Release 0.4.1-rc.3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -2,7 +2,9 @@
 # is pushed:
 #   * a Gitea release with the CHANGELOG notes, the linux tarballs, the CLI
 #     for Linux, macOS and Windows, the .debs and SHA256SUMS;
-#   * the .debs (amd64, arm64) in the owner's Debian package registry.
+#   * the .debs (amd64, arm64) in the owner's Debian package registry:
+#     distribution "stable", or "testing" for a pre-release (a version
+#     with a hyphen), which Gitea also marks as a pre-release.
 #
 # Needs a repository secret RELEASE_TOKEN: an access token of a user who
 # can write to the repository, with the write:repository and write:package
@@ -30,8 +32,10 @@ jobs:
             echo "::error::tag $GITHUB_REF_NAME does not match VERSION ($version)"
             exit 1
           fi
-          if ! grep -q "^## \[$version\]" CHANGELOG.md; then
-            echo "::error::CHANGELOG.md has no '## [$version]' section"
+          # The release notes (a pre-release may use its final version's
+          # section or Unreleased; see scripts/gitea-release.sh).
+          if ! scripts/gitea-release.sh notes > /dev/null; then
+            echo "::error::no release notes for $version in CHANGELOG.md"
             exit 1
           fi
 
@@ -48,6 +52,10 @@ jobs:
         run: make test
 
       - name: Build
+        env:
+          # Checked against VERSION above; don't depend on the checkout
+          # having the tag.
+          RELEASE_TAG: ${{ github.ref_name }}
         run: |
           export DEB_MAINTAINER="$(git log -1 --format='%an <%ae>')"
           make dist

CHANGELOG.md

@@ -6,6 +6,517 @@ All notable changes to Jarl are documented here. The format follows
 
 ## [Unreleased]
 
+### Upgrading from 0.4
+
+- New exposure warnings (docs/exposure.md) appear for views reachable from
+  the internet, e.g. "no rate-limit" or "version visible" on an external
+  view: fix them from the Exposure page, or acknowledge them. A change
+  that newly opens a public view up (an open resolver, say) now needs
+  `--accept-risk`, or the checkbox on the Changes page.
+
+- Once you use address ranges, the database can't go back to 0.4: its
+  parser doesn't know them. Remove the ranges first if you need to
+  downgrade.
+
+### Fixed
+
+- Option values in the web UI looked different from the editor: a long
+  line wrapped back to the left edge, losing its indentation, and the
+  column changed width when Edit opened. Values now keep their layout
+  (a long line scrolls), with the same width and padding as the editor.
+  The "{ } around the list are optional" hint only shows for options that
+  end in a list (not rate-limit, which only has one inside).
+- Query statistics skipped every query signed with a TSIG key (named
+  writes "/key NAME" after the client's port), such as queries with a
+  view's key: they are counted now.
+- A changeset with a staged record delete could not be applied after that
+  record was deleted elsewhere (e.g. with the CLI), and it was hard to see
+  which operation to remove: the error only said "record 832 does not
+  exist". A staged delete of a record that is already gone now counts as
+  done (with a warning), and the other operations that no longer apply
+  (an edit or disable of a deleted record, a change to an object changed
+  since) are named with their number and summary. The Changes page marks
+  that operation and offers to remove it right in the error.
+
+### Added
+
+- Linked zones ([docs/views.md](docs/views.md#linked-zones)): zones of the
+  same name in different views can be linked, and Jarl keeps their shared
+  records in step: a change in one view reaches the others in the same
+  changeset (diff, permissions, history and undo cover every view). Each
+  view can still have records of its own (`--local`, "Only here"), which
+  override the shared records of that name and type there, and keeps its
+  own zone options. Linking existing zones changes no answer: what is the
+  same everywhere becomes shared, the rest stays local, and a view's
+  version can be shared later (`--shared`, "Share"). `jarl zone link` and
+  `unlink`, `zone create --link-with VIEW`, `record add|set|update
+  --local|--shared`, a LINK column in `record list`, "Keep them linked"
+  when copying a zone in the web UI, `POST /zones/{zone}/link` and
+  `/unlink`. ACME challenges are written once per link, and `--view all`
+  changes a link once.
+- TLS certificates ([docs/certificates.md](docs/certificates.md)): Jarl
+  obtains certificates from Let's Encrypt or any ACME CA (account set up
+  in jarl.yaml under `acme.account`) and renews them itself, from the CA's
+  renewal information (ARI) or two thirds into their lifetime, with
+  back-off after failures. It answers the DNS-01 challenges in a zone it
+  serves, or through Porkbun's DNS API while Porkbun serves the domain;
+  `auto` decides from the domain's public name servers at every renewal,
+  so moving the domain to your own name servers needs no change. A CNAME
+  on `_acme-challenge` into a zone Jarl serves is followed, for domains
+  hosted elsewhere. A certificate is used for jarld's HTTPS ("web") and/or
+  written for named (`<bind.config_dir>/tls/NAME/`, "dns"; named rereads
+  it on renewal), and certificates you renew yourself can be used too
+  (reread when their files change). Certificates page and dashboard card
+  in the web UI, `jarl cert` (check, create, issue, update, delete,
+  account), `/api/v1/certificates`, Prometheus
+  `jarl_certificate_expiry_timestamp_seconds`, `jarl_certificate_failing`.
+- jarld serves HTTPS and plain HTTP on the same ports once it has a
+  certificate (`tls.cert_file`, or one with the web use, which takes
+  effect without a restart): plain HTTP from the server itself and from
+  trusted proxies is served as before, browsers elsewhere are redirected
+  to HTTPS and API requests get `https_required`. Before, with
+  `tls.cert_file`, plain HTTP got an error even from localhost.
+- Internet exposure ([docs/exposure.md](docs/exposure.md)): Jarl works out
+  which views are reachable from the internet (match-clients ending in a
+  catch-all; for a server without views, open allow-query and a
+  non-private listen address), with a per-view override, and checks them:
+  response rate limiting, open resolvers, ANY answers (minimal-any), cache
+  snooping, open NOTIFY and zone transfers, BIND version and host name,
+  management interfaces. Fixes are staged like any change, including
+  response rate limiting from ISC's example in log-only mode, with your
+  secondaries exempt, and a later "start enforcing". With statistics on,
+  Jarl reads named's rate limiting log lines and shows what was (or would
+  have been) limited: counts, client networks and names (Exposure page,
+  `jarl stats breakdown rrl`, top lists `ratelimited`, Prometheus
+  `jarl_ratelimit_logged_total`). A change that newly opens a public view
+  up must be confirmed (checkbox on the Changes page, `--accept-risk`, API
+  `accept_risk`; 409 `confirm_risk` otherwise). Findings can be
+  acknowledged with a reason: they stay visible as info, with who, when
+  and why. Exposure page and dashboard card in the web UI, `jarl
+  exposure` (fix, ack, unack), `GET /exposure`.
+- `jarl changeset show`, `diff`, `apply`, `discard` and `remove` take the
+  changeset from `-C` or `JARL_CHANGESET` when no ID is given
+  (`jarl changeset apply`). A changeset from `JARL_CHANGESET` is now
+  checked before it is used, for staging too: it must exist, be open and
+  be yours, so a stale export (an applied changeset, or an ID that later
+  turned into someone else's web UI draft) can't silently take your
+  changes; the error says what to do. Commands say on stderr which
+  changeset from `JARL_CHANGESET` they use, and `apply`/`discard` remind
+  you to `unset JARL_CHANGESET`. `-C` and ID arguments are used as given.
+- Address ranges such as `10.0.10.101-10.0.10.199` or
+  `2001:db8::100-2001:db8::1ff` (also `!` negated, and with spaces around
+  the dash) wherever an address match list is used: ACLs, views'
+  match-clients and match-destinations, options such as allow-query, and
+  blocking's client groups ([docs/concepts.md](docs/concepts.md)). Jarl
+  keeps the range as written and writes the fewest prefixes that cover
+  exactly that range to named.conf, with the range as a comment. The web
+  UI shows what a range becomes while you type it (`GET
+  /catalog/ranges`). Mistakes are refused when entered: an end that isn't
+  a full address, the start after the end, IPv4 mixed with IPv6, a range
+  in an option that takes no address match list (forwarders). A range
+  covered by an earlier element is reported as never matching, a range of
+  every address counts as "any" for the open resolver and open transfer
+  checks, and an IPv6 range in the IPv4-mapped space gets a warning. ACL
+  names can no longer look like a range.
+- Prometheus metrics at `/metrics` ([docs/metrics.md](docs/metrics.md)),
+  set up in the new `metrics:` section of jarl.yaml (off by default).
+  `metrics.allow` lists the addresses that may scrape (loopback by
+  default), `metrics.token` lets anyone who sends it as a bearer token
+  scrape, and `metrics.listen` adds addresses that serve only `/metrics`
+  (for a Prometheus server elsewhere). Root and jarld's own user can also
+  scrape on the local socket.
+  - Health, always: named up, recursive and TCP clients against their
+    limits, adopted, open changesets, last apply, validation problems by
+    severity, drifted files, object counts, the last backup (and failure,
+    and whether it is stale), blocking paused, each blocklist's entries,
+    last check and change and whether it fails, the DNSSEC phase of every
+    signed zone, and when API tokens expire.
+  - With query statistics on: named's counters (queries, result codes,
+    record types, UDP/TCP, authoritative/recursive, rate limiting, upstream
+    round-trip times, DNSSEC validation, cache hits) and Jarl's (logged
+    responses per view and zone, blocked queries per blocklist), as
+    counters since jarld started, plus named's memory, CPU, threads, cache
+    and sockets, and the collector's health.
+  - Example queries and alert rules, checked with promtool.
+
+## [0.4.0] - 2026-10-11
+
+### Upgrading from 0.3
+
+- Back up first (`sudo jarld backup`).
+- When jarld first starts, it rewrites named's configuration: options
+  move into their new fixed order, and every view gets its view key in
+  `match-clients` and `keys.conf`. It is checked with named-checkconf
+  before named reloads, like any apply. Files you changed by hand are left
+  alone; the log then says to run `jarl resync`.
+- The systemd unit changed (it allows `AF_NETLINK`). The package replaces
+  it; an override that adds `AF_NETLINK` (`systemctl edit jarl`) does no
+  harm and can be removed.
+- The database moves to schema 8 (disabled zones, client groups) as
+  jarld starts.
+- If statistics showed a spike after views were created or changed, see
+  "Statistics" under Fixed: the bad minutes can be removed from
+  `/var/lib/jarl/stats.db` (minute rows have `res = 'm'`; the hours and
+  days that include them are `'h'` and `'d'`).
+
+### Added
+
+- Different blocking for different devices (docs/blocking.md), like
+  Pi-hole's groups, in one view and without loading any list twice.
+  Client groups put devices (addresses, networks or ACLs of them) at a
+  blocking step: `off` (only your rules), `normal` (the default), or steps
+  you add above it, each including the lists of the steps below. Lists
+  start at a step. Jarl puts a small "gate" policy zone in front of each
+  step's lists that lets the devices below that step through. Web UI: a
+  Devices panel on the Blocking page and a step on each list. CLI: `jarl
+  block step`, `jarl block group`, `jarl blocklist update --step`. API:
+  `/blocking/steps`, `/blocking/groups`. Database schema 8.
+- View keys: every view gets a TSIG key, `jarl-view-NAME`, at the front of
+  its match-clients, so a query signed with it lands in that view from any
+  address. Jarl signs its delegation check's queries to this server's own
+  addresses with the key of the zone's view: before, they got whichever
+  view matched the server's own address (usually internal), so the check
+  could report the wrong serial for the external view. `jarl view key
+  VIEW` shows a key, for `dig -k` (docs/views.md). The first apply after
+  upgrading adds the keys to named.conf and keys.conf.
+- Server statistics: named's memory (resident, and its own count) and
+  CPU use, its cache size, sockets, and recursive and TCP clients against
+  their limits; the host's memory and load; free space where zone files,
+  logs and Jarl's data are. Memory and CPU are kept over time like the
+  other statistics. Statistics page → Server, `jarl stats server`, API
+  `/stats/server`. Read from named's statistics channel, `rndc status` and
+  /proc, with no extra privileges.
+- CLI: the record commands that change records take several views,
+  `--view internal,external`, or `--view all`, and make the change in each,
+  as one changeset (all views or none).
+- Blocking can be paused until resumed, like Pi-hole's "indefinitely":
+  `jarl block pause indefinitely`, **Until I resume** on the Blocking page,
+  `{"indefinitely": true}` in the API.
+- Disabled zones: a zone can be disabled instead of deleted. named stops
+  loading it (its zone statement is left out of named.conf), while Jarl
+  keeps it with its records, options and history, still editable;
+  enabling it serves it as it is then. Disabling says what clients get
+  instead (recursion, or REFUSED). Signed zones can't be disabled. Web
+  UI: Disable/Enable on the zone page, a badge in the zone list. CLI:
+  `jarl zone disable|enable`. API: `PATCH /zones/{zone}` with
+  `{"disabled": true}`. Database schema 7.
+- Blocking (docs/blocking.md): named answers "doesn't exist" for ads,
+  trackers and malware, using BIND's response policy zones.
+  - Blocklists in Adblock, hosts or plain-domain format, downloaded by jarld
+    and checked daily (`blocking.refresh`). A list is downloaded only when
+    the server says it changed, checked with named-checkzone, and reloaded
+    only when its content differs; a failed update keeps the previous
+    version and shows on the dashboard.
+  - Your own block and allow rules, for a domain and the names below it or
+    the exact name. Rules take precedence over every list, and the most
+    specific rule wins.
+  - Lists and rules apply to chosen views, or to every view that offers
+    recursion. They are configuration: staged, reviewed and reverted like
+    any change.
+  - Checking a name says whether it is blocked and by which rule or list
+    entry, with an Allow button in the web UI.
+  - Web UI: a Blocking page, with well-known lists to pick and named's
+    memory per list. CLI: `jarl blocklist` and `jarl block`. API:
+    `/blocking/lists`, `/blocking/rules`, `/blocking/check`.
+  - Pausing: `jarl block pause [DURATION]` or the Blocking page lets every
+    name through for a while (at most a day); blocking resumes by itself.
+    The lists stay loaded, so it takes effect at once.
+  - Statistics: blocked queries over time (a line on the queries chart)
+    and their share, blocked per list, the most blocked names and the
+    clients with the most blocked queries (`jarl stats top blocked`,
+    `top blocked-clients`). Blocked answers no longer count as names that
+    don't exist.
+  - The view choice in the web UI's forms is a compact dropdown, however
+    many views there are.
+  - A `blocking` permission; database schema 6.
+
+### Changed
+
+- Web UI: each view has its own page, like a zone: Settings (match lists,
+  comment, colour), Options and Zones tabs (with **New zone in VIEW**),
+  and Delete. The Views page lists them in order, with the arrows that
+  reorder them; view links everywhere open the view's page.
+- Web UI: A and AAAA records have a **+ CNAME** button that fills in the
+  add form with a CNAME pointing to the record's name, leaving only the
+  alias's name to type. It shows when the row is hovered or focused
+  (always on touch screens).
+- Blocking page: how many queries each blocklist blocked in the last 24
+  hours, and your rules together, with statistics on (linking to the
+  Statistics page).
+- Options are kept in one fixed order, in named.conf, the web UI and the
+  CLI: grouped by topic (files, listening, access control, recursion and
+  forwarding, DNSSEC, transfers and notify, then the rest), alphabetical
+  within a group. The same option is now in the same place in every view
+  and zone. The first apply after upgrading reorders named.conf (a diff
+  that only moves lines). Top-level statements keep their order.
+- Options that end in a list (`allow-transfer`, `forwarders`,
+  `listen-on`, ...) can be given without their braces, in the web UI, CLI
+  and API: `10.0.10.53; key xfer` becomes `{ 10.0.10.53; key xfer; }`.
+  Before, only some server options (those edited one element per line)
+  added them.
+- The dashboard's configuration checks include named-checkconf's own
+  warnings about the running configuration (such as `both "recursion no;"
+  and "allow-recursion" active`), which before only showed while applying.
+  The CLI now prints them after an apply too.
+- Statistics page: cards and tiles fill their rows instead of leaving one
+  alone beside an empty space, and the queries and failed answers charts
+  have the same margins, so their time axes line up.
+- Dashboard: options have their own tile; "0 TSIG keys · 22 options" read
+  as if the options belonged to the keys.
+- Web UI times use the 24-hour clock.
+- Diffs of named.conf say which block each change is in, after the `@@`
+  line numbers (`@@ -50,6 +49,8 @@ view "internal" {`), like git does
+  with function names. Moving an option from the server's options into a
+  view no longer looks like two unrelated edits.
+- Web UI options (server, top-level, view and zone): values with blocks,
+  such as logging, are shown and edited laid out as in named.conf, over
+  several lines with indentation. The editor grows with its content, Tab
+  indents and Enter keeps the indentation (Esc, then Tab, moves on). With
+  a draft open, the tables show the draft's values, so a staged edit stays
+  visible after Save.
+- The pending-changes banner has an Apply now button: it applies your
+  draft without going to the Changes page, and stays on the page you're
+  on. If the changes are refused, a dialog says why and links to Changes.
+- Blocking page: blocklists and rules have an Edit button (name, URL,
+  views, comment; a rule's action and scope). The list button that
+  downloads now is called Refresh, like `jarl blocklist refresh`.
+- Records table: disabled records are hatched and have a "disabled" badge
+  next to their name, instead of only a muted colour and a badge in the
+  comment column.
+
+### Fixed
+
+- Reverting a changeset added needless "restore" operations for
+  blocklists, rules and views that hadn't changed: copying the state
+  turned their empty view lists into missing ones.
+- Under the shipped systemd unit, jarld couldn't list the host's
+  addresses (it needs a netlink socket, which `RestrictAddressFamilies`
+  didn't allow), so the name server checks didn't recognize this server's
+  own addresses. The Name servers tab then queried them like another
+  server's, and the delegation check didn't sign those queries with the
+  view's key: with views, both got the view matching the server's own
+  address (usually internal) and reported a wrong serial. The unit now
+  allows `AF_NETLINK`, and without it jarld reads the addresses from
+  /proc.
+- Statistics: after a reconfig that added, removed or recreated views
+  (creating the first view, for instance), a minute could count everything
+  since named started: millions of queries in an hour. A per-view counter
+  (cache, upstream times, validation) going down was taken for a restart
+  of named. Now only a new boot time means a restart, and a counter that
+  goes down counts 0 for that minute.
+- Blocking page, checking a name: when your own block rule is for that very
+  name, it offers to remove the rule instead of an allow rule, which was
+  refused as a second rule for the same name. It also names the rule that
+  matched rather than the policy zone entry.
+- docs/validation.md lacked the `disabled_conflict` warning added in 0.3.0.
+
+## [0.3.0] - 2026-10-09
+
+### Added
+
+- Disabled records: a record can be disabled instead of deleted. It stays
+  in Jarl with its ID, TTL and comment but is left out of the zone (the
+  zone file lists it as a comment), and enabling it puts it back exactly
+  as it was. Web UI: a Disable/Enable button on each record, disabled
+  records greyed out with a badge, a filter for them, and a count in the
+  zone list. CLI: `jarl record disable|enable` (by ID or by name, type and
+  data, `--ptr` for the PTR record, `--missing-ok`), `record list
+  --disabled`, and `disable:`/`enable:` entries for `jarl apply -f`. API:
+  `POST /records/{id}/disable|enable`, `POST
+  /zones/{zone}/records/disable|enable`, a `disabled` field on records,
+  `?disabled=` on record lists and `record.disable|enable` operations.
+  Validation checks the zone as it is served: the last NS record can't be
+  disabled, enabling a record is checked like adding it, and a disabled
+  record that a CNAME now blocks gets a warning. Database schema 5.
+- DNSSEC for a zone whose parent zone is in Jarl: the DNSSEC tab gives the
+  `jarl record add PARENT NAME DS ...` command to copy and an "Add to
+  PARENT" button (staged like any change), links to the parent zone, and
+  says when the parent has the DS record. `jarl zone dnssec status` prints
+  the command too, and turning signing off gives the matching `jarl record
+  delete`.
+
+- CLI output for scripts: `-o id` prints just the IDs of what a command
+  shows or lists (`jarl zone show adbraun.lol -o id`), `-o
+  field=view,soa.serial` just those fields, tab separated. `-q` on `show`
+  and `list` prints the IDs too. With a change (`jarl record add ... -o
+  id`) they apply to the changed object.
+
+- Statistics: client lists (busiest and refused clients, in the web UI,
+  `jarl stats top clients|refused` and `jarl stats summary`) show the host
+  name Jarl's records have for each address: the PTR record's target, or
+  else the name of an A/AAAA record. Looked up in Jarl's own data, so no
+  DNS queries; an address without a record shows as before.
+- Zones list: a padlock after each signed zone's name, linking to its
+  DNSSEC tab (open and amber while signing is being turned off).
+
+### Changed
+
+- The web UI and API can listen on ports below 1024, such as 443:
+  `jarl.service` now gives jarld the `CAP_NET_BIND_SERVICE` capability
+  (and only that). With a unit that doesn't, jarld's error says what's
+  missing. See docs/configuration.md, "HTTPS on port 443".
+- Records table: names are no longer greyed out when they repeat the row
+  above (it made those records look inactive). Records of the same name
+  are separated by a faint line instead, and a full line marks where the
+  next name starts.
+
+### Fixed
+
+- `jarl record list`: one long value (a DKIM key) padded every row to its
+  length, so on a terminal each row wrapped onto a second, blank-looking
+  line. Long data is now shortened to fit the terminal; `--wide` shows it
+  in full, as does output to a pipe or file.
+
+## [0.2.0] - 2026-10-09
+
+### Added
+
+- DNSSEC signing per zone (docs/dnssec.md): `jarl zone dnssec
+  enable|status|check-ds|disable|wipe` and the zone page's DNSSEC tab, or
+  the zone's new `dnssec_policy` field in the API. named signs the zone
+  with BIND's `default` policy (one ECDSA P-256 key that is never replaced)
+  or a custom one, using inline signing, with keys in a per-view directory
+  under `/var/lib/bind/jarl/dnssec-keys`. Jarl shows the keys and the DS
+  record to give the registrar, says when it's safe to publish it, and
+  checks the parent's DS records (`check-ds`, which also tells named with
+  `rndc dnssec -checkds`). It refuses steps that would break a signed
+  domain: switching straight to unsigned (it goes through BIND's
+  `insecure` policy instead, and finishes only once named is done),
+  deleting a signed zone or moving it to another view, and TTLs above the
+  policy's `max-zone-ttl`. `wipe` starts over with a clean slate once the
+  parent has no DS. Each step in the web UI opens a dialog that says what it
+  needs first. `jarl zone delegation` now also compares the parent's DS
+  records with the zone's keys.
+- Porkbun support (optional, docs/dnssec.md#porkbun): with an API key in
+  the new `porkbun:` section of jarl.yaml (and nowhere else), `jarl zone
+  registrar status|sync-glue|set-ns|publish-ds|remove-ds` and the zone
+  page's Registrar tab show and change the domain's name servers, glue
+  records (one per name server inside the domain, with all its IPv4 and
+  IPv6 addresses) and DS records at Porkbun. Every change first checks that
+  it won't take the domain offline (the name servers answer for the zone,
+  glue matches, a DS goes out only once the domain is delegated to servers
+  that serve the signed zone, DS records match the zone's keys before the
+  name servers change); `--dry-run` shows the checks and `--force` skips
+  them. Administrators only.
+- Backups include the DNSSEC keys (private keys too), stored inside the
+  backup file, and `jarld restore` puts them back for named
+  (`bind.named_user`, default `bind`). `jarl-backup.service` has
+  `CAP_DAC_READ_SEARCH` to read them; `--without-keys` skips them.
+- Jarl raises a zone's serial above the one named has loaded whenever it
+  writes a zone file whose serial isn't higher (after restoring an older
+  database, say), so named loads it (it refuses otherwise for a signed
+  zone) and secondaries pick it up.
+- Two-factor login to the web UI with an authenticator app (TOTP: SHA-1,
+  6 digits, 30 s, as every app supports). Users turn it on under Account
+  (password, QR code, a code to confirm) and get 10 one-time recovery
+  codes. Logging in then asks for a code (or a recovery code) after the
+  password; each code works once. In a session with two-factor login,
+  creating or rotating API tokens, changing users and resetting someone's
+  two-factor login need a code from the last 5 minutes: the web UI asks
+  for one, API clients send `X-Jarl-TOTP`. API tokens and the local socket
+  are not affected.
+- `totp.require` in jarl.yaml (`none`, `admins`, `all`) makes two-factor
+  login compulsory; such a user who hasn't set it up can only set it up
+  after logging in. `totp.issuer` names the server in authenticator apps
+  (default `Jarl <hostname>`).
+- Resetting a user's two-factor login (lost phone): Users → Reset 2FA,
+  `jarl user totp reset NAME`, or on the server
+  `jarld user totp reset NAME` (also with jarld stopped).
+- The dashboard and `jarl status` list users who must use two-factor login
+  but haven't set it up, and suggest disabling the first `admin` account
+  when it is still active next to personal administrator accounts.
+  `jarl user list`/`show` and the Users page show who uses it.
+- API: `POST /auth/login/totp`, `/me/totp` (`setup`, `enable`, `disable`,
+  `recovery-codes`), `DELETE /users/{id}/totp`; database migration 4.
+- `scripts/testenv.sh`: turns a fresh Debian/Ubuntu machine into a test bed.
+  It installs BIND and the build tools (Go from go.dev), writes a hand-made
+  style configuration with internal and external views, a split-horizon
+  zone (`example.com` or `JARL_TEST_ZONE`) and a reverse zone, starts named
+  and prints the steps to install Jarl and adopt the configuration
+  (docs/development.md).
+- View colours. Give a view a colour (Views → Edit, `jarl view color`, or
+  `PUT /views/{id}/color`) and the zone list, the zone page and the views
+  list show its name in that colour. The colours are muted, and pastel in
+  dark mode. The default is the link colour. A colour isn't configuration,
+  so setting one needs no changeset or deploy.
+- A "← Zones" link above a zone, back to the zone list, and "← History"
+  above a changeset. The zone list keeps its filter, view and type in the
+  address, so going back to it (with that link or the browser's back
+  button) restores them. A view opened from a zone or the zone list has a
+  "← example.com (external)" or "← Zones" link back.
+
+### Changed
+
+- The version moved from the header to a footer: "Powered by Jarl v0.1.0",
+  linking to the release on Gitea. A build that isn't of a release tag
+  shows its commit instead, linked to the commit and marked `-modified`
+  with uncommitted changes. Before, every build of a commit after a
+  release still showed the release's version. `GET /status` and
+  `/auth/whoami` report the build as `build` (docs/development.md).
+- `jarld version`, `jarl --version`, `jarl status` and `jarl whoami` give
+  a version number only for release builds. Other builds say they are
+  development builds and how far past the last tag they are: `dev
+  ca0f148b78b6 (3 commits after v0.2.0-rc.1)`. Before, they printed the
+  version and the commit (`0.2.0-rc.1 (ca0f148b78b6)`), which read like a
+  release.
+- `make deb` gives development builds their own package version after
+  the last tag (`0.2.0~rc.1+git3.gca0f148`, plus the build time with
+  uncommitted changes). Installing one over the RC or an older build is
+  an upgrade: no more `apt install --reinstall`. It also removes older
+  packages from `dist/` (docs/development.md).
+- The view in the zone list, and on the zone page, links to that view,
+  and the views page highlights it. It used to be plain text, and the zone
+  page linked to the views page as a whole.
+- The zone's Name servers tab shows at once and follows the check as it
+  happens. Each query is listed as a dig command line (`dig @192.0.2.1
+  example.org. SOA +norec`) with a "waiting 1.8 s" counter until it is
+  answered. The finished result then replaces the progress, and the queries
+  stay under "Queries sent". Results, the delegation check's included, are
+  kept for 10 minutes, so returning to the tab shows them at once; "Check
+  again" asks anew. A check keeps running if you leave the tab. Behind it,
+  `GET /zones/{zone}/serials?stream=1` streams the queries as
+  newline-delimited JSON (docs/api.md).
+- The delegation check streams its queries the same way, every one of
+  them: finding the parent zone, its servers' addresses, the NS and DS
+  queries to each parent server and the SOA from each delegated server.
+  Each shows a short answer ("referral to katelyn.ns.cloudflare.com., …",
+  "DS 2371", "NXDOMAIN"). The serials check now lists its address lookups
+  as separate A and AAAA queries. `GET /zones/{zone}/delegation?stream=1`
+  streams them.
+- Switching a zone's tabs (Records, Settings, …) no longer blanks the page
+  while the tab loads: the page changes once the tab is ready, and
+  "Loading…" appears only if a page takes a while.
+- `jarl zone serials` compares the serial named serves, which for a signed
+  zone is the signed zone's (ahead of Jarl's).
+- `jarld import` turns `dnssec-policy` in an existing configuration into
+  the zones' DNSSEC setting, and warns that their keys must be moved into
+  Jarl's key directory before adopting.
+- `dnssec-policy` is no longer accepted as a zone, view or server option
+  (zones have a DNSSEC setting instead), nor `key-directory` as a zone
+  option.
+- Deleting a zone also removes the journal and signed files named kept
+  next to it.
+- Release candidates (tags like `v0.2.0-rc.1`) publish their `.deb`s to a
+  separate `testing` distribution of the package registry instead of
+  `stable`. Servers that follow `stable` can't pick up an RC with
+  `apt upgrade`. An RC may also take its release notes from the
+  `## [0.2.0]` or `## [Unreleased]` section of the CHANGELOG instead of
+  needing its own (docs/development.md, "Release candidates").
+
+### Fixed
+
+- Publishing a release candidate failed: `scripts/gitea-release.sh`
+  rejected its `.deb`s, whose names carry the Debian version
+  (`0.2.0~rc.1`) instead of `0.2.0-rc.1`.
+- `jarld init -u` and the install guide recommend naming the first
+  administrator after yourself (one account per person).
+- `jarld import` no longer warns that a zone with `allow-update { none; }`
+  uses dynamic updates (validation already allowed it).
+- docs/cli.md gives the CLI configuration file's location on macOS
+  (`~/Library/Application Support/jarl/config.yaml`) and Windows
+  (`%AppData%\jarl\config.yaml`). It was documented only as
+  `~/.config/jarl/config.yaml`.
+
 ## [0.1.0] - 2026-10-09
 
 The first version.

Makefile

@@ -14,7 +14,15 @@
 #                     (jarl-cli-<version>-<os>-<arch>[.exe])
 
 VERSION ?= $(shell cat VERSION 2>/dev/null || echo 0.0.0-dev)
-LDFLAGS := -s -w -X jarl/internal/version.Version=$(VERSION)
+# RELEASE_TAG marks a build of a release (the web UI then shows and links
+# the release rather than the commit): set when HEAD is tagged v$(VERSION)
+# and no tracked file is changed.
+RELEASE_TAG ?= $(shell t=v$(VERSION); git tag --points-at HEAD 2>/dev/null | grep -qx "$$t" && git diff --quiet HEAD 2>/dev/null && echo $$t)
+# DESCRIBE places other builds relative to the last tag ("3 commits after
+# v0.2.0-rc.1").
+DESCRIBE ?= $(shell git describe --tags --long --match 'v[0-9]*' --abbrev=12 HEAD 2>/dev/null)
+LDFLAGS := -s -w -X jarl/internal/version.Version=$(VERSION) -X jarl/internal/version.Tag=$(RELEASE_TAG) \
+	-X jarl/internal/version.Describe=$(DESCRIBE)
 GOFLAGS := -trimpath
 export CGO_ENABLED := 0
 
@@ -33,9 +41,18 @@ DESTDIR     ?=
 JARLD_BIN ?= bin/jarld
 JARL_BIN  ?= bin/jarl
 
-# make deb: the package's architecture (Debian name) and version.
+# make deb: the package's architecture (Debian name) and version. A
+# release is VERSION with ~ for - (0.2.0-rc.1 -> 0.2.0~rc.1, which apt
+# sorts before 0.2.0). A development build is versioned after the last
+# tag: 3 commits past v0.2.0-rc.1 is 0.2.0~rc.1+git3.gca0f148, which apt
+# sorts after that RC and before 0.2.0, so installing it upgrades without
+# --reinstall. Uncommitted changes add the build time (.m20261009153000),
+# so each such build is newer than the last.
 DEB_ARCH    ?= $(shell dpkg --print-architecture 2>/dev/null || go env GOARCH)
-DEB_VERSION ?= $(subst -,~,$(VERSION))
+DEB_DEV_VERSION := $(shell [ -n '$(DESCRIBE)' ] || exit 0; \
+	m=; git diff --quiet HEAD 2>/dev/null || m=.m$$(date -u +%Y%m%d%H%M%S); \
+	echo '$(DESCRIBE)' | sed -E 's/^v(.*)-([0-9]+)-g([0-9a-f]{7})[0-9a-f]*$$/\1+git\2.g\3/' | tr - '~' | sed "s/$$/$$m/")
+DEB_VERSION ?= $(if $(RELEASE_TAG),$(subst -,~,$(VERSION)),$(or $(DEB_DEV_VERSION),$(subst -,~,$(VERSION))))
 
 .PHONY: all build completion test vet e2e install install-files uninstall deb dist cli-dist clean
 

README.md

@@ -43,14 +43,26 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
   using it).
   Passwords use argon2id, sessions have CSRF protection, logins are rate
   limited.
+* **Two-factor login** with any authenticator app (TOTP), with recovery
+  codes; optional per user, or required for administrators or everyone
+  (`totp.require`). With it on, creating API tokens and changing users
+  asks for a fresh code, so a stolen password can't be turned into a token.
 * **Audit log** of every login, change and token, with user, token, IP and
   outcome.
-* **Daily backups** of the database by a systemd timer, checked as they are
-  written, with retention that never deletes the last few; `jarld restore`
-  puts one back safely.
+* **Daily backups** of the database and the DNSSEC keys by a systemd timer,
+  checked as they are written, with retention that never deletes the last
+  few; `jarld restore` puts one back safely, and raises zone serials so
+  named and the secondaries take the restored data.
 * **Name server checks**: whether the secondaries serve the current serial,
   and, for zones on the internet, whether the parent zone delegates them
-  to the right name servers with the right glue.
+  to the right name servers with the right glue and DS records.
+* **DNSSEC signing** per zone, by BIND itself, with every step that involves
+  the parent zone guarded: Jarl says when the DS record can be published,
+  refuses to make a zone unsigned while its DS may still be out there, turns
+  signing off in safe steps, and can wipe the slate clean.
+* **Porkbun support** (optional): the domain's name servers, glue records
+  (any number, IPv4 and IPv6) and DS records at the registrar, set from Jarl
+  after checks that the change won't take the domain offline.
 * **No token needed on the server**: root's `sudo jarl ...` talks to jarld
   over a local unix socket, so a lost token or password never locks you
   out.
@@ -59,9 +71,35 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
   queries, record types, cache hit rate. Shown in the web UI and the CLI,
   and exportable as JSON. Stored as aggregates in a separate database with
   retention you set.
+* **Internet exposure checks**: Jarl works out which views are reachable
+  from the internet (a GUA-addressed internal network still counts as
+  yours) and checks them: response rate limiting (set up in log-only mode
+  first, with what it would limit shown before you enforce it), open
+  resolvers, ANY amplification, cache snooping, version and host name
+  leaks, open management interfaces. Fixes are staged for review, changes
+  that open a public view up must be confirmed, and deliberate exceptions
+  can be acknowledged with a reason.
+* **Prometheus metrics** (optional): health to alert on (named down,
+  configuration problems, drift, failing blocklists, stale backups, DNSSEC
+  steps waiting at the parent, expiring tokens) and query counters per
+  result code, view, zone and blocklist, with example alerts. Set up in
+  jarl.yaml, with an address allow list and/or a bearer token.
+* **Blocking** like Pi-hole, done by named itself: blocklists (Adblock,
+  hosts or plain domains) downloaded and kept up to date, your own block
+  and allow rules that beat every list, per view, with "why is this
+  blocked?" checks and blocked counts in the statistics.
 * **Let's Encrypt DNS-01** built in: `jarl acme` plus certbot, acme.sh and lego
   hooks, an HTTPS-only endpoint for lego's and Traefik's `httpreq` provider,
   and CNAME delegation to a dedicated ACME zone.
+* **Certificates for the server itself**: Jarl obtains and renews TLS
+  certificates from Let's Encrypt (or any ACME CA), answering the DNS-01
+  challenge in its own zones or through Porkbun's API while Porkbun still
+  serves the domain, decided at every renewal. Use them for the web UI
+  (HTTPS without a restart) and for named's DNS over TLS and HTTPS (named
+  rereads them on renewal), or bring your own.
+* **Linked zones for split DNS**: the same zone in several views, with the
+  shared records kept in step by Jarl and a few records of each view's own
+  (an internal address for a public name, say).
 * **Adopts an existing server**: imports named.conf and zone files
   (comments included), then switches named over with an automatic
   fallback.
@@ -99,10 +137,15 @@ in `/etc/jarl/jarl.yaml` to reach it from your management network.
 | [docs/configuration.md](docs/configuration.md) | `/etc/jarl/jarl.yaml` reference |
 | [docs/cli.md](docs/cli.md) | The `jarl` command line client |
 | [docs/api.md](docs/api.md) | REST API reference |
-| [docs/permissions.md](docs/permissions.md) | Users, tokens, grants and roles |
+| [docs/permissions.md](docs/permissions.md) | Users, tokens, grants and roles, two-factor login |
 | [docs/views.md](docs/views.md) | Split DNS: adding views to a server that has none |
+| [docs/dnssec.md](docs/dnssec.md) | DNSSEC signing, going public with your own name servers, Porkbun |
 | [docs/acme.md](docs/acme.md) | Let's Encrypt DNS-01 with certbot, acme.sh, lego and Traefik |
+| [docs/certificates.md](docs/certificates.md) | TLS certificates Jarl obtains and renews for its web UI and named's DNS over TLS/HTTPS |
 | [docs/stats.md](docs/stats.md) | Query statistics: enabling, what is collected, retention |
+| [docs/exposure.md](docs/exposure.md) | Internet exposure: which views are public, hardening checks, response rate limiting |
+| [docs/metrics.md](docs/metrics.md) | Prometheus metrics: access, what is exported, example alerts |
+| [docs/blocking.md](docs/blocking.md) | Blocking ads, trackers and malware: blocklists, your own rules, views, memory |
 | [docs/validation.md](docs/validation.md) | Every check Jarl makes |
 | [docs/operations.md](docs/operations.md) | Backups, drift, failures, recovery, monitoring |
 | [docs/development.md](docs/development.md) | Code layout, tests against real BIND, conventions |
@@ -123,8 +166,10 @@ these pages:
   fields adapt to the zone type), per-zone records
   with inline editing, type-specific hints and a preview of the exact record
   that will be added (reverse zones take addresses and suggest host names), settings (SOA, TTL, serial
-  policy, view), options, the generated zone file, and pasting a zone file
-  to merge or replace records.
+  policy, view), options, the generated zone file, pasting a zone file
+  to merge or replace records, name server checks, DNSSEC (keys, the DS
+  record to copy, and each step with what it needs first) and, with a
+  Porkbun key, the registrar.
 * **Views, ACLs, TSIG keys, Server options**: wherever an address match list
   is entered, the existing ACLs and keys are offered and unknown names are
   flagged. The options editor knows every
@@ -133,7 +178,7 @@ these pages:
 * **Changes**: pending edits with the diff, named-checkconf output and
   problems, applied as one changeset. History lists applied changesets with
   their diffs and a revert button.
-* **Audit, Users, Account** (password, API tokens) and **Search**.
+* **Audit, Users, Account** (password, two-factor login, API tokens) and **Search**.
 
 By default, edits are collected as pending changes. Pending rows are shown
 inline (green = new, yellow = changed, struck out = deleted) until you
@@ -151,9 +196,18 @@ review step.
 
 ## Status
 
-Version 0.1.0, the first release. It is feature-complete for one server's
-configuration. DNSSEC signing and managing several servers are not handled
-yet ([concepts.md](docs/concepts.md#what-jarl-deliberately-doesnt-do-yet)).
+Version 0.4.0 is the current release, and 0.4.1 is in testing
+(0.4.1-rc.3): it adds Prometheus metrics, address ranges in ACLs and
+other address match lists, safer changeset handling, internet exposure
+checks with response rate limiting, TLS certificates Jarl obtains and
+renews itself, and linked zones for split DNS. 0.4.0 added blocking (blocklists and
+your own rules, like Pi-hole, done by named, with different blocking for
+different devices), disabling zones, server statistics and view keys, on
+top of 0.3.0's disabled records, script-friendly CLI output and client
+names in the statistics, and 0.2.0's DNSSEC signing, Porkbun support,
+two-factor login and view colours. Jarl is feature-complete for one server's configuration.
+Managing several servers from one jarld and dynamic updates are not
+handled yet ([concepts.md](docs/concepts.md#what-jarl-deliberately-doesnt-do-yet)).
 
 ## License
 

VERSION

@@ -1 +1 @@
-0.1.0
+0.4.1-rc.3

cmd/jarl/acme.go

@@ -83,7 +83,7 @@ func acmeZones(c *client.Client, name, view string) ([]acme.Zone, error) {
 	}
 	refs := make([]acme.Zone, len(zones))
 	for i, z := range zones {
-		refs[i] = acme.Zone{Name: z.Name, View: z.View}
+		refs[i] = acme.Zone{Name: z.Name, View: z.View, Link: z.LinkGroup}
 	}
 	out := acme.Zones(name, refs, view)
 	if len(out) == 0 {

cmd/jarl/admin_cmds.go

@@ -200,6 +200,14 @@ func statusCmd() *cobra.Command {
 				for _, t := range resp.ExpiringTokens {
 					fmt.Fprintf(w, "Token:\t%s/%s (id %d) expires %s\n", t.Username, t.Name, t.ID, fmtExpiry(t.ExpiresAt, nil))
 				}
+				if o := resp.TOTP; o != nil {
+					if len(o.Missing) > 0 {
+						fmt.Fprintf(w, "2FA:\trequired (%s) but not set up by %s\n", o.Policy, strings.Join(o.Missing, ", "))
+					}
+					if o.SharedAdmin != "" {
+						fmt.Fprintf(w, "Accounts:\tthe first account %q is still active next to personal administrator accounts; disable it if it is shared ('jarl user update %s --disabled')\n", o.SharedAdmin, o.SharedAdmin)
+					}
+				}
 				if len(st.Problems) > 0 {
 					w.(interface{ Flush() error }).Flush()
 					fmt.Println("Problems:")
@@ -333,6 +341,19 @@ func userID(c *client.Client, name string) (int64, error) {
 	return 0, fmt.Errorf("no user %q", name)
 }
 
