Jarl 0.1.0: manage BIND through a web UI, REST API and CLI

Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG
keys, zones of every type, records, named.conf options) in SQLite and
renders named.conf, keys.conf and zone files from it.

Every change goes through one changeset pipeline: whole-configuration
validation, named-checkconf -z and named-checkzone in a staging
directory, atomic install, rndc reconfig/reload, serial verification
with rndc zonestatus, and rollback if named does not load the change.
Changes apply one at a time by default or are bundled and applied
together. Applied changesets can be reverted.

- jarld: the daemon with the REST API and an embedded web UI, plus import,
  adopt, check, resync, backup and local user recovery commands
- jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh
- users with argon2id passwords and CSRF-protected sessions; hashed API
  tokens with granular grants and roles; an audit log
- systemd unit, sysusers.d/tmpfiles.d files, Makefile
- unit tests, integration tests against a real named, scripts/e2e.sh
- docs/ guides, README and CHANGELOG

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/jarld/admin.go

@@ -0,0 +1,408 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+
+	"github.com/spf13/cobra"
+
+	"jarl/internal/config"
+	"jarl/internal/engine"
+	"jarl/internal/render"
+	"jarl/internal/validate"
+	"jarl/internal/version"
+)
+
+// dirOwner restores file ownership after commands run as root.
+type dirOwner struct {
+	uid, gid int
+	active   bool
+}
+
+func newDirOwner(dir string) *dirOwner {
+	o := &dirOwner{}
+	if os.Geteuid() != 0 {
+		return o
+	}
+	fi, err := os.Stat(dir)
+	if err != nil {
+		return o
+	}
+	if st, ok := fi.Sys().(*syscall.Stat_t); ok && st.Uid != 0 {
+		o.uid, o.gid, o.active = int(st.Uid), int(st.Gid), true
+	}
+	return o
+}
+
+// fix gives root-owned files under dirs to the daemon's user (keeping
+// their group, which matters for named).
+func (o *dirOwner) fix(dirs ...string) {
+	if !o.active {
+		return
+	}
+	for _, d := range dirs {
+		filepath.WalkDir(d, func(path string, de fs.DirEntry, err error) error {
+			if err != nil {
+				return nil
+			}
+			info, err := de.Info()
+			if err != nil {
+				return nil
+			}
+			if st, ok := info.Sys().(*syscall.Stat_t); ok && st.Uid == 0 {
+				gid := int(st.Gid)
+				if path == d || strings.HasSuffix(path, ".db") || strings.Contains(path, ".db-") {
+					gid = o.gid
+				}
+				os.Lchown(path, o.uid, gid)
+			}
+			return nil
+		})
+	}
+}
+
+func printJSON(v any) {
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	enc.Encode(v)
+}
+
+func printProblems(ps []validate.Problem) {
+	for _, p := range ps {
+		fmt.Println("  " + p.String())
+	}
+}
+
+func printResult(res *engine.Result) {
+	if res == nil {
+		return
+	}
+	if len(res.Problems) > 0 {
+		fmt.Println("Problems:")
+		printProblems(res.Problems)
+	}
+	for _, m := range res.Check {
+		if m.Error {
+			obj := ""
+			if m.Object != "" {
+				obj = " [" + m.Object + "]"
+			}
+			fmt.Printf("  named-checkconf: %s%s\n", m.Text, obj)
+		}
+	}
+	for _, w := range res.Warnings {
+		fmt.Println("warning:", w)
+	}
+	for _, d := range res.Drift {
+		fmt.Printf("drift: %s (%s)\n", d.Path, d.Reason)
+	}
+}
+
+func importCmd() *cobra.Command {
+	var from string
+	var dryRun, asJSON bool
+	cmd := &cobra.Command{
+		Use:   "import",
+		Short: "Import the existing BIND configuration into Jarl",
+		Long: `Reads named.conf (following includes) and all primary zone files into
+Jarl. Key files used by rndc (rndc.key) stay as include statements.
