The zones list shows a padlock after signed zones, linking to their
DNSSEC tab. Client lists in the statistics show the host name Jarl's
records have for each address (PTR, else A/AAAA); no DNS queries.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A disabled record stays in Jarl with its ID, TTL and comment but is
left out of the zone; the zone file lists it as a comment. Web UI
toggle, jarl record disable|enable, record.disable|enable operations
and API endpoints. Database schema 5.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The zone page's breadcrumb (Zones › view) linked the view to a filtered
zone list while the view link below it opened the view. It is now a
single "← Zones" link back to the list with its filters, and a changeset
has "← History". View links carry where they came from, so the views page
offers "← example.org (external)" or "← Zones" (only the UI's own #/
addresses are accepted).
Switching a zone's tabs no longer blanks the page: the header and tabs
show at once and the previous tab stays, faded, until the next has
loaded. The router shows "Loading…" only for pages that take a while.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The view shown in the zone list and on the zone page now links to that
view. The zone page and changeset page get breadcrumbs, and the zone list
keeps its filters in the address so going back restores them. Views can
be given a colour (Views > Edit, `jarl view color`, PUT /views/{id}/color)
so zones of the same view are easy to spot; the colour is UI-only, kept
outside changesets, and needs no deploy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- CLI: name several servers and groups in the config file; select them
with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at
several servers is dry-run on all of them first and only runs if every
one accepts it. Named servers always use their own token.
- Reverse zones: /32 and /128 get single-address zones; networks between
octet or nibble boundaries (e.g. a /22) are covered by several zones
created together, from the CLI and the web UI.
- Fix: under jarl.service's RestrictSUIDSGID, creating a view directory
failed on chmod with the setgid bit; fall back to the permission bits.
- Web UI: the review/live switch is a small header button, and the
pending-changes bar only shows when there are pending changes.
- TSIG key wording; the keys page points to restricted API tokens.
- Docs: several servers (cli.md), a secondary server (operations.md),
tokens vs TSIG keys (permissions.md); CHANGELOG.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- New zone dialog: choose Domain or Reverse zone. Reverse zones are
created from a network and their name is generated; both kinds show the
exact zone name and flag likely mistakes (addresses or URLs as names,
host-like names, duplicates in the view, parent/child zones, networks
off the octet/nibble boundaries) before anything is submitted.
- Record form: clears every field but the type after an add; shows the
record exactly as it will be stored and warns about unqualified names.
In reverse zones it takes an address, defaults to PTR, suggests host
names of A/AAAA records with that address and warns about a second PTR;
the record list shows addresses.
- Address match lists (options, view match lists, ACL elements) offer the
existing ACLs, TSIG keys and built-ins as one-click suggestions and
flag unknown names.
- Server: in reverse zones a record can be named by its address, and a
PTR target like nas.example.com without the final dot is read as the
full host name (a bare label is refused). Warnings noticed while parsing
record data reach the result again.
- Fixes: brand link hover underline, the dashboard's "New zone" link
opening the dialog twice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG
keys, zones of every type, records, named.conf options) in SQLite and
renders named.conf, keys.conf and zone files from it.
Every change goes through one changeset pipeline: whole-configuration
validation, named-checkconf -z and named-checkzone in a staging
directory, atomic install, rndc reconfig/reload, serial verification
with rndc zonestatus, and rollback if named does not load the change.
Changes apply one at a time by default or are bundled and applied
together. Applied changesets can be reverted.
- jarld: the daemon with the REST API and an embedded web UI, plus import,
adopt, check, resync, backup and local user recovery commands
- jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh
- users with argon2id passwords and CSRF-protected sessions; hashed API
tokens with granular grants and roles; an audit log
- systemd unit, sysusers.d/tmpfiles.d files, Makefile
- unit tests, integration tests against a real named, scripts/e2e.sh
- docs/ guides, README and CHANGELOG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
adamandClaude Opus 5.5
abrown38andClaude Opus 5.5