leap/15.2/rundeps
+++ /dev/null
@@ -1,4 +0,0 @@
-lua51-luarocks
-git
-tar
-gzip
diff --git a/modules/experimental_dot_auth/.packaging/test.config b/modules/experimental_dot_auth/.packaging/test.config
deleted file mode 100644
index 39e9aed8..00000000
--- a/modules/experimental_dot_auth/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('experimental_dot_auth')
-assert(experimental_dot_auth)
-quit()
diff --git a/modules/experimental_dot_auth/.packaging/ubuntu/16.04/NOTSUPPORTED b/modules/experimental_dot_auth/.packaging/ubuntu/16.04/NOTSUPPORTED
deleted file mode 100644
index e69de29b..00000000
--- a/modules/experimental_dot_auth/.packaging/ubuntu/16.04/NOTSUPPORTED
+++ /dev/null
diff --git a/modules/experimental_dot_auth/.packaging/ubuntu/18.04/rundeps b/modules/experimental_dot_auth/.packaging/ubuntu/18.04/rundeps
deleted file mode 100644
index 36b83e18..00000000
--- a/modules/experimental_dot_auth/.packaging/ubuntu/18.04/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-basexx
diff --git a/modules/experimental_dot_auth/.packaging/ubuntu/20.04/rundeps b/modules/experimental_dot_auth/.packaging/ubuntu/20.04/rundeps
deleted file mode 100644
index 36b83e18..00000000
--- a/modules/experimental_dot_auth/.packaging/ubuntu/20.04/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-basexx
diff --git a/modules/graphite/.packaging/centos/7/rundeps b/modules/graphite/.packaging/centos/7/rundeps
deleted file mode 100644
index 3da806bd..00000000
--- a/modules/graphite/.packaging/centos/7/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-cqueues
diff --git a/modules/graphite/.packaging/centos/8/rundeps b/modules/graphite/.packaging/centos/8/rundeps
deleted file mode 100644
index 182251d9..00000000
--- a/modules/graphite/.packaging/centos/8/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua5.1-cqueues
diff --git a/modules/graphite/.packaging/debian/10/rundeps b/modules/graphite/.packaging/debian/10/rundeps
deleted file mode 100644
index 3da806bd..00000000
--- a/modules/graphite/.packaging/debian/10/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-cqueues
diff --git a/modules/graphite/.packaging/debian/9/rundeps b/modules/graphite/.packaging/debian/9/rundeps
deleted file mode 100644
index 3da806bd..00000000
--- a/modules/graphite/.packaging/debian/9/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-cqueues
diff --git a/modules/graphite/.packaging/fedora/31/rundeps b/modules/graphite/.packaging/fedora/31/rundeps
deleted file mode 100644
index 182251d9..00000000
--- a/modules/graphite/.packaging/fedora/31/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua5.1-cqueues
diff --git a/modules/graphite/.packaging/fedora/32/rundeps b/modules/graphite/.packaging/fedora/32/rundeps
deleted file mode 100644
index 182251d9..00000000
--- a/modules/graphite/.packaging/fedora/32/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua5.1-cqueues
diff --git a/modules/graphite/.packaging/leap/15.2/NOTSUPPORTED b/modules/graphite/.packaging/leap/15.2/NOTSUPPORTED
deleted file mode 100644
index b1ae77d0..00000000
--- a/modules/graphite/.packaging/leap/15.2/NOTSUPPORTED
+++ /dev/null
@@ -1,6 +0,0 @@
-
-ERROR:test_packaging:Installing https://luarocks.org/cqueues-20190813.51-0.src.rock
-164 Error: Failed extracting rel-20190813.tar.gz
-
-Doesn't works on GitLab CI/CD, but works on localhost.
-gzip and tar packages are installed, all packages has same version as packages on localhost's docker container.
diff --git a/modules/graphite/.packaging/leap/15.2/pre-test.sh b/modules/graphite/.packaging/leap/15.2/pre-test.sh
deleted file mode 100755
index 9614066a..00000000
--- a/modules/graphite/.packaging/leap/15.2/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks --lua-version 5.1 install cqueues --from=https://mah0x211.github.io/rocks/
diff --git a/modules/graphite/.packaging/leap/15.2/rundeps b/modules/graphite/.packaging/leap/15.2/rundeps
deleted file mode 100644
index 83238871..00000000
--- a/modules/graphite/.packaging/leap/15.2/rundeps
+++ /dev/null
@@ -1,6 +0,0 @@
-libopenssl-devel
-lua51-luarocks
-git
-tar
-gzip
-m4
diff --git a/modules/graphite/.packaging/test.config b/modules/graphite/.packaging/test.config
deleted file mode 100644
index c23033b1..00000000
--- a/modules/graphite/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('graphite')
-assert(graphite)
-quit()
diff --git a/modules/graphite/.packaging/ubuntu/16.04/rundeps b/modules/graphite/.packaging/ubuntu/16.04/rundeps
deleted file mode 100644
index 3da806bd..00000000
--- a/modules/graphite/.packaging/ubuntu/16.04/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-cqueues
diff --git a/modules/graphite/.packaging/ubuntu/18.04/rundeps b/modules/graphite/.packaging/ubuntu/18.04/rundeps
deleted file mode 100644
index 3da806bd..00000000
--- a/modules/graphite/.packaging/ubuntu/18.04/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-cqueues
diff --git a/modules/graphite/.packaging/ubuntu/20.04/rundeps b/modules/graphite/.packaging/ubuntu/20.04/rundeps
deleted file mode 100644
index 3da806bd..00000000
--- a/modules/graphite/.packaging/ubuntu/20.04/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-cqueues
diff --git a/modules/hints/.packaging/test.config b/modules/hints/.packaging/test.config
deleted file mode 100644
index d89c7f0c..00000000
--- a/modules/hints/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('hints')
-assert(hints)
-quit()
diff --git a/modules/hints/README.rst b/modules/hints/README.rst
index 97d24ddc..7d775188 100644
--- a/modules/hints/README.rst
+++ b/modules/hints/README.rst
@@ -8,8 +8,7 @@ Static hints
 This is a module providing static hints for forward records (A/AAAA) and reverse records (PTR).
 The records can be loaded from ``/etc/hosts``-like files and/or added directly.
 
-You can also use the module to change the root hints; they are used as a safety belt or if the root NS
-drops out of cache.
+You can also use the module to change fallback addresses for the root servers.
 
 .. tip::
 
@@ -110,6 +109,9 @@ Properties
 
   Replace current root hints and return the current table of root hints.
 
+  These root hints are only used as fallback when addresses of ``NS .`` aren't available,
+  e.g. when cache is completely clear.
+
   .. tip:: If no parameters are passed, it only returns current root hints set without changing anything.
 
