Jarl 0.1.0: manage BIND through a web UI, REST API and CLI
Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG keys, zones of every type, records, named.conf options) in SQLite and renders named.conf, keys.conf and zone files from it. Every change goes through one changeset pipeline: whole-configuration validation, named-checkconf -z and named-checkzone in a staging directory, atomic install, rndc reconfig/reload, serial verification with rndc zonestatus, and rollback if named does not load the change. Changes apply one at a time by default or are bundled and applied together. Applied changesets can be reverted. - jarld: the daemon with the REST API and an embedded web UI, plus import, adopt, check, resync, backup and local user recovery commands - jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh - users with argon2id passwords and CSRF-protected sessions; hashed API tokens with granular grants and roles; an audit log - systemd unit, sysusers.d/tmpfiles.d files, Makefile - unit tests, integration tests against a real named, scripts/e2e.sh - docs/ guides, README and CHANGELOG Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
abrown38andClaude Opus 5.5 committed
commit
bd6b8778e4
122 files changed
+29217
No files matched your search
@@ -0,0 +1,408 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"syscall"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
"jarl/internal/config"
|
||||
"jarl/internal/engine"
|
||||
"jarl/internal/render"
|
||||
"jarl/internal/validate"
|
||||
"jarl/internal/version"
|
||||
)
|
||||
|
||||
// dirOwner restores file ownership after commands run as root.
|
||||
type dirOwner struct {
|
||||
uid, gid int
|
||||
active bool
|
||||
}
|
||||
|
||||
func newDirOwner(dir string) *dirOwner {
|
||||
o := &dirOwner{}
|
||||
if os.Geteuid() != 0 {
|
||||
return o
|
||||
}
|
||||
fi, err := os.Stat(dir)
|
||||
if err != nil {
|
||||
return o
|
||||
}
|
||||
if st, ok := fi.Sys().(*syscall.Stat_t); ok && st.Uid != 0 {
|
||||
o.uid, o.gid, o.active = int(st.Uid), int(st.Gid), true
|
||||
}
|
||||
return o
|
||||
}
|
||||
|
||||
// fix gives root-owned files under dirs to the daemon's user (keeping
|
||||
// their group, which matters for named).
|
||||
func (o *dirOwner) fix(dirs ...string) {
|
||||
if !o.active {
|
||||
return
|
||||
}
|
||||
for _, d := range dirs {
|
||||
filepath.WalkDir(d, func(path string, de fs.DirEntry, err error) error {
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
info, err := de.Info()
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
if st, ok := info.Sys().(*syscall.Stat_t); ok && st.Uid == 0 {
|
||||
gid := int(st.Gid)
|
||||
if path == d || strings.HasSuffix(path, ".db") || strings.Contains(path, ".db-") {
|
||||
gid = o.gid
|
||||
}
|
||||
os.Lchown(path, o.uid, gid)
|
||||
}
|
||||
return nil
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func printJSON(v any) {
|
||||
enc := json.NewEncoder(os.Stdout)
|
||||
enc.SetIndent("", " ")
|
||||
enc.Encode(v)
|
||||
}
|
||||
|
||||
func printProblems(ps []validate.Problem) {
|
||||
for _, p := range ps {
|
||||
fmt.Println(" " + p.String())
|
||||
}
|
||||
}
|
||||
|
||||
func printResult(res *engine.Result) {
|
||||
if res == nil {
|
||||
return
|
||||
}
|
||||
if len(res.Problems) > 0 {
|
||||
fmt.Println("Problems:")
|
||||
printProblems(res.Problems)
|
||||
}
|
||||
for _, m := range res.Check {
|
||||
if m.Error {
|
||||
obj := ""
|
||||
if m.Object != "" {
|
||||
obj = " [" + m.Object + "]"
|
||||
}
|
||||
fmt.Printf(" named-checkconf: %s%s\n", m.Text, obj)
|
||||
}
|
||||
}
|
||||
for _, w := range res.Warnings {
|
||||
fmt.Println("warning:", w)
|
||||
}
|
||||
for _, d := range res.Drift {
|
||||
fmt.Printf("drift: %s (%s)\n", d.Path, d.Reason)
|
||||
}
|
||||
}
|
||||
|
||||
func importCmd() *cobra.Command {
|
||||
var from string
|
||||
var dryRun, asJSON bool
|
||||
cmd := &cobra.Command{
|
||||
Use: "import",
|
||||
Short: "Import the existing BIND configuration into Jarl",
|
||||
Long: `Reads named.conf (following includes) and all primary zone files into
|
||||
Jarl. Key files used by rndc (rndc.key) stay as include statements.