+// twoFA describes a user's two-factor login.
+func twoFA(u api.User) string {
+	switch {
+	case u.TOTPEnabledAt != nil:
+		return "on since " + fmtTime(u.TOTPEnabledAt)
+	case u.TOTPRequired:
+		return "REQUIRED, not set up (they can only set it up until they do)"
+	case !u.HasPassword:
+		return "-"
+	}
+	return "off"
+}
+
 func printUser(w io.Writer, u api.User) {
 	fmt.Fprintf(w, "User:\t%s (id %d)\n", u.Username, u.ID)
 	role := "user"
@@ -346,6 +367,7 @@ func printUser(w io.Writer, u api.User) {
 		role += ", no password (tokens only)"
 	}
 	fmt.Fprintf(w, "Role:\t%s\n", role)
+	fmt.Fprintf(w, "2FA:\t%s\n", twoFA(u))
 	for i, g := range u.GrantStrings {
 		label := ""
 		if i == 0 {
@@ -384,9 +406,18 @@ func userCmd() *cobra.Command {
 				return err
 			}
 			return output(users, func(w io.Writer) {
-				fmt.Fprintln(w, "ID\tUSER\tADMIN\tDISABLED\tGRANTS\tLAST LOGIN")
+				fmt.Fprintln(w, "ID\tUSER\tADMIN\tDISABLED\t2FA\tGRANTS\tLAST LOGIN")
 				for _, u := range users {
-					fmt.Fprintf(w, "%d\t%s\t%v\t%v\t%s\t%s\n", u.ID, u.Username, u.Admin, u.Disabled, strings.Join(u.GrantStrings, "; "), fmtTime(u.LastLoginAt))
+					tfa := "off"
+					switch {
+					case u.TOTPEnabledAt != nil:
+						tfa = "on"
+					case u.TOTPRequired:
+						tfa = "MISSING"
+					case !u.HasPassword:
+						tfa = "-"
+					}
+					fmt.Fprintf(w, "%d\t%s\t%v\t%v\t%s\t%s\t%s\n", u.ID, u.Username, u.Admin, u.Disabled, tfa, strings.Join(u.GrantStrings, "; "), fmtTime(u.LastLoginAt))
 				}
 			})
 		},
@@ -548,7 +579,43 @@ func userCmd() *cobra.Command {
 		},
 	}
 	del.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask for confirmation")
-	cmd.AddCommand(list, show, create, update, del)
+	totpCmd := &cobra.Command{Use: "totp", Short: "Two-factor login of a user"}
+	totpReset := &cobra.Command{
+		Use:   "reset USER",
+		Short: "Turn off a user's two-factor login (a lost phone without recovery codes)",
+		Long: `Turns off a user's two-factor login, deletes their recovery codes and logs
+them out. They log in with the password alone next time and can set it up
+again under Account (they must, if totp.require applies to them).
+
+Users set up two-factor login themselves, in the web UI. Without any
+administrator able to log in, use 'sudo -u jarl jarld user totp reset USER'
+on the server.`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if !confirm("Turn off two-factor login of "+args[0]+"?", yes) {
+				return fmt.Errorf("canceled")
+			}
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			id, err := userID(c, args[0])
+			if err != nil {
+				return err
+			}
+			var u api.User
+			if err := c.Do(ctx(), "DELETE", fmt.Sprintf("/users/%d/totp", id), nil, nil, &u); err != nil {
+				return err
+			}
+			if !flagQuiet {
+				fmt.Printf("two-factor login of %s is off\n", u.Username)
+			}
+			return nil
+		},
+	}
+	totpReset.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask for confirmation")
+	totpCmd.AddCommand(totpReset)
+	cmd.AddCommand(list, show, create, update, del, totpCmd)
 	return cmd
 }
 

cmd/jarl/blocking.go

@@ -0,0 +1,508 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"jarl/internal/api"
+	"jarl/internal/blocking"
+)
+
+// ---- blocking (docs/blocking.md)
+
+// viewsBody adds the --view flags to a request body: names, or "auto" for
+// every view that offers recursion.
+func viewsBody(body map[string]any, views []string) {
+	if len(views) == 1 && strings.EqualFold(views[0], "auto") {
+		body["views"] = []string{}
+	} else if len(views) > 0 {
+		body["views"] = views
+	}
+}
+
+func viewsText(views []string, auto bool) string {
+	switch {
+	case auto:
+		return "auto (" + strings.Join(views, ", ") + ")"
+	case len(views) == 0:
+		return "-"
+	}
+	return strings.Join(views, ", ")
+}
+
+func blocklistCmd() *cobra.Command {
+	cmd := &cobra.Command{Use: "blocklist", Aliases: []string{"blocklists"}, Short: "Blocklists: domains to block, downloaded and kept up to date",
+		Long: `Blocklists are downloaded by jarld and turned into response policy zones, so
+named answers "doesn't exist" for the domains on them (docs/blocking.md).
+Hosts, plain domain and Adblock (||domain^) lists work. Your own block and
+allow rules ('jarl block') take precedence over every list.`}
+	var views []string
+	var comment, step string
+
+	list := &cobra.Command{
+		Use:   "list",
+		Short: "List blocklists and their state",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var lists []api.Blocklist
+			if err := c.Get(ctx(), "/blocking/lists", nil, &lists); err != nil {
+				return err
+			}
+			return output(lists, func(w io.Writer) {
+				fmt.Fprintln(w, "NAME\tSTATE\tSTEP\tDOMAINS\tVIEWS\tUPDATED\tMEMORY\tURL")
+				for _, b := range lists {
+					domains, updated, mem := "-", "-", "-"
+					if s := b.Status; s != nil && s.UpdatedAt != nil {
+						domains, updated = fmt.Sprint(s.Entries), s.UpdatedAt.Local().Format("2006-01-02 15:04")
+					}
+					if b.MemoryMB > 0 {
+						mem = fmt.Sprintf("~%d MB", b.MemoryMB)
+					}
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n", b.Name, b.State, b.Step, domains, viewsText(b.Views, b.AutoViews), updated, mem, b.URL)
+				}
+				for _, b := range lists {
+					if b.Status != nil && b.Status.Error != "" {
+						fmt.Fprintf(w, "\n%s: %s\n", b.Name, b.Status.Error)
+					}
+				}
+			})
+		},
+	}
+
+	add := &cobra.Command{
+		Use:   "add NAME URL",
+		Short: "Add a blocklist (jarld downloads it right away)",
+		Long: `Add a blocklist. NAME is a short label (letters, digits, hyphens). Without
+--view the list applies to every view that offers recursion.
+
+  jarl blocklist add hagezi-pro https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt
+  jarl blocklist add stevenblack https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts --view internal`,
+		Args: cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := map[string]any{"name": args[0], "url": args[1]}
+			viewsBody(body, views)
+			if step != "" {
+				body["step"] = step
+			}
+			if comment != "" {
+				body["comment"] = comment
+			}
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/lists", nil, body)
+			if err != nil {
+				return err
+			}
+			if err := report(resp); err != nil || flagQuiet || !resp.Applied {
+				return err
+			}
+			fmt.Println("jarld downloads the list in the background; 'jarl blocklist list' shows when it's in use.")
+			return nil
+		},
+	}
+	add.Flags().StringArrayVar(&views, "view", nil, "a view it applies to (repeat for several; default: every view that offers recursion)")
+	add.Flags().StringVar(&comment, "comment", "", "comment")
+	add.Flags().StringVar(&step, "step", "", "the blocking step it starts at (default: normal; see 'jarl block step')")
+
+	var rename, newURL string
+	update := &cobra.Command{
+		Use:   "update LIST",
+		Short: "Change a blocklist's name, URL, views or comment",
+		Example: `  jarl blocklist update hagezi --url https://example.org/new-list.txt
+  jarl blocklist update hagezi --view internal --view guest
+  jarl blocklist update hagezi --view auto     # every view that offers recursion`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := map[string]any{}
+			f := cmd.Flags()
+			if f.Changed("name") {
+				body["name"] = rename
+			}
+			if f.Changed("url") {
+				body["url"] = newURL
+			}
+			if f.Changed("comment") {
+				body["comment"] = comment
+			}
+			if f.Changed("step") {
+				body["step"] = step
+			}
+			viewsBody(body, views)
+			if len(body) == 0 {
+				return fmt.Errorf("nothing to change (see --help)")
+			}
+			resp, err := c.Mutate(ctx(), "PATCH", "/blocking/lists/"+url.PathEscape(args[0]), nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	update.Flags().StringVar(&rename, "name", "", "new name")
+	update.Flags().StringVar(&newURL, "url", "", "new URL")
+	update.Flags().StringArrayVar(&views, "view", nil, `a view it applies to (repeat for several; "auto": every view that offers recursion)`)
+	update.Flags().StringVar(&comment, "comment", "", "new comment")
+	update.Flags().StringVar(&step, "step", "", "the blocking step it starts at (normal, or a step above it)")
+
+	toggle := func(disable bool) *cobra.Command {
+		verb := map[bool]string{true: "disable", false: "enable"}[disable]
+		return &cobra.Command{
+			Use:   verb + " LIST",
+			Short: map[bool]string{true: "Stop using a blocklist (it is kept, and re-enabled without downloading)", false: "Use a disabled blocklist again"}[disable],
+			Args:  cobra.ExactArgs(1),
+			RunE: func(cmd *cobra.Command, args []string) error {
+				c, err := newClient()
+				if err != nil {
+					return err
+				}
+				resp, err := c.Mutate(ctx(), "PATCH", "/blocking/lists/"+url.PathEscape(args[0]), nil, map[string]any{"disabled": disable})
+				if err != nil {
+					return err
+				}
+				return report(resp)
+			},
+		}
+	}
+
+	var yes bool
+	del := &cobra.Command{
+		Use:   "delete LIST",
+		Short: "Delete a blocklist",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if !confirm("Delete blocklist "+args[0]+"?", yes) {
+				return fmt.Errorf("canceled")
+			}
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "DELETE", "/blocking/lists/"+url.PathEscape(args[0]), nil, nil)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	del.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask")
+
+	var force bool
+	refresh := &cobra.Command{
+		Use:   "refresh [LIST...]",
+		Short: "Download blocklists now (all enabled ones without LIST)",
+		Long: `Download blocklists now instead of waiting for their next check
+(blocking.refresh in jarl.yaml, daily by default). A list is only replaced
+when its content changed; --force downloads it even when the server says
+it hasn't.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			names := args
+			if len(names) == 0 {
+				var lists []api.Blocklist
+				if err := c.Get(ctx(), "/blocking/lists", nil, &lists); err != nil {
+					return err
+				}
+				for _, b := range lists {
+					if b.State != "disabled" && b.State != "idle" {
+						names = append(names, b.Name)
+					}
+				}
+			}
+			if flagDryRun {
+				fmt.Printf("would download: %s\n", strings.Join(names, ", "))
+				return nil
+			}
+			failed := 0
+			for _, n := range names {
+				var b api.Blocklist
+				start := time.Now()
+				err := c.Do(ctx(), "POST", "/blocking/lists/"+url.PathEscape(n)+"/refresh", q("force", map[bool]string{true: "1"}[force]), nil, &b)
+				switch {
+				case err != nil:
+					failed++
+					fmt.Printf("%s: %v\n", n, err)
+				case b.Status != nil && b.Status.Error != "":
+					failed++
+					fmt.Printf("%s: %s (the previous version stays in use)\n", n, b.Status.Error)
+				case b.Status != nil:
+					fmt.Printf("%s: %d domains (%d lines skipped), checked in %s\n", n, b.Status.Entries, b.Status.Skipped, time.Since(start).Round(100*time.Millisecond))
+				}
+			}
+			if failed > 0 {
+				return &checkFailed{fmt.Sprintf("%d of %d lists could not be updated", failed, len(names))}
+			}
+			return nil
+		},
+	}
+	refresh.Flags().BoolVar(&force, "force", false, "download even when the server says the list hasn't changed")
+
+	cmd.AddCommand(list, add, update, toggle(true), toggle(false), del, refresh)
+	return cmd
+}
+
+func blockCmd() *cobra.Command {
+	cmd := &cobra.Command{Use: "block", Short: "Your own block and allow rules, and checking what is blocked",
+		Long: `Rules block a domain, or allow it despite the blocklists ('jarl blocklist').
+A rule covers the domain and every name below it, unless --exact. Rules
+take precedence over every list, and the most specific rule wins: allow
+cdn.example.com overrides block example.com for cdn.example.com and the
+names below it (docs/blocking.md).`}
+	var views []string
+	var comment, view string
+	var exact bool
+
+	addRule := func(action string) *cobra.Command {
+		c := &cobra.Command{
+			Use:   map[string]string{"block": "add DOMAIN", "allow": "allow DOMAIN"}[action],
+			Short: map[string]string{"block": "Block a domain (and the names below it)", "allow": "Allow a domain (and the names below it) that a blocklist blocks"}[action],
+			Example: map[string]string{
+				"block": "  jarl block add doubleclick.net\n  jarl block add telemetry.example.com --exact --view internal",
+				"allow": "  jarl block allow cdn.example.com\n  jarl block allow login.example.com --exact",
+			}[action],
+			Args: cobra.ExactArgs(1),
+			RunE: func(cmd *cobra.Command, args []string) error {
+				c, err := newClient()
+				if err != nil {
+					return err
+				}
+				body := map[string]any{"name": args[0], "action": action}
+				if exact {
+					body["exact"] = true
+				}
+				viewsBody(body, views)
+				if comment != "" {
+					body["comment"] = comment
+				}
+				resp, err := c.Mutate(ctx(), "POST", "/blocking/rules", nil, body)
+				if err != nil {
+					return err
+				}
+				return report(resp)
+			},
+		}
+		c.Flags().BoolVar(&exact, "exact", false, "only this name, not the names below it")
+		c.Flags().StringArrayVar(&views, "view", nil, "a view it applies to (repeat for several; default: every view that offers recursion)")
+		c.Flags().StringVar(&comment, "comment", "", "comment")
+		return c
+	}
+
+	list := &cobra.Command{
+		Use:   "list",
+		Short: "List your block and allow rules",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var rules []api.BlockRule
+			if err := c.Get(ctx(), "/blocking/rules", nil, &rules); err != nil {
+				return err
+			}
+			note := pausedNote(c)
+			return output(rules, func(w io.Writer) {
+				if note != "" {
+					fmt.Fprintln(w, note)
+				}
+				fmt.Fprintln(w, "ID\tACTION\tDOMAIN\tCOVERS\tVIEWS\tCOMMENT")
+				for _, r := range rules {
+					covers := "and below"
+					if r.Exact {
+						covers = "exact"
+					}
+					fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%s\n", r.ID, r.Action, r.Name, covers, viewsText(r.Views, r.AutoViews), r.Comment)
+				}
+			})
+		},
+	}
+
+	var id int64
+	var missingOK bool
+	del := &cobra.Command{
+		Use:   "delete DOMAIN  |  delete --id ID",
+		Short: "Delete the rules for a domain (or one rule by ID)",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var resp *api.MutationResponse
+			switch {
+			case id > 0:
+				resp, err = c.Mutate(ctx(), "DELETE", fmt.Sprintf("/blocking/rules/%d", id), nil, nil)
+			case len(args) == 1:
+				qv := q("name", args[0], "view", view)
+				if missingOK {
+					qv.Set("missing_ok", "1")
+				}
+				resp, err = c.Mutate(ctx(), "DELETE", "/blocking/rules", qv, nil)
+			default:
+				return fmt.Errorf("give DOMAIN, or --id")
+			}
+			if err != nil {
+				return err
+			}
+			if !resp.Applied && !resp.Staged && !resp.DryRun {
+				fmt.Println("nothing to do")
+				return nil
+			}
+			return report(resp)
+		},
+	}
+	del.Flags().Int64Var(&id, "id", 0, "delete the rule with this ID")
+	del.Flags().StringVar(&view, "view", "", "only the rules that apply in this view")
+	del.Flags().BoolVar(&missingOK, "missing-ok", false, "succeed when there is no such rule")
+
+	check := &cobra.Command{
+		Use:   "check DOMAIN",
+		Short: "Show whether a name is blocked, and by which rule or list",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var matches []blocking.Match
+			if err := c.Get(ctx(), "/blocking/check", q("name", args[0]), &matches); err != nil {
+				return err
+			}
+			note := pausedNote(c)
+			return output(matches, func(w io.Writer) {
+				if note != "" {
+					fmt.Fprint(w, note+"While it is, every name is answered. Otherwise:\n")
+				}
+				if len(matches) == 0 {
+					fmt.Fprintln(w, "Blocking isn't set up in any view.")
+					return
+				}
+				for _, m := range matches {
+					where := ""
+					if m.View != "" {
+						where = "view " + m.View + ":\t"
+					}
+					switch {
+					case m.Result == "none":
+						fmt.Fprintf(w, "%snot blocked\n", where)
+					case m.List != "" && m.Step != "":
+						fmt.Fprintf(w, "%sblocked for clients at step %s and above, by blocklist %s (entry %s); not for others\n", where, m.Step, m.List, m.Entry)
+					case m.List != "":
+						fmt.Fprintf(w, "%sblocked by blocklist %s (entry %s)\n", where, m.List, m.Entry)
+					default:
+						fmt.Fprintf(w, "%s%s by your rule %d (entry %s)\n", where, m.Result, m.RuleID, m.Entry)
+					}
+				}
+			})
+		},
+	}
+
+	pause := &cobra.Command{
+		Use:   "pause [DURATION | indefinitely]",
+		Short: "Let every name through for a while (default 10m, at most 24h) or until resumed",
+		Long: `Pause blocking: every name is answered normally until the time is up,
+then blocking resumes by itself. Useful to see whether blocking is what
+breaks a site. The lists stay loaded, so pausing and resuming take effect
+at once. "indefinitely" pauses until 'jarl block resume'.
+
+  jarl block pause          # 10 minutes
+  jarl block pause 1h
+  jarl block pause indefinitely
+  jarl block resume`,
+		Args:      cobra.MaximumNArgs(1),
+		ValidArgs: []string{"indefinitely", "5m", "10m", "30m", "1h", "24h"},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if len(args) == 1 && args[0] == "indefinitely" {
+				c, err := newClient()
+				if err != nil {
+					return err
+				}
+				resp, err := c.Mutate(ctx(), "POST", "/blocking/pause", nil, map[string]any{"indefinitely": true})
+				if err != nil {
+					return err
+				}
+				if err := report(resp); err != nil || flagQuiet || !resp.Applied {
+					return err
+				}
+				fmt.Println("Blocking is paused until you resume it ('jarl block resume').")
+				return nil
+			}
+			d := 10 * time.Minute
+			if len(args) == 1 {
+				var err error
+				if d, err = time.ParseDuration(args[0]); err != nil || d < time.Minute {
+					return fmt.Errorf("invalid duration %q (like 10m or 2h, or indefinitely)", args[0])
+				}
+			}
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/pause", nil, map[string]any{"minutes": int(d.Round(time.Minute) / time.Minute)})
+			if err != nil {
+				return err
+			}
+			if err := report(resp); err != nil || flagQuiet || !resp.Applied {
+				return err
+			}
+			fmt.Printf("Blocking is paused until %s.\n", time.Now().Add(d.Round(time.Minute)).Format("15:04"))
+			return nil
+		},
+	}
+	resume := &cobra.Command{
+		Use:   "resume",
+		Short: "End a pause: block again now",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/resume", nil, nil)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+
+	cmd.AddCommand(addRule("block"), addRule("allow"), list, del, check, pause, resume, blockStepCmd(), blockGroupCmd())
+	return cmd
+}
+
+// pausedNote returns a line about a pause of blocking, or "".
+func pausedNote(c interface {
+	Get(context.Context, string, url.Values, any) error
+}) string {
+	var st struct {
+		PausedUntil        *time.Time `json:"paused_until"`
+		PausedIndefinitely bool       `json:"paused_indefinitely"`
+	}
+	if c.Get(ctx(), "/blocking/status", nil, &st) != nil {
+		return ""
+	}
+	if st.PausedIndefinitely {
+		return "Blocking is paused until you resume it ('jarl block resume').\n"
+	}
+	if st.PausedUntil == nil {
+		return ""
+	}
+	return "Blocking is paused until " + st.PausedUntil.Local().Format("2006-01-02 15:04") + " ('jarl block resume' ends it).\n"
+}

cmd/jarl/certs.go

@@ -0,0 +1,556 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"jarl/internal/client"
+)
+
+type certStatus struct {
+	State   string `json:"state"`
+	Message string `json:"message"`
+}
+
+type certInfo struct {
+	ID           int64      `json:"id"`
+	Name         string     `json:"name"`
+	Source       string     `json:"source"`
+	Domains      []string   `json:"domains"`
+	CertFile     string     `json:"cert_file,omitempty"`
+	KeyFile      string     `json:"key_file,omitempty"`
+	Uses         []string   `json:"uses"`
+	Challenge    string     `json:"challenge,omitempty"`
+	KeyType      string     `json:"key_type,omitempty"`
+	Comment      string     `json:"comment"`
+	Names        []string   `json:"names,omitempty"`
+	NotBefore    *time.Time `json:"not_before,omitempty"`
+	NotAfter     *time.Time `json:"not_after,omitempty"`
+	Issuer       string     `json:"issuer,omitempty"`
+	Serial       string     `json:"serial,omitempty"`
+	RenewAt      *time.Time `json:"renew_at,omitempty"`
+	LastAttempt  *time.Time `json:"last_attempt,omitempty"`
+	LastSuccess  *time.Time `json:"last_success,omitempty"`
+	LastError    string     `json:"last_error,omitempty"`
+	Failures     int        `json:"failures,omitempty"`
+	LastRoutes   []string   `json:"last_routes,omitempty"`
+	Status       certStatus `json:"status"`
+	NextAttempt  *time.Time `json:"next_attempt,omitempty"`
+	IssuingSince *time.Time `json:"issuing_since,omitempty"`
+	Serving      bool       `json:"serving,omitempty"`
+	Files        *struct {
+		Chain string `json:"chain"`
+		Key   string `json:"key"`
+	} `json:"files,omitempty"`
+}
+
+type certAccount struct {
+	Directory            string     `json:"directory"`
+	Email                string     `json:"email"`
+	AgreeTOS             bool       `json:"agree_tos"`
+	EAB                  bool       `json:"eab"`
+	Registered           bool       `json:"registered"`
+	URI                  string     `json:"uri"`
+	RegisteredAt         *time.Time `json:"registered_at"`
+	Porkbun              bool       `json:"porkbun"`
+	Resolvers            []string   `json:"resolvers"`
+	Dir                  string     `json:"dir"`
+	ActiveWebCertificate string     `json:"active_web_certificate"`
+}
+
+type certRoute struct {
+	Domain   string   `json:"domain"`
+	Record   string   `json:"record"`
+	Target   string   `json:"target"`
+	Route    string   `json:"route"`
+	Zone     string   `json:"zone"`
+	PublicNS []string `json:"public_ns"`
+	Why      string   `json:"why"`
+	Error    string   `json:"error"`
+}
+
+func certPath(name string) string { return "/certificates/" + url.PathEscape(name) }
+
+func certCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "cert",
+		Aliases: []string{"certificate", "certificates"},
+		Short:   "TLS certificates Jarl obtains and renews, or reads from files (docs/certificates.md)",
+		Long: `Certificates for jarld's own HTTPS (use "web") and for named's DNS over
+TLS and HTTPS (use "dns": written where named can read them).
+
+Jarl obtains them from an ACME CA (Let's Encrypt by default; the account is
+set up in jarl.yaml under acme.account) and renews them itself. It answers
+the DNS-01 challenges in a zone it serves, or through Porkbun's API while
+Porkbun serves the domain ("auto" decides at every renewal from the
+domain's public name servers). A certificate you renew yourself can be
+used too (--cert-file and --key-file): Jarl rereads it when it changes.`,
+		Example: `  jarl cert check --domain ns1.adbraun.lol                # where would the challenge go?
+  jarl cert create ns1 --domain ns1.adbraun.lol --use web --use dns
+  jarl cert create wild --domain adbraun.lol --domain '*.adbraun.lol' --use dns
+  jarl cert create own --cert-file /etc/ssl/ns1/fullchain.pem --key-file /etc/ssl/ns1/privkey.pem --use web
+  jarl cert list
+  jarl cert issue ns1                                      # renew now
+  jarl cert update ns1 --challenge porkbun                 # pin the route (auto, jarl or porkbun)`,
+	}
+	cmd.AddCommand(certListCmd(), certShowCmd(), certCreateCmd(), certUpdateCmd(), certIssueCmd(), certCheckCmd(), certDeleteCmd(), certAccountCmd())
+	return cmd
+}
+
+func certListCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:     "list",
+		Aliases: []string{"ls"},
+		Short:   "List certificates",
+		Args:    cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				Certificates []certInfo `json:"certificates"`
+			}
+			if err := c.Get(ctx(), "/certificates", nil, &r); err != nil {
+				return err
+			}
+			return output(r.Certificates, func(w io.Writer) {
+				fmt.Fprintln(w, "NAME\tSOURCE\tUSES\tNAMES\tEXPIRES\tSTATUS")
+				for _, ci := range r.Certificates {
+					names := ci.Names
+					if len(names) == 0 {
+						names = ci.Domains
+					}
+					state := ci.Status.State
+					if ci.IssuingSince != nil {
+						state = "obtaining"
+					}
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\n", ci.Name, ci.Source, dash(strings.Join(ci.Uses, ",")), strings.Join(names, " "), fmtDate(ci.NotAfter), state)
+				}
+			})
+		},
+	}
+}
+
+func fmtDate(t *time.Time) string {
+	if t == nil {
+		return "-"
+	}
+	return t.Local().Format("2006-01-02")
+}
+
+func printCert(w io.Writer, ci certInfo) {
+	fmt.Fprintf(w, "Name:\t%s\n", ci.Name)
+	switch ci.Source {
+	case "acme":
+		fmt.Fprintf(w, "Source:\tacme (Jarl obtains and renews it)\n")
+		fmt.Fprintf(w, "Domains:\t%s\n", strings.Join(ci.Domains, " "))
+		fmt.Fprintf(w, "Challenge:\t%s\n", ci.Challenge)
+		fmt.Fprintf(w, "Key type:\t%s\n", ci.KeyType)
+	default:
+		fmt.Fprintf(w, "Source:\tfile (you renew it)\n")
+		fmt.Fprintf(w, "Cert file:\t%s\n", ci.CertFile)
+		fmt.Fprintf(w, "Key file:\t%s\n", ci.KeyFile)
+	}
+	uses := []string{}
+	for _, u := range ci.Uses {
+		switch u {
+		case "web":
+			s := "web (jarld's HTTPS"
+			if ci.Serving {
+				s += ", serving now"
+			}
+			uses = append(uses, s+")")
+		case "dns":
+			uses = append(uses, "dns (for named)")
+		}
+	}
+	fmt.Fprintf(w, "Uses:\t%s\n", dash(strings.Join(uses, ", ")))
+	if ci.Comment != "" {
+		fmt.Fprintf(w, "Comment:\t%s\n", ci.Comment)
+	}
+	state := ci.Status.State
+	if ci.Status.Message != "" {
+		state += ": " + ci.Status.Message
+	}
+	if ci.IssuingSince != nil {
+		state = "obtaining since " + fmtTime(ci.IssuingSince)
+	}
+	fmt.Fprintf(w, "Status:\t%s\n", state)
+	if ci.NotAfter != nil {
+		fmt.Fprintf(w, "Names:\t%s\n", strings.Join(ci.Names, " "))
+		fmt.Fprintf(w, "Valid:\t%s to %s\n", fmtTime(ci.NotBefore), fmtTime(ci.NotAfter))
+		fmt.Fprintf(w, "Issuer:\t%s\n", ci.Issuer)
+		fmt.Fprintf(w, "Serial:\t%s\n", ci.Serial)
+	}
+	if ci.Source == "acme" {
+		if ci.NextAttempt != nil && ci.NotAfter != nil {
+			fmt.Fprintf(w, "Renews:\t%s\n", fmtTime(ci.NextAttempt))
+		} else if ci.NextAttempt != nil {
+			fmt.Fprintf(w, "Next try:\t%s\n", fmtTime(ci.NextAttempt))
+		}
+		if len(ci.LastRoutes) > 0 {
+			fmt.Fprintf(w, "Challenges:\t%s\n", strings.Join(ci.LastRoutes, "; "))
+		}
+	}
+	if ci.LastSuccess != nil {
+		fmt.Fprintf(w, "Last success:\t%s\n", fmtTime(ci.LastSuccess))
+	}
+	if ci.LastError != "" {
+		fmt.Fprintf(w, "Last error:\t%s\n", ci.LastError)
+	}
+	if ci.Files != nil {
+		fmt.Fprintf(w, "For named:\t%s\n\t%s\n", ci.Files.Chain, ci.Files.Key)
+	}
+}
+
+func certShowCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "show NAME",
+		Short: "Show a certificate",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var ci certInfo
+			if err := c.Get(ctx(), certPath(args[0]), nil, &ci); err != nil {
+				return err
+			}
+			return output(ci, func(w io.Writer) { printCert(w, ci) })
+		},
+	}
+}
+
+type certFlags struct {
+	domains            []string
+	uses               []string
+	challenge, keyType string
+	comment            string
+	certFile, keyFile  string
+}
+
+func (f *certFlags) add(cmd *cobra.Command) {
+	fl := cmd.Flags()
+	fl.StringArrayVarP(&f.domains, "domain", "d", nil, "a name on the certificate (repeat for several; *.example.com for a wildcard)")
+	fl.StringArrayVarP(&f.uses, "use", "u", nil, "what it is for: web (jarld's HTTPS) or dns (named's DNS over TLS/HTTPS); repeat for both")
+	fl.StringVar(&f.challenge, "challenge", "", "where DNS-01 challenges go: auto (from the domain's public name servers), jarl or porkbun")
+	fl.StringVar(&f.keyType, "key-type", "", "key type: ec256 (default), ec384, rsa2048, rsa3072 or rsa4096")
+	fl.StringVar(&f.comment, "comment", "", "a comment")
+	fl.StringVar(&f.certFile, "cert-file", "", "a certificate you renew yourself: the full chain (PEM)")
+	fl.StringVar(&f.keyFile, "key-file", "", "its private key (PEM)")
+}
+
+func (f *certFlags) body(cmd *cobra.Command) map[string]any {
+	b := map[string]any{}
+	ch := cmd.Flags().Changed
+	if ch("domain") {
+		b["domains"] = f.domains
+	}
+	if ch("use") {
+		uses := []string{}
+		for _, u := range f.uses {
+			for _, x := range strings.Split(u, ",") {
+				if x = strings.TrimSpace(x); x != "" && x != "none" {
+					uses = append(uses, x)
+				}
+			}
+		}
+		b["uses"] = uses
+	}
+	for flag, key := range map[string]string{"challenge": "challenge", "key-type": "key_type", "comment": "comment", "cert-file": "cert_file", "key-file": "key_file"} {
+		if ch(flag) {
+			v, _ := cmd.Flags().GetString(flag)
+			b[key] = v
+		}
+	}
+	return b
+}
+
+func certCreateCmd() *cobra.Command {
+	var f certFlags
+	var noIssue, noWait bool
+	cmd := &cobra.Command{
+		Use:   "create NAME",
+		Short: "Add a certificate: obtained by Jarl (--domain), or one you renew (--cert-file, --key-file)",
+		Long: `Adds a certificate. With --domain, Jarl obtains it from the CA at once
+(and renews it from then on); the command waits for the outcome. With
+--cert-file and --key-file it is a certificate you renew yourself, which
+Jarl reads (and rereads when the files change).
+
+The name is used for the files for named (<certificates.dir>/NAME/).`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			b := f.body(cmd)
+			b["name"] = args[0]
+			b["source"] = "acme"
+			if f.certFile != "" || f.keyFile != "" {
+				b["source"] = "file"
+			}
+			b["issue"] = !noIssue
+			var r struct {
+				Certificate certInfo `json:"certificate"`
+				Error       string   `json:"error"`
+			}
+			if err := c.Do(ctx(), "POST", "/certificates", nil, b, &r); err != nil {
+				return err
+			}
+			if r.Certificate.IssuingSince != nil && !noWait {
+				return waitIssue(c, args[0])
+			}
+			if r.Error != "" {
+				return errors.New(r.Error)
+			}
+			return output(r.Certificate, func(w io.Writer) { printCert(w, r.Certificate) })
+		},
+	}
+	f.add(cmd)
+	cmd.Flags().BoolVar(&noIssue, "no-issue", false, "don't obtain it now (jarld does within minutes)")
+	cmd.Flags().BoolVar(&noWait, "no-wait", false, "return at once instead of waiting for the CA")
+	return cmd
+}
+
+func certUpdateCmd() *cobra.Command {
+	var f certFlags
+	cmd := &cobra.Command{
+		Use:   "update NAME",
+		Short: "Change a certificate (--domain and --use replace the whole list)",
+		Long: `Changes a certificate. --domain and --use replace the whole list
+(--use none for no use). New names or a new key type make Jarl obtain it
+again soon (run 'jarl cert issue NAME' to do it now).`,
+		Example: `  jarl cert update ns1 --use web --use dns
+  jarl cert update ns1 --challenge auto
+  jarl cert update ns1 --domain ns1.adbraun.lol --domain dns.adbraun.lol`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			b := f.body(cmd)
+			if len(b) == 0 {
+				return errors.New("nothing to change")
+			}
+			var r struct {
+				Certificate certInfo `json:"certificate"`
+			}
+			if err := c.Do(ctx(), "PATCH", certPath(args[0]), nil, b, &r); err != nil {
+				return err
+			}
+			return output(r.Certificate, func(w io.Writer) { printCert(w, r.Certificate) })
+		},
+	}
+	f.add(cmd)
+	return cmd
+}
+
+func certIssueCmd() *cobra.Command {
+	var noWait bool
+	cmd := &cobra.Command{
+		Use:     "issue NAME",
+		Aliases: []string{"renew"},
+		Short:   "Obtain the certificate now (reread the files of one you renew yourself)",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				Certificate certInfo `json:"certificate"`
+				Error       string   `json:"error"`
+			}
+			if err := c.Do(ctx(), "POST", certPath(args[0])+"/issue", nil, map[string]any{}, &r); err != nil {
+				return err
+			}
+			if r.Error != "" {
+				return errors.New(r.Error)
+			}
+			if r.Certificate.IssuingSince != nil && !noWait {
+				return waitIssue(c, args[0])
+			}
+			return output(r.Certificate, func(w io.Writer) { printCert(w, r.Certificate) })
+		},
+	}
+	cmd.Flags().BoolVar(&noWait, "no-wait", false, "return at once instead of waiting for the CA")
+	return cmd
+}
+
+// waitIssue polls until jarld has finished obtaining the certificate and
+// reports the outcome.
+func waitIssue(c *client.Client, name string) error {
+	tty := !flagQuiet && flagOutput == "table"
+	if tty {
+		fmt.Fprintf(os.Stderr, "Obtaining %s from the CA (this can take a few minutes while the challenges reach every name server)", name)
+	}
+	deadline := time.Now().Add(20 * time.Minute)
+	var ci certInfo
+	for {
+		ci = certInfo{} // a field the answer leaves out must not keep the last value
+		if err := c.Get(ctx(), certPath(name), nil, &ci); err != nil {
+			return err
+		}
+		if ci.IssuingSince == nil || time.Now().After(deadline) {
+			break
+		}
+		if tty {
+			fmt.Fprint(os.Stderr, ".")
+		}
+		time.Sleep(2 * time.Second)
+	}
+	if tty {
+		fmt.Fprintln(os.Stderr)
+	}
+	if ci.IssuingSince != nil {
+		return fmt.Errorf("jarld is still obtaining %s; check later with: jarl cert show %s", name, name)
+	}
+	if err := output(ci, func(w io.Writer) { printCert(w, ci) }); err != nil {
+		return err
+	}
+	if ci.LastError != "" && (ci.LastSuccess == nil || ci.LastAttempt != nil && ci.LastAttempt.After(*ci.LastSuccess)) {
+		return fmt.Errorf("obtaining %s failed (jarld tries again at %s)", name, fmtTime(ci.NextAttempt))
+	}
+	return nil
+}
+
+func certCheckCmd() *cobra.Command {
+	var f certFlags
+	cmd := &cobra.Command{
+		Use:   "check [NAME]",
+		Short: "Show where each name's DNS-01 challenge would go, without asking the CA",
+		Long: `For an existing certificate, or for --domain names, shows where Jarl would
+publish each DNS-01 challenge (in a zone it serves, or at Porkbun) and why,
+seen from the resolvers in acme.resolvers, as the CA would see it. Nothing
+is published and the CA isn't asked.`,
+		Example: `  jarl cert check ns1
+  jarl cert check --domain ns1.adbraun.lol --domain '*.adbraun.lol'`,
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				OK      bool        `json:"ok"`
+				Routes  []certRoute `json:"routes"`
+				Account certAccount `json:"account"`
+			}
+			if len(args) == 1 {
+				err = c.Do(ctx(), "POST", certPath(args[0])+"/check", nil, map[string]any{}, &r)
+			} else {
+				b := f.body(cmd)
+				if b["domains"] == nil {
+					return errors.New("give a certificate name, or --domain")
+				}
+				err = c.Do(ctx(), "POST", "/certificates/check", nil, b, &r)
+			}
+			if err != nil {
+				return err
+			}
+			if err := output(r, func(w io.Writer) {
+				fmt.Fprintln(w, "NAME\tROUTE\tRECORD\tWHY")
+				for _, rt := range r.Routes {
+					rec := strings.TrimSuffix(rt.Target, ".")
+					if rt.Target != rt.Record && rt.Target != "" {
+						rec += " (CNAME from " + strings.TrimSuffix(rt.Record, ".") + ")"
+					}
+					if rt.Error != "" {
+						fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", rt.Domain, "none", dash(rec), rt.Error)
+						continue
+					}
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", rt.Domain, rt.Route, rec, rt.Why)
+				}
+				if !r.Account.AgreeTOS {
+					fmt.Fprintln(w, "\nNote: acme.account.agree_tos isn't set in jarl.yaml, so Jarl can't register with the CA yet.")
+				}
+			}); err != nil {
+				return err
+			}
+			if !r.OK {
+				return errors.New("not every name can be validated")
+			}
+			return nil
+		},
+	}
+	cmd.Flags().StringArrayVarP(&f.domains, "domain", "d", nil, "a name to check (repeat for several)")
+	cmd.Flags().StringVar(&f.challenge, "challenge", "", "the challenge setting to check with: auto, jarl or porkbun")
+	return cmd
+}
+
+func certDeleteCmd() *cobra.Command {
+	var yes bool
+	cmd := &cobra.Command{
+		Use:   "delete NAME",
+		Short: "Delete a certificate (and its files for named)",
+		Long: `Deletes a certificate. Its files for named are removed, so take it out of
+any tls block in named's configuration first. If jarld served it, jarld
+goes back to tls.cert_file, or to plain HTTP.`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if !confirm("Delete certificate "+args[0]+"?", yes) {
+				return errors.New("aborted")
+			}
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			if err := c.Do(ctx(), "DELETE", certPath(args[0]), nil, nil, nil); err != nil {
+				return err
+			}
+			if !flagQuiet {
+				fmt.Println("deleted certificate", args[0])
+			}
+			return nil
+		},
+	}
+	cmd.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask")
+	return cmd
+}
+
+func certAccountCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "account",
+		Short: "Show the ACME account and settings (set in jarl.yaml under acme)",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				Account certAccount `json:"account"`
+			}
+			if err := c.Get(ctx(), "/certificates", nil, &r); err != nil {
+				return err
+			}
+			a := r.Account
+			return output(a, func(w io.Writer) {
+				fmt.Fprintf(w, "Directory:\t%s\n", a.Directory)
+				fmt.Fprintf(w, "Email:\t%s\n", dash(a.Email))
+				fmt.Fprintf(w, "Terms agreed:\t%v\n", a.AgreeTOS)
+				if a.Registered {
+					fmt.Fprintf(w, "Account:\t%s (since %s)\n", a.URI, fmtTime(a.RegisteredAt))
+				} else {
+					fmt.Fprintf(w, "Account:\tnot registered yet (it is, with the first certificate)\n")
+				}
+				fmt.Fprintf(w, "EAB:\t%v\n", a.EAB)
+				fmt.Fprintf(w, "Porkbun:\t%v\n", a.Porkbun)
+				fmt.Fprintf(w, "Resolvers:\t%s\n", strings.Join(a.Resolvers, " "))
+				fmt.Fprintf(w, "Files for named:\t%s\n", a.Dir)
+				fmt.Fprintf(w, "Serving HTTPS with:\t%s\n", dash(a.ActiveWebCertificate))
+			})
+		},
+	}
+}

cmd/jarl/changes.go

@@ -26,6 +26,10 @@ type batchEntry struct {
 	Delete map[string]any `yaml:"delete,omitempty" json:"delete,omitempty"`
 	Set    map[string]any `yaml:"set,omitempty" json:"set,omitempty"`
 	Update map[string]any `yaml:"update,omitempty" json:"update,omitempty"`
+	// Disable and Enable find records like Delete: by id, or by zone,
+	// name, type and optionally data.
+	Disable map[string]any `yaml:"disable,omitempty" json:"disable,omitempty"`
+	Enable  map[string]any `yaml:"enable,omitempty" json:"enable,omitempty"`
 	// Any API operation: op, id, data.
 	Op   string         `yaml:"op,omitempty" json:"op,omitempty"`
 	ID   int64          `yaml:"id,omitempty" json:"id,omitempty"`
@@ -57,25 +61,23 @@ func (b *batchFile) requests() ([]api.ChangeRequest, error) {
 	var out []api.ChangeRequest
 	for i, e := range b.Changes {
 		n := 0
-		for _, set := range []bool{e.Add != nil, e.Delete != nil, e.Set != nil, e.Update != nil, e.Op != ""} {
+		for _, set := range []bool{e.Add != nil, e.Delete != nil, e.Set != nil, e.Update != nil, e.Disable != nil, e.Enable != nil, e.Op != ""} {
 			if set {
 				n++
 			}
 		}
 		if n != 1 {
-			return nil, fmt.Errorf("change %d: use exactly one of add, delete, set, update or op", i+1)
+			return nil, fmt.Errorf("change %d: use exactly one of add, delete, set, update, disable, enable or op", i+1)
 		}
 		switch {
 		case e.Add != nil:
 			out = append(out, api.ChangeRequest{Op: "record.create", Data: rawJSON(e.Add)})
 		case e.Delete != nil:
-			d := e.Delete
-			if id, ok := toInt64(d["id"]); ok {
-				delete(d, "id")
-				out = append(out, api.ChangeRequest{Op: "record.delete", ID: id, Data: rawJSON(d)})
-			} else {
-				out = append(out, api.ChangeRequest{Op: "record.delete", Data: rawJSON(d)})
-			}
+			out = append(out, byIDOrMatch("record.delete", e.Delete))
+		case e.Disable != nil:
+			out = append(out, byIDOrMatch("record.disable", e.Disable))
+		case e.Enable != nil:
+			out = append(out, byIDOrMatch("record.enable", e.Enable))
 		case e.Set != nil:
 			s := e.Set
 			switch d := s["data"].(type) {
@@ -104,17 +106,31 @@ func (b *batchFile) requests() ([]api.ChangeRequest, error) {
 	return out, nil
 }
 
+// byIDOrMatch is a request for the record with d's id, or for the records
+// d matches.
+func byIDOrMatch(op string, d map[string]any) api.ChangeRequest {
+	if id, ok := toInt64(d["id"]); ok {
+		delete(d, "id")
+		return api.ChangeRequest{Op: op, ID: id, Data: rawJSON(d)}
+	}
+	return api.ChangeRequest{Op: op, Data: rawJSON(d)}
+}
+
 // submitBatch applies requests as one changeset, or stages them into the
 // changeset given with --changeset.
 func submitBatch(c *client.Client, description string, reqs []api.ChangeRequest) error {
 	var resp api.MutationResponse
-	if c.Changeset > 0 {
-		if err := c.Do(ctx(), "POST", fmt.Sprintf("/changesets/%d/ops", c.Changeset), nil, map[string]any{"ops": reqs}, &resp); err != nil {
+	cs, err := c.UseChangeset(ctx())
+	if err != nil {
+		return err
+	}
+	if cs > 0 {
+		if err := c.Do(ctx(), "POST", fmt.Sprintf("/changesets/%d/ops", cs), nil, map[string]any{"ops": reqs}, &resp); err != nil {
 			return err
 		}
 		return report(&resp)
 	}
-	if err := c.Do(ctx(), "POST", "/apply", nil, api.BatchRequest{Description: description, Ops: reqs, DryRun: c.DryRun, Force: c.Force}, &resp); err != nil {
+	if err := c.Do(ctx(), "POST", "/apply", nil, api.BatchRequest{Description: description, Ops: reqs, DryRun: c.DryRun, Force: c.Force, AcceptRisk: c.AcceptRisk}, &resp); err != nil {
 		return err
 	}
 	return report(&resp)
@@ -218,8 +234,9 @@ func changesetCmd() *cobra.Command {
 		Example: `  export JARL_CHANGESET=$(jarl changeset create "move web servers" -q)
   jarl record add example.com www2 A 192.0.2.20
   jarl record delete example.com www A
-  jarl changeset diff $JARL_CHANGESET
-  jarl changeset apply $JARL_CHANGESET`,
+  jarl changeset diff                # JARL_CHANGESET's
+  jarl changeset apply
+  unset JARL_CHANGESET`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
@@ -233,21 +250,25 @@ func changesetCmd() *cobra.Command {
 				fmt.Println(cs.ID)
 				return nil
 			}
-			fmt.Printf("created changeset %d\nstage changes with --changeset %d (or export JARL_CHANGESET=%d)\n", cs.ID, cs.ID, cs.ID)
+			fmt.Printf("created changeset %d\nstage changes with --changeset %d (or export JARL_CHANGESET=%d), then 'jarl changeset apply'\n", cs.ID, cs.ID, cs.ID)
 			return nil
 		},
 	}
 	show := &cobra.Command{
-		Use:   "show ID",
-		Short: "Show a changeset's operations",
-		Args:  cobra.ExactArgs(1),
+		Use:   "show [ID]",
+		Short: "Show a changeset's operations (default: -C or JARL_CHANGESET)",
+		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
+			id, _, err := changesetArg(c, args, false)
+			if err != nil {
+				return err
+			}
 			var cs api.Changeset
-			if err := c.Get(ctx(), "/changesets/"+args[0], nil, &cs); err != nil {
+			if err := c.Get(ctx(), "/changesets/"+id, nil, &cs); err != nil {
 				return err
 			}
 			return output(cs, func(w io.Writer) {
@@ -268,16 +289,20 @@ func changesetCmd() *cobra.Command {
 		},
 	}
 	diff := &cobra.Command{
-		Use:   "diff ID",
-		Short: "Validate an open changeset and show what applying it would change",
-		Args:  cobra.ExactArgs(1),
+		Use:   "diff [ID]",
+		Short: "Validate an open changeset and show what applying it would change (default: -C or JARL_CHANGESET)",
+		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
+			id, fromEnv, err := changesetArg(c, args, true)
+			if err != nil {
+				return err
+			}
 			var raw json.RawMessage
-			if err := c.Get(ctx(), "/changesets/"+args[0]+"/preview", nil, &raw); err != nil {
+			if err := c.Get(ctx(), "/changesets/"+id+"/preview", nil, &raw); err != nil {
 				return err
 			}
 			if flagOutput != "table" {
@@ -300,56 +325,82 @@ func changesetCmd() *cobra.Command {
 			fmt.Println()
 			fmt.Print(r.Diff)
 			if r.Valid {
-				fmt.Println("\nvalid: apply with 'jarl changeset apply " + args[0] + "'")
+				how := "jarl changeset apply " + id
+				if fromEnv {
+					how = "jarl changeset apply"
+				}
+				fmt.Println("\nvalid: apply with '" + how + "'")
 				return nil
 			}
 			return fmt.Errorf("the changeset can't be applied as it is")
 		},
 	}
 	apply := &cobra.Command{
-		Use:   "apply ID",
-		Short: "Apply an open changeset",
-		Args:  cobra.ExactArgs(1),
+		Use:   "apply [ID]",
+		Short: "Apply an open changeset (default: -C or JARL_CHANGESET)",
+		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
+			id, fromEnv, err := changesetArg(c, args, true)
+			if err != nil {
+				return err
+			}
 			var resp api.MutationResponse
-			if err := c.Do(ctx(), "POST", "/changesets/"+args[0]+"/apply", nil, map[string]any{"force": c.Force, "dry_run": c.DryRun}, &resp); err != nil {
+			if err := c.Do(ctx(), "POST", "/changesets/"+id+"/apply", nil, map[string]any{"force": c.Force, "dry_run": c.DryRun, "accept_risk": c.AcceptRisk}, &resp); err != nil {
 				return err
 			}
-			return report(&resp)
+			if err := report(&resp); err != nil {
+				return err
+			}
+			if fromEnv && resp.Applied {
+				envChangesetDone(id, "applied")
+			}
+			return nil
 		},
 	}
 	discard := &cobra.Command{
-		Use:   "discard ID",
-		Short: "Throw away an open changeset",
-		Args:  cobra.ExactArgs(1),
+		Use:   "discard [ID]",
+		Short: "Throw away an open changeset (default: -C or JARL_CHANGESET)",
+		Args:  cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
-			if err := c.Do(ctx(), "POST", "/changesets/"+args[0]+"/discard", nil, nil, nil); err != nil {
+			id, fromEnv, err := changesetArg(c, args, true)
+			if err != nil {
+				return err
+			}
+			if err := c.Do(ctx(), "POST", "/changesets/"+id+"/discard", nil, nil, nil); err != nil {
 				return err
 			}
 			if !flagQuiet {
-				fmt.Println("discarded changeset", args[0])
+				fmt.Println("discarded changeset", id)
+			}
+			if fromEnv {
+				envChangesetDone(id, "discarded")
 			}
 			return nil
 		},
 	}
 	remove := &cobra.Command{
-		Use:   "remove ID SEQ",
-		Short: "Remove one operation from an open changeset",
-		Args:  cobra.ExactArgs(2),
+		Use:   "remove [ID] SEQ",
+		Short: "Remove one operation from an open changeset (default: -C or JARL_CHANGESET)",
+		Args:  cobra.RangeArgs(1, 2),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
 			if err != nil {
 				return err
 			}
-			return c.Do(ctx(), "DELETE", "/changesets/"+args[0]+"/ops/"+args[1], nil, nil, nil)
+			seq := args[len(args)-1]
+			id, _, err := changesetArg(c, args[:len(args)-1], true)
+			if err != nil {
+				return err
+			}
+			return c.Do(ctx(), "DELETE", "/changesets/"+id+"/ops/"+seq, nil, nil, nil)
 		},
 	}
 	revert := &cobra.Command{

cmd/jarl/clientgroups.go

@@ -0,0 +1,271 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"net/url"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"jarl/internal/api"
+)
+
+// Blocking steps and client groups (docs/blocking.md).
+
+func blockStepCmd() *cobra.Command {
+	cmd := &cobra.Command{Use: "step", Aliases: []string{"steps"}, Short: "Blocking steps: which lists apply to which client groups",
+		Long: `Steps decide which blocklists a client group gets. Each step includes the
+lists of the steps below it, plus its own:
+
+  off      only your rules (built in)
+  normal   your rules + the normal lists; clients not in a group (built in)
+  strict   normal + the lists at step strict (a step you add)
+  ...
+
+Lists start at a step ('jarl blocklist update LIST --step strict'), client
+groups are at one ('jarl block group add kids 10.10.0.50 --step strict').`}
+	list := &cobra.Command{
+		Use:   "list",
+		Short: "List the steps, lowest first",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var steps []api.BlockStep
+			if err := c.Get(ctx(), "/blocking/steps", nil, &steps); err != nil {
+				return err
+			}
+			return output(steps, func(w io.Writer) {
+				fmt.Fprintln(w, "STEP\tLISTS\tGROUPS\tCOMMENT")
+				fmt.Fprintln(w, "off\t-\t(built in)\tonly your rules")
+				fmt.Fprintln(w, "normal\t-\t(built in)\tthe default")
+				for _, s := range steps {
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", s.Name, orDash(strings.Join(s.Lists, ", ")), orDash(strings.Join(s.Groups, ", ")), s.Comment)
+				}
+			})
+		},
+	}
+	var comment string
+	add := &cobra.Command{
+		Use:   "add NAME",
+		Short: "Add a step above the existing ones",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/steps", nil, map[string]any{"name": args[0], "comment": comment})
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	add.Flags().StringVar(&comment, "comment", "", "comment")
+	rename := &cobra.Command{
+		Use:   "rename STEP NEW-NAME",
+		Short: "Rename a step",
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "PATCH", "/blocking/steps/"+url.PathEscape(args[0]), nil, map[string]any{"name": args[1]})
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	order := &cobra.Command{
+		Use:     "order STEP...",
+		Short:   "Set the order of the steps above normal, lowest first",
+		Example: "  jarl block step order strict very-strict",
+		Args:    cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/steps/order", nil, map[string]any{"steps": args})
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	del := &cobra.Command{
+		Use:   "delete STEP",
+		Short: "Delete a step (refused while lists or groups use it)",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "DELETE", "/blocking/steps/"+url.PathEscape(args[0]), nil, nil)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.AddCommand(list, add, rename, order, del)
+	return cmd
+}
+
+func blockGroupCmd() *cobra.Command {
+	cmd := &cobra.Command{Use: "group", Aliases: []string{"groups"}, Short: "Client groups: blocking steps for some devices",
+		Long: `A client group puts devices at a blocking step: off (only your rules),
+normal, or a step you added ('jarl block step'). Members are addresses,
+prefixes, or ACLs made of them. Devices not in a group are at normal.
+named must see the devices' own addresses (not a router forwarding for
+them), and they need fixed addresses (DHCP reservations).`}
+	list := &cobra.Command{
+		Use:   "list",
+		Short: "List client groups",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var groups []api.ClientGroup
+			if err := c.Get(ctx(), "/blocking/groups", nil, &groups); err != nil {
+				return err
+			}
+			return output(groups, func(w io.Writer) {
+				fmt.Fprintln(w, "GROUP\tSTEP\tMEMBERS\tVIEWS\tCOMMENT")
+				for _, g := range groups {
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", g.Name, g.Step, orDash(strings.Join(g.Members, ", ")), viewsText(g.Views, g.AutoViews), g.Comment)
+				}
+			})
+		},
+	}
+	var step, comment string
+	var views []string
+	add := &cobra.Command{
+		Use:   "add NAME MEMBER...",
+		Short: "Add a client group",
+		Example: `  jarl block group add work 10.10.0.20 --step off
+  jarl block group add kids 10.10.0.50 10.10.0.51 2001:db8:1::/64 --step strict
+  jarl block group add guests guest-net --step normal      # an ACL`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := map[string]any{"name": args[0], "members": args[1:], "comment": comment}
+			if step != "" {
+				body["step"] = step
+			}
+			viewsBody(body, views)
+			resp, err := c.Mutate(ctx(), "POST", "/blocking/groups", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	add.Flags().StringVar(&step, "step", "", "the group's step: off, normal (default) or one you added")
+	add.Flags().StringArrayVar(&views, "view", nil, "a view it applies in (repeat for several; default: every view with blocking)")
+	add.Flags().StringVar(&comment, "comment", "", "comment")
+	var addM, removeM []string
+	var rename string
+	update := &cobra.Command{
+		Use:   "update GROUP",
+		Short: "Change a group's members, step, name, views or comment",
+		Example: `  jarl block group update kids --add 10.10.0.52 --remove 10.10.0.50
+  jarl block group update kids --step very-strict`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := map[string]any{}
+			f := cmd.Flags()
+			if len(addM) > 0 || len(removeM) > 0 {
+				var g api.ClientGroup
+				var all []api.ClientGroup
+				if err := c.Get(ctx(), "/blocking/groups", nil, &all); err != nil {
+					return err
+				}
+				for _, x := range all {
+					if x.Name == strings.ToLower(args[0]) {
+						g = x
+					}
+				}
+				if g.ID == 0 {
+					return fmt.Errorf("client group %s not found", args[0])
+				}
+				drop := map[string]bool{}
+				for _, m := range removeM {
+					drop[m] = true
+				}
+				members := []string{}
+				for _, m := range g.Members {
+					if !drop[m] {
+						members = append(members, m)
+					}
+				}
+				body["members"] = append(members, addM...)
+			}
+			if f.Changed("step") {
+				body["step"] = step
+			}
+			if f.Changed("name") {
+				body["name"] = rename
+			}
+			if f.Changed("comment") {
+				body["comment"] = comment
+			}
+			viewsBody(body, views)
+			if len(body) == 0 {
+				return fmt.Errorf("nothing to change (see --help)")
+			}
+			resp, err := c.Mutate(ctx(), "PATCH", "/blocking/groups/"+url.PathEscape(args[0]), nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	update.Flags().StringArrayVar(&addM, "add", nil, "add a member (repeat for several)")
+	update.Flags().StringArrayVar(&removeM, "remove", nil, "remove a member (repeat for several)")
+	update.Flags().StringVar(&step, "step", "", "new step")
+	update.Flags().StringVar(&rename, "name", "", "new name")
+	update.Flags().StringArrayVar(&views, "view", nil, `a view it applies in (repeat; "auto": every view with blocking)`)
+	update.Flags().StringVar(&comment, "comment", "", "new comment")
+	del := &cobra.Command{
+		Use:   "delete GROUP",
+		Short: "Delete a client group (its devices go back to normal)",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "DELETE", "/blocking/groups/"+url.PathEscape(args[0]), nil, nil)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.AddCommand(list, add, update, del)
+	return cmd
+}
+
+func orDash(s string) string {
+	if s == "" {
+		return "-"
+	}
+	return s
+}

cmd/jarl/complete.go

@@ -15,6 +15,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"jarl/internal/api"
+	"jarl/internal/model"
 	"jarl/internal/rr"
 )
 
