The version moves from the header to a "Powered by Jarl" footer. A build
of a release tag (HEAD tagged v<VERSION>, no tracked changes; the release
workflow sets RELEASE_TAG) shows and links the release; any other build
shows and links its commit, marked -modified with uncommitted changes.
jarld version, jarl --version, /status and /auth/whoami report the same.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The view shown in the zone list and on the zone page now links to that
view. The zone page and changeset page get breadcrumbs, and the zone list
keeps its filters in the address so going back restores them. Views can
be given a colour (Views > Edit, `jarl view color`, PUT /views/{id}/color)
so zones of the same view are easy to spot; the colour is UI-only, kept
outside changesets, and needs no deploy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Users can set up an authenticator app from their account page; login
then asks for a code after the password, with one-time recovery codes
as a fallback. Sensitive actions (tokens, user changes, 2FA resets)
need a code from the last 5 minutes. totp.require (none/admins/all)
forces setup, and admins can reset a user's 2FA from the UI, the jarl
CLI or jarld on the server. The dashboard and jarl status flag users
missing 2FA and a shared "admin" account still in use.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jarld import warned that zones with allow-update { none; } use dynamic
updates, though that turns them off (validation already allowed it).
docs/cli.md now gives the CLI configuration file's location on macOS and
Windows, not only ~/.config/jarl/config.yaml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On a fresh Debian/Ubuntu machine it installs BIND and the build tools
(Go from go.dev), writes a hand-made style configuration with internal
and external views, a split-horizon zone (example.com or
JARL_TEST_ZONE) and a reverse zone, starts named and prints the steps
to install Jarl and adopt the configuration.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
make deb now builds two packages: jarl-cli (the CLI, its completion and
the ACME hooks, no scripts) and jarl (the server), which depends on
jarl-cli of the same version.
Pushing a v* tag runs .gitea/workflows/release.yml: it tests, builds the
tarballs, the CLI for Linux, macOS and Windows (make cli-dist) and the
.debs for amd64 and arm64, then scripts/gitea-release.sh creates the
Gitea release and uploads the .debs to the Debian package registry, so
servers install and upgrade with apt. The stats package's inode lookup
is split by OS so the CLI builds for Windows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.
Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.
With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Daily database backups: jarl-backup.timer runs 'jarld backup', which
writes jarl-<UTC time>.db into backup.dir, checks it before naming it,
and prunes by the time in the name while always keeping the newest
keep_at_least. New backup: section in jarl.yaml; the dashboard and
'jarl status' show the newest backup and warn when it is stale or
failed. The Debian package enables the timer.
- 'jarld restore [FILE | latest]': checks the backup, shows it next to
the current database, keeps the current one aside and records the
restore. 'jarld serve' holds a database lock, so a restore can't run
under a live jarld and two jarlds can't share a database.
- Token expiry warnings from 14 days ahead: dashboard, token lists, a
daily log line, and a CLI warning via the Jarl-Token-Expires header;
'jarl token list --expiring'.
- 'jarl zone serials' and the zone page's Name servers tab: compare the
serial on a primary zone's secondaries (NS records, also-notify) or a
secondary zone's primaries with this server's.
- 'jarl zone delegation': for zones on the internet, check the parent's
delegation and glue against the zone; an undelegated zone gets a note.
- Server: Jarl/<version> header; CLI exit code 2 for failed checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The header now shows the login page's wordmark letters (without the rule)
instead of "Jarl" set in Cinzel, so the bundled Cinzel font, its preload
and its licence stanza in the .deb's copyright file are removed: the web
UI needs no web font.
The README opens with the login page's banner, the logo above the
wordmark (artwork/banner.svg). scripts/banner.py builds it from the web
UI's logo.js and brand.js, with light and dark colors, and logo.py runs
it after tracing the logo.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The logo was an 880 KB SVG wrapping a 1254px PNG, downloaded again on
every page load. Keep that PNG as the master (artwork/logo.png) and have
scripts/logo.py trace it with potrace into a 6 KB logo.svg (favicon,
README) and logo.js, which brand.js draws inline in the header and on the
login page so the logo arrives with the page. Remove the unused
logo-white.svg.
Static files now carry content ETags, so reloads get 304s instead of
downloading the UI again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jarld also listens on /run/jarl/jarl.sock (socket in jarl.yaml). Requests
on it from root or jarld's own user need no token and act as an
administrator; the kernel's SO_PEERCRED says who is connecting, and
anyone else must send a token. The jarl CLI uses the socket when no server
is configured, or with -s local, so 'sudo jarl status' works on the server
with nothing set up and a lost token or password never locks root out.