   Example:
@@ -127,8 +129,6 @@ Properties
       [1] => 202.12.27.33
     }
 
-  .. tip:: A good rule of thumb is to select only a few fastest root hints. The server learns RTT and NS quality over time, and thus tries all servers available. You can help it by preselecting the candidates.
-
 .. function:: hints.use_nodata(toggle)
 
   :param bool toggle: true if enabling NODATA synthesis, false if disabling
@@ -136,6 +136,8 @@ Properties
 
   If set to true (the default), NODATA will be synthesised for matching hint name, but mismatching type (e.g. AAAA query when only A hint exists).
 
+  The setting is (now) per-entry, so you want to set it before any address-name pairs.
+
 .. function:: hints.ttl([new_ttl])
 
   :param int new_ttl: new TTL to set (optional)
@@ -143,3 +145,5 @@ Properties
 
   This function allows to read and write the TTL value used for records generated by the hints module.
 
+  The setting is (now) per-entry, so you want to set it before any address-name pairs.
+
diff --git a/modules/hints/hints.c b/modules/hints/hints.c
index 25d41c90..ccbc9880 100644
--- a/modules/hints/hints.c
+++ b/modules/hints/hints.c
@@ -20,6 +20,7 @@
 #include "lib/zonecut.h"
 #include "lib/module.h"
 #include "lib/layer.h"
+#include "lib/rules/api.h"
 
 #include <inttypes.h>
 #include <math.h>
@@ -29,8 +30,6 @@
 #define ERR_MSG(...) kr_log_error(HINT, "[     ]" __VA_ARGS__)
 
 struct hints_data {
-	struct kr_zonecut hints;
-	struct kr_zonecut reverse_hints;
 	bool use_nodata; /**< See hint_use_nodata() description, exposed via lua. */
 	uint32_t ttl;    /**< TTL used for the hints, exposed via lua. */
 };
@@ -45,130 +44,6 @@ static char * bool2jsonstr(bool val)
 	return result;
 }
 
-static int put_answer(knot_pkt_t *pkt, struct kr_query *qry, knot_rrset_t *rr, bool use_nodata)
-{
-	int ret = 0;
-	if (!knot_rrset_empty(rr) || use_nodata) {
-		/* Update packet question */
-		if (!knot_dname_is_equal(knot_pkt_qname(pkt), rr->owner)) {
-			kr_pkt_recycle(pkt);
-			knot_pkt_put_question(pkt, qry->sname, qry->sclass, qry->stype);
-		}
-		if (!knot_rrset_empty(rr)) {
-			/* Append to packet */
-			ret = knot_pkt_put_rotate(pkt, KNOT_COMPR_HINT_QNAME, rr,
-						  qry->reorder, KNOT_PF_FREE);
-		} else {
-			/* Return empty answer if name exists, but type doesn't match */
-			knot_wire_set_aa(pkt->wire);
-		}
-	} else {
-		ret = kr_error(ENOENT);
-	}
-	/* Clear RR if failed */
-	if (ret != 0) {
-		knot_rrset_clear(rr, &pkt->mm);
-	}
-	return ret;
-}
-
-static int satisfy_reverse(/*const*/ struct hints_data *data,
-			   knot_pkt_t *pkt, struct kr_query *qry)
-{
-	/* Find a matching name */
-	pack_t *addr_set = kr_zonecut_find(&data->reverse_hints, qry->sname);
-	if (!addr_set || addr_set->len == 0) {
-		return kr_error(ENOENT);
-	}
-	knot_dname_t *qname = knot_dname_copy(qry->sname, &pkt->mm);
-	knot_rrset_t rr;
-	knot_rrset_init(&rr, qname, KNOT_RRTYPE_PTR, KNOT_CLASS_IN, data->ttl);
-
-	/* Append address records from hints */
-	uint8_t *addr = pack_last(*addr_set);
-	if (addr != NULL) {
-		size_t len = pack_obj_len(addr);
-		void *addr_val = pack_obj_val(addr);
-		knot_rrset_add_rdata(&rr, addr_val, len, &pkt->mm);
-	}
-
-	return put_answer(pkt, qry, &rr, data->use_nodata);
-}
-
-static int satisfy_forward(/*const*/ struct hints_data *data,
-			   knot_pkt_t *pkt, struct kr_query *qry)
-{
-	/* Find a matching name */
-	pack_t *addr_set = kr_zonecut_find(&data->hints, qry->sname);
-	if (!addr_set || addr_set->len == 0) {
-		return kr_error(ENOENT);
-	}
-	knot_dname_t *qname = knot_dname_copy(qry->sname, &pkt->mm);
-	knot_rrset_t rr;
-	knot_rrset_init(&rr, qname, qry->stype, qry->sclass, data->ttl);
-
-	size_t family_len;
-	switch (rr.type) {
-	case KNOT_RRTYPE_A:
-		family_len = sizeof(struct in_addr);
-		break;
-	case KNOT_RRTYPE_AAAA:
-		family_len = sizeof(struct in6_addr);
-		break;
-	default:
-		goto finish;
-	};
-
-	/* Append address records from hints */
-	uint8_t *addr = pack_head(*addr_set);
-	while (addr != pack_tail(*addr_set)) {
-		size_t len = pack_obj_len(addr);
-		void *addr_val = pack_obj_val(addr);
-		if (len == family_len) {
-			knot_rrset_add_rdata(&rr, addr_val, len, &pkt->mm);
-		}
-		addr = pack_obj_next(addr);
-	}
-finish:
-	return put_answer(pkt, qry, &rr, data->use_nodata);
-}
-
-static int query(kr_layer_t *ctx, knot_pkt_t *pkt)
-{
-	struct kr_query *qry = ctx->req->current_query;
-	if (!qry || (ctx->state & KR_STATE_FAIL)) {
-		return ctx->state;
-	}
-
-	struct kr_module *module = ctx->api->data;
-	struct hints_data *data = module->data;
-	if (!data) { /* No valid file. */
-		return ctx->state;
-	}
-	/* We can optimize for early return like this: */
-	if (!data->use_nodata && qry->stype != KNOT_RRTYPE_A
-	    && qry->stype != KNOT_RRTYPE_AAAA && qry->stype != KNOT_RRTYPE_PTR) {
-		return ctx->state;
-	}
-	/* FIXME: putting directly into packet breaks ordering in case the hint
-	 * is applied after a CNAME jump. */
-	if (knot_dname_in_bailiwick(qry->sname, (const uint8_t *)"\4arpa\0") >= 0) {
-		if (satisfy_reverse(data, pkt, qry) != 0)
-			return ctx->state;
-	} else {
-		if (satisfy_forward(data, pkt, qry) != 0)
-			return ctx->state;
-	}
-
-	VERBOSE_MSG(qry, "<= answered from hints\n");
-	qry->flags.DNSSEC_WANT = false; /* Never authenticated */
-	qry->flags.CACHED = true;
-	qry->flags.NO_MINIMIZE = true;
-	pkt->parsed = pkt->size;
-	knot_wire_set_qr(pkt->wire);
-	return KR_STATE_DONE;
-}
-
 static int parse_addr_str(union kr_sockaddr *sa, const char *addr)
 {
 	int family = strchr(addr, ':') ? AF_INET6 : AF_INET;
@@ -228,7 +103,7 @@ static const knot_dname_t * addr2reverse(const char *addr)
 				kr_inaddr_family(&ia.ip));
 }
 