|
||||
|
||||
If the imported configuration is valid it is applied right away: Jarl
|
||||
writes its own files (bind.config_dir, bind.zone_dir), but named keeps
|
||||
running on the old configuration until you run 'jarld adopt'. If there
|
||||
are problems, the import is kept as an open changeset that you can fix in
|
||||
the web UI or with the CLI.`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
a, err := openApp(true)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer a.close()
|
||||
ctx := context.Background()
|
||||
if from == "" {
|
||||
from = a.cfg.BIND.MainConfig
|
||||
}
|
||||
p, err := a.localPrincipal(ctx, "")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
res, err := a.eng.Import(ctx, from, p, dryRun)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if asJSON {
|
||||
printJSON(res)
|
||||
return nil
|
||||
}
|
||||
rep := res.Report
|
||||
fmt.Printf("Read %s:\n", from)
|
||||
fmt.Printf(" %d views, %d zones, %d records, %d ACLs, %d TSIG keys, %d options\n",
|
||||
rep.Counts["views"], rep.Counts["zones"], rep.Counts["records"], rep.Counts["acls"], rep.Counts["tsig_keys"], rep.Counts["options"])
|
||||
for _, z := range rep.Zones {
|
||||
view := ""
|
||||
if z.View != "" {
|
||||
view = " [view " + z.View + "]"
|
||||
}
|
||||
extra := ""
|
||||
if z.Skipped > 0 {
|
||||
extra = fmt.Sprintf(", %d skipped", z.Skipped)
|
||||
}
|
||||
fmt.Printf(" zone %-35s %-10s %4d records%s\n", z.Name+view, z.Type, z.Records, extra)
|
||||
}
|
||||
for _, k := range rep.Kept {
|
||||
fmt.Printf(" kept as include: %s\n", k)
|
||||
}
|
||||
for _, w := range rep.Warnings {
|
||||
fmt.Println("warning:", w)
|
||||
}
|
||||
if len(rep.Skipped) > 0 {
|
||||
fmt.Println("Not imported:")
|
||||
for _, s := range rep.Skipped {
|
||||
fmt.Println(" " + s)
|
||||
}
|
||||
}
|
||||
if dryRun {
|
||||
fmt.Printf("\nDry run: %d operations would be applied; nothing was changed.\n", len(res.Changeset.Ops))
|
||||
return nil
|
||||
}
|
||||
if !res.Applied {
|
||||
fmt.Printf("\nThe import is saved as changeset #%d but was NOT applied:\n", res.Changeset.ID)
|
||||
if res.Result != nil && res.Result.Error != nil {
|
||||
fmt.Println(" " + res.Result.Error.Message)
|
||||
}
|
||||
printResult(res.Result)
|
||||
fmt.Println("\nFix the problems (web UI: Changes, or 'jarl changeset show " + fmt.Sprint(res.Changeset.ID) + "'), apply the changeset, then run 'jarld adopt'.")
|
||||
return nil
|
||||
}
|
||||
printResult(res.Result)
|
||||
fmt.Printf("\nImported and applied as changeset #%d. Jarl's files are in %s and %s.\n", res.Result.ChangesetID, a.cfg.BIND.ConfigDir, a.cfg.BIND.ZoneDir)
|
||||
fmt.Println("named still uses the old configuration. Review Jarl's files, then switch named over with:")
|
||||
fmt.Println("\n sudo jarld adopt")
|
||||
return nil
|
||||
},
|
||||
}
|
||||
cmd.Flags().StringVar(&from, "from", "", "named.conf to import (default: bind.main_config)")
|
||||
cmd.Flags().BoolVar(&dryRun, "dry-run", false, "only show what would be imported")
|
||||
cmd.Flags().BoolVar(&asJSON, "json", false, "print the result as JSON")
|
||||
return cmd
|
||||
}
|
||||
|
||||
func adoptCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "adopt",
|
||||
Short: "Switch named over to Jarl's configuration (run as root)",
|
||||
Long: `Makes named load Jarl's configuration:
|
||||
|
||||
1. bumps the serial of every primary zone,
|
||||
2. saves bind.main_config (e.g. /etc/bind/named.conf) as
|
||||
named.conf.pre-jarl-<date> and replaces it with a single include of
|
||||
Jarl's named.conf,
|
||||
3. runs named-checkconf, rndc reconfig and reloads every zone,
|
||||
4. checks that named serves every zone from Jarl's files.
|
||||
|
||||
If anything fails the previous named.conf is restored. Writing
|
||||
named.conf needs root.`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
a, err := openApp(true)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer a.close()
|
||||
ctx := context.Background()
|
||||
p, err := a.localPrincipal(ctx, "")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
res, err := a.eng.Adopt(ctx, p)
|
||||
if err != nil {
|
||||
if ee, ok := engine.AsError(err); ok && len(ee.Problems) > 0 {
|
||||
fmt.Println("Problems:")
|
||||
printProblems(ee.Problems)
|
||||
}
|
||||
return err
|
||||
}
|
||||
if res.Already {
|
||||
fmt.Printf("named already loads Jarl's configuration (%s includes %s).\n", res.MainConfig, filepath.Join(a.cfg.BIND.ConfigDir, "named.conf"))
|
||||
return nil
|
||||
}
|
||||
fmt.Printf("named now loads Jarl's configuration.\n %s includes %s\n previous configuration saved as %s\n", res.MainConfig, filepath.Join(a.cfg.BIND.ConfigDir, "named.conf"), res.Backup)
|
||||
for _, s := range res.Serials {
|
||||
fmt.Printf(" zone %s serial %d -> %d\n", strings.TrimSuffix(s.Zone, "."), s.Old, s.New)
|
||||
}
|
||||
fmt.Println("\nFrom now on, change DNS only through Jarl. To go back: restore the saved file and run 'rndc reconfig'.")