+
+If the imported configuration is valid it is applied right away: Jarl
+writes its own files (bind.config_dir, bind.zone_dir), but named keeps
+running on the old configuration until you run 'jarld adopt'. If there
+are problems, the import is kept as an open changeset that you can fix in
+the web UI or with the CLI.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			ctx := context.Background()
+			if from == "" {
+				from = a.cfg.BIND.MainConfig
+			}
+			p, err := a.localPrincipal(ctx, "")
+			if err != nil {
+				return err
+			}
+			res, err := a.eng.Import(ctx, from, p, dryRun)
+			if err != nil {
+				return err
+			}
+			if asJSON {
+				printJSON(res)
+				return nil
+			}
+			rep := res.Report
+			fmt.Printf("Read %s:\n", from)
+			fmt.Printf("  %d views, %d zones, %d records, %d ACLs, %d TSIG keys, %d options\n",
+				rep.Counts["views"], rep.Counts["zones"], rep.Counts["records"], rep.Counts["acls"], rep.Counts["tsig_keys"], rep.Counts["options"])
+			for _, z := range rep.Zones {
+				view := ""
+				if z.View != "" {
+					view = " [view " + z.View + "]"
+				}
+				extra := ""
+				if z.Skipped > 0 {
+					extra = fmt.Sprintf(", %d skipped", z.Skipped)
+				}
+				fmt.Printf("  zone %-35s %-10s %4d records%s\n", z.Name+view, z.Type, z.Records, extra)
+			}
+			for _, k := range rep.Kept {
+				fmt.Printf("  kept as include: %s\n", k)
+			}
+			for _, w := range rep.Warnings {
+				fmt.Println("warning:", w)
+			}
+			if len(rep.Skipped) > 0 {
+				fmt.Println("Not imported:")
+				for _, s := range rep.Skipped {
+					fmt.Println("  " + s)
+				}
+			}
+			if dryRun {
+				fmt.Printf("\nDry run: %d operations would be applied; nothing was changed.\n", len(res.Changeset.Ops))
+				return nil
+			}
+			if !res.Applied {
+				fmt.Printf("\nThe import is saved as changeset #%d but was NOT applied:\n", res.Changeset.ID)
+				if res.Result != nil && res.Result.Error != nil {
+					fmt.Println("  " + res.Result.Error.Message)
+				}
+				printResult(res.Result)
+				fmt.Println("\nFix the problems (web UI: Changes, or 'jarl changeset show " + fmt.Sprint(res.Changeset.ID) + "'), apply the changeset, then run 'jarld adopt'.")
+				return nil
+			}
+			printResult(res.Result)
+			fmt.Printf("\nImported and applied as changeset #%d. Jarl's files are in %s and %s.\n", res.Result.ChangesetID, a.cfg.BIND.ConfigDir, a.cfg.BIND.ZoneDir)
+			fmt.Println("named still uses the old configuration. Review Jarl's files, then switch named over with:")
+			fmt.Println("\n  sudo jarld adopt")
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&from, "from", "", "named.conf to import (default: bind.main_config)")
+	cmd.Flags().BoolVar(&dryRun, "dry-run", false, "only show what would be imported")
+	cmd.Flags().BoolVar(&asJSON, "json", false, "print the result as JSON")
+	return cmd
+}
+
+func adoptCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "adopt",
+		Short: "Switch named over to Jarl's configuration (run as root)",
+		Long: `Makes named load Jarl's configuration:
+
+  1. bumps the serial of every primary zone,
+  2. saves bind.main_config (e.g. /etc/bind/named.conf) as
+     named.conf.pre-jarl-<date> and replaces it with a single include of
+     Jarl's named.conf,
+  3. runs named-checkconf, rndc reconfig and reloads every zone,
+  4. checks that named serves every zone from Jarl's files.