-static int add_pair(struct kr_zonecut *hints, const char *name, const char *addr)
+static int add_pair_root(struct kr_zonecut *hints, const char *name, const char *addr)
 {
 	/* Build key */
 	knot_dname_t key[KNOT_DNAME_MAXLEN];
@@ -241,73 +116,107 @@ static int add_pair(struct kr_zonecut *hints, const char *name, const char *addr
 	if (parse_addr_str(&ia, addr) != 0) {
 		return kr_error(EINVAL);
 	}
-
 	return kr_zonecut_add(hints, key, kr_inaddr(&ia.ip), kr_inaddr_len(&ia.ip));
 }
 
-static int add_reverse_pair(struct kr_zonecut *hints, const char *name, const char *addr)
+static int add_pair(const struct hints_data *data, const char *name, const char *addr)
 {
-	const knot_dname_t *key = addr2reverse(addr);
+	/* Build key */
+	knot_dname_t key[KNOT_DNAME_MAXLEN];
+	if (!knot_dname_from_str(key, name, sizeof(key))) {
+		return kr_error(EINVAL);
+	}
+	knot_dname_to_lower(key);
 
-	if (key == NULL) {
+	union kr_sockaddr ia;
+	if (parse_addr_str(&ia, addr) != 0) {
 		return kr_error(EINVAL);
 	}
 
+	uint16_t rrtype = ia.ip.sa_family == AF_INET6 ? KNOT_RRTYPE_AAAA : KNOT_RRTYPE_A;
+	knot_rrset_t rrs;
+	knot_rrset_init(&rrs, key, rrtype, KNOT_CLASS_IN, data->ttl);
+	int ret;
+	if (ia.ip.sa_family == AF_INET6) {
+		ret = knot_rrset_add_rdata(&rrs, (const uint8_t *)&ia.ip6.sin6_addr, 16, NULL);
+	} else {
+		ret = knot_rrset_add_rdata(&rrs, (const uint8_t *)&ia.ip4.sin_addr, 4, NULL);
+	}
+	if (!ret) ret = kr_rule_local_data_ins(&rrs, NULL, KR_RULE_TAGS_ALL);
+	if (!ret && data->use_nodata) {
+		rrs.type = KNOT_RRTYPE_CNAME;
+		rrs.rrs.count = 0;
+		rrs.rrs.size = 0;
+		ret = kr_rule_local_data_ins(&rrs, NULL, KR_RULE_TAGS_ALL);
+	}
+
+	knot_rdataset_clear(&rrs.rrs, NULL);
+	return ret;
+}
+
+static int add_reverse_pair(const struct hints_data *data, const char *name, const char *addr)
+{
+	const knot_dname_t *key = addr2reverse(addr);
+	if (!key)
+		return kr_error(EINVAL);
+	knot_rrset_t rrs;
+	knot_rrset_init(&rrs, /*const-cast*/(knot_dname_t *)key,
+			KNOT_RRTYPE_PTR, KNOT_CLASS_IN, data->ttl);
 	knot_dname_t ptr_name[KNOT_DNAME_MAXLEN];
-	if (!knot_dname_from_str(ptr_name, name, sizeof(ptr_name))) {
+	if (!knot_dname_from_str(ptr_name, name, sizeof(ptr_name)))
 		return kr_error(EINVAL);
+	int ret = knot_rrset_add_rdata(&rrs, ptr_name, knot_dname_size(ptr_name), NULL);
+	if (!ret) {
+		ret = kr_rule_local_data_ins(&rrs, NULL, KR_RULE_TAGS_ALL);
+		knot_rdataset_clear(&rrs.rrs, NULL);
 	}
-
-	return kr_zonecut_add(hints, key, ptr_name, knot_dname_size(ptr_name));
+	return ret;
 }
 
-/** For a given name, remove either one address or all of them (if == NULL).
+/** For a given name, remove either one address  ##or all of them (if == NULL).
  *
  * Also remove the corresponding reverse records.
  */
 static int del_pair(struct hints_data *data, const char *name, const char *addr)
 {
-	/* Build key */
-	knot_dname_t key[KNOT_DNAME_MAXLEN];
-	if (!knot_dname_from_str(key, name, sizeof(key))) {
+	// Parse addr
+	if (!addr)
+		return kr_error(ENOSYS);
+	union kr_sockaddr ia;
+	if (parse_addr_str(&ia, addr) != 0)
 		return kr_error(EINVAL);
-	}
-	int key_len = knot_dname_size(key);
-
-        if (addr) {
-		/* Remove the pair. */
-		union kr_sockaddr ia;
-		if (parse_addr_str(&ia, addr) != 0) {
-			return kr_error(EINVAL);
-		}
-
-		const knot_dname_t *reverse_key = addr2reverse(addr);
-		kr_zonecut_del(&data->reverse_hints, reverse_key, key, key_len);
-		return kr_zonecut_del(&data->hints, key,
-					kr_inaddr(&ia.ip), kr_inaddr_len(&ia.ip));
-	}
-	/* We're removing everything for the name;
-	 * first find the name's pack */
-	pack_t *addr_set = kr_zonecut_find(&data->hints, key);
-	if (!addr_set || addr_set->len == 0) {
-		return kr_error(ENOENT);
-	}
-
-	/* Remove address records in hints from reverse_hints. */
-
-	for (uint8_t *a = pack_head(*addr_set); a != pack_tail(*addr_set);
-						a = pack_obj_next(a)) {
-		void *addr_val = pack_obj_val(a);
-		int family = pack_obj_len(a) == kr_family_len(AF_INET)
-				? AF_INET : AF_INET6;
-		const knot_dname_t *reverse_key = raw_addr2reverse(addr_val, family);
-		if (reverse_key != NULL) {
-			kr_zonecut_del(&data->reverse_hints, reverse_key, key, key_len);
-		}
-	}
 