@@ -23,7 +24,7 @@ const completeTimeout = 3 * time.Second
 // setupCompletion adds value completion to the command tree.
 func setupCompletion(root *cobra.Command) {
 	root.RegisterFlagCompletionFunc("server", completeServers(true))
-	root.RegisterFlagCompletionFunc("output", cobra.FixedCompletions([]string{"table", "json", "yaml"}, cobra.ShellCompDirectiveNoFileComp))
+	root.RegisterFlagCompletionFunc("output", cobra.FixedCompletions([]string{"table", "json", "yaml", "id", "field="}, cobra.ShellCompDirectiveNoFileComp|cobra.ShellCompDirectiveNoSpace))
 	var walk func(c *cobra.Command)
 	walk = func(c *cobra.Command) {
 		for _, name := range []string{"view", "user", "zone"} {
@@ -71,8 +72,12 @@ func argCompletion(c *cobra.Command) cobra.CompletionFunc {
 			return lookup(cmd, "zone")
 		case p == "VIEW":
 			return lookup(cmd, "view")
+		case p == "COLOR":
+			return append([]string{"default"}, model.ViewColors...), cobra.ShellCompDirectiveNoFileComp
 		case p == "ACL":
 			return lookup(cmd, "acl")
+		case p == "LIST":
+			return lookup(cmd, "blocklist")
 		case p == "USER":
 			return lookup(cmd, "user")
 		case p == "KEY" && parent == "tsig":
@@ -196,6 +201,14 @@ func lookup(cmd *cobra.Command, kind string) ([]cobra.Completion, cobra.ShellCom
 		for _, v := range views {
 			addName(v.Name, v.Comment)
 		}
+	case "blocklist":
+		var lists []api.Blocklist
+		if c.Get(ctx(), "/blocking/lists", nil, &lists) != nil {
+			return nil, none
+		}
+		for _, b := range lists {
+			addName(b.Name, b.URL)
+		}
 	case "acl":
 		var acls []api.ACL
 		if c.Get(ctx(), "/acls", nil, &acls) != nil {

cmd/jarl/config_cmds.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"net/url"
+	"slices"
 	"strings"
 
 	"github.com/spf13/cobra"
@@ -27,15 +28,15 @@ func viewCmd() *cobra.Command {
 				return err
 			}
 			return output(views, func(w io.Writer) {
-				fmt.Fprintln(w, "#\tID\tVIEW\tMATCH-CLIENTS\tMATCH-DESTINATIONS\tZONES")
+				fmt.Fprintln(w, "#\tID\tVIEW\tMATCH-CLIENTS\tMATCH-DESTINATIONS\tZONES\tCOLOR")
 				for i, v := range views {
-					fmt.Fprintf(w, "%d\t%d\t%s\t%s\t%s\t%d\n", i+1, v.ID, v.Name, orAny(v.MatchClients), orAny(v.MatchDestinations), v.Zones)
+					fmt.Fprintf(w, "%d\t%d\t%s\t%s\t%s\t%d\t%s\n", i+1, v.ID, v.Name, orAny(v.MatchClients), orAny(v.MatchDestinations), v.Zones, orDefault(v.Color))
 				}
 			})
 		},
 	}
 	var clients, dests []string
-	var recursiveOnly, comment string
+	var recursiveOnly, comment, exposure string
 	var adopt, cascade, yes bool
 	viewBody := func(cmd *cobra.Command) map[string]any {
 		body := map[string]any{}
@@ -59,6 +60,9 @@ func viewCmd() *cobra.Command {
 		if f.Changed("comment") {
 			body["comment"] = comment
 		}
+		if f.Changed("exposure") {
+			body["exposure"] = exposure
+		}
 		return body
 	}
 	addViewFlags := func(c *cobra.Command) {
@@ -66,6 +70,7 @@ func viewCmd() *cobra.Command {
 		c.Flags().StringSliceVar(&dests, "match-destinations", nil, "match-destinations elements")
 		c.Flags().StringVar(&recursiveOnly, "recursive-only", "", "match-recursive-only: yes, no or default")
 		c.Flags().StringVar(&comment, "comment", "", "comment")
+		c.Flags().StringVar(&exposure, "exposure", "", "reachable from the internet: auto (worked out), public or private (docs/exposure.md)")
 	}
 	create := &cobra.Command{
 		Use:   "create NAME",
@@ -172,10 +177,83 @@ func viewCmd() *cobra.Command {
 			return report(resp)
 		},
 	}
-	cmd.AddCommand(list, create, update, del, order)
+	color := &cobra.Command{
+		Use:   "color VIEW COLOR",
+		Short: "Set the colour the web UI shows a view in",
+		Long: "Set the colour the web UI shows a view in, so zones of the same view are easy to spot.\n" +
+			"Colours: default (the link colour), " + strings.Join(model.ViewColors, ", ") + ".\n" +
+			"This only changes the web UI: it applies at once, with no changeset or deploy.",
+		Example: `  jarl view color internal green
+  jarl view color internal default`,
+		Args: cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			col := strings.ToLower(args[1])
+			if col == "default" {
+				col = ""
+			} else if !slices.Contains(model.ViewColors, col) {
+				return fmt.Errorf("unknown colour %q: use default, %s", args[1], strings.Join(model.ViewColors, ", "))
+			}
+			var v api.View
+			if err := c.Do(ctx(), "PUT", "/views/"+url.PathEscape(args[0])+"/color", nil, api.ViewColor{Color: col}, &v); err != nil {
+				return err
+			}
+			fmt.Printf("View %s: colour %s\n", v.Name, orDefault(v.Color))
+			return nil
+		},
+	}
+	var keyNamed bool
+	key := &cobra.Command{
+		Use:   "key VIEW",
+		Short: "Show the TSIG key that selects a view, to query it from anywhere",
+		Long: `Every view has a TSIG key (jarl-view-NAME) at the front of its
+match-clients: a query signed with it lands in that view, whatever address
+it comes from. Jarl signs its own checks of this server with it; use it to
+see what a view answers:
+
+  jarl view key external                       # shows a ready dig -y command
+  jarl view key external --named-conf > external.key
+  dig -k external.key @SERVER adbraun.lol SOA
+
+Showing it needs tsig:write and is recorded in the audit log.`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var k struct {
+				Name      string `json:"name"`
+				Algorithm string `json:"algorithm"`
+				Secret    string `json:"secret"`
+			}
+			if err := c.Get(ctx(), "/views/"+url.PathEscape(args[0])+"/key", nil, &k); err != nil {
+				return err
+			}
+			if keyNamed {
+				fmt.Printf("key %q {\n\talgorithm %s;\n\tsecret %q;\n};\n", k.Name, k.Algorithm, k.Secret)
+				return nil
+			}
+			return output(k, func(w io.Writer) {
+				fmt.Fprintf(w, "Key:\t%s\nAlgorithm:\t%s\nSecret:\t%s\ndig:\tdig -y %s:%s:%s @SERVER NAME\n", k.Name, k.Algorithm, k.Secret, k.Algorithm, k.Name, k.Secret)
+			})
+		},
+	}
+	key.Flags().BoolVar(&keyNamed, "named-conf", false, "print a key statement (for dig -k FILE)")
+	cmd.AddCommand(list, create, update, del, order, color, key)
 	return cmd
 }
 
+func orDefault(s string) string {
+	if s == "" {
+		return "default"
+	}
+	return s
+}
+
 func orAny(list []string) string {
 	if len(list) == 0 {
 		return "any"
@@ -682,7 +760,7 @@ func settingsCmd() *cobra.Command {
 		},
 	}
 	var ns []string
-	var contact, policy string
+	var contact, policy, srvExposure string
 	var ttl, refresh, retry, expire, neg uint32
 	set := &cobra.Command{
 		Use:   "set",
@@ -703,6 +781,9 @@ func settingsCmd() *cobra.Command {
 			if f.Changed("serial-policy") {
 				body["serial_policy"] = policy
 			}
+			if f.Changed("exposure") {
+				body["exposure"] = srvExposure
+			}
 			for name, v := range map[string]uint32{"ttl": ttl, "refresh": refresh, "retry": retry, "expire": expire, "negative-ttl": neg} {
 				if f.Changed(name) {
 					key := map[string]string{"ttl": "default_ttl", "negative-ttl": "negative_ttl"}[name]
@@ -725,6 +806,7 @@ func settingsCmd() *cobra.Command {
 	set.Flags().StringSliceVar(&ns, "ns", nil, "default name servers")
 	set.Flags().StringVar(&contact, "contact", "", "default SOA contact")
 	set.Flags().StringVar(&policy, "serial-policy", "", "date, increment or unixtime")
+	set.Flags().StringVar(&srvExposure, "exposure", "", "without views: is the server reachable from the internet? auto, public or private (docs/exposure.md)")
 	set.Flags().Uint32Var(&ttl, "ttl", 0, "default TTL")
 	set.Flags().Uint32Var(&refresh, "refresh", 0, "SOA refresh")
 	set.Flags().Uint32Var(&retry, "retry", 0, "SOA retry")

cmd/jarl/dnssec.go

@@ -0,0 +1,389 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"jarl/internal/api"
+	"jarl/internal/dnssec"
+)
+
+func zoneDNSSECCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "dnssec",
+		Short: "Sign a zone with DNSSEC, and turn signing off safely",
+		Long: `named signs the zone itself (BIND's dnssec-policy with inline signing): Jarl
+keeps writing the unsigned zone, and named keeps a signed copy next to it
+and its keys in Jarl's key directory. See docs/dnssec.md.
+
+Turning signing on is safe at any time; validation only starts once you add
+the zone's DS record at the parent zone (your registrar), and 'status' says
+when that is safe. Turning it off goes through BIND's insecure policy, which
+keeps the zone signed until the DS is gone from the parent.`,
+	}
+	var view string
+	status := &cobra.Command{
+		Use:     "status ZONE",
+		Short:   "Show the zone's keys, its DS record and the next step",
+		Example: "  jarl zone dnssec status adbraun.lol --view external",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			resp, err := dnssecStatus(args[0], view)
+			if err != nil {
+				return err
+			}
+			return output(resp, func(w io.Writer) { printDNSSEC(w, resp) })
+		},
+	}
+	status.Flags().StringVar(&view, "view", "", "view of the zone")
+
+	var policy string
+	enable := &cobra.Command{
+		Use:   "enable ZONE",
+		Short: "Start signing the zone",
+		Long: `Starts signing the zone with BIND's default policy (one ECDSA P-256 key that
+is never replaced, so the DS record at the parent never has to change) or a
+custom dnssec-policy statement.
+
+Nothing changes for resolvers until the zone's DS record is added at the
+parent zone. named first publishes the key for long enough that every cache
+has it ('status' shows when: about a day with the default policy); add the
+DS after that.`,
+		Example: "  jarl zone dnssec enable adbraun.lol --view external",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			path, qv := zonePath(args[0], view)
+			resp, err := c.Mutate(ctx(), "PATCH", path, qv, map[string]any{"dnssec_policy": policy})
+			if err != nil {
+				return err
+			}
+			if err := report(resp); err != nil || !resp.Applied {
+				return err
+			}
+			if !flagQuiet {
+				fmt.Printf("\nnamed is signing %s now. Add the DS record at your registrar only when\n'jarl zone dnssec status %s' says the zone is ready.\n", strings.TrimSuffix(args[0], "."), args[0]+viewFlag(view))
+			}
+			return nil
+		},
+	}
+	enable.Flags().StringVar(&view, "view", "", "view of the zone")
+	enable.Flags().StringVar(&policy, "policy", "default", "dnssec-policy: default, or a custom policy defined as a top-level dnssec-policy statement")
+
+	var yes bool
+	disable := &cobra.Command{
+		Use:   "disable ZONE",
+		Short: "Turn signing off, one safe step at a time",
+		Long: `Turns signing off in two steps, so the zone never goes unsigned while the
+parent zone still has its DS record:
+
+1. The first run switches the zone to BIND's insecure policy. named keeps it
+   signed and publishes a CDS "delete" record. Remove the DS record at your
+   registrar, then run 'jarl zone dnssec check-ds' so named knows. named
+   waits until resolvers have forgotten the DS (the parent's DS TTL, often a
+   day) and then removes the keys and signatures.
+2. Run it again when 'status' says turning off has finished: DNSSEC is then
+   switched off for the zone.
+
+A zone whose DS never reached the parent can be wiped at once instead
+('jarl zone dnssec wipe').`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			st, err := dnssecStatus(args[0], view)
+			if err != nil {
+				return err
+			}
+			var next string
+			switch {
+			case st.Policy == "":
+				fmt.Println("DNSSEC is already off for this zone.")
+				if st.Phase.Code == dnssec.PhaseLeftover {
+					fmt.Println("Old keys are still in its key directory; 'jarl zone dnssec wipe' removes them.")
+				}
+				return nil
+			case st.Policy != "insecure":
+				if !confirm(fmt.Sprintf("Start turning DNSSEC off for %s? named keeps it signed until you've removed the DS record from the parent zone.", displayName(st.Zone)), yes) {
+					return fmt.Errorf("canceled")
+				}
+				next = "insecure"
+			case !st.Phase.CanFinish:
+				fmt.Fprintf(os.Stderr, "%s\n", st.Phase.Summary)
+				if st.Phase.Next != "" {
+					fmt.Fprintf(os.Stderr, "%s\n", st.Phase.Next)
+				}
+				return &checkFailed{"turning DNSSEC off hasn't finished yet"}
+			}
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			path, qv := zonePath(args[0], view)
+			resp, err := c.Mutate(ctx(), "PATCH", path, qv, map[string]any{"dnssec_policy": next})
+			if err != nil {
+				return err
+			}
+			if err := report(resp); err != nil || !resp.Applied || flagQuiet {
+				return err
+			}
+			if next == "insecure" && st.ParentZone != "" {
+				fmt.Printf("\nNext: remove the DS record for %s from %s:\n  %s\nthen run\n  jarl zone dnssec check-ds %s\nRun 'jarl zone dnssec disable %s' again when 'status' says it has finished.\n", displayName(st.Zone), displayName(st.ParentZone), parentDSCommand(st, "delete", ""), args[0]+viewFlag(view), args[0]+viewFlag(view))
+			} else if next == "insecure" {
+				fmt.Printf("\nNext: remove the DS record for %s at your registrar, then run\n  jarl zone dnssec check-ds %s\nRun 'jarl zone dnssec disable %s' again when 'status' says it has finished.\n", displayName(st.Zone), args[0]+viewFlag(view), args[0]+viewFlag(view))
+			} else {
+				fmt.Println("\nDNSSEC is off. The old keys stay in the key directory until you wipe them ('jarl zone dnssec wipe').")
+			}
+			return nil
+		},
+	}
+	disable.Flags().StringVar(&view, "view", "", "view of the zone")
+	disable.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask for confirmation")
+
+	var resolver string
+	checkDS := &cobra.Command{
+		Use:   "check-ds ZONE",
+		Short: "Check the parent zone's DS records and tell named",
+		Long: `Asks every server of the parent zone for the zone's DS records, and tells
+named (rndc dnssec -checkds) when its key's DS has appeared there (after you
+added it at the registrar) or is gone (while turning DNSSEC off). named
+moves to the next step only once it knows.
+
+The parent is found through jarld's resolver, or --resolver. Exits with 2
+when the parent couldn't be checked.`,
+		Example: "  jarl zone dnssec check-ds adbraun.lol --view external",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			path, qv := zonePath(args[0], view)
+			if resolver != "" {
+				qv.Set("resolver", resolver)
+			}
+			var resp api.CheckDSResponse
+			if err := c.Do(ctx(), "POST", path+"/dnssec/check-ds", qv, nil, &resp); err != nil {
+				return err
+			}
+			err = output(resp, func(w io.Writer) {
+				p := resp.Parent
+				if p.Error != "" {
+					fmt.Fprintf(w, "error: %s\n", p.Error)
+				} else {
+					fmt.Fprintf(w, "Parent zone:\t%s (%d of %d servers answered, found through %s)\n", displayName(p.Parent), p.Reached, len(p.Servers), p.Resolver)
+					if !p.Delegated {
+						fmt.Fprintf(w, "Delegation:\tnone (the zone isn't delegated from %s)\n", displayName(p.Parent))
+					}
+					if len(p.DS) == 0 {
+						fmt.Fprintln(w, "DS records:\tnone")
+					}
+					for _, d := range p.DS {
+						fmt.Fprintf(w, "DS record:\tkey %d, algorithm %d, digest type %d\n", d.KeyTag, d.Algorithm, d.DigestType)
+					}
+				}
+				flush(w)
+				for _, m := range resp.Marked {
+					fmt.Printf("named told: %s\n", m)
+				}
+				for _, n := range resp.Notes {
+					fmt.Printf("note: %s\n", n)
+				}
+				if resp.Status != nil {
+					fmt.Printf("\n%s\n", resp.Status.Phase.Summary)
+					if resp.Status.Phase.Next != "" {
+						fmt.Println(resp.Status.Phase.Next)
+					}
+				}
+			})
+			if err != nil {
+				return err
+			}
+			if resp.Parent.Error != "" {
+				return &checkFailed{"the parent zone couldn't be checked"}
+			}
+			return nil
+		},
+	}
+	checkDS.Flags().StringVar(&view, "view", "", "view of the zone")
+	checkDS.Flags().StringVar(&resolver, "resolver", "", "resolver to find the parent zone with, e.g. 9.9.9.9 (default: the server's)")
+
+	var force bool
+	wipe := &cobra.Command{
+		Use:   "wipe ZONE",
+		Short: "Switch signing off at once and delete the zone's keys (a clean slate)",
+		Long: `Switches DNSSEC off for the zone at once (skipping the insecure policy) and
+deletes its keys and named's signed copy, so that signing it again starts
+from scratch. Also cleans up a zone that is off but still has old keys.
+
+This is only safe when the parent zone has no DS record for the zone: Jarl
+checks the parent first and refuses while it has one. When the parent can't
+be checked (a zone that isn't on the internet, or no internet access),
+--force wipes anyway. Needs an administrator.`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if !confirm(fmt.Sprintf("Switch DNSSEC off for %s and delete its keys? Make sure the parent zone has no DS record for it.", strings.TrimSuffix(args[0], ".")), yes) {
+				return fmt.Errorf("canceled")
+			}
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			path, qv := zonePath(args[0], view)
+			if resolver != "" {
+				qv.Set("resolver", resolver)
+			}
+			if flagDryRun {
+				qv.Set("dry_run", "1")
+			}
+			var resp api.DNSSECWipeResponse
+			if err := c.Do(ctx(), "POST", path+"/dnssec/wipe", qv, api.DNSSECWipe{Force: force, DryRun: flagDryRun}, &resp); err != nil {
+				return err
+			}
+			return output(resp, func(w io.Writer) {
+				verb := "removed"
+				if resp.DryRun {
+					verb = "would remove"
+				}
+				for _, f := range resp.Removed {
+					fmt.Printf("%s %s\n", verb, f)
+				}
+				if resp.DryRun {
+					fmt.Println("dry run: nothing was changed")
+				} else {
+					fmt.Println("DNSSEC is off and the zone's keys are gone.")
+				}
+			})
+		},
+	}
+	wipe.Flags().StringVar(&view, "view", "", "view of the zone")
+	wipe.Flags().BoolVar(&force, "force", false, "wipe although the parent zone couldn't be checked")
+	wipe.Flags().StringVar(&resolver, "resolver", "", "resolver to find the parent zone with (default: the server's)")
+	wipe.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask for confirmation")
+
+	cmd.AddCommand(status, enable, disable, checkDS, wipe)
+	return cmd
+}
+
+func viewFlag(view string) string {
+	if view == "" {
+		return ""
+	}
+	return " --view " + view
+}
+
+func dnssecStatus(zone, view string) (*api.DNSSECResponse, error) {
+	c, err := newClient()
+	if err != nil {
+		return nil, err
+	}
+	path, qv := zonePath(zone, view)
+	var resp api.DNSSECResponse
+	if err := c.Get(ctx(), path+"/dnssec", qv, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func printDNSSEC(w io.Writer, r *api.DNSSECResponse) {
+	head := displayName(r.Zone)
+	if r.View != "" {
+		head += " [view " + r.View + "]"
+	}
+	fmt.Fprintf(w, "Zone:\t%s\n", head)
+	policy := r.Policy
+	switch policy {
+	case "":
+		policy = "none (not signed)"
+	case "insecure":
+		policy = "insecure (turning DNSSEC off)"
+	}
+	fmt.Fprintf(w, "Policy:\t%s\n", policy)
+	fmt.Fprintf(w, "Status:\t%s\n", r.Phase.Summary)
+	if r.Phase.Next != "" {
+		fmt.Fprintf(w, "Next:\t%s\n", r.Phase.Next)
+	}
+	if r.Named != nil && r.Named.Secure {
+		fmt.Fprintf(w, "named:\tsigned serial %d (zone file %d)", r.Named.SignedSerial, r.Named.Serial)
+		if r.Named.NextKeyEvent != "" {
+			fmt.Fprintf(w, ", next key event %s", r.Named.NextKeyEvent)
+		}
+		fmt.Fprintln(w)
+	}
+	if r.NamedError != "" {
+		fmt.Fprintf(w, "named:\t%s\n", r.NamedError)
+	}
+	if r.Policy != "" || len(r.Keys) > 0 {
+		fmt.Fprintf(w, "Key directory:\t%s\n", r.KeyDir)
+	}
+	if r.KeyError != "" {
+		fmt.Fprintf(w, "Keys:\tcan't be read: %s\n", r.KeyError)
+	}
+	flush(w)
+	if len(r.Keys) > 0 {
+		fmt.Fprintln(w, "\nKEY\tROLE\tALGORITHM\tGOAL\tDNSKEY\tDS AT PARENT\tCREATED")
+		for _, k := range r.Keys {
+			created := "-"
+			if k.Created != nil {
+				created = k.Created.Local().Format("2006-01-02 15:04")
+			}
+			fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%s\t%s\n", k.Tag, k.Role, k.AlgorithmName, dash(k.Goal), dash(k.DNSKEYState), dash(k.DSState), created)
+		}
+		flush(w)
+	}
+	var ds []*dnssec.Key
+	for _, k := range r.Keys {
+		if k.DS != nil && k.Goal == dnssec.Omnipresent {
+			ds = append(ds, k)
+		}
+	}
+	if len(ds) > 0 && r.Policy != "insecure" {
+		where := "at your registrar"
+		if r.ParentZone != "" {
+			where = "in the parent zone " + displayName(r.ParentZone) + ", which is in Jarl: add it as a DS record there"
+		}
+		fmt.Fprintf(w, "\nDS record for the parent zone (%s):\n", where)
+		if !r.Phase.CanPublishDS && r.Phase.DSReadyAt != nil {
+			fmt.Fprintf(w, "  (not yet: wait until %s)\n", r.Phase.DSReadyAt.Local().Format(time.RFC1123))
+		}
+		for _, k := range ds {
+			fmt.Fprintf(w, "  %s\n", strings.ReplaceAll(k.DS.Record, "\t", " "))
+			fmt.Fprintf(w, "  key tag %d, algorithm %d (%s), digest type %d (SHA-256), digest %s\n", k.DS.KeyTag, k.DS.Algorithm, k.AlgorithmName, k.DS.DigestType, k.DS.Digest)
+			if r.ParentZone != "" {
+				data := fmt.Sprintf("%d %d %d %s", k.DS.KeyTag, k.DS.Algorithm, k.DS.DigestType, k.DS.Digest)
+				if slices.ContainsFunc(r.ParentDS, func(d string) bool { return strings.EqualFold(d, data) }) {
+					fmt.Fprintf(w, "  %s has it.\n", displayName(r.ParentZone))
+				} else {
+					fmt.Fprintf(w, "  %s\n", parentDSCommand(r, "add", data))
+				}
+			}
+		}
+	}
+}
+
+// parentDSCommand is the jarl command that adds (or deletes) the zone's DS
+// record in its parent zone in Jarl.
+func parentDSCommand(r *api.DNSSECResponse, verb, data string) string {
+	parts := []string{"jarl record", verb, displayName(r.ParentZone), strings.TrimSuffix(r.Zone, "."+r.ParentZone), "DS"}
+	if data != "" {
+		parts = append(parts, data)
+	}
+	if r.ParentView != "" {
+		parts = append(parts, "--view", r.ParentView)
+	}
+	return strings.Join(parts, " ")
+}
+
+func dash(s string) string {
+	if s == "" {
+		return "-"
+	}
+	return s
+}

cmd/jarl/envchangeset.go

@@ -0,0 +1,98 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+
+	"jarl/internal/api"
+	"jarl/internal/client"
+	"jarl/internal/model"
+)
+
+// A changeset given with --changeset is used as given (jarld still refuses
+// what isn't allowed). One taken from JARL_CHANGESET is checked first: an
+// exported ID outlives the changeset (it gets applied), and changeset IDs
+// keep growing, so a stale or mistyped one can name someone else's
+// changeset later. It is used only when it is open and the caller's own,
+// and the CLI says on stderr which changeset that is.
+
+// envChangeset returns the changeset in JARL_CHANGESET (0 if unset).
+func envChangeset() (int64, error) {
+	v := os.Getenv("JARL_CHANGESET")
+	if v == "" {
+		return 0, nil
+	}
+	n, err := strconv.ParseInt(v, 10, 64)
+	if err != nil || n <= 0 {
+		return 0, fmt.Errorf("invalid JARL_CHANGESET %q", v)
+	}
+	return n, nil
+}
+
+// checkEnvChangeset checks the changeset id from JARL_CHANGESET before it
+// is used. With mustOwn, it must also be open and the caller's own (for
+// staging into it, applying or discarding it).
+func checkEnvChangeset(c *client.Client, id int64, mustOwn bool) (*api.Changeset, error) {
+	var cs api.Changeset
+	if err := c.Get(ctx(), fmt.Sprintf("/changesets/%d", id), nil, &cs); err != nil {
+		var ce *client.Error
+		if errors.As(err, &ce) && ce.Status == 404 {
+			return nil, fmt.Errorf("JARL_CHANGESET is %d, but there is no changeset %d: start one with 'export JARL_CHANGESET=$(jarl changeset create -q)', or 'unset JARL_CHANGESET' to make changes live", id, id)
+		}
+		return nil, err
+	}
+	if mustOwn {
+		if cs.Status != model.ChangesetOpen {
+			return nil, fmt.Errorf("JARL_CHANGESET is %d, but changeset %d is %s: 'unset JARL_CHANGESET' to make changes live, or start a new one with 'export JARL_CHANGESET=$(jarl changeset create -q)'", id, id, cs.Status)
+		}
+		var me api.Whoami
+		if err := c.Get(ctx(), "/auth/whoami", nil, &me); err != nil {
+			return nil, err
+		}
+		mine := cs.UserID == me.User.ID && (me.User.ID != 0 || cs.Username == me.User.Username)
+		if !mine {
+			return nil, fmt.Errorf("JARL_CHANGESET is %d, but changeset %d is %s's (made via %s), not yours, so it isn't used from JARL_CHANGESET; give it as -C %d to use it anyway, or 'unset JARL_CHANGESET'", id, id, cs.Username, cs.Via, id)
+		}
+	}
+	if !flagQuiet {
+		desc := cs.Description
+		if desc == "" {
+			desc = "no description"
+		}
+		fmt.Fprintf(os.Stderr, "changeset %d (%s, %d operations) from JARL_CHANGESET\n", id, desc, len(cs.Ops))
+	}
+	return &cs, nil
+}
+
+// changesetArg returns the changeset a changeset subcommand works on: the
+// ID argument, else --changeset, else JARL_CHANGESET (checked; mustOwn as
+// for checkEnvChangeset). fromEnv says it came from JARL_CHANGESET.
+func changesetArg(c *client.Client, args []string, mustOwn bool) (id string, fromEnv bool, err error) {
+	if len(args) > 0 {
+		return args[0], false, nil
+	}
+	if flagChangeset > 0 {
+		return strconv.FormatInt(flagChangeset, 10), false, nil
+	}
+	n, err := envChangeset()
+	if err != nil {
+		return "", false, err
+	}
+	if n == 0 {
+		return "", false, errors.New("which changeset? Give its ID, or set JARL_CHANGESET (export JARL_CHANGESET=$(jarl changeset create -q))")
+	}
+	if _, err := checkEnvChangeset(c, n, mustOwn); err != nil {
+		return "", false, err
+	}
+	return strconv.FormatInt(n, 10), true, nil
+}
+
+// envChangesetDone reminds that JARL_CHANGESET still names a changeset
+// that was just applied or discarded: later changes would fail to stage.
+func envChangesetDone(id, what string) {
+	if !flagQuiet {
+		fmt.Fprintf(os.Stderr, "JARL_CHANGESET still names changeset %s, which is now %s: run 'unset JARL_CHANGESET' (or export a new one) before making more changes\n", id, what)
+	}
+}

cmd/jarl/exposure.go

@@ -0,0 +1,191 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+type exposureFinding struct {
+	Severity string `json:"severity"`
+	Code     string `json:"code"`
+	Message  string `json:"message"`
+	View     string `json:"view"`
+	Fix      string `json:"fix"`
+}
+
+type exposureReport struct {
+	Scopes []struct {
+		ViewID    int64             `json:"view_id"`
+		View      string            `json:"view"`
+		Public    bool              `json:"public"`
+		Override  string            `json:"override"`
+		Reason    string            `json:"reason"`
+		RateLimit string            `json:"rate_limit"`
+		Findings  []exposureFinding `json:"findings"`
+	} `json:"scopes"`
+	Server       []exposureFinding `json:"server"`
+	RateLimiting *struct {
+		Since  string `json:"since"`
+		Counts []struct {
+			Key   string
+			Count int64
+		} `json:"counts"`
+		Networks []struct {
+			Key   string
+			Count int64
+		} `json:"networks"`
+		Names []struct {
+			Key   string
+			Count int64
+		} `json:"names"`
+	} `json:"rate_limiting"`
+}
+
+// exposureScope turns "server" (or "") into the server, anything else
+// into a view name.
+func exposureScope(s string) map[string]any {
+	if s == "" || strings.EqualFold(s, "server") {
+		return map[string]any{}
+	}
+	return map[string]any{"view": s}
+}
+
+func exposureCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "exposure",
+		Short: "What is reachable from the internet, and what to harden (docs/exposure.md)",
+		Long: `Shows which views (or the server, without views) are reachable from the
+internet and why, their rate limiting, and the exposure findings with the
+fix Jarl can stage for each.`,
+		Example: `  jarl exposure
+  jarl exposure fix external exposure_rate_limit          # rate limiting, log-only first
+  jarl exposure fix external exposure_rate_limit_log_only # then start enforcing
+  jarl exposure fix server exposure_version
+  jarl exposure ack external security_open_resolver --reason "public resolver for the club"
+  jarl view update external --exposure public             # override the classification`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r exposureReport
+			if err := c.Get(ctx(), "/exposure", nil, &r); err != nil {
+				return err
+			}
+			return output(r, func(w io.Writer) {
+				fmt.Fprintln(w, "VIEW\tEXPOSURE\tRATE LIMIT\tWHY")
+				for _, s := range r.Scopes {
+					name, exp := s.View, "private"
+					if name == "" {
+						name = "(server)"
+					}
+					if s.Public {
+						exp = "public"
+					}
+					if s.Override != "" {
+						exp += " (set)"
+					}
+					rl := s.RateLimit
+					if !s.Public && rl == "off" {
+						rl = "-"
+					}
+					fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", name, exp, rl, s.Reason)
+				}
+				var all []exposureFinding
+				for _, s := range r.Scopes {
+					all = append(all, s.Findings...)
+				}
+				all = append(all, r.Server...)
+				fmt.Fprintln(w)
+				if len(all) == 0 {
+					fmt.Fprintln(w, "No findings.")
+				} else {
+					fmt.Fprintln(w, "SEVERITY\tWHERE\tCODE\tFINDING")
+					for _, f := range all {
+						where := f.View
+						if where == "" {
+							where = "server"
+						}
+						fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", f.Severity, where, f.Code, f.Message)
+						if f.Fix != "" {
+							fmt.Fprintf(w, "\t\t\tfix: jarl exposure fix %s %s (%s)\n", where, f.Code, f.Fix)
+						}
+					}
+				}
+				if a := r.RateLimiting; a != nil && len(a.Counts) > 0 {
+					fmt.Fprintf(w, "\nRATE LIMITING, LAST %s\n", a.Since)
+					for _, e := range a.Counts {
+						fmt.Fprintf(w, "%s\t%d\n", e.Key, e.Count)
+					}
+					for _, e := range a.Networks {
+						fmt.Fprintf(w, "network %s\t%d\n", e.Key, e.Count)
+					}
+					for _, e := range a.Names {
+						fmt.Fprintf(w, "name %s\t%d\n", e.Key, e.Count)
+					}
+				}
+			})
+		},
+	}
+	fix := &cobra.Command{
+		Use:   "fix VIEW|server CODE",
+		Short: "Stage (or apply) the fix Jarl suggests for a finding",
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := exposureScope(args[0])
+			body["code"] = args[1]
+			resp, err := c.Mutate(ctx(), "POST", "/exposure/fix", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	var reason string
+	ack := &cobra.Command{
+		Use:   "ack VIEW|server CODE --reason TEXT",
+		Short: "Accept a finding on purpose: it stays, as info, with who and why",
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := exposureScope(args[0])
+			body["code"], body["reason"] = args[1], reason
+			resp, err := c.Mutate(ctx(), "POST", "/exposure/ack", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	ack.Flags().StringVar(&reason, "reason", "", "why the finding is accepted (required)")
+	unack := &cobra.Command{
+		Use:   "unack VIEW|server CODE",
+		Short: "Take an acknowledgement back: the finding warns again",
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			body := exposureScope(args[0])
+			body["code"] = args[1]
+			resp, err := c.Mutate(ctx(), "POST", "/exposure/unack", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.AddCommand(fix, ack, unack)
+	return cmd
+}

cmd/jarl/main.go

@@ -3,6 +3,7 @@
 package main
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -11,7 +12,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	"strconv"
+	"slices"
 	"strings"
 	"sync"
 	"text/tabwriter"
@@ -46,6 +47,7 @@ var (
 	flagChangeset int64
 	flagDryRun    bool
 	flagForce     bool
+	flagRisk      bool
 	flagOutput    string
 	flagInsecure  bool
 	flagCACert    string
@@ -147,15 +149,21 @@ func newClient() (*client.Client, error) {
 	}
 	c.Changeset = flagChangeset
 	if c.Changeset == 0 {
-		if v := os.Getenv("JARL_CHANGESET"); v != "" {
-			n, err := strconv.ParseInt(v, 10, 64)
-			if err != nil {
-				return nil, fmt.Errorf("invalid JARL_CHANGESET %q", v)
-			}
+		n, err := envChangeset()
+		if err != nil {
+			return nil, err
+		}
+		if n > 0 {
+			// Checked when a change is first staged into it
+			// (envchangeset.go).
 			c.Changeset = n
+			c.CheckChangeset = func(context.Context) error {
+				_, err := checkEnvChangeset(c, n, true)
+				return err
+			}
 		}
 	}
-	c.DryRun, c.Force = flagDryRun || c.Preflight, flagForce
+	c.DryRun, c.Force, c.AcceptRisk = flagDryRun || c.Preflight, flagForce, flagRisk
 	if !c.Preflight {
 		c.OnTokenExpiry = tokenExpiryWarning(t.Name)
 	}
@@ -225,7 +233,7 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 5 conflict, 6 invalid or rejected by validation, 7 server or BIND error.`,
 		SilenceUsage:  true,
 		SilenceErrors: true,
-		Version:       version.Version,
+		Version:       version.String(),
 		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
 			return checkFanOut(cmd)
 		},
@@ -237,10 +245,11 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 	pf.Int64VarP(&flagChangeset, "changeset", "C", 0, "stage changes into this changeset instead of applying them (env JARL_CHANGESET)")
 	pf.BoolVarP(&flagDryRun, "dry-run", "n", false, "validate and show the changes without applying them")
 	pf.BoolVar(&flagForce, "force", false, "overwrite BIND files that were changed outside Jarl")
-	pf.StringVarP(&flagOutput, "output", "o", "table", "output format: table, json or yaml")
+	pf.BoolVar(&flagRisk, "accept-risk", false, "confirm a change that opens a public view up, such as an open resolver (docs/exposure.md)")
+	pf.StringVarP(&flagOutput, "output", "o", "table", "output format: table, json, yaml, id (just the IDs) or field=NAME[,NAME...] (just those fields, e.g. field=view or field=soa.serial)")
 	pf.BoolVar(&flagInsecure, "insecure", false, "don't verify the server's TLS certificate")
 	pf.StringVar(&flagCACert, "ca-cert", "", "PEM file with a CA to trust for the server's certificate")
-	pf.BoolVarP(&flagQuiet, "quiet", "q", false, "only print errors (and IDs where useful)")
+	pf.BoolVarP(&flagQuiet, "quiet", "q", false, "only print errors and IDs (with show and list: just the IDs, like -o id)")
 	root.AddGroup(&cobra.Group{ID: "dns", Title: "DNS commands:"}, &cobra.Group{ID: "changes", Title: "Changes:"}, &cobra.Group{ID: "admin", Title: "Administration:"})
 	add := func(group string, cmds ...*cobra.Command) {
 		for _, c := range cmds {
@@ -248,9 +257,9 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 			root.AddCommand(c)
 		}
 	}
-	add("dns", zoneCmd(), recordCmd(), viewCmd(), aclCmd(), tsigCmd(), optionCmd(), settingsCmd(), acmeCmd(), searchCmd(), statsCmd())
+	add("dns", zoneCmd(), recordCmd(), viewCmd(), aclCmd(), tsigCmd(), optionCmd(), settingsCmd(), blockCmd(), blocklistCmd(), acmeCmd(), searchCmd(), statsCmd())
 	add("changes", applyCmd(), changesetCmd(), historyCmd())
-	add("admin", statusCmd(), whoamiCmd(), userCmd(), tokenCmd(), auditCmd(), checkCmd(), resyncCmd(), configCmd())
+	add("admin", statusCmd(), exposureCmd(), certCmd(), whoamiCmd(), userCmd(), tokenCmd(), auditCmd(), checkCmd(), resyncCmd(), configCmd())
 	setupCompletion(root)
 	return root
 }
@@ -262,7 +271,15 @@ func ctx() context.Context { return context.Background() }
 // ---- output
 
 func output(v any, table func(w io.Writer)) error {
-	switch flagOutput {
+	format := flagOutput
+	quietIDs := flagQuiet && (format == "table" || format == "")
+	if quietIDs {
+		format = "id"
+	}
+	if fieldFormat(format) {
+		return outputFields(v, format, quietIDs)
+	}
+	switch format {
 	case "json":
 		enc := json.NewEncoder(os.Stdout)
 		enc.SetIndent("", "  ")
@@ -286,7 +303,79 @@ func output(v any, table func(w io.Writer)) error {
 		table(tw)
 		return tw.Flush()
 	}
-	return fmt.Errorf("unknown output format %q (use table, json or yaml)", flagOutput)
+	return fmt.Errorf("unknown output format %q (use table, json, yaml, id or field=NAME)", flagOutput)
+}
+
+// outputFields prints fields of each object (or of the one object), one
+// line per object with the fields separated by tabs, for scripts:
+// "id" prints the IDs, "field=view,soa.serial" those fields. Names are the
+// JSON field names (see -o json); a dot reaches into nested objects. A
+// field an object doesn't have prints as empty (the API leaves out empty
+// fields).
+func outputFields(v any, format string, quiet bool) error {
+	fields := []string{"id"}
+	if f, ok := strings.CutPrefix(format, "field="); ok {
+		fields = strings.Split(f, ",")
+	}
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+	dec := json.NewDecoder(bytes.NewReader(b))
+	dec.UseNumber()
+	var x any
+	if err := dec.Decode(&x); err != nil {
+		return err
+	}
+	items, ok := x.([]any)
+	if !ok {
+		items = []any{x}
+	}
+	if quiet && !slices.ContainsFunc(items, func(it any) bool { _, ok := lookupField(it, "id"); return ok }) {
+		return nil // -q on something without IDs: only errors
+	}
+	var out strings.Builder
+	for _, it := range items {
+		var vals []string
+		for _, f := range fields {
+			val, _ := lookupField(it, strings.TrimSpace(f))
+			vals = append(vals, fieldText(val))
+		}
+		out.WriteString(strings.Join(vals, "\t") + "\n")
+	}
+	_, err = io.WriteString(os.Stdout, out.String())
+	return err
+}
+
+// fieldFormat reports whether an -o format prints fields (id, field=...).
+func fieldFormat(format string) bool {
+	return format == "id" || strings.HasPrefix(format, "field=")
+}
+
+func lookupField(v any, path string) (any, bool) {
+	for _, part := range strings.Split(path, ".") {
+		m, ok := v.(map[string]any)
+		if !ok {
+			return nil, false
+		}
+		if v, ok = m[part]; !ok {
+			return nil, false
+		}
+	}
+	return v, true
+}
+
+func fieldText(v any) string {
+	switch x := v.(type) {
+	case nil:
+		return ""
+	case string:
+		return x
+	case json.Number, bool:
+		return fmt.Sprint(x)
+	}
+	b, _ := json.Marshal(v)
+	return string(b)
 }
 
 func dot(name string) string {
@@ -391,6 +480,14 @@ func report(resp *api.MutationResponse) error {
 	if flagOutput == "json" || flagOutput == "yaml" {
 		return output(resp, nil)
 	}
+	if fieldFormat(flagOutput) {
+		// The changed object, if the response has it ("jarl record add
+		// ... -o id" prints the new record's ID).
+		if len(resp.Object) > 0 {
+			return outputFields(resp.Object, flagOutput, false)
+		}
+		return outputFields(resp, flagOutput, false)
+	}
 	w := os.Stdout
 	r := client.ParseResult(resp.Result)
 	switch {
@@ -440,6 +537,18 @@ func report(resp *api.MutationResponse) error {
 		json.Unmarshal(resp.Problems, &introduced)
 	}
 	printProblems(os.Stderr, introduced)
+	// named-checkconf's own warnings about the new configuration.
+	if r != nil && (resp.Applied || resp.DryRun) {
+		for _, m := range r.Check {
+			if !m.Error && !strings.HasPrefix(m.Text, "loaded serial") && m.Text != "OK" {
+				where := ""
+				if m.Object != "" {
+					where = " (" + m.Object + ")"
+				}
+				fmt.Fprintf(os.Stderr, "warning: named-checkconf: %s%s\n", m.Text, where)
+			}
+		}
+	}
 	for _, warn := range resp.Warnings {
 		fmt.Fprintln(os.Stderr, "warning:", warn)
 	}

cmd/jarl/main_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -22,6 +23,8 @@ changes:
   - set:    {zone: example.com, name: api, type: A, data: 192.0.2.5}
   - set:    {zone: example.com, name: gone, type: TXT}
   - update: {id: 13, data: 192.0.2.9}
+  - disable: {zone: example.com, name: www, type: A, data: 192.0.2.1, ptr: true}
+  - enable: {id: 14}
   - op: zone.create
     data: {name: lab.example.com}
 `
@@ -44,6 +47,8 @@ changes:
 		{"rrset.replace", 0, `{"data":["192.0.2.5"],"name":"api","type":"A","zone":"example.com"}`},
 		{"rrset.replace", 0, `{"data":[],"name":"gone","type":"TXT","zone":"example.com"}`},
 		{"record.update", 13, `{"data":"192.0.2.9"}`},
+		{"record.disable", 0, `{"data":"192.0.2.1","name":"www","ptr":true,"type":"A","zone":"example.com"}`},
+		{"record.enable", 14, `{}`},
 		{"zone.create", 0, `{"name":"lab.example.com"}`},
 	}
 	if len(reqs) != len(want) {
@@ -112,6 +117,38 @@ func TestListValue(t *testing.T) {
 // filters they send: flags bound to variables shared between subcommands
 // must not leak defaults (zone create's --type primary once hid every
 // non-primary zone from 'zone list').
+func TestDisableCommands(t *testing.T) {
+	var got string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got = r.Method + " " + r.URL.Path + "?" + r.URL.RawQuery
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"applied":true,"changeset_id":1}`))
+	}))
+	defer srv.Close()
+	t.Setenv("JARL_CLI_CONFIG", filepath.Join(t.TempDir(), "cli.yaml"))
+	for _, tc := range []struct {
+		args []string
+		want string
+	}{
+		{[]string{"record", "disable", "example.com", "www", "A"}, "POST /api/v1/zones/example.com/records/disable?name=www&type=A"},
+		{[]string{"record", "disable", "example.com", "www", "A", "192.0.2.1", "--ptr", "--view", "internal"}, "POST /api/v1/zones/example.com/records/disable?data=192.0.2.1&name=www&ptr=1&type=A&view=internal"},
+		{[]string{"record", "enable", "--id", "12", "--ptr"}, "POST /api/v1/records/12/enable?ptr=1"},
+		{[]string{"record", "enable", "example.com", "old", "CNAME", "--missing-ok"}, "POST /api/v1/zones/example.com/records/enable?missing_ok=1&name=old&type=CNAME"},
+	} {
+		got = ""
+		root := rootCmd()
+		root.SetArgs(append(tc.args, "--server", srv.URL, "--token", "jarl_test_token", "-o", "json"))
+		root.SetOut(io.Discard)
+		if err := root.Execute(); err != nil {
+			t.Errorf("%v: %v", tc.args, err)
+			continue
+		}
+		if got != tc.want {
+			t.Errorf("%v sent %q, want %q", tc.args, got, tc.want)
+		}
+	}
+}
+
 func TestListQueries(t *testing.T) {
 	var got string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -154,3 +191,44 @@ func TestListQueries(t *testing.T) {
 		}
 	}
 }
+
+func TestOutputFields(t *testing.T) {
+	capture := func(f func() error) string {
+		t.Helper()
+		r, w, _ := os.Pipe()
+		old := os.Stdout
+		os.Stdout = w
+		err := f()
+		os.Stdout = old
+		w.Close()
+		b, _ := io.ReadAll(r)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return string(b)
+	}
+	zones := []map[string]any{
+		{"id": 12, "name": "adbraun.lol.", "view": "external", "soa": map[string]any{"serial": 2026100901}},
+		{"id": 3, "name": "lab.adbraun.lol.", "soa": map[string]any{"serial": 7}},
+	}
+	defer func(o string, q bool) { flagOutput, flagQuiet = o, q }(flagOutput, flagQuiet)
+	for _, tc := range []struct {
+		format string
+		quiet  bool
+		v      any
+		want   string
+	}{
+		{"id", false, zones, "12\n3\n"},
+		{"id", false, zones[0], "12\n"},
+		{"field=name,view,soa.serial", false, zones, "adbraun.lol.\texternal\t2026100901\nlab.adbraun.lol.\t\t7\n"},
+		{"field=soa", false, zones[1], "{\"serial\":7}\n"},
+		{"table", true, zones, "12\n3\n"},
+		{"table", true, map[string]any{"status": "ok"}, ""}, // -q without IDs: nothing
+	} {
+		flagOutput, flagQuiet = tc.format, tc.quiet
+		got := capture(func() error { return output(tc.v, func(io.Writer) { t.Error("table printed") }) })
+		if got != tc.want {
+			t.Errorf("-o %s (quiet %v) = %q, want %q", tc.format, tc.quiet, got, tc.want)
+		}
+	}
+}

cmd/jarl/multiview.go

@@ -0,0 +1,127 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"jarl/internal/api"
+	"jarl/internal/client"
+)
+
+// zoneViews expands a --view value for a record command: "" or one view
+// as it is, "a,b" to those views, and "all" to every view that has the
+// zone.
+// localFanOut is set by commands making local changes (--local), which
+// go to every view named even when the zones are linked.
+var localFanOut bool
+
+func zoneViews(c *client.Client, zone, view string) ([]string, error) {
+	if view != "all" && !strings.Contains(view, ",") {
+		return []string{view}, nil
+	}
+	var zones []api.Zone
+	if err := c.Get(ctx(), "/zones", nil, &zones); err != nil {
+		return nil, err
+	}
+	want := strings.ToLower(strings.TrimSuffix(zone, "."))
+	link := map[string]int64{}
+	var out []string
+	for _, z := range zones {
+		if strings.ToLower(strings.TrimSuffix(z.Display, ".")) == want && z.View != "" {
+			link[z.View] = z.LinkGroup
+			if view == "all" {
+				out = append(out, z.View)
+			}
+		}
+	}
+	if view != "all" {
+		for _, v := range strings.Split(view, ",") {
+			if v = strings.TrimSpace(v); v != "" {
+				out = append(out, v)
+			}
+		}
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("zone %s is in no view", zone)
+	}
+	// Linked zones (docs/views.md#linked-zones) get a shared change once:
+	// Jarl copies it to the others. A local change goes to each.
+	if localFanOut {
+		return out, nil
+	}
+	var dedup []string
+	first := map[int64]string{}
+	for _, v := range out {
+		g := link[v]
+		if g != 0 {
+			if f, ok := first[g]; ok {
+				if !flagQuiet {
+					fmt.Fprintf(os.Stderr, "view %s: linked with %s, so it gets the change from there\n", v, f)
+				}
+				continue
+			}
+			first[g] = v
+		}
+		dedup = append(dedup, v)
+	}
+	return dedup, nil
+}
+
+// perView runs a record command once per view. With several views, the
+// changes are staged into one changeset and applied together, so either
+// every view gets the change or none does (with --changeset, they are
+// staged there).
+//
+// do returns the server's response, or nil when there was nothing to do.
+func perView(c *client.Client, views []string, description string, do func(c *client.Client, view string) (*api.MutationResponse, error)) error {
+	if len(views) == 1 || c.Changeset > 0 {
+		for _, v := range views {
+			resp, err := do(c, v)
+			if err != nil {
+				if len(views) > 1 {
+					err = fmt.Errorf("view %s: %w", v, err)
+				}
+				return err
+			}
+			if resp != nil {
+				if err := report(resp); err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	}
+	var cs api.Changeset
+	if err := c.Do(ctx(), "POST", "/changesets", nil, map[string]any{"description": description + " (views " + strings.Join(views, ", ") + ")"}, &cs); err != nil {
+		return err
+	}
+	discard := func() { c.Do(ctx(), "POST", fmt.Sprintf("/changesets/%d/discard", cs.ID), nil, nil, nil) }
+	staging := *c
+	staging.Changeset, staging.DryRun = cs.ID, false
+	staged := 0
+	for _, v := range views {
+		resp, err := do(&staging, v)
+		if err != nil {
+			discard()
+			fmt.Fprintf(os.Stderr, "view %s failed, so nothing was changed in any view\n", v)
+			return err
+		}
+		if resp != nil {
+			staged++
+		}
+	}
+	if staged == 0 {
+		discard()
+		return nil
+	}
+	var resp api.MutationResponse
+	err := c.Do(ctx(), "POST", fmt.Sprintf("/changesets/%d/apply", cs.ID), nil, map[string]any{"force": c.Force, "dry_run": c.DryRun, "accept_risk": c.AcceptRisk}, &resp)
+	if err != nil || c.DryRun {
+		discard()
+	}
+	if err != nil {
+		return err
+	}
+	return report(&resp)
+}

