4 Commits

Include renames

Author	SHA1	Message	Date
adamandClaude Opus 5.5	71ebed2b73	Log failed logins and refused tokens, address first ... For Guard's jarl preset and fail2ban: msg="login failed" ip=... user=... and msg="token refused" ip=..., beside the audit records. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 16:29:37 +01:00
adamandClaude Opus 5.5	057433c198	Linked zones: shared records kept in step across views ... Zones of the same name in different views can be linked. Shared records are kept in step: a change in one view reaches the others in the same changeset, as explicit operations, so the diff, permission checks, history and undo cover every view. Records local to a view override the shared records of that name and type there; removing the override brings the shared ones back, and sharing a view's version makes it every view's. Each zone keeps its own options, serial and file. Linking existing zones changes no answer: what is the same everywhere becomes shared, the rest stays local. Unlinking keeps every record, all local. ACME challenges are written once per link, and --view all changes a link once. jarl zone link/unlink, zone create --link-with, record --local/--shared, LINK column, web UI controls, POST /zones/{zone}/link and /unlink, validation checks linked_*, store migration 11, docs and e2e. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-12 15:53:58 +01:00
adamandClaude Opus 5.5	89663e366b	Disable zones instead of deleting them ... A disabled zone stays in Jarl with its records, options and history, still editable, but named doesn't load it; enabling it serves it as it is then. Signed zones, and zones another view shares, can't be disabled. jarl zone disable|enable, the zone page's Disable/Enable button. Database schema 7. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 13:45:55 +00:00
abrown38andClaude Opus 5.5	6b44b92975	Add an httpreq endpoint for lego and Traefik ... jarld can now answer lego's httpreq DNS provider (POST /api/v1/acme/httpreq/present and /cleanup), so lego and Traefik publish DNS-01 challenges with only environment variables, without the jarl CLI. lego's username and API token arrive as HTTP Basic auth, accepted on these routes only. The endpoint is off by default (acme.httpreq.enabled) and HTTPS-only by default: jarld's own TLS, or a trusted proxy that says so with X-Forwarded-Proto or Forwarded (the last value counts). Plain HTTP can be allowed from loopback only or everywhere. GET /api/v1/acme/httpreq shows how jarld sees a request, to check a proxy setup. jarl acme and the endpoint share their code in internal/acme. Documented in docs/acme.md, configuration.md, api.md and permissions.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 13:48:47 +00:00