Encrypted DNS health, comparing a zone's views, --local everywhere

jarld checks the DoT and DoH listeners every 10 minutes as a client would (page, dashboard, jarl encrypted-dns health, jarl_encrypted_dns_up). The Compare views tab and jarl zone diff show what differs between a zone's views, with Use this version. --local works on unlinked zones. A changed certificates.dir is followed by encrypted DNS's tls statements. Sharing an already shared version replaces other views' overrides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/certs/certs_test.go

@@ -25,6 +25,7 @@ import (
 	"github.com/miekg/dns"
 
 	"jarl/internal/auth"
+	"jarl/internal/encdns"
 	"jarl/internal/engine"
 	"jarl/internal/model"
 	"jarl/internal/porkbun"
@@ -488,3 +489,34 @@ func TestCleanLegoError(t *testing.T) {
 		t.Errorf("rate limit: %s", got)
 	}
 }
+
+// When certificates.dir changes, Start writes the certificates to the new
+// place and points encrypted DNS's tls statement there.
+func TestDirChangeFollowed(t *testing.T) {
+	e := newEnv(t, false)
+	ctx := context.Background()
+	admin := &auth.Principal{User: &model.User{Username: "admin", Admin: true}}
+	now := time.Now()
+	certFile, keyFile := filepath.Join(e.dir, "c.pem"), filepath.Join(e.dir, "k.pem")
+	cert, key := makeCert(t, []string{"dns.example.com"}, now.Add(-time.Hour), now.Add(60*24*time.Hour), true)
+	os.WriteFile(certFile, cert, 0o600)
+	os.WriteFile(keyFile, key, 0o600)
+	if _, err := e.m.Create(ctx, Input{Name: model.Ptr("dns"), Source: model.Ptr("file"), CertFile: &certFile, KeyFile: &keyFile, Uses: &[]string{"dns"}}, admin); err != nil {
+		t.Fatal(err)
+	}
+	e.submit(engine.NewRequest(engine.OpOptionCreate, 0, engine.OptionInput{Scope: model.Ptr(model.ScopeTopLevel), Name: model.Ptr("tls"), Value: model.Ptr(encdns.TLSValue("dns", e.m.cfg.Dir))}))
+
+	moved := filepath.Join(e.dir, "tls-moved")
+	cfg := e.m.cfg
+	cfg.Dir = moved
+	m2 := New(cfg, e.st, e.eng, slog.New(slog.NewTextHandler(io.Discard, nil)))
+	m2.Start(ctx)
+	if _, err := os.Stat(filepath.Join(moved, "dns", ChainFile)); err != nil {
+		t.Fatalf("not written to the new place: %v", err)
+	}
+	for _, o := range e.state().ScopedOptions(model.ScopeTopLevel, 0) {
+		if o.Name == "tls" && !strings.Contains(o.Value, moved+"/dns/fullchain.pem") {
+			t.Errorf("tls statement still points elsewhere: %s", o.Value)
+		}
+	}
+}