Release 0.5.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Release 0.5.0-rc.1
2026-10-12 20:27:25 +01:00 · 2026-10-12 20:19:38 +01:00 · 2026-10-12 20:06:18 +01:00 · 2026-10-12 20:06:18 +01:00 · 2026-10-12 20:06:18 +01:00 · 2026-10-12 19:29:33 +01:00
176 changed files with 18802 additions and 627 deletions
@@ -6,8 +6,247 @@ All notable changes to Jarl are documented here. The format follows

 ## [Unreleased]

+## [0.5.0] - 2026-10-12
+
+### Upgrading from 0.4
+
+- The database gets three new versions (internet exposure, certificates,
+  linked zones), applied when jarld starts; a 0.4 jarld can't open it
+  afterwards, so take a backup first (`sudo jarld backup`). Backups made
+  by 0.4 restore into this version. Tested: 0.4.0 packages with views,
+  zones, records, blocking and statistics, upgraded in place and
+  restored from a 0.4.0 backup.
+
+- Statistics per view start with this version: earlier figures are for
+  all views together.
+
+- New exposure warnings (docs/exposure.md) appear for views reachable from
+  the internet, e.g. "no rate-limit" or "version visible" on an external
+  view: fix them from the Exposure page, or acknowledge them. A change
+  that newly opens a public view up (an open resolver, say) now needs
+  `--accept-risk`, or the checkbox on the Changes page.
+
+- Once you use address ranges, the database can't go back to 0.4: its
+  parser doesn't know them. Remove the ranges first if you need to
+  downgrade.
+
+### Changed
+
+- The web UI's top bar had grown too long, and the user name, Users and
+  Log out ended up on a second line on the left. The server's
+  configuration and security pages (Server options, ACLs, TSIG keys,
+  Exposure, Certificates, Encrypted DNS, Audit log) are now in a
+  **Server** menu, and Account, Users and Log out in a menu under your
+  name. On narrow screens the search box and your name stay together on
+  the right.
+
+### Fixed
+
+- "update PTR" when editing a record (`jarl record update ID --ptr`) did
+  nothing unless the name or address changed too, and the web UI didn't
+  even send it alone: a reverse zone created after the record never got
+  its PTR. Alone, it now adds the PTR record if it is missing (or enables
+  it). For records of linked zones, the reverse zones of every linked view
+  count, not only the record's own view.
+
+- Option values in the web UI looked different from the editor: a long
+  line wrapped back to the left edge, losing its indentation, and the
+  column changed width when Edit opened. Values now keep their layout
+  (a long line scrolls), with the same width and padding as the editor.
+  The "{ } around the list are optional" hint only shows for options that
+  end in a list (not rate-limit, which only has one inside).
+- Query statistics skipped every query signed with a TSIG key (named
+  writes "/key NAME" after the client's port), such as queries with a
+  view's key: they are counted now.
+- A changeset with a staged record delete could not be applied after that
+  record was deleted elsewhere (e.g. with the CLI), and it was hard to see
+  which operation to remove: the error only said "record 832 does not
+  exist". A staged delete of a record that is already gone now counts as
+  done (with a warning), and the other operations that no longer apply
+  (an edit or disable of a deleted record, a change to an object changed
+  since) are named with their number and summary. The Changes page marks
+  that operation and offers to remove it right in the error.
+
 ### Added

+- Statistics per view ([docs/stats.md](docs/stats.md#views)): the
+  Statistics page has a toggle per view, with All and None, remembered in
+  the browser, to see some views only or several together (linked views,
+  say). Answers, result codes, record types, zones, blocking, rate
+  limiting and the top lists follow it; named's own counters stay for the
+  whole server, and the page says so. `jarl stats --view`, API
+  `?views=`. Per-view figures start with this version.
+- DNS over TLS and HTTPS ([docs/encrypted-dns.md](docs/encrypted-dns.md)):
+  `jarl encrypted-dns setup --hostname NAME --address ADDR` (and the
+  Encrypted DNS page) obtains a certificate for the host name if needed,
+  checks that nothing else listens on port 853 and the DoH port (443 by
+  default) at those addresses, offering a free port, and stages named's
+  `tls` statement and listeners as one change, keeping port 53 where it
+  was, plus the host name's records in your private views (local to the
+  view in a linked zone). The page and `jarl encrypted-dns` say what to
+  give Android, Linux, Firefox, Chrome and Windows. A `tls` statement whose
+  files are missing is refused (`tls_file_missing`), and a certificate
+  named uses can't be deleted.
+- Linked zones ([docs/views.md](docs/views.md#linked-zones)): zones of the
+  same name in different views can be linked, and Jarl keeps their shared
+  records in step: a change in one view reaches the others in the same
+  changeset (diff, permissions, history and undo cover every view). Each
+  view can still have records of its own (`--local`, "Only here"), which
+  override the shared records of that name and type there, and keeps its
+  own zone options. Linking existing zones changes no answer: what is the
+  same everywhere becomes shared, the rest stays local, and a view's
+  version can be shared later (`--shared`, "Share"). `jarl zone link` and
+  `unlink`, `zone create --link-with VIEW`, `record add|set|update
+  --local|--shared`, a LINK column in `record list`, "Keep them linked"
+  when copying a zone in the web UI, `POST /zones/{zone}/link` and
+  `/unlink`. ACME challenges are written once per link, and `--view all`
+  changes a link once.
+- TLS certificates ([docs/certificates.md](docs/certificates.md)): Jarl
+  obtains certificates from Let's Encrypt or any ACME CA (account set up
+  in jarl.yaml under `acme.account`) and renews them itself, from the CA's
+  renewal information (ARI) or two thirds into their lifetime, with
+  back-off after failures. It answers the DNS-01 challenges in a zone it
+  serves, or through Porkbun's DNS API while Porkbun serves the domain;
+  `auto` decides from the domain's public name servers at every renewal,
+  so moving the domain to your own name servers needs no change. A CNAME
+  on `_acme-challenge` into a zone Jarl serves is followed, for domains
+  hosted elsewhere. A certificate is used for jarld's HTTPS ("web") and/or
+  written for named (`<bind.config_dir>/tls/NAME/`, "dns"; named rereads
+  it on renewal), and certificates you renew yourself can be used too
+  (reread when their files change). Certificates page and dashboard card
+  in the web UI, `jarl cert` (check, create, issue, update, delete,
+  account), `/api/v1/certificates`, Prometheus
+  `jarl_certificate_expiry_timestamp_seconds`, `jarl_certificate_failing`.
+- jarld serves HTTPS and plain HTTP on the same ports once it has a
+  certificate (`tls.cert_file`, or one with the web use, which takes
+  effect without a restart): plain HTTP from the server itself and from
+  trusted proxies is served as before, browsers elsewhere are redirected
+  to HTTPS and API requests get `https_required`. Before, with
+  `tls.cert_file`, plain HTTP got an error even from localhost.
+- Internet exposure ([docs/exposure.md](docs/exposure.md)): Jarl works out
+  which views are reachable from the internet (match-clients ending in a
+  catch-all; for a server without views, open allow-query and a
+  non-private listen address), with a per-view override, and checks them:
+  response rate limiting, open resolvers, ANY answers (minimal-any), cache
+  snooping, open NOTIFY and zone transfers, BIND version and host name,
+  management interfaces. Fixes are staged like any change, including
+  response rate limiting from ISC's example in log-only mode, with your
+  secondaries exempt, and a later "start enforcing". With statistics on,
+  Jarl reads named's rate limiting log lines and shows what was (or would
+  have been) limited: counts, client networks and names (Exposure page,
+  `jarl stats breakdown rrl`, top lists `ratelimited`, Prometheus
+  `jarl_ratelimit_logged_total`). A change that newly opens a public view
+  up must be confirmed (checkbox on the Changes page, `--accept-risk`, API
+  `accept_risk`; 409 `confirm_risk` otherwise). Findings can be
+  acknowledged with a reason: they stay visible as info, with who, when
+  and why. Exposure page and dashboard card in the web UI, `jarl
+  exposure` (fix, ack, unack), `GET /exposure`.
+- `jarl changeset show`, `diff`, `apply`, `discard` and `remove` take the
+  changeset from `-C` or `JARL_CHANGESET` when no ID is given
+  (`jarl changeset apply`). A changeset from `JARL_CHANGESET` is now
+  checked before it is used, for staging too: it must exist, be open and
+  be yours, so a stale export (an applied changeset, or an ID that later
+  turned into someone else's web UI draft) can't silently take your
+  changes; the error says what to do. Commands say on stderr which
+  changeset from `JARL_CHANGESET` they use, and `apply`/`discard` remind
+  you to `unset JARL_CHANGESET`. `-C` and ID arguments are used as given.
+- Address ranges such as `10.0.10.101-10.0.10.199` or
+  `2001:db8::100-2001:db8::1ff` (also `!` negated, and with spaces around
+  the dash) wherever an address match list is used: ACLs, views'
+  match-clients and match-destinations, options such as allow-query, and
+  blocking's client groups ([docs/concepts.md](docs/concepts.md)). Jarl
+  keeps the range as written and writes the fewest prefixes that cover
+  exactly that range to named.conf, with the range as a comment. The web
+  UI shows what a range becomes while you type it (`GET
+  /catalog/ranges`). Mistakes are refused when entered: an end that isn't
+  a full address, the start after the end, IPv4 mixed with IPv6, a range
+  in an option that takes no address match list (forwarders). A range
+  covered by an earlier element is reported as never matching, a range of
+  every address counts as "any" for the open resolver and open transfer
+  checks, and an IPv6 range in the IPv4-mapped space gets a warning. ACL
+  names can no longer look like a range.
+- Prometheus metrics at `/metrics` ([docs/metrics.md](docs/metrics.md)),
+  set up in the new `metrics:` section of jarl.yaml (off by default).
+  `metrics.allow` lists the addresses that may scrape (loopback by
+  default), `metrics.token` lets anyone who sends it as a bearer token
+  scrape, and `metrics.listen` adds addresses that serve only `/metrics`
+  (for a Prometheus server elsewhere). Root and jarld's own user can also
+  scrape on the local socket.
+  - Health, always: named up, recursive and TCP clients against their
+    limits, adopted, open changesets, last apply, validation problems by
+    severity, drifted files, object counts, the last backup (and failure,
+    and whether it is stale), blocking paused, each blocklist's entries,
+    last check and change and whether it fails, the DNSSEC phase of every
+    signed zone, and when API tokens expire.
+  - With query statistics on: named's counters (queries, result codes,
+    record types, UDP/TCP, authoritative/recursive, rate limiting, upstream
+    round-trip times, DNSSEC validation, cache hits) and Jarl's (logged
+    responses per view and zone, blocked queries per blocklist), as
+    counters since jarld started, plus named's memory, CPU, threads, cache
+    and sockets, and the collector's health.
+  - Example queries and alert rules, checked with promtool.
+
+## [0.4.0] - 2026-10-11
+
+### Upgrading from 0.3
+
+- Back up first (`sudo jarld backup`).
+- When jarld first starts, it rewrites named's configuration: options
+  move into their new fixed order, and every view gets its view key in
+  `match-clients` and `keys.conf`. It is checked with named-checkconf
+  before named reloads, like any apply. Files you changed by hand are left
+  alone; the log then says to run `jarl resync`.
+- The systemd unit changed (it allows `AF_NETLINK`). The package replaces
+  it; an override that adds `AF_NETLINK` (`systemctl edit jarl`) does no
+  harm and can be removed.
+- The database moves to schema 8 (disabled zones, client groups) as
+  jarld starts.
+- If statistics showed a spike after views were created or changed, see
+  "Statistics" under Fixed: the bad minutes can be removed from
+  `/var/lib/jarl/stats.db` (minute rows have `res = 'm'`; the hours and
+  days that include them are `'h'` and `'d'`).
+
+### Added
+
+- Different blocking for different devices (docs/blocking.md), like
+  Pi-hole's groups, in one view and without loading any list twice.
+  Client groups put devices (addresses, networks or ACLs of them) at a
+  blocking step: `off` (only your rules), `normal` (the default), or steps
+  you add above it, each including the lists of the steps below. Lists
+  start at a step. Jarl puts a small "gate" policy zone in front of each
+  step's lists that lets the devices below that step through. Web UI: a
+  Devices panel on the Blocking page and a step on each list. CLI: `jarl
+  block step`, `jarl block group`, `jarl blocklist update --step`. API:
+  `/blocking/steps`, `/blocking/groups`. Database schema 8.
+- View keys: every view gets a TSIG key, `jarl-view-NAME`, at the front of
+  its match-clients, so a query signed with it lands in that view from any
+  address. Jarl signs its delegation check's queries to this server's own
+  addresses with the key of the zone's view: before, they got whichever
+  view matched the server's own address (usually internal), so the check
+  could report the wrong serial for the external view. `jarl view key
+  VIEW` shows a key, for `dig -k` (docs/views.md). The first apply after
+  upgrading adds the keys to named.conf and keys.conf.
+- Server statistics: named's memory (resident, and its own count) and
+  CPU use, its cache size, sockets, and recursive and TCP clients against
+  their limits; the host's memory and load; free space where zone files,
+  logs and Jarl's data are. Memory and CPU are kept over time like the
+  other statistics. Statistics page → Server, `jarl stats server`, API
+  `/stats/server`. Read from named's statistics channel, `rndc status` and
+  /proc, with no extra privileges.
+- CLI: the record commands that change records take several views,
+  `--view internal,external`, or `--view all`, and make the change in each,
+  as one changeset (all views or none).
+- Blocking can be paused until resumed, like Pi-hole's "indefinitely":
+  `jarl block pause indefinitely`, **Until I resume** on the Blocking page,
+  `{"indefinitely": true}` in the API.
+- Disabled zones: a zone can be disabled instead of deleted. named stops
+  loading it (its zone statement is left out of named.conf), while Jarl
+  keeps it with its records, options and history, still editable;
+  enabling it serves it as it is then. Disabling says what clients get
+  instead (recursion, or REFUSED). Signed zones can't be disabled. Web
+  UI: Disable/Enable on the zone page, a badge in the zone list. CLI:
+  `jarl zone disable|enable`. API: `PATCH /zones/{zone}` with
+  `{"disabled": true}`. Database schema 7.
 - Blocking (docs/blocking.md): named answers "doesn't exist" for ads,
  trackers and malware, using BIND's response policy zones.
  - Blocklists in Adblock, hosts or plain-domain format, downloaded by jarld
@@ -26,13 +265,96 @@ All notable changes to Jarl are documented here. The format follows
  - Web UI: a Blocking page, with well-known lists to pick and named's
    memory per list. CLI: `jarl blocklist` and `jarl block`. API:
    `/blocking/lists`, `/blocking/rules`, `/blocking/check`.
-  - Statistics: blocked queries and their share, blocked per list, most
-    blocked names (`jarl stats top blocked`). Blocked answers no longer
-    count as names that don't exist.
+  - Pausing: `jarl block pause [DURATION]` or the Blocking page lets every
+    name through for a while (at most a day); blocking resumes by itself.
+    The lists stay loaded, so it takes effect at once.
+  - Statistics: blocked queries over time (a line on the queries chart)
+    and their share, blocked per list, the most blocked names and the
+    clients with the most blocked queries (`jarl stats top blocked`,
+    `top blocked-clients`). Blocked answers no longer count as names that
+    don't exist.
+  - The view choice in the web UI's forms is a compact dropdown, however
+    many views there are.
  - A `blocking` permission; database schema 6.

+### Changed
+
+- Web UI: each view has its own page, like a zone: Settings (match lists,
+  comment, colour), Options and Zones tabs (with **New zone in VIEW**),
+  and Delete. The Views page lists them in order, with the arrows that
+  reorder them; view links everywhere open the view's page.
+- Web UI: A and AAAA records have a **+ CNAME** button that fills in the
+  add form with a CNAME pointing to the record's name, leaving only the
+  alias's name to type. It shows when the row is hovered or focused
+  (always on touch screens).
+- Blocking page: how many queries each blocklist blocked in the last 24
+  hours, and your rules together, with statistics on (linking to the
+  Statistics page).
+- Options are kept in one fixed order, in named.conf, the web UI and the
+  CLI: grouped by topic (files, listening, access control, recursion and
+  forwarding, DNSSEC, transfers and notify, then the rest), alphabetical
+  within a group. The same option is now in the same place in every view
+  and zone. The first apply after upgrading reorders named.conf (a diff
+  that only moves lines). Top-level statements keep their order.
+- Options that end in a list (`allow-transfer`, `forwarders`,
+  `listen-on`, ...) can be given without their braces, in the web UI, CLI
+  and API: `10.0.10.53; key xfer` becomes `{ 10.0.10.53; key xfer; }`.
+  Before, only some server options (those edited one element per line)
+  added them.
+- The dashboard's configuration checks include named-checkconf's own
+  warnings about the running configuration (such as `both "recursion no;"
+  and "allow-recursion" active`), which before only showed while applying.
+  The CLI now prints them after an apply too.
+- Statistics page: cards and tiles fill their rows instead of leaving one
+  alone beside an empty space, and the queries and failed answers charts
+  have the same margins, so their time axes line up.
+- Dashboard: options have their own tile; "0 TSIG keys · 22 options" read
+  as if the options belonged to the keys.
+- Web UI times use the 24-hour clock.
+- Diffs of named.conf say which block each change is in, after the `@@`
+  line numbers (`@@ -50,6 +49,8 @@ view "internal" {`), like git does
+  with function names. Moving an option from the server's options into a
+  view no longer looks like two unrelated edits.
+- Web UI options (server, top-level, view and zone): values with blocks,
+  such as logging, are shown and edited laid out as in named.conf, over
+  several lines with indentation. The editor grows with its content, Tab
+  indents and Enter keeps the indentation (Esc, then Tab, moves on). With
+  a draft open, the tables show the draft's values, so a staged edit stays
+  visible after Save.
+- The pending-changes banner has an Apply now button: it applies your
+  draft without going to the Changes page, and stays on the page you're
+  on. If the changes are refused, a dialog says why and links to Changes.
+- Blocking page: blocklists and rules have an Edit button (name, URL,
+  views, comment; a rule's action and scope). The list button that
+  downloads now is called Refresh, like `jarl blocklist refresh`.
+- Records table: disabled records are hatched and have a "disabled" badge
+  next to their name, instead of only a muted colour and a badge in the
+  comment column.
+
 ### Fixed

+- Reverting a changeset added needless "restore" operations for
+  blocklists, rules and views that hadn't changed: copying the state
+  turned their empty view lists into missing ones.
+- Under the shipped systemd unit, jarld couldn't list the host's
+  addresses (it needs a netlink socket, which `RestrictAddressFamilies`
+  didn't allow), so the name server checks didn't recognize this server's
+  own addresses. The Name servers tab then queried them like another
+  server's, and the delegation check didn't sign those queries with the
+  view's key: with views, both got the view matching the server's own
+  address (usually internal) and reported a wrong serial. The unit now
+  allows `AF_NETLINK`, and without it jarld reads the addresses from
+  /proc.
+- Statistics: after a reconfig that added, removed or recreated views
+  (creating the first view, for instance), a minute could count everything
+  since named started: millions of queries in an hour. A per-view counter
+  (cache, upstream times, validation) going down was taken for a restart
+  of named. Now only a new boot time means a restart, and a counter that
+  goes down counts 0 for that minute.
+- Blocking page, checking a name: when your own block rule is for that very
+  name, it offers to remove the rule instead of an allow rule, which was
+  refused as a second rule for the same name. It also names the rule that
+  matched rather than the policy zone entry.
 - docs/validation.md lacked the `disabled_conflict` warning added in 0.3.0.

 ## [0.3.0] - 2026-10-09
@@ -71,6 +71,19 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
  queries, record types, cache hit rate. Shown in the web UI and the CLI,
  and exportable as JSON. Stored as aggregates in a separate database with
  retention you set.
+* **Internet exposure checks**: Jarl works out which views are reachable
+  from the internet (a GUA-addressed internal network still counts as
+  yours) and checks them: response rate limiting (set up in log-only mode
+  first, with what it would limit shown before you enforce it), open
+  resolvers, ANY amplification, cache snooping, version and host name
+  leaks, open management interfaces. Fixes are staged for review, changes
+  that open a public view up must be confirmed, and deliberate exceptions
+  can be acknowledged with a reason.
+* **Prometheus metrics** (optional): health to alert on (named down,
+  configuration problems, drift, failing blocklists, stale backups, DNSSEC
+  steps waiting at the parent, expiring tokens) and query counters per
+  result code, view, zone and blocklist, with example alerts. Set up in
+  jarl.yaml, with an address allow list and/or a bearer token.
 * **Blocking** like Pi-hole, done by named itself: blocklists (Adblock,
  hosts or plain domains) downloaded and kept up to date, your own block
  and allow rules that beat every list, per view, with "why is this
@@ -78,6 +91,18 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
 * **Let's Encrypt DNS-01** built in: `jarl acme` plus certbot, acme.sh and lego
  hooks, an HTTPS-only endpoint for lego's and Traefik's `httpreq` provider,
  and CNAME delegation to a dedicated ACME zone.
+* **Certificates for the server itself**: Jarl obtains and renews TLS
+  certificates from Let's Encrypt (or any ACME CA), answering the DNS-01
+  challenge in its own zones or through Porkbun's API while Porkbun still
+  serves the domain, decided at every renewal. Use them for the web UI
+  (HTTPS without a restart) and for named's DNS over TLS and HTTPS (named
+  rereads them on renewal), or bring your own.
+* **DNS over TLS and HTTPS** for your own devices in one step: the
+  certificate, named's listeners on the addresses you choose (after
+  checking the ports are free) and the host name in your private views.
+* **Linked zones for split DNS**: the same zone in several views, with the
+  shared records kept in step by Jarl and a few records of each view's own
+  (an internal address for a public name, say).
 * **Adopts an existing server**: imports named.conf and zone files
  (comments included), then switches named over with an automatic
  fallback.
@@ -119,7 +144,11 @@ in `/etc/jarl/jarl.yaml` to reach it from your management network.
 | [docs/views.md](docs/views.md) | Split DNS: adding views to a server that has none |
 | [docs/dnssec.md](docs/dnssec.md) | DNSSEC signing, going public with your own name servers, Porkbun |
 | [docs/acme.md](docs/acme.md) | Let's Encrypt DNS-01 with certbot, acme.sh, lego and Traefik |
+| [docs/encrypted-dns.md](docs/encrypted-dns.md) | DNS over TLS and HTTPS for your clients: setup, ports, client settings |
+| [docs/certificates.md](docs/certificates.md) | TLS certificates Jarl obtains and renews for its web UI and named's DNS over TLS/HTTPS |
 | [docs/stats.md](docs/stats.md) | Query statistics: enabling, what is collected, retention |
+| [docs/exposure.md](docs/exposure.md) | Internet exposure: which views are public, hardening checks, response rate limiting |
+| [docs/metrics.md](docs/metrics.md) | Prometheus metrics: access, what is exported, example alerts |
 | [docs/blocking.md](docs/blocking.md) | Blocking ads, trackers and malware: blocklists, your own rules, views, memory |
 | [docs/validation.md](docs/validation.md) | Every check Jarl makes |
 | [docs/operations.md](docs/operations.md) | Backups, drift, failures, recovery, monitoring |
@@ -171,9 +200,16 @@ review step.

 ## Status

-Version 0.3.0 is the current release. It adds disabled records,
-script-friendly CLI output and client names in the statistics, on top of
-0.2.0's DNSSEC signing, Porkbun support, two-factor login and view colours. Jarl is feature-complete for one server's configuration.
+Version 0.5.0 is the current release. It adds Prometheus metrics,
+address ranges in ACLs and other address match lists, safer changeset
+handling, internet exposure checks with response rate limiting, TLS
+certificates Jarl obtains and renews itself, linked zones for split DNS,
+DNS over TLS and HTTPS, and statistics per view. 0.4.0 added blocking (blocklists and
+your own rules, like Pi-hole, done by named, with different blocking for
+different devices), disabling zones, server statistics and view keys, on
+top of 0.3.0's disabled records, script-friendly CLI output and client
+names in the statistics, and 0.2.0's DNSSEC signing, Porkbun support,
+two-factor login and view colours. Jarl is feature-complete for one server's configuration.
 Managing several servers from one jarld and dynamic updates are not
 handled yet ([concepts.md](docs/concepts.md#what-jarl-deliberately-doesnt-do-yet)).

@@ -1 +1 @@
-0.3.0
+0.5.0
@@ -83,7 +83,7 @@ func acmeZones(c *client.Client, name, view string) ([]acme.Zone, error) {
 	}
 	refs := make([]acme.Zone, len(zones))
 	for i, z := range zones {
-		refs[i] = acme.Zone{Name: z.Name, View: z.View}
+		refs[i] = acme.Zone{Name: z.Name, View: z.View, Link: z.LinkGroup}
 	}
 	out := acme.Zones(name, refs, view)
 	if len(out) == 0 {
@@ -1,6 +1,7 @@
 package main

 import (
+	"context"
 	"fmt"
 	"io"
 	"net/url"
@@ -42,7 +43,7 @@ named answers "doesn't exist" for the domains on them (docs/blocking.md).
 Hosts, plain domain and Adblock (||domain^) lists work. Your own block and
 allow rules ('jarl block') take precedence over every list.`}
 	var views []string
-	var comment string
+	var comment, step string

 	list := &cobra.Command{
 		Use:   "list",
@@ -58,7 +59,7 @@ allow rules ('jarl block') take precedence over every list.`}
 				return err
 			}
 			return output(lists, func(w io.Writer) {
-				fmt.Fprintln(w, "NAME\tSTATE\tDOMAINS\tVIEWS\tUPDATED\tMEMORY\tURL")
+				fmt.Fprintln(w, "NAME\tSTATE\tSTEP\tDOMAINS\tVIEWS\tUPDATED\tMEMORY\tURL")
 				for _, b := range lists {
 					domains, updated, mem := "-", "-", "-"
 					if s := b.Status; s != nil && s.UpdatedAt != nil {
@@ -67,7 +68,7 @@ allow rules ('jarl block') take precedence over every list.`}
 					if b.MemoryMB > 0 {
 						mem = fmt.Sprintf("~%d MB", b.MemoryMB)
 					}
-					fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", b.Name, b.State, domains, viewsText(b.Views, b.AutoViews), updated, mem, b.URL)
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n", b.Name, b.State, b.Step, domains, viewsText(b.Views, b.AutoViews), updated, mem, b.URL)
 				}
 				for _, b := range lists {
 					if b.Status != nil && b.Status.Error != "" {
@@ -94,6 +95,9 @@ allow rules ('jarl block') take precedence over every list.`}
 			}
 			body := map[string]any{"name": args[0], "url": args[1]}
 			viewsBody(body, views)
+			if step != "" {
+				body["step"] = step
+			}
 			if comment != "" {
 				body["comment"] = comment
 			}
@@ -110,6 +114,7 @@ allow rules ('jarl block') take precedence over every list.`}
 	}
 	add.Flags().StringArrayVar(&views, "view", nil, "a view it applies to (repeat for several; default: every view that offers recursion)")
 	add.Flags().StringVar(&comment, "comment", "", "comment")
+	add.Flags().StringVar(&step, "step", "", "the blocking step it starts at (default: normal; see 'jarl block step')")

 	var rename, newURL string
 	update := &cobra.Command{
@@ -135,6 +140,9 @@ allow rules ('jarl block') take precedence over every list.`}
 			if f.Changed("comment") {
 				body["comment"] = comment
 			}
+			if f.Changed("step") {
+				body["step"] = step
+			}
 			viewsBody(body, views)
 			if len(body) == 0 {
 				return fmt.Errorf("nothing to change (see --help)")
@@ -150,6 +158,7 @@ allow rules ('jarl block') take precedence over every list.`}
 	update.Flags().StringVar(&newURL, "url", "", "new URL")
 	update.Flags().StringArrayVar(&views, "view", nil, `a view it applies to (repeat for several; "auto": every view that offers recursion)`)
 	update.Flags().StringVar(&comment, "comment", "", "new comment")
+	update.Flags().StringVar(&step, "step", "", "the blocking step it starts at (normal, or a step above it)")

 	toggle := func(disable bool) *cobra.Command {
 		verb := map[bool]string{true: "disable", false: "enable"}[disable]
@@ -309,7 +318,11 @@ names below it (docs/blocking.md).`}
 			if err := c.Get(ctx(), "/blocking/rules", nil, &rules); err != nil {
 				return err
 			}
+			note := pausedNote(c)
 			return output(rules, func(w io.Writer) {
+				if note != "" {
+					fmt.Fprintln(w, note)
+				}
 				fmt.Fprintln(w, "ID\tACTION\tDOMAIN\tCOVERS\tVIEWS\tCOMMENT")
 				for _, r := range rules {
 					covers := "and below"
@@ -372,7 +385,11 @@ names below it (docs/blocking.md).`}
 			if err := c.Get(ctx(), "/blocking/check", q("name", args[0]), &matches); err != nil {
 				return err
 			}
+			note := pausedNote(c)
 			return output(matches, func(w io.Writer) {
+				if note != "" {
+					fmt.Fprint(w, note+"While it is, every name is answered. Otherwise:\n")
+				}
 				if len(matches) == 0 {
 					fmt.Fprintln(w, "Blocking isn't set up in any view.")
 					return
@@ -385,6 +402,8 @@ names below it (docs/blocking.md).`}
 					switch {
 					case m.Result == "none":
 						fmt.Fprintf(w, "%snot blocked\n", where)
+					case m.List != "" && m.Step != "":
+						fmt.Fprintf(w, "%sblocked for clients at step %s and above, by blocklist %s (entry %s); not for others\n", where, m.Step, m.List, m.Entry)
 					case m.List != "":
 						fmt.Fprintf(w, "%sblocked by blocklist %s (entry %s)\n", where, m.List, m.Entry)
 					default:
@@ -395,6 +414,95 @@ names below it (docs/blocking.md).`}
 		},
 	}

-	cmd.AddCommand(addRule("block"), addRule("allow"), list, del, check)
+	pause := &cobra.Command{
+		Use:   "pause [DURATION | indefinitely]",
+		Short: "Let every name through for a while (default 10m, at most 24h) or until resumed",
+		Long: `Pause blocking: every name is answered normally until the time is up,
+then blocking resumes by itself. Useful to see whether blocking is what
+breaks a site. The lists stay loaded, so pausing and resuming take effect
+at once. "indefinitely" pauses until 'jarl block resume'.
+
+  jarl block pause          # 10 minutes
+  jarl block pause 1h
+  jarl block pause indefinitely
+  jarl block resume`,
+		Args:      cobra.MaximumNArgs(1),
+		ValidArgs: []string{"indefinitely", "5m", "10m", "30m", "1h", "24h"},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if len(args) == 1 && args[0] == "indefinitely" {
+				c, err := newClient()
+				if err != nil {
+					return err
+				}
+				resp, err := c.Mutate(ctx(), "POST", "/blocking/pause", nil, map[string]any{"indefinitely": true})
+				if err != nil {
+					return err
+				}
+				if err := report(resp); err != nil || flagQuiet || !resp.Applied {
+					return err
+				}
+				fmt.Println("Blocking is paused until you resume it ('jarl block resume').")
+				return nil
+			}
+			d := 10 * time.Minute
+			if len(args) == 1 {
+				var err error
+				if d, err = time.ParseDuration(args[0]); err != nil || d < time.Minute {
+					return fmt.Errorf("invalid duration %q (like 10m or 2h, or indefinitely)", args[0])
+				}
+			}
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/pause", nil, map[string]any{"minutes": int(d.Round(time.Minute) / time.Minute)})
+			if err != nil {
+				return err
+			}
+			if err := report(resp); err != nil || flagQuiet || !resp.Applied {
+				return err
+			}
+			fmt.Printf("Blocking is paused until %s.\n", time.Now().Add(d.Round(time.Minute)).Format("15:04"))
+			return nil
+		},
+	}
+	resume := &cobra.Command{
+		Use:   "resume",
+		Short: "End a pause: block again now",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/resume", nil, nil)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+
+	cmd.AddCommand(addRule("block"), addRule("allow"), list, del, check, pause, resume, blockStepCmd(), blockGroupCmd())
 	return cmd
 }
+
+// pausedNote returns a line about a pause of blocking, or "".
+func pausedNote(c interface {
+	Get(context.Context, string, url.Values, any) error
+}) string {
+	var st struct {
+		PausedUntil        *time.Time `json:"paused_until"`
+		PausedIndefinitely bool       `json:"paused_indefinitely"`
+	}
+	if c.Get(ctx(), "/blocking/status", nil, &st) != nil {
+		return ""
+	}
+	if st.PausedIndefinitely {
+		return "Blocking is paused until you resume it ('jarl block resume').\n"
+	}
+	if st.PausedUntil == nil {
+		return ""
+	}
+	return "Blocking is paused until " + st.PausedUntil.Local().Format("2006-01-02 15:04") + " ('jarl block resume' ends it).\n"
+}
@@ -0,0 +1,556 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"jarl/internal/client"
+)
+
+type certStatus struct {
+	State   string `json:"state"`
+	Message string `json:"message"`
+}
+
+type certInfo struct {
+	ID           int64      `json:"id"`
+	Name         string     `json:"name"`
+	Source       string     `json:"source"`
+	Domains      []string   `json:"domains"`
+	CertFile     string     `json:"cert_file,omitempty"`
+	KeyFile      string     `json:"key_file,omitempty"`
+	Uses         []string   `json:"uses"`
+	Challenge    string     `json:"challenge,omitempty"`
+	KeyType      string     `json:"key_type,omitempty"`
+	Comment      string     `json:"comment"`
+	Names        []string   `json:"names,omitempty"`
+	NotBefore    *time.Time `json:"not_before,omitempty"`
+	NotAfter     *time.Time `json:"not_after,omitempty"`
+	Issuer       string     `json:"issuer,omitempty"`
+	Serial       string     `json:"serial,omitempty"`
+	RenewAt      *time.Time `json:"renew_at,omitempty"`
+	LastAttempt  *time.Time `json:"last_attempt,omitempty"`
+	LastSuccess  *time.Time `json:"last_success,omitempty"`
+	LastError    string     `json:"last_error,omitempty"`
+	Failures     int        `json:"failures,omitempty"`
+	LastRoutes   []string   `json:"last_routes,omitempty"`
+	Status       certStatus `json:"status"`
+	NextAttempt  *time.Time `json:"next_attempt,omitempty"`
+	IssuingSince *time.Time `json:"issuing_since,omitempty"`
+	Serving      bool       `json:"serving,omitempty"`
+	Files        *struct {
+		Chain string `json:"chain"`
+		Key   string `json:"key"`
+	} `json:"files,omitempty"`
+}
+
+type certAccount struct {
+	Directory            string     `json:"directory"`
+	Email                string     `json:"email"`
+	AgreeTOS             bool       `json:"agree_tos"`
+	EAB                  bool       `json:"eab"`
+	Registered           bool       `json:"registered"`
+	URI                  string     `json:"uri"`
+	RegisteredAt         *time.Time `json:"registered_at"`
+	Porkbun              bool       `json:"porkbun"`
+	Resolvers            []string   `json:"resolvers"`
+	Dir                  string     `json:"dir"`
+	ActiveWebCertificate string     `json:"active_web_certificate"`
+}
+
+type certRoute struct {
+	Domain   string   `json:"domain"`
+	Record   string   `json:"record"`
+	Target   string   `json:"target"`
+	Route    string   `json:"route"`
+	Zone     string   `json:"zone"`
+	PublicNS []string `json:"public_ns"`
+	Why      string   `json:"why"`
+	Error    string   `json:"error"`
+}
+
+func certPath(name string) string { return "/certificates/" + url.PathEscape(name) }
+
+func certCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "cert",
+		Aliases: []string{"certificate", "certificates"},
+		Short:   "TLS certificates Jarl obtains and renews, or reads from files (docs/certificates.md)",
+		Long: `Certificates for jarld's own HTTPS (use "web") and for named's DNS over
+TLS and HTTPS (use "dns": written where named can read them).
+
+Jarl obtains them from an ACME CA (Let's Encrypt by default; the account is
+set up in jarl.yaml under acme.account) and renews them itself. It answers
+the DNS-01 challenges in a zone it serves, or through Porkbun's API while
+Porkbun serves the domain ("auto" decides at every renewal from the
+domain's public name servers). A certificate you renew yourself can be
+used too (--cert-file and --key-file): Jarl rereads it when it changes.`,
+		Example: `  jarl cert check --domain ns1.adbraun.lol                # where would the challenge go?
+  jarl cert create ns1 --domain ns1.adbraun.lol --use web --use dns
+  jarl cert create wild --domain adbraun.lol --domain '*.adbraun.lol' --use dns
+  jarl cert create own --cert-file /etc/ssl/ns1/fullchain.pem --key-file /etc/ssl/ns1/privkey.pem --use web
+  jarl cert list
+  jarl cert issue ns1                                      # renew now
+  jarl cert update ns1 --challenge porkbun                 # pin the route (auto, jarl or porkbun)`,
+	}
+	cmd.AddCommand(certListCmd(), certShowCmd(), certCreateCmd(), certUpdateCmd(), certIssueCmd(), certCheckCmd(), certDeleteCmd(), certAccountCmd())
+	return cmd
+}
+
+func certListCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:     "list",
+		Aliases: []string{"ls"},
+		Short:   "List certificates",
+		Args:    cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				Certificates []certInfo `json:"certificates"`
+			}
+			if err := c.Get(ctx(), "/certificates", nil, &r); err != nil {
+				return err
+			}
+			return output(r.Certificates, func(w io.Writer) {
+				fmt.Fprintln(w, "NAME\tSOURCE\tUSES\tNAMES\tEXPIRES\tSTATUS")
+				for _, ci := range r.Certificates {
+					names := ci.Names
+					if len(names) == 0 {
+						names = ci.Domains
+					}
+					state := ci.Status.State
+					if ci.IssuingSince != nil {
+						state = "obtaining"
+					}
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\n", ci.Name, ci.Source, dash(strings.Join(ci.Uses, ",")), strings.Join(names, " "), fmtDate(ci.NotAfter), state)
+				}
+			})
+		},
+	}
+}
+
+func fmtDate(t *time.Time) string {
+	if t == nil {
+		return "-"
+	}
+	return t.Local().Format("2006-01-02")
+}
+
+func printCert(w io.Writer, ci certInfo) {
+	fmt.Fprintf(w, "Name:\t%s\n", ci.Name)
+	switch ci.Source {
+	case "acme":
+		fmt.Fprintf(w, "Source:\tacme (Jarl obtains and renews it)\n")
+		fmt.Fprintf(w, "Domains:\t%s\n", strings.Join(ci.Domains, " "))
+		fmt.Fprintf(w, "Challenge:\t%s\n", ci.Challenge)
+		fmt.Fprintf(w, "Key type:\t%s\n", ci.KeyType)
+	default:
+		fmt.Fprintf(w, "Source:\tfile (you renew it)\n")
+		fmt.Fprintf(w, "Cert file:\t%s\n", ci.CertFile)
+		fmt.Fprintf(w, "Key file:\t%s\n", ci.KeyFile)
+	}
+	uses := []string{}
+	for _, u := range ci.Uses {
+		switch u {
+		case "web":
+			s := "web (jarld's HTTPS"
+			if ci.Serving {
+				s += ", serving now"
+			}
+			uses = append(uses, s+")")
+		case "dns":
+			uses = append(uses, "dns (for named)")
+		}
+	}
+	fmt.Fprintf(w, "Uses:\t%s\n", dash(strings.Join(uses, ", ")))
+	if ci.Comment != "" {
+		fmt.Fprintf(w, "Comment:\t%s\n", ci.Comment)
+	}
+	state := ci.Status.State
+	if ci.Status.Message != "" {
+		state += ": " + ci.Status.Message
+	}
+	if ci.IssuingSince != nil {
+		state = "obtaining since " + fmtTime(ci.IssuingSince)
+	}
+	fmt.Fprintf(w, "Status:\t%s\n", state)
+	if ci.NotAfter != nil {
+		fmt.Fprintf(w, "Names:\t%s\n", strings.Join(ci.Names, " "))
+		fmt.Fprintf(w, "Valid:\t%s to %s\n", fmtTime(ci.NotBefore), fmtTime(ci.NotAfter))
+		fmt.Fprintf(w, "Issuer:\t%s\n", ci.Issuer)
+		fmt.Fprintf(w, "Serial:\t%s\n", ci.Serial)
+	}
+	if ci.Source == "acme" {
+		if ci.NextAttempt != nil && ci.NotAfter != nil {
+			fmt.Fprintf(w, "Renews:\t%s\n", fmtTime(ci.NextAttempt))
+		} else if ci.NextAttempt != nil {
+			fmt.Fprintf(w, "Next try:\t%s\n", fmtTime(ci.NextAttempt))
+		}
+		if len(ci.LastRoutes) > 0 {
+			fmt.Fprintf(w, "Challenges:\t%s\n", strings.Join(ci.LastRoutes, "; "))
+		}
+	}
+	if ci.LastSuccess != nil {
+		fmt.Fprintf(w, "Last success:\t%s\n", fmtTime(ci.LastSuccess))
+	}
+	if ci.LastError != "" {
+		fmt.Fprintf(w, "Last error:\t%s\n", ci.LastError)
+	}
+	if ci.Files != nil {
+		fmt.Fprintf(w, "For named:\t%s\n\t%s\n", ci.Files.Chain, ci.Files.Key)
+	}
+}
+
+func certShowCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "show NAME",
+		Short: "Show a certificate",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var ci certInfo
+			if err := c.Get(ctx(), certPath(args[0]), nil, &ci); err != nil {
+				return err
+			}
+			return output(ci, func(w io.Writer) { printCert(w, ci) })
+		},
+	}
+}
+
+type certFlags struct {
+	domains            []string
+	uses               []string
+	challenge, keyType string
+	comment            string
+	certFile, keyFile  string
+}
+
+func (f *certFlags) add(cmd *cobra.Command) {
+	fl := cmd.Flags()
+	fl.StringArrayVarP(&f.domains, "domain", "d", nil, "a name on the certificate (repeat for several; *.example.com for a wildcard)")
+	fl.StringArrayVarP(&f.uses, "use", "u", nil, "what it is for: web (jarld's HTTPS) or dns (named's DNS over TLS/HTTPS); repeat for both")
+	fl.StringVar(&f.challenge, "challenge", "", "where DNS-01 challenges go: auto (from the domain's public name servers), jarl or porkbun")
+	fl.StringVar(&f.keyType, "key-type", "", "key type: ec256 (default), ec384, rsa2048, rsa3072 or rsa4096")
+	fl.StringVar(&f.comment, "comment", "", "a comment")
+	fl.StringVar(&f.certFile, "cert-file", "", "a certificate you renew yourself: the full chain (PEM)")
+	fl.StringVar(&f.keyFile, "key-file", "", "its private key (PEM)")
+}
+
+func (f *certFlags) body(cmd *cobra.Command) map[string]any {
+	b := map[string]any{}
+	ch := cmd.Flags().Changed
+	if ch("domain") {
+		b["domains"] = f.domains
+	}
+	if ch("use") {
+		uses := []string{}
+		for _, u := range f.uses {
+			for _, x := range strings.Split(u, ",") {
+				if x = strings.TrimSpace(x); x != "" && x != "none" {
+					uses = append(uses, x)
+				}
+			}
+		}
+		b["uses"] = uses
+	}
+	for flag, key := range map[string]string{"challenge": "challenge", "key-type": "key_type", "comment": "comment", "cert-file": "cert_file", "key-file": "key_file"} {
+		if ch(flag) {
+			v, _ := cmd.Flags().GetString(flag)
+			b[key] = v
+		}
+	}
+	return b
+}
+
+func certCreateCmd() *cobra.Command {
+	var f certFlags
+	var noIssue, noWait bool
+	cmd := &cobra.Command{
+		Use:   "create NAME",
+		Short: "Add a certificate: obtained by Jarl (--domain), or one you renew (--cert-file, --key-file)",
+		Long: `Adds a certificate. With --domain, Jarl obtains it from the CA at once
+(and renews it from then on); the command waits for the outcome. With
+--cert-file and --key-file it is a certificate you renew yourself, which
+Jarl reads (and rereads when the files change).
+
+The name is used for the files for named (<certificates.dir>/NAME/).`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			b := f.body(cmd)
+			b["name"] = args[0]
+			b["source"] = "acme"
+			if f.certFile != "" || f.keyFile != "" {
+				b["source"] = "file"
+			}
+			b["issue"] = !noIssue
+			var r struct {
+				Certificate certInfo `json:"certificate"`
+				Error       string   `json:"error"`
+			}
+			if err := c.Do(ctx(), "POST", "/certificates", nil, b, &r); err != nil {
+				return err
+			}
+			if r.Certificate.IssuingSince != nil && !noWait {
+				return waitIssue(c, args[0])
+			}
+			if r.Error != "" {
+				return errors.New(r.Error)
+			}
+			return output(r.Certificate, func(w io.Writer) { printCert(w, r.Certificate) })
+		},
+	}
+	f.add(cmd)
+	cmd.Flags().BoolVar(&noIssue, "no-issue", false, "don't obtain it now (jarld does within minutes)")
+	cmd.Flags().BoolVar(&noWait, "no-wait", false, "return at once instead of waiting for the CA")
+	return cmd
+}
+
+func certUpdateCmd() *cobra.Command {
+	var f certFlags
+	cmd := &cobra.Command{
+		Use:   "update NAME",
+		Short: "Change a certificate (--domain and --use replace the whole list)",
+		Long: `Changes a certificate. --domain and --use replace the whole list
+(--use none for no use). New names or a new key type make Jarl obtain it
+again soon (run 'jarl cert issue NAME' to do it now).`,
+		Example: `  jarl cert update ns1 --use web --use dns
+  jarl cert update ns1 --challenge auto
+  jarl cert update ns1 --domain ns1.adbraun.lol --domain dns.adbraun.lol`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			b := f.body(cmd)
+			if len(b) == 0 {
+				return errors.New("nothing to change")
+			}
+			var r struct {
+				Certificate certInfo `json:"certificate"`
+			}
+			if err := c.Do(ctx(), "PATCH", certPath(args[0]), nil, b, &r); err != nil {
+				return err
+			}
+			return output(r.Certificate, func(w io.Writer) { printCert(w, r.Certificate) })
+		},
+	}
+	f.add(cmd)
+	return cmd
+}
+
+func certIssueCmd() *cobra.Command {
+	var noWait bool
+	cmd := &cobra.Command{
+		Use:     "issue NAME",
+		Aliases: []string{"renew"},
+		Short:   "Obtain the certificate now (reread the files of one you renew yourself)",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				Certificate certInfo `json:"certificate"`
+				Error       string   `json:"error"`
+			}
+			if err := c.Do(ctx(), "POST", certPath(args[0])+"/issue", nil, map[string]any{}, &r); err != nil {
+				return err
+			}
+			if r.Error != "" {
+				return errors.New(r.Error)
+			}
+			if r.Certificate.IssuingSince != nil && !noWait {
+				return waitIssue(c, args[0])
+			}
+			return output(r.Certificate, func(w io.Writer) { printCert(w, r.Certificate) })
+		},
+	}
+	cmd.Flags().BoolVar(&noWait, "no-wait", false, "return at once instead of waiting for the CA")
+	return cmd
+}
+
+// waitIssue polls until jarld has finished obtaining the certificate and
+// reports the outcome.
+func waitIssue(c *client.Client, name string) error {
+	tty := !flagQuiet && flagOutput == "table"
+	if tty {
+		fmt.Fprintf(os.Stderr, "Obtaining %s from the CA (this can take a few minutes while the challenges reach every name server)", name)
+	}
+	deadline := time.Now().Add(20 * time.Minute)
+	var ci certInfo
+	for {
+		ci = certInfo{} // a field the answer leaves out must not keep the last value
+		if err := c.Get(ctx(), certPath(name), nil, &ci); err != nil {
+			return err
+		}
+		if ci.IssuingSince == nil || time.Now().After(deadline) {
+			break
+		}
+		if tty {
+			fmt.Fprint(os.Stderr, ".")
+		}
+		time.Sleep(2 * time.Second)
+	}
+	if tty {
+		fmt.Fprintln(os.Stderr)
+	}
+	if ci.IssuingSince != nil {
+		return fmt.Errorf("jarld is still obtaining %s; check later with: jarl cert show %s", name, name)
+	}
+	if err := output(ci, func(w io.Writer) { printCert(w, ci) }); err != nil {
+		return err
+	}
+	if ci.LastError != "" && (ci.LastSuccess == nil || ci.LastAttempt != nil && ci.LastAttempt.After(*ci.LastSuccess)) {
+		return fmt.Errorf("obtaining %s failed (jarld tries again at %s)", name, fmtTime(ci.NextAttempt))
+	}
+	return nil
+}
+
+func certCheckCmd() *cobra.Command {
+	var f certFlags
+	cmd := &cobra.Command{
+		Use:   "check [NAME]",
+		Short: "Show where each name's DNS-01 challenge would go, without asking the CA",
+		Long: `For an existing certificate, or for --domain names, shows where Jarl would
+publish each DNS-01 challenge (in a zone it serves, or at Porkbun) and why,
+seen from the resolvers in acme.resolvers, as the CA would see it. Nothing
+is published and the CA isn't asked.`,
+		Example: `  jarl cert check ns1
+  jarl cert check --domain ns1.adbraun.lol --domain '*.adbraun.lol'`,
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				OK      bool        `json:"ok"`
+				Routes  []certRoute `json:"routes"`
+				Account certAccount `json:"account"`
+			}
+			if len(args) == 1 {
+				err = c.Do(ctx(), "POST", certPath(args[0])+"/check", nil, map[string]any{}, &r)
+			} else {
+				b := f.body(cmd)
+				if b["domains"] == nil {
+					return errors.New("give a certificate name, or --domain")
+				}
+				err = c.Do(ctx(), "POST", "/certificates/check", nil, b, &r)
+			}
+			if err != nil {
+				return err
+			}
+			if err := output(r, func(w io.Writer) {
+				fmt.Fprintln(w, "NAME\tROUTE\tRECORD\tWHY")
+				for _, rt := range r.Routes {
+					rec := strings.TrimSuffix(rt.Target, ".")
+					if rt.Target != rt.Record && rt.Target != "" {
+						rec += " (CNAME from " + strings.TrimSuffix(rt.Record, ".") + ")"
+					}
+					if rt.Error != "" {
+						fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", rt.Domain, "none", dash(rec), rt.Error)
+						continue
+					}
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", rt.Domain, rt.Route, rec, rt.Why)
+				}
+				if !r.Account.AgreeTOS {
+					fmt.Fprintln(w, "\nNote: acme.account.agree_tos isn't set in jarl.yaml, so Jarl can't register with the CA yet.")
+				}
+			}); err != nil {
+				return err
+			}
+			if !r.OK {
+				return errors.New("not every name can be validated")
+			}
+			return nil
+		},
+	}
+	cmd.Flags().StringArrayVarP(&f.domains, "domain", "d", nil, "a name to check (repeat for several)")
+	cmd.Flags().StringVar(&f.challenge, "challenge", "", "the challenge setting to check with: auto, jarl or porkbun")
+	return cmd
+}
+
+func certDeleteCmd() *cobra.Command {
+	var yes bool
+	cmd := &cobra.Command{
+		Use:   "delete NAME",
+		Short: "Delete a certificate (and its files for named)",
+		Long: `Deletes a certificate. Its files for named are removed, so take it out of
+any tls block in named's configuration first. If jarld served it, jarld
+goes back to tls.cert_file, or to plain HTTP.`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if !confirm("Delete certificate "+args[0]+"?", yes) {
+				return errors.New("aborted")
+			}
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			if err := c.Do(ctx(), "DELETE", certPath(args[0]), nil, nil, nil); err != nil {
+				return err
+			}
+			if !flagQuiet {
+				fmt.Println("deleted certificate", args[0])
+			}
+			return nil
+		},
+	}
+	cmd.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask")
+	return cmd
+}
+
+func certAccountCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "account",
+		Short: "Show the ACME account and settings (set in jarl.yaml under acme)",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				Account certAccount `json:"account"`
+			}
+			if err := c.Get(ctx(), "/certificates", nil, &r); err != nil {
+				return err
+			}
+			a := r.Account
+			return output(a, func(w io.Writer) {
+				fmt.Fprintf(w, "Directory:\t%s\n", a.Directory)
+				fmt.Fprintf(w, "Email:\t%s\n", dash(a.Email))
+				fmt.Fprintf(w, "Terms agreed:\t%v\n", a.AgreeTOS)
+				if a.Registered {
+					fmt.Fprintf(w, "Account:\t%s (since %s)\n", a.URI, fmtTime(a.RegisteredAt))
+				} else {
+					fmt.Fprintf(w, "Account:\tnot registered yet (it is, with the first certificate)\n")
+				}
+				fmt.Fprintf(w, "EAB:\t%v\n", a.EAB)
+				fmt.Fprintf(w, "Porkbun:\t%v\n", a.Porkbun)
+				fmt.Fprintf(w, "Resolvers:\t%s\n", strings.Join(a.Resolvers, " "))
+				fmt.Fprintf(w, "Files for named:\t%s\n", a.Dir)
+				fmt.Fprintf(w, "Serving HTTPS with:\t%s\n", dash(a.ActiveWebCertificate))
+			})
+		},
+	}
+}
@@ -120,13 +120,17 @@ func byIDOrMatch(op string, d map[string]any) api.ChangeRequest {
 // changeset given with --changeset.
 func submitBatch(c *client.Client, description string, reqs []api.ChangeRequest) error {
 	var resp api.MutationResponse
-	if c.Changeset > 0 {
-		if err := c.Do(ctx(), "POST", fmt.Sprintf("/changesets/%d/ops", c.Changeset), nil, map[string]any{"ops": reqs}, &resp); err != nil {
+	cs, err := c.UseChangeset(ctx())
+	if err != nil {
+		return err
+	}
+	if cs > 0 {
+		if err := c.Do(ctx(), "POST", fmt.Sprintf("/changesets/%d/ops", cs), nil, map[string]any{"ops": reqs}, &resp); err != nil {
 			return err
 		}
 		return report(&resp)
 	}
-	if err := c.Do(ctx(), "POST", "/apply", nil, api.BatchRequest{Description: description, Ops: reqs, DryRun: c.DryRun, Force: c.Force}, &resp); err != nil {
+	if err := c.Do(ctx(), "POST", "/apply", nil, api.BatchRequest{Description: description, Ops: reqs, DryRun: c.DryRun, Force: c.Force, AcceptRisk: c.AcceptRisk}, &resp); err != nil {
 		return err
 	}
 	return report(&resp)
@@ -230,8 +234,9 @@ func changesetCmd() *cobra.Command {
 		Example: `  export JARL_CHANGESET=$(jarl changeset create "move web servers" -q)
  jarl record add example.com www2 A 192.0.2.20
  jarl record delete example.com www A
-  jarl changeset diff $JARL_CHANGESET
-  jarl changeset apply $JARL_CHANGESET`,
+  jarl changeset diff                # JARL_CHANGESET's
+  jarl changeset apply
+  unset JARL_CHANGESET`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
@@ -245,21 +250,25 @@ func changesetCmd() *cobra.Command {
 				fmt.Println(cs.ID)
 				return nil
 			}
-			fmt.Printf("created changeset %d\nstage changes with --changeset %d (or export JARL_CHANGESET=%d)\n", cs.ID, cs.ID, cs.ID)
+			fmt.Printf("created changeset %d\nstage changes with --changeset %d (or export JARL_CHANGESET=%d), then 'jarl changeset apply'\n", cs.ID, cs.ID, cs.ID)
 			return nil
 		},
 	}
 	show := &cobra.Command{
-		Use:   "show ID",
-		Short: "Show a changeset's operations",
-		Args:  cobra.ExactArgs(1),
+		Use:   "show [ID]",
+		Short: "Show a changeset's operations (default: -C or JARL_CHANGESET)",
+		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
+			id, _, err := changesetArg(c, args, false)
+			if err != nil {
+				return err
+			}
 			var cs api.Changeset
-			if err := c.Get(ctx(), "/changesets/"+args[0], nil, &cs); err != nil {
+			if err := c.Get(ctx(), "/changesets/"+id, nil, &cs); err != nil {
 				return err
 			}
 			return output(cs, func(w io.Writer) {
@@ -280,16 +289,20 @@ func changesetCmd() *cobra.Command {
 		},
 	}
 	diff := &cobra.Command{
-		Use:   "diff ID",
-		Short: "Validate an open changeset and show what applying it would change",
-		Args:  cobra.ExactArgs(1),
+		Use:   "diff [ID]",
+		Short: "Validate an open changeset and show what applying it would change (default: -C or JARL_CHANGESET)",
+		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
+			id, fromEnv, err := changesetArg(c, args, true)
+			if err != nil {
+				return err
+			}
 			var raw json.RawMessage
-			if err := c.Get(ctx(), "/changesets/"+args[0]+"/preview", nil, &raw); err != nil {
+			if err := c.Get(ctx(), "/changesets/"+id+"/preview", nil, &raw); err != nil {
 				return err
 			}
 			if flagOutput != "table" {
@@ -312,56 +325,82 @@ func changesetCmd() *cobra.Command {
 			fmt.Println()
 			fmt.Print(r.Diff)
 			if r.Valid {
-				fmt.Println("\nvalid: apply with 'jarl changeset apply " + args[0] + "'")
+				how := "jarl changeset apply " + id
+				if fromEnv {
+					how = "jarl changeset apply"
+				}
+				fmt.Println("\nvalid: apply with '" + how + "'")
 				return nil
 			}
 			return fmt.Errorf("the changeset can't be applied as it is")
 		},
 	}
 	apply := &cobra.Command{
-		Use:   "apply ID",
-		Short: "Apply an open changeset",
-		Args:  cobra.ExactArgs(1),
+		Use:   "apply [ID]",
+		Short: "Apply an open changeset (default: -C or JARL_CHANGESET)",
+		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
+			id, fromEnv, err := changesetArg(c, args, true)
+			if err != nil {
+				return err
+			}
 			var resp api.MutationResponse
-			if err := c.Do(ctx(), "POST", "/changesets/"+args[0]+"/apply", nil, map[string]any{"force": c.Force, "dry_run": c.DryRun}, &resp); err != nil {
+			if err := c.Do(ctx(), "POST", "/changesets/"+id+"/apply", nil, map[string]any{"force": c.Force, "dry_run": c.DryRun, "accept_risk": c.AcceptRisk}, &resp); err != nil {
 				return err
 			}
-			return report(&resp)
+			if err := report(&resp); err != nil {
+				return err
+			}
+			if fromEnv && resp.Applied {
+				envChangesetDone(id, "applied")
+			}
+			return nil
 		},
 	}
 	discard := &cobra.Command{
-		Use:   "discard ID",
-		Short: "Throw away an open changeset",
-		Args:  cobra.ExactArgs(1),
+		Use:   "discard [ID]",
+		Short: "Throw away an open changeset (default: -C or JARL_CHANGESET)",
+		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
-			if err := c.Do(ctx(), "POST", "/changesets/"+args[0]+"/discard", nil, nil, nil); err != nil {
+			id, fromEnv, err := changesetArg(c, args, true)
+			if err != nil {
+				return err
+			}
+			if err := c.Do(ctx(), "POST", "/changesets/"+id+"/discard", nil, nil, nil); err != nil {
 				return err
 			}
 			if !flagQuiet {
-				fmt.Println("discarded changeset", args[0])
+				fmt.Println("discarded changeset", id)
+			}
+			if fromEnv {
+				envChangesetDone(id, "discarded")
 			}
 			return nil
 		},
 	}
 	remove := &cobra.Command{
-		Use:   "remove ID SEQ",
-		Short: "Remove one operation from an open changeset",
-		Args:  cobra.ExactArgs(2),
+		Use:   "remove [ID] SEQ",
+		Short: "Remove one operation from an open changeset (default: -C or JARL_CHANGESET)",
+		Args:  cobra.RangeArgs(1, 2),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
-			return c.Do(ctx(), "DELETE", "/changesets/"+args[0]+"/ops/"+args[1], nil, nil, nil)
+			seq := args[len(args)-1]
+			id, _, err := changesetArg(c, args[:len(args)-1], true)
+			if err != nil {
+				return err
+			}
+			return c.Do(ctx(), "DELETE", "/changesets/"+id+"/ops/"+seq, nil, nil, nil)
 		},
 	}
 	revert := &cobra.Command{
@@ -0,0 +1,271 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"net/url"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"jarl/internal/api"
+)
+
+// Blocking steps and client groups (docs/blocking.md).
+
+func blockStepCmd() *cobra.Command {
+	cmd := &cobra.Command{Use: "step", Aliases: []string{"steps"}, Short: "Blocking steps: which lists apply to which client groups",
+		Long: `Steps decide which blocklists a client group gets. Each step includes the
+lists of the steps below it, plus its own:
+
+  off      only your rules (built in)
+  normal   your rules + the normal lists; clients not in a group (built in)
+  strict   normal + the lists at step strict (a step you add)
+  ...
+
+Lists start at a step ('jarl blocklist update LIST --step strict'), client
+groups are at one ('jarl block group add kids 10.10.0.50 --step strict').`}
+	list := &cobra.Command{
+		Use:   "list",
+		Short: "List the steps, lowest first",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var steps []api.BlockStep
+			if err := c.Get(ctx(), "/blocking/steps", nil, &steps); err != nil {
+				return err
+			}
+			return output(steps, func(w io.Writer) {
+				fmt.Fprintln(w, "STEP\tLISTS\tGROUPS\tCOMMENT")
+				fmt.Fprintln(w, "off\t-\t(built in)\tonly your rules")
+				fmt.Fprintln(w, "normal\t-\t(built in)\tthe default")
+				for _, s := range steps {
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", s.Name, orDash(strings.Join(s.Lists, ", ")), orDash(strings.Join(s.Groups, ", ")), s.Comment)
+				}
+			})
+		},
+	}
+	var comment string
+	add := &cobra.Command{
+		Use:   "add NAME",
+		Short: "Add a step above the existing ones",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/steps", nil, map[string]any{"name": args[0], "comment": comment})
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	add.Flags().StringVar(&comment, "comment", "", "comment")
+	rename := &cobra.Command{
+		Use:   "rename STEP NEW-NAME",
+		Short: "Rename a step",
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "PATCH", "/blocking/steps/"+url.PathEscape(args[0]), nil, map[string]any{"name": args[1]})
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	order := &cobra.Command{
+		Use:     "order STEP...",
+		Short:   "Set the order of the steps above normal, lowest first",
+		Example: "  jarl block step order strict very-strict",
+		Args:    cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/steps/order", nil, map[string]any{"steps": args})
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	del := &cobra.Command{
+		Use:   "delete STEP",
+		Short: "Delete a step (refused while lists or groups use it)",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "DELETE", "/blocking/steps/"+url.PathEscape(args[0]), nil, nil)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.AddCommand(list, add, rename, order, del)
+	return cmd
+}
+
+func blockGroupCmd() *cobra.Command {
+	cmd := &cobra.Command{Use: "group", Aliases: []string{"groups"}, Short: "Client groups: blocking steps for some devices",
+		Long: `A client group puts devices at a blocking step: off (only your rules),
+normal, or a step you added ('jarl block step'). Members are addresses,
+prefixes, or ACLs made of them. Devices not in a group are at normal.
+named must see the devices' own addresses (not a router forwarding for
+them), and they need fixed addresses (DHCP reservations).`}
+	list := &cobra.Command{
+		Use:   "list",
+		Short: "List client groups",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var groups []api.ClientGroup
+			if err := c.Get(ctx(), "/blocking/groups", nil, &groups); err != nil {
+				return err
+			}
+			return output(groups, func(w io.Writer) {
+				fmt.Fprintln(w, "GROUP\tSTEP\tMEMBERS\tVIEWS\tCOMMENT")
+				for _, g := range groups {
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", g.Name, g.Step, orDash(strings.Join(g.Members, ", ")), viewsText(g.Views, g.AutoViews), g.Comment)
+				}
+			})
+		},
+	}
+	var step, comment string
+	var views []string
+	add := &cobra.Command{
+		Use:   "add NAME MEMBER...",
+		Short: "Add a client group",
+		Example: `  jarl block group add work 10.10.0.20 --step off
+  jarl block group add kids 10.10.0.50 10.10.0.51 2001:db8:1::/64 --step strict
+  jarl block group add guests guest-net --step normal      # an ACL`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := map[string]any{"name": args[0], "members": args[1:], "comment": comment}
+			if step != "" {
+				body["step"] = step
+			}
+			viewsBody(body, views)
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/groups", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	add.Flags().StringVar(&step, "step", "", "the group's step: off, normal (default) or one you added")
+	add.Flags().StringArrayVar(&views, "view", nil, "a view it applies in (repeat for several; default: every view with blocking)")
+	add.Flags().StringVar(&comment, "comment", "", "comment")
+	var addM, removeM []string
+	var rename string
+	update := &cobra.Command{
+		Use:   "update GROUP",
+		Short: "Change a group's members, step, name, views or comment",
+		Example: `  jarl block group update kids --add 10.10.0.52 --remove 10.10.0.50
+  jarl block group update kids --step very-strict`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := map[string]any{}
+			f := cmd.Flags()
+			if len(addM) > 0 || len(removeM) > 0 {
+				var g api.ClientGroup
+				var all []api.ClientGroup
+				if err := c.Get(ctx(), "/blocking/groups", nil, &all); err != nil {
+					return err
+				}
+				for _, x := range all {
+					if x.Name == strings.ToLower(args[0]) {
+						g = x
+					}
+				}
+				if g.ID == 0 {
+					return fmt.Errorf("client group %s not found", args[0])
+				}
+				drop := map[string]bool{}
+				for _, m := range removeM {
+					drop[m] = true
+				}
+				members := []string{}
+				for _, m := range g.Members {
+					if !drop[m] {
+						members = append(members, m)
+					}
+				}
+				body["members"] = append(members, addM...)
+			}
+			if f.Changed("step") {
+				body["step"] = step
+			}
+			if f.Changed("name") {
+				body["name"] = rename
+			}
+			if f.Changed("comment") {
+				body["comment"] = comment
+			}
+			viewsBody(body, views)
+			if len(body) == 0 {
+				return fmt.Errorf("nothing to change (see --help)")
+			}
+			resp, err := c.Mutate(ctx(), "PATCH", "/blocking/groups/"+url.PathEscape(args[0]), nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	update.Flags().StringArrayVar(&addM, "add", nil, "add a member (repeat for several)")
+	update.Flags().StringArrayVar(&removeM, "remove", nil, "remove a member (repeat for several)")
+	update.Flags().StringVar(&step, "step", "", "new step")
+	update.Flags().StringVar(&rename, "name", "", "new name")
+	update.Flags().StringArrayVar(&views, "view", nil, `a view it applies in (repeat; "auto": every view with blocking)`)
+	update.Flags().StringVar(&comment, "comment", "", "new comment")
+	del := &cobra.Command{
+		Use:   "delete GROUP",
+		Short: "Delete a client group (its devices go back to normal)",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "DELETE", "/blocking/groups/"+url.PathEscape(args[0]), nil, nil)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.AddCommand(list, add, update, del)
+	return cmd
+}
+
+func orDash(s string) string {
+	if s == "" {
+		return "-"
+	}
+	return s
+}
@@ -36,7 +36,7 @@ func viewCmd() *cobra.Command {
 		},
 	}
 	var clients, dests []string
-	var recursiveOnly, comment string
+	var recursiveOnly, comment, exposure string
 	var adopt, cascade, yes bool
 	viewBody := func(cmd *cobra.Command) map[string]any {
 		body := map[string]any{}
@@ -60,6 +60,9 @@ func viewCmd() *cobra.Command {
 		if f.Changed("comment") {
 			body["comment"] = comment
 		}
+		if f.Changed("exposure") {
+			body["exposure"] = exposure
+		}
 		return body
 	}
 	addViewFlags := func(c *cobra.Command) {
@@ -67,6 +70,7 @@ func viewCmd() *cobra.Command {
 		c.Flags().StringSliceVar(&dests, "match-destinations", nil, "match-destinations elements")
 		c.Flags().StringVar(&recursiveOnly, "recursive-only", "", "match-recursive-only: yes, no or default")
 		c.Flags().StringVar(&comment, "comment", "", "comment")
+		c.Flags().StringVar(&exposure, "exposure", "", "reachable from the internet: auto (worked out), public or private (docs/exposure.md)")
 	}
 	create := &cobra.Command{
 		Use:   "create NAME",
@@ -201,7 +205,45 @@ func viewCmd() *cobra.Command {
 			return nil
 		},
 	}
-	cmd.AddCommand(list, create, update, del, order, color)
+	var keyNamed bool
+	key := &cobra.Command{
+		Use:   "key VIEW",
+		Short: "Show the TSIG key that selects a view, to query it from anywhere",
+		Long: `Every view has a TSIG key (jarl-view-NAME) at the front of its
+match-clients: a query signed with it lands in that view, whatever address
+it comes from. Jarl signs its own checks of this server with it; use it to
+see what a view answers:
+
+  jarl view key external                       # shows a ready dig -y command
+  jarl view key external --named-conf > external.key
+  dig -k external.key @SERVER adbraun.lol SOA
+
+Showing it needs tsig:write and is recorded in the audit log.`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var k struct {
+				Name      string `json:"name"`
+				Algorithm string `json:"algorithm"`
+				Secret    string `json:"secret"`
+			}
+			if err := c.Get(ctx(), "/views/"+url.PathEscape(args[0])+"/key", nil, &k); err != nil {
+				return err
+			}
+			if keyNamed {
+				fmt.Printf("key %q {\n\talgorithm %s;\n\tsecret %q;\n};\n", k.Name, k.Algorithm, k.Secret)
+				return nil
+			}
+			return output(k, func(w io.Writer) {
+				fmt.Fprintf(w, "Key:\t%s\nAlgorithm:\t%s\nSecret:\t%s\ndig:\tdig -y %s:%s:%s @SERVER NAME\n", k.Name, k.Algorithm, k.Secret, k.Algorithm, k.Name, k.Secret)
+			})
+		},
+	}
+	key.Flags().BoolVar(&keyNamed, "named-conf", false, "print a key statement (for dig -k FILE)")
+	cmd.AddCommand(list, create, update, del, order, color, key)
 	return cmd
 }