+
+If anything fails the previous named.conf is restored. Writing
+named.conf needs root.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			ctx := context.Background()
+			p, err := a.localPrincipal(ctx, "")
+			if err != nil {
+				return err
+			}
+			res, err := a.eng.Adopt(ctx, p)
+			if err != nil {
+				if ee, ok := engine.AsError(err); ok && len(ee.Problems) > 0 {
+					fmt.Println("Problems:")
+					printProblems(ee.Problems)
+				}
+				return err
+			}
+			if res.Already {
+				fmt.Printf("named already loads Jarl's configuration (%s includes %s).\n", res.MainConfig, filepath.Join(a.cfg.BIND.ConfigDir, "named.conf"))
+				return nil
+			}
+			fmt.Printf("named now loads Jarl's configuration.\n  %s includes %s\n  previous configuration saved as %s\n", res.MainConfig, filepath.Join(a.cfg.BIND.ConfigDir, "named.conf"), res.Backup)
+			for _, s := range res.Serials {
+				fmt.Printf("  zone %s serial %d -> %d\n", strings.TrimSuffix(s.Zone, "."), s.Old, s.New)
+			}
+			fmt.Println("\nFrom now on, change DNS only through Jarl. To go back: restore the saved file and run 'rndc reconfig'.")
+			return nil
+		},
+	}
+}
+
+func checkCmd() *cobra.Command {
+	var asJSON bool
+	cmd := &cobra.Command{
+		Use:   "check",
+		Short: "Validate the current configuration and run named-checkconf on it",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			res, err := a.eng.CheckCurrent(context.Background())
+			if err != nil {
+				return err
+			}
+			if asJSON {
+				printJSON(res)
+			} else {
+				printResult(res)
+				if res.Diff != "" {
+					fmt.Println("Files on disk differ from the configuration; 'jarld resync' rewrites them:")
+					fmt.Print(res.Diff)
+				}
+			}
+			if !res.Valid {
+				return fmt.Errorf("the configuration has errors")
+			}
+			if !asJSON {
+				fmt.Println("OK: the configuration is valid and named-checkconf accepts it.")
+			}
+			return nil
+		},
+	}
+	cmd.Flags().BoolVar(&asJSON, "json", false, "print the result as JSON")
+	return cmd
+}
+
+func renderCmd() *cobra.Command {
+	var out string
+	cmd := &cobra.Command{
+		Use:   "render",
+		Short: "Write the generated configuration to a directory (for inspection)",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if out == "" {
+				return fmt.Errorf("--out is required")
+			}
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.store.Close()
+			st, err := a.store.LoadState(context.Background())
+			if err != nil {
+				return err
+			}
+			paths := render.Paths{ConfigDir: filepath.Join(out, "config"), ZoneDir: filepath.Join(out, "zones"), CacheDir: filepath.Join(out, "cache")}
+			o := render.Render(st, paths)
+			for _, f := range o.Files {
+				if err := os.MkdirAll(filepath.Dir(f.Path), 0o750); err != nil {
+					return err
+				}
+				if err := os.WriteFile(f.Path, f.Content, 0o640); err != nil {
+					return err
+				}
+				fmt.Println(f.Path)
+			}
+			return nil
+		},
+	}
+	cmd.Flags().StringVarP(&out, "out", "o", "", "output directory")
+	return cmd
+}
+
+func resyncCmd() *cobra.Command {
+	var force, dryRun bool
+	cmd := &cobra.Command{
+		Use:   "resync",
+		Short: "Rewrite all generated files from the database and reload named",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			ctx := context.Background()
+			p, err := a.localPrincipal(ctx, "")
+			if err != nil {
+				return err
+			}
+			res, err := a.eng.Resync(ctx, p, engine.ApplyOptions{Force: force, DryRun: dryRun})
+			printResult(res)
+			if err != nil {
+				return err
+			}
+			if res.Diff != "" {
+				fmt.Print(res.Diff)
+			}
+			if dryRun {
+				fmt.Printf("Dry run: %d files would be written.\n", len(res.Files))