-	/* Remove the whole name. */
-	return kr_zonecut_del_all(&data->hints, key);
+	// Remove the PTR
+	const knot_dname_t *reverse_key = addr2reverse(addr);
+	knot_rrset_t rrs;
+	knot_rrset_init(&rrs, /*const-cast*/(knot_dname_t *)reverse_key,
+			KNOT_RRTYPE_PTR, KNOT_CLASS_IN, data->ttl);
+	int ret = kr_rule_local_data_del(&rrs, KR_RULE_TAGS_ALL);
+	if (ret != 1)
+		VERBOSE_MSG(NULL, "del_pair PTR for %s; error: %s\n", addr, kr_strerror(ret));
+	if (ret != 1 && ret != kr_error(ENOENT)) // ignore ENOENT for PTR (duplicities)
+		return ret;
+
+	// Remove the forward entry
+	knot_dname_t key_buf[KNOT_DNAME_MAXLEN];
+	rrs.owner = knot_dname_from_str(key_buf, name, sizeof(key_buf));
+	if (!rrs.owner)
+		return kr_error(EINVAL);
+	rrs.type = ia.ip.sa_family == AF_INET6 ? KNOT_RRTYPE_AAAA : KNOT_RRTYPE_A;
+	ret = kr_rule_local_data_del(&rrs, KR_RULE_TAGS_ALL);
+	if (ret != 1)
+		VERBOSE_MSG(NULL, "del_pair for %s; error: %s\n", name, kr_strerror(ret));
+
+	// Remove the NODATA entry; again, not perfect matching,
+	//  but we don't care much about this dynamic hints API.
+	if (ret == 1 && data->use_nodata) {
+		rrs.type = KNOT_RRTYPE_CNAME;
+		ret = kr_rule_local_data_del(&rrs, KR_RULE_TAGS_ALL);
+		if (ret != 1)
+			VERBOSE_MSG(NULL, "del_pair for NODATA %s; error: %s\n",
+					name, kr_strerror(ret));
+	}
+	return ret < 0 ? ret : kr_ok();
 }
 
 static int load_file(struct kr_module *module, const char *path)
@@ -343,31 +252,21 @@ static int load_file(struct kr_module *module, const char *path)
 		}
 		const char *canonical_name = strtok_r(NULL, " \t\n", &saveptr);
 		if (canonical_name == NULL) {
-			ret = -1;
+			ret = kr_error(EINVAL);
 			goto error;
 		}
-		/* Since the last added PTR records takes preference,
-		 * we add canonical name as the last one. */
 		const char *name_tok;
 		while ((name_tok = strtok_r(NULL, " \t\n", &saveptr)) != NULL) {
-			ret = add_pair(&data->hints, name_tok, addr);
-			if (!ret) {
-				ret = add_reverse_pair(&data->reverse_hints, name_tok, addr);
-			}
-			if (ret) {
-				ret = -1;
+			ret = add_pair(data, name_tok, addr);
+			if (ret)
 				goto error;
-			}
 			count += 1;
 		}
-		ret = add_pair(&data->hints, canonical_name, addr);
-		if (!ret) {
-			ret = add_reverse_pair(&data->reverse_hints, canonical_name, addr);
-		}
-		if (ret) {
-			ret = -1;
+		ret = add_pair(data, canonical_name, addr);
+		if (!ret) // PTR only to the canonical name
+			ret = add_reverse_pair(data, canonical_name, addr);
+		if (ret)
 			goto error;
-		}
 		count += 1;
 	}
 error:
@@ -408,12 +307,9 @@ static char* hint_set(void *env, struct kr_module *module, const char *args)
 	if (addr) {
 		*addr = '\0';
 		++addr;
-		ret = add_reverse_pair(&data->reverse_hints, args_copy, addr);
-		if (ret) {
-			del_pair(data, args_copy, addr);
-		} else {
-			ret = add_pair(&data->hints, args_copy, addr);
-		}
+		ret = add_reverse_pair(data, args_copy, addr);
+		if (!ret)
+			ret = add_pair(data, args_copy, addr);
 	}
 
 	return bool2jsonstr(ret == 0);
@@ -435,6 +331,8 @@ static char* hint_del(void *env, struct kr_module *module, const char *args)
 		++addr;
 	}
 	ret = del_pair(data, args_copy, addr);
+	if (ret)
+		VERBOSE_MSG(NULL, "hints.del(%s) error: %s\n", args, kr_strerror(ret));
 
 	return bool2jsonstr(ret == 0);
 }
@@ -457,7 +355,6 @@ static JsonNode *pack_addrs(pack_t *pack)
 	return root;
 }
 
-static char* pack_hints(struct kr_zonecut *hints);
 /**
  * Retrieve address hints, either for given name or for all names.
  *
@@ -466,30 +363,7 @@ static char* pack_hints(struct kr_zonecut *hints);
  */
 static char* hint_get(void *env, struct kr_module *module, const char *args)
 {
-	struct kr_zonecut *hints = &((struct hints_data *) module->data)->hints;
-	if (kr_fails_assert(hints))
-		return NULL;
-
-	if (!args) {
-		return pack_hints(hints);
-	}
-
-	knot_dname_t key[KNOT_DNAME_MAXLEN];
-	pack_t *pack = NULL;
-	if (knot_dname_from_str(key, args, sizeof(key))) {
-		pack = kr_zonecut_find(hints, key);
-	}
-	if (!pack || pack->len == 0) {
-		return NULL;
-	}
-
-	char *result = NULL;
-	JsonNode *root = pack_addrs(pack);
-	if (root) {
-		result = json_encode(root);
-		json_delete(root);
-	}
-	return result;
+	return NULL;
 }
 
 /** @internal Pack all hints into serialized JSON. */
@@ -515,8 +389,12 @@ static void unpack_hint(struct kr_zonecut *root_hints, JsonNode *table, const ch
 	JsonNode *node = NULL;
 	json_foreach(node, table) {
 		switch(node->tag) {
-		case JSON_STRING: add_pair(root_hints, name ? name : node->key, node->string_); break;
-		case JSON_ARRAY: unpack_hint(root_hints, node, name ? name : node->key); break;
+		case JSON_STRING:
+			add_pair_root(root_hints, name ? name : node->key, node->string_);
+			break;
+		case JSON_ARRAY:
+			unpack_hint(root_hints, node, name ? name : node->key);
+			break;
 		default: continue;
 		}
 	}
@@ -597,14 +475,22 @@ static char* hint_ttl(void *env, struct kr_module *module, const char *args)
 KR_EXPORT
 int hints_init(struct kr_module *module)
 {
-	static kr_layer_api_t layer = {
-		.produce = &query,
-	};
+	static kr_layer_api_t layer = { 0 };
 	/* Store module reference */
 	layer.data = module;
 	module->layer = &layer;
 
 	static const struct kr_prop props[] = {
+	/* FIXME(decide): .set() and .del() used to work on individual RRs;
+	 * now they overwrite or delete whole RRsets.
+	 * Also, .get() doesn't work at all.
+	 *
+	 * It really depends what kind of config/API we'll be exposing to user.
+	 *  - Manipulating whole RRsets generally makes more sense to me.
+	 *    (But hints.set() currently can't even insert larger sets.)
+	 *  - We'll probably be deprecating access through these non-declarative
+	 *    commands (set, get, del) which are also usable dynamically.
+	 */
 	    { &hint_set,    "set", "Set {name, address} hint.", },
 	    { &hint_del,    "del", "Delete one {name, address} hint or all addresses for the name.", },
 	    { &hint_get,    "get", "Retrieve hint for given name.", },
@@ -617,17 +503,9 @@ int hints_init(struct kr_module *module)
 	};
 	module->props = props;
 
