4 Commits

Include renames

Author	SHA1	Message	Date
adamandClaude Opus 5.5	bb6b4ab64d	Stream the delegation check's queries too ... Every DNS query the name server checks send is now reported from exchangeHostPort as a dig command line with a short answer (addresses, referral, DS, NXDOMAIN) and its round-trip time; the serials check's SOA queries keep their own events with the server's result. The delegation check streams with ?stream=1 like /serials, and the Name servers tab shows its queries as they happen, keeps its result and follows a running check when you come back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 16:00:39 +00:00
adamandClaude Opus 5.5	020223d1a5	Show the Name servers check as it happens, and keep its results ... The zone's Name servers tab no longer waits for the other servers before showing: it lists each query as a dig command line with a waiting counter, fills in the answers as they arrive, then shows the result with the queries under "Queries sent". Results (serials and delegation) are kept for 10 minutes so revisiting the tab is instant; "Check again" asks anew, and a check keeps running when the tab is left. GET /zones/{zone}/serials?stream=1 streams the queries as newline-delimited JSON (nscheck.Checker.Watch); without it the endpoint is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 15:49:11 +00:00
abrown38andClaude Opus 5.5	5630e7a848	Add DNSSEC signing, key backups and Porkbun support ... Zones get a DNSSEC setting: named signs them with BIND's default (or a custom) dnssec-policy and inline signing, with keys in a per-view key directory. Jarl shows the keys, the DS record and when it is safe to publish it, checks the parent's DS records (check-ds, which also tells named), and refuses steps that would break a signed domain: switching straight to unsigned, finishing a turn-off too early, deleting or moving a signed zone, TTLs above max-zone-ttl. Turning off goes through the insecure policy; wipe starts over once the parent has no DS. Backups store the DNSSEC keys and restore puts them back for named; the backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's serial above named's whenever it writes an older one (after a restore). The serials check compares the signed serial. With a Porkbun API key in jarl.yaml, the registrar's name servers, glue records and DS records can be shown and changed, each change checked first (dry run, force to override). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 21:19:04 +00:00
abrown38andClaude Opus 5.5	293e6ddd33	Add backups, token expiry warnings and name server checks ... - Daily database backups: jarl-backup.timer runs 'jarld backup', which writes jarl-<UTC time>.db into backup.dir, checks it before naming it, and prunes by the time in the name while always keeping the newest keep_at_least. New backup: section in jarl.yaml; the dashboard and 'jarl status' show the newest backup and warn when it is stale or failed. The Debian package enables the timer. - 'jarld restore [FILE | latest]': checks the backup, shows it next to the current database, keeps the current one aside and records the restore. 'jarld serve' holds a database lock, so a restore can't run under a live jarld and two jarlds can't share a database. - Token expiry warnings from 14 days ahead: dashboard, token lists, a daily log line, and a CLI warning via the Jarl-Token-Expires header; 'jarl token list --expiring'. - 'jarl zone serials' and the zone page's Name servers tab: compare the serial on a primary zone's secondaries (NS records, also-notify) or a secondary zone's primaries with this server's. - 'jarl zone delegation': for zones on the internet, check the parent's delegation and glue against the zone; an undelegated zone gets a note. - Server: Jarl/<version> header; CLI exit code 2 for failed checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 19:02:34 +00:00