+			} else {
+				fmt.Printf("%d files written; named reloaded: %v\n", len(res.Files), res.Reloaded)
+			}
+			return nil
+		},
+	}
+	cmd.Flags().BoolVar(&force, "force", false, "overwrite files changed outside Jarl")
+	cmd.Flags().BoolVar(&dryRun, "dry-run", false, "only show what would change")
+	return cmd
+}
+
+func backupCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "backup FILE",
+		Short: "Write a consistent copy of the database to FILE (safe while jarld runs)",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			if _, err := os.Stat(args[0]); err == nil {
+				return fmt.Errorf("%s already exists", args[0])
+			}
+			if err := a.store.Backup(context.Background(), args[0]); err != nil {
+				return err
+			}
+			os.Chmod(args[0], 0o600)
+			fmt.Println("Database copied to", args[0])
+			return nil
+		},
+	}
+}
+
+func configCmd() *cobra.Command {
+	var example bool
+	cmd := &cobra.Command{
+		Use:   "config",
+		Short: "Show the effective configuration (or an example file)",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if example {
+				fmt.Print(config.Example)
+				return nil
+			}
+			cfg, err := config.Load(configPath, true)
+			if err != nil {
+				return err
+			}
+			printJSON(cfg)
+			return nil
+		},
+	}
+	cmd.Flags().BoolVar(&example, "example", false, "print a commented example configuration file")
+	return cmd
+}
+
+func versionCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "version",
+		Short: "Print the version",
+		Run: func(cmd *cobra.Command, args []string) {
+			fmt.Println("jarld", version.Version)
+		},
+	}
+}

cmd/jarld/main.go

@@ -0,0 +1,502 @@
+// Command jarld is the Jarl daemon: it serves the web UI and the REST API
+// and writes BIND's configuration. It also has administrative subcommands
+// for setting up and migrating a server.
+package main
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/spf13/cobra"
+	"golang.org/x/term"
+
+	"jarl/internal/auth"
+	"jarl/internal/bind"
+	"jarl/internal/config"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+	"jarl/internal/render"
+	"jarl/internal/server"
+	"jarl/internal/store"
+	"jarl/internal/version"
+	"jarl/internal/web"
+)
+
+func main() {
+	if err := rootCmd().Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, "error:", err)
+		os.Exit(1)
+	}
+}
+
+var configPath string
+
+func rootCmd() *cobra.Command {
+	root := &cobra.Command{
+		Use:           "jarld",
+		Short:         "Jarl: manage BIND (named) through a web UI, a REST API and a CLI",
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		Version:       version.Version,
+	}
+	def := os.Getenv("JARL_CONFIG")
+	if def == "" {
+		def = config.DefaultPath
+	}
+	root.PersistentFlags().StringVarP(&configPath, "config", "c", def, "configuration file")
+	root.AddCommand(serveCmd(), initCmd(), userCmd(), importCmd(), adoptCmd(), checkCmd(), renderCmd(), resyncCmd(), backupCmd(), configCmd(), versionCmd())
+	return root
+}
+
+// app holds what most commands need.
+type app struct {
+	cfg   *config.Config
+	log   *slog.Logger
+	store *store.Store
+	eng   *engine.Engine
+	owner *dirOwner
+}
+
+func newLogger(cfg *config.Config, w io.Writer) *slog.Logger {
+	var level slog.Level
+	switch strings.ToLower(cfg.Log.Level) {
+	case "debug":
+		level = slog.LevelDebug
+	case "warn", "warning":
+		level = slog.LevelWarn
+	case "error":
+		level = slog.LevelError
+	default:
+		level = slog.LevelInfo
+	}
+	opts := &slog.HandlerOptions{Level: level}
+	if cfg.Log.Format == "json" {
+		return slog.New(slog.NewJSONHandler(w, opts))
+	}
+	// systemd's journal adds timestamps.