|
||||
return nil
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func checkCmd() *cobra.Command {
|
||||
var asJSON bool
|
||||
cmd := &cobra.Command{
|
||||
Use: "check",
|
||||
Short: "Validate the current configuration and run named-checkconf on it",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
a, err := openApp(true)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer a.close()
|
||||
res, err := a.eng.CheckCurrent(context.Background())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if asJSON {
|
||||
printJSON(res)
|
||||
} else {
|
||||
printResult(res)
|
||||
if res.Diff != "" {
|
||||
fmt.Println("Files on disk differ from the configuration; 'jarld resync' rewrites them:")
|
||||
fmt.Print(res.Diff)
|
||||
}
|
||||
}
|
||||
if !res.Valid {
|
||||
return fmt.Errorf("the configuration has errors")
|
||||
}
|
||||
if !asJSON {
|
||||
fmt.Println("OK: the configuration is valid and named-checkconf accepts it.")
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
cmd.Flags().BoolVar(&asJSON, "json", false, "print the result as JSON")
|
||||
return cmd
|
||||
}
|
||||
|
||||
func renderCmd() *cobra.Command {
|
||||
var out string
|
||||
cmd := &cobra.Command{
|
||||
Use: "render",
|
||||
Short: "Write the generated configuration to a directory (for inspection)",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
if out == "" {
|
||||
return fmt.Errorf("--out is required")
|
||||
}
|
||||
a, err := openApp(true)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer a.store.Close()
|
||||
st, err := a.store.LoadState(context.Background())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
paths := render.Paths{ConfigDir: filepath.Join(out, "config"), ZoneDir: filepath.Join(out, "zones"), CacheDir: filepath.Join(out, "cache")}
|
||||
o := render.Render(st, paths)
|
||||
for _, f := range o.Files {
|
||||
if err := os.MkdirAll(filepath.Dir(f.Path), 0o750); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.WriteFile(f.Path, f.Content, 0o640); err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Println(f.Path)
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
cmd.Flags().StringVarP(&out, "out", "o", "", "output directory")
|
||||
return cmd
|
||||
}
|
||||
|
||||
func resyncCmd() *cobra.Command {
|
||||
var force, dryRun bool
|
||||
cmd := &cobra.Command{
|
||||
Use: "resync",
|
||||
Short: "Rewrite all generated files from the database and reload named",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
a, err := openApp(true)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer a.close()
|
||||
ctx := context.Background()
|
||||
p, err := a.localPrincipal(ctx, "")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
res, err := a.eng.Resync(ctx, p, engine.ApplyOptions{Force: force, DryRun: dryRun})
|
||||
printResult(res)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if res.Diff != "" {
|
||||
fmt.Print(res.Diff)
|
||||
}
|
||||
if dryRun {
|
||||
fmt.Printf("Dry run: %d files would be written.\n", len(res.Files))
|
||||
} else {
|
||||
fmt.Printf("%d files written; named reloaded: %v\n", len(res.Files), res.Reloaded)
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
cmd.Flags().BoolVar(&force, "force", false, "overwrite files changed outside Jarl")
|
||||
cmd.Flags().BoolVar(&dryRun, "dry-run", false, "only show what would change")
|
||||
return cmd
|
||||
}
|
||||
|
||||
func backupCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "backup FILE",
|
||||
Short: "Write a consistent copy of the database to FILE (safe while jarld runs)",
|
||||
Args: cobra.ExactArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
a, err := openApp(true)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer a.close()
|
||||
if _, err := os.Stat(args[0]); err == nil {
|
||||
return fmt.Errorf("%s already exists", args[0])
|
||||
}
|
||||
if err := a.store.Backup(context.Background(), args[0]); err != nil {
|
||||
return err
|
||||
}
|
||||
os.Chmod(args[0], 0o600)
|
||||
fmt.Println("Database copied to", args[0])
|
||||
return nil
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func configCmd() *cobra.Command {
|
||||
var example bool
|
||||
cmd := &cobra.Command{
|
||||
Use: "config",
|
||||
Short: "Show the effective configuration (or an example file)",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
if example {
|
||||
fmt.Print(config.Example)
|
||||
return nil
|
||||
}
|
||||
cfg, err := config.Load(configPath, true)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
printJSON(cfg)
|
||||
return nil
|
||||
},
|
||||
}
|
||||
cmd.Flags().BoolVar(&example, "example", false, "print a commented example configuration file")
|
||||
return cmd
|
||||
}
|
||||
|
||||
func versionCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "version",
|
||||
Short: "Print the version",
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
fmt.Println("jarld", version.Version)
|
||||
},
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user