@@ -718,7 +760,7 @@ func settingsCmd() *cobra.Command {
 		},
 	}
 	var ns []string
-	var contact, policy string
+	var contact, policy, srvExposure string
 	var ttl, refresh, retry, expire, neg uint32
 	set := &cobra.Command{
 		Use:   "set",
@@ -739,6 +781,9 @@ func settingsCmd() *cobra.Command {
 			if f.Changed("serial-policy") {
 				body["serial_policy"] = policy
 			}
+			if f.Changed("exposure") {
+				body["exposure"] = srvExposure
+			}
 			for name, v := range map[string]uint32{"ttl": ttl, "refresh": refresh, "retry": retry, "expire": expire, "negative-ttl": neg} {
 				if f.Changed(name) {
 					key := map[string]string{"ttl": "default_ttl", "negative-ttl": "negative_ttl"}[name]
@@ -761,6 +806,7 @@ func settingsCmd() *cobra.Command {
 	set.Flags().StringSliceVar(&ns, "ns", nil, "default name servers")
 	set.Flags().StringVar(&contact, "contact", "", "default SOA contact")
 	set.Flags().StringVar(&policy, "serial-policy", "", "date, increment or unixtime")
+	set.Flags().StringVar(&srvExposure, "exposure", "", "without views: is the server reachable from the internet? auto, public or private (docs/exposure.md)")
 	set.Flags().Uint32Var(&ttl, "ttl", 0, "default TTL")
 	set.Flags().Uint32Var(&refresh, "refresh", 0, "SOA refresh")
 	set.Flags().Uint32Var(&retry, "retry", 0, "SOA retry")
@@ -0,0 +1,339 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+type encEndpoint struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+}
+
+type encStatus struct {
+	Enabled     bool          `json:"enabled"`
+	Certificate string        `json:"certificate"`
+	Hostname    string        `json:"hostname"`
+	DoTHost     string        `json:"dot_host"`
+	DoHURL      string        `json:"doh_url"`
+	DoT         []encEndpoint `json:"dot"`
+	DoH         []encEndpoint `json:"doh"`
+	Other       bool          `json:"other"`
+	Addresses   []struct {
+		Address string `json:"address"`
+		Private bool   `json:"private"`
+	} `json:"addresses"`
+	Views []struct {
+		Name    string `json:"name"`
+		Public  bool   `json:"public"`
+		HasZone bool   `json:"has_zone"`
+	} `json:"views"`
+	Certificates []struct {
+		Name     string   `json:"name"`
+		Names    []string `json:"names"`
+		Domains  []string `json:"domains"`
+		DNS      bool     `json:"dns"`
+		Obtained bool     `json:"obtained"`
+	} `json:"certificates"`
+}
+
+type encConflict struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+	What    string `json:"what"`
+}
+
+func endpoints(es []encEndpoint) string {
+	var out []string
+	for _, e := range es {
+		out = append(out, fmt.Sprintf("%s port %d", e.Address, e.Port))
+	}
+	return strings.Join(out, ", ")
+}
+
+func encryptedDNSCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "encrypted-dns",
+		Aliases: []string{"encdns"},
+		Short:   "DNS over TLS and HTTPS for your clients (docs/encrypted-dns.md)",
+		Long: `Shows whether named serves DNS over TLS (DoT) and DNS over HTTPS (DoH),
+where, and what to give clients. 'setup' sets it up: a certificate for the
+host name (obtained if needed), named's tls statement and listeners on the
+addresses you choose, and the host name's address records in your private
+views.`,
+		Example: `  jarl encrypted-dns
+  jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 --address 2a02:8013:7f3d:10::5
+  jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 --no-doh
+  jarl encrypted-dns check --address 10.0.10.5 --doh-port 443
+  jarl encrypted-dns disable`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var s encStatus
+			if err := c.Get(ctx(), "/encrypted-dns", nil, &s); err != nil {
+				return err
+			}
+			return output(s, func(w io.Writer) {
+				if !s.Enabled {
+					fmt.Fprintln(w, "Encrypted DNS:\toff (jarl encrypted-dns setup --hostname NAME --address ADDR)")
+				} else {
+					fmt.Fprintf(w, "Certificate:\t%s\n", s.Certificate)
+					if len(s.DoT) > 0 {
+						fmt.Fprintf(w, "DNS over TLS:\t%s\n", endpoints(s.DoT))
+					}
+					if len(s.DoH) > 0 {
+						fmt.Fprintf(w, "DNS over HTTPS:\t%s\n", endpoints(s.DoH))
+					}
+					if s.DoTHost != "" {
+						fmt.Fprintf(w, "For DoT clients:\t%s   (Android: Private DNS hostname; Linux: DNS=ADDRESS#%s, DNSOverTLS=yes)\n", s.DoTHost, s.Hostname)
+					}
+					if s.DoHURL != "" {
+						fmt.Fprintf(w, "For DoH clients:\t%s   (Firefox, Chrome, Windows 11)\n", s.DoHURL)
+					}
+				}
+				if s.Other {
+					fmt.Fprintln(w, "Note:\tnamed has DoT or DoH listeners written by hand too; setup leaves them alone")
+				}
+				var addrs []string
+				for _, a := range s.Addresses {
+					t := a.Address
+					if !a.Private {
+						t += " (public)"
+					}
+					addrs = append(addrs, t)
+				}
+				fmt.Fprintf(w, "This server's addresses:\t%s\n", strings.Join(addrs, ", "))
+			})
+		},
+	}
+	var host, certName string
+	var addrs, views []string
+	var noDoT, noDoH bool
+	var dohPort, dotPort int
+	setup := &cobra.Command{
+		Use:   "setup --hostname NAME --address ADDR...",
+		Short: "Set up DNS over TLS and HTTPS (obtaining a certificate if needed)",
+		Long: `Sets up DoT (port 853) and DoH (port 443, or --doh-port) on the addresses
+given, which should be this server's addresses on your own networks:
+
+  - the certificate: --certificate, or one with the dns use whose names
+    cover the host name, or a new one Jarl obtains for it (and waits for);
+  - a check that nothing else listens on those ports there;
+  - named's tls statement and listen-on statements (and an explicit
+    listen-on { any; } when there was none, as the first listen-on would
+    otherwise stop named listening on port 53 everywhere);
+  - the host name's A and AAAA records, in the private views that have its
+    zone (or --view), local to the view when the zone is linked.
+
+It is one change, staged or applied like any other. Running it again
+replaces the earlier setup.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			host = strings.ToLower(strings.TrimSuffix(host, "."))
+			if host == "" {
+				return errors.New("give --hostname, the name clients connect to (e.g. dns.adbraun.lol)")
+			}
+			var s encStatus
+			if err := c.Get(ctx(), "/encrypted-dns", q("hostname", host), &s); err != nil {
+				return err
+			}
+			if len(addrs) == 0 {
+				var list []string
+				for _, a := range s.Addresses {
+					list = append(list, a.Address)
+				}
+				return fmt.Errorf("give --address (this server's addresses on your own networks); it has %s", strings.Join(list, ", "))
+			}
+			// The certificate.
+			if certName == "" {
+				for _, ci := range s.Certificates {
+					if coversName(append(ci.Names, ci.Domains...), host) {
+						certName = ci.Name
+						break
+					}
+				}
+			}
+			if certName == "" {
+				certName = strings.SplitN(host, ".", 2)[0]
+				fmt.Printf("Creating certificate %s for %s\n", certName, host)
+				var r struct {
+					Certificate certInfo `json:"certificate"`
+				}
+				if err := c.Do(ctx(), "POST", "/certificates", nil, map[string]any{"name": certName, "domains": []string{host}, "uses": []string{"dns"}}, &r); err != nil {
+					return err
+				}
+				if err := waitIssue(c, certName); err != nil {
+					return err
+				}
+			} else {
+				var ci certInfo
+				if err := c.Get(ctx(), certPath(certName), nil, &ci); err != nil {
+					return err
+				}
+				if !contains(ci.Uses, "dns") {
+					fmt.Printf("Adding the dns use to certificate %s\n", certName)
+					if err := c.Do(ctx(), "PATCH", certPath(certName), nil, map[string]any{"uses": append(ci.Uses, "dns")}, nil); err != nil {
+						return err
+					}
+				}
+				if ci.NotAfter == nil {
+					if ci.IssuingSince == nil {
+						if err := c.Do(ctx(), "POST", certPath(certName)+"/issue", nil, map[string]any{}, nil); err != nil {
+							return err
+						}
+					}
+					if err := waitIssue(c, certName); err != nil {
+						return err
+					}
+				}
+			}
+			body := map[string]any{"hostname": host, "certificate": certName, "addresses": addrs, "dot": !noDoT, "doh": !noDoH}
+			if cmd.Flags().Changed("doh-port") {
+				body["doh_port"] = dohPort
+			}
+			if cmd.Flags().Changed("dot-port") {
+				body["dot_port"] = dotPort
+			}
+			// Nothing else may listen there.
+			var chk struct {
+				Conflicts   []encConflict `json:"conflicts"`
+				FreeDoHPort int           `json:"free_doh_port"`
+				Error       string        `json:"error"`
+			}
+			if err := c.Do(ctx(), "POST", "/encrypted-dns/check", nil, body, &chk); err != nil {
+				return err
+			}
+			if len(chk.Conflicts) > 0 {
+				var msgs []string
+				for _, cf := range chk.Conflicts {
+					msgs = append(msgs, fmt.Sprintf("%s listens on %s port %d", cf.What, cf.Address, cf.Port))
+				}
+				hint := ""
+				if chk.FreeDoHPort != 0 && !noDoH {
+					hint = fmt.Sprintf("; for DoH, port %d is free there (--doh-port %d)", chk.FreeDoHPort, chk.FreeDoHPort)
+				}
+				return fmt.Errorf("%s%s", strings.Join(msgs, "; "), hint)
+			}
+			if chk.Error != "" && !flagQuiet {
+				fmt.Println("Note:", chk.Error)
+			}
+			if len(views) == 0 {
+				for _, v := range s.Views {
+					if !v.Public && v.HasZone {
+						views = append(views, v.Name)
+					}
+				}
+			}
+			body["views"] = views
+			resp, err := c.Mutate(ctx(), "POST", "/encrypted-dns", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	f := setup.Flags()
+	f.StringVar(&host, "hostname", "", "the name clients connect to (the certificate's)")
+	f.StringVar(&certName, "certificate", "", "the Jarl certificate to serve (default: one for the host name, obtained if there is none)")
+	f.StringArrayVar(&addrs, "address", nil, "this server's address to listen on (repeat for several)")
+	f.BoolVar(&noDoT, "no-dot", false, "no DNS over TLS")
+	f.BoolVar(&noDoH, "no-doh", false, "no DNS over HTTPS")
+	f.IntVar(&dohPort, "doh-port", 443, "port for DNS over HTTPS")
+	f.IntVar(&dotPort, "dot-port", 853, "port for DNS over TLS (clients expect 853)")
+	f.StringArrayVar(&views, "view", nil, "views to add the host name's records to (default: the private views that have its zone)")
+
+	var cAddrs []string
+	var cDoH int
+	check := &cobra.Command{
+		Use:   "check --address ADDR...",
+		Short: "See whether something already listens on the DoT and DoH ports",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				Conflicts   []encConflict `json:"conflicts"`
+				FreeDoHPort int           `json:"free_doh_port"`
+				Error       string        `json:"error"`
+			}
+			if err := c.Do(ctx(), "POST", "/encrypted-dns/check", nil, map[string]any{"addresses": cAddrs, "dot": true, "doh": true, "doh_port": cDoH}, &r); err != nil {
+				return err
+			}
+			return output(r, func(w io.Writer) {
+				if r.Error != "" {
+					fmt.Fprintln(w, r.Error)
+				}
+				if len(r.Conflicts) == 0 {
+					fmt.Fprintln(w, "The ports are free.")
+				}
+				for _, cf := range r.Conflicts {
+					fmt.Fprintf(w, "%s port %d:\t%s listens there\n", cf.Address, cf.Port, cf.What)
+				}
+				if r.FreeDoHPort != 0 {
+					fmt.Fprintf(w, "Free for DoH:\tport %d\n", r.FreeDoHPort)
+				}
+			})
+		},
+	}
+	check.Flags().StringArrayVar(&cAddrs, "address", nil, "address to check (repeat for several)")
+	check.Flags().IntVar(&cDoH, "doh-port", 443, "port for DNS over HTTPS")
+
+	disable := &cobra.Command{
+		Use:   "disable",
+		Short: "Turn DNS over TLS and HTTPS off (the certificate and records stay)",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "DELETE", "/encrypted-dns", url.Values{}, nil)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.AddCommand(setup, check, disable)
+	return cmd
+}
+
+// coversName reports whether certificate names cover host (a wildcard
+// covers one label).
+func coversName(names []string, host string) bool {
+	for _, n := range names {
+		n = strings.ToLower(strings.TrimSuffix(n, "."))
+		if n == host {
+			return true
+		}
+		if base, ok := strings.CutPrefix(n, "*."); ok {
+			if _, rest, ok := strings.Cut(host, "."); ok && rest == base {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func contains(list []string, s string) bool {
+	for _, x := range list {
+		if x == s {
+			return true
+		}
+	}
+	return false
+}
@@ -0,0 +1,98 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+
+	"jarl/internal/api"
+	"jarl/internal/client"
+	"jarl/internal/model"
+)
+
+// A changeset given with --changeset is used as given (jarld still refuses
+// what isn't allowed). One taken from JARL_CHANGESET is checked first: an
+// exported ID outlives the changeset (it gets applied), and changeset IDs
+// keep growing, so a stale or mistyped one can name someone else's
+// changeset later. It is used only when it is open and the caller's own,
+// and the CLI says on stderr which changeset that is.
+
+// envChangeset returns the changeset in JARL_CHANGESET (0 if unset).
+func envChangeset() (int64, error) {
+	v := os.Getenv("JARL_CHANGESET")
+	if v == "" {
+		return 0, nil
+	}
+	n, err := strconv.ParseInt(v, 10, 64)
+	if err != nil || n <= 0 {
+		return 0, fmt.Errorf("invalid JARL_CHANGESET %q", v)
+	}
+	return n, nil
+}
+
+// checkEnvChangeset checks the changeset id from JARL_CHANGESET before it
+// is used. With mustOwn, it must also be open and the caller's own (for
+// staging into it, applying or discarding it).
+func checkEnvChangeset(c *client.Client, id int64, mustOwn bool) (*api.Changeset, error) {
+	var cs api.Changeset
+	if err := c.Get(ctx(), fmt.Sprintf("/changesets/%d", id), nil, &cs); err != nil {
+		var ce *client.Error
+		if errors.As(err, &ce) && ce.Status == 404 {
+			return nil, fmt.Errorf("JARL_CHANGESET is %d, but there is no changeset %d: start one with 'export JARL_CHANGESET=$(jarl changeset create -q)', or 'unset JARL_CHANGESET' to make changes live", id, id)
+		}
+		return nil, err
+	}
+	if mustOwn {
+		if cs.Status != model.ChangesetOpen {
+			return nil, fmt.Errorf("JARL_CHANGESET is %d, but changeset %d is %s: 'unset JARL_CHANGESET' to make changes live, or start a new one with 'export JARL_CHANGESET=$(jarl changeset create -q)'", id, id, cs.Status)
+		}
+		var me api.Whoami
+		if err := c.Get(ctx(), "/auth/whoami", nil, &me); err != nil {
+			return nil, err
+		}
+		mine := cs.UserID == me.User.ID && (me.User.ID != 0 || cs.Username == me.User.Username)
+		if !mine {
+			return nil, fmt.Errorf("JARL_CHANGESET is %d, but changeset %d is %s's (made via %s), not yours, so it isn't used from JARL_CHANGESET; give it as -C %d to use it anyway, or 'unset JARL_CHANGESET'", id, id, cs.Username, cs.Via, id)
+		}
+	}
+	if !flagQuiet {
+		desc := cs.Description
+		if desc == "" {
+			desc = "no description"
+		}
+		fmt.Fprintf(os.Stderr, "changeset %d (%s, %d operations) from JARL_CHANGESET\n", id, desc, len(cs.Ops))
+	}
+	return &cs, nil
+}
+
+// changesetArg returns the changeset a changeset subcommand works on: the
+// ID argument, else --changeset, else JARL_CHANGESET (checked; mustOwn as
+// for checkEnvChangeset). fromEnv says it came from JARL_CHANGESET.
+func changesetArg(c *client.Client, args []string, mustOwn bool) (id string, fromEnv bool, err error) {
+	if len(args) > 0 {
+		return args[0], false, nil
+	}
+	if flagChangeset > 0 {
+		return strconv.FormatInt(flagChangeset, 10), false, nil
+	}
+	n, err := envChangeset()
+	if err != nil {
+		return "", false, err
+	}
+	if n == 0 {
+		return "", false, errors.New("which changeset? Give its ID, or set JARL_CHANGESET (export JARL_CHANGESET=$(jarl changeset create -q))")
+	}
+	if _, err := checkEnvChangeset(c, n, mustOwn); err != nil {
+		return "", false, err
+	}
+	return strconv.FormatInt(n, 10), true, nil
+}
+
+// envChangesetDone reminds that JARL_CHANGESET still names a changeset
+// that was just applied or discarded: later changes would fail to stage.
+func envChangesetDone(id, what string) {
+	if !flagQuiet {
+		fmt.Fprintf(os.Stderr, "JARL_CHANGESET still names changeset %s, which is now %s: run 'unset JARL_CHANGESET' (or export a new one) before making more changes\n", id, what)
+	}
+}
@@ -0,0 +1,191 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+type exposureFinding struct {
+	Severity string `json:"severity"`
+	Code     string `json:"code"`
+	Message  string `json:"message"`
+	View     string `json:"view"`
+	Fix      string `json:"fix"`
+}
+
+type exposureReport struct {
+	Scopes []struct {
+		ViewID    int64             `json:"view_id"`
+		View      string            `json:"view"`
+		Public    bool              `json:"public"`
+		Override  string            `json:"override"`
+		Reason    string            `json:"reason"`
+		RateLimit string            `json:"rate_limit"`
+		Findings  []exposureFinding `json:"findings"`
+	} `json:"scopes"`
+	Server       []exposureFinding `json:"server"`
+	RateLimiting *struct {
+		Since  string `json:"since"`
+		Counts []struct {
+			Key   string
+			Count int64
+		} `json:"counts"`
+		Networks []struct {
+			Key   string
+			Count int64
+		} `json:"networks"`
+		Names []struct {
+			Key   string
+			Count int64
+		} `json:"names"`
+	} `json:"rate_limiting"`
+}
+
+// exposureScope turns "server" (or "") into the server, anything else
+// into a view name.
+func exposureScope(s string) map[string]any {
+	if s == "" || strings.EqualFold(s, "server") {
+		return map[string]any{}
+	}
+	return map[string]any{"view": s}
+}
+
+func exposureCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "exposure",
+		Short: "What is reachable from the internet, and what to harden (docs/exposure.md)",
+		Long: `Shows which views (or the server, without views) are reachable from the
+internet and why, their rate limiting, and the exposure findings with the
+fix Jarl can stage for each.`,
+		Example: `  jarl exposure
+  jarl exposure fix external exposure_rate_limit          # rate limiting, log-only first
+  jarl exposure fix external exposure_rate_limit_log_only # then start enforcing
+  jarl exposure fix server exposure_version
+  jarl exposure ack external security_open_resolver --reason "public resolver for the club"
+  jarl view update external --exposure public             # override the classification`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r exposureReport
+			if err := c.Get(ctx(), "/exposure", nil, &r); err != nil {
+				return err
+			}
+			return output(r, func(w io.Writer) {
+				fmt.Fprintln(w, "VIEW\tEXPOSURE\tRATE LIMIT\tWHY")
+				for _, s := range r.Scopes {
+					name, exp := s.View, "private"
+					if name == "" {
+						name = "(server)"
+					}
+					if s.Public {
+						exp = "public"
+					}
+					if s.Override != "" {
+						exp += " (set)"
+					}
+					rl := s.RateLimit
+					if !s.Public && rl == "off" {
+						rl = "-"
+					}
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", name, exp, rl, s.Reason)
+				}
+				var all []exposureFinding
+				for _, s := range r.Scopes {
+					all = append(all, s.Findings...)
+				}
+				all = append(all, r.Server...)
+				fmt.Fprintln(w)
+				if len(all) == 0 {
+					fmt.Fprintln(w, "No findings.")
+				} else {
+					fmt.Fprintln(w, "SEVERITY\tWHERE\tCODE\tFINDING")
+					for _, f := range all {
+						where := f.View
+						if where == "" {
+							where = "server"
+						}
+						fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", f.Severity, where, f.Code, f.Message)
+						if f.Fix != "" {
+							fmt.Fprintf(w, "\t\t\tfix: jarl exposure fix %s %s (%s)\n", where, f.Code, f.Fix)
+						}
+					}
+				}
+				if a := r.RateLimiting; a != nil && len(a.Counts) > 0 {
+					fmt.Fprintf(w, "\nRATE LIMITING, LAST %s\n", a.Since)
+					for _, e := range a.Counts {
+						fmt.Fprintf(w, "%s\t%d\n", e.Key, e.Count)
+					}
+					for _, e := range a.Networks {
+						fmt.Fprintf(w, "network %s\t%d\n", e.Key, e.Count)
+					}
+					for _, e := range a.Names {
+						fmt.Fprintf(w, "name %s\t%d\n", e.Key, e.Count)
+					}
+				}
+			})
+		},
+	}
+	fix := &cobra.Command{
+		Use:   "fix VIEW|server CODE",
+		Short: "Stage (or apply) the fix Jarl suggests for a finding",
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := exposureScope(args[0])
+			body["code"] = args[1]
+			resp, err := c.Mutate(ctx(), "POST", "/exposure/fix", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	var reason string
+	ack := &cobra.Command{
+		Use:   "ack VIEW|server CODE --reason TEXT",
+		Short: "Accept a finding on purpose: it stays, as info, with who and why",
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := exposureScope(args[0])
+			body["code"], body["reason"] = args[1], reason
+			resp, err := c.Mutate(ctx(), "POST", "/exposure/ack", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	ack.Flags().StringVar(&reason, "reason", "", "why the finding is accepted (required)")
+	unack := &cobra.Command{
+		Use:   "unack VIEW|server CODE",
+		Short: "Take an acknowledgement back: the finding warns again",
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := exposureScope(args[0])
+			body["code"] = args[1]
+			resp, err := c.Mutate(ctx(), "POST", "/exposure/unack", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.AddCommand(fix, ack, unack)
+	return cmd
+}
@@ -13,7 +13,6 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
-	"strconv"
 	"strings"
 	"sync"
 	"text/tabwriter"
@@ -48,6 +47,7 @@ var (
 	flagChangeset int64
 	flagDryRun    bool
 	flagForce     bool
+	flagRisk      bool
 	flagOutput    string
 	flagInsecure  bool
 	flagCACert    string
@@ -149,15 +149,21 @@ func newClient() (*client.Client, error) {
 	}
 	c.Changeset = flagChangeset
 	if c.Changeset == 0 {
-		if v := os.Getenv("JARL_CHANGESET"); v != "" {
-			n, err := strconv.ParseInt(v, 10, 64)
-			if err != nil {
-				return nil, fmt.Errorf("invalid JARL_CHANGESET %q", v)
-			}
+		n, err := envChangeset()
+		if err != nil {
+			return nil, err
+		}
+		if n > 0 {
+			// Checked when a change is first staged into it
+			// (envchangeset.go).
 			c.Changeset = n
+			c.CheckChangeset = func(context.Context) error {
+				_, err := checkEnvChangeset(c, n, true)
+				return err
+			}
 		}
 	}
-	c.DryRun, c.Force = flagDryRun || c.Preflight, flagForce
+	c.DryRun, c.Force, c.AcceptRisk = flagDryRun || c.Preflight, flagForce, flagRisk
 	if !c.Preflight {
 		c.OnTokenExpiry = tokenExpiryWarning(t.Name)
 	}
@@ -239,6 +245,7 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 	pf.Int64VarP(&flagChangeset, "changeset", "C", 0, "stage changes into this changeset instead of applying them (env JARL_CHANGESET)")
 	pf.BoolVarP(&flagDryRun, "dry-run", "n", false, "validate and show the changes without applying them")
 	pf.BoolVar(&flagForce, "force", false, "overwrite BIND files that were changed outside Jarl")
+	pf.BoolVar(&flagRisk, "accept-risk", false, "confirm a change that opens a public view up, such as an open resolver (docs/exposure.md)")
 	pf.StringVarP(&flagOutput, "output", "o", "table", "output format: table, json, yaml, id (just the IDs) or field=NAME[,NAME...] (just those fields, e.g. field=view or field=soa.serial)")
 	pf.BoolVar(&flagInsecure, "insecure", false, "don't verify the server's TLS certificate")
 	pf.StringVar(&flagCACert, "ca-cert", "", "PEM file with a CA to trust for the server's certificate")
@@ -252,7 +259,7 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 	}
 	add("dns", zoneCmd(), recordCmd(), viewCmd(), aclCmd(), tsigCmd(), optionCmd(), settingsCmd(), blockCmd(), blocklistCmd(), acmeCmd(), searchCmd(), statsCmd())
 	add("changes", applyCmd(), changesetCmd(), historyCmd())
-	add("admin", statusCmd(), whoamiCmd(), userCmd(), tokenCmd(), auditCmd(), checkCmd(), resyncCmd(), configCmd())
+	add("admin", statusCmd(), exposureCmd(), certCmd(), encryptedDNSCmd(), whoamiCmd(), userCmd(), tokenCmd(), auditCmd(), checkCmd(), resyncCmd(), configCmd())
 	setupCompletion(root)
 	return root
 }
@@ -530,6 +537,18 @@ func report(resp *api.MutationResponse) error {
 		json.Unmarshal(resp.Problems, &introduced)
 	}
 	printProblems(os.Stderr, introduced)
+	// named-checkconf's own warnings about the new configuration.
+	if r != nil && (resp.Applied || resp.DryRun) {
+		for _, m := range r.Check {
+			if !m.Error && !strings.HasPrefix(m.Text, "loaded serial") && m.Text != "OK" {
+				where := ""
+				if m.Object != "" {
+					where = " (" + m.Object + ")"
+				}
+				fmt.Fprintf(os.Stderr, "warning: named-checkconf: %s%s\n", m.Text, where)
+			}
+		}
+	}
 	for _, warn := range resp.Warnings {
 		fmt.Fprintln(os.Stderr, "warning:", warn)
 	}
@@ -0,0 +1,127 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"jarl/internal/api"
+	"jarl/internal/client"
+)
+
+// zoneViews expands a --view value for a record command: "" or one view
+// as it is, "a,b" to those views, and "all" to every view that has the
+// zone.
+// localFanOut is set by commands making local changes (--local), which
+// go to every view named even when the zones are linked.
+var localFanOut bool
+
+func zoneViews(c *client.Client, zone, view string) ([]string, error) {
+	if view != "all" && !strings.Contains(view, ",") {
+		return []string{view}, nil
+	}
+	var zones []api.Zone
+	if err := c.Get(ctx(), "/zones", nil, &zones); err != nil {
+		return nil, err
+	}
+	want := strings.ToLower(strings.TrimSuffix(zone, "."))
+	link := map[string]int64{}
+	var out []string
+	for _, z := range zones {
+		if strings.ToLower(strings.TrimSuffix(z.Display, ".")) == want && z.View != "" {
+			link[z.View] = z.LinkGroup
+			if view == "all" {
+				out = append(out, z.View)
+			}
+		}
+	}
+	if view != "all" {
+		for _, v := range strings.Split(view, ",") {
+			if v = strings.TrimSpace(v); v != "" {
+				out = append(out, v)
+			}
+		}
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("zone %s is in no view", zone)
+	}
+	// Linked zones (docs/views.md#linked-zones) get a shared change once:
+	// Jarl copies it to the others. A local change goes to each.
+	if localFanOut {
+		return out, nil
+	}
+	var dedup []string
+	first := map[int64]string{}
+	for _, v := range out {
+		g := link[v]
+		if g != 0 {
+			if f, ok := first[g]; ok {
+				if !flagQuiet {
+					fmt.Fprintf(os.Stderr, "view %s: linked with %s, so it gets the change from there\n", v, f)
+				}
+				continue
+			}
+			first[g] = v
+		}
+		dedup = append(dedup, v)
+	}
+	return dedup, nil
+}
+
+// perView runs a record command once per view. With several views, the
+// changes are staged into one changeset and applied together, so either
+// every view gets the change or none does (with --changeset, they are
+// staged there).
+//
+// do returns the server's response, or nil when there was nothing to do.
+func perView(c *client.Client, views []string, description string, do func(c *client.Client, view string) (*api.MutationResponse, error)) error {
+	if len(views) == 1 || c.Changeset > 0 {
+		for _, v := range views {
+			resp, err := do(c, v)
+			if err != nil {
+				if len(views) > 1 {
+					err = fmt.Errorf("view %s: %w", v, err)
+				}
+				return err
+			}
+			if resp != nil {
+				if err := report(resp); err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	}
+	var cs api.Changeset
+	if err := c.Do(ctx(), "POST", "/changesets", nil, map[string]any{"description": description + " (views " + strings.Join(views, ", ") + ")"}, &cs); err != nil {
+		return err
+	}
+	discard := func() { c.Do(ctx(), "POST", fmt.Sprintf("/changesets/%d/discard", cs.ID), nil, nil, nil) }
+	staging := *c
+	staging.Changeset, staging.DryRun = cs.ID, false
+	staged := 0
+	for _, v := range views {
+		resp, err := do(&staging, v)
+		if err != nil {
+			discard()
+			fmt.Fprintf(os.Stderr, "view %s failed, so nothing was changed in any view\n", v)
+			return err
+		}
+		if resp != nil {
+			staged++
+		}
+	}
+	if staged == 0 {
+		discard()
+		return nil
+	}
+	var resp api.MutationResponse
+	err := c.Do(ctx(), "POST", fmt.Sprintf("/changesets/%d/apply", cs.ID), nil, map[string]any{"force": c.Force, "dry_run": c.DryRun, "accept_risk": c.AcceptRisk}, &resp)
+	if err != nil || c.DryRun {
+		discard()
+	}
+	if err != nil {
+		return err
+	}
+	return report(&resp)
+}
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"math"
+	"net/url"
 	"slices"
 	"strconv"
 	"strings"
@@ -21,8 +22,22 @@ func statsCmd() *cobra.Command {
 		Long: `Query statistics collected from named (see docs/stats.md). They must be
 enabled in /etc/jarl/jarl.yaml (stats.enabled: true).

-Ranges are given with --since: 90m, 24h, 7d, 2w. Use -o json or -o yaml to
-export the data.`,
+Ranges are given with --since: 90m, 24h, 7d, 2w. --view limits the figures
+to some views (repeat it, or separate with commas): answers from named's
+response log, per view; named's own counters stay for the whole server.
+Use -o json or -o yaml to export the data.`,
+	}
+	var statsViews []string
+	cmd.PersistentFlags().StringSliceVar(&statsViews, "view", nil, "only these views (repeat, or comma separated)")
+	// withViews adds the --view filter to a query.
+	withViews := func(v url.Values) url.Values {
+		if len(statsViews) > 0 {
+			if v == nil {
+				v = url.Values{}
+			}
+			v.Set("views", strings.Join(statsViews, ","))
+		}
+		return v
 	}
 	// Each command has its own --since variable: their defaults differ, and
 	// a shared variable would take the last default for all of them.
@@ -77,14 +92,27 @@ export the data.`,
 				return err
 			}
 			var s stats.Summary
-			if err := c.Get(ctx(), "/stats/summary", q("since", summarySince, "top", strconv.Itoa(topN)), &s); err != nil {
+			if err := c.Get(ctx(), "/stats/summary", withViews(q("since", summarySince, "top", strconv.Itoa(topN))), &s); err != nil {
 				return err
 			}
 			return output(s, func(w io.Writer) {
 				fmt.Fprintf(w, "Range:\t%s to %s\n", s.From.Local().Format("2006-01-02 15:04"), s.To.Local().Format("2006-01-02 15:04"))
-				fmt.Fprintf(w, "Queries:\t%d (%.2f per second on average)\n", s.Queries, s.AvgQPS)
+				if len(s.FilterViews) > 0 {
+					since := ""
+					if s.ViewsSince != nil {
+						since = ", per view since " + s.ViewsSince.Local().Format("2006-01-02 15:04")
+					}
+					fmt.Fprintf(w, "Views:\t%s (from the response log%s; named's own counters are left out)\n", strings.Join(s.FilterViews, ", "), since)
+					fmt.Fprintf(w, "Answers:\t%d (%.2f per second on average)\n", s.Queries, s.AvgQPS)
+				} else {
+					fmt.Fprintf(w, "Queries:\t%d (%.2f per second on average)\n", s.Queries, s.AvgQPS)
+				}
 				if s.Peak != nil {
-					fmt.Fprintf(w, "Busiest %s:\t%s with %d queries\n", s.Peak.Per, s.Peak.Time.Local().Format("2006-01-02 15:04"), s.Peak.Queries)
+					what := "queries"
+					if len(s.FilterViews) > 0 {
+						what = "answers"
+					}
+					fmt.Fprintf(w, "Busiest %s:\t%s with %d %s\n", s.Peak.Per, s.Peak.Time.Local().Format("2006-01-02 15:04"), s.Peak.Queries, what)
 				}
 				if s.CacheHitRatio != nil {
 					fmt.Fprintf(w, "Cache hit ratio:\t%.1f%%\n", *s.CacheHitRatio*100)
@@ -128,13 +156,15 @@ export the data.`,

 	var limit int
 	top := &cobra.Command{
-		Use:   "top [names|clients|nxdomain|servfail|refused|blocked]",
+		Use:   "top [names|clients|nxdomain|servfail|refused|blocked|blocked-clients|ratelimited|ratelimited-names]",
 		Short: "The most queried names, busiest clients, names with errors, refused clients, blocked names",
 		Example: `  jarl stats top names --since 7d
  jarl stats top clients --limit 50
  jarl stats top nxdomain      # misconfigured hosts and typos
  jarl stats top refused       # who is asking for what they may not have
-  jarl stats top blocked       # what blocking stops most (docs/blocking.md)`,
+  jarl stats top blocked       # what blocking stops most (docs/blocking.md)
+  jarl stats top blocked-clients   # the devices blocking stops most
+  jarl stats top ratelimited       # client networks rate limiting limits, or would (docs/exposure.md)`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			kind := stats.KindName
@@ -143,13 +173,19 @@ export the data.`,
 				if kind == "nxdomain" || kind == "servfail" {
 					kind = strings.ToLower(args[0])
 				}
+				if kind == "blocked-client" {
+					kind = stats.KindBlockedClient
+				}
+				if kind == "ratelimited-name" {
+					kind = stats.KindRateLimitedName
+				}
 			}
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
 			var es []stats.Entry
-			if err := c.Get(ctx(), "/stats/top", q("kind", kind, "since", topSince, "limit", strconv.Itoa(limit)), &es); err != nil {
+			if err := c.Get(ctx(), "/stats/top", withViews(q("kind", kind, "since", topSince, "limit", strconv.Itoa(limit))), &es); err != nil {
 				return err
 			}
 			return output(es, func(w io.Writer) {
@@ -157,7 +193,7 @@ export the data.`,
 				for _, e := range es {
 					total += e.Count
 				}
-				head := map[string]string{stats.KindClient: "CLIENT", stats.KindRefused: "CLIENT"}[kind]
+				head := map[string]string{stats.KindClient: "CLIENT", stats.KindRefused: "CLIENT", stats.KindBlockedClient: "CLIENT"}[kind]
 				if head == "" {
 					head = "NAME"
 				}
@@ -199,7 +235,7 @@ export the data.`,
 				qv.Add("key", k)
 			}
 			var tl stats.Timeline
-			if err := c.Get(ctx(), "/stats/timeline", qv, &tl); err != nil {
+			if err := c.Get(ctx(), "/stats/timeline", withViews(qv), &tl); err != nil {
 				return err
 			}
 			return output(tl, func(w io.Writer) {
@@ -248,7 +284,7 @@ export the data.`,
 				return err
 			}
 			var hm stats.Heatmap
-			if err := c.Get(ctx(), "/stats/heatmap", q("since", heatmapSince, "key", hmKey), &hm); err != nil {
+			if err := c.Get(ctx(), "/stats/heatmap", withViews(q("since", heatmapSince, "key", hmKey)), &hm); err != nil {
 				return err
 			}
 			return output(hm, func(w io.Writer) {
@@ -300,7 +336,7 @@ export the data.`,
 				return err
 			}
 			var es []stats.Entry
-			if err := c.Get(ctx(), "/stats/breakdown", q("group", args[0], "since", breakdownSince), &es); err != nil {
+			if err := c.Get(ctx(), "/stats/breakdown", withViews(q("group", args[0], "since", breakdownSince)), &es); err != nil {
 				return err
 			}
 			return output(es, func(w io.Writer) {
@@ -321,7 +357,61 @@ export the data.`,
 	}
 	sinceFlag(breakdown, &breakdownSince, "24h", sinceHelp)

-	cmd.AddCommand(status, summary, top, timeline, heatmap, breakdown)
+	server := &cobra.Command{
+		Use:   "server",
+		Short: "Show named's memory, CPU, cache and clients, the host's memory and load, and free disk space",
+		Long: `Server statistics, sampled once a minute: named's memory and CPU use,
+cache size, recursive and TCP clients against their limits, the host's
+memory and load, and the space left where zone files, logs and Jarl's
+data are. Memory and CPU over time: 'jarl stats timeline --key
+g:named:rss,g:named:cpu' (averages; CPU in tenths of a percent).`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var resp struct {
+				Server     *stats.Server     `json:"server"`
+				Named      map[string]string `json:"named,omitempty"`
+				NamedError string            `json:"named_error,omitempty"`
+				Disks      []stats.Disk      `json:"disks"`
+			}
+			if err := c.Get(ctx(), "/stats/server", nil, &resp); err != nil {
+				return err
+			}
+			return output(resp, func(w io.Writer) {
+				s := resp.Server
+				if s == nil {
+					fmt.Fprintln(w, "No sample yet:\tthe first is taken a minute after jarl starts")
+					return
+				}
+				fmt.Fprintf(w, "named:\t%s, up since %s, reconfigured %s\n", s.Version, isoLocal(s.BootTime), isoLocal(s.ConfigTime))
+				if s.PID > 0 {
+					fmt.Fprintf(w, "Memory:\t%s resident (named counts %s), %d threads, PID %d\n", sizeStr(s.RSS), sizeStr(s.MemInUse), s.Threads, s.PID)
+					fmt.Fprintf(w, "CPU:\t%.1f%% of one CPU over the last minute\n", s.CPUPercent)
+				} else {
+					fmt.Fprintf(w, "Memory:\tnamed counts %s (its process isn't visible to jarld)\n", sizeStr(s.MemInUse))
+				}
+				fmt.Fprintf(w, "Cache:\t%d RRsets, %s\n", s.CacheRRsets, sizeStr(s.CacheMem))
+				if n := resp.Named; n != nil {
+					fmt.Fprintf(w, "Recursive clients:\t%s (now/soft limit/limit), most at once %d\n", n["recursive_clients"], s.RecursionHighwater)
+					fmt.Fprintf(w, "TCP clients:\t%s (now/limit), most at once %d\n", n["tcp_clients"], s.TCPHighwater)
+				} else if resp.NamedError != "" {
+					fmt.Fprintf(w, "Clients:\tunknown: %s\n", resp.NamedError)
+				}
+				fmt.Fprintf(w, "Sockets:\t%d UDP, %d TCP\n", s.SocketsUDP, s.SocketsTCP)
+				if h := s.Host; h != nil && h.MemTotal > 0 {
+					fmt.Fprintf(w, "Host:\t%s of %s memory in use, load %v, %d CPUs, up %s\n", sizeStr(h.MemTotal-h.MemAvailable), sizeStr(h.MemTotal), h.Load, h.CPUs, (time.Duration(h.Uptime) * time.Second).String())
+				}
+				for _, d := range resp.Disks {
+					fmt.Fprintf(w, "Disk:\t%s free of %s for %s (%s)\n", sizeStr(d.Free), sizeStr(d.Total), strings.Join(d.Holds, ", "), d.Path)
+				}
+			})
+		},
+	}
+
+	cmd.AddCommand(status, summary, top, timeline, heatmap, breakdown, server)
 	return cmd
 }

@@ -394,3 +484,26 @@ func sparkline(vals []int64) string {
 	}
 	return sb.String()
 }
+
+// sizeStr formats a size in binary units.
+func sizeStr(n int64) string {
+	units := []string{"B", "KiB", "MiB", "GiB", "TiB"}
+	f, i := float64(n), 0
+	for f >= 1024 && i < len(units)-1 {
+		f /= 1024
+		i++
+	}
+	if i == 0 || f >= 100 {
+		return fmt.Sprintf("%.0f %s", f, units[i])
+	}
+	return fmt.Sprintf("%.1f %s", f, units[i])
+}
+
+// isoLocal shows a time named reports (RFC 3339) in local time.
+func isoLocal(s string) string {
+	t, err := time.Parse(time.RFC3339Nano, s)
+	if err != nil {
+		return s
+	}
+	return t.Local().Format("2006-01-02 15:04")
+}
@@ -45,7 +45,11 @@ func zoneCmd() *cobra.Command {
 					if z.Type == "primary" {
 						serial, recs = fmt.Sprint(z.SOA.Serial), fmt.Sprint(z.Records)
 					}
-					fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%s\n", z.ID, z.Display, z.View, z.Type, recs, serial)
+					typ := z.Type
+					if z.Disabled {
+						typ += " (disabled)"
+					}
+					fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%s\n", z.ID, z.Display, z.View, typ, recs, serial)
 				}
 			})
 		},
@@ -73,12 +77,15 @@ func zoneCmd() *cobra.Command {
 					fmt.Fprintf(w, "View:\t%s\n", z.View)
 				}
 				fmt.Fprintf(w, "Type:\t%s\n", z.Type)
+				if z.Disabled {
+					fmt.Fprintf(w, "Disabled:\tyes: named doesn't load it ('jarl zone enable %s')\n", args[0])
+				}
 				if z.Type == "primary" {
 					fmt.Fprintf(w, "Serial:\t%d\n", z.SOA.Serial)
 					fmt.Fprintf(w, "SOA:\t%s %s refresh %d retry %d expire %d minimum %d\n", z.SOA.MName, z.SOA.RName, z.SOA.Refresh, z.SOA.Retry, z.SOA.Expire, z.SOA.Minimum)
 					fmt.Fprintf(w, "Default TTL:\t%d\n", z.DefaultTTL)
-					if z.Disabled > 0 {
-						fmt.Fprintf(w, "Records:\t%d (%d disabled: jarl record list %s --disabled)\n", z.Records, z.Disabled, args[0])
+					if z.DisabledRecords > 0 {
+						fmt.Fprintf(w, "Records:\t%d (%d disabled: jarl record list %s --disabled)\n", z.Records, z.DisabledRecords, args[0])
 					} else {
 						fmt.Fprintf(w, "Records:\t%d\n", z.Records)
 					}
@@ -86,6 +93,9 @@ func zoneCmd() *cobra.Command {
 				if z.InView != "" {
 					fmt.Fprintf(w, "In view:\t%s\n", z.InView)
 				}
+				if len(z.LinkedWith) > 0 {
+					fmt.Fprintf(w, "Linked with:\t%s (shared records are kept in step; 'jarl record list' shows which are local)\n", strings.Join(z.LinkedWith, ", "))
+				}
 				if z.ZoneFile != "" {
 					fmt.Fprintf(w, "File:\t%s\n", z.ZoneFile)
 				}
@@ -98,7 +108,7 @@ func zoneCmd() *cobra.Command {
 	show.Flags().StringVar(&view, "view", "", "view of the zone (when the name exists in several views)")

 	var ns, records, primaries, forwarders, opts []string
-	var contact, comment, cloneFrom, file, inView, forward string
+	var contact, comment, cloneFrom, file, inView, forward, linkWith string
 	var ttl uint32
 	create := &cobra.Command{
 		Use:   "create NAME",
@@ -113,7 +123,8 @@ and a network between octet boundaries, like a /22, gets one zone per /24
  jarl zone create 10.0.8.0/22            # 8-11.0.10.in-addr.arpa
  jarl zone create partner.example --type secondary --primary 192.0.2.53
  jarl zone create consul --type forward --forwarder "127.0.0.1 port 8600"
-  jarl zone create example.com --view external --clone-from example.com --clone-view internal`,
+  jarl zone create example.com --view external --clone-from example.com --clone-view internal
+  jarl zone create example.com --view vps --link-with external   # linked: shared records kept in step`,
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
@@ -142,6 +153,9 @@ and a network between octet boundaries, like a /22, gets one zone per /24
 			if inView != "" {
 				body["in_view"] = inView
 			}
+			if linkWith != "" {
+				body["link_with"] = linkWith
+			}
 			var recs []map[string]any
 			for _, r := range records {
 				f := strings.Fields(r)
@@ -212,6 +226,7 @@ and a network between octet boundaries, like a /22, gets one zone per /24
 	create.Flags().StringVar(&cloneView, "clone-view", "", "view of --clone-from")
 	create.Flags().StringVar(&file, "file", "", "zone file (hint and redirect zones)")
 	create.Flags().StringVar(&inView, "in-view", "", "for in-view zones: the view to share the zone from")
+	create.Flags().StringVar(&linkWith, "link-with", "", "link with the zone of the same name in this view: copy its shared records and keep them in step (docs/views.md#linked-zones)")
 	create.Flags().StringVar(&comment, "comment", "", "comment")

 	var refresh, retry, expire, minimum, serial uint32
@@ -306,6 +321,42 @@ and a network between octet boundaries, like a /22, gets one zone per /24
 	del.Flags().StringVar(&view, "view", "", "view of the zone")
 	del.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask for confirmation")

+	toggle := func(disable bool) *cobra.Command {
+		verb := map[bool]string{true: "disable", false: "enable"}[disable]
+		long := `Load a disabled zone in named again, as it is in Jarl now (changes made
+while it was disabled included).`
+		if disable {
+			long = `Disable a zone: it stays in Jarl with its records, options and history,
+and can still be edited, but named no longer loads it. Its names are then
+answered by recursion where the view offers it (the internet's version of
+the zone, if any), and REFUSED elsewhere. Signed zones can't be disabled;
+turn signing off first.
+
+  jarl zone disable old.adbraun.lol
+  jarl zone enable old.adbraun.lol`
+		}
+		c := &cobra.Command{
+			Use:   verb + " ZONE",
+			Short: map[bool]string{true: "Stop serving a zone, keeping it in Jarl", false: "Serve a disabled zone again"}[disable],
+			Long:  long,
+			Args:  cobra.ExactArgs(1),
+			RunE: func(cmd *cobra.Command, args []string) error {
+				c, err := newClient()
+				if err != nil {
+					return err
+				}
+				path, qv := zonePath(args[0], view)
+				resp, err := c.Mutate(ctx(), "PATCH", path, qv, map[string]any{"disabled": disable})
+				if err != nil {
+					return err
+				}
+				return report(resp)
+			},
+		}
+		c.Flags().StringVar(&view, "view", "", "view of the zone")
+		return c
+	}
+
 	fileCmd := &cobra.Command{
 		Use:   "file ZONE",
 		Short: "Print the zone file Jarl generates",
@@ -373,7 +424,7 @@ equal to the file: records not in the file are deleted.`,
 	importCmd.Flags().BoolVar(&replace, "replace", false, "delete records that are not in the file")
 	importCmd.Flags().BoolVar(&useSOA, "use-soa", false, "also take SOA timers and $TTL from the file")

-	cmd.AddCommand(list, show, create, update, del, fileCmd, importCmd, zoneSerialsCmd(), zoneDelegationCmd(), zoneDNSSECCmd(), zoneRegistrarCmd())
+	cmd.AddCommand(list, show, create, update, del, toggle(true), toggle(false), fileCmd, importCmd, zoneSerialsCmd(), zoneDelegationCmd(), zoneDNSSECCmd(), zoneRegistrarCmd(), zoneLinkCmd(true), zoneLinkCmd(false))
 	return cmd
 }

@@ -406,11 +457,32 @@ func jsonUnmarshal(b []byte, v any) error { return json.Unmarshal(b, v) }

 // ---- records

+// viewsFlagHelp describes --view of the record commands that change
+// records.
+const viewsFlagHelp = "view of the zone; several (internal,external) or \"all\" make the same change in each, together"
+
 func recordCmd() *cobra.Command {
 	cmd := &cobra.Command{Use: "record", Aliases: []string{"records", "rr"}, Short: "Manage records in primary zones"}
 	var view, name, typ, search, comment, ttlArg string
-	var ptr, missingOK, yes, onlyDisabled, wide bool
+	var ptr, missingOK, yes, onlyDisabled, wide, local, shared bool
 	var id int64
+	// linkFlags adds --local and --shared (linked zones) to a command.
+	linkFlags := func(c *cobra.Command, what string) {
+		c.Flags().BoolVar(&local, "local", false, "linked zones: "+what+" in this view only (overriding the shared records of this name and type here)")
+		c.Flags().BoolVar(&shared, "shared", false, "linked zones: "+what+" in every linked view (this version becomes every view's)")
+	}
+	linkBody := func(body map[string]any) error {
+		switch {
+		case local && shared:
+			return fmt.Errorf("give --local or --shared, not both")
+		case local:
+			body["local"] = true
+			localFanOut = true
+		case shared:
+			body["local"] = false
+		}
+		return nil
+	}

 	list := &cobra.Command{
 		Use:   "list ZONE",
@@ -432,8 +504,15 @@ func recordCmd() *cobra.Command {
 			if err := c.Get(ctx(), path+"/records", qv, &recs); err != nil {
 				return err
 			}
+			linked := false
+			for _, r := range recs {
+				linked = linked || r.Linked != ""
+			}
 			return output(recs, func(w io.Writer) {
 				rows := [][]string{{"ID", "NAME", "TTL", "TYPE", "DATA", "COMMENT"}}
+				if linked {
+					rows[0] = []string{"ID", "NAME", "TTL", "TYPE", "LINK", "DATA", "COMMENT"}
+				}
 				for _, r := range recs {
 					ttl := fmt.Sprint(r.EffectiveTTL)
 					if r.TTL == nil {
@@ -443,10 +522,18 @@ func recordCmd() *cobra.Command {
 					if r.Disabled {
 						comment = strings.TrimSpace("[disabled] " + comment)
 					}
+					if linked {
+						rows = append(rows, []string{fmt.Sprint(r.ID), r.RelativeName, ttl, r.Type, r.Linked, r.Data, comment})
+						continue
+					}
 					rows = append(rows, []string{fmt.Sprint(r.ID), r.RelativeName, ttl, r.Type, r.Data, comment})
 				}
 				if !wide {
-					fitColumn(rows, 4)
+					col := 4
+					if linked {
+						col = 5
+					}
+					fitColumn(rows, col)
 				}
 				for _, row := range rows {
 					fmt.Fprintln(w, strings.Join(row, "\t"))
@@ -488,18 +575,24 @@ and splitting are automatic).
 			if ptr {
 				body["ptr"] = true
 			}
-			path, qv := zonePath(args[0], view)
-			resp, err := c.Mutate(ctx(), "POST", path+"/records", qv, body)
+			if err := linkBody(body); err != nil {
+				return err
+			}
+			views, err := zoneViews(c, args[0], view)
 			if err != nil {
 				return err
 			}
-			return report(resp)
+			return perView(c, views, "add "+args[1]+" "+strings.ToUpper(args[2]), func(c *client.Client, view string) (*api.MutationResponse, error) {
+				path, qv := zonePath(args[0], view)
+				return c.Mutate(ctx(), "POST", path+"/records", qv, body)
+			})
 		},
 	}
-	add.Flags().StringVar(&view, "view", "", "view of the zone")
+	add.Flags().StringVar(&view, "view", "", viewsFlagHelp)
 	add.Flags().StringVar(&ttlArg, "ttl", "", "TTL in seconds (default: the RRset's or the zone's)")
 	add.Flags().StringVar(&comment, "comment", "", "comment")
 	add.Flags().BoolVar(&ptr, "ptr", false, "also add the PTR record (A/AAAA)")
+	linkFlags(add, "add it")

 	var data string
 	update := &cobra.Command{
@@ -533,6 +626,9 @@ and splitting are automatic).
 			if ptr {
 				body["ptr"] = true
 			}
+			if err := linkBody(body); err != nil {
+				return err
+			}
 			if len(body) == 0 {
 				return fmt.Errorf("nothing to change (see --help)")
 			}
@@ -549,6 +645,8 @@ and splitting are automatic).
 	update.Flags().StringVar(&ttlArg, "ttl", "", `new TTL, or "default" for the zone default`)
 	update.Flags().StringVar(&comment, "comment", "", "new comment")
 	update.Flags().BoolVar(&ptr, "ptr", false, "move the PTR record along (A/AAAA)")
+	update.Flags().BoolVar(&local, "local", false, "linked zones: make this name and type local to the record's view (an override)")
+	update.Flags().BoolVar(&shared, "shared", false, "linked zones: share this name and type with the linked views; this view's version becomes every view's")

 	del := &cobra.Command{
 		Use:   "delete ZONE NAME TYPE [DATA...]  |  delete --id ID",
@@ -581,26 +679,28 @@ or one record by ID.
 			if len(args) == 3 && !confirm(fmt.Sprintf("Delete all %s records of %s?", strings.ToUpper(args[2]), args[1]), yes) {
 				return fmt.Errorf("canceled")
 			}
-			path, qv := zonePath(args[0], view)
-			qv.Set("name", args[1])
-			qv.Set("type", args[2])
-			if len(args) > 3 {
-				qv.Set("data", strings.Join(args[3:], " "))
-			}
-			if missingOK {
-				qv.Set("missing_ok", "1")
-			}
-			if ptr {
-				qv.Set("ptr", "1")
-			}
-			resp, err := c.Mutate(ctx(), "DELETE", path+"/records", qv, nil)
+			views, err := zoneViews(c, args[0], view)
 			if err != nil {
 				return err
 			}
-			return report(resp)
+			return perView(c, views, "delete "+args[1]+" "+strings.ToUpper(args[2]), func(c *client.Client, view string) (*api.MutationResponse, error) {
+				path, qv := zonePath(args[0], view)
+				qv.Set("name", args[1])
+				qv.Set("type", args[2])
+				if len(args) > 3 {
+					qv.Set("data", strings.Join(args[3:], " "))
+				}
+				if missingOK {
+					qv.Set("missing_ok", "1")
+				}
+				if ptr {
+					qv.Set("ptr", "1")
+				}
+				return c.Mutate(ctx(), "DELETE", path+"/records", qv, nil)
+			})
 		},
 	}
-	del.Flags().StringVar(&view, "view", "", "view of the zone")
+	del.Flags().StringVar(&view, "view", "", viewsFlagHelp)
 	del.Flags().Int64Var(&id, "id", 0, "delete the record with this ID")
 	del.Flags().BoolVar(&missingOK, "missing-ok", false, "succeed when nothing matches")
 	del.Flags().BoolVar(&ptr, "ptr", false, "also delete the matching PTR record (A/AAAA)")
@@ -627,17 +727,23 @@ spaces.
 			if comment != "" {
 				body["comment"] = comment
 			}
-			path, qv := zonePath(args[0], view)
-			resp, err := c.Mutate(ctx(), "PUT", path+"/rrsets/"+urlPathEscape(args[1])+"/"+urlPathEscape(args[2]), qv, body)
+			if err := linkBody(body); err != nil {
+				return err
+			}
+			views, err := zoneViews(c, args[0], view)
 			if err != nil {
 				return err
 			}
-			return report(resp)
+			return perView(c, views, "set "+args[1]+" "+strings.ToUpper(args[2]), func(c *client.Client, view string) (*api.MutationResponse, error) {
+				path, qv := zonePath(args[0], view)
+				return c.Mutate(ctx(), "PUT", path+"/rrsets/"+urlPathEscape(args[1])+"/"+urlPathEscape(args[2]), qv, body)
+			})
 		},
 	}
-	set.Flags().StringVar(&view, "view", "", "view of the zone")
+	set.Flags().StringVar(&view, "view", "", viewsFlagHelp)
 	set.Flags().StringVar(&ttlArg, "ttl", "", "TTL for the RRset")
 	set.Flags().StringVar(&comment, "comment", "", "comment for new records")
+	linkFlags(set, "set it")

 	toggle := func(disable bool) *cobra.Command {
 		verb := "enable"
@@ -685,30 +791,37 @@ with DATA), or one record by ID.
 				if len(args) < 3 {
 					return fmt.Errorf("give ZONE NAME TYPE [DATA], or --id")
 				}
-				path, zq := zonePath(args[0], tview)
-				for k, v := range zq {
-					qv[k] = v
-				}
-				qv.Set("name", args[1])
-				qv.Set("type", args[2])
-				if len(args) > 3 {
-					qv.Set("data", strings.Join(args[3:], " "))
-				}
-				if tmissing {
-					qv.Set("missing_ok", "1")
-				}
-				resp, err := c.Mutate(ctx(), "POST", path+"/records/"+verb, qv, nil)
-				if err != nil && tmissing && strings.HasSuffix(err.Error(), "nothing to do") {
-					fmt.Println("nothing to do")
-					return nil
-				}
+				views, err := zoneViews(c, args[0], tview)
 				if err != nil {
 					return err
 				}
-				return report(resp)
+				return perView(c, views, verb+" "+args[1]+" "+strings.ToUpper(args[2]), func(c *client.Client, view string) (*api.MutationResponse, error) {
+					path, zq := zonePath(args[0], view)
+					vq := q()
+					for k, v := range qv {
+						vq[k] = v
+					}
+					for k, v := range zq {
+						vq[k] = v
+					}
+					vq.Set("name", args[1])
+					vq.Set("type", args[2])
+					if len(args) > 3 {
+						vq.Set("data", strings.Join(args[3:], " "))
+					}
+					if tmissing {
+						vq.Set("missing_ok", "1")
+					}
+					resp, err := c.Mutate(ctx(), "POST", path+"/records/"+verb, vq, nil)
+					if err != nil && tmissing && strings.HasSuffix(err.Error(), "nothing to do") {
+						fmt.Println("nothing to do")
+						return nil, nil
+					}
+					return resp, err
+				})
 			},
 		}
-		c.Flags().StringVar(&tview, "view", "", "view of the zone")
+		c.Flags().StringVar(&tview, "view", "", viewsFlagHelp)
 		c.Flags().Int64Var(&tid, "id", 0, verb+" the record with this ID")
 		c.Flags().BoolVar(&tmissing, "missing-ok", false, "succeed when nothing matches or the records are already "+verb+"d")
 		c.Flags().BoolVar(&tptr, "ptr", false, "also "+verb+" the matching PTR record (A/AAAA)")
@@ -769,3 +882,58 @@ func fitColumn(rows [][]string, col int) {
 		}
 	}
 }
+
+// zoneLinkCmd is 'zone link' and 'zone unlink' (docs/views.md#linked-zones).
+func zoneLinkCmd(link bool) *cobra.Command {
+	var view string
+	var with []string
+	cmd := &cobra.Command{
+		Use:   "link ZONE --view VIEW [--with VIEW...]",
+		Short: "Link zones of the same name in several views: shared records are kept in step",
+		Long: `Links a zone with the zones of the same name in other views (--with, or
+every view that has one). Jarl then keeps their shared records in step: a
+change to one reaches the others in the same changeset. Each view can
+still have records of its own (record add/set --local), which override
+the shared records of that name and type there, and every zone keeps its
+own options, so views can still differ in who they answer and how.
+
+Linking never changes what named answers: a name and type with the same
+records in every view becomes shared, and one that differs stays local to
+each view. Share one later from the view whose version is right:
+jarl record update ID --shared.`,
+		Example: `  jarl zone link adbraun.lol --view external --with vps
+  jarl zone create adbraun.lol --view vps --link-with external   # a new zone, linked from the start
+  jarl zone unlink adbraun.lol --view vps`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			path, qv := zonePath(args[0], view)
+			verb := "unlink"
+			var body any
+			if link {
+				verb = "link"
+				body = map[string]any{"with": with}
+			}
+			resp, err := c.Mutate(ctx(), "POST", path+"/"+verb, qv, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.Flags().StringVar(&view, "view", "", "view of the zone")
+	if link {
+		cmd.Flags().StringSliceVar(&with, "with", nil, "views to link with (default: every view with a zone of that name)")
+		return cmd
+	}
+	cmd.Use = "unlink ZONE --view VIEW"
+	cmd.Short = "Take a zone out of its link: its records stay, all local"
+	cmd.Long = `Takes a zone out of its link. Its records stay as they are, all local to
+its view, and the other zones of the link keep theirs. A link left with one
+zone is dissolved.`
+	cmd.Example = "  jarl zone unlink adbraun.lol --view vps"
+	return cmd
+}
@@ -302,7 +302,11 @@ func renderCmd() *cobra.Command {
 				return err
 			}
 			paths := render.Paths{ConfigDir: filepath.Join(out, "config"), ZoneDir: filepath.Join(out, "zones"), CacheDir: filepath.Join(out, "cache")}
-			o := render.Render(st, paths, renderExtras(a.cfg))
+			x := renderExtras(a.cfg)
+			if x.ViewKeySeed, err = engine.ViewKeySeed(context.Background(), a.store); err != nil {
+				return err
+			}
+			o := render.Render(st, paths, x)
 			for _, f := range o.Files {
 				if err := os.MkdirAll(filepath.Dir(f.Path), 0o750); err != nil {
 					return err
@@ -24,9 +24,11 @@ import (

 	"jarl/internal/auth"
 	"jarl/internal/bind"
+	"jarl/internal/certs"
 	"jarl/internal/config"
 	"jarl/internal/engine"
 	"jarl/internal/model"
+	"jarl/internal/nscheck"
 	"jarl/internal/porkbun"
 	"jarl/internal/render"
 	"jarl/internal/server"
@@ -122,6 +124,7 @@ func openApp(allowMissingConfig bool) (*app, error) {
 		ReloadTimeout: time.Duration(cfg.BIND.ReloadTimeout),
 		NoReload:      cfg.BIND.NoReload,
 		Extras:        renderExtras(cfg),
+		LocalAddrs:    nscheck.LocalAddrs,
 	}, log)
 	eng.Limits = engine.BlocklistLimits{
 		Refresh: time.Duration(cfg.Blocking.Refresh), RetryAfter: time.Hour, Timeout: 2 * time.Minute,
@@ -148,7 +151,7 @@ func statsOptions(cfg *config.Config) stats.Options {
 	sc := cfg.Stats
 	o := stats.Options{QueryLog: sc.QueryLog, LogFile: sc.LogFile, StatisticsChannel: sc.StatisticsChannel, TopN: sc.TopN,
 		RetainMinute: time.Duration(sc.Retention.Minute), RetainHour: time.Duration(sc.Retention.Hour), RetainDay: time.Duration(sc.Retention.Day),
-		Anonymize: sc.AnonymizeClients}
+		Anonymize: sc.AnonymizeClients, MainConfig: cfg.BIND.MainConfig}
 	for _, p := range sc.ExcludeClients {
 		if pf, err := config.ParsePrefix(p); err == nil {
 			o.Exclude = append(o.Exclude, pf.Masked())
@@ -167,7 +170,7 @@ func zoneIndex(a *app) stats.ZoneIndex {
 		}
 		out := map[string][]string{}
 		for _, z := range st.Zones {
-			if z.Type != model.ZonePrimary && z.Type != model.ZoneSecondary && z.Type != model.ZoneMirror {
+			if z.Type != model.ZonePrimary && z.Type != model.ZoneSecondary && z.Type != model.ZoneMirror || z.Disabled {
 				continue
 			}
 			v := st.ViewName(z)
@@ -303,6 +306,23 @@ func serveCmd() *cobra.Command {
 					a.log.Warn("the configuration file holds the Porkbun API key and everyone can read it; make it readable only by root and jarld (chown root:jarl, chmod 640)", "file", configPath)
 				}
 			}
+			if a.cfg.Metrics.Enabled && a.cfg.Metrics.Token != "" {
+				if fi, err := os.Stat(configPath); err == nil && fi.Mode().Perm()&0o004 != 0 {
+					a.log.Warn("the configuration file holds metrics.token and everyone can read it; make it readable only by root and jarld (chown root:jarl, chmod 640)", "file", configPath)
+				}
+			}
+			cm := certs.New(certs.Config{
+				Directory: a.cfg.ACME.Account.DirectoryURL(), Email: a.cfg.ACME.Account.Email, AgreeTOS: a.cfg.ACME.Account.AgreeTOS,
+				EABKeyID: a.cfg.ACME.Account.EABKeyID, EABHMAC: a.cfg.ACME.Account.EABHMAC,
+				Resolvers: a.cfg.ACME.Resolvers, CABundle: a.cfg.ACME.CABundle, CheckPropagation: a.cfg.ACME.CheckPropagation,
+				Dir: a.cfg.CertDir(), Version: version.String(), Porkbun: pb, PorkbunAllows: a.cfg.Porkbun.Allows,
+			}, a.store, a.eng, a.log)
+			cm.Start(ctx)
+			if a.cfg.ACME.Account.EABHMAC != "" {
+				if fi, err := os.Stat(configPath); err == nil && fi.Mode().Perm()&0o004 != 0 {
+					a.log.Warn("the configuration file holds acme.account.eab_hmac and everyone can read it; make it readable only by root and jarld (chown root:jarl, chmod 640)", "file", configPath)
+				}
+			}
 			srv := server.New(server.Config{
 				Listen: a.cfg.Listen, TLSCertFile: a.cfg.TLS.CertFile, TLSKeyFile: a.cfg.TLS.KeyFile,
 				TrustedProxies: a.cfg.Proxies(), SessionLifetime: time.Duration(a.cfg.Session.Lifetime),
@@ -311,6 +331,9 @@ func serveCmd() *cobra.Command {
 				BackupDir: a.cfg.Backup.Dir, BackupWarnAfter: time.Duration(a.cfg.Backup.WarnAfter),
 				Porkbun: pb, PorkbunAllows: a.cfg.Porkbun.Allows,
 				TOTPRequire: a.cfg.TOTP.Require, TOTPIssuer: a.cfg.TOTP.IssuerName(),
+				Metrics: server.Metrics{Enabled: a.cfg.Metrics.Enabled, Listen: a.cfg.Metrics.Listen,
+					Allow: a.cfg.Metrics.AllowPrefixes(), Token: a.cfg.Metrics.Token},
+				Certs: cm,
 				HTTPReq: server.HTTPReq{
 					Enabled:           a.cfg.ACME.HTTPReq.Enabled,
 					AllowPlainHTTP:    !a.cfg.ACME.HTTPReq.RequireHTTPS,
@@ -328,6 +351,7 @@ func serveCmd() *cobra.Command {
 			}()
 			go auditRetention(ctx, a)
 			go blocklistLoop(ctx, a)
+			go cm.Run(ctx)
 			a.log.Info("jarld starting", "version", version.String(), "database", a.cfg.Database, "bind_config", a.cfg.BIND.ConfigDir)
 			err = srv.Serve(ctx, func() { sdNotify("READY=1\nSTATUS=serving") })
 			sdNotify("STOPPING=1")
@@ -339,22 +363,27 @@ func serveCmd() *cobra.Command {

 // blocklistLoop keeps blocklists up to date (docs/blocking.md): every few
 // minutes it downloads the lists that are due, and at once when a list
-// was added or changed.
+// was added or changed. It also ends a pause of blocking on time.
 func blocklistLoop(ctx context.Context, a *app) {
 	select {
 	case <-ctx.Done():
 		return
 	case <-time.After(10 * time.Second): // let jarld finish starting
 	}
-	t := time.NewTicker(5 * time.Minute)
-	defer t.Stop()
 	for {
 		a.eng.RefreshDue(ctx)
+		wait := 5 * time.Minute
+		if until := a.eng.ResumeBlocking(ctx); !until.IsZero() {
+			wait = min(wait, max(time.Until(until), time.Second))
+		}
+		t := time.NewTimer(wait)
 		select {
 		case <-ctx.Done():
+			t.Stop()
 			return
 		case <-t.C:
 		case <-a.eng.BlocklistKicks():
+			t.Stop()
 		}
 	}
 }
@@ -55,7 +55,9 @@ RestrictRealtime=yes
 RestrictSUIDSGID=yes
 LockPersonality=yes
 MemoryDenyWriteExecute=yes
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+# AF_NETLINK lets jarld list this host's addresses, so its name server
+# checks know which addresses are its own.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 SystemCallArchitectures=native
 # @system-service includes @chown, which jarld needs to give files to group bind.
 SystemCallFilter=@system-service
@@ -1,5 +1,11 @@
 # Let's Encrypt (ACME DNS-01) with Jarl

+This page is about **other** ACME clients (certbot, acme.sh, lego,
+Traefik) publishing their DNS-01 challenges through Jarl. For
+certificates for the DNS server itself (Jarl's web UI, named's DNS over
+TLS and HTTPS), Jarl can be the ACME client: see
+[certificates.md](certificates.md).
+
 The DNS-01 challenge proves that you control a domain by publishing a TXT
 record at `_acme-challenge.<domain>`. Jarl does this through its API, so no
 dynamic updates (`allow-update`, nsupdate) are needed. That matters because
@@ -10,6 +10,8 @@ what is documented here.
  (`www.adbraun.lol.`), and display helpers drop it (`display_name`,
  `relative_name`).
 * `GET /healthz` (no authentication) returns `{"ok": true, "version": ...}`.
+* `GET /metrics` serves Prometheus metrics when `metrics.enabled` is set.
+  Access is set in jarl.yaml, not with API tokens ([metrics.md](metrics.md)).

 ## Authentication

@@ -147,6 +149,14 @@ honours `If-Match: <version>`, and batch operations take `base_version`. If
 the object changed in the meantime the request fails with 409. Staged
 operations record the version they were staged against automatically.

+**Stale changesets.** When an object a staged operation needs was changed
+or deleted after it was staged (from the CLI, say), preview and apply fail
+on that operation: the error has `op` (its number in the changeset),
+`op_summary` and a message saying what happened; remove the operation
+(`DELETE /changesets/{id}/ops/{seq}`) or stage it again. A staged delete of
+a record that is already gone is not an error: it counts as done, with a
+warning.
+
 ## Resources

 `{zone}` is a zone ID or name (`root` for the root zone). Add `?view=NAME`
@@ -160,7 +170,7 @@ may be the name.
 | GET | `/zones` | `?view=`, `?type=`, `?q=` (name contains) |
 | POST | `/zones` | ZoneInput (below) |
 | GET | `/zones/{zone}` | |
-| PATCH | `/zones/{zone}` | ZoneInput (only the fields to change) |
+| PATCH | `/zones/{zone}` | ZoneInput (only the fields to change); `{"disabled": true}` disables the zone: named stops loading it, Jarl keeps it |
 | DELETE | `/zones/{zone}` | deletes the zone with its records and options |
 | GET | `/zones/{zone}/file` | the generated zone file (text/plain) |
 | GET | `/zones/{zone}/serials` | asks the zone's other name servers for their serial (below) |
@@ -332,6 +342,21 @@ registrar_error`.

 ### Records

+In a linked zone ([views.md](views.md#linked-zones)), records carry
+`shared_id` and `linked` (`shared` or `local`). Creating, updating
+(`PATCH /records/{id}`) and setting (`PUT .../rrsets/...`) take `"local":
+true` (this view only, an override) or `false` (shared; on an update or a
+set it makes this view's version every view's). Zones carry `link_group`
+and `linked_with` (the other views).
+
+| Method | Path | Body |
+|--------|------|------|
+| POST | `/zones/{zone}/link` | `{"with": ["external"]}` (default: every view with that zone). Names and types that are the same everywhere become shared, the rest stay local |
+| POST | `/zones/{zone}/unlink` | Takes the zone out of its link; its records stay, all local |
+
+`POST /zones` takes `"link_with": "VIEW"` to create a zone linked with
+that view's zone of the same name.
+
 | Method | Path | Body / query |
 |--------|------|--------------|
 | GET | `/zones/{zone}/records` | `?name=`, `?type=`, `?q=`, `?disabled=1` (only disabled records) or `0` (only enabled ones) |
@@ -386,6 +411,7 @@ Disabling a record that is already disabled is a 409; with `missing_ok=1`
 | GET / PATCH / DELETE | `/views/{id}` | DELETE `?cascade=1` also deletes the view's zones |
 | POST | `/views/order` | `{"ids": [3, 1, 2]}` |
 | PUT | `/views/{id}/color` | `{"color": "green"}`; `""` for the default |
+| GET | `/views/{id}/key` | `{name, algorithm, secret}`: the TSIG key that selects the view (docs/views.md); needs `tsig:write`, audited |

 `adopt_zones` moves zones that are not in a view into the new view. named
 requires every zone to be in a view as soon as one view exists.
@@ -404,7 +430,7 @@ send the request with that changeset (`?changeset=` or
 | Method | Path | Body |
 |--------|------|------|
 | GET | `/acls` | each with `used_by` |
-| POST | `/acls` | `{"name": "homelab", "elements": ["192.168.1.0/24", "!192.168.1.66", "key xfer", "localhost"], "comment": ""}` |
+| POST | `/acls` | `{"name": "homelab", "elements": ["192.168.1.0/24", "!192.168.1.66", "10.0.10.101-10.0.10.199", "key xfer", "localhost"], "comment": ""}` (ranges: [concepts.md](concepts.md#model-views-zones-records-options)) |
 | GET / PATCH / DELETE | `/acls/{id}` | renaming updates references; deleting one in use → 409 |
 | GET | `/tsig-keys` | without secrets |
 | POST | `/tsig-keys` | `{"name": "xfer", "algorithm": "hmac-sha256", "secret": "<base64>"}` (secret generated when absent; the response `object` shows it once) |
@@ -419,14 +445,22 @@ Needs `blocking:read` (`blocking:write` to change). See
 | Method | Path | Body / query |
 |--------|------|--------------|
 | GET | `/blocking/lists` | each with `views` (where it applies), `auto_views` (not chosen: every view that offers recursion), `state` (ok, waiting, error, disabled, idle), `status` (`entries`, `records`, `skipped`, `checked_at`, `updated_at`, `error`) and `memory_mb` (named's memory for it, estimated) |
-| POST | `/blocking/lists` | `{"name": "hagezi-multi", "url": "https://...", "views": ["internal"], "comment": ""}` (`views` empty or absent: automatic); jarld downloads it right after |
+| POST | `/blocking/lists` | `{"name": "hagezi-multi", "url": "https://...", "views": ["internal"], "comment": "", "step": "normal"}` (`views` empty or absent: automatic; `step` the blocking step it starts at); jarld downloads it right after |
 | GET / PATCH / DELETE | `/blocking/lists/{id or name}` | PATCH any of `name`, `url`, `views`, `disabled`, `comment` |
 | POST | `/blocking/lists/{id or name}/refresh` | download now and wait; `?force=1` even when the server says nothing changed. Returns the list; a failed update is in `state` and `status.error` |
 | GET | `/blocking/rules` | each with `views` and `auto_views` |
 | POST | `/blocking/rules` | `{"name": "doubleclick.net", "action": "block", "exact": false, "views": [], "comment": ""}` (`action` block or allow; `exact`: only the name, not the names below it) |
 | PATCH / DELETE | `/blocking/rules/{id}` | |
 | DELETE | `/blocking/rules` | `?name=DOMAIN[&view=V][&missing_ok=1]`: the rules for a domain |
-| GET | `/blocking/check` | `?name=DOMAIN`: per view with blocking, `{view, result: blocked\|allowed\|none, entry, rule_id, list}` |
+| GET | `/blocking/check` | `?name=DOMAIN`: per view with blocking, `{view, result: blocked\|allowed\|none, entry, rule_id, list, step}` (what applies to normal devices when blocking isn't paused; `step` when only devices at that step or above are blocked) |
+| GET / POST | `/blocking/steps` | the steps above normal, lowest first, with the `lists` and `groups` at each; POST `{"name": "strict", "comment": ""}` adds one on top |
+| PATCH / DELETE | `/blocking/steps/{id or name}` | `{"name", "position", "comment"}`; delete is refused while lists or groups use it |
+| POST | `/blocking/steps/order` | `{"steps": ["strict", "very-strict"]}`: every step above normal, lowest first |
+| GET / POST | `/blocking/groups` | client groups; POST `{"name": "kids", "members": ["10.10.0.50", "tablets"], "step": "strict", "views": []}` |
+| PATCH / DELETE | `/blocking/groups/{id or name}` | the same fields |
+| GET | `/blocking/status` | `{paused_until, paused_indefinitely}` (null and false when not paused) |
+| POST | `/blocking/pause` | `{"minutes": 15}` (1 to 1440): let every name through until then; jarld resumes by itself. `{"indefinitely": true}`: until resumed |
+| POST | `/blocking/resume` | end a pause now |

 Lists and rules are configuration like the rest: they can be staged, and
 listing with `?changeset=` marks them `pending`.
@@ -441,7 +475,9 @@ listing with `?changeset=` marks them `pending`.
 | GET / PATCH | `/settings` | `{"nameservers": [...], "rname": "...", "default_ttl": 3600, "refresh": ..., "retry": ..., "expire": ..., "negative_ttl": ..., "serial_policy": "date"}` |

 Option values are named.conf syntax without the final semicolon. They are
-checked against the BIND 9.20 grammar for that scope.
+checked against the BIND 9.20 grammar for that scope. `position` only
+orders top-level statements; the options of a block are always listed and
+written in Jarl's fixed order (docs/concepts.md).

 ### Catalogs and search

@@ -450,6 +486,8 @@ checked against the BIND 9.20 grammar for that scope.
 | GET | `/catalog/options` | scopes and zone types; with `?scope=options\|view\|toplevel\|zone:primary\|...` every statement allowed there (name, grammar, kind, status, ARM description). `?all=1` includes statements Jarl manages itself |
 | GET | `/catalog/rrtypes` | record types with field hints and examples |
 | GET | `/catalog/grants` | resources, roles and the grant syntax |
+| GET | `/exposure` | which views are reachable from the internet, the exposure findings and their fixes ([exposure.md](exposure.md#api)); `POST /exposure/fix`, `/exposure/ack`, `/exposure/unack` |
+| GET | `/catalog/ranges?r=A-B,C-D` | for each address range: `range` (canonical), `size` ("99 addresses"), and the `prefixes` it is written to named.conf as; or `error`. Text that isn't a range is left out |
 | GET | `/search?q=text` | zones, records and ACLs matching the text |

 ### Changesets
@@ -484,6 +522,7 @@ An **Operation** is `{"op": "...", "id": 0, "base_version": 0, "data": {...}}`:
 | `settings.update` | | settings fields |
 | `blocklist.create` / `blocklist.update` / `blocklist.delete` | blocklist (update/delete) | list fields; views as `views` (names) or `view_ids` |
 | `blockrule.create` / `blockrule.update` / `blockrule.delete` | rule (update/delete) | rule fields, likewise |
+| `blocking.pause` | | `{"until": "2026-10-10T15:04:05Z"}`, `{"indefinitely": true}`, or `{}` to resume |

 Operations later in a batch can refer to objects created earlier in it by
 name (zone and view names). One request can therefore create a view, a zone
@@ -493,13 +532,17 @@ in it and its records.

 | Method | Path | Notes |
 |--------|------|-------|
-| GET | `/status` | named status, adoption, drift, open changesets, current problems, object counts; `expiring_tokens` (tokens that expire within 14 days or expired in the last 14: all for administrators, otherwise the caller's); `backup` (administrators: `last_at`, `last_file`, `last_size`, `last_error`, `last_error_at`, `dir`, `warn_after` in seconds, `stale`); `blocklist_errors` (with `blocking:read`: lists whose last update failed, `{name, error, updated_at}`) |
+| GET | `/status` | named status, adoption, drift, open changesets, current problems, object counts; `expiring_tokens` (tokens that expire within 14 days or expired in the last 14: all for administrators, otherwise the caller's); `backup` (administrators: `last_at`, `last_file`, `last_size`, `last_error`, `last_error_at`, `dir`, `warn_after` in seconds, `stale`); `blocklist_errors` (with `blocking:read`: lists whose last update failed, `{name, error, updated_at}`); `blocking_paused_until` or `blocking_paused_indefinitely` (with `blocking:read`, while paused). `problems` include named-checkconf's warnings about the running configuration (`named_warning`) |
 | POST | `/system/check` | validation + named-checkconf of the current configuration (`options:read`) |
 | POST | `/system/resync` | `{"dry_run": false, "force": false}`: rewrite every file from the database and reload (admin) |
 | GET | `/audit` | `?user=&action=&outcome=&object_type=&changeset=&q=&since=&until=&limit=200&before=ID` |

 ### Query statistics

+Every statistics endpoint below takes `views=internal,vps` to limit the
+figures to those views ([stats.md](stats.md#views)); a breakdown that only
+exists for the whole server then answers `400 not_per_view`.
+
 Needs `stats:read`. When statistics are disabled, every endpoint but
 `status` answers 404 `stats_disabled`. See [stats.md](stats.md).

@@ -508,14 +551,37 @@ Needs `stats:read`. When statistics are disabled, every endpoint but
 | GET | `/stats/status` | | `{enabled, query_log, statistics_channel, log_file, last_poll, last_log_line, log_lines_read, first_data, retention, warnings}` |
 | GET | `/stats/summary` | `since` (90m, 24h, 7d, 2w; default 24h), `top` (default 10) | totals, `avg_qps`, `peak`, `rcodes`, `qtypes`, `views`, `zones`, `answers`, `transport`, `cache_hit_ratio`, `nxdomain_ratio` (without blocked answers), `blocked`, `blocked_ratio`, `blocklists` (blocked per list; `rules` for your rules), `tops` |
 | GET | `/stats/timeline` | `since`, `step` (auto, 1m, 5m, 15m, 1h, 6h, 1d), `key` (repeatable or comma separated; `rcode:*` = every counter of a group; default `queries`) | `{step, times: [unix...], series: [{key, values}]}` |
-| GET | `/stats/top` | `kind` (name, client, nxdomain, servfail, refused, blocked), `since`, `limit` (default 20) | `[{key, count}]`; client and refused entries add `name`, the host name of Jarl's record for the address (the summary's client list too) |
+| GET | `/stats/top` | `kind` (name, client, nxdomain, servfail, refused, blocked, blocked_client), `since`, `limit` (default 20) | `[{key, count}]`; client, refused and blocked_client entries add `name`, the host name of Jarl's record for the address (the summary's client list too) |
 | GET | `/stats/heatmap` | `since` (default 28d), `key` (default queries) | `{key, from, avg[7][24], samples[7][24]}`, Monday first, local time, `-1` = no data |
+| GET | `/stats/server` | | `{server: {rss, mem_in_use, cpu_percent, threads, pid, cache_rrsets, cache_mem, sockets_udp, sockets_tcp, recursion_highwater, tcp_highwater, version, boot_time, config_time, host: {mem_total, mem_available, load, cpus, uptime}}, named: {recursive_clients, tcp_clients, zones, cpus, worker_threads}, disks: [{path, holds, total, free}]}`; gauges over time: `/stats/timeline?key=g:named:rss` (averages, -1 without a sample) |
 | GET | `/stats/breakdown` | `group` (qtype, rcode, view, zone, answer, transport, rtt, dnssec, cache, ratelimit, blocklist), `since` | `[{key, count}]` |

 ```sh
 curl -sf -H "$AUTH" "$API/stats/top?kind=nxdomain&since=7d&limit=10" | jq -r '.[] | "\(.count)\t\(.key)"'
 ```

+### Encrypted DNS
+
+See [encrypted-dns.md](encrypted-dns.md#api): `GET`, `POST` and `DELETE
+/encrypted-dns`, `POST /encrypted-dns/check`.
+
+### Certificates
+
+Administrators only. See [certificates.md](certificates.md#api).
+
+| Method | Path | Body |
+|--------|------|------|
+| GET | `/certificates` | `certificates` (with `status`, `next_attempt`, `issuing_since`, `serving`, `files`) and `account` |
+| POST | `/certificates` | `{"name", "domains", "uses", "challenge", "key_type", "comment"}`, or `{"name", "source": "file", "cert_file", "key_file", "uses"}`; `"issue": false` doesn't start obtaining it |
+| POST | `/certificates/check` | `{"domains", "challenge"}`: the route of each challenge |
+| GET, PATCH, DELETE | `/certificates/{name}` | |
+| POST | `/certificates/{name}/issue` | 202: being obtained (poll until `issuing_since` is gone); a file certificate is reread (200) |
+| POST | `/certificates/{name}/check` | the routes of a certificate's names |
+
+`GET /status` includes `certificates` for administrators: `total`,
+`problems` (failing, expiring, expired), `next` and `next_after`,
+`serving`.
+
 ### ACME: lego's httpreq provider

 Off unless `acme.httpreq.enabled` is set, and by default HTTPS only. The
@@ -17,6 +17,7 @@ does the blocking itself; jarld only prepares the lists.
 - [Your rules](#your-rules)
 - [Blocklists](#blocklists)
 - [Checking a name](#checking-a-name)
+- [Pausing](#pausing)
 - [Statistics](#statistics)
 - [Memory and performance](#memory-and-performance)
 - [How it works](#how-it-works)
@@ -146,6 +147,56 @@ A list's state is **ok** (in use), **waiting** (not downloaded yet),
 **error** (the last update failed; the previous version stays in use),
 **disabled**, or **idle** (it applies to no view, so it does nothing).

