Jarl 0.1.0: manage BIND through a web UI, REST API and CLI

Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG
keys, zones of every type, records, named.conf options) in SQLite and
renders named.conf, keys.conf and zone files from it.

Every change goes through one changeset pipeline: whole-configuration
validation, named-checkconf -z and named-checkzone in a staging
directory, atomic install, rndc reconfig/reload, serial verification
with rndc zonestatus, and rollback if named does not load the change.
Changes apply one at a time by default or are bundled and applied
together. Applied changesets can be reverted.

- jarld: the daemon with the REST API and an embedded web UI, plus import,
  adopt, check, resync, backup and local user recovery commands
- jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh
- users with argon2id passwords and CSRF-protected sessions; hashed API
  tokens with granular grants and roles; an audit log
- systemd unit, sysusers.d/tmpfiles.d files, Makefile
- unit tests, integration tests against a real named, scripts/e2e.sh
- docs/ guides, README and CHANGELOG

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/importer/testdata/debian/db.192.168.1

@@ -0,0 +1,7 @@
+$TTL 86400
+$ORIGIN 1.168.192.in-addr.arpa.
+@	IN	SOA	ns1.adbraun.lol. admin.adbraun.lol. ( 2024051201 3600 900 1209600 300 )
+@	IN	NS	ns1.adbraun.lol.
+2	IN	PTR	ns1.adbraun.lol.
+20	IN	PTR	nas.adbraun.lol.
+$GENERATE 100-102 $ IN PTR dhcp-$.adbraun.lol.

internal/importer/testdata/debian/db.adbraun.lol

@@ -0,0 +1,17 @@
+$TTL 3600
+@	IN	SOA	ns1.adbraun.lol. admin.adbraun.lol. (
+			2024051201	; serial
+			3600		; refresh
+			900		; retry
+			1209600		; expire
+			300 )		; negative cache TTL
+	IN	NS	ns1
+	IN	MX	10 mail
+@	IN	TXT	"v=spf1 mx -all"
+ns1	IN	A	192.168.1.2	; the DNS server itself
+mail	IN	A	192.168.1.25
+www	300	IN	A	192.168.1.10
+www	300	IN	A	192.168.1.11
+nas	IN	A	192.168.1.20	; synology
+media	IN	CNAME	nas
+_acme-challenge	60	IN	TXT	"old-token"

internal/importer/testdata/debian/named.conf

@@ -0,0 +1,7 @@
+// This is the primary configuration file for the BIND DNS server named.
+include "@DIR@/named.conf.options";
+include "@DIR@/named.conf.local";
+include "@DIR@/rndc.key";
+controls {
+	inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; };
+};

internal/importer/testdata/debian/named.conf.local

@@ -0,0 +1,14 @@
+zone "adbraun.lol" {
+	type master;
+	file "@DIR@/db.adbraun.lol";
+	allow-transfer { key xfer-key; };
+};
+zone "1.168.192.in-addr.arpa" {
+	type master;
+	file "@DIR@/db.192.168.1";
+};
+zone "consul" {
+	type forward;
+	forward only;
+	forwarders { 127.0.0.1 port 8600; };
+};

internal/importer/testdata/debian/named.conf.options

@@ -0,0 +1,22 @@
+acl "homelab" {
+	192.168.1.0/24;
+	10.10.0.0/16;
+	localhost;
+};
+key "xfer-key" {
+	algorithm hmac-sha256;
+	secret "Y2hhbmdlLW1lLWNoYW5nZS1tZS1jaGFuZ2UtbWUtMTIzNA==";
+};
+options {
+	directory "/var/cache/bind";
+	recursion yes;
+	allow-recursion { homelab; };
+	allow-query { any; };
+	forwarders { 1.1.1.1; 9.9.9.9; };
+	dnssec-validation auto;
+	listen-on-v6 { any; };
+};
+logging {
+	channel default_log { file "/var/log/named/default.log" versions 3 size 5m; severity info; print-time yes; };
+	category default { default_log; };
+};

internal/importer/testdata/debian/rndc.key

@@ -0,0 +1,4 @@
+key "rndc-key" {
+	algorithm hmac-sha256;
+	secret "cm5kYy1zZWNyZXQtcm5kYy1zZWNyZXQtcm5kYy1zZWNyZXQ=";
+};