cmd/jarl/registrar.go

@@ -0,0 +1,187 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"jarl/internal/api"
+)
+
+func zoneRegistrarCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "registrar",
+		Short: "The domain's name servers, glue and DS records at the registrar (Porkbun)",
+		Long: `Shows and changes a domain's delegation at the registrar Porkbun: its name
+servers, the glue records of name servers inside the domain, and its DNSSEC
+DS records. Needs a Porkbun API key in jarl.yaml (porkbun:, see
+docs/dnssec.md#porkbun) and an administrator.
+
+Every change checks first that it won't break the domain (for example that
+the new name servers serve the zone, or that the zone is signed with the
+key a DS record points at) and is refused otherwise; --dry-run shows those
+checks, --force skips them.`,
+	}
+	var view string
+	status := &cobra.Command{
+		Use:     "status ZONE",
+		Short:   "Compare the registrar's name servers, glue and DS records with the zone",
+		Example: "  jarl zone registrar status adbraun.lol --view external",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			path, qv := zonePath(args[0], view)
+			var resp api.RegistrarResponse
+			if err := c.Get(ctx(), path+"/registrar", qv, &resp); err != nil {
+				return err
+			}
+			err = output(resp, func(w io.Writer) {
+				if resp.Error != "" {
+					fmt.Fprintf(w, "error: %s\n", resp.Error)
+					return
+				}
+				fmt.Fprintf(w, "Domain:\t%s at %s\n", resp.Domain, resp.Registrar)
+				fmt.Fprintf(w, "Name servers:\t%s\n", strings.Join(resp.NS, ", "))
+				fmt.Fprintf(w, "Zone's NS records:\t%s\n", strings.Join(resp.JarlNS, ", "))
+				flush(w)
+				if len(resp.Glue) > 0 {
+					fmt.Fprintln(w, "\nGLUE FOR\tAT REGISTRAR\tIN THE ZONE\tTO DO")
+					for _, g := range resp.Glue {
+						todo := g.Action
+						if todo == "" {
+							todo = "-"
+							if !g.Needed && !g.InUse {
+								todo = "unused"
+							}
+						}
+						fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", g.Host, firstNonEmpty(strings.Join(g.Registry, ", "), "none"), firstNonEmpty(strings.Join(g.Jarl, ", "), "-"), todo)
+					}
+					flush(w)
+				}
+				if len(resp.DS) > 0 {
+					fmt.Fprintln(w, "\nDS KEY TAG\tALGORITHM\tDIGEST TYPE\tMATCHES THE ZONE")
+					for _, d := range resp.DS {
+						fmt.Fprintf(w, "%d\t%d\t%d\t%v\n", d.KeyTag, d.Algorithm, d.DigestType, d.Matches)
+					}
+					flush(w)
+				}
+				fmt.Println()
+				for _, f := range resp.Findings {
+					fmt.Printf("%-8s %s\n", f.Level+":", f.Message)
+				}
+			})
+			if err != nil {
+				return err
+			}
+			if resp.Error != "" {
+				return &checkFailed{"the registrar couldn't be asked"}
+			}
+			for _, f := range resp.Findings {
+				if f.Level == "error" {
+					return &checkFailed{"the registrar's records don't match the zone"}
+				}
+			}
+			return nil
+		},
+	}
+	status.Flags().StringVar(&view, "view", "", "view of the zone")
+
+	var force bool
+	change := func(use, short, long, method, sub string, args cobra.PositionalArgs, body func(args []string) (string, any, error)) *cobra.Command {
+		c := &cobra.Command{
+			Use:   use,
+			Short: short,
+			Long:  long,
+			Args:  args,
+			RunE: func(cmd *cobra.Command, args []string) error {
+				cl, err := newClient()
+				if err != nil {
+					return err
+				}
+				path, qv := zonePath(args[0], view)
+				if flagDryRun {
+					qv.Set("dry_run", "1")
+				}
+				extra, b, err := body(args)
+				if err != nil {
+					return err
+				}
+				var resp api.RegistrarChangeResponse
+				if err := cl.Do(ctx(), method, path+"/registrar/"+sub+extra, qv, b, &resp); err != nil {
+					return err
+				}
+				return output(resp, func(w io.Writer) {
+					for _, f := range resp.Checks {
+						fmt.Printf("%-8s %s\n", f.Level+":", f.Message)
+					}
+					verb := "done:"
+					if resp.DryRun {
+						verb = "would:"
+					}
+					for _, d := range resp.Done {
+						fmt.Printf("%-8s %s\n", verb, d)
+					}
+					if len(resp.Done) == 0 {
+						fmt.Println("nothing to change")
+					}
+					for _, wn := range resp.Warnings {
+						fmt.Printf("note:    %s\n", wn)
+					}
+					if resp.DryRun {
+						fmt.Println("dry run: nothing was changed")
+					}
+				})
+			},
+		}
+		c.Flags().StringVar(&view, "view", "", "view of the zone")
+		c.Flags().BoolVar(&force, "force", false, "skip the checks that the change won't break the domain")
+		return c
+	}
+	syncGlue := change("sync-glue ZONE", "Create or update glue records for the zone's name servers inside the domain",
+		`Gives every name server in the zone's NS records that is inside the domain
+(ns1.adbraun.lol for adbraun.lol) a glue record at the registrar with the
+zone's A and AAAA records for it: one glue record per name server, each with
+all its addresses. Resolvers need glue to find such a server at all.
+
+Changing the glue of a name server the domain is delegated to sends
+resolvers to the new addresses, so they must answer for the zone first.`,
+		"POST", "glue", cobra.ExactArgs(1), func([]string) (string, any, error) {
+			return "", api.RegistrarChange{Force: force, DryRun: flagDryRun}, nil
+		})
+	var key uint16
+	publishDS := change("publish-ds ZONE", "Publish the zone's DS record at the registrar (turns DNSSEC validation on)",
+		`Adds the DS record of the zone's key at the registrar, which publishes it in
+the parent zone: from then on validating resolvers check the zone's
+signatures. Refused until named says the zone is ready, and unless the
+domain is delegated to name servers that serve the signed zone.
+
+Afterwards run 'jarl zone dnssec check-ds ZONE' once the parent zone has it.`,
+		"POST", "ds", cobra.ExactArgs(1), func([]string) (string, any, error) {
+			return "", api.RegistrarChange{KeyTag: key, Force: force, DryRun: flagDryRun}, nil
+		})
+	publishDS.Flags().Uint16Var(&key, "key", 0, "key tag (default: every key that needs a DS)")
+	removeDS := change("remove-ds ZONE KEYTAG", "Remove a DS record at the registrar",
+		`Removes a DS record at the registrar. Without the zone's DS record, resolvers
+stop validating it (it stays signed). This is the step 'jarl zone dnssec
+disable' asks for; a DS record that matches none of the zone's keys breaks
+the domain and should go at once.`,
+		"DELETE", "ds/", cobra.ExactArgs(2), func(args []string) (string, any, error) {
+			return args[1], nil, nil
+		})
+	setNS := change("set-ns ZONE [NAMESERVER...]", "Delegate the domain to the zone's name servers (or the ones given)",
+		`Sets the domain's name servers at the registrar: by default to the zone's NS
+records. Checked first: each name server answers for the zone with the
+current serial, name servers inside the domain have glue records that match
+the zone (run sync-glue before), and DS records at the registrar match the
+zone's keys (otherwise the domain goes dark for validating resolvers).`,
+		"PUT", "ns", cobra.MinimumNArgs(1), func(args []string) (string, any, error) {
+			return "", api.RegistrarChange{NS: args[1:], Force: force, DryRun: flagDryRun}, nil
+		})
+	cmd.AddCommand(status, syncGlue, publishDS, removeDS, setNS)
+	return cmd
+}

cmd/jarl/stats.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"math"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -91,6 +92,9 @@ export the data.`,
 				if s.NXDomainRatio != nil {
 					fmt.Fprintf(w, "NXDOMAIN:\t%.1f%% of queries\n", *s.NXDomainRatio*100)
 				}
+				if s.BlockedRatio != nil {
+					fmt.Fprintf(w, "Blocked:\t%d (%.1f%% of queries): %s\n", s.Blocked, *s.BlockedRatio*100, entryLine(s.Blocklists, s.Blocked, 6))
+				}
 				fmt.Fprintf(w, "Result codes:\t%s\n", entryLine(s.RCodes, s.Queries, 6))
 				fmt.Fprintf(w, "Record types:\t%s\n", entryLine(s.QTypes, s.Queries, 8))
 				if len(s.Answers) > 0 {
@@ -102,14 +106,18 @@ export the data.`,
 				if len(s.Zones) > 0 {
 					fmt.Fprintf(w, "Zones:\t%s\n", strings.ReplaceAll(entryLine(s.Zones, 0, 10), stats.OtherZone+" ", "other "))
 				}
-				for _, k := range []string{stats.KindName, stats.KindClient, stats.KindNXDomain} {
+				for _, k := range []string{stats.KindName, stats.KindClient, stats.KindNXDomain, stats.KindBlocked} {
 					es := s.Tops[k]
 					if len(es) == 0 {
 						continue
 					}
-					fmt.Fprintf(w, "\n%s\t\n", map[string]string{stats.KindName: "Top names", stats.KindClient: "Top clients", stats.KindNXDomain: "Top NXDOMAIN names"}[k])
+					fmt.Fprintf(w, "\n%s\t\n", map[string]string{stats.KindName: "Top names", stats.KindClient: "Top clients", stats.KindNXDomain: "Top NXDOMAIN names", stats.KindBlocked: "Top blocked names"}[k])
 					for _, e := range es {
-						fmt.Fprintf(w, "  %s\t%d\n", e.Key, e.Count)
+						key := e.Key
+						if e.Name != "" {
+							key += " (" + e.Name + ")"
+						}
+						fmt.Fprintf(w, "  %s\t%d\n", key, e.Count)
 					}
 				}
 			})
@@ -120,12 +128,15 @@ export the data.`,
 
 	var limit int
 	top := &cobra.Command{
-		Use:   "top [names|clients|nxdomain|servfail|refused]",
-		Short: "The most queried names, busiest clients, names with errors, refused clients",
+		Use:   "top [names|clients|nxdomain|servfail|refused|blocked|blocked-clients|ratelimited|ratelimited-names]",
+		Short: "The most queried names, busiest clients, names with errors, refused clients, blocked names",
 		Example: `  jarl stats top names --since 7d
   jarl stats top clients --limit 50
   jarl stats top nxdomain      # misconfigured hosts and typos
-  jarl stats top refused       # who is asking for what they may not have`,
+  jarl stats top refused       # who is asking for what they may not have
+  jarl stats top blocked       # what blocking stops most (docs/blocking.md)
+  jarl stats top blocked-clients   # the devices blocking stops most
+  jarl stats top ratelimited       # client networks rate limiting limits, or would (docs/exposure.md)`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			kind := stats.KindName
@@ -134,6 +145,12 @@ export the data.`,
 				if kind == "nxdomain" || kind == "servfail" {
 					kind = strings.ToLower(args[0])
 				}
+				if kind == "blocked-client" {
+					kind = stats.KindBlockedClient
+				}
+				if kind == "ratelimited-name" {
+					kind = stats.KindRateLimitedName
+				}
 			}
 			c, err := newClient()
 			if err != nil {
@@ -148,13 +165,22 @@ export the data.`,
 				for _, e := range es {
 					total += e.Count
 				}
-				head := map[string]string{stats.KindClient: "CLIENT", stats.KindRefused: "CLIENT"}[kind]
+				head := map[string]string{stats.KindClient: "CLIENT", stats.KindRefused: "CLIENT", stats.KindBlockedClient: "CLIENT"}[kind]
 				if head == "" {
 					head = "NAME"
 				}
-				fmt.Fprintf(w, "#\t%s\tQUERIES\t\n", head)
+				named := slices.ContainsFunc(es, func(e stats.Entry) bool { return e.Name != "" })
+				if named {
+					fmt.Fprintf(w, "#\t%s\tHOST\tQUERIES\t\n", head)
+				} else {
+					fmt.Fprintf(w, "#\t%s\tQUERIES\t\n", head)
+				}
 				for i, e := range es {
-					fmt.Fprintf(w, "%d\t%s\t%d\t%s\n", i+1, e.Key, e.Count, bar(e.Count, es[0].Count, 20))
+					if named {
+						fmt.Fprintf(w, "%d\t%s\t%s\t%d\t%s\n", i+1, e.Key, dash(e.Name), e.Count, bar(e.Count, es[0].Count, 20))
+					} else {
+						fmt.Fprintf(w, "%d\t%s\t%d\t%s\n", i+1, e.Key, e.Count, bar(e.Count, es[0].Count, 20))
+					}
 				}
 			})
 		},
@@ -303,7 +329,61 @@ export the data.`,
 	}
 	sinceFlag(breakdown, &breakdownSince, "24h", sinceHelp)
 
-	cmd.AddCommand(status, summary, top, timeline, heatmap, breakdown)
+	server := &cobra.Command{
+		Use:   "server",
+		Short: "Show named's memory, CPU, cache and clients, the host's memory and load, and free disk space",
+		Long: `Server statistics, sampled once a minute: named's memory and CPU use,
+cache size, recursive and TCP clients against their limits, the host's
+memory and load, and the space left where zone files, logs and Jarl's
+data are. Memory and CPU over time: 'jarl stats timeline --key
+g:named:rss,g:named:cpu' (averages; CPU in tenths of a percent).`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var resp struct {
+				Server     *stats.Server     `json:"server"`
+				Named      map[string]string `json:"named,omitempty"`
+				NamedError string            `json:"named_error,omitempty"`
+				Disks      []stats.Disk      `json:"disks"`
+			}
+			if err := c.Get(ctx(), "/stats/server", nil, &resp); err != nil {
+				return err
+			}
+			return output(resp, func(w io.Writer) {
+				s := resp.Server
+				if s == nil {
+					fmt.Fprintln(w, "No sample yet:\tthe first is taken a minute after jarl starts")
+					return
+				}
+				fmt.Fprintf(w, "named:\t%s, up since %s, reconfigured %s\n", s.Version, isoLocal(s.BootTime), isoLocal(s.ConfigTime))
+				if s.PID > 0 {
+					fmt.Fprintf(w, "Memory:\t%s resident (named counts %s), %d threads, PID %d\n", sizeStr(s.RSS), sizeStr(s.MemInUse), s.Threads, s.PID)
+					fmt.Fprintf(w, "CPU:\t%.1f%% of one CPU over the last minute\n", s.CPUPercent)
+				} else {
+					fmt.Fprintf(w, "Memory:\tnamed counts %s (its process isn't visible to jarld)\n", sizeStr(s.MemInUse))
+				}
+				fmt.Fprintf(w, "Cache:\t%d RRsets, %s\n", s.CacheRRsets, sizeStr(s.CacheMem))
+				if n := resp.Named; n != nil {
+					fmt.Fprintf(w, "Recursive clients:\t%s (now/soft limit/limit), most at once %d\n", n["recursive_clients"], s.RecursionHighwater)
+					fmt.Fprintf(w, "TCP clients:\t%s (now/limit), most at once %d\n", n["tcp_clients"], s.TCPHighwater)
+				} else if resp.NamedError != "" {
+					fmt.Fprintf(w, "Clients:\tunknown: %s\n", resp.NamedError)
+				}
+				fmt.Fprintf(w, "Sockets:\t%d UDP, %d TCP\n", s.SocketsUDP, s.SocketsTCP)
+				if h := s.Host; h != nil && h.MemTotal > 0 {
+					fmt.Fprintf(w, "Host:\t%s of %s memory in use, load %v, %d CPUs, up %s\n", sizeStr(h.MemTotal-h.MemAvailable), sizeStr(h.MemTotal), h.Load, h.CPUs, (time.Duration(h.Uptime) * time.Second).String())
+				}
+				for _, d := range resp.Disks {
+					fmt.Fprintf(w, "Disk:\t%s free of %s for %s (%s)\n", sizeStr(d.Free), sizeStr(d.Total), strings.Join(d.Holds, ", "), d.Path)
+				}
+			})
+		},
+	}
+
+	cmd.AddCommand(status, summary, top, timeline, heatmap, breakdown, server)
 	return cmd
 }
 
@@ -376,3 +456,26 @@ func sparkline(vals []int64) string {
 	}
 	return sb.String()
 }
+
+// sizeStr formats a size in binary units.
+func sizeStr(n int64) string {
+	units := []string{"B", "KiB", "MiB", "GiB", "TiB"}
+	f, i := float64(n), 0
+	for f >= 1024 && i < len(units)-1 {
+		f /= 1024
+		i++
+	}
+	if i == 0 || f >= 100 {
+		return fmt.Sprintf("%.0f %s", f, units[i])
+	}
+	return fmt.Sprintf("%.1f %s", f, units[i])
+}
+
+// isoLocal shows a time named reports (RFC 3339) in local time.
+func isoLocal(s string) string {
+	t, err := time.Parse(time.RFC3339Nano, s)
+	if err != nil {
+		return s
+	}
+	return t.Local().Format("2006-01-02 15:04")
+}

cmd/jarl/zones.go

@@ -3,12 +3,14 @@ package main
 import (
 	"encoding/json"
 	"fmt"
+	"golang.org/x/term"
 	"io"
 	"net/netip"
 	"net/url"
 	"os"
 	"strconv"
 	"strings"
+	"unicode/utf8"
 
 	"github.com/spf13/cobra"
 
@@ -43,7 +45,11 @@ func zoneCmd() *cobra.Command {
 					if z.Type == "primary" {
 						serial, recs = fmt.Sprint(z.SOA.Serial), fmt.Sprint(z.Records)
 					}
-					fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%s\n", z.ID, z.Display, z.View, z.Type, recs, serial)
+					typ := z.Type
+					if z.Disabled {
+						typ += " (disabled)"
+					}
+					fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%s\n", z.ID, z.Display, z.View, typ, recs, serial)
 				}
 			})
 		},
@@ -71,15 +77,25 @@ func zoneCmd() *cobra.Command {
 					fmt.Fprintf(w, "View:\t%s\n", z.View)
 				}
 				fmt.Fprintf(w, "Type:\t%s\n", z.Type)
+				if z.Disabled {
+					fmt.Fprintf(w, "Disabled:\tyes: named doesn't load it ('jarl zone enable %s')\n", args[0])
+				}
 				if z.Type == "primary" {
 					fmt.Fprintf(w, "Serial:\t%d\n", z.SOA.Serial)
 					fmt.Fprintf(w, "SOA:\t%s %s refresh %d retry %d expire %d minimum %d\n", z.SOA.MName, z.SOA.RName, z.SOA.Refresh, z.SOA.Retry, z.SOA.Expire, z.SOA.Minimum)
 					fmt.Fprintf(w, "Default TTL:\t%d\n", z.DefaultTTL)
-					fmt.Fprintf(w, "Records:\t%d\n", z.Records)
+					if z.DisabledRecords > 0 {
+						fmt.Fprintf(w, "Records:\t%d (%d disabled: jarl record list %s --disabled)\n", z.Records, z.DisabledRecords, args[0])
+					} else {
+						fmt.Fprintf(w, "Records:\t%d\n", z.Records)
+					}
 				}
 				if z.InView != "" {
 					fmt.Fprintf(w, "In view:\t%s\n", z.InView)
 				}
+				if len(z.LinkedWith) > 0 {
+					fmt.Fprintf(w, "Linked with:\t%s (shared records are kept in step; 'jarl record list' shows which are local)\n", strings.Join(z.LinkedWith, ", "))
+				}
 				if z.ZoneFile != "" {
 					fmt.Fprintf(w, "File:\t%s\n", z.ZoneFile)
 				}
@@ -92,7 +108,7 @@ func zoneCmd() *cobra.Command {
 	show.Flags().StringVar(&view, "view", "", "view of the zone (when the name exists in several views)")
 
 	var ns, records, primaries, forwarders, opts []string
-	var contact, comment, cloneFrom, file, inView, forward string
+	var contact, comment, cloneFrom, file, inView, forward, linkWith string
 	var ttl uint32
 	create := &cobra.Command{
 		Use:   "create NAME",
@@ -107,7 +123,8 @@ and a network between octet boundaries, like a /22, gets one zone per /24
   jarl zone create 10.0.8.0/22            # 8-11.0.10.in-addr.arpa
   jarl zone create partner.example --type secondary --primary 192.0.2.53
   jarl zone create consul --type forward --forwarder "127.0.0.1 port 8600"
-  jarl zone create example.com --view external --clone-from example.com --clone-view internal`,
+  jarl zone create example.com --view external --clone-from example.com --clone-view internal
+  jarl zone create example.com --view vps --link-with external   # linked: shared records kept in step`,
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := newClient()
@@ -136,6 +153,9 @@ and a network between octet boundaries, like a /22, gets one zone per /24
 			if inView != "" {
 				body["in_view"] = inView
 			}
+			if linkWith != "" {
+				body["link_with"] = linkWith
+			}
 			var recs []map[string]any
 			for _, r := range records {
 				f := strings.Fields(r)
@@ -206,6 +226,7 @@ and a network between octet boundaries, like a /22, gets one zone per /24
 	create.Flags().StringVar(&cloneView, "clone-view", "", "view of --clone-from")
 	create.Flags().StringVar(&file, "file", "", "zone file (hint and redirect zones)")
 	create.Flags().StringVar(&inView, "in-view", "", "for in-view zones: the view to share the zone from")
+	create.Flags().StringVar(&linkWith, "link-with", "", "link with the zone of the same name in this view: copy its shared records and keep them in step (docs/views.md#linked-zones)")
 	create.Flags().StringVar(&comment, "comment", "", "comment")
 
 	var refresh, retry, expire, minimum, serial uint32
@@ -300,6 +321,42 @@ and a network between octet boundaries, like a /22, gets one zone per /24
 	del.Flags().StringVar(&view, "view", "", "view of the zone")
 	del.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask for confirmation")
 
+	toggle := func(disable bool) *cobra.Command {
+		verb := map[bool]string{true: "disable", false: "enable"}[disable]
+		long := `Load a disabled zone in named again, as it is in Jarl now (changes made
+while it was disabled included).`
+		if disable {
+			long = `Disable a zone: it stays in Jarl with its records, options and history,
+and can still be edited, but named no longer loads it. Its names are then
+answered by recursion where the view offers it (the internet's version of
+the zone, if any), and REFUSED elsewhere. Signed zones can't be disabled;
+turn signing off first.
+
+  jarl zone disable old.adbraun.lol
+  jarl zone enable old.adbraun.lol`
+		}
+		c := &cobra.Command{
+			Use:   verb + " ZONE",
+			Short: map[bool]string{true: "Stop serving a zone, keeping it in Jarl", false: "Serve a disabled zone again"}[disable],
+			Long:  long,
+			Args:  cobra.ExactArgs(1),
+			RunE: func(cmd *cobra.Command, args []string) error {
+				c, err := newClient()
+				if err != nil {
+					return err
+				}
+				path, qv := zonePath(args[0], view)
+				resp, err := c.Mutate(ctx(), "PATCH", path, qv, map[string]any{"disabled": disable})
+				if err != nil {
+					return err
+				}
+				return report(resp)
+			},
+		}
+		c.Flags().StringVar(&view, "view", "", "view of the zone")
+		return c
+	}
+
 	fileCmd := &cobra.Command{
 		Use:   "file ZONE",
 		Short: "Print the zone file Jarl generates",
@@ -367,7 +424,7 @@ equal to the file: records not in the file are deleted.`,
 	importCmd.Flags().BoolVar(&replace, "replace", false, "delete records that are not in the file")
 	importCmd.Flags().BoolVar(&useSOA, "use-soa", false, "also take SOA timers and $TTL from the file")
 
-	cmd.AddCommand(list, show, create, update, del, fileCmd, importCmd, zoneSerialsCmd(), zoneDelegationCmd())
+	cmd.AddCommand(list, show, create, update, del, toggle(true), toggle(false), fileCmd, importCmd, zoneSerialsCmd(), zoneDelegationCmd(), zoneDNSSECCmd(), zoneRegistrarCmd(), zoneLinkCmd(true), zoneLinkCmd(false))
 	return cmd
 }
 
@@ -400,11 +457,32 @@ func jsonUnmarshal(b []byte, v any) error { return json.Unmarshal(b, v) }
 
 // ---- records
 
+// viewsFlagHelp describes --view of the record commands that change
+// records.
+const viewsFlagHelp = "view of the zone; several (internal,external) or \"all\" make the same change in each, together"
+
 func recordCmd() *cobra.Command {
 	cmd := &cobra.Command{Use: "record", Aliases: []string{"records", "rr"}, Short: "Manage records in primary zones"}
 	var view, name, typ, search, comment, ttlArg string
-	var ptr, missingOK, yes bool
+	var ptr, missingOK, yes, onlyDisabled, wide, local, shared bool
 	var id int64
+	// linkFlags adds --local and --shared (linked zones) to a command.
+	linkFlags := func(c *cobra.Command, what string) {
+		c.Flags().BoolVar(&local, "local", false, "linked zones: "+what+" in this view only (overriding the shared records of this name and type here)")
+		c.Flags().BoolVar(&shared, "shared", false, "linked zones: "+what+" in every linked view (this version becomes every view's)")
+	}
+	linkBody := func(body map[string]any) error {
+		switch {
+		case local && shared:
+			return fmt.Errorf("give --local or --shared, not both")
+		case local:
+			body["local"] = true
+			localFanOut = true
+		case shared:
+			body["local"] = false
+		}
+		return nil
+	}
 
 	list := &cobra.Command{
 		Use:   "list ZONE",
@@ -419,18 +497,46 @@ func recordCmd() *cobra.Command {
 			for k, v := range q("name", name, "type", strings.ToUpper(typ), "q", search) {
 				qv[k] = v
 			}
+			if onlyDisabled {
+				qv.Set("disabled", "1")
+			}
 			var recs []api.Record
 			if err := c.Get(ctx(), path+"/records", qv, &recs); err != nil {
 				return err
 			}
+			linked := false
+			for _, r := range recs {
+				linked = linked || r.Linked != ""
+			}
 			return output(recs, func(w io.Writer) {
-				fmt.Fprintln(w, "ID\tNAME\tTTL\tTYPE\tDATA\tCOMMENT")
+				rows := [][]string{{"ID", "NAME", "TTL", "TYPE", "DATA", "COMMENT"}}
+				if linked {
+					rows[0] = []string{"ID", "NAME", "TTL", "TYPE", "LINK", "DATA", "COMMENT"}
+				}
 				for _, r := range recs {
 					ttl := fmt.Sprint(r.EffectiveTTL)
 					if r.TTL == nil {
 						ttl += "*"
 					}
-					fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%s\n", r.ID, r.RelativeName, ttl, r.Type, r.Data, r.Comment)
+					comment := r.Comment
+					if r.Disabled {
+						comment = strings.TrimSpace("[disabled] " + comment)
+					}
+					if linked {
+						rows = append(rows, []string{fmt.Sprint(r.ID), r.RelativeName, ttl, r.Type, r.Linked, r.Data, comment})
+						continue
+					}
+					rows = append(rows, []string{fmt.Sprint(r.ID), r.RelativeName, ttl, r.Type, r.Data, comment})
+				}
+				if !wide {
+					col := 4
+					if linked {
+						col = 5
+					}
+					fitColumn(rows, col)
+				}
+				for _, row := range rows {
+					fmt.Fprintln(w, strings.Join(row, "\t"))
 				}
 			})
 		},
@@ -439,6 +545,8 @@ func recordCmd() *cobra.Command {
 	list.Flags().StringVar(&name, "name", "", "only this name")
 	list.Flags().StringVarP(&typ, "type", "t", "", "only this type")
 	list.Flags().StringVar(&search, "search", "", "only records whose name, data or comment contains this")
+	list.Flags().BoolVar(&onlyDisabled, "disabled", false, "only disabled records")
+	list.Flags().BoolVarP(&wide, "wide", "w", false, "show long data in full (on a terminal it is shortened to fit)")
 
 	add := &cobra.Command{
 		Use:   "add ZONE NAME TYPE DATA...",
@@ -467,18 +575,24 @@ and splitting are automatic).
 			if ptr {
 				body["ptr"] = true
 			}
-			path, qv := zonePath(args[0], view)
-			resp, err := c.Mutate(ctx(), "POST", path+"/records", qv, body)
+			if err := linkBody(body); err != nil {
+				return err
+			}
+			views, err := zoneViews(c, args[0], view)
 			if err != nil {
 				return err
 			}
-			return report(resp)
+			return perView(c, views, "add "+args[1]+" "+strings.ToUpper(args[2]), func(c *client.Client, view string) (*api.MutationResponse, error) {
+				path, qv := zonePath(args[0], view)
+				return c.Mutate(ctx(), "POST", path+"/records", qv, body)
+			})
 		},
 	}
-	add.Flags().StringVar(&view, "view", "", "view of the zone")
+	add.Flags().StringVar(&view, "view", "", viewsFlagHelp)
 	add.Flags().StringVar(&ttlArg, "ttl", "", "TTL in seconds (default: the RRset's or the zone's)")
 	add.Flags().StringVar(&comment, "comment", "", "comment")
 	add.Flags().BoolVar(&ptr, "ptr", false, "also add the PTR record (A/AAAA)")
+	linkFlags(add, "add it")
 
 	var data string
 	update := &cobra.Command{
@@ -512,6 +626,9 @@ and splitting are automatic).
 			if ptr {
 				body["ptr"] = true
 			}
+			if err := linkBody(body); err != nil {
+				return err
+			}
 			if len(body) == 0 {
 				return fmt.Errorf("nothing to change (see --help)")
 			}
@@ -528,6 +645,8 @@ and splitting are automatic).
 	update.Flags().StringVar(&ttlArg, "ttl", "", `new TTL, or "default" for the zone default`)
 	update.Flags().StringVar(&comment, "comment", "", "new comment")
 	update.Flags().BoolVar(&ptr, "ptr", false, "move the PTR record along (A/AAAA)")
+	update.Flags().BoolVar(&local, "local", false, "linked zones: make this name and type local to the record's view (an override)")
+	update.Flags().BoolVar(&shared, "shared", false, "linked zones: share this name and type with the linked views; this view's version becomes every view's")
 
 	del := &cobra.Command{
 		Use:   "delete ZONE NAME TYPE [DATA...]  |  delete --id ID",
@@ -560,26 +679,28 @@ or one record by ID.
 			if len(args) == 3 && !confirm(fmt.Sprintf("Delete all %s records of %s?", strings.ToUpper(args[2]), args[1]), yes) {
 				return fmt.Errorf("canceled")
 			}
-			path, qv := zonePath(args[0], view)
-			qv.Set("name", args[1])
-			qv.Set("type", args[2])
-			if len(args) > 3 {
-				qv.Set("data", strings.Join(args[3:], " "))
-			}
-			if missingOK {
-				qv.Set("missing_ok", "1")
-			}
-			if ptr {
-				qv.Set("ptr", "1")
-			}
-			resp, err := c.Mutate(ctx(), "DELETE", path+"/records", qv, nil)
+			views, err := zoneViews(c, args[0], view)
 			if err != nil {
 				return err
 			}
-			return report(resp)
+			return perView(c, views, "delete "+args[1]+" "+strings.ToUpper(args[2]), func(c *client.Client, view string) (*api.MutationResponse, error) {
+				path, qv := zonePath(args[0], view)
+				qv.Set("name", args[1])
+				qv.Set("type", args[2])
+				if len(args) > 3 {
+					qv.Set("data", strings.Join(args[3:], " "))
+				}
+				if missingOK {
+					qv.Set("missing_ok", "1")
+				}
+				if ptr {
+					qv.Set("ptr", "1")
+				}
+				return c.Mutate(ctx(), "DELETE", path+"/records", qv, nil)
+			})
 		},
 	}
-	del.Flags().StringVar(&view, "view", "", "view of the zone")
+	del.Flags().StringVar(&view, "view", "", viewsFlagHelp)
 	del.Flags().Int64Var(&id, "id", 0, "delete the record with this ID")
 	del.Flags().BoolVar(&missingOK, "missing-ok", false, "succeed when nothing matches")
 	del.Flags().BoolVar(&ptr, "ptr", false, "also delete the matching PTR record (A/AAAA)")
@@ -606,19 +727,108 @@ spaces.
 			if comment != "" {
 				body["comment"] = comment
 			}
-			path, qv := zonePath(args[0], view)
-			resp, err := c.Mutate(ctx(), "PUT", path+"/rrsets/"+urlPathEscape(args[1])+"/"+urlPathEscape(args[2]), qv, body)
+			if err := linkBody(body); err != nil {
+				return err
+			}
+			views, err := zoneViews(c, args[0], view)
 			if err != nil {
 				return err
 			}
-			return report(resp)
+			return perView(c, views, "set "+args[1]+" "+strings.ToUpper(args[2]), func(c *client.Client, view string) (*api.MutationResponse, error) {
+				path, qv := zonePath(args[0], view)
+				return c.Mutate(ctx(), "PUT", path+"/rrsets/"+urlPathEscape(args[1])+"/"+urlPathEscape(args[2]), qv, body)
+			})
 		},
 	}
-	set.Flags().StringVar(&view, "view", "", "view of the zone")
+	set.Flags().StringVar(&view, "view", "", viewsFlagHelp)
 	set.Flags().StringVar(&ttlArg, "ttl", "", "TTL for the RRset")
 	set.Flags().StringVar(&comment, "comment", "", "comment for new records")
+	linkFlags(set, "set it")
 
-	cmd.AddCommand(list, add, update, del, set)
+	toggle := func(disable bool) *cobra.Command {
+		verb := "enable"
+		long := `Enable disabled records again: by name and type (all of them, or only the
+one with DATA), or one record by ID. The record is checked as if it were
+added, so a CNAME added in the meantime at its name stops it.
+
+  jarl record enable example.com www A 192.0.2.10
+  jarl record enable --id 1234 --ptr`
+		if disable {
+			verb = "disable"
+			long = `Disable records: they stay in Jarl, with their TTL, comment and ID, but are
+left out of the zone (the zone file lists them as comments) until they are
+enabled again. Select them by name and type (all of them, or only the one
+with DATA), or one record by ID.
+
+  jarl record disable example.com www A 192.0.2.10 --ptr   # and its PTR record
+  jarl record disable example.com old CNAME
+  jarl record disable --id 1234
+  jarl record list example.com --disabled`
+		}
+		var tview string
+		var tid int64
+		var tptr, tmissing bool
+		c := &cobra.Command{
+			Use:   verb + " ZONE NAME TYPE [DATA...]  |  " + verb + " --id ID",
+			Short: strings.ToUpper(verb[:1]) + verb[1:] + " records",
+			Long:  long,
+			RunE: func(cmd *cobra.Command, args []string) error {
+				c, err := newClient()
+				if err != nil {
+					return err
+				}
+				qv := q()
+				if tptr {
+					qv.Set("ptr", "1")
+				}
+				if tid > 0 {
+					resp, err := c.Mutate(ctx(), "POST", "/records/"+strconv.FormatInt(tid, 10)+"/"+verb, qv, nil)
+					if err != nil {
+						return err
+					}
+					return report(resp)
+				}
+				if len(args) < 3 {
+					return fmt.Errorf("give ZONE NAME TYPE [DATA], or --id")
+				}
+				views, err := zoneViews(c, args[0], tview)
+				if err != nil {
+					return err
+				}
+				return perView(c, views, verb+" "+args[1]+" "+strings.ToUpper(args[2]), func(c *client.Client, view string) (*api.MutationResponse, error) {
+					path, zq := zonePath(args[0], view)
+					vq := q()
+					for k, v := range qv {
+						vq[k] = v
+					}
+					for k, v := range zq {
+						vq[k] = v
+					}
+					vq.Set("name", args[1])
+					vq.Set("type", args[2])
+					if len(args) > 3 {
+						vq.Set("data", strings.Join(args[3:], " "))
+					}
+					if tmissing {
+						vq.Set("missing_ok", "1")
+					}
+					resp, err := c.Mutate(ctx(), "POST", path+"/records/"+verb, vq, nil)
+					if err != nil && tmissing && strings.HasSuffix(err.Error(), "nothing to do") {
+						fmt.Println("nothing to do")
+						return nil, nil
+					}
+					return resp, err
+				})
+			},
+		}
+		c.Flags().StringVar(&tview, "view", "", viewsFlagHelp)
+		c.Flags().Int64Var(&tid, "id", 0, verb+" the record with this ID")
+		c.Flags().BoolVar(&tmissing, "missing-ok", false, "succeed when nothing matches or the records are already "+verb+"d")
+		c.Flags().BoolVar(&tptr, "ptr", false, "also "+verb+" the matching PTR record (A/AAAA)")
+		return c
+	}
+
+	cmd.AddCommand(list, add, update, del, set, toggle(true), toggle(false))
 	return cmd
 }
 
@@ -636,3 +846,94 @@ func setTTL(body map[string]any, ttl string) error {
 	}
 	return nil
 }
+
+// fitColumn shortens column col of a table (header row first) so that the
+// rows fit the terminal: the table pads every row to its longest cell, so
+// one long TXT record would make every row wrap. Nothing is shortened when
+// standard output isn't a terminal.
+func fitColumn(rows [][]string, col int) {
+	fd := int(os.Stdout.Fd())
+	if !term.IsTerminal(fd) {
+		return
+	}
+	width, _, err := term.GetSize(fd)
+	if err != nil || width <= 0 {
+		return
+	}
+	widths := make([]int, len(rows[0]))
+	for _, row := range rows {
+		for i, c := range row {
+			widths[i] = max(widths[i], utf8.RuneCountInString(c))
+		}
+	}
+	used := 0
+	for i, w := range widths {
+		if i != col {
+			used += w + 2 // the table's padding
+		}
+	}
+	if col == len(widths)-1 {
+		used -= 2
+	}
+	limit := max(width-used-2, 24)
+	for _, row := range rows[1:] {
+		if r := []rune(row[col]); len(r) > limit {
+			row[col] = string(r[:limit-1]) + "…"
+		}
+	}
+}
+
+// zoneLinkCmd is 'zone link' and 'zone unlink' (docs/views.md#linked-zones).
+func zoneLinkCmd(link bool) *cobra.Command {
+	var view string
+	var with []string
+	cmd := &cobra.Command{
+		Use:   "link ZONE --view VIEW [--with VIEW...]",
+		Short: "Link zones of the same name in several views: shared records are kept in step",
+		Long: `Links a zone with the zones of the same name in other views (--with, or
+every view that has one). Jarl then keeps their shared records in step: a
+change to one reaches the others in the same changeset. Each view can
+still have records of its own (record add/set --local), which override
+the shared records of that name and type there, and every zone keeps its
+own options, so views can still differ in who they answer and how.
+
+Linking never changes what named answers: a name and type with the same
+records in every view becomes shared, and one that differs stays local to
+each view. Share one later from the view whose version is right:
+jarl record update ID --shared.`,
+		Example: `  jarl zone link adbraun.lol --view external --with vps
+  jarl zone create adbraun.lol --view vps --link-with external   # a new zone, linked from the start
+  jarl zone unlink adbraun.lol --view vps`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			path, qv := zonePath(args[0], view)
+			verb := "unlink"
+			var body any
+			if link {
+				verb = "link"
+				body = map[string]any{"with": with}
+			}
+			resp, err := c.Mutate(ctx(), "POST", path+"/"+verb, qv, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.Flags().StringVar(&view, "view", "", "view of the zone")
+	if link {
+		cmd.Flags().StringSliceVar(&with, "with", nil, "views to link with (default: every view with a zone of that name)")
+		return cmd
+	}
+	cmd.Use = "unlink ZONE --view VIEW"
+	cmd.Short = "Take a zone out of its link: its records stay, all local"
+	cmd.Long = `Takes a zone out of its link. Its records stay as they are, all local to
+its view, and the other zones of the link keep theirs. A link left with one
+zone is dissolved.`
+	cmd.Example = "  jarl zone unlink adbraun.lol --view vps"
+	return cmd
+}

cmd/jarld/admin.go

@@ -302,7 +302,11 @@ func renderCmd() *cobra.Command {
 				return err
 			}
 			paths := render.Paths{ConfigDir: filepath.Join(out, "config"), ZoneDir: filepath.Join(out, "zones"), CacheDir: filepath.Join(out, "cache")}
-			o := render.Render(st, paths, renderExtras(a.cfg))
+			x := renderExtras(a.cfg)
+			if x.ViewKeySeed, err = engine.ViewKeySeed(context.Background(), a.store); err != nil {
+				return err
+			}
+			o := render.Render(st, paths, x)
 			for _, f := range o.Files {
 				if err := os.MkdirAll(filepath.Dir(f.Path), 0o750); err != nil {
 					return err
@@ -383,7 +387,7 @@ func versionCmd() *cobra.Command {
 		Use:   "version",
 		Short: "Print the version",
 		Run: func(cmd *cobra.Command, args []string) {
-			fmt.Println("jarld", version.Version)
+			fmt.Println("jarld", version.String())
 		},
 	}
 }

cmd/jarld/backup.go

@@ -7,8 +7,11 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/user"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"syscall"
 	"text/tabwriter"
 	"time"
 
@@ -18,11 +21,13 @@ import (
 	"jarl/internal/auth"
 	"jarl/internal/backup"
 	"jarl/internal/config"
+	"jarl/internal/render"
 	"jarl/internal/store"
 )
 
 func backupCmd() *cobra.Command {
-	return &cobra.Command{
+	var withoutKeys bool
+	cmd := &cobra.Command{
 		Use:   "backup [FILE]",
 		Short: "Back up the database (safe while jarld runs)",
 		Long: `Writes a consistent copy of Jarl's database and checks it.
@@ -35,10 +40,18 @@ say. This is what the jarl-backup.timer systemd timer runs every day.
 With FILE it writes a single copy there, which is never deleted
 automatically.
 
+Each backup also holds the DNSSEC keys of signed zones (from Jarl's key
+directory, private keys included), so that 'jarld restore' can put them
+back: a zone whose keys are lost stops validating while its parent still
+has a DS record for them. named's private keys are readable only by named's
+user, so run this as root; jarl-backup.service has the capability to read
+them. --without-keys backs up only the database.
+
 Every backup is recorded in the database, and the dashboard shows the newest.
 Restore one with 'jarld restore'.`,
-		Example: `  sudo -u jarl jarld backup
-  sudo -u jarl jarld backup /root/jarl-before-upgrade.db`,
+		Example: `  sudo jarld backup
+  sudo jarld backup /root/jarl-before-upgrade.db
+  sudo systemctl start jarl-backup.service`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := config.Load(configPath, true)
@@ -59,7 +72,14 @@ Restore one with 'jarld restore'.`,
 			defer newDirOwner(filepath.Dir(cfg.Database)).fix(filepath.Dir(cfg.Database))
 			ctx := context.Background()
 			now := time.Now()
+			keysDir := render.Paths{ZoneDir: cfg.BIND.ZoneDir}.KeysDir()
+			if withoutKeys {
+				keysDir = ""
+			}
 			fail := func(err error) error {
+				if strings.Contains(err.Error(), "DNSSEC keys") {
+					err = fmt.Errorf("%w; or back up only the database with --without-keys", err)
+				}
 				if rerr := st.RecordBackup(ctx, store.BackupRecord{At: now, Error: err.Error()}); rerr != nil {
 					fmt.Fprintln(os.Stderr, "warning: couldn't record the failure in the database:", rerr)
 				}
@@ -74,27 +94,33 @@ Restore one with 'jarld restore'.`,
 					os.Remove(dst)
 					return fail(fmt.Errorf("backing up %s: %w", cfg.Database, err))
 				}
+				if keysDir != "" {
+					if _, err := backup.AddFiles(ctx, dst, keysDir); err != nil {
+						os.Remove(dst)
+						return fail(err)
+					}
+				}
 				if err := backup.Verify(ctx, dst); err != nil {
 					os.Remove(dst)
 					return fail(fmt.Errorf("the backup failed its check: %w", err))
 				}
 				fi, _ := os.Stat(dst)
 				st.RecordBackup(ctx, store.BackupRecord{At: now, File: dst, Size: fi.Size()})
-				fmt.Printf("Database backed up to %s (%s)\n", dst, size(fi.Size()))
+				fmt.Printf("Database backed up to %s (%s)%s\n", dst, size(fi.Size()), keysNote(ctx, dst))
 				return nil
 			}
 
 			dir := cfg.Backup.Dir
 			defer newDirOwner(dir).fix(dir)
-			f, err := backup.Write(ctx, cfg.Database, dir, backup.KindJarl, now)
+			f, err := backup.Write(ctx, cfg.Database, dir, backup.KindJarl, now, keysDir)
 			if err != nil {
 				return fail(fmt.Errorf("backing up %s: %w", cfg.Database, err))
 			}
-			fmt.Printf("Database backed up to %s (%s)\n", f.Path, size(f.Size))
+			fmt.Printf("Database backed up to %s (%s)%s\n", f.Path, size(f.Size), keysNote(ctx, f.Path))
 			kinds := []string{backup.KindJarl}
 			if cfg.Backup.Stats {
 				if _, err := os.Stat(cfg.Stats.Database); err == nil {
-					sf, err := backup.Write(ctx, cfg.Stats.Database, dir, backup.KindStats, now)
+					sf, err := backup.Write(ctx, cfg.Stats.Database, dir, backup.KindStats, now, "")
 					if err != nil {
 						return fail(fmt.Errorf("backing up the statistics database %s: %w", cfg.Stats.Database, err))
 					}
@@ -117,10 +143,20 @@ Restore one with 'jarld restore'.`,
 			return nil
 		},
 	}
+	cmd.Flags().BoolVar(&withoutKeys, "without-keys", false, "back up only the database, not the DNSSEC keys")
+	return cmd
+}
+
+// keysNote says how many DNSSEC key files a backup holds.
+func keysNote(ctx context.Context, path string) string {
+	if in, err := backup.Inspect(ctx, path); err == nil && in.KeyFiles > 0 {
+		return ", with " + plural(in.KeyFiles, "DNSSEC key file")
+	}
+	return ""
 }
 
 func restoreCmd() *cobra.Command {
-	var yes bool
+	var yes, withoutKeys bool
 	cmd := &cobra.Command{
 		Use:   "restore [FILE | latest]",
 		Short: "Replace the database with a backup (jarld must be stopped)",
@@ -132,13 +168,20 @@ confirm replaces the database with it. jarld must be stopped first. The
 current database is kept as DATABASE.before-restore-<UTC time>, and the
 restore is recorded in the restored database's audit log.
 