+	if os.Getenv("JOURNAL_STREAM") != "" {
+		opts.ReplaceAttr = func(groups []string, a slog.Attr) slog.Attr {
+			if a.Key == slog.TimeKey && len(groups) == 0 {
+				return slog.Attr{}
+			}
+			return a
+		}
+	}
+	return slog.New(slog.NewTextHandler(w, opts))
+}
+
+func openApp(allowMissingConfig bool) (*app, error) {
+	cfg, err := config.Load(configPath, allowMissingConfig)
+	if err != nil {
+		return nil, fmt.Errorf("loading configuration: %w", err)
+	}
+	log := newLogger(cfg, os.Stderr)
+	owner := newDirOwner(filepath.Dir(cfg.Database))
+	if err := os.MkdirAll(filepath.Dir(cfg.Database), 0o750); err != nil {
+		return nil, err
+	}
+	st, err := store.Open(cfg.Database)
+	if err != nil {
+		return nil, fmt.Errorf("opening database %s: %w", cfg.Database, err)
+	}
+	tools := &bind.Tools{NamedCheckConf: cfg.BIND.NamedCheckConf, NamedCheckZone: cfg.BIND.NamedCheckZone, RNDC: cfg.BIND.RNDC, RNDCArgs: cfg.BIND.RNDCArgs}
+	eng := engine.New(st, tools, engine.Config{
+		Paths:         render.Paths{ConfigDir: cfg.BIND.ConfigDir, ZoneDir: cfg.BIND.ZoneDir, CacheDir: cfg.BIND.CacheDir},
+		MainConfig:    cfg.BIND.MainConfig,
+		StagingDir:    cfg.StagingDir,
+		FileGroup:     cfg.BIND.FileGroup,
+		ReloadTimeout: time.Duration(cfg.BIND.ReloadTimeout),
+		NoReload:      cfg.BIND.NoReload,
+	}, log)
+	return &app{cfg: cfg, log: log, store: st, eng: eng, owner: owner}, nil
+}
+
+func (a *app) close() {
+	a.store.Close()
+	// Commands run as root must not leave root-owned files where the
+	// daemon (running as its own user) needs to write.
+	a.owner.fix(filepath.Dir(a.cfg.Database), a.cfg.StagingDir, a.cfg.BIND.ConfigDir, a.cfg.BIND.ZoneDir, a.cfg.BIND.CacheDir)
+}
+
+// localPrincipal is used for administrative commands run on the server.
+func (a *app) localPrincipal(ctx context.Context, username string) (*auth.Principal, error) {
+	if username == "" {
+		username = os.Getenv("SUDO_USER")
+	}
+	if username != "" {
+		if u, err := a.store.GetUserByName(ctx, username); err == nil {
+			if !u.Admin {
+				return nil, fmt.Errorf("user %s is not an administrator", username)
+			}
+			return &auth.Principal{User: u, Method: "local"}, nil
+		}
+	}
+	// Fall back to the first administrator, or a synthetic one.
