Encrypted DNS: several host names, views per listen address, what named uses a certificate for

The setup takes several host names (one certificate for all; the health check says when the served certificate misses one), stored in the settings. Each listen address gets its own views for the host names' A/AAAA records (--address ADDR=VIEW,..., a view checkbox per address in the form), always local to the view, with a warning when a public view would get a private address; a view no longer given loses the address, other records of the names stay, and the form starts from where the records are now. Certificates (page and jarl cert show) say what named uses each for: DNS over TLS or HTTPS, on which addresses and ports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_certs.go

@@ -9,6 +9,7 @@ import (
 	"jarl/internal/api"
 	"jarl/internal/auth"
 	"jarl/internal/certs"
+	"jarl/internal/encdns"
 	"jarl/internal/model"
 )
 
@@ -21,6 +22,9 @@ type certView struct {
 	NextTry *time.Time   `json:"next_attempt,omitempty"` // acme: when the loop obtains it next
 	Files   *certFiles   `json:"files,omitempty"`        // dns use: where named reads it
 	Serving bool         `json:"serving,omitempty"`      // jarld serves it now (web use)
+	// NamedUse says what of named's configuration uses it: "DNS over TLS
+	// on 10.0.10.5 port 853" (list and get only).
+	NamedUse []string `json:"named_use,omitempty"`
 	// IssuingSince is set while Jarl is obtaining it.
 	IssuingSince *time.Time `json:"issuing_since,omitempty"`
 }
@@ -79,9 +83,15 @@ func (s *Server) certList(w http.ResponseWriter, r *http.Request, p *auth.Princi
 	if err != nil {
 		return err
 	}
+	st, err := s.store.LoadState(r.Context())
+	if err != nil {
+		return err
+	}
 	out := []certView{}
 	for _, c := range all {
-		out = append(out, s.presentCert(c))
+		v := s.presentCert(c)
+		v.NamedUse = encdns.CertUses(st, s.cfg.Certs.FilesDir(c.Name))
+		out = append(out, v)
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"certificates": out, "account": s.cfg.Certs.AccountInfo(r.Context())})
 	return nil
@@ -96,7 +106,13 @@ func (s *Server) certGet(w http.ResponseWriter, r *http.Request, p *auth.Princip
 	if err != nil {
 		return certErr(err)
 	}
-	writeJSON(w, http.StatusOK, s.presentCert(c))
+	st, err := s.store.LoadState(r.Context())
+	if err != nil {
+		return err
+	}
+	v := s.presentCert(c)
+	v.NamedUse = encdns.CertUses(st, s.cfg.Certs.FilesDir(c.Name))
+	writeJSON(w, http.StatusOK, v)
 	return nil
 }