+## Different blocking for different devices
+
+Client groups give some devices less or more blocking than the rest, like
+Pi-hole's groups: no blocking for a work laptop, an extra list for the
+kids' tablets.
+
+**Steps** decide which lists a device gets. Each step includes the lists
+of the steps below it, plus its own:
+
+| Step | Gets |
+|------|------|
+| `off` (built in) | only your rules |
+| `normal` (built in) | your rules and the normal lists; every device not in a group |
+| `strict` (one you add) | normal, plus the lists at step `strict` |
+| `very-strict` (one you add) | strict, plus the lists at step `very-strict` |
+
+Every list starts at a step (normal unless you choose one), and every
+group is at a step. Your rules apply at every step, `off` included.
+
+```sh
+jarl block step add strict
+jarl blocklist update social-media --step strict
+jarl block group add work 10.10.0.20 --step off
+jarl block group add kids 10.10.0.50 10.10.0.51 2001:db8:1::/64 --step strict
+jarl block group list
+```
+
+In the web UI, the Blocking page's **Devices** panel holds the steps and
+the groups, and each list has a step.
+
+- **Members** are addresses, networks (`10.10.0.0/24`), ranges
+  (`10.10.0.20-10.10.0.49`), or ACLs made only of those (`key`, `localnets` and `!` can't be used: blocking matches
+  clients by address). A device is in one group: two groups with the same
+  address are refused, but a more specific address in another group wins
+  (`10.10.0.0/24` in one group, `10.10.0.20` in another).
+- **Steps only add.** A group gets everything up to its step, so "kids get
+  list A, guests get list B, and neither gets the other's" can't be done
+  with steps. That needs a view per group, each with its own lists (and
+  their memory).
+- Lists aren't copied per step: each is loaded once, and the steps cost a
+  small zone each. Lists at a step no group reaches block nothing (Jarl
+  warns, and shows them as "no effect").
+- named must see the device's own address. When a router hands out itself
+  as DNS server and forwards to named, every query comes from the router,
+  and groups can't tell devices apart. Devices also need fixed addresses
+  (DHCP reservations); IPv6 privacy addresses change, so add a device's
+  network, or rely on its IPv4 address.
+- `jarl block check NAME` (and the Blocking page) answers for normal
+  devices, and says when a list of a higher step blocks the name.
+
 ## Checking a name

 `jarl block check NAME`, or the box at the top of the Blocking page, says
@@ -163,15 +214,40 @@ Views without blocking aren't listed.
 In the web UI a blocked name gets an **Allow** button, and the statistics'
 most blocked names link to this check.

+## Pausing
+
+To see whether blocking is what breaks a site, pause it: every name is
+answered normally until the time is up (at most a day), then blocking
+resumes by itself, also if jarld was restarted in between. A pause can
+also last until someone resumes blocking (like Pi-hole's "indefinitely").
+
+```sh
+jarl block pause          # 10 minutes; or: jarl block pause 1h
+jarl block pause indefinitely
+jarl block resume         # end it now
+```
+
+In the web UI, **Pause blocking** is at the top of the Blocking page (with
+**Until I resume** among the lengths), and the dashboard says while
+blocking is paused. The lists stay loaded (the
+rules zone just lets everything through), so pausing and resuming take
+effect within a second. Pausing and resuming are recorded in the history
+like other changes.
+
 ## Statistics

 With [query statistics](stats.md) on (including `query_log`), Jarl counts
-what blocking does: blocked queries over time and as a share of all
-queries, which rules and lists blocked them, and the most blocked names
-(`jarl stats summary`, `jarl stats top blocked`, `jarl stats breakdown
-blocklist`). Blocked answers are left out of the NXDOMAIN figures, which
+what blocking does: blocked queries over time (next to all queries) and
+as a share of them, which rules and lists blocked them, the most blocked
+names, and the clients with the most blocked queries (`jarl stats summary`,
+`jarl stats top blocked`, `jarl stats top blocked-clients`, `jarl stats
+breakdown blocklist`). Blocked answers are left out of the NXDOMAIN figures, which
 are about names that really don't exist.

+The Blocking page shows the last 24 hours too: a **Blocked (24h)** column
+for each list, and one count for your rules together (named logs which
+policy zone matched, not which rule in it).
+
 Without statistics named doesn't log what it blocks at all.

 ## Memory and performance
@@ -228,6 +304,16 @@ response-policy {
  blocking in the same view: Jarl refuses the change and says so.
 - Rewrites are logged to Jarl's response log when statistics read it, and
  not at all otherwise.
+- With client groups, a **gate** zone stands in front of the lists of each
+  step: `off.gate.jarl.invalid` before the normal lists,
+  `STEP.gate.jarl.invalid` before a step's. named checks the zones in
+  order and the first match decides; a gate matches the devices below its
+  step by address (`rpz-client-ip` triggers) with `rpz-passthru`, so they
+  never reach the lists behind it. A gate is never logged, and its file is
+  next to the rules zone (`/var/lib/bind/jarl/VIEW/strict.gate.jarl.invalid.rpz`).
+  For "everyone except these devices", a gate lists the address ranges
+  around them, at most a few hundred entries. named matches IPv4 clients as
+  IPv4-mapped IPv6 addresses, so the IPv6 part leaves `::ffff:0:0/96` out.

 Lists and rules need the `blocking` permission ([permissions.md](permissions.md)).

@@ -0,0 +1,253 @@
+# TLS certificates
+
+Jarl can obtain TLS certificates from an ACME CA (Let's Encrypt by
+default) and renew them itself, and put them where they are used:
+
+- **web**: jarld's own HTTPS (the web UI, the API and the CLI's server).
+- **dns**: files named can read, for DNS over TLS (DoT) and DNS over HTTPS
+  (DoH) in named's `tls` blocks.
+
+One certificate can have both uses. Jarl answers the ACME DNS-01
+challenge itself: in a zone it serves, or through Porkbun's API while
+Porkbun still serves the domain. So no other ACME client, hook script or
+DNS provider plugin is needed, and the server doesn't have to be
+reachable on port 80 or 443 from the internet.
+
+A certificate you renew some other way (certbot, acme.sh, your own CA)
+can be used too: Jarl reads it from its files and rereads it when they
+change.
+
+In the web UI: **Certificates** (administrators). In the CLI: `jarl cert`.
+In the API: `/api/v1/certificates`. All of it is for administrators only:
+a certificate's key can impersonate your server.
+
+## Quick start
+
+1. Set up the ACME account in `/etc/jarl/jarl.yaml` and restart jarld
+   (`systemctl restart jarl`). Try Let's Encrypt's staging CA first: its
+   certificates aren't trusted by browsers, but its rate limits are
+   generous, so mistakes cost nothing.
+
+   ```yaml
+   acme:
+     account:
+       directory: letsencrypt-staging   # then: letsencrypt
+       email: you@adbraun.lol           # optional
+       agree_tos: true                  # after reading https://letsencrypt.org/repository/
+   ```
+
+2. See where the challenges would go, without asking the CA for anything:
+
+   ```sh
+   jarl cert check --domain ns1.adbraun.lol
+   ```
+
+   ```
+   NAME             ROUTE    RECORD                           WHY
+   ns1.adbraun.lol  porkbun  _acme-challenge.ns1.adbraun.lol  adbraun.lol is served by Porkbun (curitiba.ns.porkbun.com, ...), so the record goes in through Porkbun's API
+   ```
+
+3. Create the certificate. Jarl obtains it at once; the command waits for
+   the outcome (usually under a minute, a few minutes through Porkbun):
+
+   ```sh
+   jarl cert create ns1 --domain ns1.adbraun.lol --use web --use dns
+   ```
+
+4. When it works, switch `directory` to `letsencrypt`, restart jarld and
+   renew: `jarl cert issue ns1`.
+
+From then on jarld renews it by itself.
+
+## The ACME account
+
+| Setting | Default | |
+|--|--|--|
+| `acme.account.directory` | `letsencrypt` | `letsencrypt`, `letsencrypt-staging`, or the directory URL of another ACME CA (ZeroSSL, Google, step-ca, ...). |
+| `acme.account.email` | `""` | Contact address for the CA (optional; Let's Encrypt no longer sends expiry mails). |
+| `acme.account.agree_tos` | `false` | You accept the CA's terms of service. Jarl registers no account without it, and says so. |
+| `acme.account.eab_kid`, `eab_hmac` | `""` | External Account Binding, for CAs that need it (ZeroSSL, Google): from the CA's dashboard. |
+| `acme.resolvers` | `1.1.1.1:53`, `9.9.9.9:53`, `8.8.8.8:53` | Recursive resolvers Jarl uses to see a domain as the CA does (below). |
+| `acme.ca_bundle` | `""` | A PEM file of extra CA certificates to trust when talking to the ACME server (a private CA). |
+| `acme.check_propagation` | `true` | Before telling the CA to look, wait until every name server of the zone serves the challenge (asked directly on port 53). |
+| `certificates.dir` | `<bind.config_dir>/tls` | Where certificates with the dns use are written for named. |
+
+The account is registered with the first certificate, and its key is
+kept in Jarl's database. Changing `directory` registers a new account with
+that CA; changing `email` updates the account.
+
+## Where the challenge goes
+
+For each name on a certificate, the CA looks up a TXT record at
+`_acme-challenge.<name>` (a wildcard `*.example.com` uses
+`_acme-challenge.example.com`). Jarl first looks the name up the way the
+CA will, through `acme.resolvers` (public resolvers, not this server,
+which may answer from an internal view), following a CNAME on
+`_acme-challenge` if there is one. Then it finds the zone that holds the
+record on the internet and that zone's public name servers:
+
+| The zone's public name servers | Route | Jarl writes the record |
+|--|--|--|
+| Porkbun's (`*.ns.porkbun.com`), with `porkbun.api_key` set | `porkbun` | through Porkbun's DNS API (TTL 600, Porkbun's minimum), and deletes it afterwards. The key is the one the registrar features use ([configuration.md](configuration.md#porkbun-registrar-and-dns-host)); it needs DNS record write access, "API Access" switched on for the domain, and the domain in `porkbun.domains` if you set that |
+| the name servers in Jarl's own zone of that name | `jarl` | in that zone, in every view that has it, as a change by `system` (in the history) |
+| anything else | none | nowhere: the certificate fails with what to do |
+
+The certificate's `challenge` setting chooses:
+
+- **`auto`** (the default) decides again at **every** issue and renewal.
+  While Porkbun serves `adbraun.lol`, the challenge goes to Porkbun. Once
+  you point the domain's name servers at your own servers, the next
+  renewal writes into Jarl's zone instead. Nothing needs changing.
+- **`jarl`** or **`porkbun`** pins the route. Jarl still checks that the
+  CA will see the record there and refuses to try otherwise (no wasted
+  attempt against the CA's rate limits).
+
+```sh
+jarl cert update ns1 --challenge porkbun     # or jarl, or auto
+```
+
+`jarl cert check NAME` (or **Check the names** in the web UI) shows the
+route for each name, and why, at any time.
+
+### Domains Jarl can't write to: a CNAME
+
+For a domain whose DNS is elsewhere (Cloudflare, say), point the
+challenge name at a zone this server serves on the internet, once, by
+hand:
+
+```
+_acme-challenge.www.example.org.  CNAME  www-example-org.acme.adbraun.lol.
+```
+
+Jarl follows the CNAME and writes the record at its target, in its zone
+`acme.adbraun.lol` (which must be delegated to this server). Renewals
+never touch the other provider again. That is the same idea as
+[acme.md section 7](acme.md#7-a-dedicated-acme-zone-cname-delegation).
+
+## Renewal
+
+jarld looks at every certificate every 10 minutes:
+
+- A certificate Jarl obtains is renewed at the time the CA suggests
+  (ACME Renewal Information, RFC 9773; asked twice a day, so a CA that
+  needs to replace certificates early, e.g. after revoking them, gets its
+  way), or, without one, two thirds into its lifetime: day 60 of a 90-day
+  certificate. Each renewal makes a new key.
+- When obtaining fails, jarld tries again after 1, 2, 4, 8, 16 hours, then
+  daily. The dashboard and the Certificates page show the error; so do
+  `jarl cert list` and Prometheus (`jarl_certificate_failing`).
+- New names or a new key type on a certificate make it due at once.
+- `jarl cert issue NAME` (**Renew** in the web UI) obtains it now. It runs
+  in the background: the command waits and reports, the web page updates
+  itself.
+
+A certificate counts as **expiring** (a warning) when less than a sixth of
+its lifetime is left, which for a renewing certificate means renewal has
+been failing for a while; and **expired** after its end.
+
+## Use: web (jarld's HTTPS)
+
+Only one certificate can have the web use. As soon as it has been
+obtained, jarld serves it on all its `listen` addresses, **without a
+restart**: each port speaks HTTPS and plain HTTP side by side.
+
+- HTTPS connections get the certificate (HTTP/2 included).
+- Plain HTTP from this server itself (`127.0.0.1`, `::1`) is served as
+  before, so local scripts and `--server http://127.0.0.1:8053` keep
+  working. So is plain HTTP from `trusted_proxies`.
+- Plain HTTP from anywhere else: browsers are redirected to
+  `https://<the same host and port>`; API requests get `400
+  https_required` (and, if they carried a token, a note that it crossed
+  the network unencrypted).
+
+Point browsers and CLIs at the certificate's name:
+`jarl config set server https://ns1.adbraun.lol:8053`. A CLI that uses the
+server's IP address fails the name check.
+
+A managed certificate takes over from `tls.cert_file`. Taking the web use
+off (or deleting the certificate) goes back to `tls.cert_file`, or to
+plain HTTP.
+
+## Use: dns (for named)
+
+Jarl writes the certificate to `<certificates.dir>/<name>/`:
+
+```
+/etc/bind/jarl/tls/ns1/fullchain.pem   (0644)
+/etc/bind/jarl/tls/ns1/privkey.pem     (0640, group bind)
+```
+
+Debian's AppArmor profile lets named read `/etc/bind`, and group `bind`
+lets it read the key. When a renewal changes the files and named's
+configuration names them, Jarl runs `rndc reconfig`, and named serves the
+new certificate at once (checked with BIND 9.20: DoT keeps working, with
+the new certificate).
+
+`jarl encrypted-dns setup` sets up DNS over TLS and HTTPS with it
+([encrypted-dns.md](encrypted-dns.md)). By hand, a `tls` statement names
+the files:
+
+```sh
+jarl option set tls 'dot { cert-file "/etc/bind/jarl/tls/ns1/fullchain.pem"; key-file "/etc/bind/jarl/tls/ns1/privkey.pem"; }' --toplevel
+jarl option set listen-on 'port 853 tls dot { 10.0.10.5; }' --add
+```
+
+A certificate named uses can't be deleted or lose its `dns` use until
+named no longer names its files.
+
+## A certificate you renew yourself
+
+```sh
+jarl cert create own --cert-file /etc/ssl/ns1/fullchain.pem --key-file /etc/ssl/ns1/privkey.pem --use web
+```
+
+Jarl checks that the key belongs to the certificate, warns when the file
+holds only the certificate without its intermediates (use the full
+chain), and rereads both files when they change (within 10 minutes, or at
+once with `jarl cert issue own`). A pair that doesn't match is reported
+and the last good one stays in use. jarld runs as user `jarl`, which must
+be able to read both files (e.g. `chgrp jarl` and `chmod 640`, or have
+your renewal hook copy them somewhere it can read).
+
+## Security notes
+
+- Certificates Jarl obtains, their keys and the ACME account key are kept
+  in Jarl's database, so they are in its backups (like TSIG secrets). The
+  API never returns a key.
+- Every publicly trusted certificate is published in Certificate
+  Transparency logs, with all its names. A name like `ns1.adbraun.lol`
+  used for both the web UI and DNS reveals less than separate names. Avoid
+  wildcards where one name will do: a wildcard's key is good for every
+  name in the domain.
+- Using one certificate for jarld and named puts its key in two places.
+  On one server, where jarld already writes named's configuration, that
+  changes little.
+
+## API
+
+| Method | Path | |
+|--|--|--|
+| GET | `/certificates` | `certificates` (each with `status` {`state`: ok, pending, failing, expiring, expired; `message`}, `next_attempt`, `issuing_since` while being obtained, `serving`, `files`) and `account` |
+| POST | `/certificates` | `{"name": "ns1", "domains": [...], "uses": ["web", "dns"], "challenge": "auto", "key_type": "ec256"}`, or `{"name", "source": "file", "cert_file", "key_file", "uses"}`. One Jarl obtains starts being obtained at once (`"issue": false` leaves it to the loop) |
+| POST | `/certificates/check` | `{"domains": [...], "challenge": "auto"}`: where each challenge would go (`routes`: `route`, `target`, `zone`, `public_ns`, `why` or `error`) |
+| GET, PATCH, DELETE | `/certificates/{name}` | `domains` and `uses` replace the whole list |
+| POST | `/certificates/{name}/issue` | obtain now: 202, then poll `GET /certificates/{name}` until `issuing_since` is gone; a file certificate is reread (200) |
+| POST | `/certificates/{name}/check` | the routes for an existing certificate |
+
+## Testing with Pebble
+
+[Pebble](https://github.com/letsencrypt/pebble) is Let's Encrypt's test
+CA. Point it at a test named, and Jarl at it:
+
+```sh
+docker run -d --name pebble --network host -e PEBBLE_VA_NOSLEEP=1 \
+  ghcr.io/letsencrypt/pebble -config test/config/pebble-config.json -dnsserver 127.0.0.1:53
+docker cp pebble:/test/certs/pebble.minica.pem /etc/jarl/pebble.pem
+```
+
+```yaml
+acme:
+  account: {directory: "https://localhost:14000/dir", agree_tos: true}
+  resolvers: ["127.0.0.1:53"]
+  ca_bundle: /etc/jarl/pebble.pem
+```
@@ -41,7 +41,7 @@ jarl whoami
 | API token (`@FILE` reads it from a file) | `--token` | `JARL_TOKEN` | `token` |
 | Skip TLS verification | `--insecure` | | `insecure` |
 | Extra trusted CA (PEM) | `--ca-cert` | | `ca_cert` |
-| Changeset to stage into | `-C/--changeset` | `JARL_CHANGESET` | |
+| Changeset to stage into (and the default for `jarl changeset diff/apply/...`) | `-C/--changeset` | `JARL_CHANGESET` (checked: open and yours, see [Changesets](#changesets-stage-review-apply)) | |

 Flags win over the environment, and the environment wins over the file. The
 file is `jarl/config.yaml` in the user's configuration directory, or
@@ -143,6 +143,7 @@ to stderr with `-o json` or `-o yaml`, so stdout holds just the documents.
 | `-n, --dry-run` | Validate and show the diff without changing anything. |
 | `-C, --changeset ID` | Stage the change into an open changeset instead of applying it. |
 | `--force` | Overwrite BIND files that were changed outside Jarl (drift). |
+| `--accept-risk` | Confirm a change that opens a public view up, such as an open resolver ([exposure.md](exposure.md)). Without it such a change stops with exit 5. |
 | `-q, --quiet` | Print only errors, or just the IDs: of what a command creates, or what `show` and `list` find (like `-o id`). |

 ## Exit codes
@@ -182,12 +183,21 @@ jarl zone create consul --type forward --forwarder "127.0.0.1 port 8600"
 jarl zone update adbraun.lol --ttl 3600 --contact hostmaster@adbraun.lol --refresh 7200
 jarl zone update adbraun.lol --move-to-view internal
 jarl zone delete lab.adbraun.lol [-y]
+jarl zone disable lab.adbraun.lol [--view V]   # named stops serving it; kept (and editable) in Jarl
+jarl zone enable lab.adbraun.lol [--view V]
 jarl zone file adbraun.lol                             # the generated zone file
 jarl zone import adbraun.lol db.adbraun.lol [--replace] [--use-soa]
 jarl zone serials adbraun.lol                          # are the secondaries (or primaries) on the current serial?
 jarl zone delegation adbraun.lol [--resolver 9.9.9.9]  # does the parent zone delegate it correctly?
 ```

+**Disabling a zone** leaves it out of named's configuration but keeps it in
+Jarl: records, options and history, which can still be edited. Its names
+are then answered by recursion where the view offers it (the internet's
+version of the zone, if any), and REFUSED elsewhere; `disable` says which.
+Enabling it serves it as it is then. A signed zone can't be disabled (turn
+signing off first), nor a zone another view shares with `in-view`.
+
 Reverse names follow the dots (the nibbles in IPv6), so a reverse zone
 covers a /8, /16 or /24 (a multiple of /4 for IPv6). A network in between is
 covered by several zones, created together in one changeset: a /22 by four
@@ -201,6 +211,18 @@ router, answers for the rest of the /24. IPv4 networks smaller than a /24
 are deleted. Try it with `--dry-run` first. `--option "NAME VALUE"` on
 `zone create` sets any zone option in the same step.

+Linked zones ([views.md](views.md#linked-zones)) keep their shared
+records in step across views:
+
+```sh
+jarl zone link adbraun.lol --view internal --with external
+jarl zone create adbraun.lol --view vps --link-with external
+jarl zone unlink adbraun.lol --view vps
+jarl record add adbraun.lol nas A 10.0.10.20 --view internal --local   # this view only
+jarl record set adbraun.lol www A 10.0.10.5 --view internal --local    # override the shared www A here
+jarl record update 1234 --local | --shared
+```
+
 When a zone exists in several views, add `--view NAME` to commands that
 name it.

@@ -264,8 +286,20 @@ jarl record disable --id 1234                             # by ID; same for enab

 # reverse zones: name records by address; the host name needs no final dot
 jarl record add 0.10.10.in-addr.arpa 10.10.0.20 PTR nas.adbraun.lol
+
+# a zone in several views (split horizon): the same change in each
+jarl record add adbraun.lol mx2 A 203.0.113.5 --view internal,external
+jarl record delete adbraun.lol old A --view all -y
 ```

+**Several views.** When a zone exists in more than one view, the record
+commands that change records (`add`, `set`, `delete`, `disable`,
+`enable`) take `--view a,b` or `--view all` (every view the zone is in).
+The changes are applied together as one changeset: if one view refuses
+(the zone isn't in it, a CNAME conflict, ...), no view is changed. With
+`--changeset` they are staged there instead. Keep split-horizon data that
+differs per view (an internal address, say) to one view at a time.
+
 Names are relative to the zone (`@` is the apex) unless they end with a
 dot. Data uses zone file syntax, except that TXT/SPF take plain text: Jarl
 adds the quotes and splits long values into 255-byte strings. In reverse zones the name can be the address
@@ -273,7 +307,9 @@ adds the quotes and splits long values into 255-byte strings. In reverse zones t
 host name (a bare `nas` is refused, since it would mean
 `nas.0.10.10.in-addr.arpa.`). `--ptr`
 keeps the PTR record in the reverse zone in step (when that zone is managed
-by Jarl). Every record type BIND supports can be used. Jarl knows the
+by Jarl); `jarl record update ID --ptr` with nothing else adds the PTR record
+if it is missing, e.g. after creating the reverse zone. In linked zones, the
+reverse zones of every linked view count. Every record type BIND supports can be used. Jarl knows the
 syntax of the common ones and checks them strictly, and the rest are
 validated by parsing.

@@ -324,9 +360,9 @@ reads standard input.
 export JARL_CHANGESET=$(jarl changeset create "renumber lab" -q)
 jarl record set lab.adbraun.lol gw A 10.20.0.1
 jarl record set lab.adbraun.lol nas A 10.20.0.10
-jarl changeset diff $JARL_CHANGESET       # validation + named-checkconf + diff
-jarl changeset remove $JARL_CHANGESET 2   # drop operation #2
-jarl changeset apply $JARL_CHANGESET
+jarl changeset diff                       # validation + named-checkconf + diff
+jarl changeset remove 2                   # drop operation #2
+jarl changeset apply
 unset JARL_CHANGESET

 jarl changeset list [--status open|applied|discarded] [--mine]
@@ -336,8 +372,74 @@ jarl history [--limit 50]
 jarl changeset revert 42 -q | xargs jarl changeset apply   # undo an applied changeset
 ```

+`show`, `diff`, `apply`, `discard` and `remove` work on the changeset you
+name, else the one in `-C`, else the one in `JARL_CHANGESET`.
+
+A changeset from `JARL_CHANGESET` is checked before anything uses it,
+because an exported ID easily outlives its changeset, and IDs keep growing
+(every change, live ones included, gets the next one), so a stale or
+mistyped ID can later name a changeset that isn't yours:
+
+- Staging into it, and `diff`, `apply`, `discard` and `remove` on it, need
+  it to be open and yours. Otherwise the command stops and says why
+  (`there is no changeset 99`, `changeset 42 is applied`, `changeset 57 is
+  certbot's`) and what to do. Commands that only read (`jarl zone list`)
+  and `jarl changeset create` don't care, so you can always start a new one.
+- Each command says on stderr which changeset it uses: `changeset 42 (renumber
+  lab, 2 operations) from JARL_CHANGESET` (not with `-q`).
+- After `apply` or `discard`, a reminder to `unset JARL_CHANGESET`: the CLI
+  can't change your shell's environment, and later changes would fail to
+  stage.
+
+`-C ID` and an ID argument are used as given, without these checks (jarld
+still refuses a changeset that isn't open, or another user's unless you are
+an administrator).
+
 Changesets staged in the web UI show up here too, and the other way round.

+## Internet exposure
+
+```sh
+jarl exposure                                         # public views, findings, fixes, rate limiting
+jarl exposure fix external exposure_rate_limit        # rate limiting, log-only first
+jarl exposure fix external exposure_rate_limit_log_only   # then start enforcing
+jarl exposure fix server exposure_version
+jarl exposure ack external security_open_resolver --reason "public resolver, monitored"
+jarl exposure unack external security_open_resolver
+jarl view update external --exposure public|private|auto
+```
+
+See [exposure.md](exposure.md).
+
+## Encrypted DNS
+
+```sh
+jarl encrypted-dns                                   # what is set up, what to give clients
+jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 [--address IPv6] [--doh-port 8443] [--no-doh]
+jarl encrypted-dns check --address 10.0.10.5 --doh-port 443
+jarl encrypted-dns disable
+```
+
+See [encrypted-dns.md](encrypted-dns.md).
+
+## Certificates
+
+```sh
+jarl cert check --domain ns1.adbraun.lol             # where each challenge would go, and why
+jarl cert create ns1 --domain ns1.adbraun.lol --use web --use dns   # obtained at once; waits
+jarl cert create wild -d adbraun.lol -d '*.adbraun.lol' --use dns --key-type ec384
+jarl cert create own --cert-file /etc/ssl/ns1/fullchain.pem --key-file /etc/ssl/ns1/privkey.pem --use web
+jarl cert list
+jarl cert show ns1
+jarl cert issue ns1                                  # renew now (--no-wait to return at once)
+jarl cert update ns1 --challenge porkbun             # auto, jarl or porkbun
+jarl cert update ns1 --use dns                       # --use and --domain replace the list (--use none)
+jarl cert delete ns1
+jarl cert account                                    # the ACME account (set in jarl.yaml)
+```
+
+Administrators only. See [certificates.md](certificates.md).
+
 ## Views, ACLs, TSIG keys, options, settings

 ```sh
@@ -347,8 +449,10 @@ jarl view order internal external
 jarl view update external --match-clients "!homelab,any"
 jarl view delete old [--cascade]
 jarl view color internal green                # web UI colour; "default" resets it
+jarl view key external [--named-conf]         # the key that selects the view (dig -k), docs/views.md

 jarl acl create homelab 192.168.1.0/24 10.10.0.0/16 localhost
+jarl acl create dhcp 10.0.10.101-10.0.10.199 2001:db8::100-2001:db8::1ff   # ranges (concepts.md)
 jarl acl update homelab --add 10.20.0.0/16 --remove 10.10.0.0/16
 jarl acl update homelab --rename lan          # references are updated
 jarl acl delete lan                           # refused while in use
@@ -362,12 +466,22 @@ jarl option list [--view V | --zone Z | --toplevel | --all]
 jarl option set recursion yes
 jarl option set allow-recursion '{ homelab; localhost; }'
 jarl option set forwarders '{ 1.1.1.1; 9.9.9.9; }'
-jarl option set allow-transfer '{ key xfer; }' --zone adbraun.lol
+jarl option set forwarders 1.1.1.1 9.9.9.9    # the same: braces are added to a list
+jarl option set allow-transfer 'key xfer; 10.0.10.53' --zone adbraun.lol
+jarl option set allow-query '10.0.20.1-10.0.20.99; localhost' --view internal
 jarl option set response-policy '{ zone "rpz.local"; }' --view internal
 jarl option set logging '{ channel q { file "/var/log/named/query.log" versions 3 size 20m; }; category queries { q; }; }' --toplevel
 jarl option unset forwarders
 jarl option describe                          # every option allowed at this scope
 jarl option describe allow-query-cache        # grammar and ARM description
+```
+
+Options that end in a list (`allow-*`, `forwarders`, `listen-on`, ...) may
+be given without the braces: elements are separated by `;`, `,` or spaces,
+and `key NAME` and `port N` stay with their element. Options are always
+listed in one fixed order (see [concepts.md](concepts.md)).
+
+```sh

 jarl settings show
 jarl settings set --ns ns1.adbraun.lol.,ns2.adbraun.lol. --contact hostmaster@adbraun.lol --ttl 3600
@@ -416,13 +530,17 @@ working.

 ## Query statistics

+`--view internal,vps` (or repeated) limits any `jarl stats` command to those
+views ([stats.md](stats.md#views)).
+
 ```sh
 jarl stats status
 jarl stats summary --since 7d
-jarl stats top names | clients | nxdomain | servfail | refused | blocked [--since 24h] [--limit 20]
+jarl stats top names | clients | nxdomain | servfail | refused | blocked | blocked-clients [--since 24h] [--limit 20]
 jarl stats timeline --since 6h [--key rcode:NXDOMAIN] [--table]
 jarl stats heatmap --since 28d
 jarl stats breakdown qtype | rcode | view | zone | answer | rtt | blocklist
+jarl stats server                                # named's memory, CPU, cache, clients; host; disk space
 ```

 Statistics must be enabled in `jarl.yaml`, and `-o json` exports the data.
@@ -442,6 +560,15 @@ jarl block allow DOMAIN [--exact] [--view V]...  # an exception that beats every
 jarl block list
 jarl block delete DOMAIN [--view V] | --id ID
 jarl block check DOMAIN                          # blocked? by which rule or list?
+jarl block pause [DURATION]                      # let everything through for a while (default 10m, at most 24h)
+jarl block pause indefinitely                    # ... until 'jarl block resume'
+jarl block step list | add NAME | rename STEP NEW | order STEP... | delete STEP
+jarl block group list
+jarl block group add NAME MEMBER... [--step S] [--view V]...   # addresses, networks or ACLs
+jarl block group update GROUP [--add M] [--remove M] [--step S] [--name N]
+jarl block group delete GROUP
+jarl blocklist update LIST --step STEP           # devices at that step or above get it
+jarl block resume
 ```

 See [blocking.md](blocking.md).
@@ -68,7 +68,9 @@ both, using a single mechanism:
 * `POST /api/v1/apply` (CLI: `jarl apply -f changes.yaml`) applies a list of
  operations as one changeset in a single request.
 * `?dry_run=1` (CLI: `--dry-run`) runs the whole pipeline except installing
-  files and reloading named, and shows the problems and the diff.
+  files and reloading named, and shows the problems and the diff. Each
+  part of a named.conf diff says which block it is in, after the `@@`
+  line numbers: `@@ -50,6 +49,8 @@ view "internal" {`.

 **Why bundling matters.** Some changes only make sense together. Turning
 `www` from an A record into a CNAME means deleting the A record and adding
@@ -159,6 +161,38 @@ RFC 1982 arithmetic.
  Jarl checks them before named does. Statements that Jarl manages itself
  (`zone`, `view`, `acl`, `key`, a zone's `type`/`file`, a view's
  `match-clients`, ...) can't be set as raw options.
+  Options of a block are kept in one fixed order, the same in named.conf,
+  the web UI and the CLI: grouped (files, listening, access control,
+  recursion and forwarding, DNSSEC, transfers and notify, then the rest),
+  alphabetical within a group. So the same option is in the same place in
+  every view and zone. Top-level statements stay in the order they were
+  added.
+* **Address ranges.** Wherever named takes an address match list (ACLs,
+  views' `match-clients` and `match-destinations`, options such as
+  `allow-query` or `allow-recursion`) and in blocking's client groups, Jarl
+  also takes a range of addresses: `10.0.10.101-10.0.10.199`,
+  `2001:db8::100-2001:db8::1ff`, `!10.0.10.150-10.0.10.160`. BIND only
+  matches addresses and prefixes, so Jarl keeps the range as you wrote it
+  and writes the fewest prefixes that cover exactly that range to
+  named.conf, with the range as a comment above them:
+  ```
+  acl "dhcp" {
+  	// 10.0.10.101-10.0.10.199
+  	10.0.10.101;
+  	10.0.10.102/31;
+  	10.0.10.104/29;
+  	10.0.10.112/28;
+  	10.0.10.128/26;
+  	10.0.10.192/29;
+  };
+  ```
+  Nothing outside the range is matched (writing such lists by hand, it is
+  easy to round to `10.0.10.96/27` and let in more than you meant). Both
+  ends are full addresses of the same family, and spaces around the dash
+  are fine. A range takes at most 62 prefixes for IPv4 and 254 for IPv6.
+  The web UI shows what a range becomes while you type it. A range in the
+  IPv4-mapped space (`::ffff:0:0/96`) gets a warning: named can see IPv4
+  clients as such addresses, so it may match IPv4 clients too.
 * **Settings** are Jarl's defaults for new zones: name servers, SOA contact
  and timers, default TTL, serial policy.

@@ -20,7 +20,7 @@ The CLI has its own small configuration file, described in [cli.md](cli.md).
 |-----|---------|---------|
 | `listen` | `["127.0.0.1:8053"]` | Addresses to listen on (`host:port`, several allowed). Keep these on localhost and management networks. Ports below 1024 (`"192.168.10.2:443"`) work because `jarl.service` gives jarld the `CAP_NET_BIND_SERVICE` capability, and only that ([HTTPS on port 443](#example-https-on-port-443)). |
 | `socket` | `/run/jarl/jarl.sock` | A local unix socket for the API. Requests on it from root or jarld's own user need no token and have administrator rights; anyone else must send a token ([permissions.md](permissions.md#the-local-socket)). The `jarl` CLI uses it when no server is configured. At most 107 bytes long; `""` turns it off. If it can't be created, jarld logs a warning and serves the network addresses only. |
-| `tls.cert_file`, `tls.key_file` | (empty: plain HTTP) | PEM certificate chain and key. Both or neither. The files are rechecked every 10 minutes and on SIGHUP (`systemctl reload jarl`), so renewed certificates are used without a restart. |
+| `tls.cert_file`, `tls.key_file` | (empty: plain HTTP) | PEM certificate chain and key. Both or neither. The files are rechecked every 10 minutes and on SIGHUP (`systemctl reload jarl`), so renewed certificates are used without a restart. Easier: let Jarl obtain and renew one ([certificates.md](certificates.md), use `web`), which takes over from these. With a certificate, the `listen` ports serve HTTPS and plain HTTP side by side: plain HTTP is still served to this server itself and to `trusted_proxies`; anyone else is sent to HTTPS. |
 | `trusted_proxies` | `[]` | Addresses or prefixes of reverse proxies whose `X-Forwarded-For` and `X-Forwarded-Proto` (or `Forwarded: proto=`) headers are believed. Needed for correct client IPs in the audit log and for rate limiting behind a proxy, and for knowing that a proxied request came over HTTPS (the session cookie's Secure flag, `acme.httpreq`). From other addresses these headers are ignored. |
 | `session.lifetime` | `12h` | A web session ends this long after login... |
 | `session.idle_timeout` | `2h` | ...or after this long without requests. |
@@ -73,6 +73,35 @@ The `stats:` section turns on query statistics (off by default). See
 [stats.md](stats.md) for every setting and what it changes in named's
 configuration. Changing it takes effect when jarld restarts.

+### Prometheus metrics
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `metrics.enabled` | `false` | Serve Prometheus metrics at `/metrics` on `listen` and the local socket ([metrics.md](metrics.md)). |
+| `metrics.listen` | `[]` | Extra `ADDRESS:PORT`s that serve only `/metrics`, over plain HTTP, e.g. `["0.0.0.0:9450"]`. |
+| `metrics.allow` | `["127.0.0.1", "::1"]` | Addresses or prefixes that may scrape without a token. |
+| `metrics.token` | `""` | A bearer token (at least 16 characters) that lets any address scrape. Keep jarl.yaml readable by root and jarld only when set. |
+
+Query counters need `stats.enabled` as well. Changes take effect when jarld
+restarts.
+
+### Certificates (ACME account)
+
+The account Jarl obtains certificates with, and where it writes them for
+named. See [certificates.md](certificates.md). Changes take effect when
+jarld restarts.
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `acme.account.directory` | `letsencrypt` | `letsencrypt`, `letsencrypt-staging` or an ACME directory URL (`https://...`). |
+| `acme.account.email` | `""` | Contact address for the CA (optional). |
+| `acme.account.agree_tos` | `false` | You accept the CA's terms of service; no account is registered without it. |
+| `acme.account.eab_kid`, `acme.account.eab_hmac` | `""` | External Account Binding, for CAs that need it. Both or neither. Keep the file readable only by root and jarld. |
+| `acme.resolvers` | `["1.1.1.1:53", "9.9.9.9:53", "8.8.8.8:53"]` | Recursive resolvers (`address:port`) used to see domains as the CA does: their zone, public name servers, and a CNAME on `_acme-challenge`. Not this server: it may answer from an internal view. |
+| `acme.ca_bundle` | `""` | PEM file of extra CA certificates to trust for the ACME server (a private CA). |
+| `acme.check_propagation` | `true` | Wait until every name server of the zone serves a challenge before the CA is told to look (they are asked directly, on port 53). |
+| `certificates.dir` | `<bind.config_dir>/tls` | Where certificates with the `dns` use are written for named: `<dir>/<name>/fullchain.pem` and `privkey.pem`. |
+
 ### ACME (lego httpreq endpoint)

 An endpoint for lego's `httpreq` DNS provider, so lego and Traefik can
@@ -114,18 +143,27 @@ there (`ReadWritePaths`). If you change them, update both
 ReadWritePaths=/srv/bind/jarl /srv/bind/zones
 ```

-### Porkbun (registrar)
+### Porkbun (registrar and DNS host)

-With an API key, Jarl can show and set a domain's name servers, glue
-records and DNSSEC DS records at Porkbun, after checking that the change
-won't break the domain ([dnssec.md](dnssec.md#porkbun)). Without a key
-(the default) nothing about Porkbun shows up.
+With an API key, Jarl can:
+
+- show and set a domain's name servers, glue records and DNSSEC DS records
+  at Porkbun, after checking that the change won't break the domain
+  ([dnssec.md](dnssec.md#porkbun));
+- publish the DNS-01 challenges of certificates it obtains while Porkbun
+  still serves the domain's DNS ([certificates.md](certificates.md#where-the-challenge-goes)):
+  it only adds TXT records at `_acme-challenge` names and removes them
+  again.
+
+Without a key (the default) nothing about Porkbun shows up, and
+certificates for domains Porkbun serves can't be obtained (`jarl cert
+check` says so).

 | Key | Default | Meaning |
 |-----|---------|---------|
 | `porkbun.api_key` | `""` | The API key (`pk1_...`). Set both or neither. |
 | `porkbun.secret_api_key` | `""` | Its secret (`sk1_...`). |
-| `porkbun.domains` | `[]` | Only these domains (default: every primary zone the key can reach). |
+| `porkbun.domains` | `[]` | Only these domains, for both uses (default: any domain the key can reach). |

 The key can move your domain anywhere, so it is only ever read from this
 file: it isn't stored in the database or backups, and there is no API to
@@ -10,6 +10,7 @@ internal/
  dnsname/            DNS name handling: FQDNs, relative names, check-names rules, reverse zones
  rr/                 record data parsing/canonicalization (miekg/dns), TXT quoting, the record type catalog
  namedconf/          named.conf lexer, parser and printer; address match lists
+  iprange/            address ranges (10.0.10.101-10.0.10.199): parsing and the exact prefix cover
  catalog/            every BIND 9.20 statement: grammar (from named.conf(5)) + ARM descriptions, embedded
  validate/           whole-configuration validation and security lints
  render/             State → named.conf, keys.conf and zone files, with a source map for error messages
@@ -117,7 +118,13 @@ checker tests work with the installed `bind9-utils` too.
 ACME hooks, DNSSEC signing, backup and restore with keys, audit) and checks
 the answers with `dig`. The Porkbun code is tested against
 `porkbun.Fake`, an in-memory stand-in for its API; nothing calls the real
-one. `KEEP=1` leaves named
+one. With Docker, certificates are tested end to end against
+[Pebble](https://github.com/letsencrypt/pebble), Let's Encrypt's test CA
+(`ghcr.io/letsencrypt/pebble`, host network, ports 14000 and 15000),
+which checks the challenges against the test named: obtaining, HTTPS
+from jarld, DNS over TLS from named, renewal. `PEBBLE=0` skips that; the
+certs package's own tests use a fake DNS server and `porkbun.Fake`, and
+never a real CA. `KEEP=1` leaves named
 and jarld running afterwards. The output says where; set `JARL_CLI_CONFIG`
 to that directory's `cli.yaml` to keep using the CLI against it.

@@ -175,13 +175,17 @@ Before you go public:
 ## Porkbun

 With a Porkbun API key, Jarl manages a domain's name servers, glue records
-and DS records at Porkbun, and checks each change before making it.
+and DS records at Porkbun, and checks each change before making it. The
+same key also lets Jarl publish the DNS-01 challenges of its own
+certificates while Porkbun serves the domain's DNS
+([certificates.md](certificates.md#where-the-challenge-goes)).

 **Setting it up**

 1. At porkbun.com, *Account → API Access*: create a key. If you can,
-   limit it to the domain and the permissions it needs (domains, read),
-   and to your server's address.
+   limit it to the domain and the permissions it needs, and to your
+   server's address. The registrar features need the domain permissions;
+   certificate challenges need DNS record write access too.
 2. On the domain's page, switch **API Access** on (Porkbun refuses API
   calls for a domain until you do).
 3. Put the key in `/etc/jarl/jarl.yaml` and restart jarld:
@@ -0,0 +1,131 @@
+# DNS over TLS and HTTPS
+
+named (BIND 9.20) can answer over encrypted connections itself: DNS over
+TLS (DoT, port 853) and DNS over HTTPS (DoH, at `/dns-query`). Your
+phones, laptops and browsers then ask this server without anyone on the
+network seeing or changing their queries, and they get exactly what plain
+DNS gives them: the same views, the same records and the same blocking.
+
+Jarl sets it up in one step: a certificate for the host name clients
+connect to (obtained and renewed by Jarl, [certificates.md](certificates.md)),
+named's `tls` statement and listeners on the addresses you choose, and the
+host name's address records in your private views.
+
+In the web UI: **Encrypted DNS** (administrators). In the CLI: `jarl
+encrypted-dns`. In the API: `/api/v1/encrypted-dns`.
+
+## Setting it up
+
+```sh
+jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 --address 2a02:8013:7f3d:10::5
+```
+
+This:
+
+1. **finds or obtains the certificate**: one Jarl manages whose names cover
+   the host name (`--certificate NAME` to pick one), or a new one named
+   after the host name's first label, which Jarl obtains from the CA (the
+   command waits). The certificate gets the `dns` use, so it is written
+   where named can read it, and named rereads it on every renewal.
+2. **checks the ports**: nothing else may listen on the chosen addresses
+   on port 853 or the DoH port. Jarl looks at the host's listening sockets
+   (it binds nothing) and says what is in the way, e.g. `jarld (Jarl's web
+   UI and API) listens on 10.0.10.5 port 443`, and which port is free
+   instead (`--doh-port 8443`).
+3. **stages named's configuration**, as one change you can review:
+
+   ```
+   tls jarl-dns { cert-file ".../tls/dns/fullchain.pem"; key-file ".../tls/dns/privkey.pem"; protocols { TLSv1.2; TLSv1.3; }; };
+   options {
+       listen-on port 853 tls jarl-dns { 10.0.10.5; };
+       listen-on port 443 tls jarl-dns http default { 10.0.10.5; };
+       listen-on-v6 port 853 tls jarl-dns { 2a02:8013:7f3d:10::5; };
+       ...
+   ```
+
+   named listens on port 53 on every address only while there is no
+   `listen-on` statement at all. The first one, for DoT, would end that, so
+   when you have none the setup adds `listen-on { any; };` (and the same
+   for IPv6) to keep plain DNS where it was.
+4. **adds the host name's A and AAAA records** with the chosen addresses,
+   in the private views that have a zone for it (`--view` to choose). In a
+   linked zone they are local to the view, so the name doesn't reach your
+   external view.
+
+Running it again replaces the earlier setup (other addresses, ports, DoT
+or DoH only with `--no-doh` / `--no-dot`). `jarl encrypted-dns disable`
+takes the listeners and the `tls` statement out; the certificate and the
+records stay.
+
+| Option | Default | |
+|--|--|--|
+| `--hostname` | | The name clients connect to; the certificate is for it |
+| `--address` | | This server's addresses to listen on (repeat). Choose your own networks' addresses: a listener on a public address answers anyone who reaches it, like port 53 there |
+| `--certificate` | one for the host name, obtained if needed | A certificate Jarl manages |
+| `--no-dot`, `--no-doh` | both on | |
+| `--dot-port` | 853 | Clients expect 853 |
+| `--doh-port` | 443 | Any free port; clients take it in the URL |
+| `--view` | private views with the zone | Where the host name's records go |
+
+In the web UI the same form checks the ports as you choose, offers the
+free port, and obtains the certificate before setting up.
+
+## Which view clients get
+
+A DoT or DoH client gets the view its address matches, as over plain DNS:
+your phone at home gets the internal view, with its records and blocking.
+Choosing a view by key (`match-clients { key ...; }`) doesn't work over
+DoT and DoH, as clients don't sign their queries.
+
+## Clients
+
+`jarl encrypted-dns` (and the page) shows what to give them:
+
+```
+For DoT clients:   dns.adbraun.lol
+For DoH clients:   https://dns.adbraun.lol/dns-query
+```
+
+| Client | Where |
+|--|--|
+| Android 9+ | Settings → Network → Private DNS → Private DNS provider hostname: `dns.adbraun.lol` (DoT) |
+| Linux (systemd-resolved) | `/etc/systemd/resolved.conf`: `DNS=10.0.10.5#dns.adbraun.lol` and `DNSOverTLS=yes` (or `opportunistic`, which falls back to plain DNS) |
+| Firefox | Settings → Privacy & Security → DNS over HTTPS → Increased protection → Custom: the DoH URL |
+| Chrome, Edge | Settings → Privacy and security → Security → Use secure DNS → custom: the DoH URL |
+| Windows 11 | Settings → Network → your connection → DNS server assignment → Edit: the server's address, DNS over HTTPS on (manual template), the DoH URL |
+
+Test from a machine on your network:
+
+```sh
+kdig +tls-ca +tls-host=dns.adbraun.lol @10.0.10.5 example.com
+dig +https @10.0.10.5 example.com
+curl -s -H 'accept: application/dns-json' 'https://dns.adbraun.lol/dns-query?name=example.com'
+```
+
+**Android away from home.** Private DNS in hostname mode applies on every
+network. Away from home, your server can't be reached, and Android then
+resolves nothing at all ("Private DNS server cannot be accessed"). Use a
+VPN home (WireGuard) when you're out, or switch Private DNS to
+*Automatic* when you leave. Firefox's *Increased protection* and
+systemd-resolved's `opportunistic` fall back to normal DNS by themselves.
+
+Clients check the certificate against the host name, so the name must
+resolve to this server for them: the setup adds it to your private views.
+Open the ports in the server's firewall for your own networks only.
+
+## What Jarl checks
+
+* A `tls` statement whose files don't exist is an error
+  (`tls_file_missing`): named won't load its configuration without them.
+* A certificate named uses can't be deleted, nor lose its `dns` use: turn
+  encrypted DNS off first.
+* Listeners you wrote yourself are left alone; the page notes them.
+
+## API
+
+| Method | Path | Body |
+|--------|------|------|
+| GET | `/encrypted-dns` | `enabled`, `certificate`, `hostname`, `dot` and `doh` (address and port), `dot_host`, `doh_url`, `listeners`; for the form: `addresses` (this server's, with `private`), `views` (with `public`, and `has_zone` for `?hostname=`), `certificates` |
+| POST | `/encrypted-dns/check` | `{"addresses", "dot", "doh", "dot_port", "doh_port"}`: `conflicts` (address, port, what) and `free_doh_port` |
+| POST | `/encrypted-dns` | `{"hostname", "certificate", "addresses", "dot", "doh", "dot_port", "doh_port", "views"}`: staged or applied like any change; 409 while the certificate hasn't been obtained |
+| DELETE | `/encrypted-dns` | Turns it off |
@@ -0,0 +1,213 @@
+# Internet exposure
+
+When a view (or the whole server) can be reached from the internet, a few
+things matter that don't on your own network: it shouldn't help attackers
+flood others with DNS answers (amplification), recurse for strangers, or
+tell scanners its exact version. Jarl works out which views are public,
+checks them, and stages the fixes for you to review.
+
+In the web UI: **Exposure** (and its card on the dashboard). In the CLI:
+`jarl exposure`. In the API: `GET /api/v1/exposure`.
+
+## Which views are public
+
+A view is **public** when its `match-clients` let in anyone: after ACLs
+and ranges are filled in, they end in a catch-all (`any`, `0.0.0.0/0`,
+`::/0`, or a prefix wider than /8 for IPv4 or /16 for IPv6), or they are
+empty, which named reads as "any". A typical external view
+(`match-clients { any; }` or `{ !internal; any; }`) is public.
+
+A view that lists the networks it serves is **private**, whatever kind of
+addresses those are. An internal view for your global IPv6 prefix
+(`2a02:8013:7f3d:10::/64`) is as private as one for `192.168.1.0/24`:
+listing a network says "these are mine". Jarl doesn't look at whether
+addresses are private (RFC 1918, ULA) for this, because on IPv6 your own
+devices have global addresses.
+
+A view whose `match-destinations` list only private addresses (it answers
+only on a private interface) is private too.
+
+**A server without views** has no match list, so Jarl looks at
+`allow-query` and where named listens: it is public when anyone may query
+it (`allow-query` unset, or with a catch-all) **and** named listens on an
+address that isn't private (a public IPv4 address or a global IPv6
+address of this host). This can't see your firewall, so it is a guess.
+
+**When Jarl gets it wrong**, override it per view: `public`, `private` or
+`auto`. For example, behind a NAT port forward named only ever sees
+private addresses although it is reachable from the internet.
+
+```sh
+jarl view update external --exposure public
+jarl settings set --exposure private          # a server without views
+```
+
+The Exposure page shows each view's classification and the reason
+("match-clients ends in any", "match-clients lists only homelab, no
+catch-all"), with a selector for the override.
+
+## The checks
+
+They run on public views only, and are warnings (they don't stop you
+applying) unless acknowledged.
+
+| Code | What | Fix Jarl can stage |
+|------|------|-------------------|
+| `exposure_rate_limit` | No response rate limiting: the view can be used to flood others with its answers (DNS amplification) | `rate-limit { responses-per-second 10; log-only yes; exempt-clients { your secondaries }; }` |
+| `exposure_rate_limit_log_only` (info) | Rate limiting only logs | The same block without `log-only`: start enforcing |
+| `security_open_resolver` | Recursion for anyone: an open resolver | `recursion no` in that view |
+| `exposure_minimal_any` | ANY queries get full answers, a favourite for amplification | `minimal-any yes` |
+| `exposure_cache_snooping` | `allow-query-cache` lets anyone see what your clients look up | `allow-query-cache { none; }` |
+| `security_open_transfer` | Zone transfers for anyone | none: allow your secondaries or a TSIG key |
+| `exposure_open_notify` | `allow-notify` accepts NOTIFY from anyone | none: allow your primaries |
+| `exposure_version` | `dig CH TXT version.bind` shows the exact BIND version | `version none` |
+| `exposure_hostname` | `dig CH TXT hostname.bind` shows the host name | `hostname none` |
+| `exposure_management` | `controls` or `statistics-channels` on an address that isn't loopback, open to anyone | none: use 127.0.0.1 or an allow list |
+
+The last three are server-wide: they are checked when any view is public.
+
+A **fix** goes into your pending changes like any edit (or is applied at
+once in live mode), so you see the named.conf diff before it reaches named:
+
+```sh
+jarl exposure                                         # classification, findings, fixes
+jarl exposure fix external exposure_rate_limit
+jarl exposure fix server exposure_version
+```
+
+## Response rate limiting
+
+Response rate limiting (RRL, BIND's `rate-limit`) counts identical
+responses sent to the same client network. Past the limit, named drops
+some and "slips" others: it sends a short reply asking the client to retry
+over TCP (or with a DNS cookie). A real client does; the spoofed victim of
+an amplification attack never sees the answers it didn't ask for. ISC
+recommends it for authoritative servers only, so Jarl only suggests it for
+public views, never for your internal resolver.
+
+Jarl starts from ISC's example, 10 identical responses per second per
+client network, and exempts the servers your zones notify and allow
+transfers to (`also-notify` and `allow-transfer` addresses, through ACLs
+too): limiting your own secondaries is the classic RRL mistake.
+
+**Rollout in two steps:**
+
+1. The fix turns rate limiting on with `log-only yes`. named answers
+   everyone as before, but logs every response it *would* have limited.
+   With [query statistics](stats.md) on, Jarl reads those lines: the
+   Exposure page shows how many responses would have been limited, and
+   which client networks and names. Check that your secondaries,
+   monitoring, or a big shared resolver aren't among them (add them to
+   `exempt-clients` if they are).
+2. When you're happy, **Start enforcing** (the fix of
+   `exposure_rate_limit_log_only`) removes `log-only`.
+
+In log-only mode named's own counters don't move: what would be limited
+is only in its log (category `query-errors`). That is why the activity
+needs query statistics; without them, look at named's log for
+`would rate limit`. When rate limiting is configured and statistics are
+on, Jarl adds `query-errors` to its log channel (keeping named's syslog
+destination for it).
+
+The statistics also count it: the `rrl` breakdown (`drop`, `slip`,
+`would-drop`, `would-slip`), the `ratelimited` and `ratelimited_name` top
+lists, and in Prometheus `jarl_ratelimit_logged_total{action}` next to
+named's own `jarl_ratelimit_responses_total` ([metrics.md](metrics.md)).
+
+### Settings
+
+You can tune the block like any option; `option set` replaces the whole
+block, so copy the current value from `jarl option list --view external`
+and edit it:
+
+```sh
+jarl option set rate-limit '{ responses-per-second 20; window 15; slip 2; exempt-clients { 192.0.2.53; }; log-only yes; }' --view external
+```
+
+named counts **identical responses** to the same **client network** (a
+/24 for IPv4, a /56 for IPv6) over a **window**, and limits each kind of
+response separately. These are the settings (BIND 9.20; the ARM has the
+full text):
+
+| Setting | Default | What it does | When to change it |
+|---------|---------|--------------|-------------------|
+| `responses-per-second` | 0 (off) | Answers with data for the same name and type, per client network. Wildcard answers count as the zone's apex. This is the main limit; Jarl's fix sets 10 | Raise it if a legitimate network shows up in log-only mode, e.g. a large shared resolver (mobile carriers, public resolvers) asking for your popular names |
+| `nxdomains-per-second` | same as `responses-per-second` | NXDOMAIN answers (names that don't exist), counted together for a domain whatever the name asked | `0` turns NXDOMAIN limiting off, for zones that legitimately get many lookups of missing names |
+| `nodata-per-second` | same as `responses-per-second` | Empty answers (the name exists, the type doesn't), counted together whatever the type | Rarely |
+| `referrals-per-second` | same as `responses-per-second` | Referrals to child zones you delegate | Only if you delegate subdomains to other servers |
+| `errors-per-second` | same as `responses-per-second` | Other errors (REFUSED, SERVFAIL, FORMERR), counted together whatever the name | Rarely. REFUSED and SERVFAIL can't be truncated, so slipped ones still go out at the slip rate |
+| `all-per-second` | 0 (off) | All UDP answers to a client network, of any kind, like a firewall rate limit; over it, answers are only **dropped** (`slip` doesn't apply) | Usually leave off; if you use it, ISC says at least 4 times the other limits |
+| `window` | 15 seconds (1–3600) | How far back named counts. A client over the limit stays limited until its rate over the window falls again | Longer windows remember attackers longer and also punish short legitimate bursts longer |
+| `slip` | 2 (0–10) | Of the limited answers, every n-th "slips": instead of being dropped it gets a short reply asking the client to retry: truncated (TC) so it retries over TCP, or, when the query carried a DNS cookie, BADCOOKIE with a server cookie that lets it through on its retry. `0` drops all, `1` slips all | `1` if you'd rather every real client gets a retry hint; `0` drops all (spoofed victims see nothing, but real clients just time out) |
+| `ipv4-prefix-length` | 24 | The size of the client network answers are counted for (IPv4) | `32` counts each address on its own: fairer to neighbours, more memory |
+| `ipv6-prefix-length` | 56 | The same for IPv6 | `64` if one /56 holds many independent clients; `48` to treat a whole site as one |
+| `exempt-clients` | none | Address match list (addresses, prefixes, [ranges](concepts.md#model-views-zones-records-options), ACLs) that is never limited. Jarl's fix puts your secondaries here | Add monitoring, other servers of yours, and anything legitimate that log-only mode shows |
+| `log-only` | no | Count and log what would be limited, answer everyone normally | Jarl starts with `yes`; the "start enforcing" fix removes it |
+| `qps-scale` | off | When the total query rate is above this, all limits shrink in proportion (at a rate of 1000 with `qps-scale 250`, a limit of 20 becomes 5) | Only on busy servers that see attacks spread over many networks |
+| `max-table-size`, `min-table-size` | min 500 entries | The table of client networks named tracks (40–80 bytes per entry) | Only on busy servers |
+
+What Jarl checked against real named: TCP answers are never limited;
+`nxdomains-per-second` falls back to `responses-per-second` and `0`
+turns it off; NXDOMAIN answers for different missing names in a zone
+share one limit; `all-per-second` only drops; with `slip 1`, clients
+without DNS cookies get truncated answers, and clients with cookies (dig
+sends them by default) get through on their retry with the server's
+cookie; `exempt-clients` is never limited; in log-only mode nothing is
+limited and only the log shows what would be.
+
+Rate limiting is per view: put it in the external view (`--view
+external`). Set in the server options, it applies to every view that has
+none of its own, your internal resolver included, which RRL isn't meant
+for.
+
+## Confirming a change that opens a view up
+
+A change that *introduces* an open resolver, open zone transfers, cache
+snooping, open NOTIFY or an open management interface on a public view
+must be confirmed:
+
+- **Web UI:** the Changes page shows the finding with a checkbox (*I
+  understand: …*); **Apply** stays disabled until it is ticked.
+- **CLI:** the command stops (exit 5) and says why; run it again with
+  `--accept-risk`.
+- **API:** `accept_risk: true` in the apply body, or `?accept_risk=1` on a
+  change applied at once; without it the answer is 409 `confirm_risk`.
+  Previews (`GET /changesets/{id}/preview`) list them as `risks`.
+
+Only changes that newly open something up ask: an unrelated change to a
+view that is already open, or taking back an acknowledgement, doesn't.
+
+## Acknowledging a finding
+
+Some findings are deliberate: a public resolver for a club's network, a
+visible version string. Acknowledge them with a reason:
+
+```sh
+jarl exposure ack external security_open_resolver --reason "public resolver for the club, monitored"
+jarl exposure ack server exposure_version --reason "version shown on purpose"
+jarl exposure unack external security_open_resolver
+```
+
+The finding doesn't disappear: it stays visible as **info**, with who
+accepted it, when and why (*open resolver … (acknowledged by adam on 12
+Oct 2026: public resolver for the club, monitored)*), on the Exposure page,
+the dashboard and in `jarl check`. An acknowledgement covers that one
+finding on that one view (or the server); the same finding elsewhere
+warns as usual. Acknowledging is a configuration change like any other,
+so it is in the history and audit log, and can be reverted.
+
+Jarl isn't designed to run an open resolver, and an acknowledgement makes
+one deliberate and visible, not safe: a public resolver also needs abuse
+monitoring, response size limits and usually a machine of its own.
+
+## API
+
+| Method | Path | Body |
+|--------|------|------|
+| GET | `/exposure` | `scopes` (per view, or the server: `public`, `override`, `reason`, `rate_limit` off/log-only/enforcing, `findings` with `fix` where Jarl has one), `server` (server-wide findings), `rate_limiting` (last 24h, with statistics: `counts`, `networks`, `names`) |
+| POST | `/exposure/fix` | `{"view": "external", "code": "exposure_rate_limit"}` (`view_id` works too; no view: the server). Staged with `?changeset=` like any change |
+| POST | `/exposure/ack` | `{"view": "external", "code": "security_open_resolver", "reason": "..."}` |
+| POST | `/exposure/unack` | `{"view": "external", "code": "security_open_resolver"}` |
+
+The override is a view's `exposure` field (`PATCH /views/{id}`), or the
+settings' for a server without views (`PATCH /settings`).
@@ -0,0 +1,244 @@
+# Prometheus metrics
+
+jarld can serve metrics for [Prometheus](https://prometheus.io/) at
+`/metrics`:
+- **health** you can alert on: named up, validation problems, files changed
+  outside Jarl, blocklists that fail to download, backup age, DNSSEC zones
+  waiting for you at the parent, and API tokens about to expire,
+- **queries**, once [query statistics](stats.md) are on: named's counters
+  (result codes, record types, cache, upstream times, DNSSEC validation, rate
+  limiting) and Jarl's own (responses per view and zone, blocked queries per
+  blocklist), plus named's memory, CPU, cache and sockets.
+
+Metrics are **off by default**. Everything is set in `/etc/jarl/jarl.yaml`;
+nothing is stored in the database.
+
+## Turning it on
+
+Prometheus on the same server needs only:
+
+```yaml
+metrics:
+  enabled: true
+```
+
+```sh
+sudo systemctl restart jarl
+curl -s http://127.0.0.1:8053/metrics | head
+```
+
+`/metrics` is served on the addresses in `listen` (and their TLS, if set)
+and on the local socket. Query counters also need `stats.enabled: true`
+([stats.md](stats.md)); without it you get only the health metrics.
+
+### Prometheus on another machine
+
+Give `/metrics` an address of its own and say who may scrape it:
+
+```yaml
+metrics:
+  enabled: true
+  listen: ["0.0.0.0:9450"]       # serves only /metrics, over plain HTTP
+  allow: ["192.168.1.20"]        # the Prometheus server
+```
+
+```yaml
+# prometheus.yml
+scrape_configs:
+  - job_name: jarl
+    static_configs:
+      - targets: ["dns.lan:9450"]
+```
+
+Or use a token instead of (or as well as) the address list. Any address
+that sends it may scrape:
+
+```yaml
+metrics:
+  enabled: true
+  listen: ["0.0.0.0:9450"]
+  token: "…"                     # e.g. from: openssl rand -hex 24
+```
+
+```yaml
+# prometheus.yml
+scrape_configs:
+  - job_name: jarl
+    authorization:
+      credentials: "…"           # or credentials_file: /etc/prometheus/jarl.token
+    static_configs:
+      - targets: ["dns.lan:9450"]
+```
+
+With a token in jarl.yaml, keep the file readable by root and jarld only
+(`chown root:jarl /etc/jarl/jarl.yaml; chmod 640 /etc/jarl/jarl.yaml`);
+jarld warns at start when everyone can read it. On `metrics.listen` the
+token travels unencrypted, so use it on a network you trust, or scrape the
+main listener over HTTPS instead (`scheme: https` and its port in
+Prometheus).
+
+### Settings
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `metrics.enabled` | `false` | Serve `/metrics`. |
+| `metrics.listen` | `[]` | Extra `ADDRESS:PORT`s that serve only `/metrics`, over plain HTTP. |
+| `metrics.allow` | `["127.0.0.1", "::1"]` | Addresses or prefixes that may scrape without a token. Behind a reverse proxy in `trusted_proxies`, this is the client's address from `X-Forwarded-For`. `[]` with a token: the token is required everywhere. |
+| `metrics.token` | `""` | A bearer token (at least 16 characters) that lets any address scrape. |
+
+A scrape is allowed when it comes from an address in `allow`, **or**
+carries the token, **or** comes over the local socket from root or jarld's
+own user. A wrong token is refused (and counts towards the per-address
+limit on failed logins). Jarl's API tokens don't work for `/metrics`.
+
+The firewall must let Prometheus reach the port. `allow` is checked by
+jarld, not the kernel.
+
+## What is exported
+
+Everything is prefixed `jarl_`. The text format is checked with `promtool
+check metrics`.
+
+### Health (always)
+
+These are read at most every 15 seconds; a scrape in between gets the
+same values.
+
+| Metric | Meaning |
+|--------|---------|
+| `jarl_build_info{version}` | Always 1. |
+| `jarl_start_time_seconds` | When jarld started. |
+| `jarl_metrics_state_ok` | 0 when Jarl's state couldn't be read (see jarld's log). |
+| `jarl_adopted` | 1 when named loads Jarl's configuration. |
+| `jarl_named_up` | 1 when named answers `rndc status` (missing with `bind.no_reload`). |
+| `jarl_named_recursive_clients`, `…_soft_limit`, `…_limit` | Recursive clients now, and named's limits (`rndc status`). |
+| `jarl_named_tcp_clients`, `…_limit` | TCP clients now, and the limit. |
+| `jarl_open_changesets` | Changesets with staged changes not applied yet. |
+| `jarl_last_apply_timestamp_seconds` | When the last changeset was applied. |
+| `jarl_problems{severity}` | Validation problems (`error`, `warning`, `info`) as on the dashboard, including named's own warnings. |
+| `jarl_drifted_files` | Managed files changed or removed outside Jarl. |
+| `jarl_objects{kind}` | Views, zones, records, ACLs, TSIG keys and options. |
+| `jarl_backup_last_success_timestamp_seconds`, `jarl_backup_last_size_bytes` | The newest backup by `jarld backup`. |
+| `jarl_backup_last_failure_timestamp_seconds` | A failed backup newer than the last good one. |
+| `jarl_backup_stale` | 1 when the newest backup is older than `backup.warn_after`. |
+| `jarl_blocking_paused` | 1 while blocking is paused (only with blocklists or rules). |
+| `jarl_blocking_paused_until_timestamp_seconds` | When a timed pause ends. |
+| `jarl_blocklist_enabled{list}` | 1 for lists that are switched on. |
+| `jarl_blocklist_entries{list}` | Domains in the last good download. |
+| `jarl_blocklist_failing{list}` | 1 when the last download or check of an enabled list failed. |
+| `jarl_blocklist_last_check_timestamp_seconds{list}`, `jarl_blocklist_last_change_timestamp_seconds{list}` | When the list was last checked, and last changed. |
+| `jarl_dnssec_phase{zone,view,phase}` | Always 1, one per signed zone; `phase` is one of the [DNSSEC phases](dnssec.md). `ready` means: add the DS at the parent. `removing_ds`: remove it. |
+| `jarl_token_expiry_timestamp_seconds{id,user,token}` | When each API token with an expiry date expires. |
+| `jarl_certificate_expiry_timestamp_seconds{certificate,source}` | When each certificate Jarl manages expires ([certificates.md](certificates.md)). |
+| `jarl_certificate_failing{certificate,source}` | 1 when obtaining (or reading) the certificate failed the last time, or it has expired. |
+| `jarl_certificate_renewal_failures{certificate}` | Failed attempts to obtain a certificate since its last success. |
+
+### Queries (with `stats.enabled`)
+
+The counters start at zero when jarld starts (Prometheus handles that).
+named's counters move once a minute, when Jarl polls named's statistics
+channel. Counters from the response log (`responses`, views, zones,
+blocking) move as lines are read and need `stats.query_log`. Clients in
+`stats.exclude_clients` are left out of those. Names and clients are not
+exported, because there would be too many of them. Use the Statistics page
+for them.
+
+| Metric | Meaning |
+|--------|---------|
+| `jarl_queries_total` | Queries named received. |
+| `jarl_responses_by_rcode_total{rcode}` | Responses by result code (`NOERROR`, `NXDOMAIN`, `SERVFAIL`, `REFUSED`, …). |
+| `jarl_queries_by_type_total{type}` | Queries by record type. |
+| `jarl_queries_by_transport_total{transport}` | `udp` and `tcp`. |
+| `jarl_answers_total{source}` | `authoritative` or `recursive`. |
+| `jarl_recursion_queries_total`, `jarl_dropped_queries_total`, `jarl_duplicate_queries_total` | Queries that caused recursion, that named dropped, and duplicates. |
+| `jarl_ratelimit_responses_total{action}` | Responses rate limiting `dropped` or `slipped` (named's counters; they don't move in log-only mode). |
+| `jarl_ratelimit_logged_total{action}` | Rate limited responses from named's log: `drop`, `slip`, and in log-only mode `would-drop`, `would-slip` ([exposure.md](exposure.md#response-rate-limiting)). |
+| `jarl_upstream_responses_by_rtt_total{rtt}` | Upstream answers during recursion by round-trip time (`<10ms` … `>1600ms`). |
+| `jarl_dnssec_validations_total{result}` | `valid`, `valid-negative` and `failed`. |
+| `jarl_cache_lookups_total{result}` | `hits` and `misses`. |
+| `jarl_logged_responses_total` | Responses read from the response log. |
+| `jarl_responses_by_view_total{view}` | Logged responses per view (`_default` without views). |
+| `jarl_responses_by_zone_total{zone}` | Logged responses per local zone; `-` for names in no local zone. |
+| `jarl_blocked_queries_total` | Queries blocking answered. |
+| `jarl_blocked_by_list_total{list}` | Blocked queries per blocklist; `rules` for your own rules. |
+| `jarl_stats_poll_ok`, `jarl_stats_last_poll_timestamp_seconds` | Whether the last poll of named's statistics channel worked, and when it was. |
+| `jarl_stats_log_lines_total`, `jarl_stats_last_log_line_timestamp_seconds` | Response log lines read, and the time of the last one. |
+| `jarl_stats_warnings` | Warnings on the Statistics page (e.g. no log lines while named answers queries). |
+| `jarl_named_start_time_seconds`, `jarl_named_config_time_seconds` | When named started, and last loaded its configuration. |
+| `jarl_named_resident_memory_bytes`, `jarl_named_threads`, `jarl_named_cpu_seconds_total` | named's process (`/proc`). |
+| `jarl_named_memory_in_use_bytes` | Memory named counts as in use. |
+| `jarl_named_cache_rrsets`, `jarl_named_cache_memory_bytes` | named's caches, all views together. |
+| `jarl_named_sockets{proto}` | Open UDP and TCP sockets. |
+| `jarl_named_recursive_clients_highwater`, `jarl_named_tcp_clients_highwater` | The most clients at once since named started. |
+
+Host metrics (load, memory, disks) are left to
+[node_exporter](https://github.com/prometheus/node_exporter).
+
+## Example queries
+
+```promql
+# Queries per second, and the share that failed
+rate(jarl_queries_total[5m])
+rate(jarl_responses_by_rcode_total{rcode="SERVFAIL"}[5m]) / ignoring(rcode) rate(jarl_queries_total[5m])
+
+# Blocked share of logged responses, per list
+rate(jarl_blocked_by_list_total[1h]) / ignoring(list) group_left rate(jarl_logged_responses_total[1h])
+
+# Busiest zones
+topk(5, rate(jarl_responses_by_zone_total{zone!="-"}[1h]))
+
+# Cache hit rate
+rate(jarl_cache_lookups_total{result="hits"}[5m]) / ignoring(result) sum without(result) (rate(jarl_cache_lookups_total[5m]))
+```
+
+## Example alerts
+
+```yaml
+groups:
+  - name: jarl
+    rules:
+      - alert: JarlDown
+        expr: up{job="jarl"} == 0
+        for: 5m
+      - alert: NamedDown
+        expr: jarl_named_up == 0
+        for: 2m
+      - alert: JarlConfigErrors
+        expr: jarl_problems{severity="error"} > 0
+        for: 15m
+      - alert: JarlDrift
+        expr: jarl_drifted_files > 0
+        for: 15m
+      - alert: BlocklistFailing
+        expr: jarl_blocklist_failing == 1
+        for: 6h
+      - alert: BackupStale
+        expr: jarl_backup_stale == 1
+      - alert: DNSSECWaitingForYou
+        expr: jarl_dnssec_phase{phase=~"ready|removing_ds|unsigned"} == 1
+        for: 1h
+        annotations:
+          summary: "{{ $labels.zone }}: DNSSEC is waiting for a step at the parent ({{ $labels.phase }})"
+      - alert: TokenExpiresSoon
+        expr: jarl_token_expiry_timestamp_seconds - time() < 7 * 86400
+        annotations:
+          summary: "API token {{ $labels.token }} of {{ $labels.user }} expires within a week"
+      - alert: CertificateFailing
+        expr: jarl_certificate_failing == 1
+        for: 12h
+        annotations:
+          summary: "Certificate {{ $labels.certificate }} can't be renewed (see the Certificates page)"
+      - alert: CertificateExpiresSoon
+        expr: jarl_certificate_expiry_timestamp_seconds - time() < 10 * 86400
+        annotations:
+          summary: "Certificate {{ $labels.certificate }} expires within 10 days"
+      - alert: BlockingPausedForLong
+        expr: jarl_blocking_paused == 1
+        for: 24h
+      - alert: NamedRecursiveClientsHigh
+        expr: jarl_named_recursive_clients / jarl_named_recursive_clients_soft_limit > 0.8
+        for: 5m
+      - alert: StatsNotCollecting
+        expr: jarl_stats_poll_ok == 0 or jarl_stats_warnings > 0
+        for: 15m
+```
@@ -363,6 +363,9 @@ rndc reconfig
 ## Monitoring

 * `GET /healthz` (no authentication) reports that jarld is up.
+* Prometheus: `/metrics` covers named up, configuration problems, drift,
+  blocklist failures, backup age, DNSSEC steps waiting at the parent and
+  expiring tokens, with example alerts ([metrics.md](metrics.md)).
 * On the server, a check can use the local socket and needs no token:
  `sudo jarl status -o json`.
 * `GET /api/v1/status` with a read-only token reports named reachability,
@@ -116,8 +116,9 @@ demote or delete the last enabled administrator.

 A user's permissions are a list of grants. Administrators (`admin: true`)
 may do everything, and only they can manage users, see everyone's tokens,
-run `resync`, wipe a zone's DNSSEC keys, and use the registrar (Porkbun,
-whose key can move the domain).
+run `resync`, wipe a zone's DNSSEC keys, use the registrar (Porkbun,
+whose key can move the domain), and manage TLS certificates (whose keys
+can impersonate the server; [certificates.md](certificates.md)).

 A grant is written as:

@@ -103,11 +103,32 @@ lists, views, zones). named's own counters can't be filtered.
 | `zone:NAME` | response log | answers per local zone; `zone:-` for names in none of your zones |
 | `responses` | response log | lines read (a health check) |
 | `blocked`, `blocklist:NAME` | response log | queries [blocking](blocking.md) answered, and by which list (`blocklist:rules` for your own rules) |
+| `rrl:drop`, `rrl:slip`, `rrl:would-drop`, `rrl:would-slip` | response log | responses [rate limiting](exposure.md#response-rate-limiting) limited, or would have in log-only mode (named's own `ratelimit:*` counters don't move then) |
+
+**Server** (sampled every minute; stored as gauges, `g:KEY` the sum of
+the samples and `gn:KEY` their number, so a chart shows the average):
+
+| Gauge | Source | Meaning |
+|-------|--------|---------|
+| `g:named:rss` | /proc | named's resident memory (what the system sees), bytes |
+| `g:named:mem` | named | the memory named counts itself as using, bytes |
+| `g:named:cpu` | /proc | named's CPU use over the minute, in tenths of a percent of one CPU |
+| `g:cache:mem`, `g:cache:rrsets` | named | the cache's memory and RRsets, all views |
+| `g:host:mem-used`, `g:host:load` | /proc | the host's memory in use, and its 1-minute load average times 100 |
+
+Jarl finds named's process by name (the one whose command line mentions
+named's main configuration file); reading its memory and CPU time needs no
+privileges. With `/proc` mounted `hidepid`, it isn't visible and those
+figures are left out. The current values also include named's sockets, its
+recursive and TCP clients against their limits (`rndc status`), the most
+at once since it started, and the space left on the file systems holding
+the zone files, Jarl's cache, named.conf, the response log and this
+database.

 **Top lists** (per hour and per day, the `top_n` largest): `name` (most
 queried names), `client`, `nxdomain` (names answered NXDOMAIN), `servfail`
 (names answered SERVFAIL), `refused` (clients that were refused), `blocked`
-(names blocking answered). Blocked answers are NXDOMAIN too, but they
+(names blocking answered), `blocked_client` (clients by blocked queries). Blocked answers are NXDOMAIN too, but they
 aren't counted as names that don't exist: not in the `nxdomain` list, and
 not in the summary's NXDOMAIN ratio.

@@ -131,7 +152,9 @@ prefixes and get no name.
 page follows it. Charts have a hover readout (or focus them and use the
 arrow keys) and a **Table** button showing the same data as a table. The
 heatmap shows the average queries per hour for each weekday and hour over at
-least the last 7 days. The page refreshes every minute.
+least the last 7 days. The page refreshes every minute. **Server**, at the
+bottom, shows named's memory, CPU, cache and clients, the host and the
+disks now, and named's memory and CPU over the range.

