Jarl 0.1.0: manage BIND through a web UI, REST API and CLI

Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG
keys, zones of every type, records, named.conf options) in SQLite and
renders named.conf, keys.conf and zone files from it.

Every change goes through one changeset pipeline: whole-configuration
validation, named-checkconf -z and named-checkzone in a staging
directory, atomic install, rndc reconfig/reload, serial verification
with rndc zonestatus, and rollback if named does not load the change.
Changes apply one at a time by default or are bundled and applied
together. Applied changesets can be reverted.

- jarld: the daemon with the REST API and an embedded web UI, plus import,
  adopt, check, resync, backup and local user recovery commands
- jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh
- users with argon2id passwords and CSRF-protected sessions; hashed API
  tokens with granular grants and roles; an audit log
- systemd unit, sysusers.d/tmpfiles.d files, Makefile
- unit tests, integration tests against a real named, scripts/e2e.sh
- docs/ guides, README and CHANGELOG

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/serial.go

@@ -0,0 +1,75 @@
+package engine
+
+import (
+	"time"
+
+	"jarl/internal/model"
+	"jarl/internal/render"
+)
+
+// serialGreater reports whether a > b in RFC 1982 serial number
+// arithmetic.
+func serialGreater(a, b uint32) bool { return int32(a-b) > 0 }
+
+// NextSerial returns the serial after old under policy, with the same
+// semantics as BIND's serial-update-method.
+func NextSerial(old uint32, policy string, now time.Time) uint32 {
+	switch policy {
+	case model.SerialUnixtime:
+		t := uint32(now.Unix())
+		if serialGreater(t, old) {
+			return t
+		}
+		return old + 1
+	case model.SerialIncrement:
+		return old + 1
+	default: // date: YYYYMMDDnn
+		d := dateSerial(now)
+		if serialGreater(d, old) {
+			return d
+		}
+		return old + 1
+	}
+}
+
+// SerialChange records a serial bump.
+type SerialChange struct {
+	ZoneID int64  `json:"zone_id"`
+	Zone   string `json:"zone"`
+	View   string `json:"view,omitempty"`
+	Old    uint32 `json:"old"`
+	New    uint32 `json:"new"`
+}
+
+// bumpSerials increments the serial of every primary zone in work whose
+// DNS data differs from base, unless the serial was set explicitly.
+func bumpSerials(base, work *model.State, now time.Time, user string) []SerialChange {
+	var out []SerialChange
+	for _, z := range work.SortedZones() {
+		if z.Type != model.ZonePrimary {
+			continue
+		}
+		policy := z.SerialPolicy
+		if policy == "" {
+			policy = work.Settings.SerialPolicy
+		}
+		old := base.Zones[z.ID]
+		if old == nil || old.Type != model.ZonePrimary || old.ViewID != z.ViewID {
+			// New to named (or moved): keep the serial it was created
+			// with, which InitialSerial or the source zone provided.
+			continue
+		}
+		if z.SOA.Serial != old.SOA.Serial {
+			// Set explicitly by the user.
+			continue
+		}
+		if render.ZoneContentHash(base, old) == render.ZoneContentHash(work, z) {
+			continue
+		}
+		next := NextSerial(old.SOA.Serial, policy, now)
+		out = append(out, SerialChange{ZoneID: z.ID, Zone: z.Name, View: work.ViewName(z), Old: old.SOA.Serial, New: next})
+		z.SOA.Serial = next
+		z.Touch(user, now)
+	}
+	return out
+}