Give the DS command for a parent zone in Jarl, and allow port 443

The DNSSEC tab and 'jarl zone dnssec status' give the jarl record add
command (and an Add to parent button) when the parent zone is in Jarl.
jarl.service grants CAP_NET_BIND_SERVICE so the web UI can listen on 443.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/configuration.md

@@ -18,7 +18,7 @@ The CLI has its own small configuration file, described in [cli.md](cli.md).
 
 | Key | Default | Meaning |
 |-----|---------|---------|
-| `listen` | `["127.0.0.1:8053"]` | Addresses to listen on (`host:port`, several allowed). Keep these on localhost and management networks. |
+| `listen` | `["127.0.0.1:8053"]` | Addresses to listen on (`host:port`, several allowed). Keep these on localhost and management networks. Ports below 1024 (`"192.168.10.2:443"`) work because `jarl.service` gives jarld the `CAP_NET_BIND_SERVICE` capability, and only that ([HTTPS on port 443](#example-https-on-port-443)). |
 | `socket` | `/run/jarl/jarl.sock` | A local unix socket for the API. Requests on it from root or jarld's own user need no token and have administrator rights; anyone else must send a token ([permissions.md](permissions.md#the-local-socket)). The `jarl` CLI uses it when no server is configured. At most 107 bytes long; `""` turns it off. If it can't be created, jarld logs a warning and serves the network addresses only. |
 | `tls.cert_file`, `tls.key_file` | (empty: plain HTTP) | PEM certificate chain and key. Both or neither. The files are rechecked every 10 minutes and on SIGHUP (`systemctl reload jarl`), so renewed certificates are used without a restart. |
 | `trusted_proxies` | `[]` | Addresses or prefixes of reverse proxies whose `X-Forwarded-For` and `X-Forwarded-Proto` (or `Forwarded: proto=`) headers are believed. Needed for correct client IPs in the audit log and for rate limiting behind a proxy, and for knowing that a proxied request came over HTTPS (the session cookie's Secure flag, `acme.httpreq`). From other addresses these headers are ignored. |
@@ -149,6 +149,32 @@ audit:
   retention_days: 730
 ```
 
+## Example: HTTPS on port 443
+
+```yaml
+listen:
+  - "127.0.0.1:8053"        # the CLI on the server keeps using this (or the socket)
+  - "192.168.10.2:443"
+tls:
+  cert_file: /etc/jarl/tls/fullchain.pem
+  key_file: /etc/jarl/tls/privkey.pem
+```
+
+jarld runs as the unprivileged `jarl` user, and binding a port below 1024
+needs the `CAP_NET_BIND_SERVICE` capability, which `jarl.service` grants
+(`AmbientCapabilities=CAP_NET_BIND_SERVICE`; nothing else). The unit in
+Jarl 0.2.0 and earlier doesn't, and jarld then fails with "bind:
+permission denied". Upgrading the package installs the new unit; until
+then, a drop-in does the same:
+
+```sh
+sudo systemctl edit jarl
+#   [Service]
+#   CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+#   AmbientCapabilities=CAP_NET_BIND_SERVICE
+sudo systemctl restart jarl
+```
+
 ## Example: behind nginx
 
 ```yaml

docs/dnssec.md

@@ -122,8 +122,18 @@ can make validating resolvers reject cached answers. Then:
    [DNSViz](https://dnsviz.net/) gives an independent picture.
 
 If the parent zone is itself a primary zone in Jarl (`home.adbraun.lol`
-inside `adbraun.lol`), the DNSSEC tab says so: add the DS as a record in
-that zone.
+inside `adbraun.lol`), the DS goes in as a record in that zone, and Jarl
+gives you both ways to add it: an **Add to adbraun.lol** button on the
+DNSSEC tab, and the command, which `jarl zone dnssec status` prints too:
+
+```sh
+jarl record add adbraun.lol home DS 51126 13 2 FFBECE3D...
+```
+
+Once the parent zone has it, the tab and `status` say so. When turning
+signing off, the steps give the matching `jarl record delete adbraun.lol
+home DS`. The zone must be delegated first (NS records for `home` in
+`adbraun.lol`), or validation refuses the DS.
 
 ## Putting your own name servers on the internet