+The DNSSEC keys stored in the backup go back into Jarl's key directory,
+owned by named's user (bind.named_user), which needs root. Key files that
+are there but not in the backup are left alone. --without-keys restores
+only the database.
+
 Then start jarld and bring named's files in line with the restored database:
 
   systemctl start jarl
   jarl resync --dry-run     # what differs
   jarl resync --force       # write everything and reload named
 
-See "Restoring" in docs/operations.md, also for zone serials and secondaries.`,
+Jarl raises the serials of zones whose data goes back to an older state
+above what named and the secondaries have, so they pick it up. See
+"Restoring" in docs/operations.md.`,
 		Example: `  sudo jarld restore
   sudo systemctl stop jarl
   sudo jarld restore latest
@@ -180,6 +223,24 @@ See "Restoring" in docs/operations.md, also for zone serials and secondaries.`,
 			if info.Schema > store.SchemaVersion() {
 				return fmt.Errorf("%s was made by a newer Jarl (schema %d, this one knows %d); install that version to restore it", src, info.Schema, store.SchemaVersion())
 			}
+			keysDir := render.Paths{ZoneDir: cfg.BIND.ZoneDir}.KeysDir()
+			var keyFiles []backup.StoredFile
+			if !withoutKeys {
+				var root string
+				root, keyFiles, err = backup.Files(ctx, src)
+				if err != nil {
+					return fmt.Errorf("reading the DNSSEC keys in %s: %w", src, err)
+				}
+				if len(keyFiles) > 0 && os.Geteuid() != 0 && !runningAs(cfg.BIND.NamedUser) {
+					return fmt.Errorf("the backup holds %s, and putting them back for named needs root: run this as root (or add --without-keys to restore only the database)", plural(len(keyFiles), "DNSSEC key file"))
+				}
+				if root != "" && root != keysDir && len(keyFiles) > 0 {
+					fmt.Printf("The keys were backed up from %s; they go to %s now.\n", root, keysDir)
+				}
+			}
+			if info.SignedZones > 0 && len(keyFiles) == 0 && !withoutKeys {
+				fmt.Fprintf(os.Stderr, "warning: the backup has %s but no DNSSEC keys (it was made with --without-keys, or before Jarl backed them up). Unless the keys are still in %s, named makes new ones, and a DS record for the old ones at the parent stops matching.\n", plural(info.SignedZones, "signed zone"), keysDir)
+			}
 			unlock, err := lockDatabase(cfg.Database)
 			if errors.Is(err, errInUse) {
 				return fmt.Errorf("jarld is running; stop it first (systemctl stop jarl), then run this again")
@@ -192,6 +253,9 @@ See "Restoring" in docs/operations.md, also for zone serials and secondaries.`,
 			w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
 			fmt.Fprintf(w, "Backup:\t%s\n", src)
 			describe(w, info, backupTime(src))
+			if len(keyFiles) > 0 {
+				fmt.Fprintf(w, "  DNSSEC keys\t%s (go back to %s)\n", plural(len(keyFiles), "file"), keysDir)
+			}
 			if cur, err := backup.Inspect(ctx, cfg.Database); err == nil {
 				fmt.Fprintf(w, "\nCurrent database:\t%s\n", cfg.Database)
 				describe(w, cur, time.Time{})
@@ -224,13 +288,27 @@ See "Restoring" in docs/operations.md, also for zone serials and secondaries.`,
 					moved = true
 				}
 			}
-			if err := copyFile(src, db, 0o640); err != nil {
+			restoreErr := copyFile(src, db, 0o640)
+			if restoreErr == nil {
+				// The keys go back to their own files, not into the
+				// live database.
+				restoreErr = backup.DropFiles(ctx, db)
+			}
+			if restoreErr != nil {
+				os.Remove(db)
 				if moved {
 					os.Rename(aside, db)
 					os.Rename(aside+"-wal", db+"-wal")
 					os.Rename(aside+"-shm", db+"-shm")
 				}
-				return fmt.Errorf("restoring: %w (the current database was left in place)", err)
+				return fmt.Errorf("restoring: %w (the current database was left in place)", restoreErr)
+			}
+			if len(keyFiles) > 0 {
+				n, err := restoreKeys(cfg, keysDir, keyFiles)
+				if err != nil {
+					return fmt.Errorf("the database was restored, but putting back the DNSSEC keys failed after %d files: %w", n, err)
+				}
+				fmt.Printf("Put back %s in %s.\n", plural(n, "DNSSEC key file"), keysDir)
 			}
 			// Open it as jarld will: an older backup gets the current
 			// schema now, and the restore goes into its audit log.
@@ -255,17 +333,89 @@ Next:
   jarl resync --dry-run     # what differs between the restored database and named's files
   jarl resync --force       # write them and reload named
 
-If you have secondary servers, zone serials older than what they last saw
-are ignored by them: raise them with 'jarl zone update ZONE --serial N'
-(see "Restoring" in docs/operations.md).
+Zones whose data goes back to an older state get a serial above the one
+named has, so named and the secondaries load them (see "Restoring" in
+docs/operations.md).
 `)
 			return nil
 		},
 	}
 	cmd.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask for confirmation")
+	cmd.Flags().BoolVar(&withoutKeys, "without-keys", false, "restore only the database, not the DNSSEC keys")
 	return cmd
 }
 
+// runningAs reports whether this process runs as the named user.
+func runningAs(name string) bool {
+	u, err := user.Lookup(name)
+	return err == nil && u.Uid == strconv.Itoa(os.Geteuid())
+}
+
+// restoreKeys writes DNSSEC key files from a backup into keysDir, owned
+// by named's user and Jarl's file group with their backed-up modes, so
+// named can use them. Directories get the owner of the zone directory
+// (jarld's user), like the ones jarld makes. Files already there are
+// replaced; others are left alone.
+func restoreKeys(cfg *config.Config, keysDir string, files []backup.StoredFile) (int, error) {
+	uid, gid := -1, -1
+	if u, err := user.Lookup(cfg.BIND.NamedUser); err == nil {
+		uid, _ = strconv.Atoi(u.Uid)
+	} else {
+		return 0, fmt.Errorf("named's user %q (bind.named_user): %w", cfg.BIND.NamedUser, err)
+	}
+	if g, err := user.LookupGroup(cfg.BIND.FileGroup); err == nil {
+		gid, _ = strconv.Atoi(g.Gid)
+	}
+	dirUID, dirGID := -1, gid
+	if fi, err := os.Stat(cfg.BIND.ZoneDir); err == nil {
+		if st, ok := fi.Sys().(*syscall.Stat_t); ok {
+			dirUID = int(st.Uid)
+		}
+	}
+	var mkdir func(dir string) error
+	mkdir = func(dir string) error {
+		if _, err := os.Stat(dir); err == nil {
+			return nil
+		}
+		if err := mkdir(filepath.Dir(dir)); err != nil {
+			return err
+		}
+		if err := os.Mkdir(dir, 0o770); err != nil && !os.IsExist(err) {
+			return err
+		}
+		os.Chown(dir, dirUID, dirGID)
+		return os.Chmod(dir, 0o770|os.ModeSetgid)
+	}
+	n := 0
+	for _, f := range files {
+		if filepath.IsAbs(f.Path) || strings.HasPrefix(filepath.Clean(f.Path), "..") {
+			return n, fmt.Errorf("refusing the file name %q in the backup", f.Path)
+		}
+		dst := filepath.Join(keysDir, f.Path)
+		if err := mkdir(filepath.Dir(dst)); err != nil {
+			return n, err
+		}
+		tmp := dst + ".restore-tmp"
+		if err := os.WriteFile(tmp, f.Data, 0o600); err != nil {
+			return n, err
+		}
+		if err := os.Chown(tmp, uid, gid); err != nil {
+			os.Remove(tmp)
+			return n, err
+		}
+		if err := os.Chmod(tmp, f.Mode); err != nil {
+			os.Remove(tmp)
+			return n, err
+		}
+		if err := os.Rename(tmp, dst); err != nil {
+			os.Remove(tmp)
+			return n, err
+		}
+		n++
+	}
+	return n, nil
+}
+
 func listBackups(dir string) error {
 	files, err := backup.List(dir)
 	if err != nil {
@@ -290,6 +440,9 @@ func describe(w io.Writer, in *backup.Info, made time.Time) {
 		fmt.Fprintf(w, "  made\t%s (%s ago)\n", made.Local().Format("2006-01-02 15:04:05"), fmtDuration(time.Since(made)))
 	}
 	fmt.Fprintf(w, "  contents\t%s, %s, %s (schema %d)\n", plural(in.Zones, "zone"), plural(in.Records, "record"), plural(in.Users, "user"), in.Schema)
+	if in.SignedZones > 0 {
+		fmt.Fprintf(w, "  signed zones\t%d\n", in.SignedZones)
+	}
 	if in.LastChange != nil {
 		fmt.Fprintf(w, "  last change\t%s\n", in.LastChange.Local().Format("2006-01-02 15:04:05"))
 	}

cmd/jarld/main.go

@@ -24,9 +24,12 @@ import (
 
 	"jarl/internal/auth"
 	"jarl/internal/bind"
+	"jarl/internal/certs"
 	"jarl/internal/config"
 	"jarl/internal/engine"
 	"jarl/internal/model"
+	"jarl/internal/nscheck"
+	"jarl/internal/porkbun"
 	"jarl/internal/render"
 	"jarl/internal/server"
 	"jarl/internal/stats"
@@ -50,7 +53,7 @@ func rootCmd() *cobra.Command {
 		Short:         "Jarl: manage BIND (named) through a web UI, a REST API and a CLI",
 		SilenceUsage:  true,
 		SilenceErrors: true,
-		Version:       version.Version,
+		Version:       version.String(),
 	}
 	def := os.Getenv("JARL_CONFIG")
 	if def == "" {
@@ -121,7 +124,12 @@ func openApp(allowMissingConfig bool) (*app, error) {
 		ReloadTimeout: time.Duration(cfg.BIND.ReloadTimeout),
 		NoReload:      cfg.BIND.NoReload,
 		Extras:        renderExtras(cfg),
+		LocalAddrs:    nscheck.LocalAddrs,
 	}, log)
+	eng.Limits = engine.BlocklistLimits{
+		Refresh: time.Duration(cfg.Blocking.Refresh), RetryAfter: time.Hour, Timeout: 2 * time.Minute,
+		MaxBytes: int64(cfg.Blocking.MaxDownloadMB) << 20, MaxEntries: cfg.Blocking.MaxEntries,
+	}
 	return &app{cfg: cfg, log: log, store: st, eng: eng, owner: owner}, nil
 }
 
@@ -143,7 +151,7 @@ func statsOptions(cfg *config.Config) stats.Options {
 	sc := cfg.Stats
 	o := stats.Options{QueryLog: sc.QueryLog, LogFile: sc.LogFile, StatisticsChannel: sc.StatisticsChannel, TopN: sc.TopN,
 		RetainMinute: time.Duration(sc.Retention.Minute), RetainHour: time.Duration(sc.Retention.Hour), RetainDay: time.Duration(sc.Retention.Day),
-		Anonymize: sc.AnonymizeClients}
+		Anonymize: sc.AnonymizeClients, MainConfig: cfg.BIND.MainConfig}
 	for _, p := range sc.ExcludeClients {
 		if pf, err := config.ParsePrefix(p); err == nil {
 			o.Exclude = append(o.Exclude, pf.Masked())
@@ -162,7 +170,7 @@ func zoneIndex(a *app) stats.ZoneIndex {
 		}
 		out := map[string][]string{}
 		for _, z := range st.Zones {
-			if z.Type != model.ZonePrimary && z.Type != model.ZoneSecondary && z.Type != model.ZoneMirror {
+			if z.Type != model.ZonePrimary && z.Type != model.ZoneSecondary && z.Type != model.ZoneMirror || z.Disabled {
 				continue
 			}
 			v := st.ViewName(z)
@@ -291,12 +299,41 @@ func serveCmd() *cobra.Command {
 				// database closes, however serving ends.
 				defer func() { cancel(); <-collectorDone }()
 			}
+			var pb *porkbun.Client
+			if a.cfg.Porkbun.Enabled() {
+				pb = &porkbun.Client{BaseURL: a.cfg.Porkbun.APIURL, APIKey: a.cfg.Porkbun.APIKey, Secret: a.cfg.Porkbun.SecretAPIKey}
+				if fi, err := os.Stat(configPath); err == nil && fi.Mode().Perm()&0o004 != 0 {
+					a.log.Warn("the configuration file holds the Porkbun API key and everyone can read it; make it readable only by root and jarld (chown root:jarl, chmod 640)", "file", configPath)
+				}
+			}
+			if a.cfg.Metrics.Enabled && a.cfg.Metrics.Token != "" {
+				if fi, err := os.Stat(configPath); err == nil && fi.Mode().Perm()&0o004 != 0 {
+					a.log.Warn("the configuration file holds metrics.token and everyone can read it; make it readable only by root and jarld (chown root:jarl, chmod 640)", "file", configPath)
+				}
+			}
+			cm := certs.New(certs.Config{
+				Directory: a.cfg.ACME.Account.DirectoryURL(), Email: a.cfg.ACME.Account.Email, AgreeTOS: a.cfg.ACME.Account.AgreeTOS,
+				EABKeyID: a.cfg.ACME.Account.EABKeyID, EABHMAC: a.cfg.ACME.Account.EABHMAC,
+				Resolvers: a.cfg.ACME.Resolvers, CABundle: a.cfg.ACME.CABundle, CheckPropagation: a.cfg.ACME.CheckPropagation,
+				Dir: a.cfg.CertDir(), Version: version.String(), Porkbun: pb, PorkbunAllows: a.cfg.Porkbun.Allows,
+			}, a.store, a.eng, a.log)
+			cm.Start(ctx)
+			if a.cfg.ACME.Account.EABHMAC != "" {
+				if fi, err := os.Stat(configPath); err == nil && fi.Mode().Perm()&0o004 != 0 {
+					a.log.Warn("the configuration file holds acme.account.eab_hmac and everyone can read it; make it readable only by root and jarld (chown root:jarl, chmod 640)", "file", configPath)
+				}
+			}
 			srv := server.New(server.Config{
 				Listen: a.cfg.Listen, TLSCertFile: a.cfg.TLS.CertFile, TLSKeyFile: a.cfg.TLS.KeyFile,
 				TrustedProxies: a.cfg.Proxies(), SessionLifetime: time.Duration(a.cfg.Session.Lifetime),
 				SessionIdle: time.Duration(a.cfg.Session.IdleTimeout), CookieSecure: a.cfg.Session.CookieSecure,
-				Version: version.Version, Stats: collector, Socket: a.cfg.Socket,
+				Version: version.String(), Stats: collector, Socket: a.cfg.Socket,
 				BackupDir: a.cfg.Backup.Dir, BackupWarnAfter: time.Duration(a.cfg.Backup.WarnAfter),
+				Porkbun: pb, PorkbunAllows: a.cfg.Porkbun.Allows,
+				TOTPRequire: a.cfg.TOTP.Require, TOTPIssuer: a.cfg.TOTP.IssuerName(),
+				Metrics: server.Metrics{Enabled: a.cfg.Metrics.Enabled, Listen: a.cfg.Metrics.Listen,
+					Allow: a.cfg.Metrics.AllowPrefixes(), Token: a.cfg.Metrics.Token},
+				Certs: cm,
 				HTTPReq: server.HTTPReq{
 					Enabled:           a.cfg.ACME.HTTPReq.Enabled,
 					AllowPlainHTTP:    !a.cfg.ACME.HTTPReq.RequireHTTPS,
@@ -313,7 +350,9 @@ func serveCmd() *cobra.Command {
 				}
 			}()
 			go auditRetention(ctx, a)
-			a.log.Info("jarld starting", "version", version.Version, "database", a.cfg.Database, "bind_config", a.cfg.BIND.ConfigDir)
+			go blocklistLoop(ctx, a)
+			go cm.Run(ctx)
+			a.log.Info("jarld starting", "version", version.String(), "database", a.cfg.Database, "bind_config", a.cfg.BIND.ConfigDir)
 			err = srv.Serve(ctx, func() { sdNotify("READY=1\nSTATUS=serving") })
 			sdNotify("STOPPING=1")
 			a.log.Info("jarld stopped")
@@ -322,6 +361,33 @@ func serveCmd() *cobra.Command {
 	}
 }
 
+// blocklistLoop keeps blocklists up to date (docs/blocking.md): every few
+// minutes it downloads the lists that are due, and at once when a list
+// was added or changed. It also ends a pause of blocking on time.
+func blocklistLoop(ctx context.Context, a *app) {
+	select {
+	case <-ctx.Done():
+		return
+	case <-time.After(10 * time.Second): // let jarld finish starting
+	}
+	for {
+		a.eng.RefreshDue(ctx)
+		wait := 5 * time.Minute
+		if until := a.eng.ResumeBlocking(ctx); !until.IsZero() {
+			wait = min(wait, max(time.Until(until), time.Second))
+		}
+		t := time.NewTimer(wait)
+		select {
+		case <-ctx.Done():
+			t.Stop()
+			return
+		case <-t.C:
+		case <-a.eng.BlocklistKicks():
+			t.Stop()
+		}
+	}
+}
+
 func auditRetention(ctx context.Context, a *app) {
 	if a.cfg.Audit.RetentionDays <= 0 {
 		return
@@ -464,7 +530,7 @@ Jarl starts empty. Either import your existing BIND configuration with
 			return nil
 		},
 	}
-	cmd.Flags().StringVarP(&username, "user", "u", "admin", "administrator username")
+	cmd.Flags().StringVarP(&username, "user", "u", "admin", "the first administrator's username: best your own name, as each person should have their own account")
 	cmd.Flags().BoolVar(&stdin, "password-stdin", false, "read the password from standard input")
 	cmd.Flags().BoolVar(&withToken, "token", false, "also create an API token for the CLI")
 	cmd.Flags().StringSliceVar(&nameservers, "nameservers", nil, "default name servers for new zones (e.g. ns1.example.com.)")
@@ -610,6 +676,9 @@ func userCmd() *cobra.Command {
 				if !u.HasPassword {
 					flags = append(flags, "no password")
 				}
+				if u.HasTOTP() {
+					flags = append(flags, "2fa")
+				}
 				var gs []string
 				for _, g := range u.Grants {
 					gs = append(gs, auth.FormatGrant(g))
@@ -619,6 +688,40 @@ func userCmd() *cobra.Command {
 			return nil
 		},
 	}
-	cmd.AddCommand(add, passwd, token, list)
+	totpCmd := &cobra.Command{Use: "totp", Short: "Two-factor login of a user"}
+	totpReset := &cobra.Command{
+		Use:   "reset NAME",
+		Short: "Turn off a user's two-factor login (a lost phone without recovery codes)",
+		Long: `Turns off a user's two-factor login and deletes their recovery codes, and
+logs them out. They log in with the password alone next time; if
+totp.require applies to them, they must then set it up again before doing
+anything else. Works with jarld stopped too.`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			a, err := openApp(true)
+			if err != nil {
+				return err
+			}
+			defer a.close()
+			ctx := context.Background()
+			u, err := a.store.GetUserByName(ctx, args[0])
+			if err != nil {
+				return fmt.Errorf("user %s: %w", args[0], err)
+			}
+			if !u.HasTOTP() && u.TOTPPending == "" {
+				fmt.Printf("%s doesn't use two-factor login.\n", u.Username)
+				return nil
+			}
+			if err := a.store.DisableTOTP(ctx, u.ID); err != nil {
+				return err
+			}
+			a.store.DeleteUserSessions(ctx, u.ID, "")
+			a.eng.Audit(ctx, &auth.Principal{User: &model.User{Username: "local"}, Method: "local"}, "user.totp_reset", "user", u.ID, u.Username, "success", "jarld user totp reset")
+			fmt.Printf("Two-factor login of %s is off; they log in with the password and can set it up again under Account.\n", u.Username)
+			return nil
+		},
+	}
+	totpCmd.AddCommand(totpReset)
+	cmd.AddCommand(add, passwd, token, list, totpCmd)
 	return cmd
 }

deploy/systemd/jarl-backup.service

@@ -1,4 +1,5 @@
-# Jarl: one database backup, run daily by jarl-backup.timer.
+# Jarl: one database backup (with the DNSSEC keys), run daily by
+# jarl-backup.timer.
 # Installed as /etc/systemd/system/jarl-backup.service (see
 # docs/operations.md#backups). What to keep, and where, is in the backup:
 # section of /etc/jarl/jarl.yaml; when it runs is in jarl-backup.timer.
@@ -28,8 +29,12 @@ PrivateTmp=yes
 PrivateDevices=yes
 PrivateNetwork=yes
 NoNewPrivileges=yes
-CapabilityBoundingSet=
-AmbientCapabilities=
+# Read access to every file, and nothing else: named's DNSSEC private keys
+# (under /var/lib/bind/jarl/dnssec-keys) are readable only by named's user,
+# and the backup includes them. Everything outside the paths above stays
+# read-only (ProtectSystem=strict).
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH
+AmbientCapabilities=CAP_DAC_READ_SEARCH
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes

deploy/systemd/jarl.service

@@ -40,8 +40,10 @@ ProtectHome=yes
 PrivateTmp=yes
 PrivateDevices=yes
 NoNewPrivileges=yes
-CapabilityBoundingSet=
-AmbientCapabilities=
+# The only privilege jarld gets: listening on ports below 1024 (443 for the
+# web UI). Nothing else, and NoNewPrivileges still applies.
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes
@@ -53,7 +55,9 @@ RestrictRealtime=yes
 RestrictSUIDSGID=yes
 LockPersonality=yes
 MemoryDenyWriteExecute=yes
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+# AF_NETLINK lets jarld list this host's addresses, so its name server
+# checks know which addresses are its own.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 SystemCallArchitectures=native
 # @system-service includes @chown, which jarld needs to give files to group bind.
 SystemCallFilter=@system-service

docs/acme.md

@@ -1,5 +1,11 @@
 # Let's Encrypt (ACME DNS-01) with Jarl
 
+This page is about **other** ACME clients (certbot, acme.sh, lego,
+Traefik) publishing their DNS-01 challenges through Jarl. For
+certificates for the DNS server itself (Jarl's web UI, named's DNS over
+TLS and HTTPS), Jarl can be the ACME client: see
+[certificates.md](certificates.md).
+
 The DNS-01 challenge proves that you control a domain by publishing a TXT
 record at `_acme-challenge.<domain>`. Jarl does this through its API, so no
 dynamic updates (`allow-update`, nsupdate) are needed. That matters because

docs/api.md

@@ -10,6 +10,8 @@ what is documented here.
   (`www.adbraun.lol.`), and display helpers drop it (`display_name`,
   `relative_name`).
 * `GET /healthz` (no authentication) returns `{"ok": true, "version": ...}`.
+* `GET /metrics` serves Prometheus metrics when `metrics.enabled` is set.
+  Access is set in jarl.yaml, not with API tokens ([metrics.md](metrics.md)).
 
 ## Authentication
 
@@ -26,7 +28,27 @@ change something (anything but GET/HEAD) must send it as `X-CSRF-Token`.
 `POST /auth/logout` ends the session.
 
 `GET /auth/whoami` returns the user, the token (if any), the effective
-permissions and whether the caller is an administrator.
+permissions and whether the caller is an administrator. For sessions it
+also has `totp` (the user's two-factor login: `enabled`, `required`,
+`recovery_codes_left`) and `totp_setup_required`.
+
+**Two-factor login** ([permissions.md](permissions.md#two-factor-login)):
+for a user with it, `POST /auth/login` answers a correct password with
+`{"totp_required": true, "challenge": "..."}` and no cookie. Send
+`POST /auth/login/totp` with `{"challenge": "...", "code": "123456"}` (or
+a recovery code) within 5 minutes to get the session. Wrong codes answer
+401 `totp_invalid`; after 5, or 5 minutes, `login_expired` (start again).
+
+Creating or rotating tokens, changing users and resetting someone's
+two-factor login need, in a session of a user with two-factor login, a
+code proved in the last 5 minutes. Otherwise they answer 403
+`totp_step_up`: send the request again with the current code in
+`X-Jarl-TOTP: 123456` (a wrong one gives 403 `totp_invalid`). Tokens and
+the local socket never need one.
+
+When `totp.require` applies to a user who hasn't set it up, a session can
+only call `/auth/whoami`, `/auth/logout`, `/me/password` and `/me/totp...`;
+everything else answers 403 `totp_setup_required`.
 
 **The local socket**: on jarld's unix socket (`/run/jarl/jarl.sock`),
 requests from root or jarld's own user need no `Authorization` header and
@@ -90,7 +112,8 @@ on the resources below, except users and tokens) works the same way:
 
 Reads accept `?changeset=ID` too. They then show the configuration as it
 will be after the changeset, with `"pending": "add" | "change" | "delete"`
-on affected zones and records.
+on affected zones and records (`"disable"` or `"enable"` for a record
+that is only being disabled or enabled).
 
 The response of an applied change:
 
@@ -126,6 +149,14 @@ honours `If-Match: <version>`, and batch operations take `base_version`. If
 the object changed in the meantime the request fails with 409. Staged
 operations record the version they were staged against automatically.
 
+**Stale changesets.** When an object a staged operation needs was changed
+or deleted after it was staged (from the CLI, say), preview and apply fail
+on that operation: the error has `op` (its number in the changeset),
+`op_summary` and a message saying what happened; remove the operation
+(`DELETE /changesets/{id}/ops/{seq}`) or stage it again. A staged delete of
+a record that is already gone is not an error: it counts as done, with a
+warning.
+
 ## Resources
 
 `{zone}` is a zone ID or name (`root` for the root zone). Add `?view=NAME`
@@ -139,11 +170,19 @@ may be the name.
 | GET | `/zones` | `?view=`, `?type=`, `?q=` (name contains) |
 | POST | `/zones` | ZoneInput (below) |
 | GET | `/zones/{zone}` | |
-| PATCH | `/zones/{zone}` | ZoneInput (only the fields to change) |
+| PATCH | `/zones/{zone}` | ZoneInput (only the fields to change); `{"disabled": true}` disables the zone: named stops loading it, Jarl keeps it |
 | DELETE | `/zones/{zone}` | deletes the zone with its records and options |
 | GET | `/zones/{zone}/file` | the generated zone file (text/plain) |
 | GET | `/zones/{zone}/serials` | asks the zone's other name servers for their serial (below) |
 | GET | `/zones/{zone}/delegation` | checks the parent zone's delegation of a primary zone (below); `?resolver=IP` |
+| GET | `/zones/{zone}/dnssec` | the zone's DNSSEC keys, DS record and phase ([DNSSEC](#dnssec)) |
+| POST | `/zones/{zone}/dnssec/check-ds` | asks the parent for the zone's DS records and tells named; `?resolver=IP` |
+| POST | `/zones/{zone}/dnssec/wipe` | `{"force": false, "dry_run": false}`: signing off at once, keys deleted (administrators) |
+| GET | `/zones/{zone}/registrar` | name servers, glue and DS records at the registrar ([Registrar](#registrar-porkbun)) |
+| POST | `/zones/{zone}/registrar/glue` | create or update glue records |
+| PUT | `/zones/{zone}/registrar/ns` | set the domain's name servers |
+| POST | `/zones/{zone}/registrar/ds` | publish the zone's DS record |
+| DELETE | `/zones/{zone}/registrar/ds/{keytag}` | remove a DS record |
 | POST | `/zones/{zone}/import` | `{"text": "<zone file>", "mode": "merge"\|"replace", "use_soa": false, "dry_run": false}` |
 
 ZoneInput:
@@ -159,6 +198,7 @@ ZoneInput:
           "refresh": 3600, "retry": 900, "expire": 1209600, "minimum": 300},
   "default_ttl": 3600,
   "serial_policy": "date",            // date, increment, unixtime
+  "dnssec_policy": "default",         // primary zones: "" (off), "default", a custom policy, "insecure" (turning off)
   "comment": "",
   // create only:
   "nameservers": ["ns1.adbraun.lol."],                     // default: settings
@@ -191,25 +231,146 @@ when called ([operations.md](operations.md#checking-name-servers-and-the-delegat
 `error` (with `error`). `source` is `NS record`, `also-notify` or
 `primaries`; `port` is set for a non-default port.
 
+`/serials?stream=1` and `/delegation?stream=1` answer with
+newline-delimited JSON (`application/x-ndjson`) while they work, which is
+how the web UI shows a check's progress. Each DNS query is an event when it
+is sent and another when it is answered: `{"kind": "start", "id": 2,
+"query": "dig @192.0.2.1 example.org. SOA +norec"}`, then `{"kind": "end",
+"id": 2, "answer": "serial 2026100900", "rtt_ms": 12}`. `answer` sums the
+answer up (addresses, `referral to …`, `NXDOMAIN`, `no such record`);
+`error` replaces it when there was none. The serials check's SOA queries
+end with `result`, the `servers` entry, instead. ID 0 is `rndc zonestatus`,
+which asks this server's named. The last line is `{"kind": "done",
+"response": {...}}`, the endpoint's usual response.
+
 `/delegation` returns `parent`, `resolver`, `delegated`, `parent_ns`,
 `jarl_ns`, `parent_servers` (each parent server's `status`: `delegated`,
 `not_delegated`, `unreachable`, `error`, with `ns` and `glue`), `glue`
 (`name`, `parent`, `jarl`, `match`), `servers` (as above, for the delegated
 name servers) and `findings`: `{"level": "ok"|"info"|"warning"|"error",
 "message": "..."}`. A zone that isn't delegated gets one `info` finding.
+`parent_ds` lists the zone's DS records at the parent, and the findings
+compare them with the zone's keys (a DS that matches no key, or a DS for a
+zone that isn't signed, is an `error`).
+
+Zones in responses also carry `registrar` (`"porkbun"`) when Jarl can
+manage the domain at a registrar.
+
+#### DNSSEC
+
+Signing is the zone's `dnssec_policy` field, changed with `PATCH
+/zones/{zone}` like any other field, so it goes through validation,
+changesets and history. Jarl refuses unsafe steps there: `""` straight from
+a signed policy (use `"insecure"` first), `""` before named has finished
+removing the signatures, deleting a signed zone, or moving it to another
+view ([dnssec.md](dnssec.md#what-jarl-refuses-and-why)).
+
+`GET /zones/{zone}/dnssec`:
+
+```json
+{
+  "zone": "adbraun.lol.", "view": "external", "type": "primary",
+  "policy": "default",
+  "key_dir": "/var/lib/bind/jarl/dnssec-keys/view-3",
+  "keys": [{
+    "tag": 51126, "algorithm": 13, "algorithm_name": "ECDSAP256SHA256", "role": "CSK",
+    "dnskey": "adbraun.lol.\t3600\tIN\tDNSKEY\t257 3 13 ...",
+    "ds": {"key_tag": 51126, "algorithm": 13, "digest_type": 2, "digest": "FFBE...", "record": "adbraun.lol.\t3600\tIN\tDS\t51126 13 2 FFBE..."},
+    "goal": "omnipresent", "dnskey_state": "rumoured", "ds_state": "hidden",
+    "zone_rrsig_state": "rumoured", "key_rrsig_state": "rumoured",
+    "created": "...", "published": "...", "active": "...", "publish_cds": "...",
+    "files": ["Kadbraun.lol.+013+51126.key", "Kadbraun.lol.+013+51126.private", "Kadbraun.lol.+013+51126.state"]
+  }],
+  "phase": {
+    "code": "signing", "summary": "named is signing the zone. ...", "next": "Wait until ...",
+    "ds_ready_at": "...", "can_publish_ds": false, "can_finish": false
+  },
+  "named": {"secure": true, "inline_signing": true, "serial": 2026100802, "signed_serial": 2026100804, "next_key_event": "..."},
+  "policies": ["default"],
+  "parent_zone": "",          // set when the parent zone is a primary zone in Jarl
+  "registrar": "porkbun"      // when the DS can be published through Jarl
+}
+```
+
+`phase.code` is one of `off`, `leftover_keys`, `starting`, `signing`,
+`ready`, `ds_pending`, `secure`, `removing_ds`, `ds_expiring`,
+`removing_keys`, `unsigned` ([dnssec.md](dnssec.md#phases)).
+
+`POST /dnssec/check-ds` (zones write) returns `parent` (the parent's
+servers with their `ds`, the union `ds`, `delegated`, `reached`,
+`consistent`, or `error`), `marked` (what named was told, `rndc dnssec
+-checkds`), `notes` and the updated `status`.
+
+`POST /dnssec/wipe` (administrators) asks the parent first and answers
+`409` while it has a DS record for the zone, or while named still counts a
+removed one as cached; when the parent can't be asked, it needs `"force":
+true`. It returns `removed` (the files deleted) and `changeset_id`.
+
+#### Registrar (Porkbun)
+
+Administrators only, and only with a Porkbun key in jarl.yaml
+([dnssec.md](dnssec.md#porkbun)). `GET /zones/{zone}/registrar`:
+
+```json
+{
+  "registrar": "porkbun", "domain": "adbraun.lol",
+  "ns": ["curitiba.ns.porkbun.com", "fortaleza.ns.porkbun.com"], "jarl_ns": ["ns1.adbraun.lol", "ns2.adbraun.lol"],
+  "ns_match": false,
+  "glue": [{"host": "ns1.adbraun.lol", "registry": [], "jarl": ["203.0.113.1", "2001:db8::1"],
+            "needed": true, "in_use": false, "action": "create"}],
+  "ds": [{"key_tag": 51126, "algorithm": 13, "digest_type": 2, "digest": "FFBE...", "matches": true}],
+  "findings": [{"level": "warning", "message": "..."}],
+  "error": ""                 // e.g. "Porkbun: ... (API_ACCESS_DISABLED)"; the rest is then empty
+}
+```
+
+The changes take `{"force": false, "dry_run": false}` (`PUT /ns` also
+`"ns": [...]`, default the zone's NS records; `POST /ds` also `"key_tag"`)
+and answer:
+
+```json
+{"done": ["create glue for ns1.adbraun.lol: 203.0.113.1, 2001:db8::1"], "dry_run": false,
+ "checks": [{"level": "ok"|"info"|"warning"|"error", "message": "..."}], "warnings": []}
+```
+
+Each change runs its checks first: the name servers answer for the zone,
+glue matches, the DS points at a key the zone has, and the domain is
+delegated to servers that serve the signed zone before a DS is published. An
+`error` check refuses the change with `409` unless `force` is set; a dry run
+returns the checks without changing anything. Errors from Porkbun are `502
+registrar_error`.
 
 ### Records
 
+In a linked zone ([views.md](views.md#linked-zones)), records carry
+`shared_id` and `linked` (`shared` or `local`). Creating, updating
+(`PATCH /records/{id}`) and setting (`PUT .../rrsets/...`) take `"local":
+true` (this view only, an override) or `false` (shared; on an update or a
+set it makes this view's version every view's). Zones carry `link_group`
+and `linked_with` (the other views).
+
+| Method | Path | Body |
+|--------|------|------|
+| POST | `/zones/{zone}/link` | `{"with": ["external"]}` (default: every view with that zone). Names and types that are the same everywhere become shared, the rest stay local |
+| POST | `/zones/{zone}/unlink` | Takes the zone out of its link; its records stay, all local |
+
+`POST /zones` takes `"link_with": "VIEW"` to create a zone linked with
+that view's zone of the same name.
+
 | Method | Path | Body / query |
 |--------|------|--------------|
-| GET | `/zones/{zone}/records` | `?name=`, `?type=`, `?q=` |
+| GET | `/zones/{zone}/records` | `?name=`, `?type=`, `?q=`, `?disabled=1` (only disabled records) or `0` (only enabled ones) |
 | POST | `/zones/{zone}/records` | a RecordInput, or an array of them (one changeset) |
 | DELETE | `/zones/{zone}/records` | `?name=&type=[&data=][&missing_ok=1][&ptr=1]`: delete by match |
+| POST | `/zones/{zone}/records/disable` | same query as delete by match: disable the matching records |
+| POST | `/zones/{zone}/records/enable` | same query: enable them again |
 | PUT | `/zones/{zone}/rrsets/{name}/{type}` | `{"data": ["192.0.2.1", "192.0.2.2"], "ttl": 60, "comment": "..."}`: make the RRset exactly this |
 | DELETE | `/zones/{zone}/rrsets/{name}/{type}` | delete the whole RRset |
 | GET | `/records/{id}` | |
 | PATCH | `/records/{id}` | RecordInput fields to change (`If-Match` supported) |
 | DELETE | `/records/{id}` | `?ptr=1` also deletes the matching PTR |
+| POST | `/records/{id}/disable` | `?ptr=1` also disables the matching PTR |
+| POST | `/records/{id}/enable` | `?ptr=1` also enables the matching PTR |
 
 RecordInput:
 
@@ -220,12 +381,26 @@ RecordInput:
   "data": "192.0.2.10",        // zone file syntax; TXT/SPF take plain text
   "ttl": 300,                  // null or absent: the zone's default TTL
   "comment": "web server",
-  "ptr": true                  // A/AAAA: also create/move/delete the PTR in the reverse zone
+  "disabled": false,           // true: keep the record in Jarl but out of the zone
+  "ptr": true                  // A/AAAA: also create/move/delete (or disable/enable) the PTR in the reverse zone
 }
 ```
 
 Responses add `zone`, `view`, `relative_name`, `effective_ttl`, and `text`
-(the decoded value of TXT records).
+(the decoded value of TXT records). Zones have `disabled_count` when
+some of their records are disabled.
+
+**Disabled records** stay in Jarl, with their ID, TTL and comment, but are
+left out of the zone: the zone file lists them as comments (`; disabled:
+www IN A 192.0.2.10`). Disabling and enabling are ordinary changes (staged,
+reviewed, reverted like any other). Validation checks the zone as it is
+served, so disabling the zone's last NS record is refused, and enabling a
+record is checked as if it were added: a CNAME added at its name in the
+meantime stops it (and gives a `disabled_conflict` warning until then).
+`PUT /rrsets` makes the RRset exactly the given data: a disabled record
+with one of the values is enabled, other disabled records are left alone.
+Disabling a record that is already disabled is a 409; with `missing_ok=1`
+(by match) it's "nothing to do".
 
 ### Views
 
@@ -235,22 +410,61 @@ Responses add `zone`, `view`, `relative_name`, `effective_ttl`, and `text`
 | POST | `/views` | `{"name": "internal", "match_clients": ["homelab", "localhost"], "match_destinations": [], "match_recursive_only": null, "comment": "", "adopt_zones": true}` |
 | GET / PATCH / DELETE | `/views/{id}` | DELETE `?cascade=1` also deletes the view's zones |
 | POST | `/views/order` | `{"ids": [3, 1, 2]}` |
+| PUT | `/views/{id}/color` | `{"color": "green"}`; `""` for the default |
+| GET | `/views/{id}/key` | `{name, algorithm, secret}`: the TSIG key that selects the view (docs/views.md); needs `tsig:write`, audited |
 
 `adopt_zones` moves zones that are not in a view into the new view. named
 requires every zone to be in a view as soon as one view exists.
 
+`color` is how the web UI shows the view: one of `green`, `teal`,
+`purple`, `pink`, `orange`, `yellow`, `red` and `grey`. When it's left out,
+the view uses the link colour. It isn't part of the BIND configuration, so
+`PUT /views/{id}/color` applies at once and creates no changeset. It needs
+write access to the view, and it is logged in the audit log as
+`view.color`. To colour a view that so far exists only in a changeset,
+send the request with that changeset (`?changeset=` or
+`X-Jarl-Changeset`).
+
 ### ACLs and TSIG keys
 
 | Method | Path | Body |
 |--------|------|------|
 | GET | `/acls` | each with `used_by` |
-| POST | `/acls` | `{"name": "homelab", "elements": ["192.168.1.0/24", "!192.168.1.66", "key xfer", "localhost"], "comment": ""}` |
+| POST | `/acls` | `{"name": "homelab", "elements": ["192.168.1.0/24", "!192.168.1.66", "10.0.10.101-10.0.10.199", "key xfer", "localhost"], "comment": ""}` (ranges: [concepts.md](concepts.md#model-views-zones-records-options)) |
 | GET / PATCH / DELETE | `/acls/{id}` | renaming updates references; deleting one in use → 409 |
 | GET | `/tsig-keys` | without secrets |
 | POST | `/tsig-keys` | `{"name": "xfer", "algorithm": "hmac-sha256", "secret": "<base64>"}` (secret generated when absent; the response `object` shows it once) |
 | GET | `/tsig-keys/{id}` | `?secret=1` includes the secret (needs `tsig:write`, audited) |
 | PATCH / DELETE | `/tsig-keys/{id}` | PATCH `{"secret": "..."}` rotates |
 
+### Blocking
+
+Needs `blocking:read` (`blocking:write` to change). See
+[blocking.md](blocking.md).
+
+| Method | Path | Body / query |
+|--------|------|--------------|
+| GET | `/blocking/lists` | each with `views` (where it applies), `auto_views` (not chosen: every view that offers recursion), `state` (ok, waiting, error, disabled, idle), `status` (`entries`, `records`, `skipped`, `checked_at`, `updated_at`, `error`) and `memory_mb` (named's memory for it, estimated) |
+| POST | `/blocking/lists` | `{"name": "hagezi-multi", "url": "https://...", "views": ["internal"], "comment": "", "step": "normal"}` (`views` empty or absent: automatic; `step` the blocking step it starts at); jarld downloads it right after |
+| GET / PATCH / DELETE | `/blocking/lists/{id or name}` | PATCH any of `name`, `url`, `views`, `disabled`, `comment` |
+| POST | `/blocking/lists/{id or name}/refresh` | download now and wait; `?force=1` even when the server says nothing changed. Returns the list; a failed update is in `state` and `status.error` |
+| GET | `/blocking/rules` | each with `views` and `auto_views` |
+| POST | `/blocking/rules` | `{"name": "doubleclick.net", "action": "block", "exact": false, "views": [], "comment": ""}` (`action` block or allow; `exact`: only the name, not the names below it) |
+| PATCH / DELETE | `/blocking/rules/{id}` | |
+| DELETE | `/blocking/rules` | `?name=DOMAIN[&view=V][&missing_ok=1]`: the rules for a domain |
+| GET | `/blocking/check` | `?name=DOMAIN`: per view with blocking, `{view, result: blocked\|allowed\|none, entry, rule_id, list, step}` (what applies to normal devices when blocking isn't paused; `step` when only devices at that step or above are blocked) |
+| GET / POST | `/blocking/steps` | the steps above normal, lowest first, with the `lists` and `groups` at each; POST `{"name": "strict", "comment": ""}` adds one on top |
+| PATCH / DELETE | `/blocking/steps/{id or name}` | `{"name", "position", "comment"}`; delete is refused while lists or groups use it |
+| POST | `/blocking/steps/order` | `{"steps": ["strict", "very-strict"]}`: every step above normal, lowest first |
+| GET / POST | `/blocking/groups` | client groups; POST `{"name": "kids", "members": ["10.10.0.50", "tablets"], "step": "strict", "views": []}` |
+| PATCH / DELETE | `/blocking/groups/{id or name}` | the same fields |
+| GET | `/blocking/status` | `{paused_until, paused_indefinitely}` (null and false when not paused) |
+| POST | `/blocking/pause` | `{"minutes": 15}` (1 to 1440): let every name through until then; jarld resumes by itself. `{"indefinitely": true}`: until resumed |
+| POST | `/blocking/resume` | end a pause now |
+
+Lists and rules are configuration like the rest: they can be staged, and
+listing with `?changeset=` marks them `pending`.
+
 ### Options and settings
 
 | Method | Path | Body / query |
@@ -261,7 +475,9 @@ requires every zone to be in a view as soon as one view exists.
 | GET / PATCH | `/settings` | `{"nameservers": [...], "rname": "...", "default_ttl": 3600, "refresh": ..., "retry": ..., "expire": ..., "negative_ttl": ..., "serial_policy": "date"}` |
 
 Option values are named.conf syntax without the final semicolon. They are
-checked against the BIND 9.20 grammar for that scope.
+checked against the BIND 9.20 grammar for that scope. `position` only
+orders top-level statements; the options of a block are always listed and
+written in Jarl's fixed order (docs/concepts.md).
 
 ### Catalogs and search
 
@@ -270,6 +486,8 @@ checked against the BIND 9.20 grammar for that scope.
 | GET | `/catalog/options` | scopes and zone types; with `?scope=options\|view\|toplevel\|zone:primary\|...` every statement allowed there (name, grammar, kind, status, ARM description). `?all=1` includes statements Jarl manages itself |
 | GET | `/catalog/rrtypes` | record types with field hints and examples |
 | GET | `/catalog/grants` | resources, roles and the grant syntax |
+| GET | `/exposure` | which views are reachable from the internet, the exposure findings and their fixes ([exposure.md](exposure.md#api)); `POST /exposure/fix`, `/exposure/ack`, `/exposure/unack` |
+| GET | `/catalog/ranges?r=A-B,C-D` | for each address range: `range` (canonical), `size` ("99 addresses"), and the `prefixes` it is written to named.conf as; or `error`. Text that isn't a range is left out |
 | GET | `/search?q=text` | zones, records and ACLs matching the text |
 
 ### Changesets
@@ -295,12 +513,16 @@ An **Operation** is `{"op": "...", "id": 0, "base_version": 0, "data": {...}}`:
 | `record.create` | | RecordInput + `"zone": "adbraun.lol"` (or `zone_id`) and `"view"` |
 | `record.update` | record | RecordInput |
 | `record.delete` | record, or 0 with `zone`, `name`, `type`, optional `data`, `missing_ok`, `ptr` | |
+| `record.disable` / `record.enable` | record, or 0 with the same match fields as `record.delete` | stored as `record.update` operations |
 | `rrset.replace` | | `{"zone", "view", "name", "type", "ttl", "data": [...]}` (empty data deletes the RRset) |
 | `view.create` / `view.update` / `view.delete` / `view.reorder` | view (update/delete) | ViewInput / `{"ids": [...]}` |
 | `acl.create` / `acl.update` / `acl.delete` | ACL | ACL fields |
 | `tsig.create` / `tsig.update` / `tsig.delete` | key | key fields |
 | `option.create` / `option.update` / `option.delete` | option | option fields |
 | `settings.update` | | settings fields |
+| `blocklist.create` / `blocklist.update` / `blocklist.delete` | blocklist (update/delete) | list fields; views as `views` (names) or `view_ids` |
+| `blockrule.create` / `blockrule.update` / `blockrule.delete` | rule (update/delete) | rule fields, likewise |
+| `blocking.pause` | | `{"until": "2026-10-10T15:04:05Z"}`, `{"indefinitely": true}`, or `{}` to resume |
 
 Operations later in a batch can refer to objects created earlier in it by
 name (zone and view names). One request can therefore create a view, a zone
@@ -310,7 +532,7 @@ in it and its records.
 
 | Method | Path | Notes |
 |--------|------|-------|
-| GET | `/status` | named status, adoption, drift, open changesets, current problems, object counts; `expiring_tokens` (tokens that expire within 14 days or expired in the last 14: all for administrators, otherwise the caller's); `backup` (administrators: `last_at`, `last_file`, `last_size`, `last_error`, `last_error_at`, `dir`, `warn_after` in seconds, `stale`) |
+| GET | `/status` | named status, adoption, drift, open changesets, current problems, object counts; `expiring_tokens` (tokens that expire within 14 days or expired in the last 14: all for administrators, otherwise the caller's); `backup` (administrators: `last_at`, `last_file`, `last_size`, `last_error`, `last_error_at`, `dir`, `warn_after` in seconds, `stale`); `blocklist_errors` (with `blocking:read`: lists whose last update failed, `{name, error, updated_at}`); `blocking_paused_until` or `blocking_paused_indefinitely` (with `blocking:read`, while paused). `problems` include named-checkconf's warnings about the running configuration (`named_warning`) |
 | POST | `/system/check` | validation + named-checkconf of the current configuration (`options:read`) |
 | POST | `/system/resync` | `{"dry_run": false, "force": false}`: rewrite every file from the database and reload (admin) |
 | GET | `/audit` | `?user=&action=&outcome=&object_type=&changeset=&q=&since=&until=&limit=200&before=ID` |
@@ -323,16 +545,34 @@ Needs `stats:read`. When statistics are disabled, every endpoint but
 | Method | Path | Query | Returns |
 |--------|------|-------|---------|
 | GET | `/stats/status` | | `{enabled, query_log, statistics_channel, log_file, last_poll, last_log_line, log_lines_read, first_data, retention, warnings}` |
-| GET | `/stats/summary` | `since` (90m, 24h, 7d, 2w; default 24h), `top` (default 10) | totals, `avg_qps`, `peak`, `rcodes`, `qtypes`, `views`, `zones`, `answers`, `transport`, `cache_hit_ratio`, `nxdomain_ratio`, `tops` |
+| GET | `/stats/summary` | `since` (90m, 24h, 7d, 2w; default 24h), `top` (default 10) | totals, `avg_qps`, `peak`, `rcodes`, `qtypes`, `views`, `zones`, `answers`, `transport`, `cache_hit_ratio`, `nxdomain_ratio` (without blocked answers), `blocked`, `blocked_ratio`, `blocklists` (blocked per list; `rules` for your rules), `tops` |
 | GET | `/stats/timeline` | `since`, `step` (auto, 1m, 5m, 15m, 1h, 6h, 1d), `key` (repeatable or comma separated; `rcode:*` = every counter of a group; default `queries`) | `{step, times: [unix...], series: [{key, values}]}` |
-| GET | `/stats/top` | `kind` (name, client, nxdomain, servfail, refused), `since`, `limit` (default 20) | `[{key, count}]` |
+| GET | `/stats/top` | `kind` (name, client, nxdomain, servfail, refused, blocked, blocked_client), `since`, `limit` (default 20) | `[{key, count}]`; client, refused and blocked_client entries add `name`, the host name of Jarl's record for the address (the summary's client list too) |
 | GET | `/stats/heatmap` | `since` (default 28d), `key` (default queries) | `{key, from, avg[7][24], samples[7][24]}`, Monday first, local time, `-1` = no data |
-| GET | `/stats/breakdown` | `group` (qtype, rcode, view, zone, answer, transport, rtt, dnssec, cache, ratelimit), `since` | `[{key, count}]` |
+| GET | `/stats/server` | | `{server: {rss, mem_in_use, cpu_percent, threads, pid, cache_rrsets, cache_mem, sockets_udp, sockets_tcp, recursion_highwater, tcp_highwater, version, boot_time, config_time, host: {mem_total, mem_available, load, cpus, uptime}}, named: {recursive_clients, tcp_clients, zones, cpus, worker_threads}, disks: [{path, holds, total, free}]}`; gauges over time: `/stats/timeline?key=g:named:rss` (averages, -1 without a sample) |
+| GET | `/stats/breakdown` | `group` (qtype, rcode, view, zone, answer, transport, rtt, dnssec, cache, ratelimit, blocklist), `since` | `[{key, count}]` |
 
