Add backups, token expiry warnings and name server checks

- Daily database backups: jarl-backup.timer runs 'jarld backup', which
  writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
  and prunes by the time in the name while always keeping the newest
  keep_at_least. New backup: section in jarl.yaml; the dashboard and
  'jarl status' show the newest backup and warn when it is stale or
  failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
  the current database, keeps the current one aside and records the
  restore. 'jarld serve' holds a database lock, so a restore can't run
  under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
  daily log line, and a CLI warning via the Jarl-Token-Expires header;
  'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
  serial on a primary zone's secondaries (NS records, also-notify) or a
  secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
  delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/debian/postinst

@@ -18,8 +18,26 @@ if [ "$1" = configure ]; then
 		mv /etc/jarl/jarl.yaml.dpkg-new /etc/jarl/jarl.yaml
 	fi
 
+	# The daily database backup (jarl-backup.timer) is on by default. An
+	# administrator's 'systemctl disable jarl-backup.timer' is remembered
+	# by deb-systemd-helper and kept across upgrades. Before 'jarld init'
+	# the backup skips itself (there is no database yet).
+	if command -v deb-systemd-helper >/dev/null 2>&1; then
+		deb-systemd-helper unmask jarl-backup.timer >/dev/null || true
+		if deb-systemd-helper --quiet was-enabled jarl-backup.timer; then
+			deb-systemd-helper enable jarl-backup.timer >/dev/null || true
+		else
+			deb-systemd-helper update-state jarl-backup.timer >/dev/null || true
+		fi
+	elif [ -z "$2" ] && [ -d /run/systemd/system ]; then
+		systemctl enable jarl-backup.timer >/dev/null 2>&1 || true
+	fi
+
 	if [ -d /run/systemd/system ]; then
 		systemctl daemon-reload || true
+		if systemctl is-enabled --quiet jarl-backup.timer 2>/dev/null; then
+			systemctl start jarl-backup.timer || true
+		fi
 		# An upgrade restarts a running jarld (its database is upgraded
 		# when it starts). A first install starts nothing: Jarl needs
 		# 'jarld init' and 'jarld adopt' first.

deploy/debian/postrm

@@ -10,12 +10,27 @@ remove|purge)
 	;;
 esac
 
+# The backup timer's enabled state (see postinst): masked while the
+# package is removed, forgotten on purge.
+if command -v deb-systemd-helper >/dev/null 2>&1; then
+	case "$1" in
+	remove)
+		deb-systemd-helper mask jarl-backup.timer >/dev/null || true
+		;;
+	purge)
+		deb-systemd-helper purge jarl-backup.timer >/dev/null || true
+		deb-systemd-helper unmask jarl-backup.timer >/dev/null || true
+		;;
+	esac
+fi
+
 # Even a purge keeps Jarl's data: the database in /var/lib/jarl is the
 # source of your DNS configuration, and named.conf may still include the
 # files in /etc/bind/jarl. Remove them by hand when you no longer need them.
 if [ "$1" = purge ]; then
-	echo "jarl: kept /etc/jarl, /var/lib/jarl, /etc/bind/jarl, /var/lib/bind/jarl and"
-	echo "/var/cache/bind/jarl (named may still use them); remove them by hand if unused."
+	echo "jarl: kept /etc/jarl, /var/lib/jarl, /var/backups/jarl, /etc/bind/jarl,"
+	echo "/var/lib/bind/jarl and /var/cache/bind/jarl (named may still use some of"
+	echo "them); remove them by hand if unused."
 fi
 
 exit 0

deploy/debian/prerm

@@ -2,11 +2,15 @@
 # Jarl: runs before the package's files are removed (also on upgrades).
 set -e
 
-# On removal (not on upgrade) stop jarld and remove its boot-time link.
-# named keeps running with the configuration Jarl last wrote.
+# On removal (not on upgrade) stop jarld and the backup timer and remove
+# jarld's boot-time link (postrm deals with the timer's). named keeps
+# running with the configuration Jarl last wrote.
 if [ "$1" = remove ] && [ -d /run/systemd/system ]; then
-	systemctl stop jarl.service 2>/dev/null || true
+	systemctl stop jarl.service jarl-backup.timer jarl-backup.service 2>/dev/null || true
 	systemctl disable jarl.service 2>/dev/null || true
+	if ! command -v deb-systemd-helper >/dev/null 2>&1; then
+		systemctl disable jarl-backup.timer 2>/dev/null || true
+	fi
 fi
 
 exit 0

deploy/systemd/jarl-backup.service

@@ -0,0 +1,47 @@
+# Jarl: one database backup, run daily by jarl-backup.timer.
+# Installed as /etc/systemd/system/jarl-backup.service (see
+# docs/operations.md#backups). What to keep, and where, is in the backup:
+# section of /etc/jarl/jarl.yaml; when it runs is in jarl-backup.timer.
+[Unit]
+Description=Jarl database backup
+Documentation=file:///usr/local/share/doc/jarl/docs/operations.md
+# Nothing to back up before 'jarld init'. (If you moved the database in
+# jarl.yaml, change this with 'systemctl edit jarl-backup.service'.)
+ConditionPathExists=/var/lib/jarl/jarl.db
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/jarld --config /etc/jarl/jarl.yaml backup
+User=jarl
+Group=jarl
+UMask=0077
+Nice=10
+IOSchedulingClass=idle
+
+# The database (read, and the backup's record written) and the backup
+# directory. If you change backup.dir in jarl.yaml, allow the new one too:
+# 'systemctl edit jarl-backup.service' and add ReadWritePaths=/new/dir.
+ProtectSystem=strict
+ReadWritePaths=/var/lib/jarl -/var/backups/jarl
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM

deploy/systemd/jarl-backup.timer

@@ -0,0 +1,20 @@
+# Jarl: runs jarl-backup.service (a database backup) every day.
+# Installed as /etc/systemd/system/jarl-backup.timer. Change the schedule
+# with 'systemctl edit jarl-backup.timer', e.g.
+#   [Timer]
+#   OnCalendar=
+#   OnCalendar=*-*-* 02:30
+# and keep backup.warn_after in jarl.yaml above the new interval.
+[Unit]
+Description=Daily Jarl database backup
+Documentation=file:///usr/local/share/doc/jarl/docs/operations.md
+
+[Timer]
+OnCalendar=daily
+# Spread the start over an hour, and catch up on a run missed while the
+# machine was off.
+RandomizedDelaySec=1h
+Persistent=true
+
+[Install]
+WantedBy=timers.target

deploy/tmpfiles.d/jarl.conf

@@ -14,3 +14,5 @@ d      /var/cache/bind/jarl  2770  jarl bind
 # (Debian's AppArmor profile allows /var/log/named) and jarld reads it as a
 # member of group bind.
 d      /var/log/named        0750  bind bind
+# Database backups (jarl-backup.timer; backup.dir in jarl.yaml).
+d      /var/backups/jarl     0700  jarl jarl