 **CLI**:

@@ -145,16 +168,42 @@ jarl stats top refused                     # who asks for what they may not have
 jarl stats timeline --since 6h             # sparkline; --table for every bucket
 jarl stats timeline --since 7d --key rcode:NXDOMAIN --key rcode:SERVFAIL
 jarl stats heatmap --since 28d
-jarl stats breakdown qtype | rcode | view | zone | answer | rtt | dnssec | cache | transport | ratelimit
+jarl stats breakdown qtype | rcode | view | zone | answer | rtt | dnssec | cache | transport | ratelimit | rrl
+jarl stats top ratelimited                 # client networks rate limiting limits (or would)
+jarl stats server                          # memory, CPU, cache, clients, host, disks now
+jarl stats timeline --since 7d --key g:named:rss --table   # named's memory over a week
 jarl stats summary --since 30d -o json     # export (also -o yaml)
 ```

 **API**: see [api.md](api.md#query-statistics).

+**Prometheus**: with `metrics.enabled`, the counters are also served at
+`/metrics` ([metrics.md](metrics.md)).
+
 **Permissions**: the `stats` resource (`stats:read`). The `readonly` and
 `operator` roles include it, `dns-editor` doesn't. Statistics show client
 addresses and what they look up, so grant it with care.

+## Views
+
+With views, the Statistics page has a toggle per view (and **All** and
+**None**): switch some off to see only the others, for example your
+internal and VPS views without the internet's noise on the external one,
+or several linked views together. The choice is remembered in your
+browser. The CLI takes `--view` on every `jarl stats` command (repeat it,
+or separate views with commas), and the API `?views=internal,vps`.
+
+Only what named's response log says can be split by view: answers (shown
+as *answers* instead of queries), result codes, record types, zones,
+blocking, rate limiting and the top lists. named's own counters (answer
+sources, transport, upstream response times, DNSSEC, the cache and the
+server) are for the whole server, and the page says so; asking for them
+per view (`jarl stats breakdown answer --view internal`) is refused.
+
+Per-view figures are kept from the version that added them (Jarl 0.4.1);
+the page says since when. They take some more room in the statistics
+database, roughly in proportion to the number of views.
+
 ## How data is kept

 - Minute counters are kept for `retention.minute`, hourly counters and top
@@ -57,6 +57,8 @@ showing them.
 | `zone_missing_option` | error | Secondary, stub and mirror zones need `primaries` |
 | `zone_file_required` / `zone_file_invalid` / `zone_file_managed` | error | Hint zones need a file. Forward zones have none. Primary zone files are Jarl's |
 | `zone_inview_invalid`, `zone_inview_option` | error | `in-view` zones only inside views, and only with `forward`/`forwarders` |
+| `zone_inview_disabled` | error | An `in-view` zone can't share a disabled zone |
+| `zone_disabled_signed` | error | A signed zone can't be disabled: turn signing off first |
 | `zone_records_unmanaged` | error | Only primary zones can have records in Jarl |
 | `zone_serial_policy` | error | `date`, `increment` or `unixtime` |
 | `zone_no_forwarders`, `zone_hint_name`, `zone_name_slash` | info / warning | Unusual but legal setups |
@@ -65,11 +67,12 @@ showing them.

 | Code | Severity | Rule |
 |------|----------|------|
-| `acl_element_invalid` | error | Address match elements: addresses, prefixes (host bits must be zero, like BIND requires), `!negation`, `key NAME`, ACL names, `{ nested lists }`, `any`/`none`/`localhost`/`localnets` |
+| `acl_element_invalid` | error | Address match elements: addresses, prefixes (host bits must be zero, like BIND requires), ranges (`10.0.10.101-10.0.10.199`: both ends full addresses of one family, start not after end), `!negation`, `key NAME`, ACL names, `{ nested lists }`, `any`/`none`/`localhost`/`localnets`. Ranges in options are checked when they're entered, and only options with address match lists take them (not `forwarders`, say) |
+| `range_mapped4` | warning | An IPv6 range that reaches into `::ffff:0:0/96`: named can see IPv4 clients as such addresses, so it may match IPv4 clients too |
 | `acl_ref_missing`, `key_ref_missing` | error | Every ACL or TSIG key that is referenced must exist |
 | `acl_cycle` | error | ACLs that include each other |
-| `acl_duplicate`, `acl_name_invalid`, `acl_empty`, `acl_shadowed` | error / warning | Unique names, built-in names reserved, elements that can never match |
-| `key_*` | error / warning | Valid key names, a supported algorithm, a base64 secret of a sensible length. hmac-md5/sha1 are flagged as weak |
+| `acl_duplicate`, `acl_name_invalid`, `acl_empty`, `acl_shadowed` | error / warning | Unique names, built-in names reserved, names that look like addresses or ranges, elements that can never match (a prefix or range an earlier one already covers) |
+| `key_*` | error / warning | Valid key names, a supported algorithm, a base64 secret of a sensible length. hmac-md5/sha1 are flagged as weak. Names starting with `jarl-view-` are reserved for the view keys (`key_name_reserved`) |
 | `view_duplicate`, `view_name_invalid`, `view_acl_invalid` | error | Valid, unique views and match lists |
 | `view_unreachable` | warning | A view that comes after one matching every client is never used |
 | `option_unknown`, `option_scope_invalid` | error | The option must exist in BIND 9.20 and be allowed where it is set (server, view, zone of this type, top level) |
@@ -101,6 +104,26 @@ applied.
 | `dnssec_old_keys` | info | Signing a zone whose key directory still has old keys |
 | `serial_not_higher` | error | An explicit serial on a signed zone must be above the one named has loaded (automatic serials are raised by themselves) |

+## TLS
+
+| Code | Severity | Check |
+|------|----------|-------|
+| `tls_file_missing` | error | The files a top-level `tls` statement names (certificate, key, CA) exist: named doesn't load its configuration without them |
+
+## Linked zones
+
+See [views.md](views.md#linked-zones). Jarl keeps linked zones in step
+itself, so these only show when something got past it (a change staged
+before the zones were linked, or the database edited by hand).
+
+| Code | Severity | Check |
+|------|----------|-------|
+| `linked_zone_type` | error | Only primary zones can be linked |
+| `linked_zone_name` | error | Linked zones have the same name |
+| `linked_mixed` | error | A name and type in a zone is either shared or local, not both |
+| `linked_out_of_sync` | error | Every view that doesn't override a shared name and type has the same records for it. Link the zones again (`jarl zone link`) to work out what is shared |
+| `linked_zone_alone` | info | A zone linked with no other zone |
+
 ## Blocking

 From [blocking.md](blocking.md).
@@ -113,14 +136,34 @@ From [blocking.md](blocking.md).
 | `blocking_view_missing` | error | A list or rule names a view that doesn't exist |
 | `blocking_no_view` | warning | A list or rule applies to no view: none offers recursion, and blocking only changes recursive answers |
 | `blocking_no_recursion` | warning | A list or rule names a view that doesn't offer recursion, where it has no effect |
+| `blocking_step_missing` | error | A list or client group is at a step that doesn't exist (a list can't be at `off`) |
+| `client_group_member_invalid` | error | Client group members are addresses, networks, or ACLs made only of those |
+| `client_group_overlap` | error | The same address or network is in two client groups of a view |
+| `client_group_empty` | warning | A client group has no members |
+| `blocklist_step_unused` | warning | A list is at a step that no client group reaches, so it blocks nothing |

 ## Security lints

+These and the exposure checks below only look at views that are
+reachable from the internet ([exposure.md](exposure.md)); without views,
+the open resolver and open transfer checks look at the server. Any of them
+can be acknowledged (it then shows as info, with who accepted it and why),
+and a change that newly introduces an open resolver, open transfers, cache
+snooping, open NOTIFY or an open management interface on a public view
+must be confirmed (`--accept-risk`).
+
 | Code | Severity | What it catches |
 |------|----------|-----------------|
 | `security_open_resolver` | warning | A view (or the server) where recursion is on and reachable by any client. This includes the BIND trap where `allow-recursion` is unset and inherits `allow-query { any; }`. Open resolvers are abused for DDoS amplification. Set `allow-recursion` to your own networks |
 | `security_open_transfer` | warning | `allow-transfer` open to anyone. Restrict it to your secondaries or a TSIG key |
 | `dynamic_update_unsupported` | error | `allow-update` / `update-policy` on a Jarl zone. named would write to files that Jarl regenerates, losing the updates. Use the API (e.g. `jarl acme`) instead |
+| `exposure_rate_limit` | warning | A public view without response rate limiting (`rate-limit`) |
+| `exposure_rate_limit_log_only` | info | Rate limiting in log-only mode: check what it would limit, then enforce |
+| `exposure_minimal_any` | warning | A public view answering ANY queries in full (`minimal-any` off) |
+| `exposure_cache_snooping` | warning | A public view without recursion whose cache anyone may query (`allow-query-cache`) |
+| `exposure_open_notify` | warning | A public view accepting NOTIFY from anyone (`allow-notify`) |
+| `exposure_version`, `exposure_hostname` | warning | The server is public and shows its BIND version or host name to anyone (`version none`, `hostname none`) |
+| `exposure_management` | warning | `controls` or `statistics-channels` on an address that isn't loopback, open to anyone, while the server is public |

 ## What only BIND checks

@@ -130,3 +173,10 @@ values Jarl accepts as raw named.conf syntax, such as `logging` channels
 and `rrset-order`, are the main example. Their errors come back as
 `validation_failed` (HTTP 422) with the checker's messages in `check`, each
 tied to the object it belongs to.
+
+named-checkconf's warnings don't block a change. They are shown with the
+change, and the dashboard's configuration checks list them for as long as
+they apply (`named_warning`; `named_error` if the running configuration no
+longer passes, after a hand edit say). Jarl runs named-checkconf on the
+running configuration for this, without loading zones, when the dashboard
+asks and the configuration changed, or at most every 10 minutes.
@@ -81,21 +81,34 @@ avoids named-checkconf's warning that `allow-recursion` is still active in a
 view with recursion off. Jarl warns (`security_open_resolver`) if a view
 ever offers recursion to everyone.

+Jarl counts the external view as reachable from the internet (its
+match-clients end in `any`) and checks it: rate limiting, ANY queries,
+the version string and more. See the **Exposure** page or `jarl exposure`,
+and [exposure.md](exposure.md) to set up response rate limiting.
+
 ### 4. Give the external view its zones

-**Different data per view (split DNS).** Copy the zone, then change what
-should differ:
+**Mostly the same, a few differences (split DNS).** Create the external
+copy *linked* ([below](#linked-zones)): Jarl keeps the shared records the
+same in both views, and each view can have records of its own:
+
+```sh
+jarl zone create adbraun.lol --view external --link-with internal
+jarl record set adbraun.lol www A 203.0.113.20 --view external --local   # public address, external only
+jarl record delete adbraun.lol nas-internal A --view external            # gone from both: it was shared
+```
+
+Delete records you don't want outside before you link, or make them local
+to the internal view first (`jarl record update ID --local`): a shared
+record is in both views.
+
+**Two separate copies.** `--clone-from` copies the zone once; from then on
+the two are separate zones, and a record added to one isn't in the other:

 ```sh
 jarl zone create adbraun.lol --view external --clone-from adbraun.lol --clone-view internal
-jarl record list adbraun.lol --view external
-jarl record update <id> --data 203.0.113.20          # public address instead of 10.10.0.20
-jarl record delete adbraun.lol nas-internal A --view external
 ```

-From then on the two copies are separate zones. A record added to one isn't
-in the other, and the serials are separate.
-
 **The same data in both views.** Use an `in-view` zone. The external view
 then serves the internal view's zone, so there is one copy to maintain:

@@ -116,7 +129,105 @@ dig @<public-ip> example.com                            # from outside: status R
 jarl check
 ```

-On the server, `dig -b <source address>` picks which view you test.
+On the server, `dig -b <source address>` picks which view you test, or,
+from anywhere, sign the query with the view's key (below):
+
+```sh
+jarl view key external --named-conf > external.key
+dig -k external.key @ns1.adbraun.lol nas.adbraun.lol +short   # 203.0.113.20, even from the LAN
+```
+
+## View keys
+
+named picks a view by where a query comes from, so a query this server
+sends to its own public address usually lands in the internal view: its
+source is one of your own networks. That makes checks of the external view
+from the server itself (such as Jarl's delegation check) see the wrong
+view.
+
+So Jarl gives every view a TSIG key, `jarl-view-NAME`, and puts it at the
+front of the view's `match-clients`:
+
+```
+view "internal" {
+	match-clients { !key jarl-view-external; key jarl-view-internal; homelab; };
+	...
+view "external" {
+	match-clients { key jarl-view-external; any; };
+```
+
+A query signed with a view's key lands in that view, whatever its source;
+the `!key` stops an earlier view from taking a later view's queries.
+Clients don't send these keys, so for them nothing changes. Jarl signs its
+own queries to this server's addresses with the key of the zone's view.
+The keys live in `keys.conf` with your other keys, never in diffs or in
+`jarl tsig list`; their secrets are derived from a random value in Jarl's
+database (and in its backups), so they stay the same from one apply to
+the next. `jarl view key VIEW`
+shows one (it needs `tsig:write` and is audited). Key names starting with
+`jarl-view-` are reserved, and the view keys can be used in your own
+options (`allow-transfer { key jarl-view-external; }`).
+
+## Linked zones
+
+Most split-horizon zones are the same in every view apart from a few
+names. Linking zones of the same name in different views lets Jarl keep
+the shared records in step, while each view can still have records of its
+own and its own zone options.
+
+* **Shared records** are in every linked view. Adding, changing,
+  disabling or deleting one in any view does the same in the others, in
+  the same changeset: the diff shows every view, and history, undo and
+  `jarl check` treat them together.
+* **Local records** are in one view only (`--local`, or **Only here** in
+  the web UI). A local record overrides the shared records of the same name
+  and type in that view: `www A 10.0.10.5` local to internal, while the
+  external view keeps the shared `www A 203.0.113.20`. Delete the local
+  records and the view gets the shared ones back.
+* A new record joins the set of the same name and type: local if that set
+  is local in its view, shared otherwise.
+* **Sharing a version** (`jarl record update ID --shared`, **Share** in the
+  web UI) makes that view's records of that name and type the shared
+  version: the other views' records of that name and type are replaced.
+* Zones stay separate in named, so each keeps its own serial, options
+  (allow-transfer, DNSSEC signing, ...) and file, and the views keep their
+  own `match-clients`, recursion and order.
+
+```sh
+jarl zone link adbraun.lol --view internal --with external   # link two existing zones
+jarl zone create adbraun.lol --view vps --link-with external # a new zone, linked from the start
+jarl record list adbraun.lol --view internal                 # LINK column: shared or local
+jarl record add adbraun.lol nas A 10.0.10.20 --view internal --local
+jarl record update 1234 --local                              # this name and type: only this view
+jarl record update 1234 --shared                             # this view's version, everywhere
+jarl zone unlink adbraun.lol --view vps                      # records stay, all local
+```
+
+**Linking never changes what named answers.** A name and type with the
+same records in every view becomes shared; one that differs stays local to
+each view (Jarl lists them). Share the right version afterwards. Unlinking
+keeps every record, all local; a link left with one zone is dissolved, as
+when the other zone is deleted.
+
+**Permissions** are checked in every view a change reaches. A token with
+a grant for one view only (`views=internal`) can change that view's local
+records and make overrides, but not a shared record, since that would
+change the other views too: Jarl says so and suggests a local record. A
+grant without a view (the usual `zones=adbraun.lol`) covers every view.
+
+**Importing a zone file** into a linked zone (`jarl zone import`) adds
+the records like any others: shared, unless the name and type is local
+there. With `--replace`, shared records missing from the file are deleted
+in every linked view.
+
+**ACME challenges** are written once per link, and so reach every linked
+view; `jarl acme`, lego's httpreq and certificates Jarl obtains all do
+this.
+
+**Compared with BIND's `in-view`**, where one view serves another's zone
+as it is: linked zones can differ per view, keep their own options, and
+don't depend on the view order (`in-view` can only use a view defined
+before it).

 ## Living with views

@@ -125,12 +236,17 @@ On the server, `dig -b <source address>` picks which view you test.
  guess.
 * `jarl acme` writes challenge records into **every** view that has the
  zone, so Let's Encrypt (external) and internal clients see the same
-  thing. Use `--view` to limit it.
+  thing (once per link, for linked zones). Use `--view` to limit it.
+* `--view all` (or a list) on record commands changes each linked zone
+  once: the change reaches the others through the link. With `--local` it
+  goes to each view named.
 * `jarl view order internal external` changes the match order, and
  `jarl view list` shows it.
 * Deleting a view is refused while it still has zones, unless you pass
  `--cascade`.
-* Give each view a colour (Views → Edit → Colour, or
+* Each view has its own page (Views → the view's name): its settings,
+  options and zones.
+* Give each view a colour (the view's page → Settings → Colour, or
  `jarl view color internal green`) to tell the zones of each view apart
  in the zone list. The colour only affects the web UI, so it applies at
  once, with no changeset or deploy. `jarl view color internal default`
@@ -4,6 +4,7 @@ go 1.27.1

 require (
 	github.com/aymanbagabas/go-udiff v0.4.1
+	github.com/go-acme/lego/v4 v4.35.2
 	github.com/miekg/dns v1.1.73
 	github.com/spf13/cobra v1.10.2
 	go.yaml.in/yaml/v3 v3.0.5
@@ -15,7 +16,9 @@ require (
 )

 require (
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
@@ -1,8 +1,16 @@
 github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/go-acme/lego/v4 v4.35.2 h1:uVQg+KC/yj9R2g7Q9W5wDqhvQvxV5SMu5eqFVoN5xZU=
+github.com/go-acme/lego/v4 v4.35.2/go.mod h1:pX2jN5n8OphMGY1IaMjYm5DAEzguBaKRt8AvJAgJXpc=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -24,6 +32,8 @@ github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
@@ -21,6 +21,10 @@ const Comment = "ACME DNS-01 challenge"
 type Zone struct {
 	Name string // as Jarl stores it, e.g. "adbraun.lol."
 	View string // "" when views are not used
+	// Link is the zone's link group (0: not linked). A record written
+	// into one zone of a link reaches the others (docs/views.md#linked-zones),
+	// so only one of them is written to.
+	Link int64
 }

 // Zones returns the zones that hold name: the longest matching zone, in
@@ -46,7 +50,19 @@ func Zones(name string, zones []Zone, view string) []Zone {
 			out = append(out, z)
 		}
 	}
-	return out
+	// One zone per link: Jarl writes the shared record into the others.
+	var dedup []Zone
+	links := map[int64]bool{}
+	for _, z := range out {
+		if z.Link != 0 {
+			if links[z.Link] {
+				continue
+			}
+			links[z.Link] = true
+		}
+		dedup = append(dedup, z)
+	}
+	return dedup
 }

 // Requests returns the changes that set (or, with set false, remove) the
@@ -22,13 +22,18 @@ type Zone struct {
 	Display string `json:"display_name"`
 	View    string `json:"view,omitempty"`
 	Records int    `json:"record_count"`
-	// Disabled is how many of the records are disabled.
-	Disabled int    `json:"disabled_count,omitempty"`
-	ZoneFile string `json:"zone_file,omitempty"` // the file named loads
-	RName    string `json:"rname_email,omitempty"`
+	// DisabledRecords is how many of the records are disabled.
+	DisabledRecords int    `json:"disabled_count,omitempty"`
+	ZoneFile        string `json:"zone_file,omitempty"` // the file named loads
+	RName           string `json:"rname_email,omitempty"`
 	// Registrar names the registrar Jarl can manage the domain at
 	// ("porkbun"), when one is configured for it.
 	Registrar string `json:"registrar,omitempty"`
+	// LinkedWith are the views of the zones this one is linked with
+	// (docs/views.md#linked-zones).
+	LinkedWith []string `json:"linked_with,omitempty"`
+	// Links are the zones this one is linked with, with their views.
+	Links []ZoneLink `json:"links,omitempty"`
 	// Pending is set when listing with a changeset: add, change or delete.
 	Pending string `json:"pending,omitempty"`
 }
@@ -40,6 +45,8 @@ type Record struct {
 	View         string `json:"view,omitempty"`
 	RelativeName string `json:"relative_name"`
 	EffectiveTTL uint32 `json:"effective_ttl"`
+	// Linked is "shared" or "local" for a record of a linked zone ("" otherwise).
+	Linked string `json:"linked,omitempty"`
 	// Text is the decoded value of TXT and SPF records.
 	Text *string `json:"text,omitempty"`
 	// Pending is set when listing with a changeset: add, change, delete,
@@ -77,6 +84,10 @@ type Option struct {
 	Where       string `json:"where"` // e.g. "view internal"
 	Description string `json:"description,omitempty"`
 	Status      string `json:"status,omitempty"`
+	// Formatted is the value laid out over several lines, as in
+	// named.conf, when it has a block (for display and editing; Value is
+	// the same on one line).
+	Formatted string `json:"formatted,omitempty"`
 }

 // User is a user with formatted grants.
@@ -204,6 +215,9 @@ type BatchRequest struct {
 	Ops         []ChangeRequest `json:"ops"`
 	DryRun      bool            `json:"dry_run,omitempty"`
 	Force       bool            `json:"force,omitempty"`
+	// AcceptRisk confirms a change that opens the server up
+	// (docs/exposure.md).
+	AcceptRisk bool `json:"accept_risk,omitempty"`
 	// Apply (for POST /changesets) applies the new changeset at once.
 	Apply bool `json:"apply,omitempty"`
 }
@@ -245,6 +259,33 @@ type StatusResponse struct {
 	// BlocklistErrors are blocklists whose last update failed (for those
 	// who may see blocking).
 	BlocklistErrors []BlocklistError `json:"blocklist_errors,omitempty"`
+	// BlockingPausedUntil is set while blocking is paused for a time,
+	// BlockingPausedIndefinitely while it is paused until resumed.
+	BlockingPausedUntil        *time.Time `json:"blocking_paused_until,omitempty"`
+	BlockingPausedIndefinitely bool       `json:"blocking_paused_indefinitely,omitempty"`
+	// Certificates sums up the TLS certificates Jarl manages
+	// (administrators only, when there are any).
+	Certificates *CertSummary `json:"certificates,omitempty"`
+}
+
+// CertSummary is what the dashboard reports about certificates.
+type CertSummary struct {
+	Total int `json:"total"`
+	// Problems are the certificates that aren't fine: failing, expiring,
+	// expired (not ones still being obtained for the first time).
+	Problems []CertProblem `json:"problems"`
+	// Next is the certificate that expires first, and when.
+	Next      string     `json:"next,omitempty"`
+	NextAfter *time.Time `json:"next_after,omitempty"`
+	// Serving is the certificate jarld serves HTTPS with ("" for none or tls.cert_file).
+	Serving string `json:"serving,omitempty"`
+}
+
+// CertProblem is a certificate that needs attention.
+type CertProblem struct {
+	Name    string `json:"name"`
+	State   string `json:"state"`
+	Message string `json:"message"`
 }

 // BlocklistError is a blocklist whose last update failed. UpdatedAt is
@@ -498,6 +539,27 @@ type Blocklist struct {
 	// MemoryMB estimates what named needs for the list, in all its views.
 	MemoryMB int    `json:"memory_mb,omitempty"`
 	Pending  string `json:"pending,omitempty"`
+	// Step is the name of the step the list starts at ("normal" or one
+	// above it).
+	Step string `json:"step"`
+}
+
+// BlockStep is a blocking step above normal as returned by the API, with
+// what uses it.
+type BlockStep struct {
+	model.BlockStep
+	Lists   []string `json:"lists"`
+	Groups  []string `json:"groups"`
+	Pending string   `json:"pending,omitempty"`
+}
+
+// ClientGroup is a client group as returned by the API.
+type ClientGroup struct {
+	model.ClientGroup
+	Step      string   `json:"step"`
+	Views     []string `json:"views"`
+	AutoViews bool     `json:"auto_views,omitempty"`
+	Pending   string   `json:"pending,omitempty"`
 }

 // BlockRule is a block or allow rule as returned by the API.
@@ -507,3 +569,9 @@ type BlockRule struct {
 	AutoViews bool     `json:"auto_views,omitempty"`
 	Pending   string   `json:"pending,omitempty"`
 }
+
+// ZoneLink is a zone a zone is linked with.
+type ZoneLink struct {
+	ID   int64  `json:"id"`
+	View string `json:"view"`
+}
@@ -340,7 +340,14 @@ type ServerStatus struct {
 	ConfigFile     string `json:"config_file"`
 	Zones          string `json:"zones"`
 	Running        bool   `json:"running"`
-	Raw            string `json:"raw"`
+	// RecursiveClients is "now/soft limit/hard limit" (the soft limit is
+	// where named starts dropping the oldest queries), TCPClients
+	// "now/limit".
+	RecursiveClients string `json:"recursive_clients,omitempty"`
+	TCPClients       string `json:"tcp_clients,omitempty"`
+	CPUs             string `json:"cpus,omitempty"`
+	WorkerThreads    string `json:"worker_threads,omitempty"`
+	Raw              string `json:"raw"`
 }

 // Status returns named's status.
@@ -363,6 +370,14 @@ func (t *Tools) Status(ctx context.Context) (*ServerStatus, error) {
 			st.ConfigFile = v
 		case ok && k == "number of zones":
 			st.Zones = v
+		case ok && k == "recursive clients":
+			st.RecursiveClients = v
+		case ok && k == "tcp clients":
+			st.TCPClients = v
+		case ok && k == "CPUs found":
+			st.CPUs = v
+		case ok && k == "worker threads":
+			st.WorkerThreads = v
 		case strings.Contains(line, "server is up and running"):
 			st.Running = true
 		}
@@ -0,0 +1,180 @@
+package blocking
+
+import (
+	"fmt"
+	"math"
+	"net/netip"
+	"sort"
+	"strings"
+)
+
+// Client steps (docs/blocking.md): named checks policy zones in order and
+// the first match decides, so a "gate" zone that lets some clients through
+// (rpz-passthru, matched on the client's address) keeps them from every
+// zone after it. Jarl puts a gate in front of the lists of each step,
+// letting through the clients whose step is below it.
+
+// GateSuffix follows a gate's name: off.gate.jarl.invalid,
+// strict.gate.jarl.invalid.
+const GateSuffix = ".gate.jarl.invalid"
+
+// v4Mapped holds the IPv4-mapped IPv6 addresses.
+var v4Mapped = netip.MustParsePrefix("::ffff:0:0/96")
+
+// GateZone returns the policy zone name of the gate in front of a step's
+// lists ("off" for the gate in front of the normal lists).
+func GateZone(step string) string { return step + GateSuffix }
+
+// Assignment gives the addresses in Prefix a step rank (-1 off, 0 normal,
+// 1, 2, ... the steps above it).
+type Assignment struct {
+	Prefix netip.Prefix
+	Rank   int
+}
+
+// PassBelow returns the fewest prefixes that cover exactly the addresses whose
+// rank is below k. An address has the rank of the most specific
+// assignment containing it, and rank 0 (normal) when none does. When two
+// assignments have the same prefix, the higher rank counts (validation
+// refuses that anyway).
+func PassBelow(assigns []Assignment, k int) []netip.Prefix {
+	var out []netip.Prefix
+	for _, root := range []netip.Prefix{netip.MustParsePrefix("0.0.0.0/0"), netip.MustParsePrefix("::/0")} {
+		var mine []Assignment
+		if !root.Addr().Is4() {
+			// named matches IPv4 clients as IPv4-mapped IPv6 addresses:
+			// keep IPv6 prefixes clear of them, so only the IPv4 ones
+			// decide for IPv4 clients.
+			mine = append(mine, Assignment{v4Mapped, math.MaxInt})
+		}
+		rank := 0
+		for _, a := range assigns {
+			p := a.Prefix.Masked()
+			if p.Addr().Is4() != root.Addr().Is4() {
+				continue
+			}
+			if p.Bits() == 0 {
+				rank = max(rank, a.Rank)
+				continue
+			}
+			mine = append(mine, Assignment{p, a.Rank})
+		}
+		for _, p := range cover(root, rank, mine, k) {
+			if p.Bits() == 0 {
+				// A trigger needs at least one bit: use both halves.
+				lo, hi := halves(p)
+				out = append(out, lo, hi)
+				continue
+			}
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// cover returns the prefixes inside p whose addresses have a rank below k.
+// rank is p's own; inside are the assignments strictly inside p.
+func cover(p netip.Prefix, rank int, inside []Assignment, k int) []netip.Prefix {
+	if len(inside) == 0 {
+		if rank < k {
+			return []netip.Prefix{p}
+		}
+		return nil
+	}
+	var out []netip.Prefix
+	lo, hi := halves(p)
+	full := 0
+	for _, h := range []netip.Prefix{lo, hi} {
+		var sub []Assignment
+		for _, a := range inside {
+			if a.Prefix.Bits() > h.Bits() && h.Contains(a.Prefix.Addr()) {
+				sub = append(sub, a)
+			}
+		}
+		c := cover(h, ownRank(inside, h, rank), sub, k)
+		if len(c) == 1 && c[0] == h {
+			full++
+		}
+		out = append(out, c...)
+	}
+	if full == 2 {
+		return []netip.Prefix{p}
+	}
+	return out
+}
+
+// ownRank is the rank of h: its own assignments' (the highest), or the
+// inherited one without any.
+func ownRank(inside []Assignment, h netip.Prefix, inherited int) int {
+	r, found := 0, false
+	for _, a := range inside {
+		if a.Prefix == h {
+			if !found || a.Rank > r {
+				r = a.Rank
+			}
+			found = true
+		}
+	}
+	if !found {
+		return inherited
+	}
+	return r
+}
+
+// halves splits a prefix into its two halves.
+func halves(p netip.Prefix) (netip.Prefix, netip.Prefix) {
+	bits := p.Bits() + 1
+	lo := netip.PrefixFrom(p.Addr(), bits).Masked()
+	b := lo.Addr().AsSlice()
+	i := (bits - 1) / 8
+	b[i] |= 0x80 >> ((bits - 1) % 8)
+	a, _ := netip.AddrFromSlice(b)
+	return lo, netip.PrefixFrom(a, bits)
+}
+
+// ClientIPOwner returns the policy zone owner name that matches clients
+// in p (an rpz-client-ip trigger): 32.37.0.10.10.rpz-client-ip for
+// 10.10.0.37/32, 64.zz.3d7f.8013.2a02.rpz-client-ip for 2a02:8013:3d7f::/64.
+func ClientIPOwner(p netip.Prefix) string {
+	p = p.Masked()
+	a := p.Addr()
+	var labels []string
+	if a.Is4() {
+		b := a.As4()
+		labels = []string{fmt.Sprint(b[3]), fmt.Sprint(b[2]), fmt.Sprint(b[1]), fmt.Sprint(b[0])}
+	} else {
+		// RFC 5952 text, with "zz" for the "::" and the words reversed.
+		s := a.String()
+		var words []string
+		if left, right, ok := strings.Cut(s, "::"); ok {
+			if left != "" {
+				words = append(words, strings.Split(left, ":")...)
+			}
+			words = append(words, "zz")
+			if right != "" {
+				words = append(words, strings.Split(right, ":")...)
+			}
+		} else {
+			words = strings.Split(s, ":")
+		}
+		for i := len(words) - 1; i >= 0; i-- {
+			labels = append(labels, words[i])
+		}
+	}
+	return fmt.Sprint(p.Bits()) + "." + strings.Join(labels, ".") + ".rpz-client-ip"
+}
+
+// GateZoneFile renders a gate: every client in prefixes passes.
+func GateZoneFile(title string, prefixes []netip.Prefix) string {
+	owners := make([]string, 0, len(prefixes))
+	for _, p := range prefixes {
+		owners = append(owners, ClientIPOwner(p))
+	}
+	sort.Strings(owners)
+	var sb strings.Builder
+	sb.WriteString(header(title, 1))
+	for _, o := range owners {
+		sb.WriteString(o + "\tCNAME\trpz-passthru.\n")
+	}
+	return sb.String()
+}
@@ -0,0 +1,96 @@
+package blocking
+
+import (
+	"net/netip"
+	"slices"
+	"strings"
+	"testing"
+)
+
+func pfx(s string) netip.Prefix { return netip.MustParsePrefix(s) }
+
+// rankOf is the rank PassBelow's model gives an address.
+func rankOf(assigns []Assignment, a netip.Addr) int {
+	best, bits := 0, -1
+	for _, x := range assigns {
+		if x.Prefix.Contains(a) && x.Prefix.Bits() >= bits {
+			if x.Prefix.Bits() > bits || x.Rank > best {
+				best = x.Rank
+			}
+			bits = x.Prefix.Bits()
+		}
+	}
+	return best
+}
+
+func covered(ps []netip.Prefix, a netip.Addr) bool {
+	for _, p := range ps {
+		if p.Contains(a) {
+			return true
+		}
+	}
+	return false
+}
+
+func TestPassBelow(t *testing.T) {
+	assigns := []Assignment{
+		{pfx("10.10.0.20/32"), -1},   // work laptop: off
+		{pfx("10.10.0.0/24"), 2},     // the kids' network: very strict
+		{pfx("10.10.0.50/32"), 1},    // except one tablet: strict
+		{pfx("2a02:db8::/64"), 1},    // an IPv6 network: strict
+		{pfx("2a02:db8::99/128"), 0}, // one device in it: normal
+	}
+	probe := []string{"10.10.0.20", "10.10.0.21", "10.10.0.50", "10.10.0.51", "10.10.1.1", "192.168.1.1", "0.0.0.1", "255.255.255.255",
+		"2a02:db8::1", "2a02:db8::99", "2a02:db8:0:1::1", "::1", "ffff::1"}
+	for k := 0; k <= 3; k++ {
+		gate := PassBelow(assigns, k)
+		for _, s := range probe {
+			a := netip.MustParseAddr(s)
+			if want := rankOf(assigns, a) < k; covered(gate, a) != want {
+				t.Errorf("k=%d %s: passes=%v, want %v (rank %d)", k, s, !want, want, rankOf(assigns, a))
+			}
+		}
+		for _, p := range gate {
+			if p.Bits() == 0 {
+				t.Errorf("k=%d: a /0 trigger", k)
+			}
+			// named matches IPv4 clients as ::ffff:a.b.c.d: no IPv6
+			// prefix may reach them.
+			if p.Addr().Is6() && p.Overlaps(v4Mapped) {
+				t.Errorf("k=%d: %s covers IPv4-mapped addresses", k, p)
+			}
+		}
+	}
+	// Off clients only, before the normal lists.
+	if got := PassBelow(assigns, 0); !slices.Equal(got, []netip.Prefix{pfx("10.10.0.20/32")}) {
+		t.Errorf("off gate = %v", got)
+	}
+	// Nobody above normal: everyone passes the gate of step 1: two IPv4
+	// halves, and IPv6 around the IPv4-mapped /96 (96 prefixes).
+	if got := PassBelow(nil, 1); len(got) != 2+96 {
+		t.Errorf("empty step-1 gate = %v", got)
+	}
+	// The complement of one IPv4 address is 32 prefixes (plus IPv6's 96).
+	if got := PassBelow([]Assignment{{pfx("10.10.0.50/32"), 1}}, 1); len(got) != 32+96 {
+		t.Errorf("complement of one address: %d prefixes", len(got))
+	}
+}
+
+func TestClientIPOwner(t *testing.T) {
+	for p, want := range map[string]string{
+		"10.10.0.37/32":            "32.37.0.10.10.rpz-client-ip",
+		"10.10.0.0/24":             "24.0.0.10.10.rpz-client-ip",
+		"2a02:db8::/64":            "64.zz.db8.2a02.rpz-client-ip",
+		"2a02:db8::1/128":          "128.1.zz.db8.2a02.rpz-client-ip",
+		"::/1":                     "1.zz.rpz-client-ip",
+		"2001:db8:1:2:3:4:5:6/128": "128.6.5.4.3.2.1.db8.2001.rpz-client-ip",
+	} {
+		if got := ClientIPOwner(pfx(p)); got != want {
+			t.Errorf("%s: %s, want %s", p, got, want)
+		}
+	}
+	z := GateZoneFile("t", []netip.Prefix{pfx("10.10.0.20/32")})
+	if !strings.Contains(z, "32.20.0.10.10.rpz-client-ip\tCNAME\trpz-passthru.\n") {
+		t.Errorf("gate zone:\n%s", z)
+	}
+}
@@ -40,6 +40,9 @@ type Match struct {
 	Entry  string `json:"entry,omitempty"` // the matching entry: the name, or *.parent
 	RuleID int64  `json:"rule_id,omitempty"`
 	List   string `json:"list,omitempty"` // the blocklist, when a list matched
+	// Step is the list's step when it is above normal: only clients at
+	// that step or above get this answer (others: none).
+	Step string `json:"step,omitempty"`
 }

 // Actions of rules.
@@ -139,6 +142,13 @@ func RuleEntries(rules []Rule) map[string]string {
 	return e
 }