 ```sh
 curl -sf -H "$AUTH" "$API/stats/top?kind=nxdomain&since=7d&limit=10" | jq -r '.[] | "\(.count)\t\(.key)"'
 ```
 
+### Certificates
+
+Administrators only. See [certificates.md](certificates.md#api).
+
+| Method | Path | Body |
+|--------|------|------|
+| GET | `/certificates` | `certificates` (with `status`, `next_attempt`, `issuing_since`, `serving`, `files`) and `account` |
+| POST | `/certificates` | `{"name", "domains", "uses", "challenge", "key_type", "comment"}`, or `{"name", "source": "file", "cert_file", "key_file", "uses"}`; `"issue": false` doesn't start obtaining it |
+| POST | `/certificates/check` | `{"domains", "challenge"}`: the route of each challenge |
+| GET, PATCH, DELETE | `/certificates/{name}` | |
+| POST | `/certificates/{name}/issue` | 202: being obtained (poll until `issuing_since` is gone); a file certificate is reread (200) |
+| POST | `/certificates/{name}/check` | the routes of a certificate's names |
+
+`GET /status` includes `certificates` for administrators: `total`,
+`problems` (failing, expiring, expired), `next` and `next_after`,
+`serving`.
+
 ### ACME: lego's httpreq provider
 
 Off unless `acme.httpreq.enabled` is set, and by default HTTPS only. The
@@ -354,13 +594,19 @@ Success is `200 {"ok": true, "fqdn": ..., "changeset_id": ..., "zones": [...]}`.
 |--------|------|------|
 | GET | `/users` | admin |
 | POST | `/users` | `{"username": "alice", "password": "...", "admin": false, "role": "dns-editor", "grant_strings": ["records:write zones=lab.adbraun.lol"], "comment": ""}` (`password: ""` = service account) |
-| GET / PATCH / DELETE | `/users/{id}` | PATCH also takes `disabled` |
+| GET / PATCH / DELETE | `/users/{id}` | PATCH also takes `disabled`, and `username` to rename. Users have `totp_enabled_at` (two-factor login on since) and `totp_required` |
 | GET / POST | `/users/{id}/tokens` | admin (or yourself) |
 | GET / POST | `/me/tokens` | `{"name": "laptop", "role": "", "grant_strings": [...], "expires_in": "90d"}`. The response's `token` field is the secret, shown once |
 | GET | `/tokens` | every token (admin); `?all=1` includes revoked tokens |
 | DELETE | `/tokens/{id}` | revoke |
 | POST | `/tokens/{id}/rotate` | New secret, same token. Optional body `{"grace": "1h", "expires_in": "90d", "expires_at": "...", "no_expiry": false}`. The response's `token` field is the new secret, shown once; `previous_secret_valid_until` says when the old one stops. A restricted token may rotate itself and tokens no wider than itself |
 | POST | `/me/password` | `{"current_password": "...", "password": "..."}` (sessions only) |
+| GET | `/me/totp` | Your two-factor login: `enabled`, `enabled_at`, `required`, `recovery_codes_left`, `policy` |
+| POST | `/me/totp/setup` | `{"password": "..."}` (sessions only). A new secret: `secret`, `uri` (`otpauth://`), `qr` (an SVG `data:` URI), `issuer`, `account`. Not active until confirmed. With two-factor login already on (a new phone), it needs a recent code |
+| POST | `/me/totp/enable` | `{"code": "123456"}`: confirms the secret from setup. Returns `{"recovery_codes": [...]}`, shown once, and logs out your other sessions |
+| POST | `/me/totp/disable` | `{"password": "...", "code": "..."}` (a code or a recovery code). Refused (409) while `totp.require` applies to you |
+| POST | `/me/totp/recovery-codes` | New recovery codes, replacing the old ones (needs a recent code) |
+| DELETE | `/users/{id}/totp` | admin: turn off someone's two-factor login, delete their recovery codes and end their sessions |
 
 User and token changes take effect immediately. They are not changesets,
 because they don't touch named, but they are audited.

docs/blocking.md

@@ -0,0 +1,331 @@
+# Blocking
+
+Jarl can make named answer "this name doesn't exist" (NXDOMAIN) for ads,
+trackers and malware, like Pi-hole does, for every device that uses your
+server to resolve names. It has two parts:
+
+- **Blocklists**: lists of domains published by others, which jarld
+  downloads and keeps up to date.
+- **Your rules**: domains you block or allow yourself. They take precedence
+  over every list.
+
+It uses BIND's own mechanism for this, response policy zones (RPZ), so named
+does the blocking itself; jarld only prepares the lists.
+
+- [Quick start](#quick-start)
+- [Where blocking applies](#where-blocking-applies)
+- [Your rules](#your-rules)
+- [Blocklists](#blocklists)
+- [Checking a name](#checking-a-name)
+- [Pausing](#pausing)
+- [Statistics](#statistics)
+- [Memory and performance](#memory-and-performance)
+- [How it works](#how-it-works)
+- [Troubleshooting](#troubleshooting)
+
+## Quick start
+
+In the web UI, open **Blocking**, pick one of the well-known lists, and
+click **Add list**. Or with the CLI:
+
+```sh
+jarl blocklist add hagezi-multi https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/multi.txt
+jarl blocklist list                     # "ok" once downloaded, usually within seconds
+jarl block check ads.doubleclick.net    # blocked? by what?
+jarl block allow cdn.example.com        # something you need was blocked
+```
+
+Like every change in Jarl, adding a list or rule can be staged and reviewed
+first (the web UI does this by default: apply it under **Changes**).
+
+## Where blocking applies
+
+Blocking changes the answers named gives when it resolves names for a
+client (recursion). It doesn't change what the internet sees of your own
+zones: other resolvers ask your server without recursion.
+
+**Views.** A list or rule applies to the views you choose, or by default
+to every view that offers recursion. With the usual split (an `internal`
+view that resolves for your network, an `external` view that only answers
+for your zones) that is just `internal`. A view that doesn't offer
+recursion gets nothing, and naming one gives a warning. Without views,
+blocking applies to the whole server.
+
+**What it can't do:**
+
+- Devices that don't use your server for DNS aren't affected. That includes
+  browsers using their own DNS over HTTPS, and devices with a hard-coded
+  resolver (8.8.8.8). A firewall rule that sends port 53 to your server, and
+  your network's DNS settings, are the usual answers.
+- A device that validates DNSSEC itself sees a blocked name as a
+  validation failure rather than "doesn't exist". It's still blocked.
+- A list can contain names in your own zones. They are blocked like any
+  other; allow them with a rule if that's not what you want.
+
+## Your rules
+
+A rule **blocks** or **allows** a domain and every name below it, or with
+`--exact` (web UI: "only this exact name") just the domain itself.
+
+```sh
+jarl block add doubleclick.net                       # doubleclick.net and everything below it
+jarl block add telemetry.example.com --exact         # just that name
+jarl block allow cdn.example.com --view internal     # an exception, in one view
+jarl block list
+jarl block delete doubleclick.net                    # or: --id ID
+```
+
+**Precedence:** your rules come before every blocklist, and among your
+rules the most specific one wins. With these rules:
+
+| Rule | |
+|------|-|
+| block `example.com` | and below |
+| allow `cdn.example.com` | exact |
+
+`example.com` and `www.example.com` are blocked, `cdn.example.com` is
+allowed, and `img.cdn.example.com` is blocked again (the allow rule was for
+the exact name). An allow rule beats a blocklist entry whatever the lists
+say.
+
+There is one rule per domain and view; a second one is refused. A rule
+takes effect as soon as the change is applied.
+
+## Blocklists
+
+**Formats.** Lists are read line by line; one list may mix formats:
+
+| Line | Blocks |
+|------|--------|
+| `\|\|ads.example^` (Adblock) | the name and every name below it |
+| `*.ads.example` | the name and every name below it |
+| `0.0.0.0 ads.example` (hosts file, any address) | just the name |
+| `ads.example` (plain domain) | just the name |
+
+Comments (`#`, `!`), headers and blank lines are ignored. Lines that DNS
+can't act on are skipped and counted: Adblock exceptions (`@@`), cosmetic
+and URL rules, addresses, invalid names, and single labels (a broken list
+can't block `com`). Prefer lists in Adblock format: they say which entries
+cover the names below them.
+
+**Well-known lists** (sizes in October 2026; they change):
+
+| List | URL | Domains | Memory per view |
+|------|-----|--------:|----------------:|
+| Hagezi Light | `https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/light.txt` | 55,000 | ~65 MB |
+| Hagezi Multi Normal | `https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/multi.txt` | 159,000 | ~190 MB |
+| Hagezi Pro | `https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt` | 195,000 | ~235 MB |
+| OISD Small | `https://small.oisd.nl/` | 58,000 | ~70 MB |
+| OISD Big | `https://big.oisd.nl/` | 241,000 | ~290 MB |
+| StevenBlack hosts | `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts` | 73,000 | ~45 MB |
+
+One good list is usually enough; lists overlap a lot. Hagezi Multi Normal
+is a balanced start; Light and OISD Small block less but almost never
+something you need.
+
+**Updates.** jarld checks each list every `blocking.refresh` (a day by
+default) and downloads it only when the server says it changed. A new
+version is checked with `named-checkzone` and replaces the old one only
+when its content differs; named then reloads it. If a download or check
+fails, named keeps using the previous version, jarld tries again within
+the hour, and the dashboard shows the error. To update now:
+
+```sh
+jarl blocklist refresh              # every list; or: refresh hagezi-multi [--force]
+```
+
+**Managing lists:**
+
+```sh
+jarl blocklist update hagezi-multi --view internal     # --view auto: every view with recursion
+jarl blocklist update hagezi-multi --url URL --name NEW-NAME
+jarl blocklist disable hagezi-multi                    # stop using it, keep it (enable: back without a download)
+jarl blocklist delete hagezi-multi
+```
+
+A list's state is **ok** (in use), **waiting** (not downloaded yet),
+**error** (the last update failed; the previous version stays in use),
+**disabled**, or **idle** (it applies to no view, so it does nothing).
+
+## Different blocking for different devices
+
+Client groups give some devices less or more blocking than the rest, like
+Pi-hole's groups: no blocking for a work laptop, an extra list for the
+kids' tablets.
+
+**Steps** decide which lists a device gets. Each step includes the lists
+of the steps below it, plus its own:
+
+| Step | Gets |
+|------|------|
+| `off` (built in) | only your rules |
+| `normal` (built in) | your rules and the normal lists; every device not in a group |
+| `strict` (one you add) | normal, plus the lists at step `strict` |
+| `very-strict` (one you add) | strict, plus the lists at step `very-strict` |
+
+Every list starts at a step (normal unless you choose one), and every
+group is at a step. Your rules apply at every step, `off` included.
+
+```sh
+jarl block step add strict
+jarl blocklist update social-media --step strict
+jarl block group add work 10.10.0.20 --step off
+jarl block group add kids 10.10.0.50 10.10.0.51 2001:db8:1::/64 --step strict
+jarl block group list
+```
+
+In the web UI, the Blocking page's **Devices** panel holds the steps and
+the groups, and each list has a step.
+
+- **Members** are addresses, networks (`10.10.0.0/24`), ranges
+  (`10.10.0.20-10.10.0.49`), or ACLs made only of those (`key`, `localnets` and `!` can't be used: blocking matches
+  clients by address). A device is in one group: two groups with the same
+  address are refused, but a more specific address in another group wins
+  (`10.10.0.0/24` in one group, `10.10.0.20` in another).
+- **Steps only add.** A group gets everything up to its step, so "kids get
+  list A, guests get list B, and neither gets the other's" can't be done
+  with steps. That needs a view per group, each with its own lists (and
+  their memory).
+- Lists aren't copied per step: each is loaded once, and the steps cost a
+  small zone each. Lists at a step no group reaches block nothing (Jarl
+  warns, and shows them as "no effect").
+- named must see the device's own address. When a router hands out itself
+  as DNS server and forwards to named, every query comes from the router,
+  and groups can't tell devices apart. Devices also need fixed addresses
+  (DHCP reservations); IPv6 privacy addresses change, so add a device's
+  network, or rely on its IPv4 address.
+- `jarl block check NAME` (and the Blocking page) answers for normal
+  devices, and says when a list of a higher step blocks the name.
+
+## Checking a name
+
+`jarl block check NAME`, or the box at the top of the Blocking page, says
+for each view whether a name is blocked or allowed, and by which rule or
+list entry:
+
+```
+$ jarl block check img.ads.example.com
+view internal:  blocked by blocklist hagezi-multi (entry *.ads.example.com)
+view guest:     allowed by your rule 12 (entry *.ads.example.com)
+```
+
+Views without blocking aren't listed.
+
+In the web UI a blocked name gets an **Allow** button, and the statistics'
+most blocked names link to this check.
+
+## Pausing
+
+To see whether blocking is what breaks a site, pause it: every name is
+answered normally until the time is up (at most a day), then blocking
+resumes by itself, also if jarld was restarted in between. A pause can
+also last until someone resumes blocking (like Pi-hole's "indefinitely").
+
+```sh
+jarl block pause          # 10 minutes; or: jarl block pause 1h
+jarl block pause indefinitely
+jarl block resume         # end it now
+```
+
+In the web UI, **Pause blocking** is at the top of the Blocking page (with
+**Until I resume** among the lengths), and the dashboard says while
+blocking is paused. The lists stay loaded (the
+rules zone just lets everything through), so pausing and resuming take
+effect within a second. Pausing and resuming are recorded in the history
+like other changes.
+
+## Statistics
+
+With [query statistics](stats.md) on (including `query_log`), Jarl counts
+what blocking does: blocked queries over time (next to all queries) and
+as a share of them, which rules and lists blocked them, the most blocked
+names, and the clients with the most blocked queries (`jarl stats summary`,
+`jarl stats top blocked`, `jarl stats top blocked-clients`, `jarl stats
+breakdown blocklist`). Blocked answers are left out of the NXDOMAIN figures, which
+are about names that really don't exist.
+
+The Blocking page shows the last 24 hours too: a **Blocked (24h)** column
+for each list, and one count for your rules together (named logs which
+policy zone matched, not which rule in it).
+
+Without statistics named doesn't log what it blocks at all.
+
+## Memory and performance
+
+**Memory** is the cost to watch. named keeps each list in memory, once per
+view it applies to: about 0.6 KB per policy record (an Adblock entry is
+two records: the name, and the names below it). The Blocking page and
+`jarl blocklist list` show the estimate per list. Hagezi Pro in one view
+took named from 25 MB to 260 MB in a test with BIND 9.20; while a list
+reloads, the old and new versions briefly coexist.
+
+**Answers aren't slowed**: named looks blocked names up in memory, and
+answers them without asking the internet.
+
+**Updating a list** (Hagezi Pro: download, parse, check) takes jarld about
+2 seconds. While named loads the new version, the queries that the loading
+thread would have answered wait, up to half a second; this only happens
+when the list changed, at most once per `blocking.refresh`.
+
+**Other changes are unaffected**: the lists' contents never go through
+Jarl's apply, so adding a record takes as long with a list as without.
+
+Downloads are limited by `blocking.max_download_mb` and
+`blocking.max_entries` ([configuration.md](configuration.md#blocking)).
+
+## How it works
+
+For each view (or the server, without views) Jarl writes a
+`response-policy` statement and the policy zones it lists, in this order:
+
+```
+response-policy {
+	zone "rules.jarl.invalid" min-update-interval 0;              # your rules
+	zone "hagezi-multi.blocklist.jarl.invalid" min-update-interval 0;
+} qname-wait-recurse no break-dnssec yes;
+```
+
+- Policy zones are named under `.invalid`, so they can't clash with real
+  zones (zone names under `jarl.invalid` are refused). They allow no
+  queries or transfers.
+- The rules zone of each view is a file next to your zone files
+  (`/var/lib/bind/jarl/VIEW/rules.jarl.invalid.rpz`) and shows up in the
+  changeset diff like any other.
+- A list's file is `/var/cache/bind/jarl/blocklists/list-ID.rpz`, shared by
+  the views that use it. Until the first download it is an empty policy
+  zone, so named always starts. Files of deleted lists are removed.
+- `qname-wait-recurse no` blocks without first resolving the real answer;
+  `break-dnssec yes` also blocks for clients that ask for DNSSEC data;
+  `min-update-interval 0` applies a new version at once.
+- named looks names up in a policy zone like in any zone, so a wildcard
+  doesn't apply below a name the zone also contains. Jarl writes the zones
+  so that the most specific rule still wins.
+- A `response-policy` option of your own can't be combined with Jarl's
+  blocking in the same view: Jarl refuses the change and says so.
+- Rewrites are logged to Jarl's response log when statistics read it, and
+  not at all otherwise.
+- With client groups, a **gate** zone stands in front of the lists of each
+  step: `off.gate.jarl.invalid` before the normal lists,
+  `STEP.gate.jarl.invalid` before a step's. named checks the zones in
+  order and the first match decides; a gate matches the devices below its
+  step by address (`rpz-client-ip` triggers) with `rpz-passthru`, so they
+  never reach the lists behind it. A gate is never logged, and its file is
+  next to the rules zone (`/var/lib/bind/jarl/VIEW/strict.gate.jarl.invalid.rpz`).
+  For "everyone except these devices", a gate lists the address ranges
+  around them, at most a few hundred entries. named matches IPv4 clients as
+  IPv4-mapped IPv6 addresses, so the IPv6 part leaves `::ffff:0:0/96` out.
+
+Lists and rules need the `blocking` permission ([permissions.md](permissions.md)).
+
+## Troubleshooting
+
+- **"no domains found in N lines"**: the URL didn't return a list (often an
+  HTML error page). Check it in a browser.
+- **A list has no effect / is "idle"**: no view it applies to offers
+  recursion. Pick the view your devices use (`--view internal`).
+- **Something is still answered**: `jarl block check NAME` shows whether
+  Jarl blocks it. If it does, the device probably doesn't use your server
+  (DNS over HTTPS, another resolver), or has the answer cached for a
+  while.
+- **Something you need is blocked**: `jarl block check NAME` shows which
+  list; `jarl block allow NAME` overrides it.

docs/certificates.md

@@ -0,0 +1,252 @@
+# TLS certificates
+
+Jarl can obtain TLS certificates from an ACME CA (Let's Encrypt by
+default) and renew them itself, and put them where they are used:
+
+- **web**: jarld's own HTTPS (the web UI, the API and the CLI's server).
+- **dns**: files named can read, for DNS over TLS (DoT) and DNS over HTTPS
+  (DoH) in named's `tls` blocks.
+
+One certificate can have both uses. Jarl answers the ACME DNS-01
+challenge itself: in a zone it serves, or through Porkbun's API while
+Porkbun still serves the domain. So no other ACME client, hook script or
+DNS provider plugin is needed, and the server doesn't have to be
+reachable on port 80 or 443 from the internet.
+
+A certificate you renew some other way (certbot, acme.sh, your own CA)
+can be used too: Jarl reads it from its files and rereads it when they
+change.
+
+In the web UI: **Certificates** (administrators). In the CLI: `jarl cert`.
+In the API: `/api/v1/certificates`. All of it is for administrators only:
+a certificate's key can impersonate your server.
+
+## Quick start
+
+1. Set up the ACME account in `/etc/jarl/jarl.yaml` and restart jarld
+   (`systemctl restart jarl`). Try Let's Encrypt's staging CA first: its
+   certificates aren't trusted by browsers, but its rate limits are
+   generous, so mistakes cost nothing.
+
+   ```yaml
+   acme:
+     account:
+       directory: letsencrypt-staging   # then: letsencrypt
+       email: you@adbraun.lol           # optional
+       agree_tos: true                  # after reading https://letsencrypt.org/repository/
+   ```
+
+2. See where the challenges would go, without asking the CA for anything:
+
+   ```sh
+   jarl cert check --domain ns1.adbraun.lol
+   ```
+
+   ```
+   NAME             ROUTE    RECORD                           WHY
+   ns1.adbraun.lol  porkbun  _acme-challenge.ns1.adbraun.lol  adbraun.lol is served by Porkbun (curitiba.ns.porkbun.com, ...), so the record goes in through Porkbun's API
+   ```
+
+3. Create the certificate. Jarl obtains it at once; the command waits for
+   the outcome (usually under a minute, a few minutes through Porkbun):
+
+   ```sh
+   jarl cert create ns1 --domain ns1.adbraun.lol --use web --use dns
+   ```
+
+4. When it works, switch `directory` to `letsencrypt`, restart jarld and
+   renew: `jarl cert issue ns1`.
+
+From then on jarld renews it by itself.
+
+## The ACME account
+
+| Setting | Default | |
+|--|--|--|
+| `acme.account.directory` | `letsencrypt` | `letsencrypt`, `letsencrypt-staging`, or the directory URL of another ACME CA (ZeroSSL, Google, step-ca, ...). |
+| `acme.account.email` | `""` | Contact address for the CA (optional; Let's Encrypt no longer sends expiry mails). |
+| `acme.account.agree_tos` | `false` | You accept the CA's terms of service. Jarl registers no account without it, and says so. |
+| `acme.account.eab_kid`, `eab_hmac` | `""` | External Account Binding, for CAs that need it (ZeroSSL, Google): from the CA's dashboard. |
+| `acme.resolvers` | `1.1.1.1:53`, `9.9.9.9:53`, `8.8.8.8:53` | Recursive resolvers Jarl uses to see a domain as the CA does (below). |
+| `acme.ca_bundle` | `""` | A PEM file of extra CA certificates to trust when talking to the ACME server (a private CA). |
+| `acme.check_propagation` | `true` | Before telling the CA to look, wait until every name server of the zone serves the challenge (asked directly on port 53). |
+| `certificates.dir` | `<bind.config_dir>/tls` | Where certificates with the dns use are written for named. |
+
+The account is registered with the first certificate, and its key is
+kept in Jarl's database. Changing `directory` registers a new account with
+that CA; changing `email` updates the account.
+
+## Where the challenge goes
+
+For each name on a certificate, the CA looks up a TXT record at
+`_acme-challenge.<name>` (a wildcard `*.example.com` uses
+`_acme-challenge.example.com`). Jarl first looks the name up the way the
+CA will, through `acme.resolvers` (public resolvers, not this server,
+which may answer from an internal view), following a CNAME on
+`_acme-challenge` if there is one. Then it finds the zone that holds the
+record on the internet and that zone's public name servers:
+
+| The zone's public name servers | Route | Jarl writes the record |
+|--|--|--|
+| Porkbun's (`*.ns.porkbun.com`), with `porkbun.api_key` set | `porkbun` | through Porkbun's DNS API (TTL 600, Porkbun's minimum), and deletes it afterwards. The key is the one the registrar features use ([configuration.md](configuration.md#porkbun-registrar-and-dns-host)); it needs DNS record write access, "API Access" switched on for the domain, and the domain in `porkbun.domains` if you set that |
+| the name servers in Jarl's own zone of that name | `jarl` | in that zone, in every view that has it, as a change by `system` (in the history) |
+| anything else | none | nowhere: the certificate fails with what to do |
+
+The certificate's `challenge` setting chooses:
+
+- **`auto`** (the default) decides again at **every** issue and renewal.
+  While Porkbun serves `adbraun.lol`, the challenge goes to Porkbun. Once
+  you point the domain's name servers at your own servers, the next
+  renewal writes into Jarl's zone instead. Nothing needs changing.
+- **`jarl`** or **`porkbun`** pins the route. Jarl still checks that the
+  CA will see the record there and refuses to try otherwise (no wasted
+  attempt against the CA's rate limits).
+
+```sh
+jarl cert update ns1 --challenge porkbun     # or jarl, or auto
+```
+
+`jarl cert check NAME` (or **Check the names** in the web UI) shows the
+route for each name, and why, at any time.
+
+### Domains Jarl can't write to: a CNAME
+
+For a domain whose DNS is elsewhere (Cloudflare, say), point the
+challenge name at a zone this server serves on the internet, once, by
+hand:
+
+```
+_acme-challenge.www.example.org.  CNAME  www-example-org.acme.adbraun.lol.
+```
+
+Jarl follows the CNAME and writes the record at its target, in its zone
+`acme.adbraun.lol` (which must be delegated to this server). Renewals
+never touch the other provider again. That is the same idea as
+[acme.md section 7](acme.md#7-a-dedicated-acme-zone-cname-delegation).
+
+## Renewal
+
+jarld looks at every certificate every 10 minutes:
+
+- A certificate Jarl obtains is renewed at the time the CA suggests
+  (ACME Renewal Information, RFC 9773; asked twice a day, so a CA that
+  needs to replace certificates early, e.g. after revoking them, gets its
+  way), or, without one, two thirds into its lifetime: day 60 of a 90-day
+  certificate. Each renewal makes a new key.
+- When obtaining fails, jarld tries again after 1, 2, 4, 8, 16 hours, then
+  daily. The dashboard and the Certificates page show the error; so do
+  `jarl cert list` and Prometheus (`jarl_certificate_failing`).
+- New names or a new key type on a certificate make it due at once.
+- `jarl cert issue NAME` (**Renew** in the web UI) obtains it now. It runs
+  in the background: the command waits and reports, the web page updates
+  itself.
+
+A certificate counts as **expiring** (a warning) when less than a sixth of
+its lifetime is left, which for a renewing certificate means renewal has
+been failing for a while; and **expired** after its end.
+
+## Use: web (jarld's HTTPS)
+
+Only one certificate can have the web use. As soon as it has been
+obtained, jarld serves it on all its `listen` addresses, **without a
+restart**: each port speaks HTTPS and plain HTTP side by side.
+
+- HTTPS connections get the certificate (HTTP/2 included).
+- Plain HTTP from this server itself (`127.0.0.1`, `::1`) is served as
+  before, so local scripts and `--server http://127.0.0.1:8053` keep
+  working. So is plain HTTP from `trusted_proxies`.
+- Plain HTTP from anywhere else: browsers are redirected to
+  `https://<the same host and port>`; API requests get `400
+  https_required` (and, if they carried a token, a note that it crossed
+  the network unencrypted).
+
+Point browsers and CLIs at the certificate's name:
+`jarl config set server https://ns1.adbraun.lol:8053`. A CLI that uses the
+server's IP address fails the name check.
+
+A managed certificate takes over from `tls.cert_file`. Taking the web use
+off (or deleting the certificate) goes back to `tls.cert_file`, or to
+plain HTTP.
+
+## Use: dns (for named)
+
+Jarl writes the certificate to `<certificates.dir>/<name>/`:
+
+```
+/etc/bind/jarl/tls/ns1/fullchain.pem   (0644)
+/etc/bind/jarl/tls/ns1/privkey.pem     (0640, group bind)
+```
+
+Debian's AppArmor profile lets named read `/etc/bind`, and group `bind`
+lets it read the key. When a renewal changes the files and named's
+configuration names them, Jarl runs `rndc reconfig`, and named serves the
+new certificate at once (checked with BIND 9.20: DoT keeps working, with
+the new certificate).
+
+Until Jarl sets up DNS over TLS and HTTPS for you, add it by hand:
+
+```sh
+jarl option set tls 'dot { cert-file "/etc/bind/jarl/tls/ns1/fullchain.pem"; key-file "/etc/bind/jarl/tls/ns1/privkey.pem"; }' --toplevel
+jarl option set listen-on 'port 853 tls dot { 10.0.10.5; }' --add               # DoT
+jarl option set listen-on 'port 443 tls dot http default { 10.0.10.5; }' --add  # DoH at /dns-query
+```
+
+Listen on internal addresses only, unless you mean to run a public
+resolver ([exposure.md](exposure.md)).
+
+## A certificate you renew yourself
+
+```sh
+jarl cert create own --cert-file /etc/ssl/ns1/fullchain.pem --key-file /etc/ssl/ns1/privkey.pem --use web
+```
+
+Jarl checks that the key belongs to the certificate, warns when the file
+holds only the certificate without its intermediates (use the full
+chain), and rereads both files when they change (within 10 minutes, or at
+once with `jarl cert issue own`). A pair that doesn't match is reported
+and the last good one stays in use. jarld runs as user `jarl`, which must
+be able to read both files (e.g. `chgrp jarl` and `chmod 640`, or have
+your renewal hook copy them somewhere it can read).
+
+## Security notes
+
+- Certificates Jarl obtains, their keys and the ACME account key are kept
+  in Jarl's database, so they are in its backups (like TSIG secrets). The
+  API never returns a key.
+- Every publicly trusted certificate is published in Certificate
+  Transparency logs, with all its names. A name like `ns1.adbraun.lol`
+  used for both the web UI and DNS reveals less than separate names. Avoid
+  wildcards where one name will do: a wildcard's key is good for every
+  name in the domain.
+- Using one certificate for jarld and named puts its key in two places.
+  On one server, where jarld already writes named's configuration, that
+  changes little.
+
+## API
+
+| Method | Path | |
+|--|--|--|
+| GET | `/certificates` | `certificates` (each with `status` {`state`: ok, pending, failing, expiring, expired; `message`}, `next_attempt`, `issuing_since` while being obtained, `serving`, `files`) and `account` |
+| POST | `/certificates` | `{"name": "ns1", "domains": [...], "uses": ["web", "dns"], "challenge": "auto", "key_type": "ec256"}`, or `{"name", "source": "file", "cert_file", "key_file", "uses"}`. One Jarl obtains starts being obtained at once (`"issue": false` leaves it to the loop) |
+| POST | `/certificates/check` | `{"domains": [...], "challenge": "auto"}`: where each challenge would go (`routes`: `route`, `target`, `zone`, `public_ns`, `why` or `error`) |
+| GET, PATCH, DELETE | `/certificates/{name}` | `domains` and `uses` replace the whole list |
+| POST | `/certificates/{name}/issue` | obtain now: 202, then poll `GET /certificates/{name}` until `issuing_since` is gone; a file certificate is reread (200) |
+| POST | `/certificates/{name}/check` | the routes for an existing certificate |
+
+## Testing with Pebble
+
+[Pebble](https://github.com/letsencrypt/pebble) is Let's Encrypt's test
+CA. Point it at a test named, and Jarl at it:
+
+```sh
+docker run -d --name pebble --network host -e PEBBLE_VA_NOSLEEP=1 \
+  ghcr.io/letsencrypt/pebble -config test/config/pebble-config.json -dnsserver 127.0.0.1:53
+docker cp pebble:/test/certs/pebble.minica.pem /etc/jarl/pebble.pem
+```
+
+```yaml
+acme:
+  account: {directory: "https://localhost:14000/dir", agree_tos: true}
+  resolvers: ["127.0.0.1:53"]
+  ca_bundle: /etc/jarl/pebble.pem
+```

docs/cli.md

@@ -41,11 +41,22 @@ jarl whoami
 | API token (`@FILE` reads it from a file) | `--token` | `JARL_TOKEN` | `token` |
 | Skip TLS verification | `--insecure` | | `insecure` |
 | Extra trusted CA (PEM) | `--ca-cert` | | `ca_cert` |
-| Changeset to stage into | `-C/--changeset` | `JARL_CHANGESET` | |
+| Changeset to stage into (and the default for `jarl changeset diff/apply/...`) | `-C/--changeset` | `JARL_CHANGESET` (checked: open and yours, see [Changesets](#changesets-stage-review-apply)) | |
 
 Flags win over the environment, and the environment wins over the file. The
-file is `~/.config/jarl/config.yaml` (mode 0600), or `--config` /
-`JARL_CLI_CONFIG`. `jarl config show` prints it with the token masked.
+file is `jarl/config.yaml` in the user's configuration directory, or
+`--config` / `JARL_CLI_CONFIG`:
+
+| System | File |
+|--------|------|
+| Linux and other Unix | `~/.config/jarl/config.yaml` (`$XDG_CONFIG_HOME/jarl/config.yaml` if set) |
+| macOS | `~/Library/Application Support/jarl/config.yaml` |
+| Windows | `%AppData%\jarl\config.yaml` (`C:\Users\<you>\AppData\Roaming\jarl\config.yaml`) |
+
+It is written with mode 0600 (on Windows, the AppData folder is already
+private to the user). `jarl config show` prints its path and the settings,
+with the token masked. On Windows and macOS there is no local jarld, so
+always set a server.
 
 Get tokens from the web UI (Account → API tokens), from
 `jarl token create`, or from `jarld init --token` on the server.
@@ -128,10 +139,12 @@ to stderr with `-o json` or `-o yaml`, so stdout holds just the documents.
 | Flag | Meaning |
 |------|---------|
 | `-o table\|json\|yaml` | Output format. JSON and YAML have the API's full objects, for scripts. |
+| `-o id`, `-o field=NAME[,NAME...]` | Just the IDs, or just those fields, one line per object (fields separated by tabs). See [Scripting tips](#scripting-tips). |
 | `-n, --dry-run` | Validate and show the diff without changing anything. |
 | `-C, --changeset ID` | Stage the change into an open changeset instead of applying it. |
 | `--force` | Overwrite BIND files that were changed outside Jarl (drift). |
-| `-q, --quiet` | Print only errors, or just the ID where a command creates something. |
+| `--accept-risk` | Confirm a change that opens a public view up, such as an open resolver ([exposure.md](exposure.md)). Without it such a change stops with exit 5. |
+| `-q, --quiet` | Print only errors, or just the IDs: of what a command creates, or what `show` and `list` find (like `-o id`). |
 
 ## Exit codes
 
@@ -139,7 +152,7 @@ to stderr with `-o json` or `-o yaml`, so stdout holds just the documents.
 |------|---------|
 | 0 | Success |
 | 1 | Other error (bad arguments, connection failure, ...) |
-| 2 | A check found problems (`zone serials`, `zone delegation`); its report was printed |
+| 2 | A check found problems (`zone serials`, `zone delegation`, `zone dnssec check-ds`, `zone registrar status`), or a step can't be taken yet (`zone dnssec disable` before turning off has finished); the report was printed |
 | 3 | Not authenticated, or not allowed (token lacks the permission) |
 | 4 | Not found |
 | 5 | Conflict: concurrent change, object in use, drift |
@@ -170,12 +183,21 @@ jarl zone create consul --type forward --forwarder "127.0.0.1 port 8600"
 jarl zone update adbraun.lol --ttl 3600 --contact hostmaster@adbraun.lol --refresh 7200
 jarl zone update adbraun.lol --move-to-view internal
 jarl zone delete lab.adbraun.lol [-y]
+jarl zone disable lab.adbraun.lol [--view V]   # named stops serving it; kept (and editable) in Jarl
+jarl zone enable lab.adbraun.lol [--view V]
 jarl zone file adbraun.lol                             # the generated zone file
 jarl zone import adbraun.lol db.adbraun.lol [--replace] [--use-soa]
 jarl zone serials adbraun.lol                          # are the secondaries (or primaries) on the current serial?
 jarl zone delegation adbraun.lol [--resolver 9.9.9.9]  # does the parent zone delegate it correctly?
 ```
 
+**Disabling a zone** leaves it out of named's configuration but keeps it in
+Jarl: records, options and history, which can still be edited. Its names
+are then answered by recursion where the view offers it (the internet's
+version of the zone, if any), and REFUSED elsewhere; `disable` says which.
+Enabling it serves it as it is then. A signed zone can't be disabled (turn
+signing off first), nor a zone another view shares with `in-view`.
+
 Reverse names follow the dots (the nibbles in IPv6), so a reverse zone
 covers a /8, /16 or /24 (a multiple of /4 for IPv6). A network in between is
 covered by several zones, created together in one changeset: a /22 by four
@@ -189,6 +211,18 @@ router, answers for the rest of the /24. IPv4 networks smaller than a /24
 are deleted. Try it with `--dry-run` first. `--option "NAME VALUE"` on
 `zone create` sets any zone option in the same step.
 
+Linked zones ([views.md](views.md#linked-zones)) keep their shared
+records in step across views:
+
+```sh
+jarl zone link adbraun.lol --view internal --with external
+jarl zone create adbraun.lol --view vps --link-with external
+jarl zone unlink adbraun.lol --view vps
+jarl record add adbraun.lol nas A 10.0.10.20 --view internal --local   # this view only
+jarl record set adbraun.lol www A 10.0.10.5 --view internal --local    # override the shared www A here
+jarl record update 1234 --local | --shared
+```
+
 When a zone exists in several views, add `--view NAME` to commands that
 name it.
 
@@ -200,10 +234,41 @@ zone's delegation and glue against the zone, and calls a zone that isn't
 delegated (an internal-only zone) a note, not a problem. Both only run when
 you run them; see [operations.md](operations.md#checking-name-servers-and-the-delegation).
 
+### DNSSEC and the registrar
+
+```sh
+jarl zone dnssec status adbraun.lol --view external     # keys, DS record, what's next
+jarl zone dnssec enable adbraun.lol --view external [--policy NAME]
+jarl zone dnssec check-ds adbraun.lol --view external   # has the parent got the DS? tells named
+jarl zone dnssec disable adbraun.lol --view external    # step 1: insecure; run again to finish
+jarl zone dnssec wipe adbraun.lol --view external [--force]   # off at once, keys deleted
+
+jarl zone registrar status adbraun.lol --view external  # Porkbun: NS, glue, DS vs the zone
+jarl zone registrar sync-glue adbraun.lol --view external [--dry-run]
+jarl zone registrar set-ns adbraun.lol --view external [NS...] [--dry-run]
+jarl zone registrar publish-ds adbraun.lol --view external [--key TAG]
+jarl zone registrar remove-ds adbraun.lol 51126 --view external
+```
+
+[dnssec.md](dnssec.md) explains the steps. `enable` is safe at any time:
+validation only starts once the zone's DS record is at the parent, and
+`status` says when to publish it. `disable` never makes a zone unsigned
+while the parent may still have its DS: its first run switches to BIND's
+insecure policy, and it finishes (exit 0) only when named is done (exit 2
+before). `wipe` switches off at once and deletes the keys, and refuses
+while the parent zone has a DS record for the zone; `--force` wipes when the
+parent can't be checked.
+
+The `registrar` commands need a Porkbun API key in jarl.yaml and an
+administrator. Each change checks first that it won't break the domain and
+is refused otherwise: `--dry-run` shows the checks, `--force` skips them.
+(Here `--force` means that; elsewhere it overwrites files changed outside
+Jarl.)
+
 ## Records
 
 ```sh
-jarl record list adbraun.lol [--name www] [-t A] [--search nas]
+jarl record list adbraun.lol [--name www] [-t A] [--search nas] [--disabled]
 jarl record add adbraun.lol nas A 192.168.1.20 --ptr --comment "synology"
 jarl record add adbraun.lol @ MX 10 mail
 jarl record add adbraun.lol @ TXT "v=spf1 mx -all"      # plain text, quoting is automatic
@@ -215,11 +280,26 @@ jarl record update 1234 --ttl default
 jarl record delete adbraun.lol www A                      # every A record of www
 jarl record delete adbraun.lol www A 192.168.1.10         # just this one
 jarl record delete --id 1234 [--ptr]
+jarl record disable adbraun.lol www A 192.168.1.10 --ptr  # out of the zone, kept in Jarl
+jarl record enable adbraun.lol www A 192.168.1.10 --ptr   # back again
+jarl record disable --id 1234                             # by ID; same for enable
 
 # reverse zones: name records by address; the host name needs no final dot
 jarl record add 0.10.10.in-addr.arpa 10.10.0.20 PTR nas.adbraun.lol
+
+# a zone in several views (split horizon): the same change in each
+jarl record add adbraun.lol mx2 A 203.0.113.5 --view internal,external
+jarl record delete adbraun.lol old A --view all -y
 ```
 
+**Several views.** When a zone exists in more than one view, the record
+commands that change records (`add`, `set`, `delete`, `disable`,
+`enable`) take `--view a,b` or `--view all` (every view the zone is in).
+The changes are applied together as one changeset: if one view refuses
+(the zone isn't in it, a CNAME conflict, ...), no view is changed. With
+`--changeset` they are staged there instead. Keep split-horizon data that
+differs per view (an internal address, say) to one view at a time.
+
 Names are relative to the zone (`@` is the apex) unless they end with a
 dot. Data uses zone file syntax, except that TXT/SPF take plain text: Jarl
 adds the quotes and splits long values into 255-byte strings. In reverse zones the name can be the address
@@ -231,6 +311,16 @@ by Jarl). Every record type BIND supports can be used. Jarl knows the
 syntax of the common ones and checks them strictly, and the rest are
 validated by parsing.
 
+**Disabling** a record takes it out of the zone without deleting it: it
+keeps its ID, TTL and comment, the zone file lists it as a comment
+(`; disabled: www IN A ...`), and `enable` puts it back exactly as it
+was. `record list` marks disabled records `[disabled]`, and `zone show`
+counts them. The zone is validated as it is served: you can't disable its
+last NS record, and enabling a record is checked like adding it (a CNAME
+added at the same name in the meantime stops it). `record set` enables a
+disabled record whose value it is given, and leaves other disabled
+records alone.
+
 ## Batches: `jarl apply -f`
 
 Several changes that must succeed or fail together:
@@ -245,6 +335,7 @@ changes:
   - set:    {zone: adbraun.lol, name: api, type: A, data: [192.168.1.41, 192.168.1.42], ttl: 60}
   - update: {id: 1235, comment: "old web server, remove in November"}
   - delete: {id: 1240}
+  - disable: {zone: adbraun.lol, name: old, type: A}   # or {id: ...}; enable: likewise
   - op: acl.update                     # any API operation (see api.md)
     id: 3
     data: {elements: [192.168.1.0/24, 10.10.0.0/16]}
@@ -267,9 +358,9 @@ reads standard input.
 export JARL_CHANGESET=$(jarl changeset create "renumber lab" -q)
 jarl record set lab.adbraun.lol gw A 10.20.0.1
 jarl record set lab.adbraun.lol nas A 10.20.0.10
-jarl changeset diff $JARL_CHANGESET       # validation + named-checkconf + diff
-jarl changeset remove $JARL_CHANGESET 2   # drop operation #2
-jarl changeset apply $JARL_CHANGESET
+jarl changeset diff                       # validation + named-checkconf + diff
+jarl changeset remove 2                   # drop operation #2
+jarl changeset apply
 unset JARL_CHANGESET
 
 jarl changeset list [--status open|applied|discarded] [--mine]
@@ -279,8 +370,63 @@ jarl history [--limit 50]
 jarl changeset revert 42 -q | xargs jarl changeset apply   # undo an applied changeset
 ```
 
+`show`, `diff`, `apply`, `discard` and `remove` work on the changeset you
+name, else the one in `-C`, else the one in `JARL_CHANGESET`.
+
+A changeset from `JARL_CHANGESET` is checked before anything uses it,
+because an exported ID easily outlives its changeset, and IDs keep growing
+(every change, live ones included, gets the next one), so a stale or
+mistyped ID can later name a changeset that isn't yours:
+
+- Staging into it, and `diff`, `apply`, `discard` and `remove` on it, need
+  it to be open and yours. Otherwise the command stops and says why
+  (`there is no changeset 99`, `changeset 42 is applied`, `changeset 57 is
+  certbot's`) and what to do. Commands that only read (`jarl zone list`)
+  and `jarl changeset create` don't care, so you can always start a new one.
+- Each command says on stderr which changeset it uses: `changeset 42 (renumber
+  lab, 2 operations) from JARL_CHANGESET` (not with `-q`).
+- After `apply` or `discard`, a reminder to `unset JARL_CHANGESET`: the CLI
+  can't change your shell's environment, and later changes would fail to
+  stage.
+
+`-C ID` and an ID argument are used as given, without these checks (jarld
+still refuses a changeset that isn't open, or another user's unless you are
+an administrator).
+
 Changesets staged in the web UI show up here too, and the other way round.
 
+## Internet exposure
+
+```sh
+jarl exposure                                         # public views, findings, fixes, rate limiting
+jarl exposure fix external exposure_rate_limit        # rate limiting, log-only first
+jarl exposure fix external exposure_rate_limit_log_only   # then start enforcing
+jarl exposure fix server exposure_version
+jarl exposure ack external security_open_resolver --reason "public resolver, monitored"
+jarl exposure unack external security_open_resolver
+jarl view update external --exposure public|private|auto
+```
+
+See [exposure.md](exposure.md).
+
+## Certificates
+
+```sh
+jarl cert check --domain ns1.adbraun.lol             # where each challenge would go, and why
+jarl cert create ns1 --domain ns1.adbraun.lol --use web --use dns   # obtained at once; waits
+jarl cert create wild -d adbraun.lol -d '*.adbraun.lol' --use dns --key-type ec384
+jarl cert create own --cert-file /etc/ssl/ns1/fullchain.pem --key-file /etc/ssl/ns1/privkey.pem --use web
+jarl cert list
+jarl cert show ns1
+jarl cert issue ns1                                  # renew now (--no-wait to return at once)
+jarl cert update ns1 --challenge porkbun             # auto, jarl or porkbun
+jarl cert update ns1 --use dns                       # --use and --domain replace the list (--use none)
+jarl cert delete ns1
+jarl cert account                                    # the ACME account (set in jarl.yaml)
+```
+
+Administrators only. See [certificates.md](certificates.md).
+
 ## Views, ACLs, TSIG keys, options, settings
 
 ```sh
@@ -289,8 +435,11 @@ jarl view create external --match-clients any
 jarl view order internal external
 jarl view update external --match-clients "!homelab,any"
 jarl view delete old [--cascade]
+jarl view color internal green                # web UI colour; "default" resets it
+jarl view key external [--named-conf]         # the key that selects the view (dig -k), docs/views.md
 
 jarl acl create homelab 192.168.1.0/24 10.10.0.0/16 localhost
+jarl acl create dhcp 10.0.10.101-10.0.10.199 2001:db8::100-2001:db8::1ff   # ranges (concepts.md)
 jarl acl update homelab --add 10.20.0.0/16 --remove 10.10.0.0/16
 jarl acl update homelab --rename lan          # references are updated
 jarl acl delete lan                           # refused while in use
@@ -304,12 +453,22 @@ jarl option list [--view V | --zone Z | --toplevel | --all]
 jarl option set recursion yes
 jarl option set allow-recursion '{ homelab; localhost; }'
 jarl option set forwarders '{ 1.1.1.1; 9.9.9.9; }'
-jarl option set allow-transfer '{ key xfer; }' --zone adbraun.lol
+jarl option set forwarders 1.1.1.1 9.9.9.9    # the same: braces are added to a list
+jarl option set allow-transfer 'key xfer; 10.0.10.53' --zone adbraun.lol
+jarl option set allow-query '10.0.20.1-10.0.20.99; localhost' --view internal
 jarl option set response-policy '{ zone "rpz.local"; }' --view internal
 jarl option set logging '{ channel q { file "/var/log/named/query.log" versions 3 size 20m; }; category queries { q; }; }' --toplevel
 jarl option unset forwarders
 jarl option describe                          # every option allowed at this scope
 jarl option describe allow-query-cache        # grammar and ARM description
+```
+
+Options that end in a list (`allow-*`, `forwarders`, `listen-on`, ...) may
+be given without the braces: elements are separated by `;`, `,` or spaces,
+and `key NAME` and `port N` stay with their element. Options are always
+listed in one fixed order (see [concepts.md](concepts.md)).
+
+```sh
 
 jarl settings show
 jarl settings set --ns ns1.adbraun.lol.,ns2.adbraun.lol. --contact hostmaster@adbraun.lol --ttl 3600
@@ -323,7 +482,9 @@ jarl user create alice --role dns-editor               # asks for a password
 jarl user create ci --no-password --grant "records:write zones=lab.adbraun.lol"
 jarl user update alice --admin
 jarl user update alice --password                      # set a new password
-jarl user update bob --disabled                        # logs bob out, blocks his tokens
+jarl user update bob --disabled                        # logs bob out, blocks bob's tokens
+jarl user update admin --rename adam                   # rename (e.g. the first account, to your own name)
+jarl user totp reset alice                             # turn off alice's two-factor login (lost phone)
 jarl user delete bob -y
 
 jarl token list [--user alice | --all] [--revoked]
@@ -335,6 +496,11 @@ jarl token rotate laptop --save                        # new secret, same token
 jarl token rotate --current --save --grace 10m         # the token this CLI uses
 jarl token revoke 7
 
+# 'jarl user list' and 'jarl user show' include two-factor login (2FA: on,
+# off, or MISSING when totp.require applies and it isn't set up). Users set
+# it up themselves in the web UI (Account); the CLI's tokens never need a
+# code (permissions.md#two-factor-login).
+
 jarl audit [--user alice] [--action auth.login_failed] [--outcome failure] [--since 2026-10-01] [--limit 100]
 jarl search 192.168.1.20
 jarl status          # named, adoption, drift, open changesets, backups, expiring tokens, problems
@@ -354,15 +520,43 @@ working.
 ```sh
 jarl stats status
 jarl stats summary --since 7d
-jarl stats top names | clients | nxdomain | servfail | refused [--since 24h] [--limit 20]
+jarl stats top names | clients | nxdomain | servfail | refused | blocked | blocked-clients [--since 24h] [--limit 20]
 jarl stats timeline --since 6h [--key rcode:NXDOMAIN] [--table]
 jarl stats heatmap --since 28d
-jarl stats breakdown qtype | rcode | view | zone | answer | rtt
+jarl stats breakdown qtype | rcode | view | zone | answer | rtt | blocklist
+jarl stats server                                # named's memory, CPU, cache, clients; host; disk space
 ```
 
 Statistics must be enabled in `jarl.yaml`, and `-o json` exports the data.
 See [stats.md](stats.md).
 