Changes are audited under the system user's name via "socket".
The systemd unit creates /run/jarl (0750). Socket paths over 107 bytes
are refused with a clear message. The docs explain the socket and what
happens when a token is revoked.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
make deb builds dist/jarl_<version>_<arch>.deb with dpkg-deb alone (no
root), for the host or another architecture (DEB_ARCH=arm64). The package
creates the jarl user and directories and an example jarl.yaml on the
first install, restarts a running jarld on upgrades, never touches
/etc/jarl/jarl.yaml, stops jarld on removal, and keeps Jarl's data even
on purge.
make install and the package install bash completion for jarl and jarld.
Besides commands and flags it completes server and group names from the
CLI configuration, zone, view, ACL, TSIG key and user names from the
server, and record types. make dist includes the completion scripts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jarl token rotate, a Rotate button in the web UI and
POST /api/v1/tokens/{id}/rotate give a token a new secret while it keeps
its ID, name, user and grants. The old secret stops at once or after a
grace period of up to 7 days, during which jarld logs who still uses it.
A token that expires gets its lifetime again. --save writes the new
secret where the CLI got the old one (its configuration or --token @FILE),
--write FILE to any file, and --current picks the token the CLI runs
with, so a restricted token can renew itself. A restricted token can't
rotate a wider token of its user.
Also fixes token create --save for named servers, and future times
(token expiry) shown as "just now" in the web UI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jarld can now answer lego's httpreq DNS provider
(POST /api/v1/acme/httpreq/present and /cleanup), so lego and Traefik
publish DNS-01 challenges with only environment variables, without the
jarl CLI. lego's username and API token arrive as HTTP Basic auth,
accepted on these routes only.
The endpoint is off by default (acme.httpreq.enabled) and HTTPS-only by
default: jarld's own TLS, or a trusted proxy that says so with
X-Forwarded-Proto or Forwarded (the last value counts). Plain HTTP can be
allowed from loopback only or everywhere. GET /api/v1/acme/httpreq shows
how jarld sees a request, to check a proxy setup.
jarl acme and the endpoint share their code in internal/acme. Documented
in docs/acme.md, configuration.md, api.md and permissions.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
contrib/lego/jarl-lego.sh turns lego's "present|cleanup FQDN VALUE" calls
into jarl acme set|unset --exact, so lego (and CNAME delegation to a
dedicated ACME zone) works with Jarl. docs/acme.md explains the setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The dashboard counted every open changeset, including empty ones and
other users', so "Pending changes (1 open)" led to an empty Changes page.
It now counts the user's own changesets that contain changes, the status
API's open_changesets skips empty ones, and in review mode a draft created
for an edit the server rejects is discarded instead of left open.
docs/concepts.md: zone types, a new zone's name servers and glue, reverse
zones for any network, and dynamic updates versus API tokens and TSIG keys.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- CLI: name several servers and groups in the config file; select them
with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at
several servers is dry-run on all of them first and only runs if every
one accepts it. Named servers always use their own token.
- Reverse zones: /32 and /128 get single-address zones; networks between
octet or nibble boundaries (e.g. a /22) are covered by several zones
created together, from the CLI and the web UI.
- Fix: under jarl.service's RestrictSUIDSGID, creating a view directory
failed on chmod with the setgid bit; fall back to the permission bits.
- Web UI: the review/live switch is a small header button, and the
pending-changes bar only shows when there are pending changes.
- TSIG key wording; the keys page points to restricted API tokens.
- Docs: several servers (cli.md), a secondary server (operations.md),
tokens vs TSIG keys (permissions.md); CHANGELOG.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the logo, a Viking jarl drawn like a woodcut whose spear-pointed crown
holds a DNS tree. It is generated by scripts/logo.py, which mirrors the
left half so the figure is exactly symmetrical, as logo.svg (white on a
Nordic-blue disc) and logo-white.svg. It links home in the header, sits on
the login page and is the favicon.
The login page shows an angular "JARL" wordmark drawn as SVG paths over a
rule with a "DNS" node, coloured from the theme. The header's "Jarl" uses
a self-hosted Cinzel Bold subset (SIL OFL); jarld serves .woff2 as
font/woff2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- New zone dialog: choose Domain or Reverse zone. Reverse zones are
created from a network and their name is generated; both kinds show the
exact zone name and flag likely mistakes (addresses or URLs as names,
host-like names, duplicates in the view, parent/child zones, networks
off the octet/nibble boundaries) before anything is submitted.
