The version moves from the header to a "Powered by Jarl" footer. A build
of a release tag (HEAD tagged v<VERSION>, no tracked changes; the release
workflow sets RELEASE_TAG) shows and links the release; any other build
shows and links its commit, marked -modified with uncommitted changes.
jarld version, jarl --version, /status and /auth/whoami report the same.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
make deb now builds two packages: jarl-cli (the CLI, its completion and
the ACME hooks, no scripts) and jarl (the server), which depends on
jarl-cli of the same version.
Pushing a v* tag runs .gitea/workflows/release.yml: it tests, builds the
tarballs, the CLI for Linux, macOS and Windows (make cli-dist) and the
.debs for amd64 and arm64, then scripts/gitea-release.sh creates the
Gitea release and uploads the .debs to the Debian package registry, so
servers install and upgrade with apt. The stats package's inode lookup
is split by OS so the CLI builds for Windows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Daily database backups: jarl-backup.timer runs 'jarld backup', which
writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
and prunes by the time in the name while always keeping the newest
keep_at_least. New backup: section in jarl.yaml; the dashboard and
'jarl status' show the newest backup and warn when it is stale or
failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
the current database, keeps the current one aside and records the
restore. 'jarld serve' holds a database lock, so a restore can't run
under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
daily log line, and a CLI warning via the Jarl-Token-Expires header;
'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
serial on a primary zone's secondaries (NS records, also-notify) or a
secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LICENSE is installed with the docs, included in make dist, and becomes
the Debian package's copyright file together with the bundled Cinzel
font's OFL.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
make deb builds dist/jarl_<version>_<arch>.deb with dpkg-deb alone (no
root), for the host or another architecture (DEB_ARCH=arm64). The package
creates the jarl user and directories and an example jarl.yaml on the
first install, restarts a running jarld on upgrades, never touches
/etc/jarl/jarl.yaml, stops jarld on removal, and keeps Jarl's data even
on purge.
make install and the package install bash completion for jarl and jarld.
Besides commands and flags it completes server and group names from the
CLI configuration, zone, view, ACL, TSIG key and user names from the
server, and record types. make dist includes the completion scripts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
contrib/lego/jarl-lego.sh turns lego's "present|cleanup FQDN VALUE" calls
into jarl acme set|unset --exact, so lego (and CNAME delegation to a
dedicated ACME zone) works with Jarl. docs/acme.md explains the setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG
keys, zones of every type, records, named.conf options) in SQLite and
renders named.conf, keys.conf and zone files from it.
Every change goes through one changeset pipeline: whole-configuration
validation, named-checkconf -z and named-checkzone in a staging
directory, atomic install, rndc reconfig/reload, serial verification
with rndc zonestatus, and rollback if named does not load the change.
Changes apply one at a time by default or are bundled and applied
together. Applied changesets can be reverted.
- jarld: the daemon with the REST API and an embedded web UI, plus import,
adopt, check, resync, backup and local user recovery commands
- jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh
- users with argon2id passwords and CSRF-protected sessions; hashed API
tokens with granular grants and roles; an audit log
- systemd unit, sysusers.d/tmpfiles.d files, Makefile
- unit tests, integration tests against a real named, scripts/e2e.sh
- docs/ guides, README and CHANGELOG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
abrown38andClaude Opus 5.5