+// PausedZoneFile renders a rules zone that lets every name through, for
+// while blocking is paused: the rules zone comes first, and its match
+// stops named from looking at the lists.
+func PausedZoneFile(title string) string {
+	return header(title+" (blocking is paused)", 1) + "*\tCNAME\trpz-passthru.\n"
+}
+
 // RulesZoneFile renders the rules zone of a view.
 func RulesZoneFile(title string, rules []Rule) string {
 	e := RuleEntries(rules)
@@ -427,3 +427,87 @@ func classify(name, grammar string) (string, []string) {
 	}
 	return KindRaw, nil
 }
+
+// listParam matches an optional parameter before a statement's list, such
+// as "[ port <integer> ]" in allow-transfer's grammar.
+var listParam = regexp.MustCompile(`\[ ([a-z0-9-]+) `)
+
+// WrapList adds the braces to a list value given without them, for
+// statements that end in a list ("allow-transfer [ port <integer> ] {
+// <address_match_element>; ... }"): "10.0.0.53" becomes "{ 10.0.0.53; }",
+// "port 5353 10.0.0.53; key xfer" becomes "port 5353 { 10.0.0.53; key
+// xfer; }". Elements are separated by ";", "," or new lines, or by spaces
+// when they are all addresses. Values with a brace, and values of other
+// statements, are returned as they are.
+func (st *Statement) WrapList(v string) string {
+	g, _, _ := strings.Cut(st.Grammar, "\n")
+	open := strings.Index(g, " {")
+	if strings.Contains(v, "{") || open < 0 || !strings.HasSuffix(g, "; ... };") {
+		return v
+	}
+	params := map[string]bool{}
+	for _, m := range listParam.FindAllStringSubmatch(g[:open], -1) {
+		params[m[1]] = true
+	}
+	fields := strings.Fields(v)
+	i := 0
+	for i+1 < len(fields) && params[strings.ToLower(fields[i])] {
+		i += 2
+	}
+	head := strings.Join(fields[:i], " ")
+	rest := strings.Join(fields[i:], " ")
+	var elems []string
+	if !strings.ContainsAny(rest, ";,\n") {
+		elems = spaceElements(fields[i:])
+	} else {
+		for _, e := range strings.FieldsFunc(rest, func(r rune) bool { return r == ';' || r == ',' || r == '\n' }) {
+			if e = strings.TrimSpace(e); e != "" {
+				elems = append(elems, e)
+			}
+		}
+	}
+	if len(elems) == 0 {
+		return v
+	}
+	list := "{ " + strings.Join(elems, "; ") + "; }"
+	if head != "" {
+		return head + " " + list
+	}
+	return list
+}
+
+// spaceElements splits list elements separated by spaces: "key NAME"
+// is one element, and "port N" and "tls NAME" belong to the address
+// before them (forwarders { 192.0.2.1 port 53; }).
+func spaceElements(fields []string) []string {
+	var out []string
+	for i := 0; i < len(fields); i++ {
+		f := fields[i]
+		switch strings.ToLower(f) {
+		case "key", "!key", "!":
+			if i+1 < len(fields) {
+				f += " " + fields[i+1]
+				i++
+			}
+			if f[0] == '!' && strings.HasPrefix(strings.ToLower(f), "! key") && i+1 < len(fields) {
+				f += " " + fields[i+1]
+				i++
+			}
+		case "-":
+			// A range with spaces around the dash: 10.0.0.1 - 10.0.0.9.
+			if len(out) > 0 && i+1 < len(fields) {
+				out[len(out)-1] += " - " + fields[i+1]
+				i++
+				continue
+			}
+		case "port", "tls":
+			if len(out) > 0 && i+1 < len(fields) {
+				out[len(out)-1] += " " + f + " " + fields[i+1]
+				i++
+				continue
+			}
+		}
+		out = append(out, f)
+	}
+	return out
+}
@@ -77,3 +77,28 @@ func TestCatalog(t *testing.T) {
 		t.Errorf("zone types = %s", types)
 	}
 }
+
+func TestWrapList(t *testing.T) {
+	c := Default()
+	for _, tc := range []struct{ scope, name, in, want string }{
+		{ScopeOptions, "allow-transfer", "10.0.10.53", "{ 10.0.10.53; }"},
+		{ScopeOptions, "allow-transfer", "localhost 10.0.10.53 key xfer ! key old !10.0.0.1", "{ localhost; 10.0.10.53; key xfer; ! key old; !10.0.0.1; }"},
+		{ScopeOptions, "forwarders", "1.1.1.1 port 853 tls cf 9.9.9.9", "{ 1.1.1.1 port 853 tls cf; 9.9.9.9; }"},
+		{ScopeOptions, "allow-transfer", "localhost; 10.0.10.53", "{ localhost; 10.0.10.53; }"},
+		{ScopeOptions, "allow-transfer", "port 5353 key xfer, !10.0.0.1", "port 5353 { key xfer; !10.0.0.1; }"},
+		{ScopeOptions, "allow-transfer", "{ any; }", "{ any; }"},
+		{ScopeOptions, "allow-query", "10.0.0.0/8 192.168.1.0/24", "{ 10.0.0.0/8; 192.168.1.0/24; }"},
+		{ScopeOptions, "forwarders", "1.1.1.1 9.9.9.9", "{ 1.1.1.1; 9.9.9.9; }"},
+		{ScopeOptions, "listen-on", "port 53 10.0.10.5", "port 53 { 10.0.10.5; }"},
+		{ScopeOptions, "recursion", "yes", "yes"},
+		{ScopeOptions, "directory", `"/var/cache/bind"`, `"/var/cache/bind"`},
+	} {
+		st, ok := c.Lookup(tc.scope, tc.name)
+		if !ok {
+			t.Fatalf("%s not found", tc.name)
+		}
+		if got := st.WrapList(tc.in); got != tc.want {
+			t.Errorf("%s %q = %q, want %q", tc.name, tc.in, got, tc.want)
+		}
+	}
+}
@@ -0,0 +1,406 @@
+package certs
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"regexp"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/go-acme/lego/v4/certcrypto"
+	"github.com/go-acme/lego/v4/certificate"
+	"github.com/go-acme/lego/v4/challenge/dns01"
+	"github.com/go-acme/lego/v4/lego"
+	"github.com/go-acme/lego/v4/registration"
+
+	"jarl/internal/acme"
+	"jarl/internal/auth"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+)
+
+// Account is the ACME account certificates are obtained with. Its key is
+// kept in Jarl's database (and so in backups), like TSIG secrets.
+type Account struct {
+	Directory    string    `json:"directory"`
+	Email        string    `json:"email,omitempty"`
+	URI          string    `json:"uri,omitempty"` // the account at the CA
+	RegisteredAt time.Time `json:"registered_at"`
+	KeyPEM       string    `json:"key_pem,omitempty"`
+}
+
+const metaAccount = "acme.account"
+
+// account returns the stored account (nil when there is none).
+func (m *Manager) account(ctx context.Context) *Account {
+	raw, err := m.store.GetMeta(ctx, metaAccount)
+	if err != nil {
+		return nil
+	}
+	var a Account
+	if json.Unmarshal([]byte(raw), &a) != nil {
+		return nil
+	}
+	return &a
+}
+
+type legoUser struct {
+	email string
+	reg   *registration.Resource
+	key   crypto.PrivateKey
+}
+
+func (u *legoUser) GetEmail() string                        { return u.email }
+func (u *legoUser) GetRegistration() *registration.Resource { return u.reg }
+func (u *legoUser) GetPrivateKey() crypto.PrivateKey        { return u.key }
+
+// ErrTermsNotAgreed means acme.account.agree_tos isn't set.
+var ErrTermsNotAgreed = errors.New("acme.account.agree_tos isn't set")
+
+func (m *Manager) httpClient() (*http.Client, error) {
+	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS12}
+	if m.cfg.CABundle != "" {
+		pem, err := os.ReadFile(m.cfg.CABundle)
+		if err != nil {
+			return nil, fmt.Errorf("acme.ca_bundle: %w", err)
+		}
+		pool, err := x509.SystemCertPool()
+		if err != nil || pool == nil {
+			pool = x509.NewCertPool()
+		}
+		if !pool.AppendCertsFromPEM(pem) {
+			return nil, fmt.Errorf("acme.ca_bundle: no certificates in %s", m.cfg.CABundle)
+		}
+		tr.TLSClientConfig.RootCAs = pool
+	}
+	return &http.Client{Timeout: 2 * time.Minute, Transport: tr}, nil
+}
+
+// client returns a lego client for the account (registering it when
+// needed) that makes keys of keyType.
+func (m *Manager) client(ctx context.Context, keyType string) (*lego.Client, error) {
+	dir := m.cfg.Directory
+	hc, err := m.httpClient()
+	if err != nil {
+		return nil, err
+	}
+	a := m.account(ctx)
+	user := &legoUser{email: m.cfg.Email}
+	if a != nil && a.Directory == dir && a.KeyPEM != "" {
+		if user.key, err = parseKey(a.KeyPEM); err != nil {
+			return nil, fmt.Errorf("the stored ACME account key: %w", err)
+		}
+		if a.URI != "" {
+			user.reg = &registration.Resource{URI: a.URI}
+		}
+	} else {
+		k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		if err != nil {
+			return nil, err
+		}
+		user.key = k
+	}
+	cfg := lego.NewConfig(user)
+	cfg.CADirURL, cfg.HTTPClient, cfg.UserAgent = dir, hc, "jarl/"+m.cfg.Version
+	cfg.Certificate.KeyType = legoKeyType(keyType)
+	cfg.Certificate.Timeout = 90 * time.Second
+	c, err := lego.NewClient(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("ACME server %s: %w", dir, err)
+	}
+	if user.reg != nil && (a.Email == m.cfg.Email) {
+		return c, nil
+	}
+	if user.reg != nil {
+		// Only the email changed: update the account.
+		if reg, err := c.Registration.UpdateRegistration(registration.RegisterOptions{TermsOfServiceAgreed: true}); err == nil {
+			user.reg = reg
+			return c, m.saveAccount(ctx, user, dir)
+		}
+	}
+	if !m.cfg.AgreeTOS {
+		tos := c.GetToSURL()
+		if tos == "" {
+			tos = "on the CA's website"
+		}
+		return nil, fmt.Errorf("%w: Jarl registers an account with %s only after you accept its terms of service (%s): set acme.account.agree_tos: true in jarl.yaml and restart jarld", ErrTermsNotAgreed, dir, tos)
+	}
+	var reg *registration.Resource
+	if m.cfg.EABKeyID != "" {
+		reg, err = c.Registration.RegisterWithExternalAccountBinding(registration.RegisterEABOptions{TermsOfServiceAgreed: true, Kid: m.cfg.EABKeyID, HmacEncoded: m.cfg.EABHMAC})
+	} else {
+		if c.GetExternalAccountRequired() {
+			return nil, fmt.Errorf("%s needs External Account Binding: set acme.account.eab_kid and eab_hmac in jarl.yaml (from the CA's dashboard)", dir)
+		}
+		reg, err = c.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
+	}
+	if err != nil {
+		return nil, fmt.Errorf("registering the ACME account: %w", err)
+	}
+	user.reg = reg
+	m.log.Info("ACME account registered", "directory", dir, "account", reg.URI)
+	return c, m.saveAccount(ctx, user, dir)
+}
+
+func (m *Manager) saveAccount(ctx context.Context, u *legoUser, dir string) error {
+	der, err := x509.MarshalPKCS8PrivateKey(u.key)
+	if err != nil {
+		return err
+	}
+	a := Account{Directory: dir, Email: u.email, URI: u.reg.URI, RegisteredAt: time.Now().UTC(),
+		KeyPEM: string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der}))}
+	b, _ := json.Marshal(a)
+	return m.store.SetMeta(ctx, metaAccount, string(b))
+}
+
+func parseKey(s string) (crypto.PrivateKey, error) {
+	b, _ := pem.Decode([]byte(s))
+	if b == nil {
+		return nil, errors.New("not PEM")
+	}
+	return x509.ParsePKCS8PrivateKey(b.Bytes)
+}
+
+func legoKeyType(t string) certcrypto.KeyType {
+	switch t {
+	case "ec384":
+		return certcrypto.EC384
+	case "rsa2048":
+		return certcrypto.RSA2048
+	case "rsa3072":
+		return certcrypto.RSA3072
+	case "rsa4096":
+		return certcrypto.RSA4096
+	}
+	return certcrypto.EC256
+}
+
+// KeyTypes are the key types a certificate Jarl obtains can have.
+var KeyTypes = []string{"ec256", "ec384", "rsa2048", "rsa3072", "rsa4096"}
+
+// provider answers DNS-01 challenges for one issue: in a zone Jarl serves,
+// or at Porkbun, as route decides for each name.
+type provider struct {
+	m        *Manager
+	ctx      context.Context
+	cert     *model.Certificate
+	mu       sync.Mutex
+	cleanups map[string]func() error
+	routes   []Route
+}
+
+func (p *provider) Present(domain, token, keyAuth string) error {
+	info := dns01.GetChallengeInfo(domain, keyAuth)
+	st, err := p.m.store.LoadState(p.ctx)
+	if err != nil {
+		return err
+	}
+	r := p.m.route(p.ctx, st, p.cert.Challenge, domain, info.EffectiveFQDN)
+	p.mu.Lock()
+	p.routes = append(p.routes, r)
+	p.mu.Unlock()
+	if r.Error != "" {
+		return errors.New(r.Error)
+	}
+	key := info.EffectiveFQDN + " " + info.Value
+	var cleanup func() error
+	switch r.Route {
+	case model.ChallengeJarl:
+		if err := p.m.publish(p.ctx, p.cert, info.EffectiveFQDN, info.Value, true); err != nil {
+			return err
+		}
+		cleanup = func() error {
+			return p.m.publish(context.WithoutCancel(p.ctx), p.cert, info.EffectiveFQDN, info.Value, false)
+		}
+	case model.ChallengePorkbun:
+		zone := strings.TrimSuffix(r.Zone, ".")
+		id, err := p.m.cfg.Porkbun.CreateTXT(p.ctx, zone, strings.TrimSuffix(info.EffectiveFQDN, "."), info.Value)
+		if err != nil {
+			return fmt.Errorf("publishing the challenge for %s at Porkbun: %w", domain, err)
+		}
+		cleanup = func() error { return p.m.cfg.Porkbun.DeleteRecord(context.WithoutCancel(p.ctx), zone, id) }
+	}
+	p.mu.Lock()
+	p.cleanups[key] = cleanup
+	p.mu.Unlock()
+	return nil
+}
+
+func (p *provider) CleanUp(domain, token, keyAuth string) error {
+	info := dns01.GetChallengeInfo(domain, keyAuth)
+	key := info.EffectiveFQDN + " " + info.Value
+	p.mu.Lock()
+	f := p.cleanups[key]
+	delete(p.cleanups, key)
+	p.mu.Unlock()
+	if f == nil {
+		return nil
+	}
+	if err := f(); err != nil {
+		p.m.log.Warn("removing an ACME challenge record failed", "certificate", p.cert.Name, "record", info.EffectiveFQDN, "err", err)
+		return err
+	}
+	return nil
+}
+
+// Timeout is how long lego waits for the record to reach every name
+// server of the zone: Porkbun's take a few minutes.
+func (p *provider) Timeout() (timeout, interval time.Duration) {
+	if p.m.cfg.PropagationTimeout > 0 {
+		return p.m.cfg.PropagationTimeout, 2 * time.Second
+	}
+	return 10 * time.Minute, 10 * time.Second
+}
+
+// publish writes (or removes) a challenge TXT record in the Jarl zone that
+// holds name, in every view that has it, and returns once named serves it.
+func (m *Manager) publish(ctx context.Context, c *model.Certificate, name, value string, set bool) error {
+	st, err := m.store.LoadState(ctx)
+	if err != nil {
+		return err
+	}
+	zones := acme.Zones(name, primaryZones(st), "")
+	if len(zones) == 0 {
+		return fmt.Errorf("no primary zone in Jarl contains %s", strings.TrimSuffix(name, "."))
+	}
+	var reqs []engine.Request
+	for _, r := range acme.Requests(name, zones, []string{value}, set, acme.DefaultTTL) {
+		reqs = append(reqs, engine.Request{Op: r.Op, ID: r.ID, BaseVersion: r.BaseVersion, Data: r.Data})
+	}
+	desc := acme.Description(name, set) + " (certificate " + c.Name + ")"
+	if _, err := m.eng.Submit(ctx, reqs, auth.System, "acme", desc, engine.ApplyOptions{}); err != nil {
+		return fmt.Errorf("writing the challenge record %s: %w", strings.TrimSuffix(name, "."), err)
+	}
+	return nil
+}
+
+// obtain gets a new certificate for c from the CA. old is the certificate
+// it replaces (nil for the first), so the CA can link them (ARI).
+func (m *Manager) obtain(ctx context.Context, c *model.Certificate, old *x509.Certificate) (*certificate.Resource, []Route, error) {
+	m.legoMu.Lock()
+	defer m.legoMu.Unlock()
+	client, err := m.client(ctx, c.KeyType)
+	if err != nil {
+		return nil, nil, err
+	}
+	p := &provider{m: m, ctx: ctx, cert: c, cleanups: map[string]func() error{}}
+	opts := []dns01.ChallengeOption{dns01.AddRecursiveNameservers(m.cfg.Resolvers), dns01.AddDNSTimeout(10 * time.Second)}
+	if m.cfg.SkipPropagationCheck {
+		opts = append(opts, dns01.DisableAuthoritativeNssPropagationRequirement())
+	}
+	if err := client.Challenge.SetDNS01Provider(p, opts...); err != nil {
+		return nil, nil, err
+	}
+	req := certificate.ObtainRequest{Domains: c.Domains, Bundle: true}
+	if old != nil {
+		if id, err := certificate.MakeARICertID(old); err == nil {
+			req.ReplacesCertID = id
+		}
+	}
+	res, err := client.Certificate.Obtain(req)
+	if err != nil && req.ReplacesCertID != "" && len(p.routes) == 0 && ctx.Err() == nil {
+		// The CA refused the order itself, before any challenge: it may
+		// not link the new certificate to the old one (another CA, one
+		// already replaced, or its own bug). Ask for a plain new one.
+		m.log.Info("the CA refused to link the renewal to the old certificate; asking for a new one", "certificate", c.Name, "err", cleanLegoError(err))
+		req.ReplacesCertID = ""
+		res, err = client.Certificate.Obtain(req)
+	}
+	if err != nil {
+		return nil, p.routes, cleanLegoError(err)
+	}
+	return res, p.routes, nil
+}
+
+// renewalInfo asks the CA when to renew (ARI, RFC 9773). nil, nil when
+// it doesn't say.
+func (m *Manager) renewalInfo(ctx context.Context, c *model.Certificate, leaf *x509.Certificate) (*time.Time, error) {
+	m.legoMu.Lock()
+	defer m.legoMu.Unlock()
+	client, err := m.client(ctx, c.KeyType)
+	if err != nil {
+		return nil, err
+	}
+	ri, err := client.Certificate.GetRenewalInfo(certificate.RenewalInfoRequest{Cert: leaf})
+	if err != nil {
+		if strings.Contains(err.Error(), "does not advertise a renewal info endpoint") {
+			return nil, nil
+		}
+		return nil, err
+	}
+	// A time within the CA's window (now if it has started); never later
+	// than two thirds into the lifetime, in case the window is odd.
+	at := ri.ShouldRenewAt(time.Now(), 10*365*24*time.Hour)
+	if at == nil {
+		return nil, nil
+	}
+	t := at.UTC().Truncate(time.Second)
+	if limit := twoThirds(leaf.NotBefore, leaf.NotAfter); t.After(limit) {
+		t = limit
+	}
+	return &t, nil
+}
+
+func twoThirds(nb, na time.Time) time.Time {
+	return nb.Add(na.Sub(nb) * 2 / 3).UTC().Truncate(time.Second)
+}
+
+// cleanLegoError shortens lego's errors, which wrap each name's problem in
+// several prefixes and the whole ACME problem document:
+//
+//	error: one or more domains had a problem:
+//	[a.example.com] [a.example.com] acme: error presenting token: MSG
+//	[b.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: MSG
+//
+// becomes "a.example.com: MSG; b.example.com: the CA refused (unauthorized): MSG".
+func cleanLegoError(err error) error {
+	msg := strings.TrimSpace(strings.Replace(err.Error(), "error: one or more domains had a problem:", "", 1))
+	var out []string
+	for _, line := range strings.Split(msg, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		domain := ""
+		for strings.HasPrefix(line, "[") {
+			end := strings.Index(line, "] ")
+			if end < 0 {
+				break
+			}
+			if domain == "" {
+				domain = line[1:end]
+			}
+			line = line[end+2:]
+		}
+		for _, p := range []string{"acme: error presenting token: ", "acme: error: ", "acme: "} {
+			line = strings.TrimPrefix(line, p)
+		}
+		if m := acmeProblemRe.FindStringSubmatch(line); m != nil {
+			line = "the CA refused (" + m[2] + "): " + m[3]
+		}
+		if domain != "" {
+			line = domain + ": " + line
+		}
+		out = append(out, line)
+	}
+	if len(out) == 0 {
+		return err
+	}
+	return errors.New(strings.Join(out, "; "))
+}
+
+// acmeProblemRe matches "403 :: urn:ietf:params:acme:error:unauthorized :: detail".
+var acmeProblemRe = regexp.MustCompile(`^(\d+) :: urn:ietf:params:acme:error:(\w+) :: (.*)$`)
@@ -0,0 +1,490 @@
+package certs
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"errors"
+	"io"
+	"log/slog"
+	"math/big"
+	"net"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/go-acme/lego/v4/challenge/dns01"
+	"github.com/miekg/dns"
+
+	"jarl/internal/auth"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+	"jarl/internal/porkbun"
+	"jarl/internal/render"
+	"jarl/internal/store"
+)
+
+// fakeDNS answers like the internet would: zones with their public name
+// servers, CNAME records, and TXT records (Porkbun's, from the fake API).
+type fakeDNS struct {
+	mu     sync.Mutex
+	zones  map[string][]string // zone -> NS
+	cnames map[string]string
+	txt    func(name string) []string
+	addr   string
+}
+
+func newFakeDNS(t *testing.T) *fakeDNS {
+	f := &fakeDNS{zones: map[string][]string{}, cnames: map[string]string{}, txt: func(string) []string { return nil }}
+	pc, err := net.ListenPacket("udp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := &dns.Server{PacketConn: pc, Handler: f}
+	go srv.ActivateAndServe()
+	t.Cleanup(func() { srv.Shutdown() })
+	f.addr = pc.LocalAddr().String()
+	return f
+}
+
+func (f *fakeDNS) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	m := new(dns.Msg)
+	m.SetReply(r)
+	q := r.Question[0]
+	name := strings.ToLower(q.Name)
+	zone := ""
+	for z := range f.zones {
+		if dns.IsSubDomain(z, name) && len(z) > len(zone) {
+			zone = z
+		}
+	}
+	if zone == "" {
+		m.Rcode = dns.RcodeNameError
+		w.WriteMsg(m)
+		return
+	}
+	soa := &dns.SOA{Hdr: dns.RR_Header{Name: zone, Rrtype: dns.TypeSOA, Class: dns.ClassINET, Ttl: 60}, Ns: f.zones[zone][0], Mbox: "h." + zone, Serial: 1, Refresh: 1, Retry: 1, Expire: 1, Minttl: 60}
+	switch {
+	case q.Qtype == dns.TypeSOA && name == zone:
+		m.Answer = append(m.Answer, soa)
+	case q.Qtype == dns.TypeNS && name == zone:
+		for _, ns := range f.zones[zone] {
+			m.Answer = append(m.Answer, &dns.NS{Hdr: dns.RR_Header{Name: zone, Rrtype: dns.TypeNS, Class: dns.ClassINET, Ttl: 60}, Ns: ns})
+		}
+	case f.cnames[name] != "":
+		m.Answer = append(m.Answer, &dns.CNAME{Hdr: dns.RR_Header{Name: name, Rrtype: dns.TypeCNAME, Class: dns.ClassINET, Ttl: 60}, Target: f.cnames[name]})
+	case q.Qtype == dns.TypeTXT && len(f.txt(name)) > 0:
+		for _, v := range f.txt(name) {
+			m.Answer = append(m.Answer, &dns.TXT{Hdr: dns.RR_Header{Name: name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 60}, Txt: []string{v}})
+		}
+	default:
+		m.Ns = append(m.Ns, soa)
+	}
+	w.WriteMsg(m)
+}
+
+type env struct {
+	t   *testing.T
+	m   *Manager
+	st  *store.Store
+	eng *engine.Engine
+	dns *fakeDNS
+	pb  *porkbun.Fake
+	dir string
+}
+
+// newEnv sets up Jarl with zone example.com (name server
+// ns1.example.com, which the internet also uses), a fake internet and a
+// fake Porkbun account with pb.test.
+func newEnv(t *testing.T, withPorkbun bool) *env {
+	dir := t.TempDir()
+	st, err := store.Open(filepath.Join(dir, "jarl.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	quiet := slog.New(slog.NewTextHandler(io.Discard, nil))
+	eng := engine.New(st, nil, engine.Config{
+		Paths:      render.Paths{ConfigDir: filepath.Join(dir, "etc"), ZoneDir: filepath.Join(dir, "zones"), CacheDir: filepath.Join(dir, "cache")},
+		StagingDir: filepath.Join(dir, "staging"), NoReload: true, SkipCheck: true,
+	}, quiet)
+	e := &env{t: t, st: st, eng: eng, dns: newFakeDNS(t), dir: dir}
+	e.submit(engine.NewRequest(engine.OpSettingsUpdate, 0, engine.SettingsInput{Nameservers: &[]string{"ns1.example.net."}}),
+		engine.NewRequest(engine.OpZoneCreate, 0, engine.ZoneInput{Name: model.Ptr("example.com")}))
+	e.dns.mu.Lock()
+	e.dns.zones["example.com."] = []string{"ns1.example.net."}
+	e.dns.zones["pb.test."] = []string{"curitiba.ns.porkbun.com.", "fortaleza.ns.porkbun.com."}
+	e.dns.zones["other.test."] = []string{"a.ns.cloudflare.com."}
+	e.dns.mu.Unlock()
+	cfg := Config{Resolvers: []string{e.dns.addr}, Dir: filepath.Join(dir, "tls"), Directory: "https://acme.invalid/dir"}
+	if withPorkbun {
+		e.pb = porkbun.NewFake("pk1_test", "sk1_test", "pb.test")
+		ts := httptest.NewServer(e.pb)
+		t.Cleanup(ts.Close)
+		cfg.Porkbun = &porkbun.Client{BaseURL: ts.URL + "/api/json/v3", APIKey: "pk1_test", Secret: "sk1_test"}
+		e.dns.mu.Lock()
+		e.dns.txt = func(name string) []string { return e.pb.TXT(name) }
+		e.dns.mu.Unlock()
+	}
+	e.m = New(cfg, st, eng, quiet)
+	// lego's own lookups (CNAME following) use the fake internet too.
+	dns01.AddRecursiveNameservers([]string{e.dns.addr})(nil)
+	return e
+}
+
+func (e *env) submit(reqs ...engine.Request) {
+	e.t.Helper()
+	if _, err := e.eng.Submit(context.Background(), reqs, auth.System, "test", "", engine.ApplyOptions{}); err != nil {
+		e.t.Fatal(err)
+	}
+}
+
+func (e *env) state() *model.State {
+	st, err := e.st.LoadState(context.Background())
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	return st
+}
+
+func TestRoute(t *testing.T) {
+	e := newEnv(t, true)
+	ctx := context.Background()
+	e.dns.mu.Lock()
+	e.dns.cnames["_acme-challenge.www.other.test."] = "www-other.acme.example.com."
+	e.dns.mu.Unlock()
+	cases := []struct {
+		challenge, domain string
+		route             string // "" for an error
+		target            string
+		errHas            string
+	}{
+		{"auto", "www.example.com", "jarl", "_acme-challenge.www.example.com.", ""},
+		{"auto", "*.example.com", "jarl", "_acme-challenge.example.com.", ""},
+		{"auto", "ns1.pb.test", "porkbun", "_acme-challenge.ns1.pb.test.", ""},
+		{"auto", "www.other.test", "jarl", "www-other.acme.example.com.", ""},
+		{"auto", "mail.other.test", "", "", "Point _acme-challenge.mail.other.test with a CNAME"},
+		{"porkbun", "www.example.com", "", "", "not Porkbun"},
+		{"jarl", "ns1.pb.test", "", "", "no primary zone in Jarl is pb.test"},
+		{"jarl", "www.example.com", "jarl", "_acme-challenge.www.example.com.", ""},
+	}
+	for _, c := range cases {
+		r := e.m.route(ctx, e.state(), c.challenge, c.domain, "")
+		if r.Route != c.route || c.target != "" && r.Target != c.target || c.errHas != "" && !strings.Contains(r.Error, c.errHas) {
+			t.Errorf("%s %s: route %q target %q error %q", c.challenge, c.domain, r.Route, r.Target, r.Error)
+		}
+	}
+
+	// The move from Porkbun to Jarl: while the internet still asks
+	// Porkbun, auto goes there even though Jarl has the zone; once the
+	// name servers change, it comes to Jarl.
+	e.submit(engine.NewRequest(engine.OpZoneCreate, 0, engine.ZoneInput{Name: model.Ptr("pb.test")}))
+	if r := e.m.route(ctx, e.state(), "auto", "ns1.pb.test", ""); r.Route != "porkbun" {
+		t.Errorf("before the move: %+v", r)
+	}
+	if r := e.m.route(ctx, e.state(), "jarl", "ns1.pb.test", ""); !strings.Contains(r.Error, "not by the name servers in Jarl's zone (ns1.example.net)") {
+		t.Errorf("jarl before the move: %+v", r)
+	}
+	e.dns.mu.Lock()
+	e.dns.zones["pb.test."] = []string{"ns1.example.net."}
+	e.dns.mu.Unlock()
+	if r := e.m.route(ctx, e.state(), "auto", "ns1.pb.test", ""); r.Route != "jarl" {
+		t.Errorf("after the move: %+v", r)
+	}
+	if r := e.m.route(ctx, e.state(), "porkbun", "ns1.pb.test", ""); !strings.Contains(r.Error, "not Porkbun") {
+		t.Errorf("porkbun after the move: %+v", r)
+	}
+
+	// Without a Porkbun key, a Porkbun domain says what is missing.
+	e2 := newEnv(t, false)
+	if r := e2.m.route(ctx, e2.state(), "auto", "ns1.pb.test", ""); !strings.Contains(r.Error, "no porkbun.api_key") {
+		t.Errorf("without a key: %+v", r)
+	}
+}
+
+func TestProvider(t *testing.T) {
+	e := newEnv(t, true)
+	ctx := context.Background()
+	c := &model.Certificate{Name: "t", Challenge: "auto"}
+	p := &provider{m: e.m, ctx: ctx, cert: c, cleanups: map[string]func() error{}}
+
+	// Porkbun: the record goes in through the API and is removed again.
+	info := dns01.GetChallengeInfo("ns1.pb.test", "key-auth-1")
+	if err := p.Present("ns1.pb.test", "tok", "key-auth-1"); err != nil {
+		t.Fatal(err)
+	}
+	if got := e.pb.TXT("_acme-challenge.ns1.pb.test"); len(got) != 1 || got[0] != info.Value {
+		t.Fatalf("Porkbun TXT = %v, want %s", got, info.Value)
+	}
+	if err := p.CleanUp("ns1.pb.test", "tok", "key-auth-1"); err != nil {
+		t.Fatal(err)
+	}
+	if got := e.pb.TXT("_acme-challenge.ns1.pb.test"); len(got) != 0 {
+		t.Fatalf("Porkbun TXT after cleanup = %v", got)
+	}
+
+	// Jarl: the record goes into the zone, in a changeset by the system.
+	txt := func() []string {
+		var out []string
+		st := e.state()
+		for _, r := range st.Records {
+			if r.Type == "TXT" && r.Name == "_acme-challenge.www.example.com." {
+				out = append(out, r.Data)
+			}
+		}
+		return out
+	}
+	info = dns01.GetChallengeInfo("www.example.com", "key-auth-2")
+	if err := p.Present("www.example.com", "tok", "key-auth-2"); err != nil {
+		t.Fatal(err)
+	}
+	if got := txt(); len(got) != 1 || !strings.Contains(got[0], info.Value) {
+		t.Fatalf("Jarl TXT = %v, want %s", got, info.Value)
+	}
+	if err := p.CleanUp("www.example.com", "tok", "key-auth-2"); err != nil {
+		t.Fatal(err)
+	}
+	if got := txt(); len(got) != 0 {
+		t.Fatalf("Jarl TXT after cleanup = %v", got)
+	}
+	if len(p.routes) != 2 || p.routes[0].Route != "porkbun" || p.routes[1].Route != "jarl" {
+		t.Errorf("routes = %+v", p.routes)
+	}
+
+	// A name nobody can answer for fails before anything is published.
+	if err := p.Present("mail.other.test", "tok", "k"); err == nil || !strings.Contains(err.Error(), "CNAME") {
+		t.Errorf("other.test: %v", err)
+	}
+}
+
+// makeCert returns a certificate for names (signed by a CA unless
+// selfSigned) and its key, as PEM; withCA appends the CA certificate.
+func makeCert(t *testing.T, names []string, notBefore, notAfter time.Time, withCA bool) (certPEM, keyPEM []byte) {
+	t.Helper()
+	caKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	ca := &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "Test CA", Organization: []string{"Jarl"}},
+		NotBefore: notBefore, NotAfter: notAfter.Add(time.Hour), IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign}
+	caDER, _ := x509.CreateCertificate(rand.Reader, ca, ca, &caKey.PublicKey, caKey)
+	caCert, _ := x509.ParseCertificate(caDER)
+	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	leaf := &x509.Certificate{SerialNumber: big.NewInt(time.Now().UnixNano()), Subject: pkix.Name{CommonName: names[0]}, DNSNames: names,
+		NotBefore: notBefore, NotAfter: notAfter, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}}
+	der, err := x509.CreateCertificate(rand.Reader, leaf, caCert, &key.PublicKey, caKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certPEM = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	if withCA {
+		certPEM = append(certPEM, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: caDER})...)
+	}
+	kd, _ := x509.MarshalPKCS8PrivateKey(key)
+	return certPEM, pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: kd})
+}
+
+func TestInspect(t *testing.T) {
+	now := time.Now()
+	cert, key := makeCert(t, []string{"ns1.example.com", "*.example.com"}, now, now.Add(90*24*time.Hour), true)
+	in, pair, err := Inspect(cert, key)
+	if err != nil || pair == nil {
+		t.Fatal(err)
+	}
+	if strings.Join(in.Names, " ") != "ns1.example.com *.example.com" || in.Issuer != "Jarl Test CA" || in.KeyType != "ec256" || len(in.Warnings) != 0 {
+		t.Errorf("info = %+v", in)
+	}
+	leafOnly, _ := makeCert(t, []string{"a.example.com"}, now, now.Add(time.Hour), false)
+	_, otherKey := makeCert(t, []string{"b.example.com"}, now, now.Add(time.Hour), false)
+	if _, _, err := Inspect(cert, otherKey); err == nil || !strings.Contains(err.Error(), "doesn't belong") {
+		t.Errorf("mismatched key: %v", err)
+	}
+	leafCert, leafKey := makeCert(t, []string{"a.example.com"}, now, now.Add(time.Hour), false)
+	if in, _, err := Inspect(leafCert, leafKey); err != nil || len(in.Warnings) != 1 || !strings.Contains(in.Warnings[0], "full chain") {
+		t.Errorf("leaf only: %+v %v", in, err)
+	}
+	_ = leafOnly
+	if !Covers([]string{"*.example.com"}, []string{"www.example.com"}) || Covers([]string{"*.example.com"}, []string{"a.b.example.com"}) || Covers([]string{"example.com"}, []string{"www.example.com"}) {
+		t.Error("Covers")
+	}
+}
+
+func TestDueAndStatus(t *testing.T) {
+	m := &Manager{now: time.Now}
+	now := time.Now().UTC().Truncate(time.Second)
+	nb, na := now.Add(-80*24*time.Hour), now.Add(10*24*time.Hour)
+	c := &model.Certificate{Source: model.CertSourceACME, CreatedAt: now.Add(-time.Hour)}
+	if got := m.Due(c); !got.Equal(c.CreatedAt) {
+		t.Errorf("never obtained: due %v", got)
+	}
+	if s := m.StatusOf(c); s.State != "pending" {
+		t.Errorf("pending: %+v", s)
+	}
+	c.CertPEM, c.NotBefore, c.NotAfter = "x", &nb, &na
+	if got, want := m.Due(c), twoThirds(nb, na); !got.Equal(want) {
+		t.Errorf("due %v, want two thirds %v", got, want)
+	}
+	ari := now.Add(time.Hour)
+	c.RenewAt = &ari
+	if got := m.Due(c); !got.Equal(ari) {
+		t.Errorf("due %v, want the CA's %v", got, ari)
+	}
+	// 10 days left of 90 is less than a sixth: expiring.
+	if s := m.StatusOf(c); s.State != "expiring" {
+		t.Errorf("status %+v", s)
+	}
+	// After three failures it waits four hours from the last attempt.
+	last := now.Add(-time.Hour)
+	c.Failures, c.LastAttempt, c.LastError = 3, &last, "boom"
+	if got := m.Due(c); !got.Equal(last.Add(4 * time.Hour)) {
+		t.Errorf("backoff: due %v", got)
+	}
+	if s := m.StatusOf(c); s.State != "failing" || !strings.Contains(s.Message, "boom") {
+		t.Errorf("failing: %+v", s)
+	}
+	c.Failures = 30
+	if got := m.Due(c); !got.Equal(last.Add(24 * time.Hour)) {
+		t.Errorf("backoff is at most a day: due %v", got)
+	}
+	old := now.Add(-time.Hour)
+	c.NotAfter = &old
+	if s := m.StatusOf(c); s.State != "expired" {
+		t.Errorf("expired: %+v", s)
+	}
+}
+
+func TestInput(t *testing.T) {
+	e := newEnv(t, false)
+	ctx := context.Background()
+	admin := &auth.Principal{User: &model.User{Username: "admin", Admin: true}}
+	bad := []Input{
+		{Name: model.Ptr("Bad Name"), Domains: &[]string{"a.example.com"}},
+		{Name: model.Ptr("x"), Domains: &[]string{"localhost"}},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.*.example.com"}},
+		{Name: model.Ptr("x"), Domains: &[]string{}},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.example.com"}, Uses: &[]string{"mail"}},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.example.com"}, Challenge: model.Ptr("http")},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.example.com"}, KeyType: model.Ptr("rsa1024")},
+		{Name: model.Ptr("x"), Source: model.Ptr("file"), CertFile: model.Ptr("rel.pem"), KeyFile: model.Ptr("/k.pem")},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.example.com"}, CertFile: model.Ptr("/c.pem")},
+	}
+	for _, in := range bad {
+		if _, err := e.m.Create(ctx, in, admin); err == nil {
+			t.Errorf("accepted %+v", in)
+		}
+	}
+	c, err := e.m.Create(ctx, Input{Name: model.Ptr("web"), Domains: &[]string{"WWW.Example.com.", "www.example.com", "*.example.com"}, Uses: &[]string{"web", "dns", "web"}}, admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Join(c.Domains, " ") != "www.example.com *.example.com" || strings.Join(c.Uses, ",") != "dns,web" || c.Challenge != "auto" || c.KeyType != "ec256" {
+		t.Errorf("normalized: %+v", c)
+	}
+	// Only one certificate serves jarld's HTTPS.
+	if _, err := e.m.Create(ctx, Input{Name: model.Ptr("web2"), Domains: &[]string{"a.example.com"}, Uses: &[]string{"web"}}, admin); err == nil || !strings.Contains(err.Error(), "already used for jarld's HTTPS") {
+		t.Errorf("second web certificate: %v", err)
+	}
+	if _, err := e.m.Create(ctx, Input{Name: model.Ptr("web"), Domains: &[]string{"a.example.com"}}, admin); err != ErrConflict {
+		t.Errorf("duplicate name: %v", err)
+	}
+	if _, err := e.m.Update(ctx, "web", Input{Name: model.Ptr("renamed")}, admin); err == nil {
+		t.Error("rename accepted")
+	}
+}
+
+func TestFileSource(t *testing.T) {
+	e := newEnv(t, false)
+	ctx := context.Background()
+	admin := &auth.Principal{User: &model.User{Username: "admin", Admin: true}}
+	now := time.Now()
+	certFile, keyFile := filepath.Join(e.dir, "fullchain.pem"), filepath.Join(e.dir, "privkey.pem")
+	cert, key := makeCert(t, []string{"ns1.example.com"}, now.Add(-time.Hour), now.Add(60*24*time.Hour), true)
+	os.WriteFile(certFile, cert, 0o600)
+	os.WriteFile(keyFile, key, 0o600)
+
+	c, err := e.m.Create(ctx, Input{Name: model.Ptr("own"), Source: model.Ptr("file"), CertFile: &certFile, KeyFile: &keyFile, Uses: &[]string{"web", "dns"}}, admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, _ = e.m.Get(ctx, "own")
+	if strings.Join(c.Domains, " ") != "ns1.example.com" || c.NotAfter == nil || c.CertPEM != "" {
+		t.Errorf("read: %+v", c)
+	}
+	if e.m.WebCertificate() == nil || e.m.WebName() != "own" {
+		t.Error("not served for HTTPS")
+	}
+	chain := filepath.Join(e.m.FilesDir("own"), ChainFile)
+	if b, err := os.ReadFile(chain); err != nil || string(b) != string(cert) {
+		t.Fatalf("files for named: %v", err)
+	}
+	if fi, err := os.Stat(filepath.Join(e.m.FilesDir("own"), KeyFile)); err != nil || fi.Mode().Perm() != 0o640 {
+		t.Errorf("key file: %v %v", fi, err)
+	}
+
+	// Renewed by its owner: the loop notices and puts the new one in place.
+	cert2, key2 := makeCert(t, []string{"ns1.example.com", "dns.example.com"}, now, now.Add(90*24*time.Hour), true)
+	os.WriteFile(certFile, cert2, 0o600)
+	os.WriteFile(keyFile, key2, 0o600)
+	future := now.Add(time.Minute)
+	os.Chtimes(certFile, future, future)
+	e.m.Tick(ctx)
+	c, _ = e.m.Get(ctx, "own")
+	if strings.Join(c.Domains, " ") != "ns1.example.com dns.example.com" {
+		t.Errorf("not reread: %v", c.Domains)
+	}
+	if b, _ := os.ReadFile(chain); string(b) != string(cert2) {
+		t.Error("files for named not updated")
+	}
+	if got := e.m.WebCertificate(); got == nil || len(got.Leaf.DNSNames) != 2 {
+		t.Error("HTTPS still serves the old certificate")
+	}
+
+	// A broken renewal keeps the last good certificate in place.
+	os.WriteFile(keyFile, key, 0o600)
+	os.Chtimes(keyFile, future.Add(time.Minute), future.Add(time.Minute))
+	e.m.Tick(ctx)
+	c, _ = e.m.Get(ctx, "own")
+	if !strings.Contains(c.LastError, "doesn't belong") || e.m.StatusOf(c).State != "failing" {
+		t.Errorf("mismatch not reported: %+v", c)
+	}
+	if b, _ := os.ReadFile(chain); string(b) != string(cert2) {
+		t.Error("files for named replaced by a broken pair")
+	}
+
+	// Without the dns use the files go; deleting stops HTTPS.
+	if _, err := e.m.Update(ctx, "own", Input{Uses: &[]string{"web"}}, admin); err != nil {
+		// The pair is broken now; put the good key back first.
+		t.Log(err)
+	}
+	os.WriteFile(keyFile, key2, 0o600)
+	if _, err := e.m.Update(ctx, "own", Input{Uses: &[]string{"web"}}, admin); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(e.m.FilesDir("own")); !os.IsNotExist(err) {
+		t.Errorf("files for named left behind: %v", err)
+	}
+	if err := e.m.Delete(ctx, "own", admin); err != nil {
+		t.Fatal(err)
+	}
+	if e.m.WebCertificate() != nil {
+		t.Error("still serving a deleted certificate")
+	}
+}
+
+func TestCleanLegoError(t *testing.T) {
+	in := errors.New("error: one or more domains had a problem:\n[www.example.org] [www.example.org] acme: error presenting token: example.org is served by x, which Jarl can't write to\n[a.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Incorrect TXT record \"abc\" found at _acme-challenge.a.example.com\n")
+	want := `www.example.org: example.org is served by x, which Jarl can't write to; a.example.com: the CA refused (unauthorized): Incorrect TXT record "abc" found at _acme-challenge.a.example.com`
+	if got := cleanLegoError(in).Error(); got != want {
+		t.Errorf("got  %s\nwant %s", got, want)
+	}
+	if got := cleanLegoError(errors.New("acme: error: 429 :: urn:ietf:params:acme:error:rateLimited :: too many")).Error(); got != "the CA refused (rateLimited): too many" {
+		t.Errorf("rate limit: %s", got)
+	}
+}
@@ -0,0 +1,118 @@
+// Package certs manages TLS certificates (docs/certificates.md): ones Jarl
+// obtains and renews itself over ACME, answering the DNS-01 challenges in
+// its own zones or at Porkbun, and ones you renew yourself that Jarl only
+// reads. A certificate is used for jarld's HTTPS ("web") and/or written
+// where named can read it ("dns", for DNS over TLS and HTTPS).
+package certs
+
+import (
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+// Info is what a certificate says about itself.
+type Info struct {
+	Names     []string
+	NotBefore time.Time
+	NotAfter  time.Time
+	Issuer    string
+	Serial    string
+	KeyType   string // ec256, ec384, rsa2048, ...
+	Leaf      *x509.Certificate
+	// Warnings are problems that don't stop it working everywhere (a
+	// missing intermediate certificate).
+	Warnings []string
+}
+
+// Inspect checks that certPEM (the certificate, then its intermediates)
+// and keyPEM belong together and returns what the certificate says, and
+// the pair ready to serve.
+func Inspect(certPEM, keyPEM []byte) (*Info, *tls.Certificate, error) {
+	pair, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		msg := err.Error()
+		switch {
+		case strings.Contains(msg, "private key does not match public key"):
+			return nil, nil, errors.New("the key doesn't belong to the certificate")
+		case strings.Contains(msg, "failed to find any PEM data in certificate"):
+			return nil, nil, errors.New("no certificate found (expected PEM: -----BEGIN CERTIFICATE-----)")
+		case strings.Contains(msg, "failed to find any PEM data in key"), strings.Contains(msg, "failed to find PEM block with type ending in \"PRIVATE KEY\""):
+			return nil, nil, errors.New("no private key found (expected PEM: -----BEGIN ... PRIVATE KEY-----)")
+		}
+		return nil, nil, err
+	}
+	leaf := pair.Leaf
+	if leaf == nil {
+		if leaf, err = x509.ParseCertificate(pair.Certificate[0]); err != nil {
+			return nil, nil, err
+		}
+		pair.Leaf = leaf
+	}
+	in := &Info{NotBefore: leaf.NotBefore, NotAfter: leaf.NotAfter, Serial: fmt.Sprintf("%x", leaf.SerialNumber), Leaf: leaf, KeyType: keyType(leaf)}
+	in.Names = append(in.Names, leaf.DNSNames...)
+	for _, ip := range leaf.IPAddresses {
+		in.Names = append(in.Names, ip.String())
+	}
+	if len(in.Names) == 0 && leaf.Subject.CommonName != "" {
+		in.Names = []string{leaf.Subject.CommonName}
+	}
+	in.Issuer = leaf.Issuer.CommonName
+	if len(leaf.Issuer.Organization) > 0 {
+		if in.Issuer == "" {
+			in.Issuer = leaf.Issuer.Organization[0]
+		} else {
+			in.Issuer = leaf.Issuer.Organization[0] + " " + in.Issuer
+		}
+	}
+	selfSigned := leaf.Issuer.String() == leaf.Subject.String()
+	if len(pair.Certificate) == 1 && !selfSigned {
+		in.Warnings = append(in.Warnings, "the file holds only the certificate, without its intermediate certificate: many clients will reject it; use the full chain (fullchain.pem)")
+	}
+	return in, &pair, nil
+}
+
+func keyType(c *x509.Certificate) string {
+	switch k := c.PublicKey.(type) {
+	case *ecdsa.PublicKey:
+		return fmt.Sprintf("ec%d", k.Curve.Params().BitSize)
+	case *rsa.PublicKey:
+		return fmt.Sprintf("rsa%d", k.N.BitLen())
+	case ed25519.PublicKey:
+		return "ed25519"
+	}
+	return "unknown"
+}
+
+// Covers reports whether the certificate names cover every name in want
+// (a wildcard covers one label).
+func Covers(names, want []string) bool {
+	for _, w := range want {
+		if !covered(names, w) {
+			return false
+		}
+	}
+	return true
+}
+
+func covered(names []string, want string) bool {
+	want = strings.ToLower(strings.TrimSuffix(want, "."))
+	for _, n := range names {
+		n = strings.ToLower(n)
+		if n == want {
+			return true
+		}
+		if base, ok := strings.CutPrefix(n, "*."); ok && !strings.HasPrefix(want, "*.") {
+			if _, rest, ok := strings.Cut(want, "."); ok && rest == base {
+				return true
+			}
+		}
+	}
+	return false
+}
@@ -0,0 +1,128 @@
+package certs
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+// resolver asks recursive resolvers (acme.resolvers: public ones by
+// default), to see a domain as the CA does rather than as this server's
+// own views answer it.
+type resolver struct {
+	servers []string
+	timeout time.Duration
+}
+
+func (r resolver) query(ctx context.Context, name string, qtype uint16) (*dns.Msg, error) {
+	if len(r.servers) == 0 {
+		return nil, errors.New("no resolvers configured (acme.resolvers)")
+	}
+	m := new(dns.Msg)
+	m.SetQuestion(dns.Fqdn(name), qtype)
+	m.SetEdns0(1232, false)
+	m.RecursionDesired = true
+	timeout := r.timeout
+	if timeout == 0 {
+		timeout = 5 * time.Second
+	}
+	var errs []error
+	for _, s := range r.servers {
+		c := &dns.Client{Timeout: timeout}
+		in, _, err := c.ExchangeContext(ctx, m, s)
+		if err == nil && in.Truncated {
+			c.Net = "tcp"
+			in, _, err = c.ExchangeContext(ctx, m, s)
+		}
+		if err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", s, err))
+			continue
+		}
+		if in.Rcode == dns.RcodeServerFailure || in.Rcode == dns.RcodeRefused {
+			errs = append(errs, fmt.Errorf("%s answered %s", s, dns.RcodeToString[in.Rcode]))
+			continue
+		}
+		return in, nil
+	}
+	return nil, fmt.Errorf("looking up %s %s: %w", strings.TrimSuffix(name, "."), dns.TypeToString[qtype], errors.Join(errs...))
+}
+
+// zoneOf returns the zone that name is in on the internet (the owner of
+// the SOA record that answers for it).
+func (r resolver) zoneOf(ctx context.Context, name string) (string, error) {
+	name = dns.Fqdn(strings.ToLower(name))
+	for cand := name; ; {
+		in, err := r.query(ctx, cand, dns.TypeSOA)
+		if err != nil {
+			return "", err
+		}
+		for _, sec := range [][]dns.RR{in.Answer, in.Ns} {
+			for _, rr := range sec {
+				if soa, ok := rr.(*dns.SOA); ok && dns.IsSubDomain(soa.Hdr.Name, name) {
+					return strings.ToLower(soa.Hdr.Name), nil
+				}
+			}
+		}
+		i, end := dns.NextLabel(cand, 0)
+		if end {
+			return "", fmt.Errorf("no zone found for %s", strings.TrimSuffix(name, "."))
+		}
+		cand = cand[i:]
+	}
+}
+
+// nameServers returns the zone's name servers on the internet (lowercase,
+// without trailing dots, sorted).
+func (r resolver) nameServers(ctx context.Context, zone string) ([]string, error) {
+	in, err := r.query(ctx, zone, dns.TypeNS)
+	if err != nil {
+		return nil, err
+	}
+	var out []string
+	for _, rr := range in.Answer {
+		if ns, ok := rr.(*dns.NS); ok && strings.EqualFold(ns.Hdr.Name, dns.Fqdn(zone)) {
+			out = append(out, normName(ns.Ns))
+		}
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("%s has no name servers on the internet (%s)", strings.TrimSuffix(zone, "."), dns.RcodeToString[in.Rcode])
+	}
+	slices.Sort(out)
+	return slices.Compact(out), nil
+}
+
+// follow returns where name leads after its CNAME records (name itself
+// when it has none).
+func (r resolver) follow(ctx context.Context, name string) (string, error) {
+	name = dns.Fqdn(strings.ToLower(name))
+	for range 10 {
+		in, err := r.query(ctx, name, dns.TypeCNAME)
+		if err != nil {
+			return "", err
+		}
+		next := ""
+		for _, rr := range in.Answer {
+			if c, ok := rr.(*dns.CNAME); ok && strings.EqualFold(c.Hdr.Name, name) {
+				next = strings.ToLower(c.Target)
+			}
+		}
+		if next == "" {
+			return name, nil
+		}
+		name = next
+	}
+	return "", fmt.Errorf("%s: more than 10 CNAME records in a row", name)
+}
+
+func normName(n string) string { return strings.ToLower(strings.TrimSuffix(n, ".")) }
+
+// challengeName is the DNS-01 record name for a certificate name (a
+// wildcard shares its base name's).
+func challengeName(domain string) string {
+	return "_acme-challenge." + dns.Fqdn(strings.TrimPrefix(strings.ToLower(domain), "*."))
+}
@@ -0,0 +1,929 @@
+package certs
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io/fs"
+	"log"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	legolog "github.com/go-acme/lego/v4/log"
+
+	"jarl/internal/auth"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+	"jarl/internal/porkbun"
+	"jarl/internal/store"
+)
+
+// Config configures the manager (acme and certificates in jarl.yaml).
+type Config struct {
+	Directory string // ACME directory URL
+	Email     string
+	AgreeTOS  bool
+	EABKeyID  string
+	EABHMAC   string
+	Resolvers []string
+	CABundle  string
+	// Dir is where certificates with the dns use are written for named.
+	Dir     string
+	Version string
+	// Porkbun publishes challenges for domains Porkbun serves (nil
+	// without an API key); PorkbunAllows limits it to porkbun.domains.
+	Porkbun       *porkbun.Client
+	PorkbunAllows func(domain string) bool
+	// CheckPropagation makes lego wait until every name server of the
+	// zone serves the challenge before telling the CA (acme.check_propagation).
+	CheckPropagation bool
+	// PropagationTimeout is how long to wait for that (default 10 minutes).
+	PropagationTimeout time.Duration
+	// SkipPropagationCheck is !CheckPropagation (set by New).
+	SkipPropagationCheck bool
+}
+
+// Manager keeps certificates current and serves jarld's own.
+type Manager struct {
+	cfg   Config
+	store *store.Store
+	eng   *engine.Engine
+	log   *slog.Logger
+	res   resolver
+
+	// legoMu: lego keeps its DNS settings in package variables, so one
+	// client works at a time. issueMu: one issue at a time.
+	legoMu  sync.Mutex
+	issueMu sync.Mutex
+
+	web   atomic.Pointer[webCert]
+	mu    sync.Mutex
+	files map[int64]fileStamp // file-source certificates: what was read last
+	kick  chan struct{}
+	now   func() time.Time
+	// issuing holds the names being obtained now, with when it started.
+	issuing sync.Map
+	// base is the context background issues run in (jarld's lifetime).
+	base context.Context
+}
+
+type webCert struct {
+	name string
+	pair *tls.Certificate
+}
+
+type fileStamp struct {
+	certMod, keyMod time.Time
+	certSize        int64
+}
+
+// New returns a manager. Call Start before serving, then Run.
+func New(cfg Config, st *store.Store, eng *engine.Engine, logger *slog.Logger) *Manager {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	cfg.SkipPropagationCheck = !cfg.CheckPropagation
+	m := &Manager{cfg: cfg, store: st, eng: eng, log: logger, res: resolver{servers: cfg.Resolvers},
+		files: map[int64]fileStamp{}, kick: make(chan struct{}, 1), now: time.Now, base: context.Background()}
+	// lego logs every step; keep it at debug level.
+	legolog.Logger = log.New(slogWriter{logger}, "", 0)
+	return m
+}
+
+type slogWriter struct{ l *slog.Logger }
+
+func (w slogWriter) Write(p []byte) (int, error) {
+	w.l.Debug("lego: " + strings.TrimSpace(string(p)))
+	return len(p), nil
+}
+
+// Errors for the API.
+var (
+	ErrNotFound = errors.New("no such certificate")
+	ErrConflict = errors.New("a certificate with that name exists")
+)
+
+// InputError is a request Jarl refuses.
+type InputError struct{ Msg string }
+
+func (e *InputError) Error() string { return e.Msg }
+
+func inputErr(format string, a ...any) error { return &InputError{Msg: fmt.Sprintf(format, a...)} }
+
+// Input creates or changes a certificate; nil fields are left alone.
+type Input struct {
+	Name      *string   `json:"name"`
+	Source    *string   `json:"source"`
+	Domains   *[]string `json:"domains"`
+	CertFile  *string   `json:"cert_file"`
+	KeyFile   *string   `json:"key_file"`
+	Uses      *[]string `json:"uses"`
+	Challenge *string   `json:"challenge"`
+	KeyType   *string   `json:"key_type"`
+	Comment   *string   `json:"comment"`
+}
+
+var nameRe = regexp.MustCompile(`^[a-z0-9][a-z0-9_-]{0,62}$`)
+var labelRe = regexp.MustCompile(`^[a-z0-9_]([a-z0-9_-]{0,61}[a-z0-9_])?$`)
+
+func normDomains(in []string) ([]string, error) {
+	var out []string
+	for _, d := range in {
+		d = strings.ToLower(strings.TrimSuffix(strings.TrimSpace(d), "."))
+		if d == "" {
+			continue
+		}
+		labels := strings.Split(d, ".")
+		if len(labels) < 2 {
+			return nil, inputErr("%q isn't a domain name a CA will sign (it needs at least two labels)", d)
+		}
+		for i, l := range labels {
+			if l == "*" && i == 0 {
+				continue
+			}
+			if !labelRe.MatchString(l) {
+				return nil, inputErr("%q isn't a valid domain name (a wildcard is only allowed as the first label: *.example.com)", d)
+			}
+		}
+		if len(d) > 253 {
+			return nil, inputErr("%q is too long", d)
+		}
+		if !slices.Contains(out, d) {
+			out = append(out, d)
+		}
+	}
+	if len(out) == 0 {
+		return nil, inputErr("give at least one domain name")
+	}
+	if len(out) > 100 {
+		return nil, inputErr("at most 100 names per certificate")
+	}
+	return out, nil
+}
+
+func (m *Manager) apply(c *model.Certificate, in Input, creating bool) error {
+	if in.Name != nil {
+		if !creating && *in.Name != c.Name {
+			return inputErr("a certificate can't be renamed (its files for named are named after it): create a new one and delete this one")
+		}
+		c.Name = *in.Name
+	}
+	if !nameRe.MatchString(c.Name) {
+		return inputErr("name %q: use lowercase letters, digits, - and _ (at most 63)", c.Name)
+	}
+	if in.Source != nil {
+		if !creating && *in.Source != c.Source {
+			return inputErr("a certificate's source can't change: create a new one")
+		}
+		c.Source = *in.Source
+	}
+	if c.Source == "" {
+		c.Source = model.CertSourceACME
+	}
+	if in.Uses != nil {
+		c.Uses = nil
+		for _, u := range *in.Uses {
+			u = strings.ToLower(strings.TrimSpace(u))
+			if u != model.CertUseWeb && u != model.CertUseDNS {
+				return inputErr("unknown use %q: web (jarld's HTTPS) or dns (for named: DNS over TLS and HTTPS)", u)
+			}
+			if !slices.Contains(c.Uses, u) {
+				c.Uses = append(c.Uses, u)
+			}
+		}
+		slices.Sort(c.Uses)
+	}
+	if c.Uses == nil {
+		c.Uses = []string{}
+	}
+	if in.Comment != nil {
+		c.Comment = *in.Comment
+	}
+	switch c.Source {
+	case model.CertSourceACME:
+		if in.CertFile != nil && *in.CertFile != "" || in.KeyFile != nil && *in.KeyFile != "" {
+			return inputErr("cert_file and key_file are for --source file; Jarl keeps the files of certificates it obtains itself")
+		}
+		if in.Domains != nil {
+			d, err := normDomains(*in.Domains)
+			if err != nil {
+				return err
+			}
+			c.Domains = d
+		}
+		if len(c.Domains) == 0 {
+			return inputErr("give the domain names the certificate is for")
+		}
+		if in.Challenge != nil {
+			c.Challenge = *in.Challenge
+		}
+		switch c.Challenge {
+		case "":
+			c.Challenge = model.ChallengeAuto
+		case model.ChallengeAuto, model.ChallengeJarl, model.ChallengePorkbun:
+		default:
+			return inputErr("challenge must be auto, jarl or porkbun")
+		}
+		if in.KeyType != nil {
+			c.KeyType = *in.KeyType
+		}
+		if c.KeyType == "" {
+			c.KeyType = "ec256"
+		}
+		if !slices.Contains(KeyTypes, c.KeyType) {
+			return inputErr("key type must be one of %s", strings.Join(KeyTypes, ", "))
+		}
+	case model.CertSourceFile:
+		if in.Challenge != nil && *in.Challenge != "" || in.KeyType != nil && *in.KeyType != "" {
+			return inputErr("challenge and key type are for certificates Jarl obtains (--source acme)")
+		}
+		if in.CertFile != nil {
+			c.CertFile = *in.CertFile
+		}
+		if in.KeyFile != nil {
+			c.KeyFile = *in.KeyFile
+		}
+		if !filepath.IsAbs(c.CertFile) || !filepath.IsAbs(c.KeyFile) {
+			return inputErr("cert_file and key_file must be absolute paths (the full chain, and its key)")
+		}
+		c.Challenge, c.KeyType = "", ""
+	default:
+		return inputErr("source must be acme (Jarl obtains and renews it) or file (you renew it)")
+	}
+	return nil
+}
+
+// checkUses refuses a second certificate for jarld's HTTPS.
+func (m *Manager) checkUses(ctx context.Context, c *model.Certificate) error {
+	if !c.HasUse(model.CertUseWeb) {
+		return nil
+	}
+	all, err := m.store.Certificates(ctx)
+	if err != nil {
+		return err
+	}
+	for _, o := range all {
+		if o.ID != c.ID && o.HasUse(model.CertUseWeb) {
+			return inputErr("certificate %s is already used for jarld's HTTPS; take the web use off it first (jarl cert update %s --use ...)", o.Name, o.Name)
+		}
+	}
+	return nil
+}
+
+// List returns every certificate.
+func (m *Manager) List(ctx context.Context) ([]*model.Certificate, error) {
+	return m.store.Certificates(ctx)
+}
+
+// Get returns one certificate.
+func (m *Manager) Get(ctx context.Context, name string) (*model.Certificate, error) {
+	c, err := m.store.CertificateByName(ctx, name)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil, ErrNotFound
+	}
+	return c, err
+}
+
+// Create adds a certificate. A file-source certificate is read at once;
+// one Jarl obtains is left for Issue (or the background loop).
+func (m *Manager) Create(ctx context.Context, in Input, p *auth.Principal) (*model.Certificate, error) {
+	c := &model.Certificate{CreatedBy: p.Name(), UpdatedBy: p.Name()}
+	if err := m.apply(c, in, true); err != nil {
+		return nil, err
+	}
+	if err := m.checkUses(ctx, c); err != nil {
+		return nil, err
+	}
+	if c.Source == model.CertSourceFile {
+		if _, err := m.readFiles(c); err != nil {
+			return nil, inputErr("%v", err)
+		}
+	}
+	if err := m.store.CreateCertificate(ctx, c); err != nil {
+		if errors.Is(err, store.ErrConflict) {
+			return nil, ErrConflict
+		}
+		return nil, err
+	}
+	m.eng.Audit(ctx, p, "certificate.create", "certificate", c.ID, c.Name, "ok", describe(c))
+	if c.Source == model.CertSourceFile {
+		m.refreshFile(ctx, c, true)
+	}
+	return c, nil
+}
+
+// Update changes a certificate. New names or a new key type make one Jarl
+// obtains due at once.
+func (m *Manager) Update(ctx context.Context, name string, in Input, p *auth.Principal) (*model.Certificate, error) {
+	c, err := m.Get(ctx, name)
+	if err != nil {
+		return nil, err
+	}
+	before := *c
+	if err := m.apply(c, in, false); err != nil {
+		return nil, err
+	}
+	if err := m.checkUses(ctx, c); err != nil {
+		return nil, err
+	}
+	if before.HasUse(model.CertUseDNS) && !c.HasUse(model.CertUseDNS) && m.namedUses(ctx, m.FilesDir(c.Name)) {
+		return nil, inputErr("named's configuration uses certificate %s (a tls statement names its files), so it keeps the dns use: take it out of named first (jarl encrypted-dns disable)", c.Name)
+	}
+	if c.Source == model.CertSourceFile && (c.CertFile != before.CertFile || c.KeyFile != before.KeyFile) {
+		if _, err := m.readFiles(c); err != nil {
+			return nil, inputErr("%v", err)
+		}
+	}
+	if c.Source == model.CertSourceACME && c.CertPEM != "" && (!slices.Equal(c.Domains, before.Domains) || c.KeyType != before.KeyType) {
+		now := m.now().UTC()
+		c.RenewAt, c.Failures = &now, 0
+	}
+	c.UpdatedBy = p.Name()
+	if err := m.store.UpdateCertificate(ctx, c); err != nil {
+		return nil, err
+	}
+	m.eng.Audit(ctx, p, "certificate.update", "certificate", c.ID, c.Name, "ok", describe(c))
+	if c.Source == model.CertSourceFile {
+		m.mu.Lock()
+		delete(m.files, c.ID)
+		m.mu.Unlock()
+		m.refreshFile(ctx, c, true)
+	} else if c.CertPEM != "" {
+		if err := m.deploy(ctx, c, []byte(c.CertPEM), []byte(c.KeyPEM)); err != nil {
+			m.log.Warn("writing certificate files failed", "certificate", c.Name, "err", err)
+		}
+	}
+	if before.HasUse(model.CertUseWeb) && !c.HasUse(model.CertUseWeb) {
+		m.dropWeb(c.Name)
+	}
+	m.Kick()
+	return c, nil
+}
+
+// Delete removes a certificate and its files for named.
+func (m *Manager) Delete(ctx context.Context, name string, p *auth.Principal) error {
+	c, err := m.Get(ctx, name)
+	if err != nil {
+		return err
+	}
+	if c.HasUse(model.CertUseDNS) && m.namedUses(ctx, m.FilesDir(c.Name)) {
+		return inputErr("named's configuration uses certificate %s (a tls statement names its files): take it out first (jarl encrypted-dns disable, or remove the tls statement)", c.Name)
+	}
+	if err := m.store.DeleteCertificate(ctx, c.ID); err != nil {
+		return err
+	}
+	m.dropWeb(c.Name)
+	if err := m.removeFiles(c.Name); err != nil {
+		m.log.Warn("removing certificate files failed", "certificate", c.Name, "err", err)
+	}
+	m.mu.Lock()
+	delete(m.files, c.ID)
+	m.mu.Unlock()
+	m.eng.Audit(ctx, p, "certificate.delete", "certificate", c.ID, c.Name, "ok", "")
+	return nil
+}
+
+func describe(c *model.Certificate) string {
+	s := c.Source
+	if c.Source == model.CertSourceACME {
+		s += " " + strings.Join(c.Domains, " ") + ", challenge " + c.Challenge
+	} else {
+		s += " " + c.CertFile
+	}
+	if len(c.Uses) > 0 {
+		s += ", uses " + strings.Join(c.Uses, ",")
+	}
+	return s
+}
+
+// Preview checks a new certificate's fields without saving it.
+func (m *Manager) Preview(in Input) (*model.Certificate, error) {
+	c := &model.Certificate{}
+	if err := m.apply(c, in, true); err != nil {
+		return nil, err
+	}
+	return c, nil
+}
+
+// Check works out where each name's challenge would go, without asking
+// the CA for anything.
+func (m *Manager) Check(ctx context.Context, c *model.Certificate) ([]Route, error) {
+	if c.Source != model.CertSourceACME {
+		return nil, inputErr("certificate %s is renewed by you (source file); there is nothing to check", c.Name)
+	}
+	st, err := m.store.LoadState(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out []Route
+	for _, d := range c.Domains {
+		out = append(out, m.route(ctx, st, c.Challenge, d, ""))
+	}
+	return out, nil
+}
+
+// IssueResult is the outcome of an issue.
+type IssueResult struct {
+	Certificate *model.Certificate `json:"certificate"`
+	Routes      []Route            `json:"routes"`
+}
+
+// Issuing reports since when the certificate is being obtained (zero when
+// it isn't).
+func (m *Manager) Issuing(name string) time.Time {
+	if v, ok := m.issuing.Load(name); ok {
+		return v.(time.Time)
+	}
+	return time.Time{}
+}
+
+// IssueAsync starts obtaining a certificate in the background and returns
+// at once: talking to the CA and waiting for every name server to serve
+// the challenge can take minutes. Issuing tells when it is done; the
+// outcome is in the certificate (last_success, last_error).
+func (m *Manager) IssueAsync(ctx context.Context, name string, p *auth.Principal) (*model.Certificate, error) {
+	c, err := m.Get(ctx, name)
+	if err != nil {
+		return nil, err
+	}
+	if c.Source == model.CertSourceFile {
+		res, err := m.Issue(ctx, name, p)
+		if res != nil {
+			return res.Certificate, err
+		}
+		return nil, err
+	}
+	if _, busy := m.issuing.LoadOrStore(name, m.now()); busy {
+		return c, nil
+	}
+	go func() {
+		defer m.issuing.Delete(name)
+		m.issue(m.base, c, p)
+	}()
+	return c, nil
+}
+
+// Issue obtains a new certificate for c now (a file-source certificate is
+// reread instead).
+func (m *Manager) Issue(ctx context.Context, name string, p *auth.Principal) (*IssueResult, error) {
+	c, err := m.Get(ctx, name)
+	if err != nil {
+		return nil, err
+	}
+	if c.Source == model.CertSourceFile {
+		m.mu.Lock()
+		delete(m.files, c.ID)
+		m.mu.Unlock()
+		if err := m.refreshFile(ctx, c, true); err != nil {
+			return &IssueResult{Certificate: c}, err
+		}
+		return &IssueResult{Certificate: c}, nil
+	}
+	return m.issue(ctx, c, p)
+}
+
+func (m *Manager) issue(ctx context.Context, c *model.Certificate, p *auth.Principal) (*IssueResult, error) {
+	m.issueMu.Lock()
+	defer m.issueMu.Unlock()
+	// Reload: another issue may have finished while this one waited.
+	if fresh, err := m.Get(ctx, c.Name); err == nil {
+		c = fresh
+	}
+	var old *x509.Certificate
+	if c.CertPEM != "" {
+		if in, _, err := Inspect([]byte(c.CertPEM), []byte(c.KeyPEM)); err == nil {
+			old = in.Leaf
+		}
+	}
+	m.log.Info("obtaining certificate", "certificate", c.Name, "domains", strings.Join(c.Domains, " "), "by", p.Name())
+	now := m.now().UTC()
+	c.LastAttempt = &now
+	res, routes, err := m.obtain(ctx, c, old)
+	c.LastRoutes = nil
+	for _, r := range routes {
+		if r.Error == "" {
+			c.LastRoutes = append(c.LastRoutes, r.String())
+		}
+	}
+	var info *Info
+	if err == nil {
+		info, _, err = Inspect(res.Certificate, res.PrivateKey)
+		if err != nil {
+			err = fmt.Errorf("the CA's certificate is unusable: %w", err)
+		}
+	}
+	if err != nil {
+		c.Failures++
+		c.LastError = err.Error()
+		if serr := m.store.UpdateCertificate(ctx, c); serr != nil {
+			m.log.Error("saving certificate state failed", "certificate", c.Name, "err", serr)
+		}
+		m.log.Warn("obtaining certificate failed", "certificate", c.Name, "failures", c.Failures, "err", err)
+		m.eng.Audit(ctx, p, "certificate.issue", "certificate", c.ID, c.Name, "error", err.Error())
+		return &IssueResult{Certificate: c, Routes: routes}, err
+	}
+	c.CertPEM, c.KeyPEM = string(res.Certificate), string(res.PrivateKey)
+	setInfo(c, info)
+	done := m.now().UTC()
+	c.LastSuccess, c.Failures, c.LastError = &done, 0, ""
+	at := twoThirds(info.NotBefore, info.NotAfter)
+	c.RenewAt, c.ARICheckedAt = &at, nil
+	if t, err := m.renewalInfo(ctx, c, info.Leaf); err == nil && t != nil {
+		c.RenewAt, c.ARICheckedAt = t, &done
+	}
+	if err := m.store.UpdateCertificate(ctx, c); err != nil {
+		return nil, err
+	}
+	m.log.Info("certificate obtained", "certificate", c.Name, "expires", info.NotAfter.Format(time.DateOnly), "renew_at", c.RenewAt.Format(time.RFC3339), "routes", strings.Join(c.LastRoutes, "; "))
+	m.eng.Audit(ctx, p, "certificate.issue", "certificate", c.ID, c.Name, "ok", fmt.Sprintf("%s, valid until %s, from %s", strings.Join(info.Names, " "), info.NotAfter.Format(time.DateOnly), info.Issuer))
+	if err := m.deploy(ctx, c, res.Certificate, res.PrivateKey); err != nil {
+		m.log.Error("writing certificate files failed", "certificate", c.Name, "err", err)
+		return &IssueResult{Certificate: c, Routes: routes}, fmt.Errorf("the certificate was obtained, but writing it for named failed: %w", err)
+	}
+	return &IssueResult{Certificate: c, Routes: routes}, nil
+}
+
+func setInfo(c *model.Certificate, in *Info) {
+	nb, na := in.NotBefore.UTC(), in.NotAfter.UTC()
+	c.Names, c.NotBefore, c.NotAfter, c.Issuer, c.Serial = in.Names, &nb, &na, in.Issuer, in.Serial
+}
+
+// readFiles reads a file-source certificate and checks it.
+func (m *Manager) readFiles(c *model.Certificate) (*Info, error) {
+	cert, err := os.ReadFile(c.CertFile)
+	if err != nil {
+		return nil, fileErr(err)
+	}
+	key, err := os.ReadFile(c.KeyFile)
+	if err != nil {
+		return nil, fileErr(err)
+	}
+	in, _, err := Inspect(cert, key)
+	if err != nil {
+		return nil, fmt.Errorf("%s and %s: %w", c.CertFile, c.KeyFile, err)
+	}
+	return in, nil
+}
+
+func fileErr(err error) error {
+	if errors.Is(err, fs.ErrPermission) {
+		return fmt.Errorf("%w: jarld runs as its own user (jarl) and must be able to read the certificate and its key; e.g. give the files group jarl (chgrp jarl FILE; chmod 640 FILE), or copy them somewhere it can read in your renewal hook", err)
+	}
+	return err
+}
+
+// refreshFile rereads a file-source certificate when its files changed
+// (always with force) and deploys it.
+func (m *Manager) refreshFile(ctx context.Context, c *model.Certificate, force bool) error {
+	cs, err1 := os.Stat(c.CertFile)
+	ks, err2 := os.Stat(c.KeyFile)
+	var stamp fileStamp
+	if err1 == nil && err2 == nil {
+		stamp = fileStamp{certMod: cs.ModTime(), keyMod: ks.ModTime(), certSize: cs.Size()}
+		m.mu.Lock()
+		prev, ok := m.files[c.ID]
+		m.mu.Unlock()
+		if ok && prev == stamp && !force {
+			return nil
+		}
+	}
+	in, err := m.readFiles(c)
+	now := m.now().UTC()
+	c.LastAttempt = &now
+	if err != nil {
+		if c.LastError != err.Error() {
+			m.log.Warn("reading certificate failed", "certificate", c.Name, "err", err)
+		}
+		c.LastError = err.Error()
+		c.Failures = max(c.Failures, 1)
+		m.store.UpdateCertificate(ctx, c)
+		return err
+	}
+	if c.Serial != in.Serial {
+		m.log.Info("certificate read", "certificate", c.Name, "file", c.CertFile, "expires", in.NotAfter.Format(time.DateOnly))
+	}
+	setInfo(c, in)
+	c.Domains = in.Names
+	c.LastSuccess, c.LastError, c.Failures = &now, "", 0
+	if len(in.Warnings) > 0 {
+		c.LastError = in.Warnings[0]
+	}
+	if err := m.store.UpdateCertificate(ctx, c); err != nil {
+		return err
+	}
+	cert, _ := os.ReadFile(c.CertFile)
+	key, _ := os.ReadFile(c.KeyFile)
+	if err := m.deploy(ctx, c, cert, key); err != nil {
+		return err
+	}
+	m.mu.Lock()
+	m.files[c.ID] = stamp
+	m.mu.Unlock()
+	return nil
+}
+
+// FilesDir is where a certificate with the dns use is written for named.
+func (m *Manager) FilesDir(name string) string { return filepath.Join(m.cfg.Dir, name) }
+
+// Files names a certificate's files for named.
+const (
+	ChainFile = "fullchain.pem"
+	KeyFile   = "privkey.pem"
+)
+
+// deploy puts a certificate where it is used: jarld's HTTPS and/or the
+// files named reads. When those files change and named's configuration
+// names them, named rereads it.
+func (m *Manager) deploy(ctx context.Context, c *model.Certificate, cert, key []byte) error {
+	_, pair, err := Inspect(cert, key)
+	if err != nil {
+		return err
+	}
+	if c.HasUse(model.CertUseWeb) {
+		m.web.Store(&webCert{name: c.Name, pair: pair})
+	} else {
+		m.dropWeb(c.Name)
+	}
+	if !c.HasUse(model.CertUseDNS) {
+		return m.removeFiles(c.Name)
+	}
+	dir := m.FilesDir(c.Name)
+	changed := false
+	for _, f := range []struct {
+		name    string
+		content []byte
+		mode    fs.FileMode
+	}{{ChainFile, cert, 0o644}, {KeyFile, key, 0o640}} {
+		path := filepath.Join(dir, f.name)
+		if old, err := os.ReadFile(path); err == nil && bytes.Equal(old, f.content) {
+			continue
+		}
+		if err := m.eng.WriteFile(path, f.content, f.mode); err != nil {
+			return err
+		}
+		changed = true
+	}
+	if changed && m.namedUses(ctx, dir) {
+		if err := m.eng.Reconfig(ctx); err != nil {
+			return fmt.Errorf("named didn't reread its configuration for the new certificate: %w", err)
+		}
+		m.log.Info("named rereads the new certificate", "certificate", c.Name)
+	}
+	return nil
+}
+
+// namedUses reports whether named's configuration names files in dir.
+func (m *Manager) namedUses(ctx context.Context, dir string) bool {
+	st, err := m.store.LoadState(ctx)
+	if err != nil {
+		return false
+	}
+	for _, o := range st.Options {
+		if strings.Contains(o.Value, dir+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+func (m *Manager) removeFiles(name string) error {
+	if name == "" || strings.ContainsAny(name, "/.") {
+		return nil
+	}
+	dir := m.FilesDir(name)
+	if _, err := os.Stat(dir); err != nil {
+		return nil
+	}
+	return os.RemoveAll(dir)
+}
+
+func (m *Manager) dropWeb(name string) {
+	if w := m.web.Load(); w != nil && w.name == name {
+		m.web.CompareAndSwap(w, nil)
+	}
+}
+
+// WebCertificate is the certificate for jarld's HTTPS (nil when no
+// certificate has the web use, or it has none yet).
+func (m *Manager) WebCertificate() *tls.Certificate {
+	if w := m.web.Load(); w != nil {
+		return w.pair
+	}
+	return nil
+}
+
+// WebName is the name of the certificate jarld serves ("" for none).
+func (m *Manager) WebName() string {
+	if w := m.web.Load(); w != nil {
+		return w.name
+	}
+	return ""
+}
+
+// HasWeb reports whether a certificate has the web use (whether or not
+// it has been obtained yet).
+func (m *Manager) HasWeb(ctx context.Context) bool {
+	all, err := m.store.Certificates(ctx)
+	if err != nil {
+		return false
+	}
+	return slices.ContainsFunc(all, func(c *model.Certificate) bool { return c.HasUse(model.CertUseWeb) })
+}
+
+// Kick makes the loop look at the certificates now.
+func (m *Manager) Kick() {
+	select {
+	case m.kick <- struct{}{}:
+	default:
+	}
+}
+
+// Start loads the certificates and puts them in place (jarld's HTTPS, the
+// files for named). Call it before serving.
+func (m *Manager) Start(ctx context.Context) {
+	all, err := m.store.Certificates(ctx)
+	if err != nil {
+		m.log.Error("loading certificates failed", "err", err)
+		return
+	}
+	for _, c := range all {
+		switch {
+		case c.Source == model.CertSourceFile:
+			m.refreshFile(ctx, c, true)
+		case c.CertPEM != "":
+			if err := m.deploy(ctx, c, []byte(c.CertPEM), []byte(c.KeyPEM)); err != nil {
+				m.log.Warn("putting certificate in place failed", "certificate", c.Name, "err", err)
+			}
+		}
+	}
+}
+
+// Run renews certificates when they are due and rereads file-source ones
+// when their files change, until ctx ends.
+func (m *Manager) Run(ctx context.Context) {
+	m.base = ctx
+	select {
+	case <-ctx.Done():
+		return
+	case <-time.After(20 * time.Second): // let jarld finish starting
+	}
+	for {
+		m.Tick(ctx)
+		t := time.NewTimer(10 * time.Minute)
+		select {
+		case <-ctx.Done():
+			t.Stop()
+			return
+		case <-t.C:
+		case <-m.kick:
+			t.Stop()
+		}
+	}
+}
+
+// Tick does one round of the loop.
+func (m *Manager) Tick(ctx context.Context) {
+	all, err := m.store.Certificates(ctx)
+	if err != nil {
+		m.log.Error("loading certificates failed", "err", err)
+		return
+	}
+	now := m.now()
+	for _, c := range all {
+		if ctx.Err() != nil {
+			return
+		}
+		if c.Source == model.CertSourceFile {
+			m.refreshFile(ctx, c, false)
+			continue
+		}
+		if at := m.Due(c); !at.After(now) {
+			if _, busy := m.issuing.LoadOrStore(c.Name, now); !busy {
+				m.issue(ctx, c, auth.System)
+				m.issuing.Delete(c.Name)
+			}
+			continue
+		}
+		// Ask the CA about the renewal window twice a day (it moves it
+		// earlier when a certificate must be replaced, e.g. revoked).
+		if c.CertPEM != "" && (c.ARICheckedAt == nil || now.Sub(*c.ARICheckedAt) > 12*time.Hour) {
+			in, _, err := Inspect([]byte(c.CertPEM), []byte(c.KeyPEM))
+			if err != nil {
+				continue
+			}
+			t, err := m.renewalInfo(ctx, c, in.Leaf)
+			checked := now.UTC()
+			c.ARICheckedAt = &checked
+			if err == nil && t != nil && (c.RenewAt == nil || !t.Equal(*c.RenewAt)) {
+				m.log.Info("renewal time from the CA", "certificate", c.Name, "renew_at", t.Format(time.RFC3339))
+				c.RenewAt = t
+			}
+			m.store.UpdateCertificate(ctx, c)
+		}
+	}
+}
+
+// Due is when c should be obtained (again): at once when it has no
+// certificate yet or its names changed; else at its renewal time. After
+// failures it waits 1, 2, 4 ... hours (at most a day) between attempts.
+func (m *Manager) Due(c *model.Certificate) time.Time {
+	var at time.Time
+	switch {
+	case c.CertPEM == "":
+		at = c.CreatedAt
+	case c.RenewAt != nil:
+		at = *c.RenewAt
+	case c.NotBefore != nil && c.NotAfter != nil:
+		at = twoThirds(*c.NotBefore, *c.NotAfter)
+	}
+	if c.Failures > 0 && c.LastAttempt != nil {
+		wait := time.Hour << min(c.Failures-1, 5)
+		at = maxTime(at, c.LastAttempt.Add(min(wait, 24*time.Hour)))
+	}
+	return at
+}
+
+func maxTime(a, b time.Time) time.Time {
+	if a.After(b) {
+		return a
+	}
+	return b
+}
+
+// Status is a certificate's health.
+type Status struct {
+	State   string `json:"state"` // ok, pending, failing, expiring, expired
+	Message string `json:"message,omitempty"`
+}
+
+// StatusOf says how c is doing.
+func (m *Manager) StatusOf(c *model.Certificate) Status {
+	now := m.now()
+	if c.NotAfter == nil {
+		if c.Failures > 0 {
+			return Status{"failing", "not obtained yet: " + c.LastError}
+		}
+		return Status{"pending", "not obtained yet"}
+	}
+	left := c.NotAfter.Sub(now)
+	life := c.NotAfter.Sub(*c.NotBefore)
+	switch {
+	case left <= 0:
+		return Status{"expired", "expired on " + c.NotAfter.Format(time.DateOnly)}
+	case c.Failures > 0 && c.Source == model.CertSourceACME:
+		return Status{"failing", fmt.Sprintf("renewing failed %d times (next try %s): %s", c.Failures, m.Due(c).Local().Format("2 Jan 15:04"), c.LastError)}
+	case c.Failures > 0:
+		return Status{"failing", c.LastError}
+	case left < life/6 || (c.Source == model.CertSourceFile && left < 14*24*time.Hour):
+		return Status{"expiring", fmt.Sprintf("expires in %s (%s)", days(left), c.NotAfter.Format(time.DateOnly))}
+	}
+	return Status{"ok", ""}
+}
+
+func days(d time.Duration) string {
+	n := int(d.Hours() / 24)
+	if n == 1 {
+		return "1 day"
+	}
+	if n < 1 {
+		return fmt.Sprintf("%d hours", int(d.Hours()))
+	}
+	return fmt.Sprintf("%d days", n)
+}
+
+// AccountInfo is the ACME account as the API shows it.
+type AccountInfo struct {
+	Directory     string     `json:"directory"`
+	Email         string     `json:"email,omitempty"`
+	AgreeTOS      bool       `json:"agree_tos"`
+	EAB           bool       `json:"eab"`
+	Registered    bool       `json:"registered"`
+	URI           string     `json:"uri,omitempty"`
+	RegisteredAt  *time.Time `json:"registered_at,omitempty"`
+	Porkbun       bool       `json:"porkbun"`
+	Resolvers     []string   `json:"resolvers"`
+	Dir           string     `json:"dir"`
+	ActiveWebCert string     `json:"active_web_certificate,omitempty"`
+}
+
+// AccountInfo describes the ACME account and settings.
+func (m *Manager) AccountInfo(ctx context.Context) AccountInfo {
+	ai := AccountInfo{Directory: m.cfg.Directory, Email: m.cfg.Email, AgreeTOS: m.cfg.AgreeTOS, EAB: m.cfg.EABKeyID != "",
+		Porkbun: m.cfg.Porkbun != nil, Resolvers: m.cfg.Resolvers, Dir: m.cfg.Dir, ActiveWebCert: m.WebName()}
+	if a := m.account(ctx); a != nil && a.Directory == m.cfg.Directory && a.URI != "" {
+		ai.Registered, ai.URI = true, a.URI
+		t := a.RegisteredAt
+		ai.RegisteredAt = &t
+	}
+	return ai
+}
@@ -0,0 +1,146 @@
+package certs
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"jarl/internal/acme"
+	"jarl/internal/model"
+)
+
+// Route says where the DNS-01 challenge for one certificate name goes,
+// and why.
+type Route struct {
+	Domain string `json:"domain"` // the name on the certificate
+	Record string `json:"record"` // _acme-challenge.<domain>
+	// Target is where the TXT record is written: Record, or where its
+	// CNAME points.
+	Target   string   `json:"target"`
+	Route    string   `json:"route,omitempty"` // jarl or porkbun; "" when there is none
+	Zone     string   `json:"zone,omitempty"`  // the zone on the internet that holds Target
+	PublicNS []string `json:"public_ns,omitempty"`
+	Why      string   `json:"why"`
+	Error    string   `json:"error,omitempty"`
+}
+
+func (r Route) String() string {
+	s := r.Domain + ": " + r.Route
+	if r.Target != r.Record {
+		s += " via CNAME " + strings.TrimSuffix(r.Target, ".")
+	}
+	return s + " (zone " + strings.TrimSuffix(r.Zone, ".") + ")"
+}
+
+func isPorkbunNS(ns []string) bool {
+	for _, n := range ns {
+		if strings.HasSuffix(n, ".porkbun.com") {
+			return true
+		}
+	}
+	return false
+}
+
+// route decides where the challenge for domain goes. challenge is the
+// certificate's setting: auto picks from the zone's public name servers.
+// target is the record name after CNAMEs ("" to look it up).
+func (m *Manager) route(ctx context.Context, st *model.State, challenge, domain, target string) Route {
+	r := Route{Domain: domain, Record: challengeName(domain)}
+	fail := func(format string, a ...any) Route {
+		r.Error = fmt.Sprintf(format, a...)
+		return r
+	}
+	if target == "" {
+		t, err := m.res.follow(ctx, r.Record)
+		if err != nil {
+			return fail("%v", err)
+		}
+		target = t
+	}
+	r.Target = target
+	zone, err := m.res.zoneOf(ctx, target)
+	if err != nil {
+		return fail("%v", err)
+	}
+	r.Zone = zone
+	ns, err := m.res.nameServers(ctx, zone)
+	if err != nil {
+		return fail("%v", err)
+	}
+	r.PublicNS = ns
+	zoneName, nsList := strings.TrimSuffix(zone, "."), strings.Join(ns, ", ")
+
+	// Jarl can answer when it has the zone and the internet asks the name
+	// servers listed in it.
+	var jarlNS []string
+	jarlHas := false
+	for _, z := range st.SortedZones() {
+		if z.Type != model.ZonePrimary || z.Disabled || normName(z.Name) != normName(zone) {
+			continue
+		}
+		jarlHas = true
+		for _, rec := range st.ZoneRecords(z.ID) {
+			if rec.Type == "NS" && !rec.Disabled && normName(rec.Name) == normName(zone) {
+				jarlNS = append(jarlNS, normName(rec.Data))
+			}
+		}
+	}
+	slices.Sort(jarlNS)
+	jarlNS = slices.Compact(jarlNS)
+	servedByJarl := jarlHas && slices.ContainsFunc(ns, func(n string) bool { return slices.Contains(jarlNS, n) })
+	porkbunOK := m.cfg.Porkbun != nil && (m.cfg.PorkbunAllows == nil || m.cfg.PorkbunAllows(zoneName))
+
+	porkbun := func() Route {
+		r.Route, r.Why = model.ChallengePorkbun, fmt.Sprintf("%s is served by Porkbun (%s), so the record goes in through Porkbun's API", zoneName, nsList)
+		return r
+	}
+	jarl := func() Route {
+		r.Route, r.Why = model.ChallengeJarl, fmt.Sprintf("%s is served by this server's name servers (%s), so Jarl writes the record itself", zoneName, nsList)
+		return r
+	}
+	switch challenge {
+	case model.ChallengePorkbun:
+		switch {
+		case m.cfg.Porkbun == nil:
+			return fail("the challenge is set to porkbun, but jarl.yaml has no porkbun.api_key")
+		case !porkbunOK:
+			return fail("the challenge is set to porkbun, but %s isn't in porkbun.domains in jarl.yaml", zoneName)
+		case !isPorkbunNS(ns):
+			return fail("the challenge is set to porkbun, but on the internet %s is served by %s, not Porkbun: the CA would never see the record (set the challenge to auto)", zoneName, nsList)
+		}
+		return porkbun()
+	case model.ChallengeJarl:
+		switch {
+		case !jarlHas:
+			return fail("the challenge is set to jarl, but no primary zone in Jarl is %s (where %s is on the internet)", zoneName, strings.TrimSuffix(target, "."))
+		case !servedByJarl:
+			return fail("the challenge is set to jarl, but on the internet %s is served by %s, not by the name servers in Jarl's zone (%s): the CA would never see the record (set the challenge to auto)", zoneName, nsList, strings.Join(jarlNS, ", "))
+		}
+		return jarl()
+	}
+	switch {
+	case isPorkbunNS(ns) && porkbunOK:
+		return porkbun()
+	case servedByJarl:
+		return jarl()
+	case isPorkbunNS(ns) && m.cfg.Porkbun == nil:
+		return fail("%s is served by Porkbun (%s) and jarl.yaml has no porkbun.api_key. Add the key, or point %s with a CNAME at a name in a zone this server serves on the internet", zoneName, nsList, strings.TrimSuffix(r.Record, "."))
+	case isPorkbunNS(ns):
+		return fail("%s is served by Porkbun (%s) but isn't in porkbun.domains in jarl.yaml", zoneName, nsList)
+	case jarlHas:
+		return fail("on the internet %s is served by %s, not by the name servers in Jarl's zone (%s), so the CA would never see a record Jarl writes. Delegate the zone to this server, or point %s with a CNAME at a name in a zone it serves", zoneName, nsList, strings.Join(jarlNS, ", "), strings.TrimSuffix(r.Record, "."))
+	}
+	return fail("%s is served by %s, which Jarl can't write to. Point %s with a CNAME at a name in a zone this server serves on the internet (for example %s.acme.<your domain>, in a zone acme.<your domain> delegated here): Jarl follows the CNAME and answers there", zoneName, nsList, strings.TrimSuffix(r.Record, "."), strings.ReplaceAll(strings.TrimSuffix(strings.TrimPrefix(r.Record, "_acme-challenge."), "."), ".", "-"))
+}
+
+// primaryZones lists the zones Jarl can write challenge records into.
+func primaryZones(st *model.State) []acme.Zone {
+	var out []acme.Zone
+	for _, z := range st.SortedZones() {
+		if z.Type == model.ZonePrimary && !z.Disabled {
+			out = append(out, acme.Zone{Name: z.Name, View: st.ViewName(z), Link: z.LinkGroup})
+		}
+	}
+	return out
+}
@@ -30,8 +30,17 @@ type Client struct {
 	// Changeset, if set, stages changes into this changeset instead of
 	// applying them.
 	Changeset int64
-	DryRun    bool
-	Force     bool
+	// CheckChangeset, if set, runs once before Changeset is first used,
+	// and its error stops the request. The CLI checks a changeset taken
+	// from JARL_CHANGESET with it.
+	CheckChangeset func(ctx context.Context) error
+	csChecked      bool
+	csErr          error
+	DryRun         bool
+	Force          bool
+	// AcceptRisk confirms changes that open the server up
+	// (docs/exposure.md).
+	AcceptRisk bool
 	// Preflight lets only requests through that can't change anything:
 	// reads and dry runs. Running a command on several servers uses it to
 	// check the command everywhere before running it anywhere.
@@ -243,6 +252,19 @@ func (c *Client) Get(ctx context.Context, path string, query url.Values, out any
 	return c.Do(ctx, http.MethodGet, path, query, nil, out)
 }

+// UseChangeset returns the changeset to stage into (0 for none), once
+// CheckChangeset has accepted it.
+func (c *Client) UseChangeset(ctx context.Context) (int64, error) {
+	if c.Changeset == 0 {
+		return 0, nil
+	}
+	if c.CheckChangeset != nil && !c.csChecked {
+		c.csChecked = true
+		c.csErr = c.CheckChangeset(ctx)
+	}
+	return c.Changeset, c.csErr
+}
+
 // Mutate sends a configuration change, honoring Changeset, DryRun and
 // Force.
 func (c *Client) Mutate(ctx context.Context, method, path string, query url.Values, body any) (*api.MutationResponse, error) {
@@ -250,8 +272,12 @@ func (c *Client) Mutate(ctx context.Context, method, path string, query url.Valu
 	for k, v := range query {
 		q[k] = v
 	}
-	if c.Changeset > 0 {
-		q.Set("changeset", fmt.Sprint(c.Changeset))
+	cs, err := c.UseChangeset(ctx)
+	if err != nil {
+		return &api.MutationResponse{}, err
+	}
+	if cs > 0 {
+		q.Set("changeset", fmt.Sprint(cs))
 	}
 	if c.DryRun {
 		q.Set("dry_run", "1")
@@ -259,8 +285,11 @@ func (c *Client) Mutate(ctx context.Context, method, path string, query url.Valu
 	if c.Force {
 		q.Set("force", "1")
 	}
+	if c.AcceptRisk {
+		q.Set("accept_risk", "1")
+	}
 	var out api.MutationResponse
-	err := c.Do(ctx, method, path, q, body, &out)
+	err = c.Do(ctx, method, path, q, body, &out)
 	return &out, err
 }

@@ -4,6 +4,7 @@ package config
 import (
 	"bytes"
 	"fmt"
+	"net"
 	"net/netip"
 	"net/url"
 	"os"
@@ -38,6 +39,67 @@ type Config struct {
 	ACME       ACME     `yaml:"acme"`
 	Porkbun    Porkbun  `yaml:"porkbun"`
 	Blocking   Blocking `yaml:"blocking"`
+	Metrics    Metrics  `yaml:"metrics"`
+	// Certificates configures TLS certificates Jarl manages
+	// (docs/certificates.md); the ACME account is under acme.
+	Certificates Certificates `yaml:"certificates"`
+}
+
+// Certificates configures the certificates Jarl manages.
+type Certificates struct {
+	// Dir is where certificates are written for named (DNS over TLS and
+	// HTTPS): one directory per certificate, readable by bind.file_group.
+	// "" is <bind.config_dir>/tls.
+	Dir string `yaml:"dir"`
+}
+
+// Metrics configures the Prometheus endpoint /metrics (docs/metrics.md).
+// A scrape is allowed from an address in Allow, or with Token as a bearer
+// token; root and jarld's own user may also scrape on the local socket.
+type Metrics struct {
+	Enabled bool `yaml:"enabled"`
+	// Listen are extra addresses that serve only /metrics, over plain
+	// HTTP. /metrics is always served on the main listeners too.
+	Listen []string `yaml:"listen"`
+	// Allow are the addresses or prefixes that may scrape without a token.
+	Allow []string `yaml:"allow"`
+	// Token, when set, lets any address that sends it as
+	// "Authorization: Bearer TOKEN" scrape.
+	Token string `yaml:"token"`
+}
+
+func (m *Metrics) check() error {
+	if !m.Enabled {
+		return nil
+	}
+	for _, a := range m.Listen {
+		if _, port, err := net.SplitHostPort(a); err != nil || port == "" {
+			return fmt.Errorf("listen %q must be ADDRESS:PORT, e.g. 0.0.0.0:9450", a)
+		}
+	}
+	for _, p := range m.Allow {
+		if _, err := ParsePrefix(p); err != nil {
+			return fmt.Errorf("allow: %v", err)
+		}
+	}
+	if m.Token != "" && (len(m.Token) < 16 || strings.ContainsAny(m.Token, " \t\r\n")) {
+		return fmt.Errorf("token must be at least 16 characters, without spaces (e.g. from 'openssl rand -hex 24')")
+	}
+	if len(m.Allow) == 0 && m.Token == "" {
+		return fmt.Errorf("set allow, token or both, or nobody can scrape")
+	}
+	return nil
+}
+
+// AllowPrefixes returns the parsed allow list.
+func (m *Metrics) AllowPrefixes() []netip.Prefix {
+	var out []netip.Prefix
+	for _, p := range m.Allow {
+		if pf, err := ParsePrefix(p); err == nil {
+			out = append(out, pf.Masked())
+		}
+	}
+	return out
 }

 // Blocking configures blocklist downloads (docs/blocking.md). The lists
@@ -132,9 +194,85 @@ type Backup struct {
 	WarnAfter Duration `yaml:"warn_after"`
 }

-// ACME configures the ACME helpers.
+// ACME configures the ACME helpers and the account Jarl uses to obtain
+// certificates itself.
 type ACME struct {
-	HTTPReq HTTPReq `yaml:"httpreq"`
+	HTTPReq HTTPReq     `yaml:"httpreq"`
+	Account ACMEAccount `yaml:"account"`
+	// Resolvers are the recursive resolvers used to see a domain as the
+	// CA does: its zone, its public name servers and any CNAME on
+	// _acme-challenge. Public resolvers by default, because this server's
+	// own answers may come from an internal view.
+	Resolvers []string `yaml:"resolvers"`
+	// CABundle is a PEM file of extra CA certificates to trust when
+	// talking to the ACME server (a private CA such as step-ca).
+	CABundle string `yaml:"ca_bundle"`
+	// CheckPropagation waits until every name server of the zone serves
+	// a challenge before telling the CA to look.
+	CheckPropagation bool `yaml:"check_propagation"`
+}
+
+// ACMEAccount is the ACME account certificates are obtained with.
+type ACMEAccount struct {
+	// Directory is letsencrypt, letsencrypt-staging or an ACME directory URL.
+	Directory string `yaml:"directory"`
+	Email     string `yaml:"email"`
+	// AgreeTOS says you accept the CA's terms of service. Jarl doesn't
+	// register an account without it.
+	AgreeTOS bool `yaml:"agree_tos"`
+	// EABKeyID and EABHMAC are External Account Binding credentials, for
+	// CAs that need them (ZeroSSL, Google).
+	EABKeyID string `yaml:"eab_kid"`
+	EABHMAC  string `yaml:"eab_hmac"`
+}
+
+// Directory URLs for the names acme.account.directory accepts.
+const (
+	LetsEncrypt        = "https://acme-v02.api.letsencrypt.org/directory"
+	LetsEncryptStaging = "https://acme-staging-v02.api.letsencrypt.org/directory"
+)
+
+// DirectoryURL is the account's ACME directory URL.
+func (a ACMEAccount) DirectoryURL() string {
+	switch a.Directory {
+	case "", "letsencrypt":
+		return LetsEncrypt
+	case "letsencrypt-staging":
+		return LetsEncryptStaging
+	}
+	return a.Directory
+}
+
+func (a *ACME) check() error {
+	if d := a.Account.Directory; d != "" && d != "letsencrypt" && d != "letsencrypt-staging" {
+		u, err := url.Parse(d)
+		if err != nil || u.Scheme != "https" || u.Host == "" {
+			return fmt.Errorf("account.directory must be letsencrypt, letsencrypt-staging or an https:// URL")
+		}
+	}
+	if a.Account.Email != "" && !strings.Contains(a.Account.Email, "@") {
+		return fmt.Errorf("account.email %q isn't an email address", a.Account.Email)
+	}
+	if (a.Account.EABKeyID == "") != (a.Account.EABHMAC == "") {
+		return fmt.Errorf("account: set both eab_kid and eab_hmac, or neither")
+	}
+	for _, r := range a.Resolvers {
+		if _, _, err := net.SplitHostPort(r); err != nil {
+			return fmt.Errorf("resolvers: %q must be address:port, e.g. 1.1.1.1:53 or [2606:4700:4700::1111]:53", r)
+		}
+	}
+	if a.CABundle != "" && !filepath.IsAbs(a.CABundle) {
+		return fmt.Errorf("ca_bundle must be an absolute path")
+	}
+	return nil
+}
+
+// CertDir is certificates.dir, or <bind.config_dir>/tls.
+func (c *Config) CertDir() string {
+	if c.Certificates.Dir != "" {
+		return c.Certificates.Dir
+	}
+	return filepath.Join(c.BIND.ConfigDir, "tls")
 }

 // HTTPReq configures the endpoint for lego's httpreq DNS provider
@@ -321,8 +459,10 @@ func Default() *Config {
 			Retention:         StatsRetention{Minute: Duration(7 * 24 * time.Hour), Hour: Duration(90 * 24 * time.Hour), Day: Duration(730 * 24 * time.Hour)},
 			TopN:              100,
 		},
-		ACME:     ACME{HTTPReq: HTTPReq{RequireHTTPS: true}},
+		ACME: ACME{HTTPReq: HTTPReq{RequireHTTPS: true}, Account: ACMEAccount{Directory: "letsencrypt"},
+			Resolvers: []string{"1.1.1.1:53", "9.9.9.9:53", "8.8.8.8:53"}, CheckPropagation: true},
 		Blocking: Blocking{Refresh: Duration(24 * time.Hour), MaxDownloadMB: 64, MaxEntries: 1_000_000},
+		Metrics:  Metrics{Allow: []string{"127.0.0.1", "::1"}},
 		Backup:   Backup{Dir: "/var/backups/jarl", Retention: Duration(30 * 24 * time.Hour), KeepAtLeast: 7, WarnAfter: Duration(2 * 24 * time.Hour)},
 	}
 }
@@ -394,6 +534,15 @@ func (c *Config) check() error {
 	if err := c.Blocking.check(); err != nil {
 		return fmt.Errorf("blocking: %w", err)
 	}
+	if err := c.Metrics.check(); err != nil {
+		return fmt.Errorf("metrics: %w", err)
+	}
+	if err := c.ACME.check(); err != nil {
+		return fmt.Errorf("acme: %w", err)
+	}
+	if d := c.Certificates.Dir; d != "" && !filepath.IsAbs(d) {
+		return fmt.Errorf("certificates.dir must be an absolute path")
+	}
 	switch c.Log.Format {
 	case "text", "json":
 	default:
@@ -497,8 +646,10 @@ const Example = `# Jarl daemon configuration (/etc/jarl/jarl.yaml).
 listen:
  - "127.0.0.1:8053"

-# HTTPS. The certificate is reread when the file changes (or on SIGHUP),
-# so renewed Let's Encrypt certificates are picked up automatically.
+# HTTPS from a certificate file you renew yourself. The certificate is
+# reread when the file changes (or on SIGHUP). Easier: let Jarl obtain one
+# ('jarl cert create ... --use web', docs/certificates.md), which then
+# takes over from this.
 tls:
  cert_file: ""
  key_file: ""
@@ -612,15 +763,44 @@ acme:
    # this server. Leave false if a reverse proxy runs on this server but
    # isn't in trusted_proxies: its requests would look local.
    allow_loopback_http: false
+  # The account Jarl obtains certificates with (docs/certificates.md).
+  # Nothing is registered until you create a certificate. Read the CA's
+  # terms (https://letsencrypt.org/repository/) and set agree_tos: true.
+  # Try letsencrypt-staging first: its certificates aren't trusted, but
+  # its rate limits are generous.
+  account:
+    directory: letsencrypt   # letsencrypt, letsencrypt-staging or a directory URL
+    email: ""                # optional
+    agree_tos: false
+    eab_kid: ""              # External Account Binding, only for CAs that need it
+    eab_hmac: ""
+  # Resolvers to see your domains as the CA does (their public name
+  # servers, a CNAME on _acme-challenge). Not this server: it may answer
+  # from an internal view.
+  resolvers: ["1.1.1.1:53", "9.9.9.9:53", "8.8.8.8:53"]
+  ca_bundle: ""              # extra CA certificates for a private ACME server
+  # Wait until every name server of the zone serves a challenge before
+  # telling the CA to look (they are asked directly, on port 53).
+  check_propagation: true

