Give every view a TSIG key that selects it

Each view's match-clients starts with "key jarl-view-NAME" (after
"!key" for the views listed after it), so a query signed with a view's
key lands in that view from any address. The secrets are derived from a
random seed in Jarl's database. The delegation check signs its queries
to this server's own addresses with the key of the zone's view: before,
they got whichever view matched the server's address, usually internal.
jarl view key / GET /views/{id}/key show a key for dig -k (tsig:write,
audited). jarl-view- key names are reserved; the importer drops view
keys from a configuration Jarl wrote.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/validate/config.go

@@ -57,6 +57,8 @@ func (c *checker) checkKeys() {
 			c.errf("key_name_invalid", "key", k.ID, "TSIG key has no name")
 		} else if err := dnsname.CheckZoneName(dnsname.Fqdn(k.Name)); err != nil {
 			c.errf("key_name_invalid", "key", k.ID, "%s: invalid name: %v", label, err)
+		} else if strings.HasPrefix(strings.ToLower(k.Name), model.ViewKeyPrefix) {
+			c.errf("key_name_reserved", "key", k.ID, "%s: names starting with %s are kept for the keys Jarl gives views", label, model.ViewKeyPrefix)
 		}
 		minLen, ok := TSIGAlgorithms[k.Algorithm]
 		if !ok {

internal/validate/validate.go

@@ -126,6 +126,10 @@ func State(s *model.State, opts Options) []Problem {
 	for _, k := range s.Keys {
 		c.keyNames[k.Name] = true
 	}
+	// The views' own keys (render/viewkeys.go) may be referred to too.
+	for _, v := range s.Views {
+		c.keyNames[model.NormalizeKeyName(model.ViewKeyName(v.Name))] = true
+	}
 	for _, k := range opts.ExternalKeys {
 		c.keyNames[model.NormalizeKeyName(k)] = true
 	}