+	users, err := a.store.ListUsers(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for _, u := range users {
+		if u.Admin && !u.Disabled {
+			return &auth.Principal{User: &model.User{ID: u.ID, Username: u.Username + " (local)", Admin: true}, Method: "local"}, nil
+		}
+	}
+	return &auth.Principal{User: &model.User{Username: "local", Admin: true}, Method: "local"}, nil
+}
+
+// ---- serve
+
+func serveCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "serve",
+		Short: "Run the daemon (web UI and API)",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+			defer stop()
+			if users, err := a.store.ListUsers(ctx); err == nil && len(users) == 0 {
+				a.log.Warn("there are no users yet; create an administrator with 'jarld init' or 'jarld user add --admin NAME'")
+			}
+			if ok, err := a.eng.Adopted(); err == nil && !ok {
+				a.log.Warn("named does not load Jarl's configuration yet; changes are written but named is not reloaded until 'jarld adopt' runs", "main_config", a.cfg.BIND.MainConfig)
+			}
+			srv := server.New(server.Config{
+				Listen: a.cfg.Listen, TLSCertFile: a.cfg.TLS.CertFile, TLSKeyFile: a.cfg.TLS.KeyFile,
+				TrustedProxies: a.cfg.Proxies(), SessionLifetime: time.Duration(a.cfg.Session.Lifetime),
+				SessionIdle: time.Duration(a.cfg.Session.IdleTimeout), CookieSecure: a.cfg.Session.CookieSecure,
+				Version: version.Version,
+			}, a.eng, a.log, web.FS())
+			hup := make(chan os.Signal, 1)
+			signal.Notify(hup, syscall.SIGHUP)
+			go func() {
+				for range hup {
+					sdNotify("RELOADING=1")
+					srv.ReloadTLS()
+					sdNotify("READY=1")
+				}
+			}()
+			go auditRetention(ctx, a)
+			a.log.Info("jarld starting", "version", version.Version, "database", a.cfg.Database, "bind_config", a.cfg.BIND.ConfigDir)
+			err = srv.Serve(ctx, func() { sdNotify("READY=1\nSTATUS=serving") })
+			sdNotify("STOPPING=1")
+			a.log.Info("jarld stopped")
+			return err
+		},
+	}
+}
+
+func auditRetention(ctx context.Context, a *app) {
+	if a.cfg.Audit.RetentionDays <= 0 {
+		return
+	}
+	t := time.NewTicker(6 * time.Hour)
+	defer t.Stop()
+	for {
+		before := time.Now().Add(-time.Duration(a.cfg.Audit.RetentionDays) * 24 * time.Hour)
+		if n, err := a.store.PruneAudit(ctx, before); err != nil {
+			a.log.Warn("pruning audit log failed", "err", err)
+		} else if n > 0 {
+			a.log.Info("pruned audit log", "events", n)
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+		}
+	}
+}
+
+// sdNotify tells systemd about state changes (Type=notify).
+func sdNotify(state string) {
+	sock := os.Getenv("NOTIFY_SOCKET")
+	if sock == "" {
+		return
+	}
+	addr := &net.UnixAddr{Name: sock, Net: "unixgram"}
+	if strings.HasPrefix(sock, "@") {
+		addr.Name = "\x00" + sock[1:]
+	}
+	c, err := net.DialUnix("unixgram", nil, addr)
+	if err != nil {
+		return
+	}
+	defer c.Close()
+	c.Write([]byte(state))
+}
+
+// ---- init and users
+
+func readPassword(prompt string, fromStdin bool) (string, error) {
+	if fromStdin || !term.IsTerminal(int(os.Stdin.Fd())) {
+		line, err := bufio.NewReader(os.Stdin).ReadString('\n')
+		if err != nil && !errors.Is(err, io.EOF) {
+			return "", err
+		}
+		return strings.TrimRight(line, "\r\n"), nil
+	}
+	fmt.Fprint(os.Stderr, prompt)
+	b, err := term.ReadPassword(int(os.Stdin.Fd()))
+	fmt.Fprintln(os.Stderr)
+	if err != nil {
+		return "", err
+	}
+	fmt.Fprint(os.Stderr, "Repeat: ")
+	b2, err := term.ReadPassword(int(os.Stdin.Fd()))
+	fmt.Fprintln(os.Stderr)
+	if err != nil {
+		return "", err
+	}
+	if string(b) != string(b2) {
+		return "", errors.New("passwords don't match")
+	}
+	return string(b), nil
+}
+
+func createToken(ctx context.Context, a *app, u *model.User, name string) (string, error) {
+	secret, pid, hash := auth.NewToken()
+	if err := a.store.CreateToken(ctx, &model.Token{UserID: u.ID, Name: name, PublicID: pid, SecretHash: hash}); err != nil {
+		return "", err
+	}
+	return secret, nil
+}
+
+func initCmd() *cobra.Command {
+	var username string
+	var stdin, withToken bool
+	var nameservers []string
+	var rname string
+	cmd := &cobra.Command{
+		Use:   "init",
+		Short: "Create the database, the first administrator and default server options",
+		Long: `Creates Jarl's database with a first administrator account.
