DNS over TLS and HTTPS set up in one step

jarl encrypted-dns setup (and the Encrypted DNS page) finds or obtains a
certificate for the host name, checks that nothing else listens on the
DoT and DoH ports at the chosen addresses (offering a free DoH port), and
stages named's tls statement and listeners as one change, keeping port 53
where it was when there was no listen-on, plus the host name's records in
the private views (local to the view in a linked zone). Status shows what
to give Android, Linux, Firefox, Chrome and Windows clients. A tls
statement with missing files is refused (tls_file_missing), and a
certificate named uses can't be deleted. docs/encrypted-dns.md, e2e with
real DoT and DoH queries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/validate/tls.go

@@ -0,0 +1,34 @@
+package validate
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+
+	"jarl/internal/model"
+	"jarl/internal/namedconf"
+)
+
+// checkTLSFiles checks that the files a top-level tls statement names
+// exist: named fails to load the whole configuration otherwise. (Files
+// jarld can't look at are left to named.)
+func (c *checker) checkTLSFiles() {
+	for _, o := range c.s.ScopedOptions(model.ScopeTopLevel, 0) {
+		if o.Name != "tls" {
+			continue
+		}
+		stmt, err := namedconf.ParseOptionValue("tls", o.Value)
+		if err != nil || stmt.FirstBlock() == nil {
+			continue
+		}
+		for _, s := range stmt.FirstBlock().Stmts {
+			switch s.Keyword() {
+			case "cert-file", "key-file", "ca-file", "dhparam-file":
+				path := s.Arg(0)
+				if _, err := os.Stat(path); errors.Is(err, fs.ErrNotExist) {
+					c.errf("tls_file_missing", "option", o.ID, "tls %s: %s %s doesn't exist, and named won't load its configuration without it (a certificate Jarl obtains is written once it has been obtained: jarl cert list)", stmt.Arg(0), s.Keyword(), path)
+				}
+			}
+		}
+	}
+}

internal/validate/validate.go

@@ -152,6 +152,7 @@ func State(s *model.State, opts Options) []Problem {
 	c.checkDNSSEC()
 	c.checkBlocking()
 	c.checkLinked()
+	c.checkTLSFiles()
 	c.applyAcks()
 	sortProblems(c.problems)
 	return c.problems