-	knot_mm_t *pool = mm_ctx_mempool2(MM_DEFAULT_BLKSIZE);
-	if (!pool) {
-		return kr_error(ENOMEM);
-	}
-	struct hints_data *data = mm_alloc(pool, sizeof(struct hints_data));
-	if (!data) {
-		mp_delete(pool->ctx);
+	struct hints_data *data = malloc(sizeof(*data));
+	if (!data)
 		return kr_error(ENOMEM);
-	}
-	kr_zonecut_init(&data->hints, (const uint8_t *)(""), pool);
-	kr_zonecut_init(&data->reverse_hints, (const uint8_t *)(""), pool);
 	data->use_nodata = true;
 	data->ttl = HINTS_TTL_DEFAULT;
 	module->data = data;
@@ -639,13 +517,8 @@ int hints_init(struct kr_module *module)
 KR_EXPORT
 int hints_deinit(struct kr_module *module)
 {
-	struct hints_data *data = module->data;
-	if (data) {
-		kr_zonecut_deinit(&data->hints);
-		kr_zonecut_deinit(&data->reverse_hints);
-		mp_delete(data->hints.pool->ctx);
-		module->data = NULL;
-	}
+	free(module->data);
+	module->data = NULL;
 	return kr_ok();
 }
 
diff --git a/modules/http/.packaging/centos/7/rundeps b/modules/http/.packaging/centos/7/rundeps
deleted file mode 100644
index c557cb28..00000000
--- a/modules/http/.packaging/centos/7/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-http
diff --git a/modules/http/.packaging/centos/8/rundeps b/modules/http/.packaging/centos/8/rundeps
deleted file mode 100644
index ed5aee15..00000000
--- a/modules/http/.packaging/centos/8/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua5.1-http
diff --git a/modules/http/.packaging/debian/10/rundeps b/modules/http/.packaging/debian/10/rundeps
deleted file mode 100644
index c557cb28..00000000
--- a/modules/http/.packaging/debian/10/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-http
diff --git a/modules/http/.packaging/debian/9/rundeps b/modules/http/.packaging/debian/9/rundeps
deleted file mode 100644
index c557cb28..00000000
--- a/modules/http/.packaging/debian/9/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-http
diff --git a/modules/http/.packaging/fedora/31/rundeps b/modules/http/.packaging/fedora/31/rundeps
deleted file mode 100644
index ed5aee15..00000000
--- a/modules/http/.packaging/fedora/31/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua5.1-http
diff --git a/modules/http/.packaging/fedora/32/rundeps b/modules/http/.packaging/fedora/32/rundeps
deleted file mode 100644
index ed5aee15..00000000
--- a/modules/http/.packaging/fedora/32/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua5.1-http
diff --git a/modules/http/.packaging/leap/15.2/NOTSUPPORTED b/modules/http/.packaging/leap/15.2/NOTSUPPORTED
deleted file mode 100644
index bb50260c..00000000
--- a/modules/http/.packaging/leap/15.2/NOTSUPPORTED
+++ /dev/null
@@ -1,5 +0,0 @@
-
-https://github.com/wahern/luaossl/issues/175
-
-
-Doesn't work with libopenssl-devel 1.1.0i-lp151.1.1
diff --git a/modules/http/.packaging/leap/15.2/pre-test.sh b/modules/http/.packaging/leap/15.2/pre-test.sh
deleted file mode 100755
index bb1e1311..00000000
--- a/modules/http/.packaging/leap/15.2/pre-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-luarocks --lua-version 5.1 install http --from=https://mah0x211.github.io/rocks/
diff --git a/modules/http/.packaging/leap/15.2/rundeps b/modules/http/.packaging/leap/15.2/rundeps
deleted file mode 100644
index ab051889..00000000
--- a/modules/http/.packaging/leap/15.2/rundeps
+++ /dev/null
@@ -1,7 +0,0 @@
-libopenssl-devel
-lua51-devel
-lua51-luarocks
-git
-tar
-gzip
-m4
diff --git a/modules/http/.packaging/test.config b/modules/http/.packaging/test.config
deleted file mode 100644
index cb5e5dd5..00000000
--- a/modules/http/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('http')
-assert(http)
-quit()
diff --git a/modules/http/.packaging/ubuntu/16.04/NOTSUPPORTED b/modules/http/.packaging/ubuntu/16.04/NOTSUPPORTED
deleted file mode 100644
index e69de29b..00000000
--- a/modules/http/.packaging/ubuntu/16.04/NOTSUPPORTED
+++ /dev/null
diff --git a/modules/http/.packaging/ubuntu/18.04/rundeps b/modules/http/.packaging/ubuntu/18.04/rundeps
deleted file mode 100644
index c557cb28..00000000
--- a/modules/http/.packaging/ubuntu/18.04/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-http
diff --git a/modules/http/.packaging/ubuntu/20.04/rundeps b/modules/http/.packaging/ubuntu/20.04/rundeps
deleted file mode 100644
index c557cb28..00000000
--- a/modules/http/.packaging/ubuntu/20.04/rundeps
+++ /dev/null
@@ -1 +0,0 @@
-lua-http
diff --git a/modules/nsid/.packaging/test.config b/modules/nsid/.packaging/test.config
deleted file mode 100644
index de54cceb..00000000
--- a/modules/nsid/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('nsid')
-assert(nsid)
-quit()
diff --git a/modules/policy/.packaging/test.config b/modules/policy/.packaging/test.config
deleted file mode 100644
index 60c9ddc0..00000000
--- a/modules/policy/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('policy')
-assert(policy)
-quit()
diff --git a/modules/policy/policy.lua b/modules/policy/policy.lua
index 47e436f0..443fc0b0 100644
--- a/modules/policy/policy.lua
+++ b/modules/policy/policy.lua
@@ -5,8 +5,6 @@ local ffi = require('ffi')
 local LOG_GRP_POLICY_TAG = ffi.string(ffi.C.kr_log_grp2name(ffi.C.LOG_GRP_POLICY))
 local LOG_GRP_REQDBG_TAG = ffi.string(ffi.C.kr_log_grp2name(ffi.C.LOG_GRP_REQDBG))
 
-local todname = kres.str2dname -- not available during module load otherwise
-
 -- Counter of unique rules
 local nextid = 0
 local function getruleid()
@@ -71,7 +69,8 @@ end
 -- policy functions are defined below
 local policy = {}
 
-function policy.PASS(state, _)
+function policy.PASS(state, req)
+	policy.FLAGS('PASSTHRU_LEGACY')(state, req)
 	return state
 end
 