+## Blocking
+
+```sh
+jarl blocklist list
+jarl blocklist add NAME URL [--view V]...         # default: every view that offers recursion
+jarl blocklist update NAME [--url U] [--name N] [--view V | --view auto] [--comment C]
+jarl blocklist disable | enable | delete NAME
+jarl blocklist refresh [NAME...] [--force]       # download now (all lists without NAME)
+
+jarl block add DOMAIN [--exact] [--view V]...    # block it (and the names below it)
+jarl block allow DOMAIN [--exact] [--view V]...  # an exception that beats every list
+jarl block list
+jarl block delete DOMAIN [--view V] | --id ID
+jarl block check DOMAIN                          # blocked? by which rule or list?
+jarl block pause [DURATION]                      # let everything through for a while (default 10m, at most 24h)
+jarl block pause indefinitely                    # ... until 'jarl block resume'
+jarl block step list | add NAME | rename STEP NEW | order STEP... | delete STEP
+jarl block group list
+jarl block group add NAME MEMBER... [--step S] [--view V]...   # addresses, networks or ACLs
+jarl block group update GROUP [--add M] [--remove M] [--step S] [--name N]
+jarl block group delete GROUP
+jarl blocklist update LIST --step STEP           # devices at that step or above get it
+jarl block resume
+```
+
+See [blocking.md](blocking.md).
+
 ## ACME DNS-01
 
 ```sh
@@ -376,8 +570,25 @@ See [acme.md](acme.md) for certbot, acme.sh and a dedicated ACME zone.
 
 ## Scripting tips
 
-* `-o json` gives full API objects. Pipe them to `jq`.
-* `-q` with `create` commands prints just the ID or token.
+* `-o id` prints just the IDs of what a `show` or `list` command finds, one
+  per line, and `-o field=...` picks fields (their names are those of
+  `-o json`; a dot reaches inside, as in `soa.serial`; a field an object
+  doesn't have prints as empty). For changes, they apply to the changed
+  object:
+
+  ```sh
+  ZONE=$(jarl zone show adbraun.lol --view external -o id)
+  jarl record list adbraun.lol --name www -t A -o id | xargs -n1 jarl record disable --id
+  jarl zone show adbraun.lol -o field=view,soa.serial          # external	2026100901
+  jarl zone list -o field=id,name,view
+  ID=$(jarl record add adbraun.lol www A 192.0.2.10 -o id)     # the new record's ID
+  ```
+* `-q` with `create` commands prints just the ID or token, and with `show`
+  and `list` just the IDs. Commands without IDs (status, checks) print
+  nothing but errors.
+* `jarl record list` on a terminal shortens data too long for a line
+  (`…`); `--wide` shows it in full, and so does output to a pipe or file.
 * Check `$?` against the exit code table.
 * `jarl record delete ... --missing-ok` succeeds when nothing matches, which
-  keeps cleanup scripts idempotent. `jarl record set` is idempotent by nature.
+  keeps cleanup scripts idempotent. So does `record disable|enable
+  --missing-ok`, also when the records are already disabled (enabled). `jarl record set` is idempotent by nature.

docs/concepts.md

@@ -40,8 +40,8 @@ renders the complete configuration from the database:
 `jarld adopt` turns `/etc/bind/named.conf` into a single
 `include "/etc/bind/jarl/named.conf";`, so named loads only what Jarl
 generates. Zone files go under `/var/lib/bind` because Debian's AppArmor
-profile lets named write there. That keeps journals and future DNSSEC
-signing working.
+profile lets named write there: its journals, the signed copies of zones
+it signs, and their keys (under `dnssec-keys/`, see [dnssec.md](dnssec.md)).
 
 Because files are always regenerated, anything you edit by hand is
 overwritten. Jarl records a checksum of every file it writes and reports
@@ -68,7 +68,9 @@ both, using a single mechanism:
 * `POST /api/v1/apply` (CLI: `jarl apply -f changes.yaml`) applies a list of
   operations as one changeset in a single request.
 * `?dry_run=1` (CLI: `--dry-run`) runs the whole pipeline except installing
-  files and reloading named, and shows the problems and the diff.
+  files and reloading named, and shows the problems and the diff. Each
+  part of a named.conf diff says which block it is in, after the `@@`
+  line numbers: `@@ -50,6 +49,8 @@ view "internal" {`.
 
 **Why bundling matters.** Some changes only make sense together. Turning
 `www` from an A record into a CNAME means deleting the A record and adding
@@ -159,6 +161,38 @@ RFC 1982 arithmetic.
   Jarl checks them before named does. Statements that Jarl manages itself
   (`zone`, `view`, `acl`, `key`, a zone's `type`/`file`, a view's
   `match-clients`, ...) can't be set as raw options.
+  Options of a block are kept in one fixed order, the same in named.conf,
+  the web UI and the CLI: grouped (files, listening, access control,
+  recursion and forwarding, DNSSEC, transfers and notify, then the rest),
+  alphabetical within a group. So the same option is in the same place in
+  every view and zone. Top-level statements stay in the order they were
+  added.
+* **Address ranges.** Wherever named takes an address match list (ACLs,
+  views' `match-clients` and `match-destinations`, options such as
+  `allow-query` or `allow-recursion`) and in blocking's client groups, Jarl
+  also takes a range of addresses: `10.0.10.101-10.0.10.199`,
+  `2001:db8::100-2001:db8::1ff`, `!10.0.10.150-10.0.10.160`. BIND only
+  matches addresses and prefixes, so Jarl keeps the range as you wrote it
+  and writes the fewest prefixes that cover exactly that range to
+  named.conf, with the range as a comment above them:
+  ```
+  acl "dhcp" {
+  	// 10.0.10.101-10.0.10.199
+  	10.0.10.101;
+  	10.0.10.102/31;
+  	10.0.10.104/29;
+  	10.0.10.112/28;
+  	10.0.10.128/26;
+  	10.0.10.192/29;
+  };
+  ```
+  Nothing outside the range is matched (writing such lists by hand, it is
+  easy to round to `10.0.10.96/27` and let in more than you meant). Both
+  ends are full addresses of the same family, and spaces around the dash
+  are fine. A range takes at most 62 prefixes for IPv4 and 254 for IPv6.
+  The web UI shows what a range becomes while you type it. A range in the
+  IPv4-mapped space (`::ffff:0:0/96`) gets a warning: named can see IPv4
+  clients as such addresses, so it may match IPv4 clients too.
 * **Settings** are Jarl's defaults for new zones: name servers, SOA contact
   and timers, default TTL, serial policy.
 
@@ -290,8 +324,6 @@ journal through jarld's log.
 * **Dynamic updates** (`allow-update`, `update-policy`): named would write
   to zone files that Jarl regenerates, so the validator rejects them on Jarl
   zones. Use the API (for example `jarl acme`) instead of nsupdate.
-* **DNSSEC signing**: not managed yet. The zone directory is
-  named-writable, so `dnssec-policy` can be added later.
 * **Several servers from one jarld**: each jarld manages the named on its
   own host. A second server runs its own jarld with secondary zones, which
   copy the primary's zones by normal AXFR/IXFR (see "A secondary server" in

docs/configuration.md

@@ -18,13 +18,15 @@ The CLI has its own small configuration file, described in [cli.md](cli.md).
 
 | Key | Default | Meaning |
 |-----|---------|---------|
-| `listen` | `["127.0.0.1:8053"]` | Addresses to listen on (`host:port`, several allowed). Keep these on localhost and management networks. |
+| `listen` | `["127.0.0.1:8053"]` | Addresses to listen on (`host:port`, several allowed). Keep these on localhost and management networks. Ports below 1024 (`"192.168.10.2:443"`) work because `jarl.service` gives jarld the `CAP_NET_BIND_SERVICE` capability, and only that ([HTTPS on port 443](#example-https-on-port-443)). |
 | `socket` | `/run/jarl/jarl.sock` | A local unix socket for the API. Requests on it from root or jarld's own user need no token and have administrator rights; anyone else must send a token ([permissions.md](permissions.md#the-local-socket)). The `jarl` CLI uses it when no server is configured. At most 107 bytes long; `""` turns it off. If it can't be created, jarld logs a warning and serves the network addresses only. |
-| `tls.cert_file`, `tls.key_file` | (empty: plain HTTP) | PEM certificate chain and key. Both or neither. The files are rechecked every 10 minutes and on SIGHUP (`systemctl reload jarl`), so renewed certificates are used without a restart. |
+| `tls.cert_file`, `tls.key_file` | (empty: plain HTTP) | PEM certificate chain and key. Both or neither. The files are rechecked every 10 minutes and on SIGHUP (`systemctl reload jarl`), so renewed certificates are used without a restart. Easier: let Jarl obtain and renew one ([certificates.md](certificates.md), use `web`), which takes over from these. With a certificate, the `listen` ports serve HTTPS and plain HTTP side by side: plain HTTP is still served to this server itself and to `trusted_proxies`; anyone else is sent to HTTPS. |
 | `trusted_proxies` | `[]` | Addresses or prefixes of reverse proxies whose `X-Forwarded-For` and `X-Forwarded-Proto` (or `Forwarded: proto=`) headers are believed. Needed for correct client IPs in the audit log and for rate limiting behind a proxy, and for knowing that a proxied request came over HTTPS (the session cookie's Secure flag, `acme.httpreq`). From other addresses these headers are ignored. |
 | `session.lifetime` | `12h` | A web session ends this long after login... |
 | `session.idle_timeout` | `2h` | ...or after this long without requests. |
 | `session.cookie_secure` | `auto` | `auto` sets the cookie's Secure flag when the request came over HTTPS (directly or via a trusted proxy); `always` / `never` force it. |
+| `totp.require` | `none` | Who must use [two-factor login](permissions.md#two-factor-login): `none` (each user decides), `admins`, or `all` (every user with a password). Someone who must and hasn't set it up can only set it up after logging in. API tokens and the local socket are not affected. |
+| `totp.issuer` | `""` | The name authenticator apps show for the account. Empty means `Jarl <short hostname>`, so several servers are told apart. At most 64 characters, no `:`. Changing it doesn't affect apps already set up. |
 
 Durations accept Go syntax (`90s`, `15m`, `12h`) and days (`30d`).
 
@@ -39,8 +41,8 @@ Durations accept Go syntax (`90s`, `15m`, `12h`) and days (`30d`).
 ### Backups
 
 `jarld backup` without a file name, which the `jarl-backup.timer` systemd
-timer runs daily, writes `jarl-<UTC time>.db` into `backup.dir` and then
-deletes old backups there. It reads these settings from this file each
+timer runs daily, writes `jarl-<UTC time>.db` into `backup.dir` (with the
+DNSSEC keys of signed zones inside it) and then deletes old backups there. It reads these settings from this file each
 time it runs; when it runs is the timer's (`systemctl edit
 jarl-backup.timer`). See [operations.md](operations.md#backups), also for
 restoring.
@@ -71,6 +73,35 @@ The `stats:` section turns on query statistics (off by default). See
 [stats.md](stats.md) for every setting and what it changes in named's
 configuration. Changing it takes effect when jarld restarts.
 
+### Prometheus metrics
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `metrics.enabled` | `false` | Serve Prometheus metrics at `/metrics` on `listen` and the local socket ([metrics.md](metrics.md)). |
+| `metrics.listen` | `[]` | Extra `ADDRESS:PORT`s that serve only `/metrics`, over plain HTTP, e.g. `["0.0.0.0:9450"]`. |
+| `metrics.allow` | `["127.0.0.1", "::1"]` | Addresses or prefixes that may scrape without a token. |
+| `metrics.token` | `""` | A bearer token (at least 16 characters) that lets any address scrape. Keep jarl.yaml readable by root and jarld only when set. |
+
+Query counters need `stats.enabled` as well. Changes take effect when jarld
+restarts.
+
+### Certificates (ACME account)
+
+The account Jarl obtains certificates with, and where it writes them for
+named. See [certificates.md](certificates.md). Changes take effect when
+jarld restarts.
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `acme.account.directory` | `letsencrypt` | `letsencrypt`, `letsencrypt-staging` or an ACME directory URL (`https://...`). |
+| `acme.account.email` | `""` | Contact address for the CA (optional). |
+| `acme.account.agree_tos` | `false` | You accept the CA's terms of service; no account is registered without it. |
+| `acme.account.eab_kid`, `acme.account.eab_hmac` | `""` | External Account Binding, for CAs that need it. Both or neither. Keep the file readable only by root and jarld. |
+| `acme.resolvers` | `["1.1.1.1:53", "9.9.9.9:53", "8.8.8.8:53"]` | Recursive resolvers (`address:port`) used to see domains as the CA does: their zone, public name servers, and a CNAME on `_acme-challenge`. Not this server: it may answer from an internal view. |
+| `acme.ca_bundle` | `""` | PEM file of extra CA certificates to trust for the ACME server (a private CA). |
+| `acme.check_propagation` | `true` | Wait until every name server of the zone serves a challenge before the CA is told to look (they are asked directly, on port 53). |
+| `certificates.dir` | `<bind.config_dir>/tls` | Where certificates with the `dns` use are written for named: `<dir>/<name>/fullchain.pem` and `privkey.pem`. |
+
 ### ACME (lego httpreq endpoint)
 
 An endpoint for lego's `httpreq` DNS provider, so lego and Traefik can
@@ -91,9 +122,10 @@ jarld restarts.
 |-----|---------|---------|
 | `bind.main_config` | `/etc/bind/named.conf` | The file named loads. `jarld import` reads it, and `jarld adopt` replaces it with an include of Jarl's configuration. |
 | `bind.config_dir` | `/etc/bind/jarl` | Where Jarl writes `named.conf` and `keys.conf`. Must be readable by named. |
-| `bind.zone_dir` | `/var/lib/bind/jarl` | Primary zone files (`<view>/<zone>.zone`). named may write journals here. |
+| `bind.zone_dir` | `/var/lib/bind/jarl` | Primary zone files (`<view>/<zone>.zone`). named may write journals, signed copies of zones and, under `dnssec-keys/`, DNSSEC keys here. |
 | `bind.cache_dir` | `/var/cache/bind/jarl` | Where named stores secondary, stub and mirror zones. |
 | `bind.file_group` | `bind` | Group given to generated files and directories so named can read them. Empty leaves the group alone. |
+| `bind.named_user` | `bind` | The user named runs as. `jarld restore` gives it the DNSSEC keys it puts back. |
 | `bind.named_checkconf` | `/usr/bin/named-checkconf` | Used to check every candidate configuration (`-z` also loads the zones). |
 | `bind.named_checkzone` | `/usr/bin/named-checkzone` | Used to check zone files. |
 | `bind.rndc` | `/usr/sbin/rndc` | Used to reconfigure and reload named and to read zone serials. |
@@ -111,6 +143,46 @@ there (`ReadWritePaths`). If you change them, update both
 ReadWritePaths=/srv/bind/jarl /srv/bind/zones
 ```
 
+### Porkbun (registrar and DNS host)
+
+With an API key, Jarl can:
+
+- show and set a domain's name servers, glue records and DNSSEC DS records
+  at Porkbun, after checking that the change won't break the domain
+  ([dnssec.md](dnssec.md#porkbun));
+- publish the DNS-01 challenges of certificates it obtains while Porkbun
+  still serves the domain's DNS ([certificates.md](certificates.md#where-the-challenge-goes)):
+  it only adds TXT records at `_acme-challenge` names and removes them
+  again.
+
+Without a key (the default) nothing about Porkbun shows up, and
+certificates for domains Porkbun serves can't be obtained (`jarl cert
+check` says so).
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `porkbun.api_key` | `""` | The API key (`pk1_...`). Set both or neither. |
+| `porkbun.secret_api_key` | `""` | Its secret (`sk1_...`). |
+| `porkbun.domains` | `[]` | Only these domains, for both uses (default: any domain the key can reach). |
+
+The key can move your domain anywhere, so it is only ever read from this
+file: it isn't stored in the database or backups, and there is no API to
+set it. Keep the file readable only by root and jarld (`chown root:jarl
+jarl.yaml; chmod 640 jarl.yaml`, as the Debian package installs it); jarld
+warns at start when everyone can read it. At porkbun.com, switch on "API
+Access" for the domain, and limit the key to the domain if you can.
+
+### Blocking
+
+How jarld downloads blocklists ([blocking.md](blocking.md)). The lists and
+rules themselves are configuration in the database.
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `blocking.refresh` | `24h` | How often each blocklist is checked for changes (at least `1h`); it is downloaded only when it changed ([blocking.md](blocking.md)). |
+| `blocking.max_download_mb` | `64` | Larger downloads are refused (the previous version stays in use). |
+| `blocking.max_entries` | `1000000` | Lists with more domains are refused. |
+
 ## Example: management network with TLS
 
 ```yaml
@@ -126,6 +198,32 @@ audit:
   retention_days: 730
 ```
 
+## Example: HTTPS on port 443
+
+```yaml
+listen:
+  - "127.0.0.1:8053"        # the CLI on the server keeps using this (or the socket)
+  - "192.168.10.2:443"
+tls:
+  cert_file: /etc/jarl/tls/fullchain.pem
+  key_file: /etc/jarl/tls/privkey.pem
+```
+
+jarld runs as the unprivileged `jarl` user, and binding a port below 1024
+needs the `CAP_NET_BIND_SERVICE` capability, which `jarl.service` grants
+(`AmbientCapabilities=CAP_NET_BIND_SERVICE`; nothing else). The unit in
+Jarl 0.2.0 and earlier doesn't, and jarld then fails with "bind:
+permission denied". Upgrading the package installs the new unit; until
+then, a drop-in does the same:
+
+```sh
+sudo systemctl edit jarl
+#   [Service]
+#   CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+#   AmbientCapabilities=CAP_NET_BIND_SERVICE
+sudo systemctl restart jarl
+```
+
 ## Example: behind nginx
 
 ```yaml

docs/development.md

@@ -10,6 +10,7 @@ internal/
   dnsname/            DNS name handling: FQDNs, relative names, check-names rules, reverse zones
   rr/                 record data parsing/canonicalization (miekg/dns), TXT quoting, the record type catalog
   namedconf/          named.conf lexer, parser and printer; address match lists
+  iprange/            address ranges (10.0.10.101-10.0.10.199): parsing and the exact prefix cover
   catalog/            every BIND 9.20 statement: grammar (from named.conf(5)) + ARM descriptions, embedded
   validate/           whole-configuration validation and security lints
   render/             State → named.conf, keys.conf and zone files, with a source map for error messages
@@ -24,8 +25,12 @@ internal/
   web/static/         the web UI: plain ES modules, no build step, embedded with go:embed
   api/, client/       JSON types and the Go client shared by server and CLI
   acme/               ACME DNS-01 challenge records, shared by jarl acme and the httpreq endpoint
-  backup/             database backups: write (VACUUM INTO) and check, list, prune by the time in the name
-  nscheck/            DNS queries to other name servers: zone serials and the parent's delegation
+  backup/             database backups: write (VACUUM INTO, plus the DNSSEC key files) and check, list, prune by the time in the name
+  nscheck/            DNS queries to other name servers: zone serials, the parent's delegation and DS records
+  dnssec/             reads named's DNSSEC key and state files; DS records; the signing phases (docs/dnssec.md)
+  porkbun/            Porkbun API client (name servers, glue, DS records) and an in-memory fake for tests
+  blocking/           blocklist parser, response policy zone writers, and matching a name the way named does
+                      (the downloads are in engine/blocklists.go)
   config/             jarld's YAML configuration
 deploy/               systemd units (jarld, the daily backup service and timer), sysusers.d and tmpfiles.d files
 deploy/debian/        the Debian package's control template and postinst/prerm/postrm
@@ -110,10 +115,49 @@ checker tests work with the installed `bind9-utils` too.
 `scripts/e2e.sh` builds a legacy BIND setup, starts named, runs
 `jarld init`, `import`, `adopt` and `serve`, then drives every CLI command
 (records, batches, changesets, views, ACLs, TSIG, options, users, tokens,
-ACME hooks, audit) and checks the answers with `dig`. `KEEP=1` leaves named
+ACME hooks, DNSSEC signing, backup and restore with keys, audit) and checks
+the answers with `dig`. The Porkbun code is tested against
+`porkbun.Fake`, an in-memory stand-in for its API; nothing calls the real
+one. With Docker, certificates are tested end to end against
+[Pebble](https://github.com/letsencrypt/pebble), Let's Encrypt's test CA
+(`ghcr.io/letsencrypt/pebble`, host network, ports 14000 and 15000),
+which checks the challenges against the test named: obtaining, HTTPS
+from jarld, DNS over TLS from named, renewal. `PEBBLE=0` skips that; the
+certs package's own tests use a fake DNS server and `porkbun.Fake`, and
+never a real CA. `KEEP=1` leaves named
 and jarld running afterwards. The output says where; set `JARL_CLI_CONFIG`
 to that directory's `cli.yaml` to keep using the CLI against it.
 
+### A test machine
+
+`scripts/testenv.sh` turns a fresh Debian/Ubuntu VM or container into a
+server to try Jarl on, the way a user would. Run it as root from the
+repository:
+
+```sh
+sudo scripts/testenv.sh                         # zone example.com
+sudo JARL_TEST_ZONE=lab.test scripts/testenv.sh # another zone
+```
+
+It installs BIND 9, make, git, curl and Go (from go.dev, at the version in
+`go.mod`, unless a new enough one is installed). It then writes a typical
+hand-made configuration for Jarl to import: an ACL, options with logging,
+an `internal` view (this machine's networks and the private ranges, with
+recursion) and an `external` view (everyone else, authoritative only).
+The zone is in both views with different answers. There is also a reverse
+zone for the machine's /24. The zone files in `/etc/bind/zones` use
+comments, `$TTL`, `$ORIGIN`, `$GENERATE`, legacy `type master` and most
+record types. The script checks the result with `named-checkconf -z`,
+(re)starts named (in the background where there is no systemd), and asks
+named a few questions with `dig`. At the end it prints the steps to build
+and install the packages, then run `init`, `import` and `adopt`.
+
+`JARL_TEST_VIEWS=no` leaves out the views, and `JARL_TEST_IP` sets the
+machine's address (default: the address of the default route). The old
+`/etc/bind` is saved in `/root/bind-before-testenv-<time>.tgz`. Once Jarl
+has adopted the configuration, running the script again needs
+`JARL_TEST_FORCE=1`. Debian 13 has BIND 9.20; Ubuntu has it from 25.04.
+
 ### The web UI
 
 The UI is plain JavaScript modules under `internal/web/static/`, with no
@@ -155,7 +199,8 @@ files are embedded at build time, so rebuild jarld after changes.
 ## Releasing
 
 1. Move the "Unreleased" section of `CHANGELOG.md` under
-   `## [<version>] - <date>`.
+   `## [<version>] - <date>`. (A release candidate may skip this; see
+   below.)
 2. Put the version in `VERSION`.
 3. `make test && JARL_BIND_ROOT=... make e2e` (CI runs only `make test`;
    it has no BIND).
@@ -168,9 +213,62 @@ amd64 and arm64) and runs `scripts/gitea-release.sh`. That creates the
 Gitea release (the CHANGELOG section as notes; the tarballs, the CLI for
 Linux, macOS and Windows, the `.deb`s and `SHA256SUMS` attached) and
 uploads the `.deb`s to the owner's Debian registry, distribution `stable`,
-component `main` ([install.md](install.md#from-the-package-registry)). A
-version with a hyphen (`1.0.0-rc.1`) becomes a pre-release; its packages
-get version `1.0.0~rc.1`, which apt sorts before `1.0.0`.
+component `main` ([install.md](install.md#from-the-package-registry)).
+
+### Release candidates
+
+A version with a hyphen (`0.2.0-rc.1`, tag `v0.2.0-rc.1`) is a
+pre-release:
+
+* **On Gitea** it is marked "Pre-Release". Gitea doesn't count it as the
+  latest release: the repository page, `/releases/latest` and the API's
+  latest release keep pointing at the last stable one.
+* **The `.deb`s go to the `testing` distribution**, not `stable`. Their
+  version is `0.2.0~rc.1`, which apt sorts after `0.1.0` but before
+  `0.2.0`. So in `stable` an RC would reach every server on its next
+  `apt upgrade`. Servers that follow only `stable` never see RCs. A test
+  machine that also lists `testing` gets each RC, and then the final
+  `0.2.0` from `stable`, which supersedes it.
+* **Release notes**: its own `## [0.2.0-rc.1]` section if there is one;
+  otherwise the section of the version it leads up to (`## [0.2.0]`), or
+  else `## [Unreleased]`. So you can tag RCs while the changes are still
+  under Unreleased, and move them under `## [0.2.0]` for the real release.
+  A stable release still needs its own section.
+
+`scripts/gitea-release.sh notes` prints the notes a release would get
+(`VERSION=0.2.0-rc.1 scripts/gitea-release.sh notes`), and the workflow
+runs it as a check before building.
+
+### Which version a build reports
+
+The footer of the web UI, `jarld version`, `jarl --version`, `jarl status`
+and `jarl whoami` say what a binary was built from (the footer links to
+it on Gitea). Only a release build reports a version number:
+
+* **A release**: `make` run on the commit tagged `v<VERSION>` with no
+  tracked file changed. The Makefile then sets `RELEASE_TAG`, and the
+  footer reads "Powered by Jarl v0.2.0", linking to the release. The
+  release workflow sets `RELEASE_TAG` itself.
+* **Any other build** is a development build, named by its commit (which
+  Go records from git) rather than `VERSION`: "Powered by Jarl
+  1a2b3c4d5e6f", linking to the commit. With uncommitted changes it is
+  marked `-modified`. The other places add where it stands relative to
+  the last tag, from `git describe` (the Makefile's `DESCRIBE`):
+  `dev 1a2b3c4d5e6f (3 commits after v0.2.0-rc.1)`, or
+  `dev 1a2b3c4d5e6f-modified (v0.2.0-rc.1 with uncommitted changes)`.
+* **No git** (a build from a source archive): `VERSION`, marked as such:
+  `0.2.0 (source build)`.
+
+`RELEASE_TAG=v0.2.0 make` forces the first case.
+
+`make deb` versions the packages the same way. A release gets `VERSION`
+with `~` for `-` (`0.2.0~rc.1`). A development build gets a version after
+the last tag: 3 commits past `v0.2.0-rc.1` is `0.2.0~rc.1+git3.gca0f148`,
+and uncommitted changes add the build time (`.m20261009153000`). apt sorts
+these after that RC and before the next one or `0.2.0`. So installing a
+newer build over an older one, or over the RC, is an upgrade: plain
+`apt install ./dist/…` works, without `--reinstall`. `make deb` removes
+older packages of the same architecture from `dist/` first.
 
 Pushing the same tag again (`git tag -f`, `git push -f`) re-runs it, and
 the script replaces the attachments and packages, so a failed release can

docs/dnssec.md

@@ -0,0 +1,348 @@
+# DNSSEC signing
+
+DNSSEC lets resolvers that validate (Cloudflare 1.1.1.1, Google 8.8.8.8,
+Quad9, many ISPs) detect forged answers for your domain. Jarl signs zones
+with BIND's own key and signing policy (`dnssec-policy`), and guides you
+through the steps that involve the parent zone, where getting the order
+wrong takes a domain offline.
+
+- [Should you sign?](#should-you-sign)
+- [How it works](#how-it-works)
+- [Turning signing on](#turning-signing-on)
+- [Putting your own name servers on the internet](#putting-your-own-name-servers-on-the-internet)
+- [Porkbun](#porkbun)
+- [Turning signing off](#turning-signing-off)
+- [Wipe: a clean slate](#wipe-a-clean-slate)
+- [Keys, backups and moving servers](#keys-backups-and-moving-servers)
+- [What Jarl refuses, and why](#what-jarl-refuses-and-why)
+- [Phases](#phases)
+- [Custom policies](#custom-policies)
+- [Adopting a signed zone](#adopting-a-signed-zone)
+
+## Should you sign?
+
+Sign a zone that the internet sees through a delegation from its parent:
+your registered domain (`adbraun.lol`), as served to the outside world.
+Validation only happens once the parent zone (`lol`) publishes a DS
+record for the zone's key, which you add at your registrar.
+
+Signing an internal-only zone (one no registrar delegates, or a split-DNS
+view only your own network reaches) adds nothing. There is no parent to
+publish a DS, and BIND doesn't validate the zones it serves itself.
+
+**Split DNS.** In Jarl a zone belongs to a view, so you sign the external
+view's `adbraun.lol` and leave the internal view's copy unsigned. That is
+the usual setup, with one catch. Once the DS is at the parent, the world
+expects `adbraun.lol` to be signed. A device on your network that validates
+DNSSEC *itself* and gets the internal, unsigned copy rejects it. Examples
+are a Pi-hole or Unbound with DNSSEC on, systemd-resolved with
+`DNSSEC=yes`, and some routers. Devices that just ask this server are fine.
+If you run such a validator, sign the internal copy too and publish both
+DS records.
+
+**What it costs.** It is one more way for the domain to break: if the DS at
+the parent stops matching the zone's keys (keys lost, wiped, or a server
+moved without them), every validating resolver rejects the whole domain.
+Most of Jarl's DNSSEC features exist to stop that from happening.
+
+## How it works
+
+named signs the zone itself, with *inline signing*:
+
+- Jarl writes the zone file as before (`/var/lib/bind/jarl/<view>/<zone>.zone`).
+  named keeps a signed copy next to it (`.signed`, `.signed.jnl`), signs
+  every change Jarl makes, and re-signs before signatures expire.
+- The keys live in Jarl's key directory,
+  `/var/lib/bind/jarl/dnssec-keys/<view>/`. The subdirectory is named after
+  the view's ID, so renaming a view doesn't move the keys. Each key is
+  three files, `K<zone>.+013+<tag>.key`, `.private` (readable only by
+  named's user) and `.state`. Zones of the same name in two views have
+  separate directories, because named requires that.
+- With BIND's `default` policy there is one key, a CSK (combined signing
+  key) using ECDSA P-256 (algorithm 13). It is never replaced, so the DS
+  record at the registrar never has to change.
+- The signed zone has its own serial, usually a little ahead of Jarl's.
+  Jarl's reload check compares the serial of the file it wrote. The serials
+  check (`jarl zone serials`) compares the signed serial, which is what
+  secondaries serve.
+- Secondaries transfer the signed zone and need nothing else.
+- The server's clock must be right (NTP): signatures are valid for a fixed
+  time window.
+
+## Turning signing on
+
+```sh
+jarl zone dnssec enable adbraun.lol --view external
+jarl zone dnssec status adbraun.lol --view external
+```
+
+or, in the web UI, the zone's **DNSSEC** tab → *Turn signing on*. This is
+safe at any time. Resolvers keep treating the zone as unsigned until its
+DS record is at the parent.
+
+`status` shows the key, the DS record, and when it is safe to publish:
+
+```
+Status:   named is signing the zone. Resolvers still treat it as unsigned, ...
+Next:     Wait until Fri 9 Oct 21:13 UTC before adding the DS at the parent: ...
+
+KEY    ROLE  ALGORITHM        GOAL         DNSKEY    DS AT PARENT  CREATED
+51126  CSK   ECDSAP256SHA256  omnipresent  rumoured  hidden        2026-10-08 21:08
+
+DS record for the parent zone (at your registrar):
+  (not yet: wait until Fri, 09 Oct 2026 21:13:51 UTC)
+  adbraun.lol. 3600 IN DS 51126 13 2 FFBECE3D...
+  key tag 51126, algorithm 13 (ECDSAP256SHA256), digest type 2 (SHA-256), digest FFBECE3D...
+```
+
+named first publishes the key for long enough that every resolver's cache
+has caught up: about a day with the default policy. Adding the DS earlier
+can make validating resolvers reject cached answers. Then:
+
+1. **Make sure the domain is delegated to servers that serve the signed
+   zone.** Your own servers, or secondaries that transfer from them.
+   Publishing a DS while the registrar still points at other name servers
+   (Porkbun's own, say) breaks the domain. `jarl zone delegation ZONE`
+   shows where the parent points.
+2. **Publish the DS record at the registrar**, by hand (the DNSSEC tab has
+   copy buttons for the whole record and for its four fields), or with
+   Jarl's [Porkbun](#porkbun) support, which checks step 1 first.
+3. **Tell named.** Once the parent zone has the DS (minutes to hours after
+   the registrar accepts it), run the DS check:
+
+   ```sh
+   jarl zone dnssec check-ds adbraun.lol --view external
+   ```
+
+   It asks every server of the parent zone for the zone's DS records, and
+   tells named (`rndc dnssec -checkds`) when all of them have it. named
+   waits for the parent's DS TTL before it counts the DS as in place.
+4. **Check.** `jarl zone delegation ZONE` now also compares the parent's
+   DS with the zone's keys. A DS that matches no key is an error.
+   [DNSViz](https://dnsviz.net/) gives an independent picture.
+
+If the parent zone is itself a primary zone in Jarl (`home.adbraun.lol`
+inside `adbraun.lol`), the DS goes in as a record in that zone, and Jarl
+gives you both ways to add it: an **Add to adbraun.lol** button on the
+DNSSEC tab, and the command, which `jarl zone dnssec status` prints too:
+
+```sh
+jarl record add adbraun.lol home DS 51126 13 2 FFBECE3D...
+```
+
+Once the parent zone has it, the tab and `status` say so. When turning
+signing off, the steps give the matching `jarl record delete adbraun.lol
+home DS`. The zone must be delegated first (NS records for `home` in
+`adbraun.lol`), or validation refuses the DS.
+
+## Putting your own name servers on the internet
+
+To serve your domain from your own server, the parent zone must delegate
+it to your server's *name* (NS records can't hold addresses). If that name
+is inside the domain itself (`ns1.adbraun.lol` for `adbraun.lol`),
+resolvers couldn't look it up without already reaching your server. **Glue
+records** solve this: the registry publishes `ns1.adbraun.lol`'s address
+together with the delegation. Each name server inside the domain needs its
+own glue record, with all of its addresses (IPv4 and IPv6).
+
+The order matters:
+
+1. In the zone (external view): NS records for your name servers, and A/AAAA
+   records for the ones inside the domain.
+2. At the registrar: a glue record for each of those (Porkbun calls them
+   "glue records", others "host records" or "child name servers").
+3. Check that every name server answers for the zone from the internet.
+4. At the registrar: set the domain's name servers.
+5. `jarl zone delegation ZONE` until it is all green. Resolvers may use the
+   old name servers for a day or two after the change, so keep those
+   serving the zone until then.
+
+Jarl's [Porkbun](#porkbun) support does steps 2 to 4 with checks.
+
+Before you go public:
+
+- **Two name servers.** Registries and RFC 1034 expect at least two, on
+  different networks: with one server at home, a power or internet outage
+  takes the domain off the internet. A free secondary service (Hurricane
+  Electric's dns.he.net, for example) or a small VPS transfers the zone
+  from Jarl, signed zone included. A *hidden primary* goes one step
+  further: your server feeds the secondaries but isn't in the NS records,
+  so your home address isn't advertised.
+- **A dynamic home address** means the glue must follow it.
+- **Inbound port 53** (UDP and TCP) must reach the server: some ISPs block
+  it, and CGNAT makes it impossible.
+
+## Porkbun
+
+With a Porkbun API key, Jarl manages a domain's name servers, glue records
+and DS records at Porkbun, and checks each change before making it. The
+same key also lets Jarl publish the DNS-01 challenges of its own
+certificates while Porkbun serves the domain's DNS
+([certificates.md](certificates.md#where-the-challenge-goes)).
+
+**Setting it up**
+
+1. At porkbun.com, *Account → API Access*: create a key. If you can,
+   limit it to the domain and the permissions it needs, and to your
+   server's address. The registrar features need the domain permissions;
+   certificate challenges need DNS record write access too.
+2. On the domain's page, switch **API Access** on (Porkbun refuses API
+   calls for a domain until you do).
+3. Put the key in `/etc/jarl/jarl.yaml` and restart jarld:
+
+   ```yaml
+   porkbun:
+     api_key: pk1_...
+     secret_api_key: sk1_...
+     domains: [adbraun.lol]   # optional: only these
+   ```
+
+The key can move your domain anywhere, so it lives only in that file:
+never in Jarl's database or its backups, and there is no API or CLI command
+to upload it. Keep the file readable by root and jarld only (`chown
+root:jarl`, `chmod 640`, as the package installs it); jarld warns at start
+when everyone can read it. Only administrators can use the registrar
+features.
+
+**Using it**: the zone's **Registrar** tab, or `jarl zone registrar`:
+
+| | |
+|---|---|
+| `status ZONE` | Name servers, glue and DS records at Porkbun next to the zone's, with what doesn't match. |
+| `sync-glue ZONE` | Gives every name server inside the domain a glue record with the zone's A and AAAA records for it. Changing the glue of a name server the domain already uses sends resolvers to the new addresses, so Jarl checks first that they answer for the zone. |
+| `set-ns ZONE [NS...]` | Sets the domain's name servers (default: the zone's NS records). Checked first: each answers for the zone with the current serial, the ones inside the domain have matching glue, and DS records at Porkbun match the zone's keys (otherwise the domain goes dark for validating resolvers). |
+| `publish-ds ZONE` | Publishes the zone's DS record. Refused until named says the zone is ready, and unless the domain is delegated to the zone's name servers and they serve the signed zone. |
+| `remove-ds ZONE KEYTAG` | Removes a DS record (the step when turning signing off; also the fix for a DS that matches no key). |
+
+Every change can be tried first with `--dry-run`, which shows the checks.
+Errors refuse the change; `--force` (in the web UI, a checkbox) overrides
+them, for example when this server can't reach its own public address to
+check it.
+
+## Turning signing off
+
+Never switch a signed zone straight to unsigned while its DS might still
+be at the parent: validating resolvers would reject the whole domain until
+the DS is gone *and* its TTL has passed (often a day). Jarl refuses that
+step and goes through BIND's `insecure` policy instead:
+
+```sh
+jarl zone dnssec disable adbraun.lol --view external
+```
+
+1. The zone switches to the `insecure` policy. named keeps it signed and
+   publishes a CDS "delete" record. Nothing breaks.
+2. Remove the DS record at your registrar (`jarl zone registrar remove-ds`
+   with Porkbun). Once the parent zone no longer has it, run `jarl zone
+   dnssec check-ds` so named knows.
+3. named waits until resolvers have forgotten the DS (the parent's DS TTL
+   plus a margin, about a day), then removes the keys and signatures.
+   `status` shows the progress.
+4. Run `jarl zone dnssec disable` again (or *Finish turning off* in the web
+   UI) when `status` says so: DNSSEC is then off for the zone.
+
+If the DS never reached the parent, named skips the wait and you can
+finish at once. The old keys stay in the key directory (named keeps them
+retired; signing again makes a new key) until you wipe them.
+
+## Wipe: a clean slate
+
+```sh
+jarl zone dnssec wipe adbraun.lol --view external
+```
+
+or *Wipe (clean slate)* on the DNSSEC tab. It switches signing off at once,
+without the insecure policy, and deletes the zone's keys and named's signed
+copy, so signing again starts from scratch. It also cleans up a zone that
+is off but still has old keys.
+
+That is only safe when the parent zone has no DS record for the zone, so
+Jarl asks the parent's servers first and **refuses while they have one**.
+It also refuses while named still counts a recently removed DS as cached.
+When the parent can't be asked (no internet access, or a zone that isn't on
+the internet), `--force` wipes anyway. Wiping needs an administrator, and
+the web UI asks you to type the zone's name.
+
+Deleting a zone that is signed is refused: turn signing off first.
+
+## Keys, backups and moving servers
+
+The zone's keys exist only in the key directory: Jarl's database doesn't
+hold them. Losing them while the parent has a DS for them breaks the
+domain.
+
+- **Backups.** Every backup (`jarld backup`, and the daily
+  `jarl-backup.timer`) stores the key directory's files inside the backup
+  file, private keys included. Keep `/var/backups/jarl` private (it is
+  `0700`). named's private keys are readable only by named's user, so
+  `jarl-backup.service` runs with the one capability it needs to read them
+  (`CAP_DAC_READ_SEARCH`); a manual backup must run as root. `--without-keys`
+  backs up only the database.
+- **Restoring.** `jarld restore` puts the keys back, owned by named's user
+  (`bind.named_user`), which needs root. Key files that exist but aren't in
+  the backup are left alone.
+- **Serials after a restore.** A restored database may have older zone
+  serials than named has. named won't load a signed zone's file unless its
+  serial went up, and secondaries ignore a serial that went down. Jarl
+  checks this whenever it writes a zone file, and raises the serial above
+  named's when needed (it shows in the result, and in the audit log).
+- **Moving to a new server.** Restore the backup *before* named loads
+  Jarl's configuration there. Otherwise named finds no keys and makes new
+  ones, which the parent's DS doesn't match.
+
+## What Jarl refuses, and why
+
+| Change | Why |
+|---|---|
+| Switching a signed zone straight to unsigned | The parent may still have the DS: use `disable` (insecure first), or `wipe` when the parent has none. |
+| Finishing `disable` before named is done | Resolvers may still have the DS cached. |
+| Deleting a signed zone | Turn signing off first. |
+| Moving a signed zone to another view | It would get new keys (another key directory) that the DS doesn't match. |
+| A TTL above the policy's `max-zone-ttl` (a day by default) | named refuses to load such a signed zone and keeps serving the old one. |
+| `dnssec-policy` as a zone, view or server option | Jarl sets it per zone, so it can guard the steps. Top-level `dnssec-policy NAME { ... }` statements (custom policies) are fine. |
+| A custom policy with an empty `keys { }` list | It crashes named 9.20 when the configuration loads (named-checkconf accepts it). Use the built-in `insecure` policy. |
+| `inline-signing no` on a signed zone | Jarl rewrites zone files; named must keep its signatures in a separate copy. |
+| Signing a secondary zone | A secondary gets its signatures from its primary. |
+
+## Phases
+
+`status`, the DNSSEC tab and the API report a phase:
+
+| Phase | Meaning | Next |
+|---|---|---|
+| `off` | Not signed. | |
+| `leftover_keys` | Not signed, but old keys are in the key directory. | Wipe them, or sign again. |
+| `starting` | Signing is on; named hasn't made the key yet. | Wait a moment. |
+| `signing` | Signed, but caches may not have the key yet. | Wait until the time shown, then publish the DS. |
+| `ready` | Safe to add the DS at the parent. | Publish it, then run the DS check. |
+| `ds_pending` | named knows the DS is at the parent and waits for its TTL. | |
+| `secure` | Signed, and the parent's DS points at the key. | |
+| `removing_ds` | Turning off; the DS must go from the parent first. | Remove it, then run the DS check. |
+| `ds_expiring` | The DS is gone; caches may still have it. | Wait. |
+| `removing_keys` | named removes the keys and signatures. | Finish when you like (it's safe now). |
+| `unsigned` | Turning off has finished. | Switch DNSSEC off for the zone. |
+
+The key states come from named (`rndc dnssec -status ZONE` shows the same):
+*rumoured* means published, but caches may not have it yet; *omnipresent*
+means everyone has it; *unretentive* means removed, but caches may still
+have it; *hidden* means gone.
+
+## Custom policies
+
+`default` suits most domains. For anything else (scheduled key rollovers,
+NSEC3, other algorithms), define a policy as a top-level statement
+(`jarl option set dnssec-policy 'NAME { ... }' --toplevel`, or *Server
+options* in the web UI) and enable it with `jarl zone dnssec enable ZONE
+--policy NAME`. With a policy that rolls the key-signing key,
+the DS at the parent must change at every rollover: `status` and the DS
+check tell you when, and named waits for the DS check before it retires
+the old key.
+
+## Adopting a signed zone
+
+When `jarld import` finds a zone that named already signs, it imports its
+policy and warns. Before `jarld adopt`, copy the zone's key files
+(`K<zone>.+*`) from its old key directory into the one Jarl uses (`jarl
+zone dnssec status ZONE` shows it), owned by named's user. Otherwise named
+makes new keys, and if the parent has a DS for the old ones, the zone stops
+validating.

docs/exposure.md

@@ -0,0 +1,213 @@
+# Internet exposure
+
+When a view (or the whole server) can be reached from the internet, a few
+things matter that don't on your own network: it shouldn't help attackers
+flood others with DNS answers (amplification), recurse for strangers, or
+tell scanners its exact version. Jarl works out which views are public,
+checks them, and stages the fixes for you to review.
+
+In the web UI: **Exposure** (and its card on the dashboard). In the CLI:
+`jarl exposure`. In the API: `GET /api/v1/exposure`.
+
+## Which views are public
+
+A view is **public** when its `match-clients` let in anyone: after ACLs
+and ranges are filled in, they end in a catch-all (`any`, `0.0.0.0/0`,
+`::/0`, or a prefix wider than /8 for IPv4 or /16 for IPv6), or they are
+empty, which named reads as "any". A typical external view
+(`match-clients { any; }` or `{ !internal; any; }`) is public.
+
+A view that lists the networks it serves is **private**, whatever kind of
+addresses those are. An internal view for your global IPv6 prefix
+(`2a02:8013:7f3d:10::/64`) is as private as one for `192.168.1.0/24`:
+listing a network says "these are mine". Jarl doesn't look at whether
+addresses are private (RFC 1918, ULA) for this, because on IPv6 your own
+devices have global addresses.
+
+A view whose `match-destinations` list only private addresses (it answers
+only on a private interface) is private too.
+
+**A server without views** has no match list, so Jarl looks at
+`allow-query` and where named listens: it is public when anyone may query
+it (`allow-query` unset, or with a catch-all) **and** named listens on an
+address that isn't private (a public IPv4 address or a global IPv6
+address of this host). This can't see your firewall, so it is a guess.
+
+**When Jarl gets it wrong**, override it per view: `public`, `private` or
+`auto`. For example, behind a NAT port forward named only ever sees
+private addresses although it is reachable from the internet.
+
+```sh
+jarl view update external --exposure public
+jarl settings set --exposure private          # a server without views
+```
+
+The Exposure page shows each view's classification and the reason
+("match-clients ends in any", "match-clients lists only homelab, no
+catch-all"), with a selector for the override.
+
+## The checks
+
+They run on public views only, and are warnings (they don't stop you
+applying) unless acknowledged.
+
+| Code | What | Fix Jarl can stage |
+|------|------|-------------------|
+| `exposure_rate_limit` | No response rate limiting: the view can be used to flood others with its answers (DNS amplification) | `rate-limit { responses-per-second 10; log-only yes; exempt-clients { your secondaries }; }` |
+| `exposure_rate_limit_log_only` (info) | Rate limiting only logs | The same block without `log-only`: start enforcing |
+| `security_open_resolver` | Recursion for anyone: an open resolver | `recursion no` in that view |
+| `exposure_minimal_any` | ANY queries get full answers, a favourite for amplification | `minimal-any yes` |
+| `exposure_cache_snooping` | `allow-query-cache` lets anyone see what your clients look up | `allow-query-cache { none; }` |
+| `security_open_transfer` | Zone transfers for anyone | none: allow your secondaries or a TSIG key |
+| `exposure_open_notify` | `allow-notify` accepts NOTIFY from anyone | none: allow your primaries |
+| `exposure_version` | `dig CH TXT version.bind` shows the exact BIND version | `version none` |
+| `exposure_hostname` | `dig CH TXT hostname.bind` shows the host name | `hostname none` |
+| `exposure_management` | `controls` or `statistics-channels` on an address that isn't loopback, open to anyone | none: use 127.0.0.1 or an allow list |
+
+The last three are server-wide: they are checked when any view is public.
+
+A **fix** goes into your pending changes like any edit (or is applied at
+once in live mode), so you see the named.conf diff before it reaches named:
+
+```sh
+jarl exposure                                         # classification, findings, fixes
+jarl exposure fix external exposure_rate_limit
+jarl exposure fix server exposure_version
+```
+
+## Response rate limiting
+
+Response rate limiting (RRL, BIND's `rate-limit`) counts identical
+responses sent to the same client network. Past the limit, named drops
+some and "slips" others: it sends a short reply asking the client to retry
+over TCP (or with a DNS cookie). A real client does; the spoofed victim of
+an amplification attack never sees the answers it didn't ask for. ISC
+recommends it for authoritative servers only, so Jarl only suggests it for
+public views, never for your internal resolver.
+
+Jarl starts from ISC's example, 10 identical responses per second per
+client network, and exempts the servers your zones notify and allow
+transfers to (`also-notify` and `allow-transfer` addresses, through ACLs
+too): limiting your own secondaries is the classic RRL mistake.
+
+**Rollout in two steps:**
+
+1. The fix turns rate limiting on with `log-only yes`. named answers
+   everyone as before, but logs every response it *would* have limited.
+   With [query statistics](stats.md) on, Jarl reads those lines: the
+   Exposure page shows how many responses would have been limited, and
+   which client networks and names. Check that your secondaries,
+   monitoring, or a big shared resolver aren't among them (add them to
+   `exempt-clients` if they are).
+2. When you're happy, **Start enforcing** (the fix of
+   `exposure_rate_limit_log_only`) removes `log-only`.
+
+In log-only mode named's own counters don't move: what would be limited
+is only in its log (category `query-errors`). That is why the activity
+needs query statistics; without them, look at named's log for
+`would rate limit`. When rate limiting is configured and statistics are
+on, Jarl adds `query-errors` to its log channel (keeping named's syslog
+destination for it).
+
+The statistics also count it: the `rrl` breakdown (`drop`, `slip`,
+`would-drop`, `would-slip`), the `ratelimited` and `ratelimited_name` top
+lists, and in Prometheus `jarl_ratelimit_logged_total{action}` next to
+named's own `jarl_ratelimit_responses_total` ([metrics.md](metrics.md)).
+
+### Settings
+
+You can tune the block like any option; `option set` replaces the whole
+block, so copy the current value from `jarl option list --view external`
+and edit it:
+
+```sh
+jarl option set rate-limit '{ responses-per-second 20; window 15; slip 2; exempt-clients { 192.0.2.53; }; log-only yes; }' --view external
+```
+
+named counts **identical responses** to the same **client network** (a
+/24 for IPv4, a /56 for IPv6) over a **window**, and limits each kind of
+response separately. These are the settings (BIND 9.20; the ARM has the
+full text):
+
+| Setting | Default | What it does | When to change it |
+|---------|---------|--------------|-------------------|
+| `responses-per-second` | 0 (off) | Answers with data for the same name and type, per client network. Wildcard answers count as the zone's apex. This is the main limit; Jarl's fix sets 10 | Raise it if a legitimate network shows up in log-only mode, e.g. a large shared resolver (mobile carriers, public resolvers) asking for your popular names |
+| `nxdomains-per-second` | same as `responses-per-second` | NXDOMAIN answers (names that don't exist), counted together for a domain whatever the name asked | `0` turns NXDOMAIN limiting off, for zones that legitimately get many lookups of missing names |
+| `nodata-per-second` | same as `responses-per-second` | Empty answers (the name exists, the type doesn't), counted together whatever the type | Rarely |
+| `referrals-per-second` | same as `responses-per-second` | Referrals to child zones you delegate | Only if you delegate subdomains to other servers |
+| `errors-per-second` | same as `responses-per-second` | Other errors (REFUSED, SERVFAIL, FORMERR), counted together whatever the name | Rarely. REFUSED and SERVFAIL can't be truncated, so slipped ones still go out at the slip rate |
+| `all-per-second` | 0 (off) | All UDP answers to a client network, of any kind, like a firewall rate limit; over it, answers are only **dropped** (`slip` doesn't apply) | Usually leave off; if you use it, ISC says at least 4 times the other limits |
+| `window` | 15 seconds (1–3600) | How far back named counts. A client over the limit stays limited until its rate over the window falls again | Longer windows remember attackers longer and also punish short legitimate bursts longer |
+| `slip` | 2 (0–10) | Of the limited answers, every n-th "slips": instead of being dropped it gets a short reply asking the client to retry: truncated (TC) so it retries over TCP, or, when the query carried a DNS cookie, BADCOOKIE with a server cookie that lets it through on its retry. `0` drops all, `1` slips all | `1` if you'd rather every real client gets a retry hint; `0` drops all (spoofed victims see nothing, but real clients just time out) |
+| `ipv4-prefix-length` | 24 | The size of the client network answers are counted for (IPv4) | `32` counts each address on its own: fairer to neighbours, more memory |
+| `ipv6-prefix-length` | 56 | The same for IPv6 | `64` if one /56 holds many independent clients; `48` to treat a whole site as one |
+| `exempt-clients` | none | Address match list (addresses, prefixes, [ranges](concepts.md#model-views-zones-records-options), ACLs) that is never limited. Jarl's fix puts your secondaries here | Add monitoring, other servers of yours, and anything legitimate that log-only mode shows |
+| `log-only` | no | Count and log what would be limited, answer everyone normally | Jarl starts with `yes`; the "start enforcing" fix removes it |
+| `qps-scale` | off | When the total query rate is above this, all limits shrink in proportion (at a rate of 1000 with `qps-scale 250`, a limit of 20 becomes 5) | Only on busy servers that see attacks spread over many networks |
+| `max-table-size`, `min-table-size` | min 500 entries | The table of client networks named tracks (40–80 bytes per entry) | Only on busy servers |
+
+What Jarl checked against real named: TCP answers are never limited;
+`nxdomains-per-second` falls back to `responses-per-second` and `0`
+turns it off; NXDOMAIN answers for different missing names in a zone
+share one limit; `all-per-second` only drops; with `slip 1`, clients
+without DNS cookies get truncated answers, and clients with cookies (dig
+sends them by default) get through on their retry with the server's
+cookie; `exempt-clients` is never limited; in log-only mode nothing is
+limited and only the log shows what would be.
+
+Rate limiting is per view: put it in the external view (`--view
+external`). Set in the server options, it applies to every view that has
+none of its own, your internal resolver included, which RRL isn't meant
+for.
+
+## Confirming a change that opens a view up
+
+A change that *introduces* an open resolver, open zone transfers, cache
+snooping, open NOTIFY or an open management interface on a public view
+must be confirmed:
+
+- **Web UI:** the Changes page shows the finding with a checkbox (*I
+  understand: …*); **Apply** stays disabled until it is ticked.
+- **CLI:** the command stops (exit 5) and says why; run it again with
+  `--accept-risk`.
+- **API:** `accept_risk: true` in the apply body, or `?accept_risk=1` on a
+  change applied at once; without it the answer is 409 `confirm_risk`.
+  Previews (`GET /changesets/{id}/preview`) list them as `risks`.
+
+Only changes that newly open something up ask: an unrelated change to a
+view that is already open, or taking back an acknowledgement, doesn't.
+
+## Acknowledging a finding
+
+Some findings are deliberate: a public resolver for a club's network, a
+visible version string. Acknowledge them with a reason:
+
+```sh
+jarl exposure ack external security_open_resolver --reason "public resolver for the club, monitored"
+jarl exposure ack server exposure_version --reason "version shown on purpose"
+jarl exposure unack external security_open_resolver
+```
+
+The finding doesn't disappear: it stays visible as **info**, with who
+accepted it, when and why (*open resolver … (acknowledged by adam on 12
+Oct 2026: public resolver for the club, monitored)*), on the Exposure page,
+the dashboard and in `jarl check`. An acknowledgement covers that one
+finding on that one view (or the server); the same finding elsewhere
+warns as usual. Acknowledging is a configuration change like any other,
+so it is in the history and audit log, and can be reverted.
+
+Jarl isn't designed to run an open resolver, and an acknowledgement makes
+one deliberate and visible, not safe: a public resolver also needs abuse
+monitoring, response size limits and usually a machine of its own.
+
+## API
+
+| Method | Path | Body |
+|--------|------|------|
+| GET | `/exposure` | `scopes` (per view, or the server: `public`, `override`, `reason`, `rate_limit` off/log-only/enforcing, `findings` with `fix` where Jarl has one), `server` (server-wide findings), `rate_limiting` (last 24h, with statistics: `counts`, `networks`, `names`) |
+| POST | `/exposure/fix` | `{"view": "external", "code": "exposure_rate_limit"}` (`view_id` works too; no view: the server). Staged with `?changeset=` like any change |
+| POST | `/exposure/ack` | `{"view": "external", "code": "security_open_resolver", "reason": "..."}` |
+| POST | `/exposure/unack` | `{"view": "external", "code": "security_open_resolver"}` |
+
+The override is a view's `exposure` field (`PATCH /views/{id}`), or the
+settings' for a server without views (`PATCH /settings`).

docs/install.md

@@ -60,6 +60,17 @@ sudo apt update
 sudo apt install jarl
 ```
 
