Add a program for lego's exec DNS provider

contrib/lego/jarl-lego.sh turns lego's "present|cleanup FQDN VALUE" calls
into jarl acme set|unset --exact, so lego (and CNAME delegation to a
dedicated ACME zone) works with Jarl. docs/acme.md explains the setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

contrib/lego/jarl-lego.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env sh
+# Jarl (BIND manager): a program for lego's "exec" DNS provider.
+#
+# lego runs it as "jarl-lego present FQDN VALUE" and "jarl-lego cleanup
+# FQDN VALUE", where FQDN is the challenge name after lego has followed
+# any CNAME. It publishes and removes the TXT record through the jarl CLI.
+#
+# Install it, then:
+#   EXEC_PATH=/usr/local/bin/jarl-lego JARL_TOKEN=@/etc/jarl/lego.token \
+#     lego --email you@example.com --dns exec -d example.com -d '*.example.com' run
+#
+# Options (environment):
+#  JARL_SERVER  Jarl server URL, e.g. https://ns1.example.com:8053 (optional if the jarl CLI is configured)
+#  JARL_TOKEN   API token, or @FILE (optional if the jarl CLI is configured)
+#  JARL_VIEW    Only write into this view (optional; default every view that has the zone)
+#  JARL_BIN     Path of the jarl binary (optional; default "jarl")
+
+JARL_BIN="${JARL_BIN:-jarl}"
+
+if [ "$2" = "--" ]; then
+  echo "jarl-lego: EXEC_MODE=RAW is not supported; unset EXEC_MODE" >&2
+  exit 2
+fi
+
+case "$1" in
+  present) action="set" ;;
+  cleanup) action="unset" ;;
+  *)
+    echo "usage: jarl-lego present|cleanup FQDN VALUE" >&2
+    exit 2
+    ;;
+esac
+
+if [ $# -ne 3 ]; then
+  echo "usage: jarl-lego present|cleanup FQDN VALUE" >&2
+  exit 2
+fi
+
+# lego passes the full record name, so --exact keeps jarl from adding
+# _acme-challenge. again.
+if [ -n "$JARL_VIEW" ]; then
+  exec "$JARL_BIN" -q acme "$action" --exact --view "$JARL_VIEW" "$2" "$3"
+fi
+exec "$JARL_BIN" -q acme "$action" --exact "$2" "$3"