@@ -269,91 +268,6 @@ function policy.ANSWER(rtable, nodata)
 	end
 end
 
-local dname_localhost = todname('localhost.')
-
--- Rule for localhost. zone; see RFC6303, sec. 3
-local function localhost(_, req)
-	local qry = req:current()
-	local answer = req:ensure_answer()
-	if answer == nil then return nil end
-	ffi.C.kr_pkt_make_auth_header(answer)
-
-	local is_exact = ffi.C.knot_dname_is_equal(qry.sname, dname_localhost)
-
-	answer:rcode(kres.rcode.NOERROR)
-	answer:begin(kres.section.ANSWER)
-	if qry.stype == kres.type.AAAA then
-		answer:put(qry.sname, 900, answer:qclass(), kres.type.AAAA,
-			'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1')
-	elseif qry.stype == kres.type.A then
-		answer:put(qry.sname, 900, answer:qclass(), kres.type.A, '\127\0\0\1')
-	elseif is_exact and qry.stype == kres.type.SOA then
-		mkauth_soa(answer, dname_localhost)
-	elseif is_exact and qry.stype == kres.type.NS then
-		answer:put(dname_localhost, 900, answer:qclass(), kres.type.NS, dname_localhost)
-	else
-		answer:begin(kres.section.AUTHORITY)
-		mkauth_soa(answer, dname_localhost)
-	end
-	return kres.DONE
-end
-
-local dname_rev4_localhost = todname('1.0.0.127.in-addr.arpa');
-local dname_rev4_localhost_apex = todname('127.in-addr.arpa');
-
--- Rule for reverse localhost.
--- Answer with locally served minimal 127.in-addr.arpa domain, only having
--- a PTR record in 1.0.0.127.in-addr.arpa, and with 1.0...0.ip6.arpa. zone.
--- TODO: much of this would better be left to the hints module (or coordinated).
-local function localhost_reversed(_, req)
-	local qry = req:current()
-	local answer = req:ensure_answer()
-	if answer == nil then return nil end
-
-	-- classify qry.sname:
-	local is_exact   -- exact dname for localhost
-	local is_apex    -- apex of a locally-served localhost zone
-	local is_nonterm -- empty non-terminal name
-	if ffi.C.knot_dname_in_bailiwick(qry.sname, todname('ip6.arpa.')) > 0 then
-		-- exact ::1 query (relying on the calling rule)
-		is_exact = true
-		is_apex = true
-	else
-		-- within 127.in-addr.arpa.
-		local labels = ffi.C.knot_dname_labels(qry.sname, nil)
-		if labels == 3 then
-			is_exact = false
-			is_apex = true
-		elseif labels == 4+2 and ffi.C.knot_dname_is_equal(
-					qry.sname, dname_rev4_localhost) then
-			is_exact = true
-		else
-			is_exact = false
-			is_apex = false
-			is_nonterm = ffi.C.knot_dname_in_bailiwick(dname_rev4_localhost, qry.sname) > 0
-		end
-	end
-
-	ffi.C.kr_pkt_make_auth_header(answer)
-	answer:rcode(kres.rcode.NOERROR)
-	answer:begin(kres.section.ANSWER)
-	if is_exact and qry.stype == kres.type.PTR then
-		answer:put(qry.sname, 900, answer:qclass(), kres.type.PTR, dname_localhost)
-	elseif is_apex and qry.stype == kres.type.SOA then
-		mkauth_soa(answer, dname_rev4_localhost_apex, dname_localhost)
-	elseif is_apex and qry.stype == kres.type.NS then
-		answer:put(dname_rev4_localhost_apex, 900, answer:qclass(), kres.type.NS,
-			dname_localhost)
-	else
-		if not is_nonterm then
-			answer:rcode(kres.rcode.NXDOMAIN)
-		end
-		answer:begin(kres.section.AUTHORITY)
-		mkauth_soa(answer, dname_rev4_localhost_apex, dname_localhost)
-	end
-	return kres.DONE
-end
-
 -- All requests
 function policy.all(action)
 	return function(_, _) return action end
@@ -916,172 +830,88 @@ function policy.todnames(names)
 	return names
 end
 
