The dashboard counted every open changeset, including empty ones and
other users', so "Pending changes (1 open)" led to an empty Changes page.
It now counts the user's own changesets that contain changes, the status
API's open_changesets skips empty ones, and in review mode a draft created
for an edit the server rejects is discarded instead of left open.
docs/concepts.md: zone types, a new zone's name servers and glue, reverse
zones for any network, and dynamic updates versus API tokens and TSIG keys.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- CLI: name several servers and groups in the config file; select them
with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at
several servers is dry-run on all of them first and only runs if every
one accepts it. Named servers always use their own token.
- Reverse zones: /32 and /128 get single-address zones; networks between
octet or nibble boundaries (e.g. a /22) are covered by several zones
created together, from the CLI and the web UI.
- Fix: under jarl.service's RestrictSUIDSGID, creating a view directory
failed on chmod with the setgid bit; fall back to the permission bits.
- Web UI: the review/live switch is a small header button, and the
pending-changes bar only shows when there are pending changes.
- TSIG key wording; the keys page points to restricted API tokens.
- Docs: several servers (cli.md), a secondary server (operations.md),
tokens vs TSIG keys (permissions.md); CHANGELOG.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- New zone dialog: choose Domain or Reverse zone. Reverse zones are
created from a network and their name is generated; both kinds show the
exact zone name and flag likely mistakes (addresses or URLs as names,
host-like names, duplicates in the view, parent/child zones, networks
off the octet/nibble boundaries) before anything is submitted.
- Record form: clears every field but the type after an add; shows the
record exactly as it will be stored and warns about unqualified names.
In reverse zones it takes an address, defaults to PTR, suggests host
names of A/AAAA records with that address and warns about a second PTR;
the record list shows addresses.
- Address match lists (options, view match lists, ACL elements) offer the
existing ACLs, TSIG keys and built-ins as one-click suggestions and
flag unknown names.
- Server: in reverse zones a record can be named by its address, and a
PTR target like nas.example.com without the final dot is read as the
full host name (a bare label is refused). Warnings noticed while parsing
record data reach the result again.
- Fixes: brand link hover underline, the dashboard's "New zone" link
opening the dialog twice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- jarl zone list showed only primary zones. zone create binds its --type
flag (default "primary") to the same variable as list's --type, so the
default leaked into the list filter and hid hint, secondary and forward
zones. list now has its own variable. TestListQueries runs list
commands against a fake server and checks the filters they send.
- named-checkconf/named-checkzone messages are classified by the tool's
exit code: on success, everything printed is a warning. Warnings such
as 'both "recursion no;" and "allow-recursion" active' were shown as
errors. The CLI, jarld check and the web UI now label them as warnings
and skip the routine "loaded serial" lines.
- The zone_outside_view error points at --adopt-zones.
- docs/views.md: step-by-step split DNS for a server that has no views
yet, tested on a copy of a stock Ubuntu 26.04 setup. Linked from the
README, concepts and validation docs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG
keys, zones of every type, records, named.conf options) in SQLite and
renders named.conf, keys.conf and zone files from it.
Every change goes through one changeset pipeline: whole-configuration
validation, named-checkconf -z and named-checkzone in a staging
directory, atomic install, rndc reconfig/reload, serial verification
with rndc zonestatus, and rollback if named does not load the change.
Changes apply one at a time by default or are bundled and applied
together. Applied changesets can be reverted.
- jarld: the daemon with the REST API and an embedded web UI, plus import,
adopt, check, resync, backup and local user recovery commands
- jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh
- users with argon2id passwords and CSRF-protected sessions; hashed API
tokens with granular grants and roles; an audit log
- systemd unit, sysusers.d/tmpfiles.d files, Makefile
- unit tests, integration tests against a real named, scripts/e2e.sh
- docs/ guides, README and CHANGELOG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
abrown38andClaude Opus 5.5