-# The registrar Porkbun (docs/dnssec.md#porkbun): with an API key, Jarl can
-# show and set a domain's name servers, glue records and DNSSEC DS records
-# there, after checking that the change won't break the domain. Off without
-# a key. Create the key at porkbun.com (Account -> API Access), switch on
-# "API Access" for the domain, and limit the key to that domain if you can.
-# The key can move your domain elsewhere: it lives only in this file (keep
-# it readable by root and jarld only: chown root:jarl, chmod 640), never in
-# Jarl's database or backups.
+# Where certificates with the "dns" use are written for named, one
+# directory per certificate (fullchain.pem, privkey.pem), readable by
+# bind.file_group. Default: <bind.config_dir>/tls.
+certificates:
+  dir: ""
+
+# Porkbun, as registrar and as DNS host. With an API key, Jarl can:
+#  - show and set a domain's name servers, glue records and DNSSEC DS
+#    records there, after checking that the change won't break the domain
+#    (docs/dnssec.md#porkbun);
+#  - publish the DNS-01 challenges of certificates Jarl obtains while
+#    Porkbun still serves the domain's DNS (docs/certificates.md): it adds
+#    and removes TXT records at _acme-challenge names only.
+# Off without a key. Create the key at porkbun.com (Account -> API Access),
+# switch on "API Access" for the domain, and limit the key to that domain
+# if you can. The key can move your domain elsewhere: it lives only in this
+# file (keep it readable by root and jarld only: chown root:jarl, chmod
+# 640), never in Jarl's database or backups.
 porkbun:
  api_key: ""          # pk1_...
  secret_api_key: ""   # sk1_...
@@ -633,4 +813,23 @@ blocking:
  refresh: 24h           # check each list for changes this often (at least 1h)
  max_download_mb: 64    # refuse larger downloads
  max_entries: 1000000   # refuse lists with more domains
+
+# Prometheus metrics at /metrics (docs/metrics.md): named's counters and
+# Jarl's own (blocking, zones, views), plus health gauges to alert on
+# (named up, validation problems, blocklist errors, backup age, DNSSEC
+# steps, token expiry). Off by default. /metrics is served on the
+# addresses in 'listen' at the top of this file; a scrape is allowed from
+# an address in 'allow' below, or with the token. Query counters need
+# stats.enabled.
+metrics:
+  enabled: false
+  # Extra addresses that serve only /metrics, over plain HTTP, e.g.
+  # ["0.0.0.0:9450"] for a Prometheus server elsewhere on the network.
+  listen: []
+  # Addresses or prefixes that may scrape without a token.
+  allow: ["127.0.0.1", "::1"]
+  # A bearer token (at least 16 characters) that lets any address scrape:
+  # in Prometheus, 'authorization: { credentials: TOKEN }'. Keep this file
+  # readable by root and jarld only when you set it.
+  token: ""
 `
@@ -3,6 +3,7 @@ package config
 import (
 	"os"
 	"path/filepath"
+	"reflect"
 	"testing"
 	"time"
 )
@@ -18,7 +19,7 @@ func TestExampleParses(t *testing.T) {
 	if c.BIND.ZoneDir != d.BIND.ZoneDir || time.Duration(c.Session.IdleTimeout) != 2*time.Hour || c.Listen[0] != "127.0.0.1:8053" {
 		t.Errorf("example differs from defaults: %+v", c)
 	}
-	if c.ACME != d.ACME || c.ACME.HTTPReq.Enabled || !c.ACME.HTTPReq.RequireHTTPS {
+	if !reflect.DeepEqual(c.ACME, d.ACME) || !reflect.DeepEqual(c.Certificates, d.Certificates) || c.ACME.HTTPReq.Enabled || !c.ACME.HTTPReq.RequireHTTPS {
 		t.Errorf("acme = %+v, want the defaults %+v", c.ACME, d.ACME)
 	}
 }
@@ -87,3 +88,31 @@ func TestStatsConfig(t *testing.T) {
 		}
 	}
 }
+
+func TestMetricsConfig(t *testing.T) {
+	d := Default()
+	if d.Metrics.Enabled || len(d.Metrics.AllowPrefixes()) != 2 || d.Metrics.Token != "" {
+		t.Errorf("defaults = %+v", d.Metrics)
+	}
+	path := filepath.Join(t.TempDir(), "jarl.yaml")
+	for _, tc := range []struct {
+		yaml string
+		ok   bool
+	}{
+		{"metrics: {enabled: true}", true},
+		{"metrics: {enabled: true, listen: [\"0.0.0.0:9450\", \"[::]:9450\"], allow: [10.0.0.5, 192.168.1.0/24]}", true},
+		{"metrics: {enabled: true, allow: [], token: 0123456789abcdef}", true},
+		{"metrics: {enabled: true, allow: []}", false}, // nobody could scrape
+		{"metrics: {enabled: true, token: short}", false},
+		{"metrics: {enabled: true, token: \"has space 0123456789\"}", false},
+		{"metrics: {enabled: true, listen: [\"9450\"]}", false},
+		{"metrics: {enabled: true, allow: [prometheus.lan]}", false},
+		{"metrics: {enabled: false, listen: [nonsense]}", true}, // only checked when enabled
+	} {
+		os.WriteFile(path, []byte(tc.yaml+"\n"), 0o644)
+		_, err := Load(path, false)
+		if (err == nil) != tc.ok {
+			t.Errorf("%s: err = %v, want ok=%v", tc.yaml, err, tc.ok)
+		}
+	}
+}
@@ -0,0 +1,395 @@
+// Package encdns sets up DNS over TLS (DoT) and DNS over HTTPS (DoH) in
+// named (docs/encrypted-dns.md): a tls statement naming a certificate Jarl
+// manages, and listen-on statements for port 853 (DoT) and the DoH port.
+// Its state is read from named's configuration, so what the setup stages
+// stays ordinary, visible configuration.
+package encdns
+
+import (
+	"fmt"
+	"net/netip"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"jarl/internal/engine"
+	"jarl/internal/model"
+	"jarl/internal/namedconf"
+)
+
+// Prefix starts the names of the tls statements the setup writes.
+const Prefix = "jarl-"
+
+// DoTPort is the port for DNS over TLS (RFC 7858).
+const DoTPort = 853
+
+// Listener is a listen-on or listen-on-v6 statement.
+type Listener struct {
+	OptionID int64    `json:"option_id"`
+	V6       bool     `json:"v6"`
+	Port     int      `json:"port"`           // as written; 0 when it isn't
+	TLS      string   `json:"tls,omitempty"`  // tls statement ("" for plain DNS)
+	HTTP     string   `json:"http,omitempty"` // http endpoints: DNS over HTTPS
+	Addrs    []string `json:"addresses"`      // the address match list
+}
+
+// EffectivePort is the port named listens on: as written, or its
+// default for the kind of listener.
+func (l Listener) EffectivePort() int {
+	switch {
+	case l.Port != 0:
+		return l.Port
+	case l.HTTP != "" && l.TLS != "" && l.TLS != "none":
+		return 443
+	case l.HTTP != "":
+		return 80
+	case l.TLS != "":
+		return DoTPort
+	}
+	return 53
+}
+
+// Kind is plain, dot or doh.
+func (l Listener) Kind() string {
+	switch {
+	case l.HTTP != "":
+		return "doh"
+	case l.TLS != "" && l.TLS != "none":
+		return "dot"
+	}
+	return "plain"
+}
+
+// Managed reports whether the setup wrote the listener.
+func (l Listener) Managed() bool { return strings.HasPrefix(l.TLS, Prefix) }
+
+// Listeners returns the server's listen-on and listen-on-v6 statements.
+func Listeners(st *model.State) []Listener {
+	var out []Listener
+	for _, o := range st.ScopedOptions(model.ScopeOptions, 0) {
+		if o.Name != "listen-on" && o.Name != "listen-on-v6" {
+			continue
+		}
+		l, err := parseListener(o.Name, o.Value)
+		if err != nil {
+			continue
+		}
+		l.OptionID, l.V6 = o.ID, o.Name == "listen-on-v6"
+		out = append(out, l)
+	}
+	return out
+}
+
+func parseListener(name, value string) (Listener, error) {
+	var l Listener
+	stmt, err := namedconf.ParseOptionValue(name, value)
+	if err != nil {
+		return l, err
+	}
+	items := stmt.Items[1:]
+	for i := 0; i < len(items); i++ {
+		it := items[i]
+		if it.Block != nil {
+			for _, s := range it.Block.Stmts {
+				l.Addrs = append(l.Addrs, namedconf.Compact(s.Items))
+			}
+			continue
+		}
+		if it.Value == nil || i+1 >= len(items) || items[i+1].Value == nil {
+			continue
+		}
+		arg := items[i+1].Value.Text
+		switch strings.ToLower(it.Value.Text) {
+		case "port":
+			l.Port, _ = strconv.Atoi(arg)
+		case "tls":
+			l.TLS = arg
+		case "http":
+			l.HTTP = arg
+		}
+		i++
+	}
+	return l, nil
+}
+
+// TLSBlock is a top-level tls statement.
+type TLSBlock struct {
+	OptionID int64  `json:"option_id"`
+	Name     string `json:"name"`
+	CertFile string `json:"cert_file"`
+	KeyFile  string `json:"key_file"`
+}
+
+// TLSBlocks returns the top-level tls statements.
+func TLSBlocks(st *model.State) []TLSBlock {
+	var out []TLSBlock
+	for _, o := range st.ScopedOptions(model.ScopeTopLevel, 0) {
+		if o.Name != "tls" {
+			continue
+		}
+		stmt, err := namedconf.ParseOptionValue("tls", o.Value)
+		if err != nil {
+			continue
+		}
+		b := TLSBlock{OptionID: o.ID, Name: stmt.Arg(0)}
+		if blk := stmt.FirstBlock(); blk != nil {
+			for _, s := range blk.Stmts {
+				switch s.Keyword() {
+				case "cert-file":
+					b.CertFile = s.Arg(0)
+				case "key-file":
+					b.KeyFile = s.Arg(0)
+				}
+			}
+		}
+		out = append(out, b)
+	}
+	return out
+}
+
+// Endpoint is an address and port named serves DoT or DoH on.
+type Endpoint struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+}
+
+// Status is what is set up.
+type Status struct {
+	Enabled bool `json:"enabled"`
+	// TLS is the tls statement the setup wrote, and Certificate the
+	// certificate it names (a Jarl certificate's name, when it is one).
+	TLS         *TLSBlock  `json:"tls,omitempty"`
+	Certificate string     `json:"certificate,omitempty"`
+	DoT         []Endpoint `json:"dot"`
+	DoH         []Endpoint `json:"doh"`
+	// Listeners are all listen-on statements, the setup's and others.
+	Listeners []Listener `json:"listeners"`
+	// Other are DoT or DoH listeners written by hand.
+	Other bool `json:"other,omitempty"`
+}
+
+// GetStatus reads the setup from the configuration. certDir is where Jarl
+// writes certificates for named (certificates.dir).
+func GetStatus(st *model.State, certDir string) Status {
+	s := Status{Listeners: Listeners(st), DoT: []Endpoint{}, DoH: []Endpoint{}}
+	if s.Listeners == nil {
+		s.Listeners = []Listener{}
+	}
+	for _, b := range TLSBlocks(st) {
+		if strings.HasPrefix(b.Name, Prefix) {
+			b := b
+			s.TLS = &b
+			if dir := filepath.Dir(b.CertFile); filepath.Dir(dir) == filepath.Clean(certDir) {
+				s.Certificate = filepath.Base(dir)
+			}
+			break
+		}
+	}
+	for _, l := range s.Listeners {
+		if l.Kind() == "plain" {
+			continue
+		}
+		if !l.Managed() {
+			s.Other = true
+			continue
+		}
+		for _, a := range l.Addrs {
+			e := Endpoint{Address: a, Port: l.EffectivePort()}
+			if l.Kind() == "doh" {
+				s.DoH = append(s.DoH, e)
+			} else {
+				s.DoT = append(s.DoT, e)
+			}
+		}
+	}
+	s.Enabled = len(s.DoT)+len(s.DoH) > 0
+	return s
+}
+
+// Setup is what to set up.
+type Setup struct {
+	// Hostname is the name clients connect to (the certificate's).
+	Hostname string `json:"hostname"`
+	// Certificate is the Jarl certificate (with the dns use) to serve.
+	Certificate string `json:"certificate"`
+	// Addresses are the addresses of this server to listen on.
+	Addresses []string `json:"addresses"`
+	DoT       bool     `json:"dot"`
+	DoH       bool     `json:"doh"`
+	DoHPort   int      `json:"doh_port"` // default 443
+	DoTPort   int      `json:"dot_port"` // default 853 (clients expect it)
+	// Views get the hostname's A/AAAA records (default: none). In a
+	// linked zone they are local to the view.
+	Views []string `json:"views"`
+}
+
+// Plan returns the requests that set up encrypted DNS as s says,
+// replacing an earlier setup, and notes for the user. certDir is where
+// the certificate's files are.
+func Plan(st *model.State, s Setup, certDir string) ([]engine.Request, []string, error) {
+	var notes []string
+	if !s.DoT && !s.DoH {
+		return nil, nil, fmt.Errorf("choose DNS over TLS, DNS over HTTPS or both")
+	}
+	if s.DoHPort == 0 {
+		s.DoHPort = 443
+	}
+	if s.DoTPort == 0 {
+		s.DoTPort = DoTPort
+	}
+	for _, p := range []int{s.DoHPort, s.DoTPort} {
+		if p < 1 || p > 65535 || p == 53 {
+			return nil, nil, fmt.Errorf("port %d: use a free port other than 53", p)
+		}
+	}
+	if s.DoT && s.DoH && s.DoHPort == s.DoTPort {
+		return nil, nil, fmt.Errorf("DoT and DoH need different ports (both are %d)", s.DoHPort)
+	}
+	if s.Certificate == "" {
+		return nil, nil, fmt.Errorf("choose the certificate to serve")
+	}
+	host := strings.ToLower(strings.TrimSuffix(strings.TrimSpace(s.Hostname), "."))
+	if host == "" || !strings.Contains(host, ".") {
+		return nil, nil, fmt.Errorf("give the host name clients connect to, e.g. dns.example.com")
+	}
+	var v4, v6 []string
+	for _, a := range s.Addresses {
+		ip, err := netip.ParseAddr(strings.TrimSpace(a))
+		if err != nil {
+			return nil, nil, fmt.Errorf("%q isn't an address of this server", a)
+		}
+		ip = ip.Unmap()
+		if ip.IsUnspecified() {
+			return nil, nil, fmt.Errorf("listen on this server's addresses, not on %s (that would include public ones)", ip)
+		}
+		if ip.Is4() {
+			v4 = append(v4, ip.String())
+		} else {
+			v6 = append(v6, ip.String())
+		}
+	}
+	if len(v4)+len(v6) == 0 {
+		return nil, nil, fmt.Errorf("choose at least one address to listen on")
+	}
+	tlsName := Prefix + s.Certificate
+	dir := filepath.Join(certDir, s.Certificate)
+	tlsValue := fmt.Sprintf(`%s { cert-file "%s"; key-file "%s"; protocols { TLSv1.2; TLSv1.3; }; }`,
+		tlsName, filepath.Join(dir, "fullchain.pem"), filepath.Join(dir, "privkey.pem"))
+
+	var reqs []engine.Request
+	// Take out the earlier setup's listeners and tls statements.
+	current := Listeners(st)
+	for _, l := range current {
+		if l.Managed() {
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionDelete, l.OptionID, nil))
+		}
+	}
+	haveTLS := false
+	for _, b := range TLSBlocks(st) {
+		switch {
+		case b.Name == tlsName:
+			haveTLS = true
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionUpdate, b.OptionID, engine.OptionInput{Value: model.Ptr(tlsValue)}))
+		case strings.HasPrefix(b.Name, Prefix):
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionDelete, b.OptionID, nil))
+		}
+	}
+	if !haveTLS {
+		reqs = append(reqs, option(model.ScopeTopLevel, "tls", tlsValue))
+	}
+	// named listens on port 53 everywhere only while there is no
+	// listen-on statement at all: adding the first one for DoT would end
+	// that, so keep it explicitly.
+	plain := func(v6 bool) bool {
+		for _, l := range current {
+			if l.V6 == v6 && !l.Managed() && l.Kind() == "plain" {
+				return true
+			}
+		}
+		return false
+	}
+	add := func(name string, addrs []string) {
+		if len(addrs) == 0 {
+			return
+		}
+		list := "{ " + strings.Join(addrs, "; ") + "; }"
+		if !plain(name == "listen-on-v6") {
+			reqs = append(reqs, option(model.ScopeOptions, name, "{ any; }"))
+			notes = append(notes, fmt.Sprintf("named listened on port 53 on every address by default; %s { any; } keeps that, as the first %s statement would otherwise end it", name, name))
+		}
+		if s.DoT {
+			reqs = append(reqs, option(model.ScopeOptions, name, fmt.Sprintf("port %d tls %s %s", s.DoTPort, tlsName, list)))
+		}
+		if s.DoH {
+			reqs = append(reqs, option(model.ScopeOptions, name, fmt.Sprintf("port %d tls %s http default %s", s.DoHPort, tlsName, list)))
+		}
+	}
+	add("listen-on", v4)
+	add("listen-on-v6", v6)
+
+	// The host name's addresses, in the views asked for.
+	fqdn := host + "."
+	for _, vn := range s.Views {
+		v := st.ViewByName(vn)
+		if v == nil {
+			return nil, nil, fmt.Errorf("view %q does not exist", vn)
+		}
+		z := zoneFor(st, fqdn, v.ID)
+		if z == nil {
+			notes = append(notes, fmt.Sprintf("view %s has no zone for %s, so no address records were added there; clients must find it some other way", v.Name, host))
+			continue
+		}
+		var local *bool
+		if z.LinkGroup != 0 {
+			local = model.Ptr(true)
+		}
+		for _, set := range []struct {
+			typ   string
+			addrs []string
+		}{{"A", v4}, {"AAAA", v6}} {
+			if len(set.addrs) == 0 {
+				continue
+			}
+			reqs = append(reqs, engine.NewRequest(engine.OpRRSetReplace, 0, engine.RRSetInput{ZoneID: z.ID, Name: fqdn, Type: set.typ, Data: set.addrs, Local: local}))
+		}
+	}
+	return reqs, notes, nil
+}
+
+func option(scope, name, value string) engine.Request {
+	return engine.NewRequest(engine.OpOptionCreate, 0, engine.OptionInput{Scope: model.Ptr(scope), Name: model.Ptr(name), Value: model.Ptr(value)})
+}
+
+// zoneFor returns the primary zone in a view that holds name.
+func zoneFor(st *model.State, name string, viewID int64) *model.Zone {
+	var best *model.Zone
+	for _, z := range st.ZonesInView(viewID) {
+		if z.Type == model.ZonePrimary && (name == z.Name || strings.HasSuffix(name, "."+z.Name)) && (best == nil || len(z.Name) > len(best.Name)) {
+			best = z
+		}
+	}
+	return best
+}
+
+// Disable returns the requests that take the setup out: its listeners and
+// tls statement. Plain listeners and the host name's records stay.
+func Disable(st *model.State) []engine.Request {
+	var reqs []engine.Request
+	for _, l := range Listeners(st) {
+		if l.Managed() {
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionDelete, l.OptionID, nil))
+		}
+	}
+	for _, b := range TLSBlocks(st) {
+		if strings.HasPrefix(b.Name, Prefix) {
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionDelete, b.OptionID, nil))
+		}
+	}
+	return reqs
+}
+
+// Private reports whether an address is private (RFC 1918, ULA, ...).
+func Private(a netip.Addr) bool {
+	a = a.Unmap()
+	return a.IsPrivate() || a.IsLoopback() || a.IsLinkLocalUnicast() || netip.MustParsePrefix("100.64.0.0/10").Contains(a)
+}
@@ -0,0 +1,188 @@
+package encdns
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"jarl/internal/auth"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+	"jarl/internal/render"
+	"jarl/internal/store"
+)
+
+type env struct {
+	t       *testing.T
+	eng     *engine.Engine
+	st      *store.Store
+	certDir string
+}
+
+func newEnv(t *testing.T) *env {
+	dir := t.TempDir()
+	st, err := store.Open(filepath.Join(dir, "jarl.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	eng := engine.New(st, nil, engine.Config{
+		Paths:      render.Paths{ConfigDir: filepath.Join(dir, "etc"), ZoneDir: filepath.Join(dir, "zones"), CacheDir: filepath.Join(dir, "cache")},
+		StagingDir: filepath.Join(dir, "staging"), NoReload: true, SkipCheck: true,
+	}, slog.New(slog.NewTextHandler(io.Discard, nil)))
+	e := &env{t: t, eng: eng, st: st, certDir: filepath.Join(dir, "tls")}
+	os.MkdirAll(filepath.Join(e.certDir, "dns"), 0o755)
+	os.WriteFile(filepath.Join(e.certDir, "dns", "fullchain.pem"), []byte("x"), 0o644)
+	os.WriteFile(filepath.Join(e.certDir, "dns", "privkey.pem"), []byte("x"), 0o600)
+	e.submit(engine.NewRequest(engine.OpSettingsUpdate, 0, engine.SettingsInput{Nameservers: &[]string{"ns1.example.net."}}),
+		engine.NewRequest(engine.OpViewCreate, 0, engine.ViewInput{Name: model.Ptr("internal"), MatchClients: &[]string{"10.0.0.0/8"}}),
+		engine.NewRequest(engine.OpViewCreate, 0, engine.ViewInput{Name: model.Ptr("external"), MatchClients: &[]string{"any"}}))
+	e.submit(engine.NewRequest(engine.OpZoneCreate, 0, engine.ZoneInput{Name: model.Ptr("example.com"), View: model.Ptr("internal")}))
+	return e
+}
+
+func (e *env) submit(reqs ...engine.Request) *engine.Result {
+	e.t.Helper()
+	res, err := e.eng.Submit(context.Background(), reqs, auth.System, "test", "", engine.ApplyOptions{})
+	if err != nil {
+		e.t.Fatalf("%v (%+v)", err, res)
+	}
+	return res
+}
+
+func (e *env) state() *model.State {
+	st, err := e.st.LoadState(context.Background())
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	return st
+}
+
+func values(st *model.State, scope, name string) []string {
+	var out []string
+	for _, o := range st.ScopedOptions(scope, 0) {
+		if o.Name == name {
+			out = append(out, o.Value)
+		}
+	}
+	return out
+}
+
+func TestSetup(t *testing.T) {
+	e := newEnv(t)
+	setup := Setup{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"10.0.10.5", "2001:db8::5"}, DoT: true, DoH: true, Views: []string{"internal", "external"}}
+	reqs, notes, err := Plan(e.state(), setup, e.certDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	e.submit(reqs...)
+	st := e.state()
+	tls := values(st, model.ScopeTopLevel, "tls")
+	if len(tls) != 1 || !strings.HasPrefix(tls[0], "jarl-dns {") || !strings.Contains(tls[0], filepath.Join(e.certDir, "dns", "fullchain.pem")) {
+		t.Errorf("tls = %q", tls)
+	}
+	// The plain listeners named had by default are kept explicitly.
+	want4 := []string{"{ any; }", "port 853 tls jarl-dns { 10.0.10.5; }", "port 443 tls jarl-dns http default { 10.0.10.5; }"}
+	if got := values(st, model.ScopeOptions, "listen-on"); !slices.Equal(got, want4) {
+		t.Errorf("listen-on = %q, want %q", got, want4)
+	}
+	if got := values(st, model.ScopeOptions, "listen-on-v6"); len(got) != 3 || got[0] != "{ any; }" {
+		t.Errorf("listen-on-v6 = %q", got)
+	}
+	if len(notes) != 3 || !strings.Contains(strings.Join(notes, " "), "external has no zone") {
+		t.Errorf("notes = %q", notes)
+	}
+	// The host name's addresses in the internal view.
+	z := st.FindZone("example.com.", st.ViewByName("internal").ID)
+	var addrs []string
+	for _, r := range st.ZoneRecords(z.ID) {
+		if r.Name == "dns.example.com." {
+			addrs = append(addrs, r.Type+" "+r.Data)
+		}
+	}
+	if !slices.Equal(addrs, []string{"A 10.0.10.5", "AAAA 2001:db8::5"}) {
+		t.Errorf("records = %q", addrs)
+	}
+	s := GetStatus(st, e.certDir)
+	if !s.Enabled || s.Certificate != "dns" || len(s.DoT) != 2 || len(s.DoH) != 2 || s.DoH[0].Port != 443 || s.Other {
+		t.Errorf("status = %+v", s)
+	}
+
+	// Setting up again replaces the setup: DoT only, one address, and the
+	// plain listeners aren't doubled.
+	reqs, _, err = Plan(st, Setup{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"10.0.10.5"}, DoT: true}, e.certDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	e.submit(reqs...)
+	st = e.state()
+	if got := values(st, model.ScopeOptions, "listen-on"); !slices.Equal(got, []string{"{ any; }", "port 853 tls jarl-dns { 10.0.10.5; }"}) {
+		t.Errorf("after the second setup: %q", got)
+	}
+	if got := values(st, model.ScopeOptions, "listen-on-v6"); !slices.Equal(got, []string{"{ any; }"}) {
+		t.Errorf("listen-on-v6 after the second setup: %q", got)
+	}
+	if got := values(st, model.ScopeTopLevel, "tls"); len(got) != 1 {
+		t.Errorf("tls statements: %q", got)
+	}
+
+	// Off: the setup's listeners and tls statement go, the rest stays.
+	e.submit(Disable(st)...)
+	st = e.state()
+	if got := values(st, model.ScopeOptions, "listen-on"); !slices.Equal(got, []string{"{ any; }"}) || len(values(st, model.ScopeTopLevel, "tls")) != 0 || GetStatus(st, e.certDir).Enabled {
+		t.Errorf("after disabling: listen-on %q tls %q", got, values(st, model.ScopeTopLevel, "tls"))
+	}
+}
+
+func TestSetupRefuses(t *testing.T) {
+	e := newEnv(t)
+	st := e.state()
+	for _, s := range []Setup{
+		{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"10.0.10.5"}},                         // neither DoT nor DoH
+		{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"0.0.0.0"}, DoT: true},                // every address
+		{Hostname: "dns.example.com", Certificate: "dns", DoT: true},                                                // no address
+		{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"10.0.10.5"}, DoH: true, DoHPort: 53}, // port 53
+		{Hostname: "dns", Certificate: "dns", Addresses: []string{"10.0.10.5"}, DoT: true},                          // not a host name
+	} {
+		if _, _, err := Plan(st, s, e.certDir); err == nil {
+			t.Errorf("accepted %+v", s)
+		}
+	}
+	// A tls statement whose files are missing is refused by validation.
+	_, err := e.eng.Submit(context.Background(), []engine.Request{engine.NewRequest(engine.OpOptionCreate, 0, engine.OptionInput{
+		Scope: model.Ptr(model.ScopeTopLevel), Name: model.Ptr("tls"), Value: model.Ptr(`x { cert-file "/nonexistent/c.pem"; key-file "/nonexistent/k.pem"; }`)})},
+		auth.System, "test", "", engine.ApplyOptions{})
+	if err == nil || !strings.Contains(err.Error(), "doesn't exist") {
+		t.Errorf("missing files: %v", err)
+	}
+}
+
+func TestPorts(t *testing.T) {
+	s, err := parseProcAddr("0100007F:0035")
+	if err != nil || s.Addr != netip.MustParseAddr("127.0.0.1") || s.Port != 53 {
+		t.Errorf("v4: %+v %v", s, err)
+	}
+	s, err = parseProcAddr("00000000000000000000000001000000:01BB")
+	if err != nil || s.Addr != netip.MustParseAddr("::1") || s.Port != 443 {
+		t.Errorf("v6: %+v %v", s, err)
+	}
+	e := newEnv(t)
+	old := ListeningSockets
+	t.Cleanup(func() { ListeningSockets = old })
+	ListeningSockets = func() ([]Socket, error) {
+		return []Socket{{netip.MustParseAddr("0.0.0.0"), 443}, {netip.MustParseAddr("10.0.10.5"), 8443}, {netip.MustParseAddr("::"), 853}}, nil
+	}
+	c, err := PortCheck(e.state(), []string{"10.0.10.5"}, []int{853, 443, 8443}, []string{"0.0.0.0:443"})
+	if err != nil || len(c) != 3 || c[1].What != "jarld (Jarl's web UI and API)" || c[2].What != "another program" {
+		t.Errorf("conflicts = %+v %v", c, err)
+	}
+	if p := FreeDoHPort(e.state(), []string{"10.0.10.5"}, nil); p != 4443 {
+		t.Errorf("free DoH port = %d, want 4443", p)
+	}
+}
@@ -0,0 +1,149 @@
+package encdns
+
+import (
+	"bufio"
+	"encoding/hex"
+	"fmt"
+	"net/netip"
+	"os"
+	"strconv"
+	"strings"
+
+	"jarl/internal/model"
+)
+
+// Socket is a listening TCP socket on this host.
+type Socket struct {
+	Addr netip.Addr
+	Port int
+}
+
+// ListeningSockets reads the host's listening TCP sockets from
+// /proc/net/tcp and tcp6 (Linux; nil elsewhere). It needs no privileges
+// and binds nothing. Tests replace it.
+var ListeningSockets = func() ([]Socket, error) {
+	var out []Socket
+	for _, f := range []string{"/proc/net/tcp", "/proc/net/tcp6"} {
+		socks, err := parseProcNet(f)
+		if err != nil {
+			if os.IsNotExist(err) {
+				continue
+			}
+			return nil, err
+		}
+		out = append(out, socks...)
+	}
+	return out, nil
+}
+
+func parseProcNet(path string) ([]Socket, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	var out []Socket
+	sc := bufio.NewScanner(f)
+	sc.Scan() // header
+	for sc.Scan() {
+		fields := strings.Fields(sc.Text())
+		if len(fields) < 4 || fields[3] != "0A" { // 0A: LISTEN
+			continue
+		}
+		s, err := parseProcAddr(fields[1])
+		if err == nil {
+			out = append(out, s)
+		}
+	}
+	return out, sc.Err()
+}
+
+// parseProcAddr parses "0100007F:0035": the address in 32-bit words of
+// host byte order (little-endian here), then the port.
+func parseProcAddr(s string) (Socket, error) {
+	ha, hp, ok := strings.Cut(s, ":")
+	if !ok {
+		return Socket{}, fmt.Errorf("bad address %q", s)
+	}
+	b, err := hex.DecodeString(ha)
+	if err != nil || (len(b) != 4 && len(b) != 16) {
+		return Socket{}, fmt.Errorf("bad address %q", s)
+	}
+	for i := 0; i+4 <= len(b); i += 4 {
+		b[i], b[i+1], b[i+2], b[i+3] = b[i+3], b[i+2], b[i+1], b[i]
+	}
+	addr, _ := netip.AddrFromSlice(b)
+	port, err := strconv.ParseUint(hp, 16, 16)
+	if err != nil {
+		return Socket{}, err
+	}
+	return Socket{Addr: addr.Unmap(), Port: int(port)}, nil
+}
+
+// Conflict is something else listening where a listener would go.
+type Conflict struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+	What    string `json:"what"` // who it is, when Jarl knows
+}
+
+// PortCheck says which of addresses × ports something else listens on
+// already. named's own listeners (the setup's, now) and jarld's (known
+// listen addresses) are told apart.
+func PortCheck(st *model.State, addresses []string, ports []int, jarld []string) ([]Conflict, error) {
+	socks, err := ListeningSockets()
+	if err != nil {
+		return nil, err
+	}
+	// What named listens on now with DoT or DoH (it will again).
+	ours := map[string]bool{}
+	for _, l := range Listeners(st) {
+		if l.Kind() != "plain" {
+			for _, a := range l.Addrs {
+				ours[a+"#"+strconv.Itoa(l.EffectivePort())] = true
+			}
+		}
+	}
+	jarldOn := map[string]bool{}
+	for _, l := range jarld {
+		jarldOn[l] = true
+	}
+	var out []Conflict
+	for _, as := range addresses {
+		a, err := netip.ParseAddr(as)
+		if err != nil {
+			continue
+		}
+		a = a.Unmap()
+		for _, p := range ports {
+			if ours[a.String()+"#"+strconv.Itoa(p)] {
+				continue
+			}
+			for _, s := range socks {
+				if s.Port != p || !(s.Addr == a || s.Addr.IsUnspecified() && s.Addr.Is4() == a.Is4() || s.Addr.IsUnspecified() && s.Addr.Is6()) {
+					continue
+				}
+				what := "another program"
+				for l := range jarldOn {
+					if strings.HasSuffix(l, ":"+strconv.Itoa(p)) {
+						what = "jarld (Jarl's web UI and API)"
+					}
+				}
+				out = append(out, Conflict{Address: a.String(), Port: p, What: what})
+				break
+			}
+		}
+	}
+	return out, nil
+}
+
+// FreeDoHPort returns the first of the usual DoH ports nothing listens on
+// at the addresses (0 when none is free).
+func FreeDoHPort(st *model.State, addresses []string, jarld []string) int {
+	for _, p := range []int{443, 8443, 4443, 9443} {
+		if c, err := PortCheck(st, addresses, []int{p}, jarld); err == nil && len(c) == 0 {
+			return p
+		}
+	}
+	return 0
+}
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"sync/atomic"
 	"testing"
+	"time"

 	"jarl/internal/blocking"
 	"jarl/internal/model"
@@ -229,3 +230,70 @@ func TestBlocklistRefresh(t *testing.T) {
 		t.Error("the deleted list's status is still there")
 	}
 }
+
+func TestBlockingPause(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin, blocklist("ads", "https://example.org/list"))
+	rulesFile := filepath.Join(env.dir, "zones/_default/rules.jarl.invalid.rpz")
+	if _, err := os.Stat(rulesFile); !os.IsNotExist(err) {
+		t.Fatal("a rules zone without rules or a pause")
+	}
+	until := env.e.Now().Add(10 * time.Minute)
+	res := env.submit(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{Until: &until}))
+	if !strings.HasPrefix(res.Ops[0].Summary, "pause blocking until ") {
+		t.Errorf("summary = %q", res.Ops[0].Summary)
+	}
+	f, err := os.ReadFile(rulesFile)
+	if err != nil || !strings.HasSuffix(string(f), "NS\tlocalhost.\n*\tCNAME\trpz-passthru.\n") {
+		t.Fatalf("paused rules zone: %v\n%s", err, f)
+	}
+	conf, _ := os.ReadFile(filepath.Join(env.dir, "etc/named.conf"))
+	if !strings.Contains(string(conf), "zone \"rules.jarl.invalid\" min-update-interval 0 log no;\n\t\tzone \"ads.") {
+		t.Errorf("the paused rules zone must come first:\n%s", conf)
+	}
+	// Not yet time: nothing happens.
+	if got := env.e.ResumeBlocking(context.Background()); !got.Equal(until) {
+		t.Errorf("ResumeBlocking before the end = %v", got)
+	}
+	// Time is up: resumed, and the rules zone is gone again.
+	env.submit(env.admin, blockRule("ads.example", "block", false))
+	env.e.Now = func() time.Time { return until.Add(time.Second) }
+	if got := env.e.ResumeBlocking(context.Background()); !got.IsZero() || env.state().Settings.BlockingPausedUntil != nil {
+		t.Fatalf("after the pause: %v, %v", got, env.state().Settings.BlockingPausedUntil)
+	}
+	if f, _ := os.ReadFile(rulesFile); !strings.Contains(string(f), "*.ads.example\tCNAME\t.\n") || strings.Contains(string(f), "passthru") {
+		t.Errorf("rules zone after the pause:\n%s", f)
+	}
+	// Reverting a pause resumes blocking.
+	until = env.e.Now().Add(time.Hour)
+	res = env.submit(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{Until: &until}))
+	rev, err := env.e.Revert(context.Background(), res.ChangesetID, env.admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := env.e.Apply(context.Background(), rev.ID, env.admin, ApplyOptions{}); err != nil || env.state().Settings.BlockingPausedUntil != nil {
+		t.Errorf("revert of a pause: %v, %v", err, env.state().Settings.BlockingPausedUntil)
+	}
+	// Until resumed: jarld never ends it, a resume does.
+	res = env.submit(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{Indefinitely: true}))
+	if res.Ops[0].Summary != "pause blocking until resumed" || !env.state().Settings.BlockingPaused() {
+		t.Errorf("indefinite pause: %q", res.Ops[0].Summary)
+	}
+	if f, _ := os.ReadFile(rulesFile); !strings.Contains(string(f), "*\tCNAME\trpz-passthru.\n") {
+		t.Errorf("rules zone while paused indefinitely:\n%s", f)
+	}
+	env.e.Now = func() time.Time { return until.Add(1000 * time.Hour) }
+	if got := env.e.ResumeBlocking(context.Background()); !got.IsZero() || !env.state().Settings.BlockingPausedIndefinitely {
+		t.Errorf("an indefinite pause ended by itself: %v", got)
+	}
+	env.submit(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{}))
+	if env.state().Settings.BlockingPaused() {
+		t.Error("resume didn't end an indefinite pause")
+	}
+	// At most a day.
+	long := env.e.Now().Add(48 * time.Hour)
+	if e := env.submitErr(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{Until: &long})); e.Kind != KindBadRequest {
+		t.Errorf("a two-day pause: %+v", e)
+	}
+}
@@ -78,7 +78,7 @@ func (e *Engine) RefreshDue(ctx context.Context) {
 		e.log.Warn("blocklists: loading their status failed", "err", err)
 		return
 	}
-	out := render.Render(st, e.cfg.Paths, e.cfg.Extras)
+	out := render.Render(st, e.cfg.Paths, e.extras(ctx))
 	if err := e.ensureBlocklistFiles(out.Blocklists); err != nil {
 		e.log.Warn("blocklists: creating empty zone files failed", "err", err)
 	}
@@ -335,7 +335,9 @@ func (l *limitedReader) Read(p []byte) (int, error) {

 // CheckBlocking reports, for every view with blocking, whether name is
 // blocked or allowed there, and by which rule or list. It looks names up
-// the way named does: rules first, then the lists in order.
+// the way named does: rules first, then the lists in order. The answer is
+// for clients at the normal step; a list of a higher step that blocks the
+// name says so (Match.Step), and clients at step off skip every list.
 func (e *Engine) CheckBlocking(st *model.State, name string) ([]blocking.Match, error) {
 	n, err := blocking.NormalizeName(name)
 	if err != nil {
@@ -349,8 +351,8 @@ func (e *Engine) CheckBlocking(st *model.State, name string) ([]blocking.Match,
 			out = append(out, blocking.Match{View: z.View, Result: "none"})
 			cur = &out[len(out)-1]
 		}
-		if cur.Result != "none" {
-			continue // an earlier zone decided
+		if cur.Result != "none" || z.IsGate() {
+			continue // an earlier zone decided, or a gate (it never blocks)
 		}
 		if z.ListID == 0 {
 			owner, act, ok := blocking.MatchRules(blocking.RuleEntries(render.ViewRules(st, z.ViewID)), n)
@@ -372,7 +374,11 @@ func (e *Engine) CheckBlocking(st *model.State, name string) ([]blocking.Match,
 			feeds[z.File] = entry
 		}
 		if entry != "" {
-			cur.Result, cur.Entry, cur.List = "blocked", entry, st.Blocklists[z.ListID].Name
+			b := st.Blocklists[z.ListID]
+			cur.Result, cur.Entry, cur.List = "blocked", entry, b.Name
+			if b.StepID != model.StepNormal {
+				cur.Step = st.StepName(b.StepID)
+			}
 		}
 	}
 	return out, nil
@@ -1,12 +1,14 @@
 package engine

 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/url"
 	"regexp"
 	"slices"
 	"strings"
+	"time"

 	"jarl/internal/auth"
 	"jarl/internal/blocking"
@@ -115,6 +117,16 @@ func applyBlocklistPut(st *model.State, op model.Op, c *applyCtx) error {
 	if in.Disabled != nil {
 		b.Disabled = *in.Disabled
 	}
+	step, given, err := stepRef(st, in.Step, in.StepID)
+	if err != nil {
+		return err
+	}
+	if given {
+		if step == model.StepOff {
+			return errf(KindBadRequest, "a blocklist starts at normal or a step above it, not off")
+		}
+		b.StepID = step
+	}
 	if in.Comment != nil {
 		b.Comment = *in.Comment
 	}
@@ -224,6 +236,11 @@ func blockingUsers(st *model.State, viewID int64) []string {
 			out = append(out, ruleLabel(r))
 		}
 	}
+	for _, g := range st.SortedClientGroups() {
+		if slices.Contains(g.ViewIDs, viewID) {
+			out = append(out, "client group "+g.Name)
+		}
+	}
 	return out
 }

@@ -270,3 +287,41 @@ func (x *expander) blockRuleCreate(req Request) ([]model.Op, error) {
 		return ruleLabel(r), nil
 	})
 }
+
+func applyBlockingPause(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	var in BlockingPauseInput
+	if err := decode(op.Data, &in); err != nil {
+		return err
+	}
+	if in.Until != nil && in.Until.Sub(c.now) > MaxBlockingPause+time.Minute {
+		return errf(KindBadRequest, "blocking can be paused for at most %s, or until it is resumed", MaxBlockingPause)
+	}
+	if in.Indefinitely && in.Until != nil {
+		return errf(KindBadRequest, "a pause is either until a time or until resumed, not both")
+	}
+	st.Settings.BlockingPausedUntil = in.Until
+	st.Settings.BlockingPausedIndefinitely = in.Indefinitely
+	return nil
+}
+
+// ResumeBlocking ends a pause whose time is up, and returns when the
+// current pause ends (zero when blocking isn't paused).
+func (e *Engine) ResumeBlocking(ctx context.Context) time.Time {
+	st, err := e.store.LoadState(ctx)
+	if err != nil || st.Settings.BlockingPausedUntil == nil {
+		return time.Time{}
+	}
+	until := *st.Settings.BlockingPausedUntil
+	if e.Now().Before(until) {
+		return until
+	}
+	if _, err := e.Submit(ctx, []Request{NewRequest(OpBlockingPause, 0, BlockingPauseInput{})}, auth.System, "system", "resume blocking after the pause", ApplyOptions{}); err != nil {
+		e.log.Warn("resuming blocking after the pause failed; it will be tried again", "err", err)
+		return e.Now().Add(time.Minute)
+	}
+	e.log.Info("blocking resumed after the pause")
+	return time.Time{}
+}
@@ -0,0 +1,270 @@
+package engine
+
+import (
+	"encoding/json"
+	"net/netip"
+	"strings"
+
+	"jarl/internal/iprange"
+	"jarl/internal/model"
+)
+
+// ---- blocking steps and client groups (docs/blocking.md)
+
+// stepRef resolves a step given by name or ID. ok is false when neither
+// is given.
+func stepRef(st *model.State, name *string, id *int64) (int64, bool, error) {
+	switch {
+	case name != nil:
+		s, found := st.StepByName(*name)
+		if !found {
+			return 0, true, errf(KindBadRequest, "blocking step %q does not exist (steps: %s)", *name, stepNames(st))
+		}
+		return s, true, nil
+	case id != nil:
+		if _, found := st.StepRank(*id); !found {
+			return 0, true, errf(KindBadRequest, "blocking step %d does not exist", *id)
+		}
+		return *id, true, nil
+	}
+	return 0, false, nil
+}
+
+// stepNames lists the steps for messages: "off, normal, strict".
+func stepNames(st *model.State) string {
+	names := []string{"off", "normal"}
+	for _, s := range st.OrderedBlockSteps() {
+		names = append(names, s.Name)
+	}
+	return strings.Join(names, ", ")
+}
+
+// NormalizeMember checks a client group member: an address, a prefix or
+// an ACL name (an ACL's own elements are checked by validation). It
+// returns the canonical form.
+func NormalizeMember(st *model.State, m string) (string, error) {
+	m = strings.TrimSpace(m)
+	if a, err := netip.ParseAddr(m); err == nil {
+		if a.Zone() != "" {
+			return "", errf(KindBadRequest, "%q: an address with a zone can't be matched", m)
+		}
+		return a.Unmap().String(), nil
+	}
+	if p, err := netip.ParsePrefix(m); err == nil {
+		return p.Masked().String(), nil
+	}
+	if r, ok, err := iprange.Parse(m); ok {
+		if err != nil {
+			return "", errf(KindBadRequest, "%v", err)
+		}
+		return r.String(), nil
+	}
+	if a := st.ACLByName(m); a != nil {
+		return a.Name, nil
+	}
+	return "", errf(KindBadRequest, "%q is not an address, a prefix (10.10.0.0/24), a range (10.10.0.20-10.10.0.49) or an ACL", m)
+}
+
+func applyBlockStepPut(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	var in BlockStepInput
+	if err := decode(op.Data, &in); err != nil {
+		return err
+	}
+	var s *model.BlockStep
+	if op.Kind == OpBlockStepCreate {
+		if op.ID <= 0 || st.BlockSteps[op.ID] != nil {
+			return errf(KindConflict, "step ID %d is already in use", op.ID)
+		}
+		if in.Name == nil {
+			return errf(KindBadRequest, "a blocking step needs a name")
+		}
+		pos := 0
+		for _, o := range st.BlockSteps {
+			pos = max(pos, o.Position+1)
+		}
+		s = &model.BlockStep{ID: op.ID, Position: pos}
+	} else {
+		s = st.BlockSteps[op.ID]
+		if s == nil {
+			return errf(KindNotFound, "blocking step %d does not exist", op.ID)
+		}
+		if err := checkVersion(op, s.Version, "step "+s.Name); err != nil {
+			return err
+		}
+	}
+	if in.Name != nil {
+		name := strings.ToLower(strings.TrimSpace(*in.Name))
+		if !blocklistNameRe.MatchString(name) || name == "off" || name == "normal" {
+			return errf(KindBadRequest, "step name %q: use 1 to 40 lowercase letters, digits and hyphens, like strict (off and normal are built in)", *in.Name)
+		}
+		if id, found := st.StepByName(name); found && id != s.ID {
+			return errf(KindConflict, "step %s already exists", name)
+		}
+		s.Name = name
+	}
+	if in.Position != nil {
+		s.Position = *in.Position
+	}
+	if in.Comment != nil {
+		s.Comment = *in.Comment
+	}
+	s.Touch(c.user(), c.now)
+	st.BlockSteps[s.ID] = s
+	return nil
+}
+
+func applyBlockStepDelete(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	s := st.BlockSteps[op.ID]
+	if s == nil {
+		return errf(KindNotFound, "blocking step %d does not exist", op.ID)
+	}
+	if err := checkVersion(op, s.Version, "step "+s.Name); err != nil {
+		return err
+	}
+	if users := stepUsers(st, s.ID); len(users) > 0 {
+		return errf(KindConflict, "step %s is used by %s; move them to another step first", s.Name, strings.Join(users, ", "))
+	}
+	delete(st.BlockSteps, s.ID)
+	return nil
+}
+
+// stepUsers lists the blocklists and client groups at a step.
+func stepUsers(st *model.State, id int64) []string {
+	var out []string
+	for _, b := range st.SortedBlocklists() {
+		if b.StepID == id {
+			out = append(out, "blocklist "+b.Name)
+		}
+	}
+	for _, g := range st.SortedClientGroups() {
+		if g.StepID == id {
+			out = append(out, "client group "+g.Name)
+		}
+	}
+	return out
+}
+
+func applyClientGroupPut(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	var in ClientGroupInput
+	if err := decode(op.Data, &in); err != nil {
+		return err
+	}
+	var g *model.ClientGroup
+	if op.Kind == OpClientGroupCreate {
+		if op.ID <= 0 || st.ClientGroups[op.ID] != nil {
+			return errf(KindConflict, "client group ID %d is already in use", op.ID)
+		}
+		if in.Name == nil {
+			return errf(KindBadRequest, "a client group needs a name")
+		}
+		g = &model.ClientGroup{ID: op.ID, Members: []string{}, StepID: model.StepNormal, ViewIDs: []int64{}}
+	} else {
+		g = st.ClientGroups[op.ID]
+		if g == nil {
+			return errf(KindNotFound, "client group %d does not exist", op.ID)
+		}
+		if err := checkVersion(op, g.Version, "client group "+g.Name); err != nil {
+			return err
+		}
+	}
+	if in.Name != nil {
+		name := strings.ToLower(strings.TrimSpace(*in.Name))
+		if !blocklistNameRe.MatchString(name) {
+			return errf(KindBadRequest, "client group name %q: use 1 to 40 lowercase letters, digits and hyphens, like kids", *in.Name)
+		}
+		if other := st.ClientGroupByName(name); other != nil && other.ID != g.ID {
+			return errf(KindConflict, "client group %s already exists", name)
+		}
+		g.Name = name
+	}
+	if in.Members != nil {
+		members := []string{}
+		seen := map[string]bool{}
+		for _, m := range *in.Members {
+			if strings.TrimSpace(m) == "" {
+				continue
+			}
+			n, err := NormalizeMember(st, m)
+			if err != nil {
+				return err
+			}
+			if !seen[n] {
+				seen[n] = true
+				members = append(members, n)
+			}
+		}
+		g.Members = members
+	}
+	step, given, err := stepRef(st, in.Step, in.StepID)
+	if err != nil {
+		return err
+	}
+	if given {
+		g.StepID = step
+	}
+	ids, err := viewIDs(st, in.Views, in.ViewIDs)
+	if err != nil {
+		return err
+	}
+	if ids != nil {
+		g.ViewIDs = ids
+	}
+	if in.Comment != nil {
+		g.Comment = *in.Comment
+	}
+	g.Touch(c.user(), c.now)
+	st.ClientGroups[g.ID] = g
+	return nil
+}
+
+func applyClientGroupDelete(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	g := st.ClientGroups[op.ID]
+	if g == nil {
+		return errf(KindNotFound, "client group %d does not exist", op.ID)
+	}
+	if err := checkVersion(op, g.Version, "client group "+g.Name); err != nil {
+		return err
+	}
+	delete(st.ClientGroups, g.ID)
+	return nil
+}
+
+// ---- expansion
+
+func (x *expander) blockStepCreate(req Request) ([]model.Op, error) {
+	return x.simpleCreate(req, OpBlockStepCreate, func(data json.RawMessage) (string, error) {
+		var in BlockStepInput
+		if err := decode(data, &in); err != nil {
+			return "", err
+		}
+		if in.Name == nil {
+			return "", errf(KindBadRequest, "a blocking step needs a name")
+		}
+		return "add blocking step " + strings.ToLower(*in.Name), nil
+	})
+}
+
+func (x *expander) clientGroupCreate(req Request) ([]model.Op, error) {
+	return x.simpleCreate(req, OpClientGroupCreate, func(data json.RawMessage) (string, error) {
+		var in ClientGroupInput
+		if err := decode(data, &in); err != nil {
+			return "", err
+		}
+		if in.Name == nil {
+			return "", errf(KindBadRequest, "a client group needs a name")
+		}
+		return "add client group " + strings.ToLower(*in.Name), nil
+	})
+}
@@ -0,0 +1,123 @@
+package engine
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+)
+
+func clientGroup(name, step string, members ...string) Request {
+	return NewRequest(OpClientGroupCreate, 0, ClientGroupInput{Name: &name, Step: &step, Members: &members})
+}
+
+func TestClientGroups(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	_, srv := newListServer(t, "||ads.example^\n")
+	env.submit(env.admin,
+		NewRequest(OpBlockStepCreate, 0, BlockStepInput{Name: model.Ptr("strict")}),
+		NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("tablets"), Elements: &[]string{"10.0.0.50", "10.0.0.51"}}),
+	)
+	env.submit(env.admin,
+		blocklist("ads", srv.URL+"/a.txt"),
+		NewRequest(OpBlocklistCreate, 0, BlocklistInput{Name: model.Ptr("social"), URL: model.Ptr(srv.URL + "/s.txt"), Step: model.Ptr("strict")}),
+		clientGroup("work", "off", "10.0.0.20"),
+		clientGroup("kids", "strict", "tablets", "2001:db8:1::/64"),
+	)
+	conf, _ := os.ReadFile(filepath.Join(env.dir, "etc/named.conf"))
+	c := string(conf)
+	// Off clients pass before the normal lists, everyone below strict
+	// before the strict ones; gates aren't logged.
+	want := "response-policy {\n" +
+		"\t\tzone \"off.gate.jarl.invalid\" min-update-interval 0 log no;\n" +
+		"\t\tzone \"ads.blocklist.jarl.invalid\" min-update-interval 0 log no;\n" +
+		"\t\tzone \"strict.gate.jarl.invalid\" min-update-interval 0 log no;\n" +
+		"\t\tzone \"social.blocklist.jarl.invalid\" min-update-interval 0 log no;\n"
+	if !strings.Contains(c, want) {
+		t.Errorf("response-policy:\n%s", c)
+	}
+	gate := func(name string) string {
+		b, err := os.ReadFile(filepath.Join(env.dir, "zones/_default", name+".gate.jarl.invalid.rpz"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		return string(b)
+	}
+	if g := gate("off"); !strings.Contains(g, "32.20.0.0.10.rpz-client-ip\tCNAME\trpz-passthru.\n") || strings.Count(g, "rpz-client-ip") != 1 {
+		t.Errorf("off gate:\n%s", g)
+	}
+	// Everyone but the kids' tablets (via the ACL) and network passes.
+	sg := gate("strict")
+	for _, notIn := range []string{"32.50.0.0.10.rpz-client-ip", "32.51.0.0.10.rpz-client-ip", "64.zz.1.db8.2001.rpz-client-ip"} {
+		if strings.Contains(sg, notIn) {
+			t.Errorf("strict gate lets %s through:\n%s", notIn, sg)
+		}
+	}
+	// 10.0.0.0/27 holds the work laptop, 10.0.0.52/30 the next addresses
+	// after the tablets, 128.0.0.0/1 the upper half of IPv4.
+	for _, in := range []string{"27.0.0.0.10.rpz-client-ip", "30.52.0.0.10.rpz-client-ip", "1.0.0.0.128.rpz-client-ip"} {
+		if !strings.Contains(sg, in) {
+			t.Errorf("strict gate lacks %s:\n%s", in, sg)
+		}
+	}
+
+	st := env.state()
+	strict, _ := st.StepByName("strict")
+	// A step that lists or groups use can't be deleted.
+	if e := env.submitErr(env.admin, NewRequest(OpBlockStepDelete, strict, nil)); e.Kind != KindConflict || !strings.Contains(e.Message, "blocklist social") {
+		t.Errorf("deleting a used step: %+v", e)
+	}
+	// One client, one group; ACLs must hold addresses only.
+	if e := env.submitErr(env.admin, clientGroup("dup", "normal", "10.0.0.20")); e.Kind != KindValidation || !strings.Contains(e.Message, "10.0.0.20/32 is in client groups") {
+		t.Errorf("an address in two groups: %+v", e)
+	}
+	env.submit(env.admin, NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("keyed"), Elements: &[]string{"localnets"}}))
+	if e := env.submitErr(env.admin, clientGroup("bad", "normal", "keyed")); e.Kind != KindValidation || !strings.Contains(e.Message, "isn't an address") {
+		t.Errorf("an ACL with a key: %+v", e)
+	}
+	for _, req := range []Request{clientGroup("x", "nope", "10.1.1.1"), clientGroup("y", "normal", "not-an-acl"), clientGroup("Bad Name", "normal")} {
+		if e := env.submitErr(env.admin, req); e.Kind != KindBadRequest {
+			t.Errorf("%s: %+v", req.Data, e)
+		}
+	}
+	// A more specific address in another group is fine: it wins.
+	env.submit(env.admin, clientGroup("guest", "normal", "2001:db8:1::9"))
+	if sg := gate("strict"); !strings.Contains(sg, "128.9.zz.1.db8.2001.rpz-client-ip") {
+		t.Errorf("the guest inside the kids' network passes the strict gate:\n%s", sg)
+	}
+
+	// The kids' group gone: the strict list blocks nobody (a warning).
+	kids := env.state().ClientGroupByName("kids")
+	res := env.submit(env.admin, NewRequest(OpClientGroupDelete, kids.ID, nil))
+	found := false
+	for _, p := range res.Problems {
+		found = found || p.Code == "blocklist_step_unused"
+	}
+	if !found {
+		t.Errorf("no warning for a step no group reaches: %+v", res.Problems)
+	}
+	// Reverting brings it back.
+	rev, err := env.e.Revert(context.Background(), res.ChangesetID, env.admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rev.Ops) != 1 {
+		t.Errorf("revert ops: %+v (only the deleted group should come back)", rev.Ops)
+	}
+	if _, err := env.e.Apply(context.Background(), rev.ID, env.admin, ApplyOptions{}); err != nil || env.state().ClientGroupByName("kids") == nil {
+		t.Fatalf("revert: %v", err)
+	}
+	// Renaming the ACL renames the member; deleting it is refused.
+	tablets := env.state().ACLByName("tablets")
+	env.submit(env.admin, NewRequest(OpACLUpdate, tablets.ID, ACLInput{Name: model.Ptr("pads")}))
+	if g := env.state().ClientGroupByName("kids"); g.Members[0] != "pads" {
+		t.Errorf("ACL rename: members %v", g.Members)
+	}
+	if e := env.submitErr(env.admin, NewRequest(OpACLDelete, tablets.ID, nil)); e.Kind != KindConflict || !strings.Contains(e.Message, "client group kids") {
+		t.Errorf("deleting an ACL a group uses: %+v", e)
+	}
+}
@@ -335,5 +335,8 @@ func fileDiff(path string, old []byte, existed bool, new []byte, removed, secret
 	if d != "" && !strings.HasSuffix(d, "\n") {
 		d += "\n"
 	}
+	if strings.HasSuffix(path, ".conf") {
+		d = labelHunks(d, string(old), string(new))
+	}
 	return d
 }
@@ -0,0 +1,136 @@
+package engine
+
+import (
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// hunkHeader matches a unified diff hunk header; the line counts are left
+// out when they are 1.
+var hunkHeader = regexp.MustCompile(`^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@$`)
+
+// labelHunks adds the blocks a hunk's first change is in to its header,
+// like git does with function names, so a change to named.conf says where
+// it is:
+//
+//	@@ -50,6 +49,8 @@ view "internal" {
+//
+// Removed lines are looked up in the old file, added ones in the new.
+func labelHunks(diff, old, new string) string {
+	if !strings.Contains(diff, "\n@@ ") {
+		return diff
+	}
+	oldCtx, newCtx := blockContext(old), blockContext(new)
+	lines := strings.SplitAfter(diff, "\n")
+	for i, line := range lines {
+		m := hunkHeader.FindStringSubmatch(strings.TrimSuffix(line, "\n"))
+		if m == nil {
+			continue
+		}
+		o, _ := strconv.Atoi(m[1])
+		n, _ := strconv.Atoi(m[2])
+		label := ""
+	hunk:
+		for _, l := range lines[i+1:] {
+			switch {
+			case strings.HasPrefix(l, "-"):
+				label = at(oldCtx, o)
+				break hunk
+			case strings.HasPrefix(l, "+"):
+				label = at(newCtx, n)
+				break hunk
+			case strings.HasPrefix(l, " "):
+				o, n = o+1, n+1
+			case strings.HasPrefix(l, `\`):
+			default:
+				break hunk
+			}
+		}
+		if label != "" {
+			lines[i] = strings.TrimSuffix(line, "\n") + " " + label + "\n"
+		}
+	}
+	return strings.Join(lines, "")
+}
+
+// at returns the context of line n (1-based), or "".
+func at(ctx []string, n int) string {
+	if n < 1 || n > len(ctx) {
+		return ""
+	}
+	return ctx[n-1]
+}
+
+// blockContext returns, for each line of a named.conf file, the blocks
+// open at its start: `view "internal" { zone "example.com" {`, or "" at
+// the top level. It knows named.conf's strings and comments.
+func blockContext(text string) []string {
+	var (
+		out     []string
+		stack   []string
+		stmt    strings.Builder // the current statement, up to a { or ;
+		inStr   bool
+		inBlock bool // in a /* */ comment
+	)
+	label := func() string {
+		if len(stack) == 0 {
+			return ""
+		}
+		return strings.Join(stack, " { ") + " {"
+	}
+	for _, line := range strings.SplitAfter(text, "\n") {
+		if line == "" {
+			continue
+		}
+		out = append(out, label())
+		for i := 0; i < len(line); i++ {
+			c := line[i]
+			switch {
+			case inBlock:
+				if c == '*' && i+1 < len(line) && line[i+1] == '/' {
+					inBlock = false
+					i++
+				}
+			case inStr:
+				stmt.WriteByte(c)
+				if c == '\\' && i+1 < len(line) {
+					stmt.WriteByte(line[i+1])
+					i++
+				} else if c == '"' {
+					inStr = false
+				}
+			case c == '"':
+				inStr = true
+				stmt.WriteByte(c)
+			case c == '#' || c == '/' && i+1 < len(line) && line[i+1] == '/':
+				i = len(line) // a comment to the end of the line
+			case c == '/' && i+1 < len(line) && line[i+1] == '*':
+				inBlock = true
+				i++
+			case c == '{':
+				stack = append(stack, shortLabel(stmt.String()))
+				stmt.Reset()
+			case c == '}':
+				if len(stack) > 0 {
+					stack = stack[:len(stack)-1]
+				}
+				stmt.Reset()
+			case c == ';':
+				stmt.Reset()
+			default:
+				stmt.WriteByte(c)
+			}
+		}
+	}
+	return out
+}
+
+// shortLabel tidies the text before a { for a hunk header.
+func shortLabel(s string) string {
+	s = strings.Join(strings.Fields(s), " ")
+	if len(s) > 60 {
+		s = s[:57] + "..."
+	}
+	return s
+}
@@ -0,0 +1,63 @@
+package engine
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestLabelHunks(t *testing.T) {
+	old := `// header
+options {
+	directory "/var/cache/bind";
+	forwarders { 1.1.1.1; 9.9.9.9; };
+	listen-on { any; };
+	recursion no;
+	version "a { b"; # a { in a string and comments: /* {
+	dnssec-validation auto;
+};
+
+view "internal" {
+	match-clients { 10.0.0.0/8; };
+	recursion yes;
+	allow-transfer { localhost; };
+	/* a { comment
+	   over lines */
+	zone "example.com" {
+		type primary;
+		file "example.com.db";
+		notify yes;
+	};
+	zone "other.example" { type primary; file "o.db"; };
+};
+`
+	new := strings.Replace(old, "\tforwarders { 1.1.1.1; 9.9.9.9; };\n", "", 1)
+	new = strings.Replace(new, "\tallow-transfer { localhost; };\n", "\tallow-transfer { localhost; };\n\tforward first;\n\tforwarders { 1.1.1.1; 9.9.9.9; };\n", 1)
+	new = strings.Replace(new, "\t\tnotify yes;\n", "\t\tnotify no;\n", 1)
+	d := fileDiff("/etc/bind/named.conf", []byte(old), true, []byte(new), false, false)
+	var headers []string
+	for _, l := range strings.Split(d, "\n") {
+		if strings.HasPrefix(l, "@@") {
+			headers = append(headers, l)
+		}
+	}
+	want := []string{
+		`@@ -1,7 +1,6 @@ options {`,
+		`@@ -12,12 +11,14 @@ view "internal" {`,
+	}
+	if strings.Join(headers, "\n") != strings.Join(want, "\n") {
+		t.Errorf("headers:\n%s\n\ndiff:\n%s", strings.Join(headers, "\n"), d)
+	}
+
+	// The first change of a hunk decides, and a change inside a zone
+	// names both blocks.
+	new2 := strings.Replace(old, "\t\tnotify yes;\n", "\t\tnotify no;\n", 1)
+	d = fileDiff("/etc/bind/named.conf", []byte(old), true, []byte(new2), false, false)
+	if !strings.Contains(d, ` @@ view "internal" { zone "example.com" {`+"\n") {
+		t.Errorf("zone change:\n%s", d)
+	}
+	// Zone files aren't named.conf syntax.
+	d = fileDiff("/var/lib/bind/example.com.db", []byte(old), true, []byte(new2), false, false)
+	if strings.Contains(d, "@@ view") {
+		t.Errorf("zone file labelled:\n%s", d)
+	}
+}
@@ -3,6 +3,7 @@ package engine
 import (
 	"fmt"
 	"reflect"
+	"slices"
 	"sort"

 	"jarl/internal/dnsname"
@@ -17,10 +18,14 @@ func DiffOps(from, to *model.State) []model.Op {
 	add := func(kind string, id int64, base int, data any, summary string) {
 		ops = append(ops, newOp(kind, id, base, data, summary))
 	}
+	if !reflect.DeepEqual(from.Settings.BlockingPausedUntil, to.Settings.BlockingPausedUntil) || from.Settings.BlockingPausedIndefinitely != to.Settings.BlockingPausedIndefinitely {
+		add(OpBlockingPause, 0, 0, BlockingPauseInput{Until: to.Settings.BlockingPausedUntil, Indefinitely: to.Settings.BlockingPausedIndefinitely}, map[bool]string{true: "pause blocking", false: "resume blocking"}[to.Settings.BlockingPaused()])
+	}
 	if !reflect.DeepEqual(stripVersion(from.Settings), stripVersion(to.Settings)) {
 		s := to.Settings
 		add(OpSettingsUpdate, 0, 0, SettingsInput{DefaultTTL: &s.DefaultTTL, Nameservers: model.Ptr(append([]string{}, s.Nameservers...)), RName: &s.RName,
-			Refresh: &s.Refresh, Retry: &s.Retry, Expire: &s.Expire, NegativeTTL: &s.NegativeTTL, SerialPolicy: &s.SerialPolicy}, "restore settings")
+			Refresh: &s.Refresh, Retry: &s.Retry, Expire: &s.Expire, NegativeTTL: &s.NegativeTTL, SerialPolicy: &s.SerialPolicy,
+			Exposure: &s.Exposure, Acknowledged: model.Ptr(slices.Clone(s.Acknowledged))}, "restore settings")
 	}

 	for _, k := range sortedKeys(to.Keys) {
@@ -44,7 +49,8 @@ func DiffOps(from, to *model.State) []model.Op {
 	for _, k := range sortedKeys(to.Views) {
 		n := to.Views[k]
 		in := ViewInput{Name: &n.Name, MatchClients: model.Ptr(append([]string{}, n.MatchClients...)),
-			MatchDestinations: model.Ptr(append([]string{}, n.MatchDestinations...)), Comment: &n.Comment, Position: model.Ptr(n.Position)}
+			MatchDestinations: model.Ptr(append([]string{}, n.MatchDestinations...)), Comment: &n.Comment, Position: model.Ptr(n.Position),
+			Exposure: model.Ptr(n.Exposure), Acknowledged: model.Ptr(slices.Clone(n.Acknowledged))}
 		if n.MatchRecursiveOnly != nil {
 			in.MatchRecursiveOnly = model.Some(*n.MatchRecursiveOnly)
 		} else {
@@ -60,7 +66,7 @@ func DiffOps(from, to *model.State) []model.Op {
 		n := to.Zones[k]
 		s := n.SOA
 		in := ZoneInput{Name: &n.Name, ViewID: &n.ViewID, Type: &n.Type, InView: &n.InView, File: &n.File,
-			DefaultTTL: &n.DefaultTTL, SerialPolicy: &n.SerialPolicy, DNSSECPolicy: &n.DNSSECPolicy, Comment: &n.Comment}
+			DefaultTTL: &n.DefaultTTL, SerialPolicy: &n.SerialPolicy, DNSSECPolicy: &n.DNSSECPolicy, Comment: &n.Comment, Disabled: &n.Disabled, LinkGroup: model.Ptr(n.LinkGroup)}
 		if n.Type == model.ZonePrimary {
 			in.SOA = &SOAInput{MName: &s.MName, RName: &s.RName, Serial: &s.Serial, Refresh: &s.Refresh, Retry: &s.Retry, Expire: &s.Expire, Minimum: &s.Minimum}
 		}
@@ -88,7 +94,7 @@ func DiffOps(from, to *model.State) []model.Op {
 	}
 	for _, k := range sortedKeys(to.Records) {
 		n := to.Records[k]
-		in := RecordInput{ZoneID: n.ZoneID, Name: &n.Name, Type: &n.Type, Data: &n.Data, Comment: &n.Comment, Disabled: &n.Disabled}
+		in := RecordInput{ZoneID: n.ZoneID, Name: &n.Name, Type: &n.Type, Data: &n.Data, Comment: &n.Comment, Disabled: &n.Disabled, SharedID: model.Ptr(n.SharedID)}
 		if n.TTL != nil {
 			in.TTL = model.Some(*n.TTL)
 		} else {
@@ -101,9 +107,19 @@ func DiffOps(from, to *model.State) []model.Op {
 			add(OpRecordUpdate, k, o.Version, in, fmt.Sprintf("restore %s %s %s", n.Name, n.Type, n.Data))
 		}
 	}
+	// Steps before the lists and groups that use them.
+	for _, k := range sortedKeys(to.BlockSteps) {
+		n := to.BlockSteps[k]
+		in := BlockStepInput{Name: &n.Name, Position: model.Ptr(n.Position), Comment: &n.Comment}
+		if o, ok := from.BlockSteps[k]; !ok {
+			add(OpBlockStepCreate, k, 0, in, "add blocking step "+n.Name)
+		} else if !sameObject(o, n) {
+			add(OpBlockStepUpdate, k, o.Version, in, "restore blocking step "+n.Name)
+		}
+	}
 	for _, k := range sortedKeys(to.Blocklists) {
 		n := to.Blocklists[k]
-		in := BlocklistInput{Name: &n.Name, URL: &n.URL, ViewIDs: model.Ptr(append([]int64{}, n.ViewIDs...)), Disabled: &n.Disabled, Comment: &n.Comment}
+		in := BlocklistInput{Name: &n.Name, URL: &n.URL, ViewIDs: model.Ptr(append([]int64{}, n.ViewIDs...)), Disabled: &n.Disabled, Comment: &n.Comment, StepID: model.Ptr(n.StepID)}
 		if o, ok := from.Blocklists[k]; !ok {
 			add(OpBlocklistCreate, k, 0, in, "add blocklist "+n.Name)
 		} else if !sameObject(o, n) {
@@ -119,7 +135,21 @@ func DiffOps(from, to *model.State) []model.Op {
 			add(OpBlockRuleUpdate, k, o.Version, in, "restore rule: "+ruleLabel(n))
 		}
 	}
+	for _, k := range sortedKeys(to.ClientGroups) {
+		n := to.ClientGroups[k]
+		in := ClientGroupInput{Name: &n.Name, Members: model.Ptr(append([]string{}, n.Members...)), StepID: model.Ptr(n.StepID), ViewIDs: model.Ptr(append([]int64{}, n.ViewIDs...)), Comment: &n.Comment}
+		if o, ok := from.ClientGroups[k]; !ok {
+			add(OpClientGroupCreate, k, 0, in, "add client group "+n.Name)
+		} else if !sameObject(o, n) {
+			add(OpClientGroupUpdate, k, o.Version, in, "restore client group "+n.Name)
+		}
+	}
 	// Deletions, most dependent objects first.
+	for _, k := range sortedKeys(from.ClientGroups) {
+		if _, ok := to.ClientGroups[k]; !ok {
+			add(OpClientGroupDelete, k, from.ClientGroups[k].Version, nil, "delete client group "+from.ClientGroups[k].Name)
+		}
+	}
 	for _, k := range sortedKeys(from.BlockRules) {
 		if _, ok := to.BlockRules[k]; !ok {
 			add(OpBlockRuleDelete, k, from.BlockRules[k].Version, nil, "delete rule: "+ruleLabel(from.BlockRules[k]))
@@ -130,6 +160,11 @@ func DiffOps(from, to *model.State) []model.Op {
 			add(OpBlocklistDelete, k, from.Blocklists[k].Version, nil, "delete blocklist "+from.Blocklists[k].Name)
 		}
 	}
+	for _, k := range sortedKeys(from.BlockSteps) {
+		if _, ok := to.BlockSteps[k]; !ok {
+			add(OpBlockStepDelete, k, from.BlockSteps[k].Version, nil, "delete blocking step "+from.BlockSteps[k].Name)
+		}
+	}
 	for _, k := range sortedKeys(from.Records) {
 		if _, ok := to.Records[k]; !ok {
 			o := from.Records[k]
@@ -184,6 +219,7 @@ func DiffOps(from, to *model.State) []model.Op {

 func stripVersion(s model.Settings) model.Settings {
 	s.Version = 0
+	s.BlockingPausedUntil, s.BlockingPausedIndefinitely = nil, false // their own operation
 	return s
 }

@@ -15,6 +15,7 @@ import (
 	"io/fs"
 	"log/slog"
 	"net/http"
+	"net/netip"
 	"os"
 	"path/filepath"
 	"slices"
@@ -56,6 +57,10 @@ type Config struct {
 	NoReload bool
 	// SkipCheck disables named-checkconf (only for tests without BIND).
 	SkipCheck bool
+	// LocalAddrs returns this host's addresses, for working out whether a
+	// server without views is reachable from the internet
+	// (docs/exposure.md). nil: none known.
+	LocalAddrs func() []netip.Addr
 }

 // Engine applies changesets.
@@ -73,6 +78,11 @@ type Engine struct {
 	blKick chan struct{} // a list was added or changed
 	HTTP   *http.Client  // for downloads; nil: a default client
 	Limits BlocklistLimits
+
+	namedCheck namedCheck // named-checkconf on the running configuration (namedwarn.go)
+
+	seedMu sync.Mutex
+	seed   []byte // the view keys' seed (viewkeys.go)
 }

 // New creates an engine.
@@ -105,17 +115,20 @@ type Result struct {
 	DryRun      bool               `json:"dry_run,omitempty"`
 	Valid       bool               `json:"valid"`
 	Problems    []validate.Problem `json:"problems"` // problems this change introduces
-	Existing    []validate.Problem `json:"existing_problems,omitempty"`
-	Check       []CheckMessage     `json:"check,omitempty"`
-	CheckOK     bool               `json:"check_ok"`
-	Diff        string             `json:"diff"`
-	Files       []string           `json:"files_changed"`
-	Serials     []SerialChange     `json:"serials,omitempty"`
-	Reloaded    []string           `json:"reloaded,omitempty"`
-	Warnings    []string           `json:"warnings,omitempty"`
-	Drift       []DriftEntry       `json:"drift,omitempty"`
-	Ops         []model.Op         `json:"ops,omitempty"`
-	Error       *Error             `json:"error,omitempty"`
+	// Risks are the introduced problems that open the server up; applying
+	// needs AcceptRisk (docs/exposure.md).
+	Risks    []validate.Problem `json:"risks,omitempty"`
+	Existing []validate.Problem `json:"existing_problems,omitempty"`
+	Check    []CheckMessage     `json:"check,omitempty"`
+	CheckOK  bool               `json:"check_ok"`
+	Diff     string             `json:"diff"`
+	Files    []string           `json:"files_changed"`
+	Serials  []SerialChange     `json:"serials,omitempty"`
+	Reloaded []string           `json:"reloaded,omitempty"`
+	Warnings []string           `json:"warnings,omitempty"`
+	Drift    []DriftEntry       `json:"drift,omitempty"`
+	Ops      []model.Op         `json:"ops,omitempty"`
+	Error    *Error             `json:"error,omitempty"`
 }

 // stored is what is kept in a changeset's result column.
@@ -133,6 +146,9 @@ type ApplyOptions struct {
 	Force bool
 	// NoReload writes the files without reloading named.
 	NoReload bool
+	// AcceptRisk confirms a change that opens the server up, such as an
+	// open resolver on a public view (validate.RiskCodes).
+	AcceptRisk bool
 	// wipeZone lets WipeDNSSEC switch signing off for this zone at once.
 	wipeZone int64
 }
@@ -175,7 +191,46 @@ func ValidateOptions(st *model.State) validate.Options {
 }

 func (e *Engine) validate(st *model.State) []validate.Problem {
-	return validate.State(st, ValidateOptions(st))
+	return validate.State(st, e.validateOptions(st))
+}
+
+func (e *Engine) validateOptions(st *model.State) validate.Options {
+	opts := ValidateOptions(st)
+	if e.cfg.LocalAddrs != nil {
+		opts.LocalAddrs = e.cfg.LocalAddrs()
+	}
+	return opts
+}
+
+// Validate checks a state as applying it would.
+func (e *Engine) Validate(st *model.State) []validate.Problem { return e.validate(st) }
+
+// Exposures says which views (or the server, without views) are
+// reachable from the internet, and why (docs/exposure.md).
+func (e *Engine) Exposures(st *model.State) []validate.Exposure {
+	return validate.Exposures(st, e.validateOptions(st))
+}
+
+// risks returns the introduced problems that open a public view (or a
+// public server) up: risky warnings that weren't there before at all. One
+// that was there already, acknowledged (taking the acknowledgement back)
+// or not, opens nothing new.
+func risks(before, introduced []validate.Problem, public map[string]bool) []validate.Problem {
+	type key struct {
+		code, objType, view string
+		id                  int64
+	}
+	had := map[key]bool{}
+	for _, p := range before {
+		had[key{p.Code, p.ObjectType, p.View, p.ObjectID}] = true
+	}
+	var out []validate.Problem
+	for _, p := range introduced {
+		if p.Severity == validate.Warning && validate.RiskCodes[p.Code] && public[p.View] && !had[key{p.Code, p.ObjectType, p.View, p.ObjectID}] {
+			out = append(out, p)
+		}
+	}
+	return out
 }

 // ---- changeset management
@@ -384,6 +439,8 @@ type plan struct {
 	base, work    *model.State
 	introduced    []validate.Problem
 	existing      []validate.Problem
+	before        []validate.Problem // the problems before the change
+	public        map[string]bool    // public views by name ("": the server), after the change
 	serials       []SerialChange
 	out           *render.Output
 	changed       []*render.File
@@ -414,6 +471,13 @@ func (pl *plan) files() []string {
 func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user string, opts ApplyOptions) (*plan, error) {
 	pl := &plan{base: base, work: work, verify: map[int64]uint32{}}
 	before := e.validate(base)
+	pl.before = before
+	pl.public = map[string]bool{}
+	for _, x := range e.Exposures(work) {
+		pl.public[x.View] = x.Public
+		// Server-wide findings (no view) count when anything is public.
+		pl.public[""] = pl.public[""] || x.Public
+	}
 	after := e.validate(work)
 	pl.introduced = append(validate.Introduced(before, after), e.dnssecChanges(base, work, opts)...)
 	introducedKeys := map[string]bool{}
@@ -435,7 +499,7 @@ func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user str
 		pl.introduced = append(pl.introduced, problems...)
 		return pl, nil
 	}
-	pl.out = render.Render(work, e.cfg.Paths, e.cfg.Extras)
+	pl.out = render.Render(work, e.cfg.Paths, e.extras(ctx))
 	deployed, err := e.store.DeployedFiles(ctx)
 	if err != nil {
 		return nil, err
@@ -471,18 +535,18 @@ func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user str
 	pl.diff = diff.String()

 	// Which zones named must reload, and which serials to verify.
-	baseOut := render.Render(base, e.cfg.Paths, e.cfg.Extras)
+	baseOut := render.Render(base, e.cfg.Paths, e.extras(ctx))
 	changedPaths := map[string]bool{}
 	for _, f := range pl.changed {
 		changedPaths[f.Path] = true
 	}
 	for _, z := range work.SortedZones() {
-		if z.Type != model.ZonePrimary {
-			continue
+		if z.Type != model.ZonePrimary || z.Disabled {
+			continue // disabled zones aren't in named: nothing to reload
 		}
 		path := pl.out.ZoneFiles[z.ID]
 		old := base.Zones[z.ID]
-		existedInNamed := old != nil && old.Type == model.ZonePrimary && baseOut.ZoneFiles[old.ID] == path
+		existedInNamed := old != nil && old.Type == model.ZonePrimary && !old.Disabled && baseOut.ZoneFiles[old.ID] == path
 		if !existedInNamed {
 			pl.newZones = true
 			pl.verify[z.ID] = z.SOA.Serial
@@ -496,13 +560,15 @@ func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user str
 	if len(work.Zones) != len(base.Zones) {
 		pl.configChanged = true
 	}
-	// Rules zones whose content changed. New ones come with a change to
-	// named.conf, and reconfig loads them.
+	// Rules zones and gates whose content changed. New ones come with a
+	// change to named.conf, and reconfig loads them.
 	for _, z := range pl.out.Policy {
 		if z.ListID != 0 || !changedPaths[z.File] {
 			continue
 		}
-		if slices.Contains(baseOut.Policy, z) {
+		if slices.ContainsFunc(baseOut.Policy, func(o render.PolicyZone) bool {
+			return o.Name == z.Name && o.ViewID == z.ViewID && o.File == z.File
+		}) {
 			pl.reloadPolicy = append(pl.reloadPolicy, z)
 		}
 	}
@@ -527,7 +593,7 @@ func (e *Engine) stagingCheck(ctx context.Context, pl *plan) error {
 	}
 	defer os.RemoveAll(dir)
 	sp := render.Paths{ConfigDir: filepath.Join(dir, "config"), ZoneDir: filepath.Join(dir, "zones"), CacheDir: filepath.Join(dir, "cache")}
-	sout := render.Render(pl.work, sp, e.cfg.Extras)
+	sout := render.Render(pl.work, sp, e.extras(ctx))
 	for _, d := range sout.Dirs {
 		if err := os.MkdirAll(d, 0o750); err != nil {
 			return err
@@ -645,6 +711,7 @@ func (pl *plan) result() *Result {
 		Files:    pl.files(),
 		Serials:  pl.serials,
 		Drift:    pl.drift,
+		Risks:    risks(pl.before, pl.introduced, pl.public),
 	}
 	r.Valid = r.Valid && r.CheckOK
 	if r.Files == nil {
@@ -774,6 +841,13 @@ func (e *Engine) applyOps(ctx context.Context, cs *model.Changeset, reqs []Reque
 	if opts.DryRun {
 		return res, nil
 	}
+	if rs := risks(pl.before, pl.introduced, pl.public); len(rs) > 0 && !opts.AcceptRisk {
+		msg := rs[0].Message
+		if len(rs) > 1 {
+			msg += fmt.Sprintf(" (and %d more)", len(rs)-1)
+		}
+		return res, &Error{Kind: KindRisk, Message: "this change opens the server up: " + msg + "; apply it again with accept_risk to confirm (jarl: --accept-risk), or acknowledge the finding for good", Problems: rs}
+	}
 	if len(pl.drift) > 0 && !opts.Force {
 		var paths []string
 		for _, d := range pl.drift {
@@ -829,7 +903,7 @@ func (e *Engine) applyOps(ctx context.Context, cs *model.Changeset, reqs []Reque
 	res.Applied = true
 	e.removeDerived(pl)
 	for _, op := range cs.Ops {
-		if strings.HasPrefix(op.Kind, "blocklist.") {
+		if strings.HasPrefix(op.Kind, "blocklist.") || op.Kind == OpBlockingPause {
 			e.KickBlocklists()
 			break
 		}
@@ -1054,7 +1128,7 @@ func (e *Engine) Resync(ctx context.Context, p *auth.Principal, opts ApplyOption
 	pl.configChanged = true
 	pl.reloadZones = nil
 	for _, z := range work.SortedZones() {
-		if z.Type == model.ZonePrimary {
+		if z.Type == model.ZonePrimary && !z.Disabled {
 			pl.reloadZones = append(pl.reloadZones, z)
 			pl.verify[z.ID] = z.SOA.Serial
 		}
@@ -1175,6 +1249,14 @@ type Status struct {
 	MainConfig     string             `json:"main_config"`
 }

+// NamedStatus asks named for its status (rndc status).
+func (e *Engine) NamedStatus(ctx context.Context) (*bind.ServerStatus, error) {
+	if e.cfg.NoReload || e.tools == nil {
+		return nil, errors.New("named is not managed by this jarld (no_reload)")
+	}
+	return e.tools.Status(ctx)
+}
+
 // Status returns the current status.
 func (e *Engine) Status(ctx context.Context) (*Status, error) {
 	st, err := e.store.LoadState(ctx)
@@ -1218,7 +1300,7 @@ func (e *Engine) Status(ctx context.Context) (*Status, error) {
 			}
 		}
 	}
-	s.Problems = nonNilProblems(e.validate(st))
+	s.Problems = nonNilProblems(append(e.validate(st), e.namedProblems(ctx, st, deployed)...))
 	s.Counts = map[string]int{"views": len(st.Views), "zones": len(st.Zones), "records": len(st.Records), "acls": len(st.ACLs), "tsig_keys": len(st.Keys), "options": len(st.Options)}
 	return s, nil
 }
@@ -21,19 +21,26 @@ const (
 	KindBIND       ErrorKind = "bind_failed"       // named-checkconf or rndc failed
 	KindDrift      ErrorKind = "drift"             // files were changed outside Jarl
 	KindNotAdopted ErrorKind = "not_adopted"       // named does not load Jarl's config yet
+	KindRisk       ErrorKind = "confirm_risk"      // the change opens the server up and needs confirming
 )

 // Error is an engine error with details for the caller.
 type Error struct {
-	Kind     ErrorKind          `json:"code"`
-	Message  string             `json:"message"`
-	OpSeq    int                `json:"op,omitempty"` // the operation that failed
-	Problems []validate.Problem `json:"problems,omitempty"`
-	Check    []CheckMessage     `json:"check,omitempty"`
-	Diff     string             `json:"diff,omitempty"`
+	Kind    ErrorKind `json:"code"`
+	Message string    `json:"message"`
+	OpSeq   int       `json:"op,omitempty"` // the operation that failed
+	// OpSummary describes that operation, so people can find it in the
+	// changeset (record IDs mean little to them).
+	OpSummary string             `json:"op_summary,omitempty"`
+	Problems  []validate.Problem `json:"problems,omitempty"`
+	Check     []CheckMessage     `json:"check,omitempty"`
+	Diff      string             `json:"diff,omitempty"`
 }

 func (e *Error) Error() string {
+	if e.OpSeq > 0 && e.OpSummary != "" {
+		return fmt.Sprintf("operation %d (%s): %s", e.OpSeq, e.OpSummary, e.Message)
+	}
 	if e.OpSeq > 0 {
 		return fmt.Sprintf("operation %d: %s", e.OpSeq, e.Message)
 	}
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/netip"
+	"slices"
 	"strings"
 	"time"

