Jarl 0.1.0: manage BIND through a web UI, REST API and CLI

Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG
keys, zones of every type, records, named.conf options) in SQLite and
renders named.conf, keys.conf and zone files from it.

Every change goes through one changeset pipeline: whole-configuration
validation, named-checkconf -z and named-checkzone in a staging
directory, atomic install, rndc reconfig/reload, serial verification
with rndc zonestatus, and rollback if named does not load the change.
Changes apply one at a time by default or are bundled and applied
together. Applied changesets can be reverted.

- jarld: the daemon with the REST API and an embedded web UI, plus import,
  adopt, check, resync, backup and local user recovery commands
- jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh
- users with argon2id passwords and CSRF-protected sessions; hashed API
  tokens with granular grants and roles; an audit log
- systemd unit, sysusers.d/tmpfiles.d files, Makefile
- unit tests, integration tests against a real named, scripts/e2e.sh
- docs/ guides, README and CHANGELOG

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/jarl.service

@@ -0,0 +1,60 @@
+# Jarl daemon: web UI and REST API for managing BIND.
+# Installed as /etc/systemd/system/jarl.service (see docs/install.md).
+[Unit]
+Description=Jarl BIND manager (web UI and API)
+Documentation=file:///usr/local/share/doc/jarl/README.md
+After=network-online.target named.service
+Wants=network-online.target
+
+[Service]
+Type=notify
+NotifyAccess=main
+ExecStart=/usr/local/bin/jarld --config /etc/jarl/jarl.yaml serve
+# SIGHUP rereads the TLS certificate.
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=5s
+
+User=jarl
+Group=jarl
+# Membership of 'bind' lets jarld read /etc/bind/rndc.key and the rest of
+# named's configuration (for rndc and named-checkconf) and give generated
+# files to group bind so named can read them.
+SupplementaryGroups=bind
+UMask=0027
+
+# /var/lib/jarl: database and staging area.
+StateDirectory=jarl
+StateDirectoryMode=0750
+ConfigurationDirectory=jarl
+ConfigurationDirectoryMode=0750
+
+# Sandboxing. jarld may only write its own state and the directories it
+# manages for named (created by tmpfiles.d/jarl.conf).
+ProtectSystem=strict
+ReadWritePaths=/etc/bind/jarl /var/lib/bind/jarl /var/cache/bind/jarl
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+# @system-service includes @chown, which jarld needs to give files to group bind.
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target

deploy/sysusers.d/jarl.conf

@@ -0,0 +1,4 @@
+# Jarl's system user (installed as /usr/lib/sysusers.d/jarl.conf).
+# It joins group 'bind' to read named's configuration and rndc.key.
+u jarl - "Jarl BIND manager" /var/lib/jarl
+m jarl bind

deploy/tmpfiles.d/jarl.conf

@@ -0,0 +1,12 @@
+# Directories Jarl needs (installed as /usr/lib/tmpfiles.d/jarl.conf).
+# Apply with: systemd-tmpfiles --create jarl.conf
+#
+# Type Path                  Mode  User Group
+d      /etc/jarl             0750  root jarl
+d      /var/lib/jarl         0750  jarl jarl
+# Generated named configuration: named reads it (AppArmor allows /etc/bind).
+d      /etc/bind/jarl        2750  jarl bind
+# Primary zone files: named may write journals here (/var/lib/bind is writable for named).
+d      /var/lib/bind/jarl    2770  jarl bind
+# Files named writes for secondary, stub and mirror zones.
+d      /var/cache/bind/jarl  2770  jarl bind