Give the DS command for a parent zone in Jarl, and allow port 443

The DNSSEC tab and 'jarl zone dnssec status' give the jarl record add
command (and an Add to parent button) when the parent zone is in Jarl.
jarl.service grants CAP_NET_BIND_SERVICE so the web UI can listen on 443.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/dnssec.js

@@ -71,10 +71,34 @@ function stateBadge(st) {
   return badge(st, { omnipresent: "ok", rumoured: "accent", unretentive: "warn" }[st] || "");
 }
 
+// parentName is the zone's name relative to its parent zone in Jarl
+// ("sectest" for sectest.adbraun.lol in adbraun.lol).
+function parentName(zone, s) {
+  return zone.name.slice(0, -(s.parent_zone.length + 1));
+}
+
+// jarlCmd is the jarl command for a record change in the parent zone.
+function jarlCmd(zone, s, verb, data) {
+  return ["jarl record", verb, display(s.parent_zone), parentName(zone, s), "DS", data, s.parent_view ? "--view " + s.parent_view : ""].filter(Boolean).join(" ");
+}
+
+const dsData = (k) => [k.ds.key_tag, k.ds.algorithm, k.ds.digest_type, k.ds.digest].join(" ");
+
+// inParent reports whether the parent zone in Jarl has the key's DS record.
+const inParent = (s, k) => (s.parent_ds || []).some((d) => d.toUpperCase() === dsData(k).toUpperCase());
+
+async function addToParent(zone, s, k) {
+  try {
+    const r = await change("POST", "/zones/" + s.parent_zone_id + "/records", { name: parentName(zone, s), type: "DS", data: dsData(k) });
+    toast(describeResult(r));
+    rerender();
+  } catch (e) { toast(e.message, "err", 8000); }
+}
+
 function dsPanel(zone, s, keys) {
   const ph = s.phase;
   const where = s.parent_zone
-    ? ["The parent zone ", h("a", { href: "#/zones" }, display(s.parent_zone)), " is in Jarl: add this as a DS record there (name ", h("code", null, display(zone.name)), ")."]
+    ? ["The parent zone ", h("a", { href: "#/zones/" + s.parent_zone_id + "/records" }, display(s.parent_zone)), " is in Jarl: add this as a DS record there (name ", h("code", null, parentName(zone, s)), "), with the button or the jarl command below."]
     : "Give this to your registrar (at Porkbun: the domain's DNSSEC settings). Registrars ask either for the whole record or for its four fields.";
   return h("div", { class: "panel" },
     h("h2", null, "DS record for the parent zone"),
@@ -90,6 +114,13 @@ function dsPanel(zone, s, keys) {
     keys.map((k) => h("div", { class: "ds-record" },
       h("label", { class: "small muted" }, "Key " + k.tag + " — DS record"),
       copyBox(k.ds.record.replace(/\t/g, " ")),
+      s.parent_zone ? [
+        h("label", { class: "small muted" }, "jarl command"),
+        copyBox(jarlCmd(zone, s, "add", dsData(k))),
+        inParent(s, k)
+          ? h("p", { class: "small" }, badge("in " + display(s.parent_zone), "ok"), " ", display(s.parent_zone) + " has this DS record.")
+          : h("p", null, h("button", { class: ph.can_publish_ds ? "primary" : "", disabled: !ph.can_publish_ds, title: ph.can_publish_ds ? "" : "Not yet: see above", onclick: () => addToParent(zone, s, k) }, "Add to " + display(s.parent_zone))),
+      ] : null,
       h("dl", { class: "kv small" },
         h("dt", null, "Key tag"), h("dd", null, copyBox(String(k.ds.key_tag))),
         h("dt", null, "Algorithm"), h("dd", null, copyBox(String(k.ds.algorithm)), h("span", { class: "muted" }, " " + (k.algorithm_name || ""))),
@@ -142,7 +173,9 @@ async function disableDialog(zone, s) {
     h("p", null, "Signing is turned off in steps, so the zone is never unsigned while the parent zone still has its DS record (validating resolvers would then reject the whole domain):"),
     steps([
       [h("strong", null, "Now: "), "the zone switches to BIND's insecure policy. named keeps it signed and publishes a CDS \"delete\" record. Nothing breaks."],
-      [h("strong", null, "You: "), "remove the DS record at your registrar (", s.registrar ? "the Registrar tab can do that at Porkbun" : "at Porkbun: the domain's DNSSEC settings", "), then click Check DS at parent so named knows it's gone."],
+      s.parent_zone
+        ? [h("strong", null, "You: "), "remove the DS record from ", display(s.parent_zone), " (", h("code", null, jarlCmd(zone, s, "delete", "")), ", or on its Records page), then click Check DS at parent so named knows it's gone."]
+        : [h("strong", null, "You: "), "remove the DS record at your registrar (", s.registrar ? "the Registrar tab can do that at Porkbun" : "at Porkbun: the domain's DNSSEC settings", "), then click Check DS at parent so named knows it's gone."],
       [h("strong", null, "named: "), "waits until resolvers have forgotten the DS (the parent's DS TTL, often a day), then removes the keys and signatures."],
       [h("strong", null, "Then: "), "this page lets you finish, which switches DNSSEC off."],
     ]),