@@ -131,7 +132,24 @@ func dateSerial(now time.Time) uint32 {
 }

 func (x *expander) expand(req Request) ([]model.Op, error) {
+	ops, err := x.expandOne(req)
+	if err != nil {
+		return nil, err
+	}
 	switch req.Op {
+	case OpRecordCreate, OpRecordUpdate, OpRecordDelete, OpRRSetReplace, OpRecordDisable, OpRecordEnable:
+		// Changes to linked zones reach the other zones of the link.
+		return x.linkSync(ops)
+	}
+	return ops, nil
+}
+
+func (x *expander) expandOne(req Request) ([]model.Op, error) {
+	switch req.Op {
+	case OpZoneLink:
+		return x.zoneLink(req)
+	case OpZoneUnlink:
+		return x.zoneUnlink(req)
 	case OpZoneCreate:
 		return x.zoneCreate(req)
 	case OpZoneUpdate, OpZoneDelete:
@@ -145,8 +163,31 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 			if n := len(x.st.ZoneRecords(z.ID)); n > 0 {
 				verb += fmt.Sprintf(" (with its %d records)", n)
 			}
+		} else if d := zoneToggle(req, z); d != nil {
+			if *d {
+				x.warnings = append(x.warnings, disabledZoneEffect(x.st, z))
+				return []model.Op{x.versioned(req, z.Version, "disable zone "+zoneDesc(x.st, z))}, nil
+			}
+			return []model.Op{x.versioned(req, z.Version, "enable zone "+zoneDesc(x.st, z))}, nil
 		}
-		return []model.Op{x.versioned(req, z.Version, "zone "+verb+" "+zoneDesc(x.st, z))}, nil
+		ops := []model.Op{x.versioned(req, z.Version, "zone "+verb+" "+zoneDesc(x.st, z))}
+		if req.Op == OpZoneDelete {
+			if rest := x.st.LinkedWith(z); len(rest) == 1 {
+				ops = append(ops, x.unlinkOps(rest[0], "unlink zone "+zoneDesc(x.st, rest[0])+": the zone it was linked with is deleted")...)
+			}
+		} else {
+			var in ZoneInput
+			if err := decode(req.Data, &in); err != nil {
+				return nil, err
+			}
+			if in.LinkGroup != nil && *in.LinkGroup != z.LinkGroup {
+				return nil, errf(KindBadRequest, "link zones with zone.link and zone.unlink (jarl zone link / unlink)")
+			}
+			if in.LinkWith != "" {
+				return nil, errf(KindBadRequest, "link_with is for new zones; link existing ones with zone.link (jarl zone link)")
+			}
+		}
+		return ops, nil
 	case OpRecordCreate:
 		return x.recordCreate(req)
 	case OpRecordUpdate:
@@ -222,6 +263,8 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 		return []model.Op{x.versioned(req, o.Version, summary)}, nil
 	case OpSettingsUpdate:
 		return []model.Op{newOpRaw(OpSettingsUpdate, 0, 0, req.Data, "update settings")}, nil
+	case OpExposureAck, OpExposureUnack:
+		return x.exposureAck(req, req.Op == OpExposureAck)
 	case OpBlocklistCreate:
 		return x.blocklistCreate(req)
 	case OpBlocklistUpdate, OpBlocklistDelete:
@@ -234,6 +277,18 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 			verb = "delete"
 		}
 		return []model.Op{x.versioned(req, b.Version, verb+" blocklist "+b.Name)}, nil
+	case OpBlockingPause:
+		var in BlockingPauseInput
+		if err := decode(req.Data, &in); err != nil {
+			return nil, err
+		}
+		summary := "resume blocking"
+		if in.Until != nil {
+			summary = "pause blocking until " + in.Until.Local().Format("2006-01-02 15:04")
+		} else if in.Indefinitely {
+			summary = "pause blocking until resumed"
+		}
+		return []model.Op{newOpRaw(OpBlockingPause, 0, 0, req.Data, summary)}, nil
 	case OpBlockRuleCreate:
 		return x.blockRuleCreate(req)
 	case OpBlockRuleUpdate, OpBlockRuleDelete:
@@ -246,6 +301,30 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 			verb = "delete rule: "
 		}
 		return []model.Op{x.versioned(req, r.Version, verb+ruleLabel(r))}, nil
+	case OpBlockStepCreate:
+		return x.blockStepCreate(req)
+	case OpBlockStepUpdate, OpBlockStepDelete:
+		s := x.st.BlockSteps[req.ID]
+		if s == nil {
+			return nil, errf(KindNotFound, "blocking step %d does not exist", req.ID)
+		}
+		verb := "change blocking step "
+		if req.Op == OpBlockStepDelete {
+			verb = "delete blocking step "
+		}
+		return []model.Op{x.versioned(req, s.Version, verb+s.Name)}, nil
+	case OpClientGroupCreate:
+		return x.clientGroupCreate(req)
+	case OpClientGroupUpdate, OpClientGroupDelete:
+		g := x.st.ClientGroups[req.ID]
+		if g == nil {
+			return nil, errf(KindNotFound, "client group %d does not exist", req.ID)
+		}
+		verb := "change client group "
+		if req.Op == OpClientGroupDelete {
+			verb = "delete client group "
+		}
+		return []model.Op{x.versioned(req, g.Version, verb+g.Name)}, nil
 	}
 	return nil, errf(KindBadRequest, "unknown operation %q", req.Op)
 }
@@ -311,7 +390,25 @@ func (x *expander) zoneCreate(req Request) ([]model.Op, error) {
 	records := in.Records
 	cloneFrom := in.CloneFrom
 	zoneOpts := in.Options
-	in.Nameservers, in.Records, in.CloneFrom, in.Options = nil, nil, 0, nil
+	linkWith := in.LinkWith
+	in.Nameservers, in.Records, in.CloneFrom, in.Options, in.LinkWith, in.LinkGroup = nil, nil, 0, nil, "", nil
+	if linkWith != "" {
+		if cloneFrom != 0 {
+			return nil, errf(KindBadRequest, "give clone_from or link_with, not both")
+		}
+		v := x.st.ViewByName(linkWith)
+		if v == nil {
+			return nil, errf(KindNotFound, "view %q does not exist", linkWith)
+		}
+		o := x.st.FindZone(name, v.ID)
+		if o == nil {
+			return nil, errf(KindNotFound, "view %s has no zone %s to link with", v.Name, dnsname.Display(name))
+		}
+		if o.Type != model.ZonePrimary || zt != model.ZonePrimary {
+			return nil, errf(KindBadRequest, "only primary zones can be linked")
+		}
+		cloneFrom = o.ID
+	}

 	set := x.st.Settings
 	var src *model.Zone
@@ -436,9 +533,30 @@ func (x *expander) zoneCreate(req Request) ([]model.Op, error) {
 			return nil, err
 		}
 	}
+	var linkOps []model.Op
+	if src != nil && linkWith != "" {
+		// The new zone joins src's link, or starts one with src: then
+		// all of src's records become shared.
+		group := src.LinkGroup
+		if group == 0 {
+			group = src.ID
+			linkOps = x.shareAllOps(src, group)
+		}
+		in.LinkGroup = &group
+	}
 	if src != nil {
 		for _, r := range x.st.ZoneRecords(src.ID) {
+			if linkWith != "" && src.LinkGroup != 0 && r.SharedID == 0 {
+				continue // local to src's view
+			}
 			ri := RecordInput{Name: model.Ptr(r.Name), Type: model.Ptr(r.Type), Data: model.Ptr(r.Data), Comment: model.Ptr(r.Comment)}
+			if linkWith != "" {
+				id := r.SharedID
+				if id == 0 {
+					id = r.ID
+				}
+				ri.SharedID = &id
+			}
 			if r.Disabled {
 				ri.Disabled = model.Ptr(true)
 			}
@@ -468,10 +586,12 @@ func (x *expander) zoneCreate(req Request) ([]model.Op, error) {
 			summary += " in view " + v.Name
 		}
 	}
-	if src != nil {
+	if src != nil && linkWith != "" {
+		summary += " (linked with " + zoneDesc(x.st, src) + ")"
+	} else if src != nil {
 		summary += " (copy of " + zoneDesc(x.st, src) + ")"
 	}
-	ops := []model.Op{newOp(OpZoneCreate, ids[0], 0, in, summary)}
+	ops := append(linkOps, newOp(OpZoneCreate, ids[0], 0, in, summary))
 	for i, zo := range zoneOpts {
 		oi := OptionInput{Scope: model.Ptr(model.ScopeZone), ScopeID: model.Ptr(ids[0]), Name: model.Ptr(zo.Name), Value: model.Ptr(zo.Value)}
 		if zo.Comment != "" {
@@ -523,11 +643,42 @@ func (x *expander) ptrCreate(z *model.Zone, owner string, p *rr.Parsed) ([]model
 	if !ok {
 		return nil, errf(KindBadRequest, "ptr only applies to A and AAAA records")
 	}
-	rz, ptrName := reverseZoneFor(x.st, z.ViewID, addr)
-	if rz == nil {
-		x.warnings = append(x.warnings, fmt.Sprintf("no reverse zone for %s in this view, so no PTR record was added", addr))
-		return nil, nil
+	var ops []model.Op
+	found := false
+	for _, vid := range ptrViews(x.st, z) {
+		rz, ptrName := reverseZoneFor(x.st, vid, addr)
+		if rz == nil {
+			continue
+		}
+		found = true
+		more, err := x.ptrCreateIn(rz, ptrName, owner)
+		if err != nil {
+			return nil, err
+		}
+		ops = append(ops, more...)
 	}
+	if !found {
+		x.warnings = append(x.warnings, fmt.Sprintf("no reverse zone for %s in this view, so no PTR record was added (create one: jarl zone create %s/%d)", addr, addr, addr.BitLen()))
+	}
+	return ops, nil
+}
+
+// ptrViews are the views whose reverse zones get the PTR records of zone
+// z's address records: z's own, and, for a linked zone, the other views
+// of the link (the record is in all of them).
+func ptrViews(st *model.State, z *model.Zone) []int64 {
+	out := []int64{z.ViewID}
+	for _, o := range st.LinkedWith(z) {
+		if !slices.Contains(out, o.ViewID) {
+			out = append(out, o.ViewID)
+		}
+	}
+	return out
+}
+
+// ptrCreateIn returns operations creating the PTR record ptrName -> owner
+// in reverse zone rz (none when it is there; enabling it when disabled).
+func (x *expander) ptrCreateIn(rz *model.Zone, ptrName, owner string) ([]model.Op, error) {
 	for _, r := range x.st.ZoneRecords(rz.ID) {
 		if r.Name == ptrName && r.Type == "PTR" {
 			if strings.EqualFold(r.Data, owner) {
@@ -555,10 +706,18 @@ func (x *expander) ptrSetDisabled(z *model.Zone, owner string, p *rr.Parsed, dis
 	if !ok {
 		return nil
 	}
-	rz, ptrName := reverseZoneFor(x.st, z.ViewID, addr)
-	if rz == nil {
-		return nil
+	var ops []model.Op
+	for _, vid := range ptrViews(x.st, z) {
+		rz, ptrName := reverseZoneFor(x.st, vid, addr)
+		if rz == nil {
+			continue
+		}
+		ops = append(ops, x.ptrSetDisabledIn(rz, ptrName, owner, disabled)...)
 	}
+	return ops
+}
+
+func (x *expander) ptrSetDisabledIn(rz *model.Zone, ptrName, owner string, disabled bool) []model.Op {
 	var ops []model.Op
 	for _, r := range x.st.ZoneRecords(rz.ID) {
 		if r.Name == ptrName && r.Type == "PTR" && strings.EqualFold(r.Data, owner) && r.Disabled != disabled {
@@ -581,12 +740,16 @@ func (x *expander) ptrDelete(z *model.Zone, owner string, p *rr.Parsed) []model.
 	if !ok {
 		return nil
 	}
-	rz, ptrName := reverseZoneFor(x.st, z.ViewID, addr)
-	if rz == nil {
-		return nil
+	var ops []model.Op
+	for _, vid := range ptrViews(x.st, z) {
+		rz, ptrName := reverseZoneFor(x.st, vid, addr)
+		if rz == nil {
+			continue
+		}
+		in := RecordInput{ZoneID: rz.ID, Name: model.Ptr(ptrName), Type: model.Ptr("PTR"), Data: model.Ptr(owner), MissingOK: true}
+		ops = append(ops, newOp(OpRecordDelete, 0, 0, in, fmt.Sprintf("delete %s IN PTR %s (if present)", ptrName, owner)))
 	}
-	in := RecordInput{ZoneID: rz.ID, Name: model.Ptr(ptrName), Type: model.Ptr("PTR"), Data: model.Ptr(owner), MissingOK: true}
-	return []model.Op{newOp(OpRecordDelete, 0, 0, in, fmt.Sprintf("delete %s IN PTR %s (if present)", ptrName, owner))}
+	return ops
 }

 // parseWarnings keeps what parsing noticed (e.g. a name read as absolute).
@@ -622,7 +785,27 @@ func (x *expander) recordCreate(req Request) ([]model.Op, error) {
 	if err != nil {
 		return nil, err
 	}
-	ops := []model.Op{newOp(OpRecordCreate, ids[0], 0, in, fmt.Sprintf("add %s%s IN %s %s", owner, ttlText(in.TTL), p.Type, p.Data))}
+	summary := fmt.Sprintf("add %s%s IN %s %s", owner, ttlText(in.TTL), p.Type, p.Data)
+	in.SharedID = nil
+	if z.LinkGroup != 0 {
+		local, err := x.localFor(z, owner, p.Type, in.Local)
+		if err != nil {
+			return nil, err
+		}
+		if local {
+			in.SharedID = model.Ptr(int64(0))
+			summary += " (local to view " + x.st.ViewName(z) + ")"
+		} else {
+			if x.st.HasLocal(z.ID, owner, p.Type) {
+				return nil, errf(KindConflict, "%s %s is local in view %s; share the set first (jarl record update ID --shared) or add this one as local", dnsname.Display(owner), p.Type, x.st.ViewName(z))
+			}
+			in.SharedID = &ids[0]
+		}
+	} else if in.Local != nil && *in.Local {
+		return nil, errf(KindBadRequest, "zone %s isn't linked with other views, so its records are local anyway", zoneDesc(x.st, z))
+	}
+	in.Local = nil
+	ops := []model.Op{newOp(OpRecordCreate, ids[0], 0, in, summary)}
 	if ptr {
 		more, err := x.ptrCreate(z, owner, p)
 		if err != nil {
@@ -646,6 +829,35 @@ func (x *expander) recordUpdate(req Request) ([]model.Op, error) {
 	ptr := in.PTR
 	in.PTR = false
 	in.Zone, in.View = "", ""
+	if in.SharedID != nil {
+		return nil, errf(KindBadRequest, "shared_id is managed by Jarl; use local: true or false to make a record local to its view or shared")
+	}
+	var pre []model.Op
+	if in.Local != nil {
+		if z.LinkGroup == 0 {
+			return nil, errf(KindBadRequest, "zone %s isn't linked with other views, so its records are local anyway", zoneDesc(x.st, z))
+		}
+		if want := *in.Local; want != (r.SharedID == 0) {
+			// The whole set of this name and type changes sides.
+			for _, o := range x.st.RRset(z.ID, r.Name, r.Type) {
+				id := int64(0)
+				what := fmt.Sprintf("make %s %s local to view %s", o.Name, o.Type, x.st.ViewName(z))
+				if !want {
+					id = o.ID
+					what = fmt.Sprintf("share %s %s %s with the linked views", o.Name, o.Type, o.Data)
+				}
+				pre = append(pre, newOp(OpRecordUpdate, o.ID, o.Version, RecordInput{SharedID: model.Ptr(id)}, what))
+			}
+			if !want {
+				// Sharing a version makes it every view's.
+				pre = append(pre, x.dropOverrides(z, r.Name, r.Type)...)
+			}
+		}
+		in.Local = nil
+		if string(mustJSON(in)) == "{}" {
+			return pre, nil
+		}
+	}
 	name, typ, data := r.Name, r.Type, r.Data
 	if in.Name != nil {
 		name = *in.Name
@@ -707,11 +919,20 @@ func (x *expander) recordUpdate(req Request) ([]model.Op, error) {
 	case len(changes) > 0:
 		summary += ": " + strings.Join(changes, ", ")
 	}
+	if z.LinkGroup != 0 && r.SharedID != 0 && len(pre) == 0 && (owner != r.Name || p.Type != r.Type) && x.st.HasLocal(z.ID, owner, p.Type) {
+		return nil, errf(KindConflict, "%s %s is local in view %s, so a shared record can't move there", dnsname.Display(owner), p.Type, x.st.ViewName(z))
+	}
 	base := req.BaseVersion
 	if base == 0 {
 		base = r.Version
 	}
-	ops := []model.Op{newOp(OpRecordUpdate, r.ID, base, in, summary)}
+	if len(pre) > 0 {
+		base = 0 // the record was just updated by pre
+	}
+	ops := pre
+	if string(mustJSON(in)) != "{}" || !ptr {
+		ops = append(ops, newOp(OpRecordUpdate, r.ID, base, in, summary))
+	}
 	disabled := r.Disabled
 	if in.Disabled != nil {
 		disabled = *in.Disabled
@@ -735,6 +956,15 @@ func (x *expander) recordUpdate(req Request) ([]model.Op, error) {
 		}
 		ops = append(ops, x.ptrSetDisabled(z, owner, p, disabled)...)
 	}
+	if ptr && !moved && !toggled && !disabled {
+		// Nothing else changes: make sure the PTR record is there (the
+		// reverse zone may be newer than the record).
+		more, err := x.ptrCreate(z, owner, p)
+		if err != nil {
+			return nil, err
+		}
+		ops = append(ops, more...)
+	}
 	return ops, nil
 }

@@ -909,17 +1139,35 @@ func (x *expander) rrsetReplace(req Request) ([]model.Op, error) {
 		canon = append(canon, p.Data)
 	}
 	in.ZoneID, in.Zone, in.View, in.Name, in.Type, in.Data = z.ID, "", "", owner, typ, canon
+	where := ""
+	var pre []model.Op
+	if z.LinkGroup != 0 {
+		local, err := x.localFor(z, owner, typ, in.Local)
+		if err != nil {
+			return nil, err
+		}
+		in.Shared = model.Ptr(!local)
+		if local {
+			where = " (local to view " + x.st.ViewName(z) + ")"
+		} else if in.Local != nil {
+			// Explicitly shared: this version becomes every view's.
+			pre = x.dropOverrides(z, owner, typ)
+		}
+	} else if in.Local != nil && *in.Local {
+		return nil, errf(KindBadRequest, "zone %s isn't linked with other views, so its records are local anyway", zoneDesc(x.st, z))
+	}
+	in.Local = nil
 	if len(canon) > 0 {
 		in.NewIDs, err = x.ids(len(canon))
 		if err != nil {
 			return nil, err
 		}
 	}
-	summary := fmt.Sprintf("set %s%s IN %s to [%s]", owner, ttlText(in.TTL), typ, strings.Join(canon, ", "))
+	summary := fmt.Sprintf("set %s%s IN %s to [%s]%s", owner, ttlText(in.TTL), typ, strings.Join(canon, ", "), where)
 	if len(canon) == 0 {
-		summary = fmt.Sprintf("delete all %s records of %s", typ, owner)
+		summary = fmt.Sprintf("delete all %s records of %s%s", typ, owner, where)
 	}
-	return []model.Op{newOp(OpRRSetReplace, 0, 0, in, summary)}, nil
+	return append(pre, newOp(OpRRSetReplace, 0, 0, in, summary)), nil
 }

 func (x *expander) viewCreate(req Request) ([]model.Op, error) {
@@ -1019,3 +1267,92 @@ func RedactOps(ops []model.Op) []model.Op {
 	}
 	return out
 }
+
+// zoneToggle returns the new disabled state when a zone update only
+// disables or enables the zone (nil otherwise).
+func zoneToggle(req Request, z *model.Zone) *bool {
+	var in ZoneInput
+	if decode(req.Data, &in) != nil || in.Disabled == nil || *in.Disabled == z.Disabled {
+		return nil
+	}
+	only := ZoneInput{Disabled: in.Disabled}
+	if string(mustJSON(in)) != string(mustJSON(only)) {
+		return nil
+	}
+	return in.Disabled
+}
+
+// disabledZoneEffect says what clients get once named no longer loads a
+// zone: in a view that offers recursion, answers from recursion (the
+// internet's version of the zone, if it has one); elsewhere, REFUSED.
+func disabledZoneEffect(st *model.State, z *model.Zone) string {
+	where := "this server"
+	if v := st.ViewName(z); v != "" {
+		where = "view " + v
+	}
+	if st.RecursionOn(z.ViewID) {
+		return fmt.Sprintf("once zone %s is disabled, clients of %s that may use recursion get its names from recursion: the internet's version of the zone, if there is one", dnsname.Display(z.Name), where)
+	}
+	return fmt.Sprintf("once zone %s is disabled, %s answers REFUSED for its names", dnsname.Display(z.Name), where)
+}
+
+// exposureAck acknowledges an exposure finding of a view or the server,
+// or takes the acknowledgement back: the view's (or the settings')
+// acknowledgements are updated as a whole.
+func (x *expander) exposureAck(req Request, ack bool) ([]model.Op, error) {
+	var in AckInput
+	if err := decode(req.Data, &in); err != nil {
+		return nil, err
+	}
+	in.Code = strings.TrimSpace(in.Code)
+	if !validate.Ackable(in.Code) {
+		return nil, errf(KindBadRequest, "%q is not an exposure finding that can be acknowledged (exposure_... or security_open_...)", in.Code)
+	}
+	if ack && strings.TrimSpace(in.Reason) == "" {
+		return nil, errf(KindBadRequest, "say why %s is accepted (a reason is required)", in.Code)
+	}
+	var v *model.View
+	switch {
+	case in.ViewID != 0:
+		v = x.st.Views[in.ViewID]
+	case in.View != "":
+		v = x.st.ViewByName(in.View)
+	}
+	if (in.ViewID != 0 || in.View != "") && v == nil {
+		return nil, errf(KindNotFound, "no view %s", firstNonEmptyStr(in.View, fmt.Sprint(in.ViewID)))
+	}
+	acks := x.st.Settings.Acknowledged
+	where := "the server"
+	if v != nil {
+		acks, where = v.Acknowledged, "view "+v.Name
+	}
+	var out []model.Acknowledgement
+	for _, a := range acks {
+		if a.Code != in.Code {
+			out = append(out, a)
+		}
+	}
+	summary := "acknowledge " + in.Code + " for " + where + ": " + strings.TrimSpace(in.Reason)
+	if ack {
+		out = append(out, model.Acknowledgement{Code: in.Code, Reason: strings.TrimSpace(in.Reason), By: x.p.Name(), At: x.now})
+	} else {
+		if len(out) == len(acks) {
+			return nil, errf(KindConflict, "%s isn't acknowledged for %s", in.Code, where)
+		}
+		summary = "take back the acknowledgement of " + in.Code + " for " + where
+	}
+	if out == nil {
+		out = []model.Acknowledgement{}
+	}
+	if v != nil {
+		return []model.Op{newOp(OpViewUpdate, v.ID, v.Version, ViewInput{Acknowledged: &out}, summary)}, nil
+	}
+	return []model.Op{newOp(OpSettingsUpdate, 0, 0, SettingsInput{Acknowledged: &out}, summary)}, nil
+}
+
+func firstNonEmptyStr(a, b string) string {
+	if a != "" {
+		return a
+	}
+	return b
+}
@@ -0,0 +1,163 @@
+package engine
+
+import (
+	"net/netip"
+	"slices"
+	"strings"
+
+	"jarl/internal/model"
+	"jarl/internal/namedconf"
+)
+
+// ExposureFix returns the requests that fix an exposure finding of a view
+// (viewID 0: the server), and what they do, or nil when there is no
+// automatic fix: what to allow instead (your secondaries, your hosts)
+// is for you to decide. The requests go through a changeset like any
+// edit (docs/exposure.md).
+func ExposureFix(st *model.State, viewID int64, code string) ([]Request, string) {
+	v := st.Views[viewID]
+	scope, scopeID := model.ScopeOptions, int64(0)
+	if v != nil {
+		scope, scopeID = model.ScopeView, v.ID
+	}
+	set := func(name, value string) Request {
+		if o := st.FindOption(scope, scopeID, name); o != nil {
+			return NewRequest(OpOptionUpdate, o.ID, OptionInput{Value: &value})
+		}
+		return NewRequest(OpOptionCreate, 0, OptionInput{Scope: &scope, ScopeID: &scopeID, Name: &name, Value: &value})
+	}
+	server := func(name, value string) Request {
+		if o := st.FindOption(model.ScopeOptions, 0, name); o != nil {
+			return NewRequest(OpOptionUpdate, o.ID, OptionInput{Value: &value})
+		}
+		return NewRequest(OpOptionCreate, 0, OptionInput{Scope: model.Ptr(model.ScopeOptions), Name: &name, Value: &value})
+	}
+	switch code {
+	case "exposure_rate_limit":
+		value := RecommendedRateLimit(st, v)
+		return []Request{set("rate-limit", value)}, "start rate limiting in log-only mode: rate-limit " + value
+	case "exposure_rate_limit_log_only":
+		o := st.FindOption(scope, scopeID, "rate-limit")
+		if o == nil {
+			o = st.FindOption(model.ScopeOptions, 0, "rate-limit")
+		}
+		if o == nil {
+			return nil, ""
+		}
+		value := withoutLogOnly(o.Value)
+		return []Request{NewRequest(OpOptionUpdate, o.ID, OptionInput{Value: &value})}, "start enforcing the rate limit: rate-limit " + value
+	case "exposure_minimal_any":
+		return []Request{set("minimal-any", "yes")}, "answer ANY queries minimally: minimal-any yes"
+	case "exposure_cache_snooping":
+		return []Request{set("allow-query-cache", "{ none; }")}, "close the cache to everyone: allow-query-cache { none; }"
+	case "exposure_version":
+		return []Request{server("version", "none")}, "hide BIND's version: version none"
+	case "exposure_hostname":
+		return []Request{server("hostname", "none")}, "hide the host name: hostname none"
+	case "security_open_resolver":
+		if v == nil {
+			return nil, "" // a server without views is also your own resolver
+		}
+		return []Request{set("recursion", "no")}, "turn recursion off in view " + v.Name + ": recursion no"
+	}
+	return nil, ""
+}
+
+// RecommendedRateLimit is the rate-limit block Jarl suggests for a public
+// view (v nil: the server): ISC's example of 10 identical responses per
+// second per client network, in log-only mode until you have looked at
+// what it would limit, with your secondaries exempt so zone transfers
+// and their queries are never limited.
+func RecommendedRateLimit(st *model.State, v *model.View) string {
+	parts := []string{"responses-per-second 10;", "log-only yes;"}
+	if ex := secondaries(st, v); len(ex) > 0 {
+		parts = append(parts, "exempt-clients { "+strings.Join(ex, "; ")+"; };")
+	}
+	return "{ " + strings.Join(parts, " ") + " }"
+}
+
+// secondaries returns the addresses the view's zones notify and allow
+// transfers to (ACLs resolved), the servers that rate limiting must leave
+// alone.
+func secondaries(st *model.State, v *model.View) []string {
+	var opts []*model.Option
+	add := func(scope string, id int64) {
+		for _, name := range []string{"also-notify", "allow-transfer"} {
+			if o := st.FindOption(scope, id, name); o != nil {
+				opts = append(opts, o)
+			}
+		}
+	}
+	add(model.ScopeOptions, 0)
+	vid := int64(0)
+	if v != nil {
+		vid = v.ID
+		add(model.ScopeView, v.ID)
+	}
+	for _, z := range st.SortedZones() {
+		if z.ViewID == vid {
+			add(model.ScopeZone, z.ID)
+		}
+	}
+	seen := map[string]bool{}
+	var out []string
+	var addElems func(list []string, depth int)
+	addElems = func(list []string, depth int) {
+		for _, s := range list {
+			e, err := namedconf.ParseAMElement(s)
+			if err != nil || e.Negated {
+				continue
+			}
+			switch e.Kind {
+			case namedconf.AMPrefix, namedconf.AMRange:
+				if t := e.String(); !seen[t] {
+					seen[t] = true
+					out = append(out, t)
+				}
+			case namedconf.AMName:
+				if a := st.ACLByName(e.Name); a != nil && depth < 10 {
+					addElems(a.Elements, depth+1)
+				}
+			}
+		}
+	}
+	for _, o := range opts {
+		stmt, err := namedconf.ParseOptionValue(o.Name, o.Value)
+		if err != nil || stmt.FirstBlock() == nil {
+			continue
+		}
+		var list []string
+		for _, s := range stmt.FirstBlock().Stmts {
+			if o.Name == "also-notify" {
+				// "ADDRESS [port N] [key K]": the address only.
+				if len(s.Items) > 0 && s.Items[0].Value != nil {
+					if _, err := netip.ParseAddr(s.Items[0].Value.Text); err == nil {
+						list = append(list, s.Items[0].Value.Text)
+					}
+				}
+				continue
+			}
+			list = append(list, namedconf.Compact(s.Items))
+		}
+		addElems(list, 0)
+	}
+	slices.Sort(out)
+	return out
+}
+
+// withoutLogOnly removes "log-only ...;" from a rate-limit block.
+func withoutLogOnly(value string) string {
+	st, err := namedconf.ParseOptionValue("rate-limit", value)
+	if err != nil || st.FirstBlock() == nil {
+		return value
+	}
+	b := st.FirstBlock()
+	var keep []*namedconf.Stmt
+	for _, s := range b.Stmts {
+		if s.Keyword() != "log-only" {
+			keep = append(keep, s)
+		}
+	}
+	b.Stmts = keep
+	return namedconf.Compact(st.Items[1:])
+}
@@ -0,0 +1,142 @@
+package engine
+
+import (
+	"net/netip"
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+	"jarl/internal/validate"
+)
+
+func problemFor(ps []validate.Problem, code, view string) *validate.Problem {
+	for i, p := range ps {
+		if p.Code == code && (view == "" || p.View == view) {
+			return &ps[i]
+		}
+	}
+	return nil
+}
+
+func TestExposure(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin,
+		// An internal network with a global IPv6 prefix is still yours.
+		NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("internal-clients"), Elements: &[]string{"2a02:8013:7f3d:10::/64", "192.168.1.0/24"}}),
+		optionReq("allow-transfer", "{ 192.0.2.53; }"),
+	)
+	env.submit(env.admin,
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("internal"), MatchClients: &[]string{"internal-clients", "localhost"}, AdoptZones: true}),
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("external"), MatchClients: &[]string{"!internal-clients", "any"}}),
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("dmz"), MatchClients: &[]string{"any"}, MatchDestinations: &[]string{"10.9.0.53"}}),
+	)
+	st := env.state()
+	exps := map[string]validate.Exposure{}
+	for _, x := range env.e.Exposures(st) {
+		exps[x.View] = x
+	}
+	if x := exps["internal"]; x.Public || !strings.Contains(x.Reason, "no catch-all") {
+		t.Errorf("internal = %+v", x)
+	}
+	if x := exps["external"]; !x.Public || x.Reason != "match-clients ends in any" {
+		t.Errorf("external = %+v", x)
+	}
+	if x := exps["dmz"]; x.Public || !strings.Contains(x.Reason, "match-destinations") {
+		t.Errorf("dmz = %+v", x)
+	}
+
+	ps := env.e.validate(st)
+	for _, code := range []string{"exposure_rate_limit", "exposure_minimal_any"} {
+		if problemFor(ps, code, "external") == nil {
+			t.Errorf("no %s for external", code)
+		}
+		if problemFor(ps, code, "internal") != nil || problemFor(ps, code, "dmz") != nil {
+			t.Errorf("%s for a private view", code)
+		}
+	}
+	for _, code := range []string{"exposure_version", "exposure_hostname"} {
+		if problemFor(ps, code, "") == nil {
+			t.Errorf("no %s", code)
+		}
+	}
+
+	// The rate limit fix starts in log-only mode and exempts the
+	// secondaries.
+	ext := st.ViewByName("external")
+	reqs, desc := ExposureFix(st, ext.ID, "exposure_rate_limit")
+	if len(reqs) != 1 || !strings.Contains(desc, "{ responses-per-second 10; log-only yes; exempt-clients { 192.0.2.53; }; }") {
+		t.Fatalf("fix = %v %q", reqs, desc)
+	}
+	env.submit(env.admin, reqs...)
+	ps = env.e.validate(env.state())
+	if problemFor(ps, "exposure_rate_limit", "external") != nil {
+		t.Error("rate limit warning stays after the fix")
+	}
+	if p := problemFor(ps, "exposure_rate_limit_log_only", "external"); p == nil || p.Severity != validate.Info {
+		t.Errorf("log-only = %+v", p)
+	}
+	reqs, desc = ExposureFix(env.state(), ext.ID, "exposure_rate_limit_log_only")
+	if !strings.Contains(desc, "{ responses-per-second 10; exempt-clients { 192.0.2.53; }; }") {
+		t.Errorf("enforce = %q", desc)
+	}
+	env.submit(env.admin, reqs...)
+	if p := problemFor(env.e.validate(env.state()), "exposure_rate_limit_log_only", "external"); p != nil {
+		t.Errorf("still log-only: %+v", p)
+	}
+
+	// Opening the server up needs confirming.
+	open := optionReqView("allow-recursion", "{ any; }", ext.ID)
+	if e := env.submitErr(env.admin, open); e.Kind != KindRisk || !strings.Contains(e.Message, "open resolver") {
+		t.Fatalf("open resolver without confirming: %+v", e)
+	}
+	if _, err := env.e.Submit(env.ctx, []Request{open}, env.admin, "test", "", ApplyOptions{AcceptRisk: true}); err != nil {
+		t.Fatalf("with accept risk: %v", err)
+	}
+	// Acknowledged, it stays as info, with who and why.
+	env.submit(env.admin, NewRequest(OpExposureAck, 0, AckInput{View: "external", Code: "security_open_resolver", Reason: "public resolver for the club"}))
+	p := problemFor(env.e.validate(env.state()), "security_open_resolver", "external")
+	if p == nil || p.Severity != validate.Info || p.Acknowledged == nil || !strings.Contains(p.Message, "acknowledged by admin on 7 Oct 2026: public resolver for the club") {
+		t.Errorf("acknowledged = %+v", p)
+	}
+	if e := env.submitErr(env.admin, NewRequest(OpExposureAck, 0, AckInput{View: "external", Code: "security_open_resolver"})); e.Kind != KindBadRequest {
+		t.Errorf("ack without a reason: %+v", e)
+	}
+	// Reverting the acknowledgement brings the warning back.
+	env.submit(env.admin, NewRequest(OpExposureUnack, 0, AckInput{View: "external", Code: "security_open_resolver"}))
+	if p := problemFor(env.e.validate(env.state()), "security_open_resolver", "external"); p == nil || p.Severity != validate.Warning {
+		t.Errorf("after unack = %+v", p)
+	}
+	// Marking a view private takes it out of the checks.
+	env.submit(env.admin, NewRequest(OpViewUpdate, ext.ID, ViewInput{Exposure: model.Ptr("private")}))
+	if p := problemFor(env.e.validate(env.state()), "security_open_resolver", "external"); p != nil {
+		t.Errorf("private view still checked: %+v", p)
+	}
+	if e := env.submitErr(env.admin, NewRequest(OpViewUpdate, ext.ID, ViewInput{Exposure: model.Ptr("internet")})); e.Kind != KindBadRequest {
+		t.Errorf("bad exposure: %+v", e)
+	}
+}
+
+// A server without views is public only when named listens on an
+// address that isn't private.
+func TestServerExposure(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	if x := env.e.Exposures(env.state())[0]; x.Public {
+		t.Errorf("no addresses known = %+v", x)
+	}
+	env.e.cfg.LocalAddrs = func() []netip.Addr {
+		return []netip.Addr{netip.MustParseAddr("192.168.1.2"), netip.MustParseAddr("2a02:8013:7f3d:10::53")}
+	}
+	if x := env.e.Exposures(env.state())[0]; !x.Public || !strings.Contains(x.Reason, "2a02:8013:7f3d:10::53") {
+		t.Errorf("GUA address = %+v", x)
+	}
+	env.submit(env.admin, NewRequest(OpSettingsUpdate, 0, SettingsInput{Exposure: model.Ptr("private")}))
+	if x := env.e.Exposures(env.state())[0]; x.Public || x.Override != "private" {
+		t.Errorf("marked private = %+v", x)
+	}
+}
+
+func optionReqView(name, value string, viewID int64) Request {
+	return NewRequest(OpOptionCreate, 0, OptionInput{Scope: model.Ptr(model.ScopeView), ScopeID: &viewID, Name: &name, Value: &value})
+}
@@ -0,0 +1,22 @@
+package engine
+
+import (
+	"context"
+	"io/fs"
+)
+
+// WriteFile writes a file outside the rendered configuration (a
+// certificate for named, docs/certificates.md) the way deployed files are
+// written: atomically, with bind.file_group, creating its directory.
+func (e *Engine) WriteFile(path string, content []byte, mode fs.FileMode) error {
+	return e.deploy.writeAtomic(path, content, mode)
+}
+
+// Reconfig makes named reread its configuration, and with it the files
+// its tls blocks name (nothing with bind.no_reload).
+func (e *Engine) Reconfig(ctx context.Context) error {
+	if e.cfg.NoReload {
+		return nil
+	}
+	return e.tools.Reconfig(ctx)
+}
@@ -2,6 +2,7 @@ package engine

 import (
 	"encoding/json"
+	"time"

 	"jarl/internal/model"
 )
@@ -36,19 +37,45 @@ const (
 	OpBlockRuleCreate = "blockrule.create"
 	OpBlockRuleUpdate = "blockrule.update"
 	OpBlockRuleDelete = "blockrule.delete"
+	OpBlockingPause   = "blocking.pause"
+
+	OpBlockStepCreate   = "blockstep.create"
+	OpBlockStepUpdate   = "blockstep.update"
+	OpBlockStepDelete   = "blockstep.delete"
+	OpClientGroupCreate = "clientgroup.create"
+	OpClientGroupUpdate = "clientgroup.update"
+	OpClientGroupDelete = "clientgroup.delete"

 	// Requests only: disabling and enabling records, by ID or by match
 	// (zone, name, type and optionally data), become record.update
 	// operations.
 	OpRecordDisable = "record.disable"
 	OpRecordEnable  = "record.enable"
+	// Acknowledging an exposure finding (docs/exposure.md), and taking it
+	// back, become view.update or settings.update operations.
+	OpExposureAck   = "exposure.ack"
+	OpExposureUnack = "exposure.unack"
+	// Linked zones (docs/views.md#linked-zones): requests that expand
+	// into zone and record updates.
+	OpZoneLink   = "zone.link"
+	OpZoneUnlink = "zone.unlink"
 )

+// AckInput acknowledges (or un-acknowledges) an exposure finding of a view
+// (by ID or name), or of the server (neither given).
+type AckInput struct {
+	ViewID int64  `json:"view_id,omitempty"`
+	View   string `json:"view,omitempty"`
+	Code   string `json:"code"`
+	Reason string `json:"reason,omitempty"`
+}
+
 // OpKinds lists all operation kinds.
 var OpKinds = []string{OpZoneCreate, OpZoneUpdate, OpZoneDelete, OpRecordCreate, OpRecordUpdate, OpRecordDelete, OpRRSetReplace,
 	OpViewCreate, OpViewUpdate, OpViewDelete, OpViewReorder, OpACLCreate, OpACLUpdate, OpACLDelete,
 	OpTSIGCreate, OpTSIGUpdate, OpTSIGDelete, OpOptionCreate, OpOptionUpdate, OpOptionDelete, OpSettingsUpdate,
-	OpBlocklistCreate, OpBlocklistUpdate, OpBlocklistDelete, OpBlockRuleCreate, OpBlockRuleUpdate, OpBlockRuleDelete}
+	OpBlocklistCreate, OpBlocklistUpdate, OpBlocklistDelete, OpBlockRuleCreate, OpBlockRuleUpdate, OpBlockRuleDelete, OpBlockingPause,
+	OpBlockStepCreate, OpBlockStepUpdate, OpBlockStepDelete, OpClientGroupCreate, OpClientGroupUpdate, OpClientGroupDelete}

 // Request is an operation as submitted by a client. Requests are expanded
 // into one or more stored operations (for example an A record with "ptr"
@@ -106,6 +133,15 @@ type ZoneInput struct {
 	// finished, off ("").
 	DNSSECPolicy *string `json:"dnssec_policy,omitempty"`
 	Comment      *string `json:"comment,omitempty"`
+	// Disabled keeps the zone in Jarl but out of named's configuration.
+	Disabled *bool `json:"disabled,omitempty"`
+	// LinkGroup is the zone's link group (0: not linked). Set by zone.link
+	// and zone.unlink; requests use those.
+	LinkGroup *int64 `json:"link_group,omitempty"`
+	// LinkWith (create only) links the new zone with the zone of the same
+	// name in this view, copying its shared records (or all of its
+	// records, when it isn't linked yet).
+	LinkWith string `json:"link_with,omitempty"`

 	// Create only: name servers for the apex NS records (default: the
 	// configured default name servers), additional records, and a zone to
@@ -138,10 +174,31 @@ type RecordInput struct {
 	// Disabled keeps the record in Jarl but out of the zone.
 	Disabled *bool `json:"disabled,omitempty"`
 	// PTR also creates (or deletes, disables or enables) the matching PTR
-	// record in the reverse zone, for A and AAAA records.
+	// record in the reverse zone, for A and AAAA records. On an update that
+	// changes nothing else it adds the PTR record if it is missing. In a
+	// linked zone, every linked view's reverse zone counts.
 	PTR bool `json:"ptr,omitempty"`
 	// MissingOK makes a delete-by-match succeed when nothing matches.
 	MissingOK bool `json:"missing_ok,omitempty"`
+	// Local (requests, linked zones): true keeps the record in this view
+	// only (an override: the whole name and type becomes local here);
+	// false shares it with the linked zones. Unset: like the records of
+	// the same name and type, shared when there are none.
+	Local *bool `json:"local,omitempty"`
+	// SharedID (stored operations) ties the copies of a shared record
+	// together; 0 makes it local.
+	SharedID *int64 `json:"shared_id,omitempty"`
+}
+
+// LinkInput links zones of the same name in several views, or (unlink)
+// takes one out of its link.
+type LinkInput struct {
+	ZoneID int64  `json:"zone_id,omitempty"`
+	Zone   string `json:"zone,omitempty"`
+	View   string `json:"view,omitempty"`
+	// With are the views whose zone of the same name to link with (link
+	// only; default: every view that has one).
+	With []string `json:"with,omitempty"`
 }

 // RRSetInput replaces all records of one name and type.
@@ -156,6 +213,11 @@ type RRSetInput struct {
 	Comment *string           `json:"comment,omitempty"`
 	// NewIDs are allocated for records that need to be created.
 	NewIDs []int64 `json:"new_ids,omitempty"`
+	// Local (requests): like RecordInput.Local, for the whole set.
+	Local *bool `json:"local,omitempty"`
+	// Shared (stored operations, linked zones): the records are shared
+	// (true) or local (false).
+	Shared *bool `json:"shared,omitempty"`
 }

 // ViewInput creates or updates a view.
@@ -172,6 +234,9 @@ type ViewInput struct {
 	AdoptZones bool `json:"adopt_zones,omitempty"`
 	// Cascade (delete) also deletes the view's zones.
 	Cascade bool `json:"cascade,omitempty"`
+	// Exposure is "auto" (or ""), "public" or "private" (docs/exposure.md).
+	Exposure     *string                  `json:"exposure,omitempty"`
+	Acknowledged *[]model.Acknowledgement `json:"acknowledged,omitempty"`
 }

 // ReorderInput sets the order of views.
@@ -215,6 +280,9 @@ type SettingsInput struct {
 	Expire       *uint32   `json:"expire,omitempty"`
 	NegativeTTL  *uint32   `json:"negative_ttl,omitempty"`
 	SerialPolicy *string   `json:"serial_policy,omitempty"`
+	// Exposure and Acknowledged are the server's (docs/exposure.md).
+	Exposure     *string                  `json:"exposure,omitempty"`
+	Acknowledged *[]model.Acknowledgement `json:"acknowledged,omitempty"`
 }

 // DeleteInput carries options for delete operations.
@@ -232,6 +300,31 @@ type BlocklistInput struct {
 	ViewIDs  *[]int64  `json:"view_ids,omitempty"`
 	Disabled *bool     `json:"disabled,omitempty"`
 	Comment  *string   `json:"comment,omitempty"`
+	// Step is the step the list starts at, by name ("normal" or a step
+	// above it) or ID (StepID; 0 is normal).
+	Step   *string `json:"step,omitempty"`
+	StepID *int64  `json:"step_id,omitempty"`
+}
+
+// BlockStepInput creates or updates a blocking step above Normal.
+// Position orders the steps (new steps go on top).
+type BlockStepInput struct {
+	Name     *string `json:"name,omitempty"`
+	Position *int    `json:"position,omitempty"`
+	Comment  *string `json:"comment,omitempty"`
+}
+
+// ClientGroupInput creates or updates a client group. Members are
+// addresses, prefixes or ACL names; the step is given by name ("off",
+// "normal" or a step) or ID; views as for BlocklistInput.
+type ClientGroupInput struct {
+	Name    *string   `json:"name,omitempty"`
+	Members *[]string `json:"members,omitempty"`
+	Step    *string   `json:"step,omitempty"`
+	StepID  *int64    `json:"step_id,omitempty"`
+	Views   *[]string `json:"views,omitempty"`
+	ViewIDs *[]int64  `json:"view_ids,omitempty"`
+	Comment *string   `json:"comment,omitempty"`
 }

 // BlockRuleInput creates or updates a block or allow rule. Views as for
@@ -244,3 +337,14 @@ type BlockRuleInput struct {
 	ViewIDs *[]int64  `json:"view_ids,omitempty"`
 	Comment *string   `json:"comment,omitempty"`
 }
+
+// BlockingPauseInput pauses blocking until a time, or resumes it (null).
+type BlockingPauseInput struct {
+	Until *time.Time `json:"until"`
+	// Indefinitely pauses until someone resumes blocking (Until is nil).
+	Indefinitely bool `json:"indefinitely,omitempty"`
+}
+
+// MaxBlockingPause is the longest pause: blocking shouldn't stay off by
+// mistake (disable lists to stop using them).
+const MaxBlockingPause = 24 * time.Hour
@@ -0,0 +1,476 @@
+package engine
+
+// Linked zones (docs/views.md#linked-zones). Zones of the same name in
+// different views can be linked: their shared records are kept in step,
+// and each zone can override a name and type with records local to its
+// view. Every zone keeps its own copy of each shared record (with the
+// same SharedID), so the rest of Jarl sees ordinary zones.
+//
+// Keeping them in step happens when requests are expanded: the request's
+// operations are applied to a scratch copy, and linkSync adds explicit
+// operations for the other zones of the link. So a change to a shared
+// record is one changeset with one operation per zone: the diff, the
+// permission checks, history and undo all see every zone.
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"jarl/internal/dnsname"
+	"jarl/internal/model"
+)
+
+type rrKey struct {
+	zone      int64
+	name, typ string
+}
+
+// linkSync returns ops followed by the operations that bring the other
+// zones of each affected link in step.
+func (x *expander) linkSync(ops []model.Op) ([]model.Op, error) {
+	if !x.st.AnyLinked() {
+		return ops, nil
+	}
+	work := x.st.Clone()
+	c := &applyCtx{p: x.p, now: x.now}
+	for _, op := range ops {
+		if err := applyOp(work, op, c); err != nil {
+			return nil, err
+		}
+	}
+	keys := affectedKeys(x.st, work, ops)
+	var extra []model.Op
+	for _, k := range keys {
+		z := work.Zones[k.zone]
+		if z == nil || z.LinkGroup == 0 {
+			continue
+		}
+		more, err := x.syncKey(work, z, k.name, k.typ)
+		if err != nil {
+			return nil, err
+		}
+		for _, op := range more {
+			if err := applyOp(work, op, c); err != nil {
+				return nil, err
+			}
+		}
+		extra = append(extra, more...)
+	}
+	return append(ops, extra...), nil
+}
+
+// affectedKeys lists the (zone, name, type) sets that ops touch, before
+// and after.
+func affectedKeys(pre, post *model.State, ops []model.Op) []rrKey {
+	var out []rrKey
+	seen := map[rrKey]bool{}
+	add := func(zone int64, name, typ string) {
+		k := rrKey{zone, name, typ}
+		if zone != 0 && name != "" && !seen[k] {
+			seen[k] = true
+			out = append(out, k)
+		}
+	}
+	fromRecord := func(id int64) {
+		for _, st := range []*model.State{pre, post} {
+			if r := st.Records[id]; r != nil {
+				add(r.ZoneID, r.Name, r.Type)
+			}
+		}
+	}
+	for _, op := range ops {
+		switch op.Kind {
+		case OpRecordCreate, OpRecordUpdate, OpRecordDelete:
+			if op.ID != 0 {
+				fromRecord(op.ID)
+			}
+			if op.Kind == OpRecordDelete && op.ID == 0 {
+				var in RecordInput
+				if decode(op.Data, &in) == nil && in.Name != nil && in.Type != nil {
+					add(in.ZoneID, *in.Name, *in.Type)
+				}
+			}
+		case OpRRSetReplace:
+			var in RRSetInput
+			if decode(op.Data, &in) == nil {
+				add(in.ZoneID, in.Name, in.Type)
+			}
+		}
+	}
+	return out
+}
+
+// syncKey brings the other zones of z's link in step with z for one name
+// and type, after z was changed:
+//
+//   - z overrides it (local records): z's shared copies go; the others
+//     keep theirs.
+//   - z's override was just removed: z gets the shared records back from
+//     a zone that has them.
+//   - otherwise z's shared records are the truth: every zone that doesn't
+//     override the name and type gets the same (created, updated or
+//     deleted to match).
+func (x *expander) syncKey(st *model.State, z *model.Zone, name, typ string) ([]model.Op, error) {
+	var ops []model.Op
+	where := func(o *model.Zone) string { return zoneDesc(st, o) }
+	if st.HasLocal(z.ID, name, typ) {
+		for _, r := range st.SharedRecords(z.ID, name, typ) {
+			ops = append(ops, newOp(OpRecordDelete, r.ID, r.Version, nil,
+				fmt.Sprintf("linked: %s %s is local in %s now, so its shared %s goes there", name, typ, where(z), r.Data)))
+		}
+		return ops, nil
+	}
+	truth := st.SharedRecords(z.ID, name, typ)
+	members := st.LinkedWith(z)
+	if len(truth) == 0 && x.st.HasLocal(z.ID, name, typ) {
+		// The override was removed: back to the shared records.
+		for _, o := range members {
+			if st.HasLocal(o.ID, name, typ) {
+				continue
+			}
+			src := st.SharedRecords(o.ID, name, typ)
+			if len(src) == 0 {
+				continue
+			}
+			for _, r := range src {
+				op, err := x.copyRecord(st, z, r, "linked: "+name+" "+typ+" is shared again in "+where(z)+": add "+r.Data)
+				if err != nil {
+					return nil, err
+				}
+				ops = append(ops, op)
+			}
+			break
+		}
+		return ops, nil
+	}
+	for _, o := range members {
+		if st.HasLocal(o.ID, name, typ) {
+			continue // o overrides this name and type
+		}
+		copies := map[int64]*model.Record{}
+		for _, r := range st.SharedRecords(o.ID, name, typ) {
+			copies[r.SharedID] = r
+		}
+		var more []model.Op
+		for _, t := range truth {
+			cp := copies[t.SharedID]
+			delete(copies, t.SharedID)
+			if cp == nil {
+				op, err := x.copyRecord(st, o, t, fmt.Sprintf("linked: add %s %s %s in %s", name, typ, t.Data, where(o)))
+				if err != nil {
+					return nil, err
+				}
+				more = append(more, op)
+				continue
+			}
+			in, changes := recordDiff(cp, t)
+			if len(changes) > 0 {
+				more = append(more, newOp(OpRecordUpdate, cp.ID, cp.Version, in,
+					fmt.Sprintf("linked: change %s %s %s in %s: %s", name, typ, cp.Data, where(o), strings.Join(changes, ", "))))
+			}
+		}
+		for _, id := range sortedKeys(copies) {
+			cp := copies[id]
+			more = append(more, newOp(OpRecordDelete, cp.ID, cp.Version, nil, fmt.Sprintf("linked: delete %s %s %s in %s", name, typ, cp.Data, where(o))))
+		}
+		if len(more) > 0 && !x.p.Can(recordAction(st, o, name, typ, true)) {
+			return nil, errf(KindForbidden, "%s %s is shared with %s, which you may not change; to change it in %s only, make it local to that view (local: true, or --local)",
+				dnsname.Display(name), typ, where(o), where(z))
+		}
+		ops = append(ops, more...)
+	}
+	return ops, nil
+}
+
+// copyRecord returns an operation that creates a copy of shared record r
+// in zone z.
+func (x *expander) copyRecord(st *model.State, z *model.Zone, r *model.Record, summary string) (model.Op, error) {
+	if !x.p.Can(recordAction(st, z, r.Name, r.Type, true)) {
+		return model.Op{}, errf(KindForbidden, "%s %s is shared with %s, which you may not change", dnsname.Display(r.Name), r.Type, zoneDesc(st, z))
+	}
+	ids, err := x.ids(1)
+	if err != nil {
+		return model.Op{}, err
+	}
+	return newOp(OpRecordCreate, ids[0], 0, recordCopyInput(z.ID, r), summary), nil
+}
+
+func recordCopyInput(zoneID int64, r *model.Record) RecordInput {
+	in := RecordInput{ZoneID: zoneID, Name: model.Ptr(r.Name), Type: model.Ptr(r.Type), Data: model.Ptr(r.Data),
+		Comment: model.Ptr(r.Comment), Disabled: model.Ptr(r.Disabled), SharedID: model.Ptr(r.SharedID)}
+	if r.TTL != nil {
+		in.TTL = model.Some(*r.TTL)
+	} else {
+		in.TTL = model.Opt[uint32]{Set: true, Null: true}
+	}
+	return in
+}
+
+// recordDiff returns the update that makes cp like t, and what changes.
+func recordDiff(cp, t *model.Record) (RecordInput, []string) {
+	var in RecordInput
+	var changes []string
+	if cp.Data != t.Data {
+		in.Data = model.Ptr(t.Data)
+		changes = append(changes, "data "+t.Data)
+	}
+	if !sameTTL(cp.TTL, t.TTL) {
+		if t.TTL != nil {
+			in.TTL = model.Some(*t.TTL)
+			changes = append(changes, fmt.Sprintf("ttl %d", *t.TTL))
+		} else {
+			in.TTL = model.Opt[uint32]{Set: true, Null: true}
+			changes = append(changes, "ttl default")
+		}
+	}
+	if cp.Comment != t.Comment {
+		in.Comment = model.Ptr(t.Comment)
+		changes = append(changes, "comment")
+	}
+	if cp.Disabled != t.Disabled {
+		in.Disabled = model.Ptr(t.Disabled)
+		changes = append(changes, enableWord(t.Disabled)+"d")
+	}
+	return in, changes
+}
+
+// linkTarget resolves the zone a link request names.
+func (x *expander) linkTarget(in LinkInput) (*model.Zone, error) {
+	z, err := x.resolveZone(in.ZoneID, in.Zone, in.View)
+	if err != nil {
+		return nil, err
+	}
+	if z.Type != model.ZonePrimary {
+		return nil, errf(KindBadRequest, "only primary zones can be linked (%s is %s)", zoneDesc(x.st, z), z.Type)
+	}
+	return z, nil
+}
+
+// zoneLink links zones of the same name in several views. It never
+// changes what named answers: a name and type with the same records in
+// every zone becomes shared; anything that differs stays local to each
+// view (and can be shared later, from the view whose version is right).
+func (x *expander) zoneLink(req Request) ([]model.Op, error) {
+	var in LinkInput
+	if err := decode(req.Data, &in); err != nil {
+		return nil, err
+	}
+	z, err := x.linkTarget(in)
+	if err != nil {
+		return nil, err
+	}
+	members := []*model.Zone{z}
+	add := func(o *model.Zone) {
+		if !slices.ContainsFunc(members, func(m *model.Zone) bool { return m.ID == o.ID }) {
+			members = append(members, o)
+		}
+	}
+	if len(in.With) == 0 {
+		for _, o := range x.st.ZonesNamed(z.Name) {
+			if o.Type == model.ZonePrimary && o.ID != z.ID {
+				add(o)
+			}
+		}
+	}
+	for _, vn := range in.With {
+		v := x.st.ViewByName(vn)
+		if v == nil {
+			return nil, errf(KindNotFound, "view %q does not exist", vn)
+		}
+		o := x.st.FindZone(z.Name, v.ID)
+		if o == nil {
+			return nil, errf(KindNotFound, "view %s has no zone %s (create it linked: jarl zone create %s --view %s --link-with %s)", v.Name, dnsname.Display(z.Name), dnsname.Display(z.Name), v.Name, x.st.ViewName(z))
+		}
+		if o.Type != model.ZonePrimary {
+			return nil, errf(KindBadRequest, "only primary zones can be linked (%s is %s)", zoneDesc(x.st, o), o.Type)
+		}
+		add(o)
+	}
+	// Zones already linked with any of them join too.
+	for _, m := range slices.Clone(members) {
+		for _, o := range x.st.LinkMembers(m.LinkGroup) {
+			add(o)
+		}
+	}
+	if len(members) < 2 {
+		return nil, errf(KindBadRequest, "zone %s exists in no other view to link it with", dnsname.Display(z.Name))
+	}
+	x.st.SortByView(members)
+	group := members[0].ID
+	for _, m := range members {
+		if m.LinkGroup != 0 {
+			group = m.LinkGroup
+			break
+		}
+	}
+
+	// What is the same everywhere?
+	type key struct{ name, typ string }
+	sig := func(rs []*model.Record) string {
+		var parts []string
+		for _, r := range rs {
+			ttl := "-"
+			if r.TTL != nil {
+				ttl = fmt.Sprint(*r.TTL)
+			}
+			parts = append(parts, fmt.Sprintf("%s|%s|%v", strings.ToLower(r.Data), ttl, r.Disabled))
+		}
+		slices.Sort(parts)
+		return strings.Join(parts, "\n")
+	}
+	keys := map[key]bool{}
+	var order []key
+	for _, m := range members {
+		for _, r := range x.st.ZoneRecords(m.ID) {
+			k := key{r.Name, r.Type}
+			if !keys[k] {
+				keys[k] = true
+				order = append(order, k)
+			}
+		}
+	}
+	var ops []model.Op
+	var local []string
+	shared := 0
+	for _, k := range order {
+		first := x.st.RRset(members[0].ID, k.name, k.typ)
+		same := len(first) > 0
+		for _, m := range members[1:] {
+			if rs := x.st.RRset(m.ID, k.name, k.typ); len(rs) == 0 || sig(rs) != sig(first) {
+				same = false
+				break
+			}
+		}
+		if same {
+			shared++
+		} else {
+			var in []string
+			for _, m := range members {
+				if len(x.st.RRset(m.ID, k.name, k.typ)) > 0 {
+					in = append(in, x.st.ViewName(m))
+				}
+			}
+			local = append(local, fmt.Sprintf("%s %s (%s)", dnsname.Display(k.name), k.typ, strings.Join(in, ", ")))
+		}
+		// Pair the copies: record i of the first zone's set (by data) with
+		// the same data in the others.
+		byData := func(rs []*model.Record) []*model.Record {
+			out := slices.Clone(rs)
+			slices.SortStableFunc(out, func(a, b *model.Record) int { return strings.Compare(strings.ToLower(a.Data), strings.ToLower(b.Data)) })
+			return out
+		}
+		ref := byData(first)
+		for _, m := range members {
+			rs := byData(x.st.RRset(m.ID, k.name, k.typ))
+			for i, r := range rs {
+				want := int64(0)
+				var comment *string
+				if same {
+					want = ref[i].ID
+					if r.Comment != ref[i].Comment && ref[i].Comment != "" {
+						comment = model.Ptr(ref[i].Comment)
+					}
+				}
+				if r.SharedID == want && comment == nil {
+					continue
+				}
+				in := RecordInput{SharedID: model.Ptr(want), Comment: comment}
+				what := "local to view " + x.st.ViewName(m)
+				if same {
+					what = "shared"
+				}
+				ops = append(ops, newOp(OpRecordUpdate, r.ID, r.Version, in, fmt.Sprintf("%s %s %s: %s", r.Name, r.Type, r.Data, what)))
+			}
+		}
+	}
+	var views []string
+	for _, m := range members {
+		views = append(views, x.st.ViewName(m))
+	}
+	var zoneOps []model.Op
+	for _, m := range members {
+		if m.LinkGroup != group {
+			zoneOps = append(zoneOps, newOp(OpZoneUpdate, m.ID, m.Version, ZoneInput{LinkGroup: model.Ptr(group)},
+				fmt.Sprintf("link zone %s in views %s", zoneDesc(x.st, m), strings.Join(views, ", "))))
+		}
+	}
+	if len(local) > 0 {
+		x.warnings = append(x.warnings, fmt.Sprintf("%d names differ between the views and stay local to each: %s. Share one from the view whose version is right (jarl record update ID --shared, or Share in the web UI).", len(local), strings.Join(local, "; ")))
+	}
+	x.warnings = append(x.warnings, fmt.Sprintf("%d names and types are shared between views %s", shared, strings.Join(views, ", ")))
+	return append(zoneOps, ops...), nil
+}
+
+// zoneUnlink takes a zone out of its link: its records stay as they are,
+// all local. A link left with one zone is dissolved.
+func (x *expander) zoneUnlink(req Request) ([]model.Op, error) {
+	var in LinkInput
+	if err := decode(req.Data, &in); err != nil {
+		return nil, err
+	}
+	z, err := x.resolveZone(in.ZoneID, in.Zone, in.View)
+	if err != nil {
+		return nil, err
+	}
+	if z.LinkGroup == 0 {
+		return nil, errf(KindConflict, "zone %s isn't linked", zoneDesc(x.st, z))
+	}
+	out := []*model.Zone{z}
+	if rest := x.st.LinkedWith(z); len(rest) == 1 {
+		out = append(out, rest[0])
+	}
+	var ops []model.Op
+	for _, m := range out {
+		ops = append(ops, x.unlinkOps(m, "unlink zone "+zoneDesc(x.st, m))...)
+	}
+	return ops, nil
+}
+
+// unlinkOps returns the operations that take zone m out of its link.
+func (x *expander) unlinkOps(m *model.Zone, summary string) []model.Op {
+	ops := []model.Op{newOp(OpZoneUpdate, m.ID, m.Version, ZoneInput{LinkGroup: model.Ptr(int64(0))}, summary)}
+	for _, r := range x.st.ZoneRecords(m.ID) {
+		if r.SharedID != 0 {
+			ops = append(ops, newOp(OpRecordUpdate, r.ID, r.Version, RecordInput{SharedID: model.Ptr(int64(0))}, fmt.Sprintf("%s %s %s: no longer shared", r.Name, r.Type, r.Data)))
+		}
+	}
+	return ops
+}
+
+// localFor works out whether a new record (or set) in zone z is local:
+// as asked, or like the records of the same name and type already there.
+func (x *expander) localFor(z *model.Zone, name, typ string, want *bool) (bool, error) {
+	has := x.st.HasLocal(z.ID, name, typ)
+	if want == nil {
+		return has, nil
+	}
+	return *want, nil
+}
+
+// shareAllOps returns the operations that start a link with zone z: it
+// joins group and all its records become shared.
+func (x *expander) shareAllOps(z *model.Zone, group int64) []model.Op {
+	ops := []model.Op{newOp(OpZoneUpdate, z.ID, z.Version, ZoneInput{LinkGroup: model.Ptr(group)}, "link zone "+zoneDesc(x.st, z))}
+	for _, r := range x.st.ZoneRecords(z.ID) {
+		if r.SharedID == 0 {
+			ops = append(ops, newOp(OpRecordUpdate, r.ID, r.Version, RecordInput{SharedID: model.Ptr(r.ID)}, fmt.Sprintf("%s %s %s: shared", r.Name, r.Type, r.Data)))
+		}
+	}
+	return ops
+}
+
+// dropOverrides returns the operations that delete the other linked
+// zones' local records of a name and type, so the shared version reaches
+// them (sharing a version makes it every view's).
+func (x *expander) dropOverrides(z *model.Zone, name, typ string) []model.Op {
+	var ops []model.Op
+	for _, o := range x.st.LinkedWith(z) {
+		for _, r := range x.st.RRset(o.ID, name, typ) {
+			if r.SharedID == 0 {
+				ops = append(ops, newOp(OpRecordDelete, r.ID, r.Version, nil, fmt.Sprintf("linked: %s %s %s in %s is replaced by the shared version", r.Name, r.Type, r.Data, zoneDesc(x.st, o))))
+			}
+		}
+	}
+	return ops
+}
@@ -0,0 +1,287 @@
+package engine
+
+import (
+	"slices"
+	"strings"
+	"testing"
+
+	"jarl/internal/auth"
+	"jarl/internal/model"
+	"jarl/internal/validate"
+)
+
+// linkedEnv has views internal and external and zone example.com in
+// internal with a few records.
+func linkedEnv(t *testing.T) *testEnv {
+	env := newEnv(t)
+	env.submit(env.admin, NewRequest(OpSettingsUpdate, 0, SettingsInput{Nameservers: &[]string{"ns1.example.net."}}))
+	env.submit(env.admin,
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("internal"), MatchClients: &[]string{"10.0.0.0/8"}}),
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("external"), MatchClients: &[]string{"any"}}))
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.com"), View: model.Ptr("internal")}))
+	env.submit(env.admin,
+		recIn("internal", "www", "A", "192.0.2.10"),
+		recIn("internal", "mail", "A", "192.0.2.25"),
+		recIn("internal", "@", "MX", "10 mail"))
+	return env
+}
+
+func recIn(view, name, typ, data string) Request {
+	return NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", View: view, Name: &name, Type: &typ, Data: &data})
+}
+
+// view returns a view's records of example.com as "name type data S|L",
+// S for shared, L for local.
+func (env *testEnv) view(name string) []string {
+	env.t.Helper()
+	s := env.state()
+	v := s.ViewByName(name)
+	z := s.FindZone("example.com.", v.ID)
+	var out []string
+	for _, r := range s.ZoneRecords(z.ID) {
+		if r.Type == "NS" {
+			continue
+		}
+		mark := "L"
+		if r.SharedID != 0 {
+			mark = "S"
+		}
+		if r.Disabled {
+			mark += " disabled"
+		}
+		out = append(out, strings.TrimSuffix(r.Name, ".example.com.")+" "+r.Type+" "+r.Data+" "+mark)
+	}
+	return out
+}
+
+func (env *testEnv) recordID(view, name, typ string) int64 {
+	env.t.Helper()
+	s := env.state()
+	z := s.FindZone("example.com.", s.ViewByName(view).ID)
+	for _, r := range s.ZoneRecords(z.ID) {
+		if r.Name == name+".example.com." && r.Type == typ {
+			return r.ID
+		}
+	}
+	env.t.Fatalf("no %s %s in %s", name, typ, view)
+	return 0
+}
+
+func want(t *testing.T, what string, got []string, w ...string) {
+	t.Helper()
+	if !slices.Equal(got, w) {
+		t.Errorf("%s:\n got  %q\n want %q", what, got, w)
+	}
+}
+
+func TestLinkedZones(t *testing.T) {
+	env := linkedEnv(t)
+	// A zone created linked copies everything; both are linked and shared.
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.com"), View: model.Ptr("external"), LinkWith: "internal"}))
+	all := []string{"mail A 192.0.2.25 S", "www A 192.0.2.10 S", "example.com. MX 10 mail.example.com. S"}
+	slices.Sort(all)
+	got := env.view("external")
+	slices.Sort(got)
+	want(t, "linked copy", got, all...)
+	s := env.state()
+	if zs := s.ZonesNamed("example.com."); zs[0].LinkGroup == 0 || zs[0].LinkGroup != zs[1].LinkGroup {
+		t.Fatalf("not linked: %+v %+v", zs[0], zs[1])
+	}
+
+	// Adding, changing, disabling and deleting a shared record reaches the other view.
+	env.submit(env.admin, recIn("external", "ftp", "CNAME", "www"))
+	if !slices.Contains(env.view("internal"), "ftp CNAME www.example.com. S") {
+		t.Errorf("shared add didn't reach internal: %q", env.view("internal"))
+	}
+	env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("internal", "mail", "A"), RecordInput{Data: model.Ptr("192.0.2.26")}))
+	if !slices.Contains(env.view("external"), "mail A 192.0.2.26 S") {
+		t.Errorf("shared change didn't reach external: %q", env.view("external"))
+	}
+	env.submit(env.admin, NewRequest(OpRecordDisable, 0, RecordInput{Zone: "example.com", View: "external", Name: model.Ptr("ftp"), Type: model.Ptr("CNAME")}))
+	if !slices.Contains(env.view("internal"), "ftp CNAME www.example.com. S disabled") {
+		t.Errorf("disable didn't reach internal: %q", env.view("internal"))
+	}
+	env.submit(env.admin, NewRequest(OpRecordDelete, 0, RecordInput{Zone: "example.com", View: "internal", Name: model.Ptr("ftp"), Type: model.Ptr("CNAME")}))
+	for _, v := range []string{"internal", "external"} {
+		for _, r := range env.view(v) {
+			if strings.HasPrefix(r, "ftp ") {
+				t.Errorf("delete by match left %s in %s", r, v)
+			}
+		}
+	}
+
+	// A local override: www in internal points elsewhere; external keeps
+	// the shared one.
+	res := env.submit(env.admin, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", View: "internal", Name: model.Ptr("www"), Type: model.Ptr("A"), Data: model.Ptr("10.0.0.10"), Local: model.Ptr(true)}))
+	if !slices.Contains(env.view("internal"), "www A 10.0.0.10 L") || slices.Contains(env.view("internal"), "www A 192.0.2.10 S") {
+		t.Errorf("override: internal %q", env.view("internal"))
+	}
+	if !slices.Contains(env.view("external"), "www A 192.0.2.10 S") {
+		t.Errorf("override changed external: %q", env.view("external"))
+	}
+	_ = res
+	// A new record of an overridden set joins it as local.
+	env.submit(env.admin, recIn("internal", "www", "A", "10.0.0.11"))
+	if !slices.Contains(env.view("internal"), "www A 10.0.0.11 L") || len(env.view("external")) != 3 {
+		t.Errorf("join override: internal %q external %q", env.view("internal"), env.view("external"))
+	}
+	// Changing the shared www in external doesn't touch internal's override.
+	env.submit(env.admin, NewRequest(OpRRSetReplace, 0, RRSetInput{Zone: "example.com", View: "external", Name: "www", Type: "A", Data: []string{"192.0.2.11"}}))
+	if !slices.Contains(env.view("external"), "www A 192.0.2.11 S") || slices.Contains(env.view("internal"), "www A 192.0.2.11 S") {
+		t.Errorf("shared set with an override elsewhere: internal %q external %q", env.view("internal"), env.view("external"))
+	}
+	// Removing the override brings the shared records back.
+	env.submit(env.admin, NewRequest(OpRRSetReplace, 0, RRSetInput{Zone: "example.com", View: "internal", Name: "www", Type: "A", Data: []string{}}))
+	if !slices.Contains(env.view("internal"), "www A 192.0.2.11 S") {
+		t.Errorf("override removed: internal %q", env.view("internal"))
+	}
+
+	// Make a shared set local, then share another view's version.
+	env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("external", "mail", "A"), RecordInput{Local: model.Ptr(true)}))
+	env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("external", "mail", "A"), RecordInput{Data: model.Ptr("198.51.100.25")}))
+	if !slices.Contains(env.view("external"), "mail A 198.51.100.25 L") || !slices.Contains(env.view("internal"), "mail A 192.0.2.26 S") {
+		t.Errorf("local edit: internal %q external %q", env.view("internal"), env.view("external"))
+	}
+	env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("external", "mail", "A"), RecordInput{Local: model.Ptr(false)}))
+	if !slices.Contains(env.view("internal"), "mail A 198.51.100.25 S") || slices.Contains(env.view("internal"), "mail A 192.0.2.26 S") {
+		t.Errorf("share external's version: internal %q", env.view("internal"))
+	}
+	if probs := env.e.Validate(env.state()); hasCode(probs, "linked_out_of_sync") || hasCode(probs, "linked_mixed") {
+		t.Errorf("validation: %+v", probs)
+	}
+
+	// Undoing a changeset undoes it in both views.
+	r := env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("internal", "mail", "A"), RecordInput{Data: model.Ptr("198.51.100.99")}))
+	cs, err := env.e.Revert(env.ctx, r.ChangesetID, env.admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := env.e.Apply(env.ctx, cs.ID, env.admin, ApplyOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	for _, v := range []string{"internal", "external"} {
+		if !slices.Contains(env.view(v), "mail A 198.51.100.25 S") {
+			t.Errorf("revert in %s: %q", v, env.view(v))
+		}
+	}
+
+	// Unlinking keeps every record, all local.
+	env.submit(env.admin, NewRequest(OpZoneUnlink, 0, LinkInput{Zone: "example.com", View: "external"}))
+	for _, z := range env.state().ZonesNamed("example.com.") {
+		if z.LinkGroup != 0 {
+			t.Errorf("still linked: %s", zoneDesc(env.state(), z))
+		}
+	}
+	for _, v := range []string{"internal", "external"} {
+		for _, r := range env.view(v) {
+			if strings.HasSuffix(r, " S") {
+				t.Errorf("still shared after unlink in %s: %s", v, r)
+			}
+		}
+	}
+	env.submit(env.admin, recIn("internal", "solo", "A", "10.0.0.5"))
+	if slices.Contains(env.view("external"), "solo A 10.0.0.5 L") {
+		t.Error("an unlinked zone was changed")
+	}
+
+	// Linking again works out what is shared: same in both, or not.
+	env.submit(env.admin, NewRequest(OpZoneLink, 0, LinkInput{Zone: "example.com", View: "internal"}))
+	in, ex := env.view("internal"), env.view("external")
+	if !slices.Contains(in, "mail A 198.51.100.25 S") || !slices.Contains(ex, "mail A 198.51.100.25 S") {
+		t.Errorf("relink: same records not shared: internal %q external %q", in, ex)
+	}
+	if !slices.Contains(in, "solo A 10.0.0.5 L") {
+		t.Errorf("relink: internal-only record should be local: %q", in)
+	}
+	if probs := env.e.Validate(env.state()); hasCode(probs, "linked_out_of_sync") || hasCode(probs, "linked_mixed") {
+		t.Errorf("validation after relink: %+v", probs)
+	}
+
+	// Deleting one zone of two dissolves the link.
+	z := env.state().FindZone("example.com.", env.state().ViewByName("external").ID)
+	env.submit(env.admin, NewRequest(OpZoneDelete, z.ID, nil))
+	if zs := env.state().ZonesNamed("example.com."); len(zs) != 1 || zs[0].LinkGroup != 0 {
+		t.Errorf("after deleting external: %+v", zs)
+	}
+	for _, r := range env.view("internal") {
+		if strings.HasSuffix(r, " S") {
+			t.Errorf("shared record left in an unlinked zone: %s", r)
+		}
+	}
+}
+
+func hasCode(probs []validate.Problem, code string) bool {
+	for _, p := range probs {
+		if p.Code == code {
+			return true
+		}
+	}
+	return false
+}
+
+func TestLinkedPermissions(t *testing.T) {
+	env := linkedEnv(t)
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.com"), View: model.Ptr("external"), LinkWith: "internal"}))
+	u := &model.User{Username: "lan", Grants: []model.Grant{{Resource: auth.ResRecords, Access: "write", Views: []string{"internal"}}, {Resource: auth.ResZones, Access: "read"}}}
+	if err := env.st.CreateUser(env.ctx, u); err != nil {
+		t.Fatal(err)
+	}
+	lan := &auth.Principal{User: u, Method: "token"}
+	// A shared change would reach external, which this user may not change.
+	e := env.submitErr(lan, NewRequest(OpRecordUpdate, env.recordID("internal", "www", "A"), RecordInput{Data: model.Ptr("10.9.9.9")}))
+	if e.Kind != KindForbidden || !strings.Contains(e.Message, "shared with example.com [external]") || !strings.Contains(e.Message, "local") {
+		t.Errorf("shared change: %v", e)
+	}
+	// A local override is theirs to make.
+	env.submit(lan, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", View: "internal", Name: model.Ptr("www"), Type: model.Ptr("A"), Data: model.Ptr("10.9.9.9"), Local: model.Ptr(true)}))
+	if !slices.Contains(env.view("internal"), "www A 10.9.9.9 L") || !slices.Contains(env.view("external"), "www A 192.0.2.10 S") {
+		t.Errorf("override by a view-restricted user: internal %q external %q", env.view("internal"), env.view("external"))
+	}
+	// Records of a zone that isn't linked can't be "local".
+	e = env.submitErr(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.org"), View: model.Ptr("internal"), LinkWith: "external"}))
+	if e.Kind != KindNotFound {
+		t.Errorf("link_with a view without the zone: %v", e)
+	}
+}
+
+func TestLinkExisting(t *testing.T) {
+	env := linkedEnv(t)
+	// external was made by hand: the same apart from www.
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.com"), View: model.Ptr("external")}))
+	env.submit(env.admin,
+		recIn("external", "www", "A", "203.0.113.10"),
+		recIn("external", "mail", "A", "192.0.2.25"),
+		recIn("external", "@", "MX", "10 mail"))
+	before := []string{}
+	for _, v := range []string{"internal", "external"} {
+		before = append(before, strings.Join(env.view(v), ";"))
+	}
+	res := env.submit(env.admin, NewRequest(OpZoneLink, 0, LinkInput{Zone: "example.com", View: "external", With: []string{"internal"}}))
+	in, ex := env.view("internal"), env.view("external")
+	if !slices.Contains(in, "www A 192.0.2.10 L") || !slices.Contains(ex, "www A 203.0.113.10 L") {
+		t.Errorf("different www should stay local: internal %q external %q", in, ex)
+	}
+	if !slices.Contains(in, "mail A 192.0.2.25 S") || !slices.Contains(ex, "mail A 192.0.2.25 S") {
+		t.Errorf("same mail should be shared: internal %q external %q", in, ex)
+	}
+	if !strings.Contains(strings.Join(res.Warnings, " "), "www.example.com A (internal, external)") {
+		t.Errorf("warnings: %q", res.Warnings)
+	}
+	// Linking never changes what named answers: the same data as before.
+	for i, v := range []string{"internal", "external"} {
+		var data []string
+		for _, r := range env.view(v) {
+			data = append(data, strings.TrimSuffix(strings.TrimSuffix(r, " S"), " L"))
+		}
+		var was []string
+		for _, r := range strings.Split(before[i], ";") {
+			was = append(was, strings.TrimSuffix(strings.TrimSuffix(r, " S"), " L"))
+		}
+		want(t, "answers in "+v, data, was...)
+	}
+	// Sharing internal's www replaces external's.
+	env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("internal", "www", "A"), RecordInput{Local: model.Ptr(false)}))
+	if !slices.Contains(env.view("external"), "www A 192.0.2.10 S") {
+		t.Errorf("shared from internal: external %q", env.view("external"))
+	}
+}
@@ -0,0 +1,77 @@
+package engine
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"jarl/internal/model"
+	"jarl/internal/render"
+	"jarl/internal/validate"
+)
+
+// namedCheckTTL is how long the result of checking named's running
+// configuration is kept when nothing changed.
+const namedCheckTTL = 10 * time.Minute
+
+// namedCheck caches the warnings of named-checkconf on the configuration
+// named runs, keyed by what it depends on.
+type namedCheck struct {
+	mu       sync.Mutex
+	key      string
+	at       time.Time
+	problems []validate.Problem
+}
+
+// namedProblems runs named-checkconf on the configuration named runs
+// (without loading zones, which is quick) and returns what it reports as
+// problems. An apply shows these too, but they are named's own checks,
+// which Jarl doesn't repeat ("both recursion no and allow-recursion
+// active"): the dashboard lists them with Jarl's so they don't go unseen
+// after the apply. The result is reused while the deployed files and
+// named's main file are unchanged.
+func (e *Engine) namedProblems(ctx context.Context, st *model.State, deployed map[string]*model.DeployedFile) []validate.Problem {
+	if e.tools == nil || e.cfg.SkipCheck || e.cfg.MainConfig == "" || len(deployed) == 0 {
+		return nil
+	}
+	key := ""
+	if fi, err := os.Stat(e.cfg.MainConfig); err == nil {
+		key = fi.ModTime().String()
+	}
+	if f := deployed[e.cfg.Paths.MainConfig()]; f != nil {
+		key += "|" + f.SHA256
+	}
+	c := &e.namedCheck
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.key == key && e.Now().Sub(c.at) < namedCheckTTL {
+		return c.problems
+	}
+	res, err := e.tools.CheckConfig(ctx, e.cfg.MainConfig, false)
+	if err != nil {
+		return nil // named-checkconf couldn't run; an apply reports that
+	}
+	out := render.Render(st, e.cfg.Paths, e.extras(ctx))
+	var ps []validate.Problem
+	for _, m := range res.Messages {
+		p := validate.Problem{Severity: validate.Warning, Code: "named_warning", View: m.View, Zone: m.Zone}
+		if m.Error {
+			p.Severity, p.Code = validate.Error, "named_error"
+		}
+		where := ""
+		if m.File != "" {
+			where = fmt.Sprintf(" (%s:%d)", m.File, m.Line)
+		}
+		if span, ok := out.Lookup(m.File, m.Line); ok {
+			p.ObjectType, p.ObjectID = span.ObjectType, span.ObjectID
+			where = " (" + span.Label + ", " + where[2:]
+		}
+		p.Message = "named-checkconf: " + strings.TrimSpace(m.Text) + where
+		ps = append(ps, p)
+	}
+	c.key, c.at, c.problems = key, e.Now(), ps
+	return ps
+}
@@ -11,6 +11,7 @@ import (
 	"jarl/internal/auth"
 	"jarl/internal/catalog"
 	"jarl/internal/dnsname"
+	"jarl/internal/iprange"
 	"jarl/internal/model"
 	"jarl/internal/namedconf"
 	"jarl/internal/rr"
@@ -106,11 +107,21 @@ func applyOp(st *model.State, op model.Op, c *applyCtx) error {
 		err = applyBlockRulePut(st, op, c)
 	case OpBlockRuleDelete:
 		err = applyBlockRuleDelete(st, op, c)
+	case OpBlockStepCreate, OpBlockStepUpdate:
+		err = applyBlockStepPut(st, op, c)
+	case OpBlockStepDelete:
+		err = applyBlockStepDelete(st, op, c)
+	case OpClientGroupCreate, OpClientGroupUpdate:
+		err = applyClientGroupPut(st, op, c)
+	case OpClientGroupDelete:
+		err = applyClientGroupDelete(st, op, c)
+	case OpBlockingPause:
+		err = applyBlockingPause(st, op, c)
 	default:
 		err = errf(KindBadRequest, "unknown operation %q", op.Kind)
 	}
 	if e, ok := AsError(err); ok && e.OpSeq == 0 {
-		e.OpSeq = op.Seq
+		e.OpSeq, e.OpSummary = op.Seq, op.Summary
 	}
 	return err
 }
@@ -238,6 +249,9 @@ func setZoneFields(st *model.State, z *model.Zone, in *ZoneInput, creating bool)
 	if in.SerialPolicy != nil {
 		z.SerialPolicy = strings.ToLower(strings.TrimSpace(*in.SerialPolicy))
 	}
+	if in.Disabled != nil {
+		z.Disabled = *in.Disabled
+	}
 	if in.DNSSECPolicy != nil {
 		p := strings.Trim(strings.TrimSpace(*in.DNSSECPolicy), `"`)
 		switch strings.ToLower(p) {
@@ -251,6 +265,9 @@ func setZoneFields(st *model.State, z *model.Zone, in *ZoneInput, creating bool)
 	if in.Comment != nil {
 		z.Comment = *in.Comment
 	}
+	if in.LinkGroup != nil {
+		z.LinkGroup = *in.LinkGroup
+	}
 	return nil
 }