--- RFC1918 Private, local, broadcast, test and special zones
--- Considerations: RFC6761, sec 6.1.
--- https://www.iana.org/assignments/locally-served-dns-zones
-local private_zones = {
-	-- RFC6303
-	'10.in-addr.arpa.',
-	'16.172.in-addr.arpa.',
-	'17.172.in-addr.arpa.',
-	'18.172.in-addr.arpa.',
-	'19.172.in-addr.arpa.',
-	'20.172.in-addr.arpa.',
-	'21.172.in-addr.arpa.',
-	'22.172.in-addr.arpa.',
-	'23.172.in-addr.arpa.',
-	'24.172.in-addr.arpa.',
-	'25.172.in-addr.arpa.',
-	'26.172.in-addr.arpa.',
-	'27.172.in-addr.arpa.',
-	'28.172.in-addr.arpa.',
-	'29.172.in-addr.arpa.',
-	'30.172.in-addr.arpa.',
-	'31.172.in-addr.arpa.',
-	'168.192.in-addr.arpa.',
-	'0.in-addr.arpa.',
-	'254.169.in-addr.arpa.',
-	'2.0.192.in-addr.arpa.',
-	'100.51.198.in-addr.arpa.',
-	'113.0.203.in-addr.arpa.',
-	'255.255.255.255.in-addr.arpa.',
-	-- RFC7793
-	'64.100.in-addr.arpa.',
-	'65.100.in-addr.arpa.',
-	'66.100.in-addr.arpa.',
-	'67.100.in-addr.arpa.',
-	'68.100.in-addr.arpa.',
-	'69.100.in-addr.arpa.',
-	'70.100.in-addr.arpa.',
-	'71.100.in-addr.arpa.',
-	'72.100.in-addr.arpa.',
-	'73.100.in-addr.arpa.',
-	'74.100.in-addr.arpa.',
-	'75.100.in-addr.arpa.',
-	'76.100.in-addr.arpa.',
-	'77.100.in-addr.arpa.',
-	'78.100.in-addr.arpa.',
-	'79.100.in-addr.arpa.',
-	'80.100.in-addr.arpa.',
-	'81.100.in-addr.arpa.',
-	'82.100.in-addr.arpa.',
-	'83.100.in-addr.arpa.',
-	'84.100.in-addr.arpa.',
-	'85.100.in-addr.arpa.',
-	'86.100.in-addr.arpa.',
-	'87.100.in-addr.arpa.',
-	'88.100.in-addr.arpa.',
-	'89.100.in-addr.arpa.',
-	'90.100.in-addr.arpa.',
-	'91.100.in-addr.arpa.',
-	'92.100.in-addr.arpa.',
-	'93.100.in-addr.arpa.',
-	'94.100.in-addr.arpa.',
-	'95.100.in-addr.arpa.',
-	'96.100.in-addr.arpa.',
-	'97.100.in-addr.arpa.',
-	'98.100.in-addr.arpa.',
-	'99.100.in-addr.arpa.',
-	'100.100.in-addr.arpa.',
-	'101.100.in-addr.arpa.',
-	'102.100.in-addr.arpa.',
-	'103.100.in-addr.arpa.',
-	'104.100.in-addr.arpa.',
-	'105.100.in-addr.arpa.',
-	'106.100.in-addr.arpa.',
-	'107.100.in-addr.arpa.',
-	'108.100.in-addr.arpa.',
-	'109.100.in-addr.arpa.',
-	'110.100.in-addr.arpa.',
-	'111.100.in-addr.arpa.',
-	'112.100.in-addr.arpa.',
-	'113.100.in-addr.arpa.',
-	'114.100.in-addr.arpa.',
-	'115.100.in-addr.arpa.',
-	'116.100.in-addr.arpa.',
-	'117.100.in-addr.arpa.',
-	'118.100.in-addr.arpa.',
-	'119.100.in-addr.arpa.',
-	'120.100.in-addr.arpa.',
-	'121.100.in-addr.arpa.',
-	'122.100.in-addr.arpa.',
-	'123.100.in-addr.arpa.',
-	'124.100.in-addr.arpa.',
-	'125.100.in-addr.arpa.',
-	'126.100.in-addr.arpa.',
-	'127.100.in-addr.arpa.',
-
-	-- RFC6303
-	-- localhost_reversed handles ::1
-	'0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.',
-	'd.f.ip6.arpa.',
-	'8.e.f.ip6.arpa.',
-	'9.e.f.ip6.arpa.',
-	'a.e.f.ip6.arpa.',
-	'b.e.f.ip6.arpa.',
-	'8.b.d.0.1.0.0.2.ip6.arpa.',
-	-- RFC8375
-	'home.arpa.',
-}
-policy.todnames(private_zones)
-
 -- @var Default rules
 policy.rules = {}
 policy.postrules = {}
-policy.special_names = {
-	-- XXX: beware of special_names_optim() when modifying these filters
-	{
-		cb=policy.suffix_common(policy.DENY_MSG(
-			'Blocking is mandated by standards, see references on '
-			.. 'https://www.iana.org/assignments/'
-			.. 'locally-served-dns-zones/locally-served-dns-zones.xhtml',
-			kres.extended_error.NOTSUP),
-			private_zones, todname('arpa.')),
-		count=0
-	},
-	{
-		cb=policy.suffix(policy.DENY_MSG(
-			'Blocking is mandated by standards, see references on '
-			.. 'https://www.iana.org/assignments/'
-			.. 'special-use-domain-names/special-use-domain-names.xhtml',
-			kres.extended_error.NOTSUP),
+
+-- This certainly isn't perfect, but it allows lua config like:
+-- kr_view_insert_action('127.0.0.0/24', policy.TAGS_ASSIGN({'t01', 't02'}))
+local kr_rule_tags_t = ffi.typeof('kr_rule_tags_t[1]')
+function policy.get_tagset(names)
+	local result = ffi.new(kr_rule_tags_t, 0)
+	for _, name in pairs(names) do
+		if ffi.C.kr_rule_tag_add(name, result) ~= 0 then
+			error('converting tagset failed')
+		end
+	end
+	return result[0] -- it's atomic value fortunately
+end
+function policy.tags_assign_bitmap(bitmap)
+	return function (_, req)
+		req.rule_tags = bitmap
+	end
+end
+function policy.TAGS_ASSIGN(names)
+	local bitmap = policy.get_tagset(names)
+	return 'policy.tags_assign_bitmap(' .. tostring(bitmap) .. ')'
+end
+
+--[[ Insert a forwarding rule, i.e. override upstream for one DNS subtree.
+
+Throws lua exceptions when detecting something fishy.
+
+\param subtree plain string
+\param options
+  .auth targets are authoritative (false by default = resolver)
+  .dnssec if overridden to false, don't validate DNSSEC locally
+    - for resolvers we still do *not* send CD=1 upstream,
+      i.e. we trust their DNSSEC validation.
+    - for auths this inserts a negative trust anchor
+      Beware that setting .set_insecure() *later* would override that.
+\param targets same format as policy.TLS_FORWARD() except that `tls = true`
+               can be specified for each address (defaults to false)
+--]]
+function policy.rule_forward_add(subtree, options, targets)
+	local targets_2 = {}
+	for _, target in ipairs(targets) do
+		local port_default = 53
+		if target.tls or false then
+			port_default = 853
+			-- lots of code; easiest to just call it this way; checks and throws
+			-- The extra .tls field gets ignored.
+			policy.TLS_FORWARD({target})
+		end
+
+		-- this also throws on failure
+		local sock = addr2sock(target[1], port_default)
+		if options.auth then
+			local port = ffi.C.kr_inaddr_port(sock)
+			assert(not options.tls and port == port_default)
+		end
+		table.insert(targets_2, sock)
+	end
+	local targets_3 = ffi.new('const struct sockaddr * [?]', #targets_2 + 1, targets_2)
+	targets_3[#targets_2] = nil
+
+	local subtree_dname = todname(subtree)
+	assert(ffi.C.kr_rule_forward(subtree_dname,
 			{
-				todname('test.'),
-				todname('onion.'),
-				todname('invalid.'),
-				todname('local.'), -- RFC 8375.4
-			}),
-		count=0
-	},
-	{
-		cb=policy.suffix(localhost, {dname_localhost}),
-		count=0
-	},
-	{
-		cb=policy.suffix_common(localhost_reversed, {
-			todname('127.in-addr.arpa.'),
-			todname('1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.')},
-			todname('arpa.')),
-		count=0
-	},
-}
+				is_nods = options.dnssec == false,
+				is_auth = options.auth,
+			},
+			targets_3
+		) == 0)
 
--- Return boolean; false = no special name may apply, true = some might apply.
--- The point is to *efficiently* filter almost all QNAMEs that do not apply.
-local function special_names_optim(req, sname)
-	local qname_size = req.qsource.packet.qname_size
-	if qname_size < 9 then return true end -- don't want to special-case bad array access
-	local root = sname + qname_size - 1
-	return
-		-- .a???. or .t???.
-		(root[-5] == 4 and (root[-4] == 97 or root[-4] == 116))
-		-- .on???. or .in?????. or lo???. or *ost.
-		or (root[-6] == 5 and root[-5] == 111 and root[-4] == 110)
-		or (root[-8] == 7 and root[-7] == 105 and root[-6] == 110)
-		or (root[-6] == 5 and root[-5] == 108 and root[-4] == 111)
-		or (root[-3] == 111 and root[-2] == 115 and root[-1] == 116)
+	-- Probably the best way to turn off DNSSEC validation for auth is negative TA.
+	if options.auth and options.dnssec == false then
+		local ntas = kres.context().negative_anchors
+		assert(ffi.C.kr_ta_add(ntas, subtree_dname, kres.type.DS, 0, nil, 0) == 0)
+	end
 end
 
