Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/types.go

@@ -6,8 +6,10 @@ import (
 	"encoding/json"
 	"time"
 
+	"jarl/internal/dnssec"
 	"jarl/internal/model"
 	"jarl/internal/nscheck"
+	"jarl/internal/porkbun"
 )
 
 // Version is the API path prefix.
@@ -21,6 +23,9 @@ type Zone struct {
 	Records  int    `json:"record_count"`
 	ZoneFile string `json:"zone_file,omitempty"` // the file named loads
 	RName    string `json:"rname_email,omitempty"`
+	// Registrar names the registrar Jarl can manage the domain at
+	// ("porkbun"), when one is configured for it.
+	Registrar string `json:"registrar,omitempty"`
 	// Pending is set when listing with a changeset: add, change or delete.
 	Pending string `json:"pending,omitempty"`
 }
@@ -267,3 +272,105 @@ type DelegationResponse struct {
 	Notes     []string  `json:"notes"`
 	CheckedAt time.Time `json:"checked_at"`
 }
+
+// DNSSECResponse is GET /zones/{zone}/dnssec.
+type DNSSECResponse struct {
+	Zone string `json:"zone"`
+	View string `json:"view,omitempty"`
+	Type string `json:"type"`
+	*dnssec.Status
+	// ParentZone is set when the parent zone is a primary zone in Jarl
+	// (in the same view): the DS record then goes there, as a record.
+	ParentZone string `json:"parent_zone,omitempty"`
+	// Registrar names the registrar Jarl can publish the DS at
+	// ("porkbun"), when one is configured in jarl.yaml.
+	Registrar string `json:"registrar,omitempty"`
+}
+
+// CheckDSResponse is POST /zones/{zone}/dnssec/check-ds: what the parent
+// zone has, and what named was told.
+type CheckDSResponse struct {
+	Parent *nscheck.ParentDSReport `json:"parent"`
+	Marked []string                `json:"marked"`
+	Notes  []string                `json:"notes"`
+	Status *dnssec.Status          `json:"status"`
+}
+
+// DNSSECWipe is POST /zones/{zone}/dnssec/wipe.
+type DNSSECWipe struct {
+	// Force wipes although the parent zone's DS records couldn't be
+	// checked, or named still counts a removed DS as cached.
+	Force  bool `json:"force,omitempty"`
+	DryRun bool `json:"dry_run,omitempty"`
+}
+
+// DNSSECWipeResponse is the result of a wipe.
+type DNSSECWipeResponse struct {
+	Removed     []string                `json:"removed"`
+	DryRun      bool                    `json:"dry_run,omitempty"`
+	ChangesetID int64                   `json:"changeset_id,omitempty"`
+	Parent      *nscheck.ParentDSReport `json:"parent,omitempty"`
+}
+
+// RegistrarResponse is GET /zones/{zone}/registrar: the domain's
+// delegation at the registrar, next to what the zone says.
+type RegistrarResponse struct {
+	Registrar string `json:"registrar"` // "porkbun"
+	Domain    string `json:"domain"`
+	// NS are the name servers at the registry, JarlNS those in the
+	// zone's NS records (both without trailing dots).
+	NS      []string `json:"ns"`
+	JarlNS  []string `json:"jarl_ns"`
+	NSMatch bool     `json:"ns_match"`
+	// Glue covers every glue record at the registry and every name server
+	// inside the zone that needs one.
+	Glue []GlueStatus `json:"glue"`
+	// DS are the DS records at the registry.
+	DS       []RegistrarDS     `json:"ds"`
+	Findings []nscheck.Finding `json:"findings"`
+	// Error is set when the registrar couldn't be asked; the rest is
+	// then empty.
+	Error string `json:"error,omitempty"`
+}
+
+// GlueStatus compares a glue record at the registry with the zone.
+type GlueStatus struct {
+	Host     string   `json:"host"`
+	Registry []string `json:"registry"` // addresses at the registry (none: no glue record)
+	Jarl     []string `json:"jarl"`     // the zone's A and AAAA records for the host
+	// Needed: a name server in the zone's NS records that is inside the
+	// domain, so resolvers need its glue. InUse: in the registry's NS.
+	Needed bool `json:"needed"`
+	InUse  bool `json:"in_use"`
+	// Action is what syncing the glue does: "create", "update" or "".
+	Action string `json:"action,omitempty"`
+}
+
+// RegistrarDS is a DS record at the registry.
+type RegistrarDS struct {
+	porkbun.DS
+	// Matches: it points at a key named publishes for the zone.
+	Matches bool `json:"matches"`
+}
+
+// RegistrarChange asks for a change at the registrar.
+type RegistrarChange struct {
+	// NS (set-ns) are the name servers to set (default: the zone's NS
+	// records).
+	NS []string `json:"ns,omitempty"`
+	// KeyTag (publish DS) picks the key (default: every key that needs
+	// one).
+	KeyTag uint16 `json:"key_tag,omitempty"`
+	// Force skips the checks that the change won't break the domain.
+	Force  bool `json:"force,omitempty"`
+	DryRun bool `json:"dry_run,omitempty"`
+}
+
+// RegistrarChangeResponse is the result of a change at the registrar.
+type RegistrarChangeResponse struct {
+	// Done lists what was changed (or would be, in a dry run).
+	Done     []string          `json:"done"`
+	DryRun   bool              `json:"dry_run,omitempty"`
+	Checks   []nscheck.Finding `json:"checks"`
+	Warnings []string          `json:"warnings"`
+}