+
+Jarl starts empty. Either import your existing BIND configuration with
+'jarld import', or build one from scratch in the web UI.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			ctx := context.Background()
+			users, err := a.store.ListUsers(ctx)
+			if err != nil {
+				return err
+			}
+			if len(users) > 0 {
+				return fmt.Errorf("Jarl is already initialized (%d users); use 'jarld user add' to add users", len(users))
+			}
+			pw, err := readPassword("Password for "+username+": ", stdin)
+			if err != nil {
+				return err
+			}
+			hash, err := auth.HashPassword(pw)
+			if err != nil {
+				return err
+			}
+			u := &model.User{Username: username, PasswordHash: hash, Admin: true, Comment: "created by jarld init"}
+			if err := a.store.CreateUser(ctx, u); err != nil {
+				return err
+			}
+			p := &auth.Principal{User: u, Method: "local"}
+			set := engine.SettingsInput{}
+			if len(nameservers) > 0 {
+				set.Nameservers = &nameservers
+			}
+			if rname != "" {
+				set.RName = &rname
+			}
+			if set.Nameservers != nil || set.RName != nil {
+				if _, err := a.eng.Submit(ctx, []engine.Request{engine.NewRequest(engine.OpSettingsUpdate, 0, set)}, p, "cli", "initial settings", engine.ApplyOptions{NoReload: true}); err != nil {
+					return err
+				}
+			}
+			a.eng.Audit(ctx, p, "system.init", "user", u.ID, u.Username, "success", "")
+			fmt.Printf("Created administrator %q in %s.\n", u.Username, a.cfg.Database)
+			if withToken {
+				tok, err := createToken(ctx, a, u, "cli")
+				if err != nil {
+					return err
+				}
+				fmt.Printf("\nAPI token for the CLI (shown only once):\n\n  %s\n\n", tok)
+			}
+			fmt.Println("\nNext steps:")
+			fmt.Println("  1. Import your current BIND configuration:  sudo -u jarl jarld import")
+			fmt.Println("  2. Switch named over to Jarl:              sudo jarld adopt")
+			fmt.Println("  3. Start the daemon:                        sudo systemctl enable --now jarl")
+			return nil
+		},
+	}
+	cmd.Flags().StringVarP(&username, "user", "u", "admin", "administrator username")
+	cmd.Flags().BoolVar(&stdin, "password-stdin", false, "read the password from standard input")
+	cmd.Flags().BoolVar(&withToken, "token", false, "also create an API token for the CLI")
+	cmd.Flags().StringSliceVar(&nameservers, "nameservers", nil, "default name servers for new zones (e.g. ns1.example.com.)")