+
+local view_action_buf = ffi.new('knot_db_val_t[1]')
+
 -- Top-down policy list walk until we hit a match
 -- the caller is responsible for reordering policy list
 -- from most specific to least specific.
@@ -1091,10 +921,14 @@ policy.layer = {
 	begin = function(state, req)
 		-- Don't act on "finished" cases.
 		if bit.band(state, bit.bor(kres.FAIL, kres.DONE)) ~= 0 then return state end
+
+		if ffi.C.kr_view_select_action(req, view_action_buf) == 0 then
+			local act_str = ffi.string(view_action_buf[0].data, view_action_buf[0].len)
+			return loadstring('return '..act_str)()(state, req)
+		end
+
 		local qry = req:initial() -- same as :current() but more descriptive
 		return policy.evaluate(policy.rules, req, qry, state)
-			or (special_names_optim(req, qry.sname)
-					and policy.evaluate(policy.special_names, req, qry, state))
 			or state
 	end,
 	finish = function(state, req)
diff --git a/modules/predict/.packaging/test.config b/modules/predict/.packaging/test.config
deleted file mode 100644
index b8e706e3..00000000
--- a/modules/predict/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('predict')
-assert(predict)
-quit()
diff --git a/modules/prefill/.packaging/test.config b/modules/prefill/.packaging/test.config
deleted file mode 100644
index d0258b02..00000000
--- a/modules/prefill/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('prefill')
-assert(prefill)
-quit()
diff --git a/modules/priming/.packaging/test.config b/modules/priming/.packaging/test.config
deleted file mode 100644
index 63239f07..00000000
--- a/modules/priming/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('priming')
-assert(priming)
-quit()
diff --git a/modules/rebinding/.packaging/test.config b/modules/rebinding/.packaging/test.config
deleted file mode 100644
index 0a84b88b..00000000
--- a/modules/rebinding/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('rebinding')
-assert(rebinding)
-quit()
diff --git a/modules/refuse_nord/.packaging/test.config b/modules/refuse_nord/.packaging/test.config
deleted file mode 100644
index 8679e269..00000000
--- a/modules/refuse_nord/.packaging/test.config
+++ /dev/null
@@ -1,3 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-assert(modules.load('refuse_nord') == true)
-quit()
diff --git a/modules/renumber/.packaging/test.config b/modules/renumber/.packaging/test.config
deleted file mode 100644
index 37f136ab..00000000
--- a/modules/renumber/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('renumber')
-assert(renumber)
-quit()
diff --git a/modules/serve_stale/.packaging/test.config b/modules/serve_stale/.packaging/test.config
deleted file mode 100644
index 362c4ec8..00000000
--- a/modules/serve_stale/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('serve_stale')
-assert(serve_stale)
-quit()
diff --git a/modules/stats/.packaging/test.config b/modules/stats/.packaging/test.config
deleted file mode 100644
index fd25460d..00000000
--- a/modules/stats/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('stats')
-assert(stats)
-quit()
diff --git a/modules/stats/README.rst b/modules/stats/README.rst
index 7d423aa8..014c9f06 100644
--- a/modules/stats/README.rst
+++ b/modules/stats/README.rst
@@ -89,6 +89,8 @@ Built-in counters keep track of number of queries and answers matching specific
 +-----------------+----------------------------------+
 | answer.slow     | completed in more than 1500ms    |
 +-----------------+----------------------------------+
+| answer.sum_ms   | sum of all latencies in ms       |
++-----------------+----------------------------------+
 
 +-----------------+----------------------------------+
 | **Answer flags**                                   |
diff --git a/modules/stats/stats.c b/modules/stats/stats.c
index ebb28778..ca3a932c 100644
--- a/modules/stats/stats.c
+++ b/modules/stats/stats.c
@@ -42,6 +42,7 @@
 	X(answer,total) X(answer,noerror) X(answer,nodata) X(answer,nxdomain) X(answer,servfail) \
 	X(answer,cached) X(answer,1ms) X(answer,10ms) X(answer,50ms) X(answer,100ms) \
 	X(answer,250ms) X(answer,500ms) X(answer,1000ms) X(answer,1500ms) X(answer,slow) \
+	X(answer,sum_ms) \
 	X(answer,aa) X(answer,tc) X(answer,rd) X(answer,ra) X(answer, ad) X(answer,cd) \
 	X(answer,edns0) X(answer,do) \
 	X(query,edns) X(query,dnssec) \
@@ -220,6 +221,7 @@ static int collect(kr_layer_t *ctx)
 		/* Histogram of answer latency. */
 		struct kr_query *first = rplan->resolved.at[0];
 		uint64_t elapsed = kr_now() - first->timestamp_mono;
+		stat_const_add(data, metric_answer_sum_ms, elapsed);
 		if (elapsed <= 1) {
 			stat_const_add(data, metric_answer_1ms, 1);
 		} else if (elapsed <= 10) {
diff --git a/modules/stats/test.integr/kresd_config.j2 b/modules/stats/test.integr/kresd_config.j2
index 4db7caab..872ce2e3 100644
--- a/modules/stats/test.integr/kresd_config.j2
+++ b/modules/stats/test.integr/kresd_config.j2
@@ -52,6 +52,7 @@ function reply_result(state, req)
 	local result = check_stats(got)
 	return result(state, req)
 end
+policy.add(policy.all(policy.FLAGS('PASSTHRU_LEGACY'))) -- the test isn't written with this in mind
 policy.add(policy.pattern(reply_result, 'stats.test.'))
 policy.add(policy.all(FWD_TARGET)) -- avoid iteration
 
diff --git a/modules/ta_sentinel/.packaging/test.config b/modules/ta_sentinel/.packaging/test.config
deleted file mode 100644
index 4bb6ac9a..00000000
--- a/modules/ta_sentinel/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('ta_sentinel')
-assert(ta_sentinel)
-quit()
diff --git a/modules/ta_signal_query/.packaging/test.config b/modules/ta_signal_query/.packaging/test.config
deleted file mode 100644
index dfa7c2a5..00000000
--- a/modules/ta_signal_query/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('ta_signal_query')
-assert(ta_signal_query)
-quit()
diff --git a/modules/ta_update/.packaging/test.config b/modules/ta_update/.packaging/test.config
deleted file mode 100644
index 5fe55875..00000000
--- a/modules/ta_update/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('ta_update')
-assert(ta_update)
-quit()
diff --git a/modules/view/.packaging/test.config b/modules/view/.packaging/test.config
deleted file mode 100644
index b639fdaf..00000000
--- a/modules/view/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('view')
-assert(view)
-quit()
diff --git a/modules/watchdog/.packaging/test.config b/modules/watchdog/.packaging/test.config
deleted file mode 100644
index 9d1a291c..00000000
--- a/modules/watchdog/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('watchdog')
-assert(watchdog)
-quit()
diff --git a/modules/workarounds/.packaging/test.config b/modules/workarounds/.packaging/test.config
deleted file mode 100644
index c420810b..00000000
--- a/modules/workarounds/.packaging/test.config
+++ /dev/null
@@ -1,4 +0,0 @@
--- SPDX-License-Identifier: GPL-3.0-or-later
-modules.load('workarounds')
-assert(workarounds)
-quit()