@@ -433,6 +450,9 @@ func applyRecordCreate(st *model.State, op model.Op, c *applyCtx) error {
 	if in.Disabled != nil {
 		r.Disabled = *in.Disabled
 	}
+	if in.SharedID != nil {
+		r.SharedID = *in.SharedID
+	}
 	for _, w := range p.Warnings {
 		c.warn("%s %s: %s", dnsname.Display(owner), p.Type, w)
 	}
@@ -444,7 +464,7 @@ func applyRecordCreate(st *model.State, op model.Op, c *applyCtx) error {
 func applyRecordUpdate(st *model.State, op model.Op, c *applyCtx) error {
 	r := st.Records[op.ID]
 	if r == nil {
-		return errf(KindNotFound, "record %d does not exist", op.ID)
+		return errf(KindConflict, "the record (ID %d) no longer exists: it was deleted after this change was staged; remove this operation from the changeset", op.ID)
 	}
 	if err := checkVersion(op, r.Version, recordLabel(r)); err != nil {
 		return err
@@ -512,6 +532,9 @@ func applyRecordUpdate(st *model.State, op model.Op, c *applyCtx) error {
 	if in.Disabled != nil {
 		r.Disabled = *in.Disabled
 	}
+	if in.SharedID != nil {
+		r.SharedID = *in.SharedID
+	}
 	r.Touch(c.user(), c.now)
 	return nil
 }
@@ -520,7 +543,10 @@ func applyRecordDelete(st *model.State, op model.Op, c *applyCtx) error {
 	if op.ID != 0 {
 		r := st.Records[op.ID]
 		if r == nil {
-			return errf(KindNotFound, "record %d does not exist", op.ID)
+			// Deleted since this was staged (by someone else, or the
+			// CLI): what the operation wanted is done.
+			c.warn("%s: the record was already deleted outside this changeset, so there was nothing to delete", strings.TrimPrefix(op.Summary, "delete "))
+			return nil
 		}
 		if err := checkVersion(op, r.Version, recordLabel(r)); err != nil {
 			return err
@@ -645,16 +671,34 @@ func applyRRSetReplace(st *model.State, op model.Op, c *applyCtx) error {
 		k := strings.ToLower(r.Data)
 		if seen[k] && !keep[k] {
 			keep[k] = true
-			if (ttlKnown && !sameTTL(r.TTL, ttl)) || r.Disabled {
+			shared := r.SharedID
+			if in.Shared != nil {
+				shared = 0
+				if *in.Shared {
+					shared = r.SharedID
+					if shared == 0 {
+						shared = r.ID
+					}
+				}
+			}
+			if (ttlKnown && !sameTTL(r.TTL, ttl)) || r.Disabled || shared != r.SharedID {
 				if ttlKnown {
 					r.TTL = copyTTL(ttl)
 				}
-				r.Disabled = false
+				r.Disabled, r.SharedID = false, shared
 				r.Touch(c.user(), c.now)
 			}
 			continue
 		}
 		if r.Disabled {
+			// Kept, but shared or local like the rest of the set.
+			if in.Shared != nil && (*in.Shared) != (r.SharedID != 0) {
+				r.SharedID = 0
+				if *in.Shared {
+					r.SharedID = r.ID
+				}
+				r.Touch(c.user(), c.now)
+			}
 			continue
 		}
 		delete(st.Records, id)
@@ -675,6 +719,9 @@ func applyRRSetReplace(st *model.State, op model.Op, c *applyCtx) error {
 		if in.Comment != nil {
 			r.Comment = *in.Comment
 		}
+		if in.Shared != nil && *in.Shared {
+			r.SharedID = r.ID
+		}
 		r.Touch(c.user(), c.now)
 		st.Records[r.ID] = r
 	}
@@ -748,9 +795,41 @@ func setViewFields(v *model.View, in *ViewInput) error {
 	if in.Position != nil {
 		v.Position = *in.Position
 	}
+	if in.Exposure != nil {
+		e, err := normalizeExposure(*in.Exposure)
+		if err != nil {
+			return err
+		}
+		v.Exposure = e
+	}
+	if in.Acknowledged != nil {
+		v.Acknowledged = cleanAcks(*in.Acknowledged)
+	}
 	return nil
 }

+// normalizeExposure checks an exposure override.
+func normalizeExposure(s string) (string, error) {
+	switch e := strings.ToLower(strings.TrimSpace(s)); e {
+	case "", "auto":
+		return model.ExposureAuto, nil
+	case model.ExposurePublic, model.ExposurePrivate:
+		return e, nil
+	}
+	return "", errf(KindBadRequest, "exposure must be auto, public or private, not %q", s)
+}
+
+// cleanAcks drops empty acknowledgements (nil for none).
+func cleanAcks(acks []model.Acknowledgement) []model.Acknowledgement {
+	var out []model.Acknowledgement
+	for _, a := range acks {
+		if a.Code != "" {
+			out = append(out, a)
+		}
+	}
+	return out
+}
+
 func applyViewCreate(st *model.State, op model.Op, c *applyCtx) error {
 	var in ViewInput
 	if err := decode(op.Data, &in); err != nil {
@@ -1122,13 +1201,50 @@ func NormalizeOption(st *model.State, scope string, scopeID int64, name, value s
 	if (stmt.Kind == catalog.KindString) && !strings.HasPrefix(v, `"`) && !strings.ContainsAny(v, " \t{};") {
 		v = namedconf.QuoteString(v)
 	}
+	// Lists may be given without their braces: "10.0.0.53; key xfer".
+	v = stmt.WrapList(v)
 	parsed, err := namedconf.ParseOptionValue(n, v)
 	if err != nil {
 		return "", "", errf(KindBadRequest, "option %s: %v", n, err)
 	}
+	namedconf.JoinRanges(parsed)
+	if err := checkOptionRanges(parsed, strings.Contains(stmt.Grammar, "<address_match_element>")); err != nil {
+		return "", "", errf(KindBadRequest, "option %s: %v", n, err)
+	}
 	return n, namedconf.Compact(parsed.Items[1:]), nil
 }

+// checkOptionRanges checks the address ranges in an option's blocks: they
+// must be valid, and only options with address match lists take them.
+func checkOptionRanges(st *namedconf.Stmt, aml bool) error {
+	for _, it := range st.Items {
+		if it.Block == nil {
+			continue
+		}
+		for _, s := range it.Block.Stmts {
+			items := s.Items
+			if len(items) == 2 && items[0].Bang {
+				items = items[1:]
+			}
+			if len(items) == 1 && items[0].Value != nil && !items[0].Value.Quoted {
+				if _, ok, err := iprange.Parse(items[0].Value.Text); ok {
+					if err != nil {
+						return err
+					}
+					if !aml {
+						return fmt.Errorf("%s: address ranges only work in address match lists (such as allow-query or an ACL), not here", items[0].Value.Text)
+					}
+					continue
+				}
+			}
+			if err := checkOptionRanges(s, aml); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
 func applyOptionPut(st *model.State, op model.Op, c *applyCtx) error {
 	var in OptionInput
 	if err := decode(op.Data, &in); err != nil {
@@ -1275,6 +1391,16 @@ func applySettings(st *model.State, op model.Op, c *applyCtx) error {
 	if in.SerialPolicy != nil {
 		s.SerialPolicy = strings.ToLower(*in.SerialPolicy)
 	}
+	if in.Exposure != nil {
+		e, err := normalizeExposure(*in.Exposure)
+		if err != nil {
+			return err
+		}
+		s.Exposure = e
+	}
+	if in.Acknowledged != nil {
+		s.Acknowledged = cleanAcks(*in.Acknowledged)
+	}
 	s.Version++
 	return nil
 }
@@ -0,0 +1,22 @@
+package engine
+
+import (
+	"testing"
+
+	"jarl/internal/model"
+)
+
+func TestNormalizeOptionWrapsLists(t *testing.T) {
+	st := model.NewState()
+	for in, want := range map[string]string{
+		"10.0.10.53":           "{ 10.0.10.53; }",
+		"localhost; key xfer;": "{ localhost; key xfer; }",
+		"port 53 { any; }":     "port 53 { any; }",
+		"localhost 10.0.10.53": "{ localhost; 10.0.10.53; }",
+	} {
+		_, v, err := NormalizeOption(st, model.ScopeOptions, 0, "allow-transfer", in)
+		if err != nil || v != want {
+			t.Errorf("%q: %q, %v; want %q", in, v, err, want)
+		}
+	}
+}
@@ -0,0 +1,53 @@
+package engine
+
+import (
+	"slices"
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+)
+
+// Ticking "update PTR" on an unchanged address record adds its PTR when
+// the reverse zone is there (it was created after the record).
+func TestUpdatePTRAddsMissing(t *testing.T) {
+	env := newEnv(t)
+	env.submit(env.admin, NewRequest(OpSettingsUpdate, 0, SettingsInput{Nameservers: &[]string{"ns1.example.net."}}))
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.com")}))
+	env.submit(env.admin, rec("example.com", "ldn", "A", "139.144.144.154"))
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("139.144.144.154/32")}))
+	var id int64
+	for _, r := range env.state().Records {
+		if r.Name == "ldn.example.com." {
+			id = r.ID
+		}
+	}
+	env.submit(env.admin, NewRequest(OpRecordUpdate, id, RecordInput{PTR: true}))
+	got := env.records("154.144.144.139.in-addr.arpa.")
+	if !slices.ContainsFunc(got, func(s string) bool { return strings.Contains(s, "PTR ldn.example.com.") }) {
+		t.Errorf("reverse zone = %q", got)
+	}
+}
+
+// In linked zones the PTR goes to the reverse zone of whichever linked
+// view has one.
+func TestUpdatePTRLinked(t *testing.T) {
+	env := linkedEnv(t)
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.com"), View: model.Ptr("external"), LinkWith: "internal"}))
+	env.submit(env.admin, recIn("internal", "ldn", "A", "139.144.144.154"))
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("139.144.144.154/32"), View: model.Ptr("external")}))
+	res := env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("internal", "ldn", "A"), RecordInput{PTR: true}))
+	st := env.state()
+	z := st.FindZone("154.144.144.139.in-addr.arpa.", st.ViewByName("external").ID)
+	ok := false
+	for _, r := range st.ZoneRecords(z.ID) {
+		ok = ok || r.Type == "PTR" && r.Data == "ldn.example.com."
+	}
+	if !ok {
+		t.Errorf("no PTR in external's reverse zone (warnings %q)", res.Warnings)
+	}
+	// Again: already there, nothing to do.
+	if e := env.submitErr(env.admin, NewRequest(OpRecordUpdate, env.recordID("internal", "ldn", "A"), RecordInput{PTR: true})); !strings.Contains(e.Message, "nothing to do") {
+		t.Errorf("second time: %v", e)
+	}
+}
@@ -0,0 +1,113 @@
+package engine
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+	"jarl/internal/validate"
+)
+
+func hasProblem(ps []validate.Problem, code string) bool {
+	for _, p := range ps {
+		if p.Code == code {
+			return true
+		}
+	}
+	return false
+}
+
+func describeProblems(e *Error) string {
+	var out []string
+	for _, p := range e.Problems {
+		out = append(out, p.Message)
+	}
+	return strings.Join(out, "; ")
+}
+
+func optionReq(name, value string) Request {
+	return NewRequest(OpOptionCreate, 0, OptionInput{Scope: model.Ptr(model.ScopeOptions), Name: &name, Value: &value})
+}
+
+func TestAddressRanges(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin,
+		NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("dhcp"), Elements: &[]string{"!10.0.10.150 - 10.0.10.160", "10.0.10.101-10.0.10.199", "2001:db8::100-2001:db8::1ff"}}),
+		optionReq("allow-query", "10.0.20.1 - 10.0.20.6; localhost"),
+	)
+	st := env.state()
+	if a := st.ACLByName("dhcp"); strings.Join(a.Elements, " ") != "!10.0.10.150-10.0.10.160 10.0.10.101-10.0.10.199 2001:db8::100-2001:db8::1ff" {
+		t.Errorf("stored elements = %q", a.Elements)
+	}
+	if o := st.FindOption(model.ScopeOptions, 0, "allow-query"); o == nil || o.Value != "{ 10.0.20.1-10.0.20.6; localhost; }" {
+		t.Errorf("stored option = %+v", o)
+	}
+	conf, _ := os.ReadFile(filepath.Join(env.dir, "etc/named.conf"))
+	c := string(conf)
+	for _, want := range []string{
+		"acl \"dhcp\" {\n\t// !10.0.10.150-10.0.10.160\n\t!10.0.10.150/31;\n\t!10.0.10.152/29;\n\t!10.0.10.160;\n\t// 10.0.10.101-10.0.10.199\n\t10.0.10.101;\n",
+		"\t10.0.10.192/29;\n\t// 2001:db8::100-2001:db8::1ff\n\t2001:db8::100/120;\n};\n",
+		"\tallow-query {\n\t\t// 10.0.20.1-10.0.20.6\n\t\t10.0.20.1;\n\t\t10.0.20.2/31;\n\t\t10.0.20.4/31;\n\t\t10.0.20.6;\n\t\tlocalhost;\n\t};\n",
+	} {
+		if !strings.Contains(c, want) {
+			t.Errorf("named.conf lacks %q:\n%s", want, c)
+		}
+	}
+	for _, l := range strings.Split(c, "\n") {
+		if code, _, _ := strings.Cut(l, "//"); strings.Contains(code, "-10.0.") || strings.Contains(code, "-2001:") {
+			t.Errorf("a range reached named.conf outside a comment: %q", l)
+		}
+	}
+
+	// Mistakes are caught when they're entered.
+	for _, tc := range []struct {
+		req  Request
+		want string
+	}{
+		{NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("bad"), Elements: &[]string{"10.0.10.199-10.0.10.101"}}), "start is after the end"},
+		{NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("bad"), Elements: &[]string{"10.0.10.101-199"}}), "not a full IP address"},
+		{optionReq("forwarders", "{ 192.0.2.1-192.0.2.9; }"), "only work in address match lists"},
+		{optionReq("allow-recursion", "{ 10.0.0.9-10.0.0.1; }"), "start is after the end"},
+		{NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("10.0.0.1-10.0.0.9"), Elements: &[]string{"10.0.0.1"}}), "looks like an address range"},
+	} {
+		if e := env.submitErr(env.admin, tc.req); !strings.Contains(e.Error(), tc.want) && !strings.Contains(describeProblems(e), tc.want) {
+			t.Errorf("%s: %v %s, want %q", tc.req.Op, e, describeProblems(e), tc.want)
+		}
+	}
+
+	// Validation sees what a range covers: everything is "any".
+	res := env.submit(env.admin, optionReq("allow-recursion", "0.0.0.0-255.255.255.255"))
+	if !hasProblem(res.Problems, "security_open_resolver") {
+		t.Errorf("no open resolver warning for 0.0.0.0-255.255.255.255: %+v", res.Problems)
+	}
+	// IPv6 ranges in the IPv4-mapped space get a warning.
+	res = env.submit(env.admin, NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("mapped"), Elements: &[]string{"::ffff:10.0.0.1-::ffff:10.0.0.9"}}))
+	if !hasProblem(res.Problems, "range_mapped4") {
+		t.Errorf("no range_mapped4 warning: %+v", res.Problems)
+	}
+}
+
+func TestClientGroupRanges(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	_, srv := newListServer(t, "||ads.example^\n")
+	env.submit(env.admin,
+		NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("tablets"), Elements: &[]string{"10.0.0.50-10.0.0.51"}}),
+	)
+	env.submit(env.admin, blocklist("ads", srv.URL+"/a.txt"), clientGroup("kids", "off", "tablets", "10.0.0.20 - 10.0.0.23"))
+	if g := env.state().SortedClientGroups(); len(g) != 1 || strings.Join(g[0].Members, " ") != "tablets 10.0.0.20-10.0.0.23" {
+		t.Fatalf("groups = %+v", g)
+	}
+	b, err := os.ReadFile(filepath.Join(env.dir, "zones/_default/off.gate.jarl.invalid.rpz"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"31.50.0.0.10.rpz-client-ip", "30.20.0.0.10.rpz-client-ip"} {
+		if !strings.Contains(string(b), want) {
+			t.Errorf("off gate lacks %s:\n%s", want, b)
+		}
+	}
+}
@@ -152,6 +152,11 @@ func FindRefs(st *model.State, kind refKind, name string) []string {
 			out = append(out, "view "+v.Name)
 		}
 	}
+	for _, g := range st.SortedClientGroups() {
+		if _, hit := rewriteElements(g.Members, kind, name, name); hit {
+			out = append(out, "client group "+g.Name)
+		}
+	}
 	var opts []string
 	for _, o := range st.Options {
 		stmt, err := namedconf.ParseOptionValue(o.Name, o.Value)
@@ -188,6 +193,12 @@ func renameRefs(st *model.State, kind refKind, old, new string, c *applyCtx) {
 			v.Touch(c.user(), c.now)
 		}
 	}
+	for _, g := range st.ClientGroups {
+		if l, hit := rewriteElements(g.Members, kind, old, new); hit {
+			g.Members = l
+			g.Touch(c.user(), c.now)
+		}
+	}
 	for _, o := range st.Options {
 		stmt, err := namedconf.ParseOptionValue(o.Name, o.Value)
 		if err != nil {
@@ -101,8 +101,8 @@ func (e *Engine) guardSerials(ctx context.Context, base, work *model.State, bump
 			continue
 		}
 		old := base.Zones[z.ID]
-		if old == nil || old.Type != model.ZonePrimary || old.ViewID != z.ViewID {
-			continue // new to named: nothing loaded to compare with
+		if old == nil || old.Type != model.ZonePrimary || old.ViewID != z.ViewID || old.Disabled || z.Disabled {
+			continue // new to named (or not in it): nothing loaded to compare with
 		}
 		path := render.ZoneFilePath(work, z, e.cfg.Paths)
 		if cur, ok, _ := readFile(path); ok && string(cur) == render.ZoneFile(work, z) {
@@ -0,0 +1,51 @@
+package engine
+
+import (
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+)
+
+// Records deleted or changed after a change to them was staged (in the
+// CLI while a web UI changeset is open, say).
+func TestStaleChangeset(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin, rec("example.com", "one", "A", "192.0.2.51"), rec("example.com", "two", "A", "192.0.2.52"), rec("example.com", "three", "A", "192.0.2.53"))
+	st := env.state()
+	one, two, three := findRec(st, "one.example.com.", "A"), findRec(st, "two.example.com.", "A"), findRec(st, "three.example.com.", "A")
+
+	// Two deletes staged; one of the records is deleted elsewhere first.
+	cs, err := env.e.CreateChangeset(env.ctx, env.admin, "web", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := env.e.Stage(env.ctx, cs.ID, []Request{NewRequest(OpRecordDelete, one.ID, nil), NewRequest(OpRecordDelete, two.ID, nil)}, env.admin); err != nil {
+		t.Fatal(err)
+	}
+	env.submit(env.admin, NewRequest(OpRecordDelete, one.ID, nil))
+	res, err := env.e.Apply(env.ctx, cs.ID, env.admin, ApplyOptions{})
+	if err != nil {
+		t.Fatalf("apply after the record was deleted elsewhere: %v", err)
+	}
+	if len(res.Warnings) != 1 || !strings.Contains(res.Warnings[0], "one.example.com. A 192.0.2.51: the record was already deleted") {
+		t.Errorf("warnings = %q", res.Warnings)
+	}
+	if st := env.state(); st.Records[two.ID] != nil {
+		t.Error("two was not deleted")
+	}
+
+	// A staged edit of a record deleted elsewhere names the operation.
+	cs, _ = env.e.CreateChangeset(env.ctx, env.admin, "web", "")
+	env.e.Stage(env.ctx, cs.ID, []Request{NewRequest(OpRecordUpdate, three.ID, RecordInput{Data: model.Ptr("192.0.2.54")})}, env.admin)
+	env.submit(env.admin, NewRequest(OpRecordDelete, three.ID, nil))
+	p, err := env.e.Preview(env.ctx, cs.ID, env.admin)
+	if err != nil || p.Error == nil || p.Error.OpSeq != 1 || !strings.HasPrefix(p.Error.OpSummary, "change three.example.com. A 192.0.2.53") {
+		t.Fatalf("preview = %+v, %v", p, err)
+	}
+	_, err = env.e.Apply(env.ctx, cs.ID, env.admin, ApplyOptions{})
+	if ee, ok := AsError(err); !ok || ee.Kind != KindConflict || !strings.Contains(err.Error(), "operation 1 (change three.example.com. A") || !strings.Contains(err.Error(), "remove this operation") {
+		t.Errorf("apply = %v", err)
+	}
+}
@@ -0,0 +1,68 @@
+package engine
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+
+	"jarl/internal/model"
+	"jarl/internal/nscheck"
+	"jarl/internal/render"
+	"jarl/internal/store"
+)
+
+// viewKeySeedMeta is where the seed of the view keys is kept.
+const viewKeySeedMeta = "view_key_seed"
+
+// ViewKeySeed returns the seed the view keys' secrets are derived from
+// (render/viewkeys.go), creating it the first time.
+func ViewKeySeed(ctx context.Context, st *store.Store) ([]byte, error) {
+	v, err := st.GetMeta(ctx, viewKeySeedMeta)
+	if err == nil {
+		return base64.StdEncoding.DecodeString(v)
+	}
+	if !errors.Is(err, store.ErrNotFound) {
+		return nil, err
+	}
+	seed := make([]byte, 32)
+	if _, err := rand.Read(seed); err != nil {
+		return nil, err
+	}
+	if err := st.SetMeta(ctx, viewKeySeedMeta, base64.StdEncoding.EncodeToString(seed)); err != nil {
+		return nil, err
+	}
+	return seed, nil
+}
+
+// extras returns what jarld's configuration adds to the rendered
+// configuration, with the view keys' seed.
+func (e *Engine) extras(ctx context.Context) render.Extras {
+	x := e.cfg.Extras
+	e.seedMu.Lock()
+	defer e.seedMu.Unlock()
+	if e.seed == nil {
+		seed, err := ViewKeySeed(ctx, e.store)
+		if err != nil {
+			e.log.Warn("view keys: reading their seed failed", "err", err)
+			return x
+		}
+		e.seed = seed
+	}
+	x.ViewKeySeed = e.seed
+	return x
+}
+
+// ViewKey returns the TSIG key that selects a zone's view on this server
+// (nil without views).
+func (e *Engine) ViewKey(ctx context.Context, st *model.State, z *model.Zone) *nscheck.Key {
+	v := st.Views[z.ViewID]
+	if v == nil {
+		return nil
+	}
+	x := e.extras(ctx)
+	if len(x.ViewKeySeed) == 0 {
+		return nil
+	}
+	return &nscheck.Key{Name: render.ViewKeyName(v.Name), Algorithm: render.ViewKeyAlgorithm, Secret: render.ViewKeySecret(x.ViewKeySeed, v.ID)}
+}
@@ -0,0 +1,81 @@
+package engine
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+)
+
+func TestZoneDisable(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	z := env.state().ZonesNamed("example.com")[0]
+	confPath := filepath.Join(env.dir, "etc/named.conf")
+	zonePath := filepath.Join(env.dir, "zones/_default/example.com.zone")
+
+	res := env.submit(env.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{Disabled: model.Ptr(true)}))
+	if res.Ops[0].Summary != "disable zone example.com" || len(res.Warnings) != 1 || !strings.Contains(res.Warnings[0], "recursion") {
+		t.Errorf("disable: %q, warnings %v", res.Ops[0].Summary, res.Warnings)
+	}
+	conf, _ := os.ReadFile(confPath)
+	if strings.Contains(string(conf), "zone \"example.com\" {") || !strings.Contains(string(conf), `// zone "example.com" is disabled in Jarl`) {
+		t.Errorf("named.conf with the zone disabled:\n%s", conf)
+	}
+	// Still edited, and its file kept up to date.
+	env.submit(env.admin, rec("example.com", "www", "A", "192.0.2.10"))
+	if f, err := os.ReadFile(zonePath); err != nil || !strings.Contains(string(f), "www\t\tIN\tA\t192.0.2.10") {
+		t.Errorf("zone file while disabled: %v\n%s", err, f)
+	}
+
+	// Enabling brings it back.
+	res = env.submit(env.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{Disabled: model.Ptr(false)}))
+	if res.Ops[0].Summary != "enable zone example.com" {
+		t.Errorf("enable: %q", res.Ops[0].Summary)
+	}
+	if conf, _ := os.ReadFile(confPath); !strings.Contains(string(conf), "zone \"example.com\" {") {
+		t.Errorf("named.conf after enabling:\n%s", conf)
+	}
+	// Reverting a disable enables the zone again.
+	res = env.submit(env.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{Disabled: model.Ptr(true)}))
+	rev, err := env.e.Revert(env.ctx, res.ChangesetID, env.admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := env.e.Apply(env.ctx, rev.ID, env.admin, ApplyOptions{}); err != nil || env.state().Zones[z.ID].Disabled {
+		t.Errorf("revert of a disable: %v, disabled=%v", err, env.state().Zones[z.ID].Disabled)
+	}
+
+	// Signed zones can't be disabled.
+	env.submit(env.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{DNSSECPolicy: model.Ptr("default")}))
+	if e := env.submitErr(env.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{Disabled: model.Ptr(true)})); e.Kind != KindValidation || !strings.Contains(e.Message, "signed zone can't be disabled") {
+		t.Errorf("disabling a signed zone: %+v", e)
+	}
+}
+
+func TestZoneDisableInView(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin,
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("internal"), MatchClients: &[]string{"10.0.0.0/8"}, AdoptZones: true}),
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("external")}),
+	)
+	st := env.state()
+	ext := st.ViewByName("external")
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.com"), ViewID: &ext.ID, Type: model.Ptr(model.ZoneInView), InView: model.Ptr("internal")}))
+	in := st.ZonesNamed("example.com")[0]
+	// The zone another view shares can't be disabled alone.
+	if e := env.submitErr(env.admin, NewRequest(OpZoneUpdate, in.ID, ZoneInput{Disabled: model.Ptr(true)})); e.Kind != KindValidation || !strings.Contains(e.Message, "is disabled, so this zone can't share it") {
+		t.Errorf("disabling a shared zone: %+v", e)
+	}
+	// Without recursion, the warning says REFUSED.
+	env.submit(env.admin, NewRequest(OpOptionCreate, 0, OptionInput{Scope: model.Ptr(model.ScopeView), ScopeID: &ext.ID, Name: model.Ptr("recursion"), Value: model.Ptr("no")}))
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("public.example"), ViewID: &ext.ID}))
+	pub := env.state().FindZone("public.example", ext.ID)
+	res := env.submit(env.admin, NewRequest(OpZoneUpdate, pub.ID, ZoneInput{Disabled: model.Ptr(true)}))
+	if len(res.Warnings) != 1 || !strings.Contains(res.Warnings[0], "view external answers REFUSED") {
+		t.Errorf("warnings = %v", res.Warnings)
+	}
+}
@@ -393,6 +393,10 @@ func (im *importer) key(s *namedconf.Stmt) error {
 		return fmt.Errorf("%s: key without a block", s.Pos)
 	}
 	name := model.NormalizeKeyName(s.Arg(0))
+	if strings.HasPrefix(name, model.ViewKeyPrefix) {
+		// A view key from a configuration Jarl wrote: Jarl makes its own.
+		return nil
+	}
 	alg, secret := "", ""
 	if a := namedconf.FindOne(b.Stmts, "algorithm"); a != nil {
 		alg = strings.ToLower(a.Arg(0))
@@ -433,7 +437,7 @@ func (im *importer) view(s *namedconf.Stmt) error {
 		switch kw := st.Keyword(); kw {
 		case "match-clients":
 			if mb := st.FirstBlock(); mb != nil {
-				v.MatchClients = nonNil(elementStrings(mb))
+				v.MatchClients = withoutViewKeys(nonNil(elementStrings(mb)))
 			}
 		case "match-destinations":
 			if mb := st.FirstBlock(); mb != nil {
@@ -807,3 +811,23 @@ func allowsNone(o *namedconf.Stmt) bool {
 	}
 	return true
 }
+
+// withoutViewKeys drops the view keys Jarl puts in front of match-clients
+// (render/viewkeys.go) from a list read from a configuration Jarl wrote,
+// and the "any" it adds after them to a view that had no list.
+func withoutViewKeys(elems []string) []string {
+	out := []string{}
+	dropped := false
+	for _, e := range elems {
+		f := strings.Fields(strings.TrimPrefix(strings.TrimSpace(e), "!"))
+		if len(f) == 2 && f[0] == "key" && strings.HasPrefix(strings.Trim(f[1], `"`), model.ViewKeyPrefix) {
+			dropped = true
+			continue
+		}
+		out = append(out, e)
+	}
+	if dropped && len(out) == 1 && out[0] == "any" {
+		return []string{}
+	}
+	return out
+}
@@ -205,3 +205,15 @@ view "internal" {
 		t.Errorf("imported state has errors: %v", ps)
 	}
 }
+
+func TestWithoutViewKeys(t *testing.T) {
+	for _, tc := range []struct{ in, want []string }{
+		{[]string{"!key jarl-view-external", `key "jarl-view-internal"`, "homelab"}, []string{"homelab"}},
+		{[]string{"key jarl-view-external", "any"}, []string{}},
+		{[]string{"key xfer", "any"}, []string{"key xfer", "any"}},
+	} {
+		if got := withoutViewKeys(tc.in); strings.Join(got, ";") != strings.Join(tc.want, ";") || got == nil {
+			t.Errorf("%v: %v, want %v", tc.in, got, tc.want)
+		}
+	}
+}
@@ -0,0 +1,148 @@
+// Package iprange handles address ranges such as 10.0.10.101-10.0.10.199
+// or 2001:db8::100-2001:db8::1ff. BIND matches only addresses and
+// prefixes, so Jarl keeps a range as it was written and turns it into the
+// exact set of prefixes that covers it when it writes named.conf.
+package iprange
+
+import (
+	"fmt"
+	"math/big"
+	"net/netip"
+	"strings"
+)
+
+// Range is an inclusive range of addresses of one family.
+type Range struct {
+	Start, End netip.Addr
+}
+
+// String returns the range as Jarl writes it: START-END.
+func (r Range) String() string { return r.Start.String() + "-" + r.End.String() }
+
+// Parse parses START-END, both full addresses of the same family. ok is
+// false when s isn't meant as a range (no "-", or text before it that
+// isn't an address, such as the ACL name "branch-office"); err is set when
+// it is meant as one but is wrong.
+func Parse(s string) (r Range, ok bool, err error) {
+	left, right, found := strings.Cut(s, "-")
+	if !found {
+		return Range{}, false, nil
+	}
+	left, right = strings.TrimSpace(left), strings.TrimSpace(right)
+	if !looksLikeAddr(left) {
+		return Range{}, false, nil
+	}
+	start, err := netip.ParseAddr(left)
+	if err != nil {
+		return Range{}, true, fmt.Errorf("range %q: %q is not a full IP address", s, left)
+	}
+	end, err := netip.ParseAddr(right)
+	if err != nil {
+		if right == "" {
+			return Range{}, true, fmt.Errorf("range %q has no end address", s)
+		}
+		return Range{}, true, fmt.Errorf("range %q: %q is not a full IP address (write both ends in full, e.g. 10.0.10.101-10.0.10.199)", s, right)
+	}
+	if start.Zone() != "" || end.Zone() != "" {
+		return Range{}, true, fmt.Errorf("range %q: addresses with a zone (%%interface) can't be matched", s)
+	}
+	if start.Is4() != end.Is4() {
+		return Range{}, true, fmt.Errorf("range %q mixes IPv4 and IPv6", s)
+	}
+	if end.Less(start) {
+		return Range{}, true, fmt.Errorf("range %q: the start is after the end", s)
+	}
+	return Range{Start: start, End: end}, true, nil
+}
+
+// looksLikeAddr reports whether s could only be meant as an address: it
+// has a colon, or it is digits and dots with at least one dot.
+func looksLikeAddr(s string) bool {
+	if strings.Contains(s, ":") {
+		return true
+	}
+	if !strings.Contains(s, ".") {
+		return false
+	}
+	for i := 0; i < len(s); i++ {
+		if c := s[i]; !(c >= '0' && c <= '9' || c == '.') {
+			return false
+		}
+	}
+	return true
+}
+
+// Prefixes returns the fewest prefixes that together cover exactly the
+// range, in address order: 10.0.10.101-10.0.10.199 is 10.0.10.101/32,
+// 10.0.10.102/31, 10.0.10.104/29, 10.0.10.112/28, 10.0.10.128/26 and
+// 10.0.10.192/29. That is at most 62 prefixes for IPv4 and 254 for IPv6.
+func (r Range) Prefixes() []netip.Prefix {
+	var out []netip.Prefix
+	a := r.Start
+	for {
+		// The largest prefix that starts at a and ends at or before End.
+		p := netip.PrefixFrom(a, a.BitLen())
+		for bits := a.BitLen() - 1; bits >= 0; bits-- {
+			q := netip.PrefixFrom(a, bits)
+			if q.Masked().Addr() != a || r.End.Less(last(q)) {
+				break
+			}
+			p = q
+		}
+		out = append(out, p)
+		end := last(p)
+		if end == r.End {
+			return out
+		}
+		a = end.Next()
+	}
+}
+
+// last returns the last address of a prefix.
+func last(p netip.Prefix) netip.Addr {
+	b := p.Addr().AsSlice()
+	for i := p.Bits(); i < len(b)*8; i++ {
+		b[i/8] |= 0x80 >> (i % 8)
+	}
+	a, _ := netip.AddrFromSlice(b)
+	return a
+}
+
+// Size returns the number of addresses in the range.
+func (r Range) Size() *big.Int {
+	s := new(big.Int).SetBytes(r.Start.AsSlice())
+	e := new(big.Int).SetBytes(r.End.AsSlice())
+	return e.Sub(e, s).Add(e, big.NewInt(1))
+}
+
+// SizeText describes the size for people: "99 addresses", or a power of
+// two for very large IPv6 ranges ("about 2^80 addresses").
+func (r Range) SizeText() string {
+	n := r.Size()
+	if n.BitLen() <= 40 {
+		if n.Int64() == 1 {
+			return "1 address"
+		}
+		return n.String() + " addresses"
+	}
+	return fmt.Sprintf("about 2^%d addresses", n.BitLen()-1)
+}
+
+// Mapped4 is the IPv4-mapped IPv6 space; BIND can see IPv4 clients as
+// addresses in it.
+var Mapped4 = netip.MustParsePrefix("::ffff:0:0/96")
+
+// TouchesMapped4 reports whether an IPv6 range overlaps ::ffff:0:0/96.
+func (r Range) TouchesMapped4() bool {
+	if r.Start.Is4() {
+		return false
+	}
+	lo, hi := Mapped4.Addr(), last(Mapped4)
+	return !(r.End.Less(lo) || hi.Less(r.Start))
+}
+
+// FromPrefix returns the addresses of a prefix as a range.
+func FromPrefix(p netip.Prefix) Range {
+	p = p.Masked()
+	return Range{Start: p.Addr(), End: last(p)}
+}
@@ -0,0 +1,123 @@
+package iprange
+
+import (
+	"math/rand"
+	"net/netip"
+	"strings"
+	"testing"
+)
+
+func TestParse(t *testing.T) {
+	for _, tc := range []struct {
+		in, want, err string
+		ok            bool
+	}{
+		{in: "10.0.10.101-10.0.10.199", want: "10.0.10.101-10.0.10.199", ok: true},
+		{in: "10.0.10.101 - 10.0.10.199", want: "10.0.10.101-10.0.10.199", ok: true},
+		{in: "2001:DB8::100-2001:db8::1ff", want: "2001:db8::100-2001:db8::1ff", ok: true},
+		{in: "10.0.0.5-10.0.0.5", want: "10.0.0.5-10.0.0.5", ok: true},
+		{in: "branch-office", ok: false},
+		{in: "10-net", ok: false},
+		{in: "10.0.0.0/24", ok: false},
+		{in: "10.0.10.101-199", ok: true, err: "not a full IP address"},
+		{in: "10.0.10.101-", ok: true, err: "no end address"},
+		{in: "2001:db8::100-1ff", ok: true, err: "not a full IP address"},
+		{in: "10.0.0.9-10.0.0.1", ok: true, err: "start is after the end"},
+		{in: "10.0.0.1-2001:db8::1", ok: true, err: "mixes IPv4 and IPv6"},
+		{in: "fe80::1%eth0-fe80::9%eth0", ok: true, err: "zone"},
+		{in: "10.0.300.1-10.0.300.9", ok: true, err: "not a full IP address"},
+		{in: "10.0.0.1-10.0.0.9-10.0.0.20", ok: true, err: "not a full IP address"},
+	} {
+		r, ok, err := Parse(tc.in)
+		if ok != tc.ok || (err == nil) != (tc.err == "") || err != nil && !strings.Contains(err.Error(), tc.err) {
+			t.Errorf("%s: ok=%v err=%v, want ok=%v err~%q", tc.in, ok, err, tc.ok, tc.err)
+			continue
+		}
+		if err == nil && ok && r.String() != tc.want {
+			t.Errorf("%s = %s, want %s", tc.in, r, tc.want)
+		}
+	}
+}
+
+func TestPrefixes(t *testing.T) {
+	for in, want := range map[string]string{
+		"10.0.10.101-10.0.10.199":                    "10.0.10.101/32 10.0.10.102/31 10.0.10.104/29 10.0.10.112/28 10.0.10.128/26 10.0.10.192/29",
+		"10.0.0.0-10.0.0.255":                        "10.0.0.0/24",
+		"10.0.0.5-10.0.0.5":                          "10.0.0.5/32",
+		"0.0.0.0-255.255.255.255":                    "0.0.0.0/0",
+		"255.255.255.254-255.255.255.255":            "255.255.255.254/31",
+		"2001:db8::100-2001:db8::1ff":                "2001:db8::100/120",
+		"::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff": "::/0",
+	} {
+		r, _, err := Parse(in)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var got []string
+		for _, p := range r.Prefixes() {
+			got = append(got, p.String())
+		}
+		if strings.Join(got, " ") != want {
+			t.Errorf("%s = %s, want %s", in, strings.Join(got, " "), want)
+		}
+	}
+	// The worst cases stay small.
+	if n := len(must(t, "0.0.0.1-255.255.255.254").Prefixes()); n != 62 {
+		t.Errorf("worst IPv4 case = %d prefixes, want 62", n)
+	}
+	if n := len(must(t, "::1-ffff:ffff:ffff:ffff:ffff:ffff:ffff:fffe").Prefixes()); n != 254 {
+		t.Errorf("worst IPv6 case = %d prefixes, want 254", n)
+	}
+}
+
+// Every address of a random range is covered once, and nothing outside it.
+func TestPrefixesExact(t *testing.T) {
+	rnd := rand.New(rand.NewSource(1))
+	for i := 0; i < 300; i++ {
+		lo, hi := rnd.Intn(4096), rnd.Intn(4096)
+		if hi < lo {
+			lo, hi = hi, lo
+		}
+		base := []byte{10, 20, 0, 0}
+		addr := func(n int) netip.Addr {
+			return netip.AddrFrom4([4]byte{base[0], base[1], byte(n >> 8), byte(n)})
+		}
+		r := Range{Start: addr(lo), End: addr(hi)}
+		ps := r.Prefixes()
+		for n := max(lo-3, 0); n <= min(hi+3, 4095); n++ {
+			c := 0
+			for _, p := range ps {
+				if p.Contains(addr(n)) {
+					c++
+				}
+			}
+			if in := n >= lo && n <= hi; in && c != 1 || !in && c != 0 {
+				t.Fatalf("%s: %s covered %d times (%v)", r, addr(n), c, ps)
+			}
+		}
+		if got := r.Size().Int64(); got != int64(hi-lo+1) {
+			t.Fatalf("%s: size %d", r, got)
+		}
+	}
+}
+
+func TestSizeAndMapped(t *testing.T) {
+	if s := must(t, "10.0.10.101-10.0.10.199").SizeText(); s != "99 addresses" {
+		t.Errorf("size = %s", s)
+	}
+	if s := must(t, "2001:db8::-2001:db8:0:ffff:ffff:ffff:ffff:ffff").SizeText(); s != "about 2^80 addresses" {
+		t.Errorf("size = %s", s)
+	}
+	if !must(t, "::ffff:10.0.0.1-::ffff:10.0.0.9").TouchesMapped4() || must(t, "2001:db8::1-2001:db8::9").TouchesMapped4() || must(t, "10.0.0.1-10.0.0.9").TouchesMapped4() {
+		t.Error("TouchesMapped4")
+	}
+}
+
+func must(t *testing.T, s string) Range {
+	t.Helper()
+	r, ok, err := Parse(s)
+	if !ok || err != nil {
+		t.Fatalf("%s: %v %v", s, ok, err)
+	}
+	return r
+}
@@ -1,10 +1,14 @@
 package model

 import (
+	"fmt"
+	"net/netip"
 	"slices"
 	"sort"
 	"strings"
 	"time"
+
+	"jarl/internal/iprange"
 )

 // Blocklist is a list of domains to block, downloaded from URL and kept up
@@ -17,10 +21,126 @@ type Blocklist struct {
 	// that offers recursion (see BlockingViews).
 	ViewIDs  []int64 `json:"view_ids"`
 	Disabled bool    `json:"disabled,omitempty"`
-	Comment  string  `json:"comment"`
+	// StepID is the blocking step the list starts at: StepNormal for
+	// every client, or a BlockStep for the clients of groups at that step
+	// or above.
+	StepID  int64  `json:"step_id"`
+	Comment string `json:"comment"`
 	Meta
 }

+// Built-in blocking steps (BlockStep IDs are positive).
+const (
+	StepOff    int64 = -1 // no blocklists (rules still apply)
+	StepNormal int64 = 0  // the default: every client not in a group
+)
+
+// BlockStep is a blocking step above Normal. Steps are ordered: each
+// includes the lists of the steps below it, plus its own (docs/blocking.md).
+type BlockStep struct {
+	ID       int64  `json:"id"`
+	Name     string `json:"name"`
+	Position int    `json:"position"`
+	Comment  string `json:"comment"`
+	Meta
+}
+
+// ClientGroup gives the clients with these addresses a blocking step.
+type ClientGroup struct {
+	ID   int64  `json:"id"`
+	Name string `json:"name"`
+	// Members are addresses, prefixes, or names of ACLs made of them.
+	Members []string `json:"members"`
+	StepID  int64    `json:"step_id"`  // StepOff, StepNormal or a BlockStep
+	ViewIDs []int64  `json:"view_ids"` // as for Blocklist
+	Comment string   `json:"comment"`
+	Meta
+}
+
+// OrderedBlockSteps returns the steps above Normal, lowest first.
+func (s *State) OrderedBlockSteps() []*BlockStep {
+	out := make([]*BlockStep, 0, len(s.BlockSteps))
+	for _, st := range s.BlockSteps {
+		out = append(out, st)
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Position != out[j].Position {
+			return out[i].Position < out[j].Position
+		}
+		return out[i].ID < out[j].ID
+	})
+	return out
+}
+
+// StepRank orders steps: -1 for Off, 0 for Normal, 1, 2, ... for the
+// steps above it. ok is false for a step that doesn't exist.
+func (s *State) StepRank(id int64) (rank int, ok bool) {
+	switch id {
+	case StepOff:
+		return -1, true
+	case StepNormal:
+		return 0, true
+	}
+	for i, st := range s.OrderedBlockSteps() {
+		if st.ID == id {
+			return i + 1, true
+		}
+	}
+	return 0, false
+}
+
+// StepName returns a step's name ("off" and "normal" for the built-in
+// ones).
+func (s *State) StepName(id int64) string {
+	switch id {
+	case StepOff:
+		return "off"
+	case StepNormal:
+		return "normal"
+	}
+	if st := s.BlockSteps[id]; st != nil {
+		return st.Name
+	}
+	return fmt.Sprintf("step %d", id)
+}
+
+// StepByName finds a step by name, the built-in ones included.
+func (s *State) StepByName(name string) (int64, bool) {
+	name = strings.ToLower(strings.TrimSpace(name))
+	switch name {
+	case "off":
+		return StepOff, true
+	case "normal":
+		return StepNormal, true
+	}
+	for _, st := range s.BlockSteps {
+		if strings.EqualFold(st.Name, name) {
+			return st.ID, true
+		}
+	}
+	return 0, false
+}
+
+// ClientGroupByName finds a client group by name.
+func (s *State) ClientGroupByName(name string) *ClientGroup {
+	for _, g := range s.ClientGroups {
+		if strings.EqualFold(g.Name, name) {
+			return g
+		}
+	}
+	return nil
+}
+
+// SortedClientGroups returns the client groups ordered by name.
+func (s *State) SortedClientGroups() []*ClientGroup {
+	out := make([]*ClientGroup, 0, len(s.ClientGroups))
+	for _, g := range s.ClientGroups {
+		out = append(out, g)
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}
+
 // Block rule actions.
 const (
 	BlockActionBlock = "block"
@@ -134,3 +254,30 @@ func (s *State) BlockingViews(viewIDs []int64) []int64 {
 	}
 	return out
 }
+
+// GroupPrefixes returns the addresses of a client group as prefixes: its
+// own, and those of the ACLs it names (and the ACLs they name). Elements
+// that aren't addresses are left out (validation reports them).
+func (s *State) GroupPrefixes(g *ClientGroup) []netip.Prefix {
+	var out []netip.Prefix
+	seen := map[string]bool{}
+	var add func(elems []string)
+	add = func(elems []string) {
+		for _, e := range elems {
+			e = strings.TrimSpace(e)
+			if a, err := netip.ParseAddr(e); err == nil {
+				a = a.Unmap()
+				out = append(out, netip.PrefixFrom(a, a.BitLen()))
+			} else if p, err := netip.ParsePrefix(e); err == nil {
+				out = append(out, p.Masked())
+			} else if r, ok, err := iprange.Parse(e); ok && err == nil {
+				out = append(out, r.Prefixes()...)
+			} else if acl := s.ACLByName(e); acl != nil && !seen[acl.Name] {
+				seen[acl.Name] = true
+				add(acl.Elements)
+			}
+		}
+	}
+	add(g.Members)
+	return out
+}
@@ -0,0 +1,71 @@
+package model
+
+import (
+	"slices"
+	"time"
+)
+
+// Certificate sources.
+const (
+	CertSourceACME = "acme" // Jarl obtains and renews it (docs/certificates.md)
+	CertSourceFile = "file" // you renew it; Jarl reads it from cert_file and key_file
+)
+
+// Certificate uses.
+const (
+	CertUseWeb = "web" // jarld's own HTTPS
+	CertUseDNS = "dns" // written where named can read it, for DNS over TLS/HTTPS
+)
+
+// Challenge routes: where Jarl publishes the DNS-01 challenge.
+const (
+	ChallengeAuto    = "auto"    // decided at every issue from the domain's public name servers
+	ChallengeJarl    = "jarl"    // in a zone Jarl serves (following a CNAME on _acme-challenge)
+	ChallengePorkbun = "porkbun" // through Porkbun's DNS API
+)
+
+// Certificate is a TLS certificate Jarl manages. Certificates are not
+// named configuration: they are kept outside changesets, like users.
+type Certificate struct {
+	ID        int64    `json:"id"`
+	Name      string   `json:"name"`
+	Source    string   `json:"source"`
+	Domains   []string `json:"domains"`             // acme: the names to ask for; file: the names in the certificate
+	CertFile  string   `json:"cert_file,omitempty"` // file source
+	KeyFile   string   `json:"key_file,omitempty"`  // file source
+	Uses      []string `json:"uses"`
+	Challenge string   `json:"challenge,omitempty"` // acme source
+	KeyType   string   `json:"key_type,omitempty"`  // acme source: ec256, ec384, rsa2048, rsa3072, rsa4096
+	Comment   string   `json:"comment"`
+
+	// The current certificate: acme source only (a file source's is read
+	// from its files). The key never leaves the server through the API.
+	CertPEM string `json:"-"`
+	KeyPEM  string `json:"-"`
+
+	// What the current certificate says (both sources).
+	Names     []string   `json:"names,omitempty"` // the names in it
+	NotBefore *time.Time `json:"not_before,omitempty"`
+	NotAfter  *time.Time `json:"not_after,omitempty"`
+	Issuer    string     `json:"issuer,omitempty"`
+	Serial    string     `json:"serial,omitempty"`
+
+	// Renewal (acme source). RenewAt is the CA's suggested time (ARI) or,
+	// without one, two thirds into the certificate's lifetime.
+	RenewAt      *time.Time `json:"renew_at,omitempty"`
+	ARICheckedAt *time.Time `json:"-"`
+	LastAttempt  *time.Time `json:"last_attempt,omitempty"`
+	LastSuccess  *time.Time `json:"last_success,omitempty"`
+	LastError    string     `json:"last_error,omitempty"`
+	Failures     int        `json:"failures,omitempty"`
+	// LastRoutes says where the challenges went the last time ("adbraun.lol: porkbun").
+	LastRoutes []string `json:"last_routes,omitempty"`
+
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+	CreatedBy string    `json:"created_by"`
+	UpdatedBy string    `json:"updated_by"`
+}
+
+// HasUse reports whether c is used for use.
+func (c *Certificate) HasUse(use string) bool { return slices.Contains(c.Uses, use) }
@@ -0,0 +1,101 @@
+package model
+
+import (
+	"slices"
+	"sort"
+)
+
+// Linked zones (docs/views.md#linked-zones): zones of the same name in
+// different views whose shared records Jarl keeps in step. Each zone
+// keeps its own copy of every shared record (with the same SharedID), so
+// named, validation and rendering see ordinary zones. A record with
+// SharedID 0 in a linked zone is local to its view: an override of the
+// shared records of the same name and type there.
+
+// LinkMembers returns the zones of a link group in view order.
+func (s *State) LinkMembers(group int64) []*Zone {
+	if group == 0 {
+		return nil
+	}
+	var out []*Zone
+	for _, z := range s.Zones {
+		if z.LinkGroup == group {
+			out = append(out, z)
+		}
+	}
+	s.SortByView(out)
+	return out
+}
+
+// LinkedWith returns the other zones z is linked with, in view order.
+func (s *State) LinkedWith(z *Zone) []*Zone {
+	var out []*Zone
+	for _, o := range s.LinkMembers(z.LinkGroup) {
+		if o.ID != z.ID {
+			out = append(out, o)
+		}
+	}
+	return out
+}
+
+// AnyLinked reports whether any zone is linked.
+func (s *State) AnyLinked() bool {
+	for _, z := range s.Zones {
+		if z.LinkGroup != 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// SortByView sorts zones in view order.
+func (s *State) SortByView(zs []*Zone) {
+	pos := func(z *Zone) int {
+		if v := s.Views[z.ViewID]; v != nil {
+			return v.Position
+		}
+		return -1
+	}
+	sort.Slice(zs, func(i, j int) bool {
+		if a, b := pos(zs[i]), pos(zs[j]); a != b {
+			return a < b
+		}
+		return zs[i].ID < zs[j].ID
+	})
+}
+
+// RRset returns the records of one name and type in a zone, by ID.
+func (s *State) RRset(zoneID int64, name, typ string) []*Record {
+	var out []*Record
+	for _, r := range s.Records {
+		if r.ZoneID == zoneID && r.Name == name && r.Type == typ {
+			out = append(out, r)
+		}
+	}
+	slices.SortFunc(out, func(a, b *Record) int { return int(a.ID - b.ID) })
+	return out
+}
+
+// HasLocal reports whether a linked zone overrides the shared records of
+// one name and type with records of its own.
+func (s *State) HasLocal(zoneID int64, name, typ string) bool {
+	for _, r := range s.Records {
+		if r.ZoneID == zoneID && r.Name == name && r.Type == typ && r.SharedID == 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// SharedRecords returns a zone's shared records of one name and type,
+// by SharedID.
+func (s *State) SharedRecords(zoneID int64, name, typ string) []*Record {
+	var out []*Record
+	for _, r := range s.Records {
+		if r.ZoneID == zoneID && r.Name == name && r.Type == typ && r.SharedID != 0 {
+			out = append(out, r)
+		}
+	}
+	slices.SortFunc(out, func(a, b *Record) int { return int(a.SharedID - b.SharedID) })
+	return out
+}
@@ -9,6 +9,7 @@ package model

 import (
 	"encoding/json"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -49,9 +50,43 @@ type View struct {
 	MatchDestinations  []string `json:"match_destinations"`
 	MatchRecursiveOnly *bool    `json:"match_recursive_only,omitempty"`
 	Comment            string   `json:"comment"`
+	// Exposure overrides whether the view counts as reachable from the
+	// internet (docs/exposure.md): "" works it out, ExposurePublic or
+	// ExposurePrivate say so.
+	Exposure string `json:"exposure,omitempty"`
+	// Acknowledged are exposure findings accepted on purpose; they are
+	// shown as info instead of warnings.
+	Acknowledged []Acknowledgement `json:"acknowledged,omitempty"`
 	Meta
 }

+// Exposure overrides.
+const (
+	ExposureAuto    = ""
+	ExposurePublic  = "public"
+	ExposurePrivate = "private"
+)
+
+// Acknowledgement accepts one exposure finding (by its code) for a view,
+// or for the server: the finding stays, as info, with who accepted it,
+// when and why.
+type Acknowledgement struct {
+	Code   string    `json:"code"`
+	Reason string    `json:"reason"`
+	By     string    `json:"by"`
+	At     time.Time `json:"at"`
+}
+
+// FindAck returns the acknowledgement of code in acks, if any.
+func FindAck(acks []Acknowledgement, code string) *Acknowledgement {
+	for i := range acks {
+		if acks[i].Code == code {
+			return &acks[i]
+		}
+	}
+	return nil
+}
+
 // ACL is a named address match list.
 type ACL struct {
 	ID       int64    `json:"id"`
@@ -128,6 +163,13 @@ type Zone struct {
 	// signing is being removed safely (docs/dnssec.md).
 	DNSSECPolicy string `json:"dnssec_policy,omitempty"`
 	Comment      string `json:"comment"`
+	// Disabled zones stay in Jarl, records and all, but named doesn't
+	// load them: their zone statement is left out of named.conf.
+	Disabled bool `json:"disabled,omitempty"`
+	// LinkGroup links zones of the same name in different views: Jarl
+	// keeps their shared records in step (docs/views.md#linked-zones). 0
+	// for a zone that isn't linked; linked zones share the ID.
+	LinkGroup int64 `json:"link_group,omitempty"`
 	Meta
 }

@@ -157,6 +199,10 @@ type Record struct {
 	// Disabled records stay in Jarl but are left out of the zone (the
 	// zone file lists them as comments).
 	Disabled bool `json:"disabled,omitempty"`
+	// SharedID ties the copies of a shared record in linked zones
+	// together (the same in every copy). 0 for a record of a zone that
+	// isn't linked, and for a record local to its view in one that is.
+	SharedID int64 `json:"shared_id,omitempty"`
 	Meta
 }

@@ -208,7 +254,22 @@ type Settings struct {
 	Expire       uint32   `json:"expire"`
 	NegativeTTL  uint32   `json:"negative_ttl"`
 	SerialPolicy string   `json:"serial_policy"`
-	Version      int      `json:"version"`
+	// BlockingPausedUntil, while set, lets every name through blocking
+	// (docs/blocking.md); jarld clears it when the time is up.
+	BlockingPausedUntil *time.Time `json:"blocking_paused_until,omitempty"`
+	// BlockingPausedIndefinitely pauses blocking until someone resumes it.
+	BlockingPausedIndefinitely bool `json:"blocking_paused_indefinitely,omitempty"`
+	// Exposure and Acknowledged are the server's own (without views, and
+	// for server-wide findings such as a visible version): see View.
+	Exposure     string            `json:"exposure,omitempty"`
+	Acknowledged []Acknowledgement `json:"acknowledged,omitempty"`
+	Version      int               `json:"version"`
+}
+
+// BlockingPaused reports whether blocking is paused, for a time or until
+// resumed.
+func (s *Settings) BlockingPaused() bool {
+	return s.BlockingPausedUntil != nil || s.BlockingPausedIndefinitely
 }

 // DefaultSettings returns the settings of a fresh installation.
@@ -233,8 +294,10 @@ type State struct {
 	Records  map[int64]*Record
 	Options  map[int64]*Option
 	// Blocking (docs/blocking.md).
-	Blocklists map[int64]*Blocklist
-	BlockRules map[int64]*BlockRule
+	Blocklists   map[int64]*Blocklist
+	BlockRules   map[int64]*BlockRule
+	BlockSteps   map[int64]*BlockStep
+	ClientGroups map[int64]*ClientGroup
 }

 // NewState returns an empty state with default settings.
@@ -248,8 +311,10 @@ func NewState() *State {
 		Records:  map[int64]*Record{},
 		Options:  map[int64]*Option{},

-		Blocklists: map[int64]*Blocklist{},
-		BlockRules: map[int64]*BlockRule{},
+		Blocklists:   map[int64]*Blocklist{},
+		BlockRules:   map[int64]*BlockRule{},
+		BlockSteps:   map[int64]*BlockStep{},
+		ClientGroups: map[int64]*ClientGroup{},
 	}
 }

@@ -264,14 +329,18 @@ func (s *State) Clone() *State {
 		Records:  make(map[int64]*Record, len(s.Records)),
 		Options:  make(map[int64]*Option, len(s.Options)),

-		Blocklists: make(map[int64]*Blocklist, len(s.Blocklists)),
-		BlockRules: make(map[int64]*BlockRule, len(s.BlockRules)),
+		Blocklists:   make(map[int64]*Blocklist, len(s.Blocklists)),
+		BlockRules:   make(map[int64]*BlockRule, len(s.BlockRules)),
+		BlockSteps:   make(map[int64]*BlockStep, len(s.BlockSteps)),
+		ClientGroups: make(map[int64]*ClientGroup, len(s.ClientGroups)),
 	}
-	c.Settings.Nameservers = append([]string(nil), s.Settings.Nameservers...)
+	c.Settings.Nameservers = slices.Clone(s.Settings.Nameservers)
+	c.Settings.Acknowledged = slices.Clone(s.Settings.Acknowledged)
 	for id, v := range s.Views {
 		n := *v
-		n.MatchClients = append([]string(nil), v.MatchClients...)
-		n.MatchDestinations = append([]string(nil), v.MatchDestinations...)
+		n.MatchClients = slices.Clone(v.MatchClients)
+		n.MatchDestinations = slices.Clone(v.MatchDestinations)
+		n.Acknowledged = slices.Clone(v.Acknowledged)
 		if v.MatchRecursiveOnly != nil {
 			b := *v.MatchRecursiveOnly
 			n.MatchRecursiveOnly = &b
@@ -280,7 +349,7 @@ func (s *State) Clone() *State {
 	}
 	for id, a := range s.ACLs {
 		n := *a
-		n.Elements = append([]string(nil), a.Elements...)
+		n.Elements = slices.Clone(a.Elements)
 		c.ACLs[id] = &n
 	}
 	for id, k := range s.Keys {
@@ -305,14 +374,24 @@ func (s *State) Clone() *State {
 	}
 	for id, b := range s.Blocklists {
 		n := *b
-		n.ViewIDs = append([]int64(nil), b.ViewIDs...)
+		n.ViewIDs = slices.Clone(b.ViewIDs)
 		c.Blocklists[id] = &n
 	}
 	for id, r := range s.BlockRules {
 		n := *r
-		n.ViewIDs = append([]int64(nil), r.ViewIDs...)
+		n.ViewIDs = slices.Clone(r.ViewIDs)
 		c.BlockRules[id] = &n
 	}
+	for id, st := range s.BlockSteps {
+		n := *st
+		c.BlockSteps[id] = &n
+	}
+	for id, g := range s.ClientGroups {
+		n := *g
+		n.Members = slices.Clone(g.Members)
+		n.ViewIDs = slices.Clone(g.ViewIDs)
+		c.ClientGroups[id] = &n
+	}
 	return c
 }

@@ -370,6 +449,13 @@ func (s *State) KeyByName(name string) *TSIGKey {
 	return nil
 }

+// ViewKeyPrefix starts the names of the TSIG keys Jarl gives views
+// (render/viewkeys.go); other keys can't use it.
+const ViewKeyPrefix = "jarl-view-"
+
+// ViewKeyName returns the name of a view's key.
+func ViewKeyName(view string) string { return ViewKeyPrefix + view }
+
 // NormalizeKeyName returns the canonical form of a key name: lowercase,
 // without a trailing dot.
 func NormalizeKeyName(name string) string {
@@ -500,7 +586,9 @@ func (s *State) ServedRecordsByZone() map[int64][]*Record {
 	return out
 }

-// ScopedOptions returns the options of a scope, in position order.
+// ScopedOptions returns the options of a scope: in a fixed order by name
+// for a block (see optionLess), in the order they were added for
+// top-level statements, which are written as entered.
 func (s *State) ScopedOptions(scope string, scopeID int64) []*Option {
 	var out []*Option
 	for _, o := range s.Options {
@@ -508,6 +596,10 @@ func (s *State) ScopedOptions(scope string, scopeID int64) []*Option {
 			out = append(out, o)
 		}
 	}
+	if scope != ScopeTopLevel {
+		sort.Slice(out, func(i, j int) bool { return optionLess(out[i], out[j]) })
+		return out
+	}
 	sort.Slice(out, func(i, j int) bool {
 		if out[i].Position != out[j].Position {
 			return out[i].Position < out[j].Position
@@ -0,0 +1,55 @@
+package model
+
+// optionGroups orders the options of a block (options, a view, a zone) the
+// same way everywhere: in named.conf, the web UI and the CLI. Related
+// options are grouped; within a group they are alphabetical, and options
+// not listed here come last, alphabetically. named doesn't care about the
+// order of options in a block.
+var optionGroups = [][]string{
+	// Files and identity.
+	{"bindkeys-file", "directory", "dump-file", "hostname", "managed-keys-directory", "memstatistics-file", "pid-file", "recursing-file", "secroots-file", "server-id", "session-keyfile", "statistics-file", "version"},
+	// Listening and source addresses.
+	{"listen-on", "listen-on-v6", "notify-source", "notify-source-v6", "query-source", "query-source-v6", "transfer-source", "transfer-source-v6"},
+	// Access control.
+	{"allow-query", "allow-query-cache", "allow-query-cache-on", "allow-query-on", "allow-recursion", "allow-recursion-on", "allow-update", "allow-update-forwarding", "blackhole", "deny-answer-addresses", "deny-answer-aliases", "update-policy"},
+	// Recursion, forwarding and the cache.
+	{"forward", "forwarders", "max-cache-size", "max-cache-ttl", "max-ncache-ttl", "minimal-responses", "prefetch", "qname-minimization", "rate-limit", "recursion", "response-policy", "serve-stale", "stale-answer-enable", "stale-answer-ttl", "stale-cache-enable"},
+	// DNSSEC.
+	{"dnssec-accept-expired", "dnssec-must-be-secure", "dnssec-policy", "dnssec-validation", "inline-signing", "key-directory", "trust-anchor-telemetry", "validate-except"},
+	// Transfers and notify.
+	{"allow-notify", "allow-transfer", "also-notify", "catalog-zones", "ixfr-from-differences", "masters", "max-transfer-idle-in", "max-transfer-idle-out", "max-transfer-time-in", "max-transfer-time-out", "notify", "notify-to-soa", "primaries", "provide-ixfr", "request-ixfr", "serial-query-rate", "transfer-format", "transfers-in", "transfers-out", "transfers-per-ns"},
+}
+
+var optionGroup = func() map[string]int {
+	m := map[string]int{}
+	for i, g := range optionGroups {
+		for _, n := range g {
+			m[n] = i
+		}
+	}
+	return m
+}()
+
+// optionLess orders two options of the same block: by group, then name,
+// then (for an option given more than once, like listen-on) the order they
+// were added in.
+func optionLess(a, b *Option) bool {
+	ga, ok := optionGroup[a.Name]
+	if !ok {
+		ga = len(optionGroups)
+	}
+	gb, ok := optionGroup[b.Name]
+	if !ok {
+		gb = len(optionGroups)
+	}
+	if ga != gb {
+		return ga < gb
+	}
+	if a.Name != b.Name {
+		return a.Name < b.Name
+	}
+	if a.Position != b.Position {
+		return a.Position < b.Position
+	}
+	return a.ID < b.ID
+}
@@ -0,0 +1,40 @@
+package model
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestScopedOptionsOrder(t *testing.T) {
+	s := NewState()
+	add := func(scope string, names ...string) {
+		for i, n := range names {
+			id := int64(len(s.Options) + 1)
+			s.Options[id] = &Option{ID: id, Scope: scope, Name: n, Position: i}
+		}
+	}
+	// Added in an arbitrary order; listen-on twice.
+	add(ScopeView, "zzz-unknown", "forwarders", "listen-on", "recursion", "dnssec-validation", "aaa-unknown", "allow-query", "forward", "directory", "listen-on", "allow-transfer")
+	var got []string
+	for _, o := range s.ScopedOptions(ScopeView, 0) {
+		got = append(got, o.Name)
+	}
+	want := "directory listen-on listen-on allow-query forward forwarders recursion dnssec-validation allow-transfer aaa-unknown zzz-unknown"
+	if strings.Join(got, " ") != want {
+		t.Errorf("order:\n got %s\nwant %s", strings.Join(got, " "), want)
+	}
+	// An option given twice keeps the order it was added in.
+	l := s.ScopedOptions(ScopeView, 0)
+	if l[1].Position > l[2].Position {
+		t.Error("repeated listen-on swapped")
+	}
+	// Top-level statements stay as entered.
+	add(ScopeTopLevel, "logging", "acl", "key")
+	got = nil
+	for _, o := range s.ScopedOptions(ScopeTopLevel, 0) {
+		got = append(got, o.Name)
+	}
+	if strings.Join(got, " ") != "logging acl key" {
+		t.Errorf("top level: %v", got)
+	}
+}
@@ -6,6 +6,8 @@ import (
 	"net/netip"
 	"strconv"
 	"strings"
+
+	"jarl/internal/iprange"
 )

 // AMKind is the kind of an address match list element.
@@ -17,6 +19,9 @@ const (
 	AMName                 // an ACL name (or built-in ACL)
 	AMNested               // { ... }
 	AMOther                // anything else (e.g. geoip), passed through
+	// AMRange is an address range, START-END: Jarl's own syntax, written
+	// to named.conf as the prefixes that cover it (ExpandRanges).
+	AMRange
 )

 // Builtin ACL names.
@@ -26,10 +31,11 @@ var BuiltinACLs = map[string]bool{"any": true, "none": true, "localhost": true,
 type AMElement struct {
 	Negated bool
 	Kind    AMKind
-	Prefix  netip.Prefix // AMPrefix
-	Name    string       // AMKey, AMName
-	Nested  []AMElement  // AMNested
-	Raw     string       // AMOther
+	Prefix  netip.Prefix  // AMPrefix
+	Name    string        // AMKey, AMName
+	Nested  []AMElement   // AMNested
+	Raw     string        // AMOther
+	Range   iprange.Range // AMRange
 }

 // String returns the element in canonical named.conf syntax, without the
@@ -55,6 +61,8 @@ func (e AMElement) String() string {
 		s = "{ " + strings.Join(parts, " ") + " }"
 	case AMOther:
 		s = e.Raw
+	case AMRange:
+		s = e.Range.String()
 	}
 	if e.Negated {
 		return "!" + s
@@ -137,6 +145,7 @@ func parseAMItems(items []Item) (AMElement, error) {
 	if len(items) == 0 {
 		return e, errors.New("empty address match element")
 	}
+	items = joinRange(items)
 	first := items[0]
 	if first.Block != nil {
 		if len(items) != 1 {
@@ -172,6 +181,16 @@ func parseAMItems(items []Item) (AMElement, error) {
 		}
 		return e, fmt.Errorf("unexpected text after %q", word)
 	}
+	if !first.Value.Quoted {
+		if r, ok, err := iprange.Parse(word); ok {
+			if err != nil {
+				return e, err
+			}
+			e.Kind = AMRange
+			e.Range = r
+			return e, nil
+		}
+	}
 	if !first.Value.Quoted || BuiltinACLs[lw] {
 		if p, ok, err := parsePrefix(word); ok {
 			if err != nil {
@@ -215,6 +234,9 @@ func CheckACLName(name string) error {
 			return fmt.Errorf("ACL name %q looks like an address", name)
 		}
 	}
+	if _, ok, _ := iprange.Parse(name); ok {
+		return fmt.Errorf("ACL name %q looks like an address range", name)
+	}
 	return nil
 }

@@ -318,18 +340,18 @@ func AMRefs(elems []AMElement) (acls, keys []string) {
 func Shadowed(elems []AMElement) []string {
 	var warns []string
 	for i, e := range elems {
-		if e.Kind != AMPrefix && e.Kind != AMName {
+		if e.Kind != AMPrefix && e.Kind != AMRange && e.Kind != AMName {
 			continue
 		}
+		er, eok := e.addrRange()
 		for j := 0; j < i; j++ {
 			prev := elems[j]
 			if prev.Kind == AMName && prev.Name == "any" {
 				warns = append(warns, fmt.Sprintf("element %q never matches: %q before it already matches every address", e.String(), prev.String()))
 				break
 			}
-			if prev.Kind == AMPrefix && e.Kind == AMPrefix &&
-				prev.Prefix.Addr().Is4() == e.Prefix.Addr().Is4() &&
-				prev.Prefix.Bits() <= e.Prefix.Bits() && prev.Prefix.Contains(e.Prefix.Addr()) {
+			if pr, ok := prev.addrRange(); ok && eok && pr.Start.Is4() == er.Start.Is4() &&
+				!er.Start.Less(pr.Start) && !pr.End.Less(er.End) {
 				warns = append(warns, fmt.Sprintf("element %q never matches: %q before it already covers it (first match wins; put the more specific element first)", e.String(), prev.String()))
 				break
 			}
@@ -338,6 +360,117 @@ func Shadowed(elems []AMElement) []string {
 	return warns
 }

+// addrRange returns the addresses a prefix or range element covers.
+func (e AMElement) addrRange() (iprange.Range, bool) {
+	switch e.Kind {
+	case AMRange:
+		return e.Range, true
+	case AMPrefix:
+		return iprange.FromPrefix(e.Prefix), true
+	}
+	return iprange.Range{}, false
+}
+
+// Expand returns the element as named.conf can take it: a range becomes
+// the prefixes that cover it (each negated when the range is), nested
+// lists are expanded too, and anything else is returned as it is.
+func (e AMElement) Expand() []AMElement {
+	switch e.Kind {
+	case AMRange:
+		var out []AMElement
+		for _, p := range e.Range.Prefixes() {
+			out = append(out, AMElement{Negated: e.Negated, Kind: AMPrefix, Prefix: p})
+		}
+		return out
+	case AMNested:
+		n := e
+		n.Nested = nil
+		for _, in := range e.Nested {
+			n.Nested = append(n.Nested, in.Expand()...)
+		}
+		return []AMElement{n}
+	}
+	return []AMElement{e}
+}
+
+// joinRange turns a range written with spaces around the dash
+// ("10.0.0.1 - 10.0.0.9", three words) into a single word.
+func joinRange(items []Item) []Item {
+	if len(items) != 3 || items[0].Value == nil || items[1].Value == nil || items[2].Value == nil ||
+		items[0].Value.Quoted || items[1].Value.Quoted || items[2].Value.Quoted || items[1].Value.Text != "-" {
+		return items
+	}
+	text := items[0].Value.Text + "-" + items[2].Value.Text
+	if _, ok, _ := iprange.Parse(text); !ok {
+		return items
+	}
+	return []Item{{Value: &Value{Text: text, Pos: items[0].Value.Pos}}}
+}
+
+// JoinRanges rewrites ranges written with spaces around the dash, in st's
+// blocks, as single words (the form Jarl stores).
+func JoinRanges(st *Stmt) {
+	for _, it := range st.Items {
+		if it.Block == nil {
+			continue
+		}
+		for _, s := range it.Block.Stmts {
+			if len(s.Items) == 4 && s.Items[0].Bang {
+				s.Items = append(s.Items[:1], joinRange(s.Items[1:])...)
+			} else {
+				s.Items = joinRange(s.Items)
+			}
+			JoinRanges(s)
+		}
+	}
+}
+
+// ExpandRanges replaces the address ranges in st's blocks (at any depth)
+// by the prefixes that cover them, with the range as a comment, so named
+// can read it. A range is a block statement that is a single word START-END,
+// optionally negated; nothing else in named.conf's grammar looks like one.
+func ExpandRanges(st *Stmt) {
+	for _, it := range st.Items {
+		if it.Block != nil {
+			expandBlock(it.Block)
+		}
+	}
+}
+
+func expandBlock(b *Block) {
+	var out []*Stmt
+	for _, s := range b.Stmts {
+		items, neg := s.Items, false
+		if len(items) == 2 && items[0].Bang {
+			items, neg = items[1:], true
+		}
+		if len(items) == 1 && items[0].Value != nil && !items[0].Value.Quoted {
+			if r, ok, err := iprange.Parse(items[0].Value.Text); ok && err == nil {
+				for i, p := range r.Prefixes() {
+					var ns Stmt
+					if neg {
+						ns.Items = append(ns.Items, Item{Bang: true})
+					}
+					text := p.String()
+					if p.IsSingleIP() {
+						text = p.Addr().String()
+					}
+					ns.Items = append(ns.Items, Item{Value: &Value{Text: text}})
+					ns.Pos = s.Pos
+					if i == 0 {
+						ns.Comment = AMElement{Negated: neg, Kind: AMRange, Range: r}.String()
+					}
+					out = append(out, &ns)
+				}
+				continue
+			}
+		}
+		ExpandRanges(s)
+		out = append(out, s)
+	}
+	b.Stmts = out
+}
+
 // ContainsAny reports whether elems contain a non-negated "any" before any
 // negated element would restrict it, which makes the list match everyone.
 // It is used for security lints (open resolvers, open transfers).
@@ -30,6 +30,9 @@ type Item struct {
 type Stmt struct {
 	Items []Item
 	Pos   Pos
+	// Comment is written before the statement (only by Jarl: comments in
+	// parsed text are dropped). ExpandRanges notes the range there.
+	Comment string
 }

 // Keyword returns the statement's first word, lowercased, or "" if the
@@ -36,6 +36,24 @@ func Compact(items []Item) string {
 // CompactStmt returns the statement on a single line with its semicolon.
 func CompactStmt(s *Stmt) string { return Compact(s.Items) + ";" }

+// FormatValue returns an option's value laid out as named.conf writes it:
+// blocks over several lines, indented with tabs. Values without a block,
+// and values that don't parse, are returned as they are.
+func FormatValue(name, value string) string {
+	if !strings.Contains(value, "{") {
+		return value
+	}
+	st, err := ParseOptionValue(name, value)
+	if err != nil {
+		return value
+	}
+	out := strings.TrimSuffix(strings.TrimRight(FormatStmt(st, 0), "\n"), ";")
+	if rest, ok := strings.CutPrefix(out, st.Keyword()); ok {
+		return strings.TrimLeft(rest, " ")
+	}
+	return value
+}
+
 // QuoteString returns s as a named.conf quoted string.
 func QuoteString(s string) string {
 	var sb strings.Builder
@@ -59,6 +77,9 @@ func valueText(v *Value) string {

 func writeStmt(sb *strings.Builder, s *Stmt, indent int) {
 	tabs := strings.Repeat("\t", indent)
+	if s.Comment != "" {
+		sb.WriteString(tabs + "// " + s.Comment + "\n")
+	}
 	sb.WriteString(tabs)
 	inline := Compact(s.Items)
 	if !hasNestedBlocks(s.Items) && len(inline)+indent*8 <= maxInline+8 {
@@ -149,6 +170,9 @@ func writeItemsInline(sb *strings.Builder, items []Item) {
 			} else {
 				sb.WriteString("{ ")
 				for _, s := range it.Block.Stmts {
+					if s.Comment != "" {
+						sb.WriteString("/* " + s.Comment + " */ ")
+					}
 					writeItemsInline(sb, s.Items)
 					sb.WriteString("; ")
 				}
@@ -0,0 +1,18 @@
+package namedconf
+
+import "testing"
+
+func TestFormatValue(t *testing.T) {
+	for _, c := range []struct{ name, value, want string }{
+		{"logging", `{ channel c { file "/var/log/named/x.log" versions 3; print-time yes; }; category default { c; }; }`,
+			// A short inner block stays on one line, as in named.conf.
+			"{\n\tchannel c { file \"/var/log/named/x.log\" versions 3; print-time yes; };\n\tcategory default { c; };\n}"},
+		{"allow-query", `{ allowed_clients; }`, `{ allowed_clients; }`}, // short: unchanged
+		{"directory", `"/var/cache/bind"`, `"/var/cache/bind"`},
+		{"logging", `{ broken`, `{ broken`}, // unparsable: as it is
+	} {
+		if got := FormatValue(c.name, c.value); got != c.want {
+			t.Errorf("FormatValue(%s, %q) =\n%s\nwant\n%s", c.name, c.value, got, c.want)
+		}
+	}
+}
@@ -1 +1 @@
 .3.0
 .5.0