+	cmd.Flags().StringVar(&rname, "contact", "", "default SOA contact for new zones (e.g. hostmaster@example.com)")
+	return cmd
+}
+
+func userCmd() *cobra.Command {
+	cmd := &cobra.Command{Use: "user", Short: "Manage users locally (for bootstrapping and recovery)"}
+	var admin, stdin, withToken, service bool
+	var grants []string
+	add := &cobra.Command{
+		Use:   "add NAME",
+		Short: "Create a user",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			ctx := context.Background()
+			u := &model.User{Username: args[0], Admin: admin}
+			for _, g := range grants {
+				gr, err := auth.ParseGrant(g)
+				if err != nil {
+					return fmt.Errorf("grant %q: %w", g, err)
+				}
+				u.Grants = append(u.Grants, gr)
+			}
+			if !service {
+				pw, err := readPassword("Password for "+u.Username+": ", stdin)
+				if err != nil {
+					return err
+				}
+				if u.PasswordHash, err = auth.HashPassword(pw); err != nil {
+					return err
+				}
+			}
+			if err := a.store.CreateUser(ctx, u); err != nil {
+				return err
+			}
+			a.eng.Audit(ctx, &auth.Principal{User: &model.User{Username: "local"}, Method: "local"}, "user.create", "user", u.ID, u.Username, "success", "jarld user add")
+			fmt.Printf("Created user %s.\n", u.Username)
+			if withToken {
+				tok, err := createToken(ctx, a, u, "cli")
+				if err != nil {
+					return err
+				}
+				fmt.Printf("API token (shown only once): %s\n", tok)
+			}
+			return nil
+		},
+	}
+	add.Flags().BoolVar(&admin, "admin", false, "make the user an administrator")
+	add.Flags().BoolVar(&stdin, "password-stdin", false, "read the password from standard input")
+	add.Flags().BoolVar(&withToken, "token", false, "also create an API token")
+	add.Flags().BoolVar(&service, "service", false, "service account without password (API tokens only)")
+	add.Flags().StringArrayVar(&grants, "grant", nil, `permission, e.g. "records:write zones=example.com" (repeatable)`)
+
+	passwd := &cobra.Command{
+		Use:   "passwd NAME",
+		Short: "Set a user's password (and enable the account)",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			ctx := context.Background()
+			u, err := a.store.GetUserByName(ctx, args[0])
+			if err != nil {
+				return fmt.Errorf("user %s: %w", args[0], err)
+			}
+			pw, err := readPassword("New password for "+u.Username+": ", stdin)
+			if err != nil {
+				return err
+			}
+			if u.PasswordHash, err = auth.HashPassword(pw); err != nil {
+				return err
+			}
+			u.Disabled = false
+			if err := a.store.UpdateUser(ctx, u); err != nil {
+				return err
+			}
+			a.store.DeleteUserSessions(ctx, u.ID, "")
+			a.eng.Audit(ctx, &auth.Principal{User: &model.User{Username: "local"}, Method: "local"}, "user.password", "user", u.ID, u.Username, "success", "jarld user passwd")
+			fmt.Printf("Password of %s changed.\n", u.Username)
+			return nil
+		},
+	}
+	passwd.Flags().BoolVar(&stdin, "password-stdin", false, "read the password from standard input")
+
+	token := &cobra.Command{
+		Use:   "token NAME [TOKEN-NAME]",
+		Short: "Create an API token for a user",
+		Args:  cobra.RangeArgs(1, 2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			ctx := context.Background()
+			u, err := a.store.GetUserByName(ctx, args[0])
+			if err != nil {
+				return fmt.Errorf("user %s: %w", args[0], err)
+			}
+			name := "cli"
+			if len(args) > 1 {
+				name = args[1]
+			}
+			tok, err := createToken(ctx, a, u, name)
+			if err != nil {
+				return err
+			}
+			fmt.Println(tok)
+			return nil
+		},
+	}
+	list := &cobra.Command{
+		Use:   "list",
+		Short: "List users",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			users, err := a.store.ListUsers(context.Background())
+			if err != nil {
+				return err
+			}
+			for _, u := range users {
+				flags := []string{}
+				if u.Admin {
+					flags = append(flags, "admin")
+				}
+				if u.Disabled {
+					flags = append(flags, "disabled")
+				}
+				if !u.HasPassword {
+					flags = append(flags, "no password")
+				}
+				var gs []string
+				for _, g := range u.Grants {
+					gs = append(gs, auth.FormatGrant(g))
+				}
+				fmt.Printf("%-20s %-25s %s\n", u.Username, strings.Join(flags, ","), strings.Join(gs, "; "))
+			}
+			return nil
+		},
+	}
+	cmd.AddCommand(add, passwd, token, list)
+	return cmd
+}