- Record form: clears every field but the type after an add; shows the
record exactly as it will be stored and warns about unqualified names.
In reverse zones it takes an address, defaults to PTR, suggests host
names of A/AAAA records with that address and warns about a second PTR;
the record list shows addresses.
- Address match lists (options, view match lists, ACL elements) offer the
existing ACLs, TSIG keys and built-ins as one-click suggestions and
flag unknown names.
- Server: in reverse zones a record can be named by its address, and a
PTR target like nas.example.com without the final dot is read as the
full host name (a bare label is refused). Warnings noticed while parsing
record data reach the result again.
- Fixes: brand link hover underline, the dashboard's "New zone" link
opening the dialog twice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Off by default (stats in jarl.yaml). When enabled, Jarl adds a loopback
statistics channel and a response log to named's configuration (merged
into existing logging/statistics-channels statements) and switches
response logging with rndc responselog, because the responselog option
only counts when named starts. jarld polls named's counters every minute
and tails the response log (resuming after restarts and across
rotation). It stores aggregates, never individual queries, in a separate
SQLite database: per-minute, hourly and daily counters (queries, result
codes, record types, views, zones, cache hits, upstream latency, DNSSEC)
and hourly/daily top lists (names, clients, NXDOMAIN and SERVFAIL names,
refused clients), each with its own retention. Clients can be anonymized
or excluded.
- Web UI: Statistics page with KPI tiles, queries and failed answers over
time, a weekday x hour heatmap, top lists and breakdowns; SVG charts
with hover/keyboard readouts, a table view and light/dark palettes
validated for colour-vision deficiency.
- CLI: jarl stats status|summary|top|timeline|heatmap|breakdown.
- API: /api/v1/stats/*, behind a new "stats" permission resource.
- jarld brings named's configuration up to date with jarl.yaml at
startup (engine.SyncConfig), never overwriting hand-edited files.
- resync now refuses to overwrite drifted files without force, as
documented.
- tmpfiles.d creates /var/log/named (allowed by named's AppArmor profile
on Debian 13 and Ubuntu).
- The e2e harness runs named with -f like the Debian unit.
- docs/stats.md, plus API, CLI, configuration, permissions and README
updates.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- jarl zone list showed only primary zones. zone create binds its --type
flag (default "primary") to the same variable as list's --type, so the
default leaked into the list filter and hid hint, secondary and forward
zones. list now has its own variable. TestListQueries runs list
commands against a fake server and checks the filters they send.
- named-checkconf/named-checkzone messages are classified by the tool's
exit code: on success, everything printed is a warning. Warnings such
as 'both "recursion no;" and "allow-recursion" active' were shown as
errors. The CLI, jarld check and the web UI now label them as warnings
and skip the routine "loaded serial" lines.
- The zone_outside_view error points at --adopt-zones.
- docs/views.md: step-by-step split DNS for a server that has no views
yet, tested on a copy of a stock Ubuntu 26.04 setup. Linked from the
README, concepts and validation docs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The soa_warning for negative caching fired on the SOA minimum alone and
blamed BIND's resolver cap (max-ncache-ttl), which doesn't apply to an
authoritative zone. Resolvers cache negative answers for the smaller of
the SOA minimum and the SOA record's TTL (RFC 2308 section 5), and the
SOA record uses the zone's default TTL. The warning now uses that value,
explains the effect, and suggests the fix command (with --view when the
zone is in a view).
Also:
- Problem.String shows zone names without the trailing dot (jarld check).
- jarl prints the warnings a change introduces when it is applied or
staged, not only on dry runs.
- jarl check/resync print only named-checkconf errors, not its
"loaded serial" lines.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG
keys, zones of every type, records, named.conf options) in SQLite and
renders named.conf, keys.conf and zone files from it.
Every change goes through one changeset pipeline: whole-configuration
validation, named-checkconf -z and named-checkzone in a staging
directory, atomic install, rndc reconfig/reload, serial verification
with rndc zonestatus, and rollback if named does not load the change.
Changes apply one at a time by default or are bundled and applied
together. Applied changesets can be reverted.
- jarld: the daemon with the REST API and an embedded web UI, plus import,
adopt, check, resync, backup and local user recovery commands
- jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh
- users with argon2id passwords and CSRF-protected sessions; hashed API
tokens with granular grants and roles; an audit log
- systemd unit, sysusers.d/tmpfiles.d files, Makefile
- unit tests, integration tests against a real named, scripts/e2e.sh
- docs/ guides, README and CHANGELOG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
