Merge branch 'dnssec'

The DNSSEC notes in CHANGELOG.md belong under Unreleased; git had put
them into the 0.1.0 section, which didn't exist when the branch was made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,41 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Added
 
+- DNSSEC signing per zone (docs/dnssec.md): `jarl zone dnssec
+  enable|status|check-ds|disable|wipe` and the zone page's DNSSEC tab, or
+  the zone's new `dnssec_policy` field in the API. named signs the zone
+  with BIND's `default` policy (one ECDSA P-256 key that is never replaced)
+  or a custom one, using inline signing, with keys in a per-view directory
+  under `/var/lib/bind/jarl/dnssec-keys`. Jarl shows the keys and the DS
+  record to give the registrar, says when it's safe to publish it, and
+  checks the parent's DS records (`check-ds`, which also tells named with
+  `rndc dnssec -checkds`). It refuses steps that would break a signed
+  domain: switching straight to unsigned (it goes through BIND's
+  `insecure` policy instead, and finishes only once named is done),
+  deleting a signed zone or moving it to another view, and TTLs above the
+  policy's `max-zone-ttl`. `wipe` starts over with a clean slate once the
+  parent has no DS. Each step in the web UI opens a dialog that says what it
+  needs first. `jarl zone delegation` now also compares the parent's DS
+  records with the zone's keys.
+- Porkbun support (optional, docs/dnssec.md#porkbun): with an API key in
+  the new `porkbun:` section of jarl.yaml (and nowhere else), `jarl zone
+  registrar status|sync-glue|set-ns|publish-ds|remove-ds` and the zone
+  page's Registrar tab show and change the domain's name servers, glue
+  records (one per name server inside the domain, with all its IPv4 and
+  IPv6 addresses) and DS records at Porkbun. Every change first checks that
+  it won't take the domain offline (the name servers answer for the zone,
+  glue matches, a DS goes out only once the domain is delegated to servers
+  that serve the signed zone, DS records match the zone's keys before the
+  name servers change); `--dry-run` shows the checks and `--force` skips
+  them. Administrators only.
+- Backups include the DNSSEC keys (private keys too), stored inside the
+  backup file, and `jarld restore` puts them back for named
+  (`bind.named_user`, default `bind`). `jarl-backup.service` has
+  `CAP_DAC_READ_SEARCH` to read them; `--without-keys` skips them.
+- Jarl raises a zone's serial above the one named has loaded whenever it
+  writes a zone file whose serial isn't higher (after restoring an older
+  database, say), so named loads it (it refuses otherwise for a signed
+  zone) and secondaries pick it up.
 - `scripts/testenv.sh`: turns a fresh Debian/Ubuntu machine into a test bed.
   It installs BIND and the build tools (Go from go.dev), writes a hand-made
   style configuration with internal and external views, a split-horizon
@@ -17,6 +52,16 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Changed
 
+- `jarl zone serials` compares the serial named serves, which for a signed
+  zone is the signed zone's (ahead of Jarl's).
+- `jarld import` turns `dnssec-policy` in an existing configuration into
+  the zones' DNSSEC setting, and warns that their keys must be moved into
+  Jarl's key directory before adopting.
+- `dnssec-policy` is no longer accepted as a zone, view or server option
+  (zones have a DNSSEC setting instead), nor `key-directory` as a zone
+  option.
+- Deleting a zone also removes the journal and signed files named kept
+  next to it.
 - Release candidates (tags like `v0.2.0-rc.1`) publish their `.deb`s to a
   separate `testing` distribution of the package registry instead of
   `stable`. Servers that follow `stable` can't pick up an RC with