+Release candidates (`0.2.0-rc.1`) are published to a separate `testing`
+distribution, so the `stable` line above only ever installs releases. To
+try release candidates on a test machine, add `testing` as well. apt then
+installs the newest of either, which is the RC until the final release
+replaces it:
+
+```sh
+echo "deb [signed-by=/etc/apt/keyrings/jarl.asc] https://gitea.adbraun.lol/api/packages/adam/debian testing main" \
+  | sudo tee -a /etc/apt/sources.list.d/jarl.list
+```
+
 The packages are as visible as the Gitea account that owns them, not the
 repository: with a public account, apt needs no login even if the
 repository is private. For a private or limited account, give apt a token
@@ -77,9 +88,9 @@ password <token>
 Download the two `.deb` files from the release page, or build them:
 
 ```sh
-make deb                                  # dist/jarl_0.1.0_amd64.deb and dist/jarl-cli_0.1.0_amd64.deb
+make deb                                  # dist/jarl_0.2.0_amd64.deb and dist/jarl-cli_0.2.0_amd64.deb
 make deb DEB_ARCH=arm64                   # for another architecture (also armhf, i386, ...)
-sudo apt install ./dist/jarl_0.1.0_amd64.deb ./dist/jarl-cli_0.1.0_amd64.deb
+sudo apt install ./dist/jarl_0.2.0_amd64.deb ./dist/jarl-cli_0.2.0_amd64.deb
 ```
 
 Give apt both files: `jarl` needs `jarl-cli` of the same version.
@@ -128,7 +139,7 @@ To manage Jarl servers from your laptop or another server, install only
 users, services or directories):
 
 ```sh
-sudo apt install jarl-cli      # with the registry above; or: sudo apt install ./jarl-cli_0.1.0_amd64.deb
+sudo apt install jarl-cli      # with the registry above; or: sudo apt install ./jarl-cli_0.2.0_amd64.deb
 jarl config set server https://ns1.adbraun.lol:8053
 jarl config set token
 ```
@@ -156,7 +167,7 @@ This installs:
 | `/usr/local/bin/jarld`, `/usr/local/bin/jarl` | daemon and CLI |
 | `/usr/local/share/bash-completion/completions/jarl`, `.../jarld` | bash completion (loaded automatically by the `bash-completion` package) |
 | `/etc/systemd/system/jarl.service` | systemd unit (`Type=notify`, sandboxed) |
-| `/etc/systemd/system/jarl-backup.service`, `jarl-backup.timer` | the daily database backup ([operations.md](operations.md#backups)) |
+| `/etc/systemd/system/jarl-backup.service`, `jarl-backup.timer` | the daily database backup, DNSSEC keys included ([operations.md](operations.md#backups)) |
 | `/usr/lib/sysusers.d/jarl.conf` | creates the `jarl` system user and adds it to group `bind` |
 | `/usr/lib/tmpfiles.d/jarl.conf` | creates `/etc/jarl`, `/var/lib/jarl`, `/etc/bind/jarl`, `/var/lib/bind/jarl`, `/var/cache/bind/jarl`, `/var/backups/jarl` |
 | `/etc/jarl/jarl.yaml` | example configuration (only if none exists) |
@@ -230,12 +241,14 @@ tar czf /root/bind-before-jarl-$(date +%F).tgz /etc/bind /var/lib/bind /var/cach
 ## 5. Create the database and the first administrator
 
 ```sh
-sudo -u jarl jarld init --token \
+sudo -u jarl jarld init --token -u adam \
     --nameservers ns1.adbraun.lol. --contact hostmaster@adbraun.lol
 ```
 
-It asks for the administrator's password (user `admin`, change it with
-`-u NAME`). `--token` also prints an API token for the CLI, shown only
+It asks for the administrator's password. Name the account after yourself
+(`-u`, default `admin`): each person should have their own account, with
+their own [two-factor login](permissions.md#two-factor-login), which you
+can turn on under Account once you have logged in. `--token` also prints an API token for the CLI, shown only
 once. `--nameservers` and `--contact` are the defaults for zones you create
 later, and you can change them in the UI or with `jarl settings set`.
 
@@ -322,7 +335,8 @@ jarl status
 jarl zone list
 ```
 
-The CLI's settings are stored in `~/.config/jarl/config.yaml` (mode 0600).
+The CLI's settings are stored in `~/.config/jarl/config.yaml` (mode 0600;
+macOS and Windows use their own folders, see [cli.md](cli.md#setup)).
 `JARL_SERVER` and `JARL_TOKEN` override them, which is handy in scripts.
 Create more tokens in the web UI (Account → API tokens) or with
 `jarl token create NAME`. See [cli.md](cli.md).
@@ -373,12 +387,15 @@ sudo apt update && sudo apt upgrade      # Debian packages from the registry
 make && sudo make install && sudo systemctl restart jarl   # make install
 ```
 
-Database migrations run automatically at startup. Before an upgrade, take
-a backup (it is safe while jarld runs); `jarld restore` puts it back if
-needed:
+Database migrations run automatically at startup. An older Jarl refuses
+to start on a database a newer one has upgraded ("database schema version
+4 is newer than this Jarl"). So going back to an earlier version, after
+trying a release candidate say, means restoring a backup taken before the
+upgrade. Before an upgrade, take a backup (it is safe while jarld runs);
+`jarld restore` puts it back if needed:
 
 ```sh
-sudo -u jarl jarld backup
+sudo jarld backup
 ```
 
 ## Uninstalling

docs/metrics.md

@@ -0,0 +1,244 @@
+# Prometheus metrics
+
+jarld can serve metrics for [Prometheus](https://prometheus.io/) at
+`/metrics`:
+- **health** you can alert on: named up, validation problems, files changed
+  outside Jarl, blocklists that fail to download, backup age, DNSSEC zones
+  waiting for you at the parent, and API tokens about to expire,
+- **queries**, once [query statistics](stats.md) are on: named's counters
+  (result codes, record types, cache, upstream times, DNSSEC validation, rate
+  limiting) and Jarl's own (responses per view and zone, blocked queries per
+  blocklist), plus named's memory, CPU, cache and sockets.
+
+Metrics are **off by default**. Everything is set in `/etc/jarl/jarl.yaml`;
+nothing is stored in the database.
+
+## Turning it on
+
+Prometheus on the same server needs only:
+
+```yaml
+metrics:
+  enabled: true
+```
+
+```sh
+sudo systemctl restart jarl
+curl -s http://127.0.0.1:8053/metrics | head
+```
+
+`/metrics` is served on the addresses in `listen` (and their TLS, if set)
+and on the local socket. Query counters also need `stats.enabled: true`
+([stats.md](stats.md)); without it you get only the health metrics.
+
+### Prometheus on another machine
+
+Give `/metrics` an address of its own and say who may scrape it:
+
+```yaml
+metrics:
+  enabled: true
+  listen: ["0.0.0.0:9450"]       # serves only /metrics, over plain HTTP
+  allow: ["192.168.1.20"]        # the Prometheus server
+```
+
+```yaml
+# prometheus.yml
+scrape_configs:
+  - job_name: jarl
+    static_configs:
+      - targets: ["dns.lan:9450"]
+```
+
+Or use a token instead of (or as well as) the address list. Any address
+that sends it may scrape:
+
+```yaml
+metrics:
+  enabled: true
+  listen: ["0.0.0.0:9450"]
+  token: "…"                     # e.g. from: openssl rand -hex 24
+```
+
+```yaml
+# prometheus.yml
+scrape_configs:
+  - job_name: jarl
+    authorization:
+      credentials: "…"           # or credentials_file: /etc/prometheus/jarl.token
+    static_configs:
+      - targets: ["dns.lan:9450"]
+```
+
+With a token in jarl.yaml, keep the file readable by root and jarld only
+(`chown root:jarl /etc/jarl/jarl.yaml; chmod 640 /etc/jarl/jarl.yaml`);
+jarld warns at start when everyone can read it. On `metrics.listen` the
+token travels unencrypted, so use it on a network you trust, or scrape the
+main listener over HTTPS instead (`scheme: https` and its port in
+Prometheus).
+
+### Settings
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `metrics.enabled` | `false` | Serve `/metrics`. |
+| `metrics.listen` | `[]` | Extra `ADDRESS:PORT`s that serve only `/metrics`, over plain HTTP. |
+| `metrics.allow` | `["127.0.0.1", "::1"]` | Addresses or prefixes that may scrape without a token. Behind a reverse proxy in `trusted_proxies`, this is the client's address from `X-Forwarded-For`. `[]` with a token: the token is required everywhere. |
+| `metrics.token` | `""` | A bearer token (at least 16 characters) that lets any address scrape. |
+
+A scrape is allowed when it comes from an address in `allow`, **or**
+carries the token, **or** comes over the local socket from root or jarld's
+own user. A wrong token is refused (and counts towards the per-address
+limit on failed logins). Jarl's API tokens don't work for `/metrics`.
+
+The firewall must let Prometheus reach the port. `allow` is checked by
+jarld, not the kernel.
+
+## What is exported
+
+Everything is prefixed `jarl_`. The text format is checked with `promtool
+check metrics`.
+
+### Health (always)
+
+These are read at most every 15 seconds; a scrape in between gets the
+same values.
+
+| Metric | Meaning |
+|--------|---------|
+| `jarl_build_info{version}` | Always 1. |
+| `jarl_start_time_seconds` | When jarld started. |
+| `jarl_metrics_state_ok` | 0 when Jarl's state couldn't be read (see jarld's log). |
+| `jarl_adopted` | 1 when named loads Jarl's configuration. |
+| `jarl_named_up` | 1 when named answers `rndc status` (missing with `bind.no_reload`). |
+| `jarl_named_recursive_clients`, `…_soft_limit`, `…_limit` | Recursive clients now, and named's limits (`rndc status`). |
+| `jarl_named_tcp_clients`, `…_limit` | TCP clients now, and the limit. |
+| `jarl_open_changesets` | Changesets with staged changes not applied yet. |
+| `jarl_last_apply_timestamp_seconds` | When the last changeset was applied. |
+| `jarl_problems{severity}` | Validation problems (`error`, `warning`, `info`) as on the dashboard, including named's own warnings. |
+| `jarl_drifted_files` | Managed files changed or removed outside Jarl. |
+| `jarl_objects{kind}` | Views, zones, records, ACLs, TSIG keys and options. |
+| `jarl_backup_last_success_timestamp_seconds`, `jarl_backup_last_size_bytes` | The newest backup by `jarld backup`. |
+| `jarl_backup_last_failure_timestamp_seconds` | A failed backup newer than the last good one. |
+| `jarl_backup_stale` | 1 when the newest backup is older than `backup.warn_after`. |
+| `jarl_blocking_paused` | 1 while blocking is paused (only with blocklists or rules). |
+| `jarl_blocking_paused_until_timestamp_seconds` | When a timed pause ends. |
+| `jarl_blocklist_enabled{list}` | 1 for lists that are switched on. |
+| `jarl_blocklist_entries{list}` | Domains in the last good download. |
+| `jarl_blocklist_failing{list}` | 1 when the last download or check of an enabled list failed. |
+| `jarl_blocklist_last_check_timestamp_seconds{list}`, `jarl_blocklist_last_change_timestamp_seconds{list}` | When the list was last checked, and last changed. |
+| `jarl_dnssec_phase{zone,view,phase}` | Always 1, one per signed zone; `phase` is one of the [DNSSEC phases](dnssec.md). `ready` means: add the DS at the parent. `removing_ds`: remove it. |
+| `jarl_token_expiry_timestamp_seconds{id,user,token}` | When each API token with an expiry date expires. |
+| `jarl_certificate_expiry_timestamp_seconds{certificate,source}` | When each certificate Jarl manages expires ([certificates.md](certificates.md)). |
+| `jarl_certificate_failing{certificate,source}` | 1 when obtaining (or reading) the certificate failed the last time, or it has expired. |
+| `jarl_certificate_renewal_failures{certificate}` | Failed attempts to obtain a certificate since its last success. |
+
+### Queries (with `stats.enabled`)
+
+The counters start at zero when jarld starts (Prometheus handles that).
+named's counters move once a minute, when Jarl polls named's statistics
+channel. Counters from the response log (`responses`, views, zones,
+blocking) move as lines are read and need `stats.query_log`. Clients in
+`stats.exclude_clients` are left out of those. Names and clients are not
+exported, because there would be too many of them. Use the Statistics page
+for them.
+
+| Metric | Meaning |
+|--------|---------|
+| `jarl_queries_total` | Queries named received. |
+| `jarl_responses_by_rcode_total{rcode}` | Responses by result code (`NOERROR`, `NXDOMAIN`, `SERVFAIL`, `REFUSED`, …). |
+| `jarl_queries_by_type_total{type}` | Queries by record type. |
+| `jarl_queries_by_transport_total{transport}` | `udp` and `tcp`. |
+| `jarl_answers_total{source}` | `authoritative` or `recursive`. |
+| `jarl_recursion_queries_total`, `jarl_dropped_queries_total`, `jarl_duplicate_queries_total` | Queries that caused recursion, that named dropped, and duplicates. |
+| `jarl_ratelimit_responses_total{action}` | Responses rate limiting `dropped` or `slipped` (named's counters; they don't move in log-only mode). |
+| `jarl_ratelimit_logged_total{action}` | Rate limited responses from named's log: `drop`, `slip`, and in log-only mode `would-drop`, `would-slip` ([exposure.md](exposure.md#response-rate-limiting)). |
+| `jarl_upstream_responses_by_rtt_total{rtt}` | Upstream answers during recursion by round-trip time (`<10ms` … `>1600ms`). |
+| `jarl_dnssec_validations_total{result}` | `valid`, `valid-negative` and `failed`. |
+| `jarl_cache_lookups_total{result}` | `hits` and `misses`. |
+| `jarl_logged_responses_total` | Responses read from the response log. |
+| `jarl_responses_by_view_total{view}` | Logged responses per view (`_default` without views). |
+| `jarl_responses_by_zone_total{zone}` | Logged responses per local zone; `-` for names in no local zone. |
+| `jarl_blocked_queries_total` | Queries blocking answered. |
+| `jarl_blocked_by_list_total{list}` | Blocked queries per blocklist; `rules` for your own rules. |
+| `jarl_stats_poll_ok`, `jarl_stats_last_poll_timestamp_seconds` | Whether the last poll of named's statistics channel worked, and when it was. |
+| `jarl_stats_log_lines_total`, `jarl_stats_last_log_line_timestamp_seconds` | Response log lines read, and the time of the last one. |
+| `jarl_stats_warnings` | Warnings on the Statistics page (e.g. no log lines while named answers queries). |
+| `jarl_named_start_time_seconds`, `jarl_named_config_time_seconds` | When named started, and last loaded its configuration. |
+| `jarl_named_resident_memory_bytes`, `jarl_named_threads`, `jarl_named_cpu_seconds_total` | named's process (`/proc`). |
+| `jarl_named_memory_in_use_bytes` | Memory named counts as in use. |
+| `jarl_named_cache_rrsets`, `jarl_named_cache_memory_bytes` | named's caches, all views together. |
+| `jarl_named_sockets{proto}` | Open UDP and TCP sockets. |
+| `jarl_named_recursive_clients_highwater`, `jarl_named_tcp_clients_highwater` | The most clients at once since named started. |
+
+Host metrics (load, memory, disks) are left to
+[node_exporter](https://github.com/prometheus/node_exporter).
+
+## Example queries
+
+```promql
+# Queries per second, and the share that failed
+rate(jarl_queries_total[5m])
+rate(jarl_responses_by_rcode_total{rcode="SERVFAIL"}[5m]) / ignoring(rcode) rate(jarl_queries_total[5m])
+
+# Blocked share of logged responses, per list
+rate(jarl_blocked_by_list_total[1h]) / ignoring(list) group_left rate(jarl_logged_responses_total[1h])
+
+# Busiest zones
+topk(5, rate(jarl_responses_by_zone_total{zone!="-"}[1h]))
+
+# Cache hit rate
+rate(jarl_cache_lookups_total{result="hits"}[5m]) / ignoring(result) sum without(result) (rate(jarl_cache_lookups_total[5m]))
+```
+
+## Example alerts
+
+```yaml
+groups:
+  - name: jarl
+    rules:
+      - alert: JarlDown
+        expr: up{job="jarl"} == 0
+        for: 5m
+      - alert: NamedDown
+        expr: jarl_named_up == 0
+        for: 2m
+      - alert: JarlConfigErrors
+        expr: jarl_problems{severity="error"} > 0
+        for: 15m
+      - alert: JarlDrift
+        expr: jarl_drifted_files > 0
+        for: 15m
+      - alert: BlocklistFailing
+        expr: jarl_blocklist_failing == 1
+        for: 6h
+      - alert: BackupStale
+        expr: jarl_backup_stale == 1
+      - alert: DNSSECWaitingForYou
+        expr: jarl_dnssec_phase{phase=~"ready|removing_ds|unsigned"} == 1
+        for: 1h
+        annotations:
+          summary: "{{ $labels.zone }}: DNSSEC is waiting for a step at the parent ({{ $labels.phase }})"
+      - alert: TokenExpiresSoon
+        expr: jarl_token_expiry_timestamp_seconds - time() < 7 * 86400
+        annotations:
+          summary: "API token {{ $labels.token }} of {{ $labels.user }} expires within a week"
+      - alert: CertificateFailing
+        expr: jarl_certificate_failing == 1
+        for: 12h
+        annotations:
+          summary: "Certificate {{ $labels.certificate }} can't be renewed (see the Certificates page)"
+      - alert: CertificateExpiresSoon
+        expr: jarl_certificate_expiry_timestamp_seconds - time() < 10 * 86400
+        annotations:
+          summary: "Certificate {{ $labels.certificate }} expires within 10 days"
+      - alert: BlockingPausedForLong
+        expr: jarl_blocking_paused == 1
+        for: 24h
+      - alert: NamedRecursiveClientsHigh
+        expr: jarl_named_recursive_clients / jarl_named_recursive_clients_soft_limit > 0.8
+        for: 5m
+      - alert: StatsNotCollecting
+        expr: jarl_stats_poll_ok == 0 or jarl_stats_warnings > 0
+        for: 15m
+```

docs/operations.md

@@ -6,7 +6,8 @@
 |------|-----|
 | Is everything healthy? | `jarl status`, or the web UI dashboard: named reachable, adoption, drift, open changesets, configuration problems, the newest backup, tokens about to expire |
 | Are the secondaries up to date? | `jarl zone serials ZONE`, or the zone's Name servers tab ([below](#checking-name-servers-and-the-delegation)) |
-| Back up / restore | Daily by `jarl-backup.timer`; by hand `sudo -u jarl jarld backup`; restore with `jarld restore` ([below](#backups)) |
+| Back up / restore | Daily by `jarl-backup.timer`; by hand `sudo jarld backup`; restore with `jarld restore` ([below](#backups)) |
+| DNSSEC | `jarl zone dnssec status ZONE`, or the zone's DNSSEC tab ([dnssec.md](dnssec.md)) |
 | What changed and who did it? | `jarl history`, `jarl changeset show ID` (with diff), `jarl audit` |
 | Undo a change | `jarl changeset revert ID`, review it, then `jarl changeset apply NEW_ID` (or History → Revert in the UI) |
 | Check the configuration | `jarl check`: full validation plus `named-checkconf -z` |
@@ -23,8 +24,10 @@ loaded. jarld is only needed to make changes.
 
 Everything Jarl knows is in its database (`/var/lib/jarl/jarl.db`): zones,
 records, views, ACLs, TSIG keys, options, users, tokens, history and the
-audit log. named's files are generated from it, so the database is the one
-thing to back up.
+audit log. named's files are generated from it. The one exception is the
+DNSSEC keys of signed zones, which named keeps in Jarl's key directory
+(`/var/lib/bind/jarl/dnssec-keys`): every backup stores those too, inside the
+backup file ([dnssec.md](dnssec.md#keys-backups-and-moving-servers)).
 
 ### The daily backup
 
@@ -41,17 +44,19 @@ Each run:
 1. writes a consistent copy of the database with SQLite's `VACUUM INTO`
    (safe while jarld runs and changes things) to a temporary file in the
    backup directory;
-2. checks the copy with SQLite's `integrity_check`, and only then gives it
+2. stores the DNSSEC keys in it (every file of the key directory, private
+   keys included);
+3. checks the copy with SQLite's `integrity_check`, and only then gives it
    its name, `jarl-<UTC time>.db`, e.g. `jarl-20261008T031512Z.db`. A file
    with that name is always a complete, intact backup;
-3. deletes backups older than `retention`, but always keeps the newest
+4. deletes backups older than `retention`, but always keeps the newest
    `keep_at_least`, however old they are. If backups stop for a while (the
    machine was off, the disk was full), the old ones aren't all deleted by
    the next run. Ages come from the time in the name, not the file's
    modification time, which copying the directory would change. Only files
    named `jarl-<time>.db` (and `stats-<time>.db`) are ever deleted, so
    anything else you put in the directory is safe;
-4. records the result in the database, so the dashboard and `jarl status`
+5. records the result in the database, so the dashboard and `jarl status`
    show when the newest backup was made, and whether the last attempt
    failed.
 
@@ -87,7 +92,9 @@ systemctl edit jarl-backup.timer
 
 The backup service runs as the `jarl` user in a sandbox that may only
 write to `/var/lib/jarl` and `/var/backups/jarl` (created by
-`tmpfiles.d/jarl.conf`, mode 0700). To keep backups elsewhere, set
+`tmpfiles.d/jarl.conf`, mode 0700). It has one capability,
+`CAP_DAC_READ_SEARCH`, to read named's DNSSEC private keys, which only
+named's user may read. To keep backups elsewhere, set
 `backup.dir`, create the directory (owned by `jarl`, mode 0700) and allow
 it:
 
@@ -104,18 +111,23 @@ well.
 ### By hand
 
 ```sh
-sudo -u jarl jarld backup                       # into backup.dir, as the timer does
-sudo -u jarl jarld backup /root/before-upgrade.db  # one copy, never deleted automatically
-sudo jarld restore                              # list the backups in backup.dir
+sudo jarld backup                       # into backup.dir, as the timer does
+sudo jarld backup /root/before-upgrade.db  # one copy, never deleted automatically
+sudo jarld restore                       # list the backups in backup.dir
+sudo systemctl start jarl-backup         # or exactly what the timer runs
 ```
 
 Query statistics live in a separate database (`/var/lib/jarl/stats.db`).
 DNS doesn't need it, so it is backed up only with `backup.stats: true`, as
 `stats-<UTC time>.db`.
 
+Run it as root (files it creates are given to `jarl`): named's DNSSEC
+private keys are readable only by named's user. As another user it fails
+when there are keys; `--without-keys` backs up only the database.
+
 The database holds password and token *hashes*, and TSIG secrets in the
-clear. Backups are written with mode 0600 into a 0700 directory; keep any
-copies just as private.
+clear, and backups hold the DNSSEC private keys too. Backups are written
+with mode 0600 into a 0700 directory; keep any copies just as private.
 
 ### Restoring
 
@@ -138,7 +150,11 @@ changing anything (`--yes` skips the question). Then it:
   `jarl.db.before-restore-<UTC time>` (with its `-wal` and `-shm` files),
   so a restore can be undone the same way;
 * copies the backup in place, upgrades it to the current schema if it is
-  older, and records the restore in its audit log.
+  older, and records the restore in its audit log;
+* puts the DNSSEC keys stored in the backup back into the key directory,
+  owned by named's user (`bind.named_user`) with the modes they had. Key
+  files that are there but not in the backup are left alone.
+  `--without-keys` skips this; without it, a backup with keys needs root.
 
 Then start jarld and bring named in line with the restored database:
 
@@ -152,11 +168,14 @@ jarl resync --force         # write everything and reload named
 Things to know:
 
 * **Zone serials.** An older backup can carry lower zone serials than named
-  last served. Your own named doesn't mind, but secondaries and caches
-  ignore a serial that went backwards, so they keep the newer data. If you
-  have secondaries, raise the serials after a restore:
-  `jarl zone update ZONE --serial <higher than before>`, then check with
-  `jarl zone serials ZONE`.
+  last served. Secondaries ignore a serial that went backwards, and named
+  refuses one for a signed zone. Jarl handles it: whenever it writes a zone
+  file whose serial isn't above the one named has loaded, it raises the
+  serial past named's (the resync result and the audit log show it). Check
+  the secondaries afterwards with `jarl zone serials ZONE`.
+* **DNSSEC keys** must be back before named loads a signed zone, or named
+  makes new keys that the parent's DS record doesn't match. On a new
+  machine, restore before adopting.
 * **Tokens and passwords** go back to what they were when the backup was
   made: tokens created since are gone, and revoked ones work again. Rotate
   or revoke as needed.
@@ -218,6 +237,7 @@ socket, without a token.
 | Forgot the admin password | `sudo jarl user update admin --password`, or (also with jarld stopped) `sudo -u jarl jarld user passwd admin` |
 | Locked out by the login rate limit | wait 15 minutes, or `systemctl restart jarl` (the limiter is in memory) |
 | Lost every admin account | `sudo -u jarl jarld user add --admin rescue` |
+| Lost the phone with the authenticator app, and the recovery codes | another administrator: Users → Reset 2FA, or `jarl user totp reset NAME`; on the server: `sudo -u jarl jarld user totp reset NAME` |
 | Need a token without the web UI | `sudo jarl token create cli --user admin`, or `sudo -u jarl jarld user token admin cli` |
 
 ## A secondary server
@@ -343,6 +363,9 @@ rndc reconfig
 ## Monitoring
 
 * `GET /healthz` (no authentication) reports that jarld is up.
+* Prometheus: `/metrics` covers named up, configuration problems, drift,
+  blocklist failures, backup age, DNSSEC steps waiting at the parent and
+  expiring tokens, with example alerts ([metrics.md](metrics.md)).
 * On the server, a check can use the local socket and needs no token:
   `sudo jarl status -o json`.
 * `GET /api/v1/status` with a read-only token reports named reachability,

docs/permissions.md

@@ -4,7 +4,7 @@
 
 | Who | How | Notes |
 |-----|-----|-------|
-| People in the web UI | Username + password → session cookie | argon2id password hashes. The session cookie is HttpOnly and SameSite=Strict and lasts 12h (2h idle). Every change also needs the session's CSRF token, which the UI sends in `X-CSRF-Token`. Changing a password logs out the user's other sessions. |
+| People in the web UI | Username + password (+ a code from an authenticator app, with [two-factor login](#two-factor-login)) → session cookie | argon2id password hashes. The session cookie is HttpOnly and SameSite=Strict and lasts 12h (2h idle). Every change also needs the session's CSRF token, which the UI sends in `X-CSRF-Token`. Changing a password logs out the user's other sessions. |
 | CLI, scripts, certbot | API token: `Authorization: Bearer jarl_...` | Shown once at creation, stored hashed. Optional expiry. Revocable. Last use time and IP are recorded. |
 | lego / Traefik (`httpreq`) | HTTP Basic: the token's user and the API token | Only on `/api/v1/acme/httpreq/...`, only when `acme.httpreq.enabled` is set, and by default only over HTTPS ([acme.md](acme.md)). The token's grants apply as usual. |
 | Root on the server, with the CLI | jarld's local socket (`/run/jarl/jarl.sock`): no token | `sudo jarl ...` with no server configured. The kernel tells jarld which system user is connecting; root and the `jarl` user are administrators, anyone else must send a token. Audited as the system user (e.g. `root`) via `socket`. See [The local socket](#the-local-socket). |
@@ -24,11 +24,101 @@ A user **without a password** (`--no-password`) is a service account. It
 can't log in to the web UI and is used only through its tokens, which suits
 certbot, CI jobs and backups.
 
+## Two-factor login
+
+Users can protect their web login with a second factor: a 6-digit code
+from an authenticator app on their phone (TOTP: Aegis, Google
+Authenticator, 1Password, Bitwarden and the like). A stolen password alone
+then gets nobody in.
+
+**Setting it up** (Account → Two-factor login): enter your password, scan
+the QR code (or type the key shown under it), and enter the code the app
+shows. Only then is it on, so a bad scan can't lock you out. Jarl then
+shows **10 recovery codes**, once: save them in a password manager or print
+them. Each logs you in once instead of a code, for when the phone is lost.
+Turning it on logs out your other sessions.
+
+**Logging in**: username and password first; the second screen asks for
+the code (or, under "Lost your phone?", a recovery code). The password
+step alone gives no session: it is good for 5 minutes and 5 tries. Codes
+from one 30-second step either side of now are accepted, for clocks that
+are a little off, and each code works only once. Wrong codes count
+against the same rate limit as wrong passwords.
+
+**Actions that ask for a code again.** Some things would let a stolen
+session or password outlive the second factor, so with two-factor login
+they need a code from the last 5 minutes (logging in counts): creating
+or rotating API tokens, creating, changing or deleting users, and
+resetting someone's two-factor login. The web UI asks for a code when
+needed; API clients send it in the `X-Jarl-TOTP` header
+([api.md](api.md#authentication)).
+
+**What it doesn't cover**: API tokens and the local socket. A token is
+already its own long random secret, and scripts can't answer a code
+prompt, which is why making one asks for a code. Root on the server can
+read the database anyway, so a code would add nothing there.
+
+**Making it compulsory**: `totp.require` in jarl.yaml
+([configuration.md](configuration.md#web-ui-and-api)):
+
+| `totp.require` | Who must use it |
+|--|--|
+| `none` (default) | nobody; each user decides |
+| `admins` | administrators |
+| `all` | every user with a password (service accounts can't log in anyway) |
+
+A user who must use it and hasn't set it up yet can log in with the
+password, but then only sees "Set up two-factor login" until they do. They
+can't turn it off while it is required (moving to a new phone is "Move to
+a new phone" under Account). The setting lives in jarl.yaml rather than in
+the web UI on purpose: someone who steals an administrator's login can't
+switch it off. The dashboard and `jarl status` list users who must use it
+but haven't set it up.
+
+**Lost phone**:
+
+* With a recovery code: log in with it, then Account → Move to a new
+  phone. New recovery codes replace the old ones (Account → New recovery
+  codes; Jarl warns when 3 or fewer are left).
+* Without: an administrator resets it (Users → Reset 2FA, or `jarl user
+  totp reset NAME`). That turns it off, deletes the recovery codes and
+  logs the user out; they log in with the password and set it up again.
+* No administrator can log in: on the server, `sudo -u jarl jarld user
+  totp reset NAME` (works with jarld stopped too).
+
+Every setup, change, failed code, recovery code use and reset is in the
+audit log (`user.totp_*`, `auth.totp_failed`).
+
+The secret is stored in the database, like TSIG secrets (it can't be
+hashed: the server needs it to work out the codes), so it is as safe as
+the database file and its backups (mode 0600, root and `jarl` only).
+Recovery codes are stored hashed.
+
+### One account per person
+
+`jarld init` creates the first administrator, `admin` unless you name it
+(`-u NAME`). If several people use that one account, nobody can tell from
+the audit log who did what, and it can't have two-factor login per person.
+So:
+
+* **Just you**: rename it to your name (`jarl user update admin --rename
+  adam`, or Users → Edit) and turn on two-factor login.
+* **Several people**: give each their own administrator account with their
+  own two-factor login, then disable `admin` (`jarl user update admin
+  --disabled`). The dashboard and `jarl status` point this out while an
+  enabled `admin` exists next to other administrators.
+
+Nothing is lost by disabling it: root on the server always gets back in
+([Recovering access](#recovering-access)), and Jarl refuses to disable,
+demote or delete the last enabled administrator.
+
 ## Grants
 
 A user's permissions are a list of grants. Administrators (`admin: true`)
-may do everything, and only they can manage users, see everyone's tokens
-and run `resync`.
+may do everything, and only they can manage users, see everyone's tokens,
+run `resync`, wipe a zone's DNSSEC keys, use the registrar (Porkbun,
+whose key can move the domain), and manage TLS certificates (whose keys
+can impersonate the server; [certificates.md](certificates.md)).
 
 A grant is written as:
 
@@ -38,7 +128,7 @@ RESOURCE:ACCESS [zones=PATTERNS] [views=PATTERNS] [names=PATTERNS] [types=TYPES]
 
 | Resource | Covers |
 |----------|--------|
-| `zones` | zone definitions (create, delete, SOA, TTL, view) and zone options |
+| `zones` | zone definitions (create, delete, SOA, TTL, view, DNSSEC signing and the DS check) and zone options |
 | `records` | records in primary zones |
 | `views` | views and view options |
 | `acls` | ACLs |
@@ -46,6 +136,7 @@ RESOURCE:ACCESS [zones=PATTERNS] [views=PATTERNS] [names=PATTERNS] [types=TYPES]
 | `options` | server options, top-level statements, the defaults for new zones, `jarl check` |
 | `audit` | everyone's audit events and changesets (without it, users see only their own) |
 | `stats` | query statistics, including client addresses and the names they look up (read only) |
+| `blocking` | blocklists and block/allow rules ([blocking.md](blocking.md)); `write` also downloads lists now |
 | `*` | all of the above |
 
 `ACCESS` is `read` or `write` (write includes read). Filters narrow a grant.
@@ -79,7 +170,7 @@ you can then edit.
 | Role | Grants |
 |------|--------|
 | `readonly` | `*:read` (includes statistics) |
-| `dns-editor` | `zones:write`, `records:write`, `views:read`, `acls:read`, `options:read` |
+| `dns-editor` | `zones:write`, `records:write`, `views:read`, `acls:read`, `options:read`, `blocking:read` |
 | `operator` | `*:write` (everything except user management) |
 | `acme` | `records:write names=_acme-challenge.* types=TXT` |
 
@@ -237,4 +328,5 @@ sudo -u jarl jarld user list
 sudo -u jarl jarld user passwd admin          # set a new password and re-enable the account
 sudo -u jarl jarld user add --admin rescue    # a new administrator
 sudo -u jarl jarld user token admin cli       # a new API token for a user
+sudo -u jarl jarld user totp reset admin      # turn off two-factor login (a lost phone)
 ```

docs/stats.md

@@ -102,22 +102,59 @@ lists, views, zones). named's own counters can't be filtered.
 | `view:NAME` | response log | answers per view (`_default` without views) |
 | `zone:NAME` | response log | answers per local zone; `zone:-` for names in none of your zones |
 | `responses` | response log | lines read (a health check) |
+| `blocked`, `blocklist:NAME` | response log | queries [blocking](blocking.md) answered, and by which list (`blocklist:rules` for your own rules) |
+| `rrl:drop`, `rrl:slip`, `rrl:would-drop`, `rrl:would-slip` | response log | responses [rate limiting](exposure.md#response-rate-limiting) limited, or would have in log-only mode (named's own `ratelimit:*` counters don't move then) |
+
+**Server** (sampled every minute; stored as gauges, `g:KEY` the sum of
+the samples and `gn:KEY` their number, so a chart shows the average):
+
+| Gauge | Source | Meaning |
+|-------|--------|---------|
+| `g:named:rss` | /proc | named's resident memory (what the system sees), bytes |
+| `g:named:mem` | named | the memory named counts itself as using, bytes |
+| `g:named:cpu` | /proc | named's CPU use over the minute, in tenths of a percent of one CPU |
+| `g:cache:mem`, `g:cache:rrsets` | named | the cache's memory and RRsets, all views |
+| `g:host:mem-used`, `g:host:load` | /proc | the host's memory in use, and its 1-minute load average times 100 |
+
+Jarl finds named's process by name (the one whose command line mentions
+named's main configuration file); reading its memory and CPU time needs no
+privileges. With `/proc` mounted `hidepid`, it isn't visible and those
+figures are left out. The current values also include named's sockets, its
+recursive and TCP clients against their limits (`rndc status`), the most
+at once since it started, and the space left on the file systems holding
+the zone files, Jarl's cache, named.conf, the response log and this
+database.
 
 **Top lists** (per hour and per day, the `top_n` largest): `name` (most
 queried names), `client`, `nxdomain` (names answered NXDOMAIN), `servfail`
-(names answered SERVFAIL), `refused` (clients that were refused).
+(names answered SERVFAIL), `refused` (clients that were refused), `blocked`
+(names blocking answered), `blocked_client` (clients by blocked queries). Blocked answers are NXDOMAIN too, but they
+aren't counted as names that don't exist: not in the `nxdomain` list, and
+not in the summary's NXDOMAIN ratio.
 
 Nothing else is stored. In particular there's no per-query record, so you
 can't look up "who asked for X at 14:02". That is deliberate, both for size
 and privacy.
 
+**Client names.** Where the client lists (busiest and refused clients) show
+an address Jarl has a record for, they show its host name too: the PTR
+record's target, or else the name of an A/AAAA record with that address
+(disabled records don't count, and only records you may read). This is
+looked up in Jarl's own data when the list is shown, not stored and not
+asked of DNS, so it is instant and adds no queries of its own. The name is
+what the records say now: with DHCP, an address seen last week may have
+been another machine. Anonymized clients (`anonymize_clients`) are
+prefixes and get no name.
+
 ## Using it
 
 **Web UI**: Statistics. Pick a range (1 hour to 90 days); everything on the
 page follows it. Charts have a hover readout (or focus them and use the
 arrow keys) and a **Table** button showing the same data as a table. The
 heatmap shows the average queries per hour for each weekday and hour over at
-least the last 7 days. The page refreshes every minute.
+least the last 7 days. The page refreshes every minute. **Server**, at the
+bottom, shows named's memory, CPU, cache and clients, the host and the
+disks now, and named's memory and CPU over the range.
 
 **CLI**:
 
@@ -131,12 +168,18 @@ jarl stats top refused                     # who asks for what they may not have
 jarl stats timeline --since 6h             # sparkline; --table for every bucket
 jarl stats timeline --since 7d --key rcode:NXDOMAIN --key rcode:SERVFAIL
 jarl stats heatmap --since 28d
-jarl stats breakdown qtype | rcode | view | zone | answer | rtt | dnssec | cache | transport | ratelimit
+jarl stats breakdown qtype | rcode | view | zone | answer | rtt | dnssec | cache | transport | ratelimit | rrl
+jarl stats top ratelimited                 # client networks rate limiting limits (or would)
+jarl stats server                          # memory, CPU, cache, clients, host, disks now
+jarl stats timeline --since 7d --key g:named:rss --table   # named's memory over a week
 jarl stats summary --since 30d -o json     # export (also -o yaml)
 ```
 
 **API**: see [api.md](api.md#query-statistics).
 
+**Prometheus**: with `metrics.enabled`, the counters are also served at
+`/metrics` ([metrics.md](metrics.md)).
+
 **Permissions**: the `stats` resource (`stats:read`). The `readonly` and
 `operator` roles include it, `dns-editor` doesn't. Statistics show client
 addresses and what they look up, so grant it with care.

docs/validation.md

@@ -30,6 +30,7 @@ showing them.
 | `record_out_of_zone` | error | The name must be inside the zone (catches `www.example.com` without the final dot) |
 | `record_duplicate` | error | The same record can't exist twice |
 | `cname_conflict` | error | A CNAME must be the only record at its name (RFC 1034), so no CNAME next to A, MX, TXT... |
+| `disabled_conflict` | warning | A disabled record that couldn't be enabled again as the zone is now (a CNAME now shares its name) |
 | `cname_multiple` | error | A name can have only one CNAME |
 | `cname_apex` | error | No CNAME at the zone apex (it needs SOA and NS) |
 | `cname_loop` | error | CNAMEs that point back to themselves |
@@ -56,6 +57,8 @@ showing them.
 | `zone_missing_option` | error | Secondary, stub and mirror zones need `primaries` |
 | `zone_file_required` / `zone_file_invalid` / `zone_file_managed` | error | Hint zones need a file. Forward zones have none. Primary zone files are Jarl's |
 | `zone_inview_invalid`, `zone_inview_option` | error | `in-view` zones only inside views, and only with `forward`/`forwarders` |
+| `zone_inview_disabled` | error | An `in-view` zone can't share a disabled zone |
+| `zone_disabled_signed` | error | A signed zone can't be disabled: turn signing off first |
 | `zone_records_unmanaged` | error | Only primary zones can have records in Jarl |
 | `zone_serial_policy` | error | `date`, `increment` or `unixtime` |
 | `zone_no_forwarders`, `zone_hint_name`, `zone_name_slash` | info / warning | Unusual but legal setups |
@@ -64,28 +67,97 @@ showing them.
 
 | Code | Severity | Rule |
 |------|----------|------|
-| `acl_element_invalid` | error | Address match elements: addresses, prefixes (host bits must be zero, like BIND requires), `!negation`, `key NAME`, ACL names, `{ nested lists }`, `any`/`none`/`localhost`/`localnets` |
+| `acl_element_invalid` | error | Address match elements: addresses, prefixes (host bits must be zero, like BIND requires), ranges (`10.0.10.101-10.0.10.199`: both ends full addresses of one family, start not after end), `!negation`, `key NAME`, ACL names, `{ nested lists }`, `any`/`none`/`localhost`/`localnets`. Ranges in options are checked when they're entered, and only options with address match lists take them (not `forwarders`, say) |
+| `range_mapped4` | warning | An IPv6 range that reaches into `::ffff:0:0/96`: named can see IPv4 clients as such addresses, so it may match IPv4 clients too |
 | `acl_ref_missing`, `key_ref_missing` | error | Every ACL or TSIG key that is referenced must exist |
 | `acl_cycle` | error | ACLs that include each other |
-| `acl_duplicate`, `acl_name_invalid`, `acl_empty`, `acl_shadowed` | error / warning | Unique names, built-in names reserved, elements that can never match |
-| `key_*` | error / warning | Valid key names, a supported algorithm, a base64 secret of a sensible length. hmac-md5/sha1 are flagged as weak |
+| `acl_duplicate`, `acl_name_invalid`, `acl_empty`, `acl_shadowed` | error / warning | Unique names, built-in names reserved, names that look like addresses or ranges, elements that can never match (a prefix or range an earlier one already covers) |
+| `key_*` | error / warning | Valid key names, a supported algorithm, a base64 secret of a sensible length. hmac-md5/sha1 are flagged as weak. Names starting with `jarl-view-` are reserved for the view keys (`key_name_reserved`) |
 | `view_duplicate`, `view_name_invalid`, `view_acl_invalid` | error | Valid, unique views and match lists |
 | `view_unreachable` | warning | A view that comes after one matching every client is never used |
 | `option_unknown`, `option_scope_invalid` | error | The option must exist in BIND 9.20 and be allowed where it is set (server, view, zone of this type, top level) |
 | `option_syntax`, `option_value_invalid` | error | The value must parse (balanced braces, strings, the grammar's value type: yes/no, enums, numbers, durations, sizes, address match lists) |
 | `option_duplicate` | error | Options that may appear once, appear once |
-| `option_managed` | error | Statements Jarl manages itself can't be raw options: `zone`, `view`, `acl`, `key`, `options`, a zone's `type`/`file`/`in-view`, a view's `match-*` |
+| `option_managed` | error | Statements Jarl manages itself can't be raw options: `zone`, `view`, `acl`, `key`, `options`, a zone's `type`/`file`/`in-view`/`key-directory`, a view's `match-*`, and `dnssec-policy` in zones, views and server options (set per zone instead; top-level `dnssec-policy NAME { }` definitions are options) |
 | `option_deprecated`, `option_obsolete`, `option_unavailable` | warning | Flags from the BIND 9.20 reference |
 | `option_experimental` | info | |
 | `settings_invalid` | error | Defaults for new zones are valid |
 
+## DNSSEC
+
+These rules come from [dnssec.md](dnssec.md#what-jarl-refuses-and-why).
+Those that compare the change with the current state are checked when it is
+applied.
+
+| Code | Severity | Rule |
+|------|----------|------|
+| `dnssec_zone_type` | error | Only primary zones are signed by Jarl |
+| `dnssec_policy_unknown` | error | The zone's policy must be `default`, `insecure` or a top-level `dnssec-policy` statement |
+| `dnssec_policy_no_keys` | error | A custom policy with an empty `keys { }` list (named 9.20 crashes loading it) |
+| `dnssec_ttl_too_long` | error | TTLs (and the default TTL) of a signed zone must be at most the policy's `max-zone-ttl` (a day for the built-in policies); named refuses to load the zone otherwise |
+| `dnssec_inline_signing` | error | No `inline-signing no` on a signed zone |
+| `dnssec_off_unsafe` | error | A signed zone can't go straight to unsigned: use the `insecure` policy first (or wipe, when the parent has no DS) |
+| `dnssec_off_too_early`, `dnssec_off_unknown` | error | Switching off after `insecure` waits until named is done removing the signatures |
+| `dnssec_delete_signed` | error | A signed zone can't be deleted; turn signing off first |
+| `dnssec_keys_moved` | error | A signed zone can't move to another view (its keys would change) |
+| `dnssec_policy_change` | warning | Changing the policy may replace the keys, and with them the DS at the parent |
+| `dnssec_old_keys` | info | Signing a zone whose key directory still has old keys |
+| `serial_not_higher` | error | An explicit serial on a signed zone must be above the one named has loaded (automatic serials are raised by themselves) |
+
+## Linked zones
+
+See [views.md](views.md#linked-zones). Jarl keeps linked zones in step
+itself, so these only show when something got past it (a change staged
+before the zones were linked, or the database edited by hand).
+
+| Code | Severity | Check |
+|------|----------|-------|
+| `linked_zone_type` | error | Only primary zones can be linked |
+| `linked_zone_name` | error | Linked zones have the same name |
+| `linked_mixed` | error | A name and type in a zone is either shared or local, not both |
+| `linked_out_of_sync` | error | Every view that doesn't override a shared name and type has the same records for it. Link the zones again (`jarl zone link`) to work out what is shared |
+| `linked_zone_alone` | info | A zone linked with no other zone |
+
+## Blocking
+
+From [blocking.md](blocking.md).
+
+| Code | Severity | Rule |
+|------|----------|------|
+| `blocking_rule_duplicate` | error | One rule per domain and view |
+| `blocking_response_policy` | error | No `response-policy` option where Jarl's blocking writes that statement (the view, or the server) |
+| `zone_name_reserved` | error | Zone names under `jarl.invalid` are reserved for blocking's policy zones |
+| `blocking_view_missing` | error | A list or rule names a view that doesn't exist |
+| `blocking_no_view` | warning | A list or rule applies to no view: none offers recursion, and blocking only changes recursive answers |
+| `blocking_no_recursion` | warning | A list or rule names a view that doesn't offer recursion, where it has no effect |
+| `blocking_step_missing` | error | A list or client group is at a step that doesn't exist (a list can't be at `off`) |
+| `client_group_member_invalid` | error | Client group members are addresses, networks, or ACLs made only of those |
+| `client_group_overlap` | error | The same address or network is in two client groups of a view |
+| `client_group_empty` | warning | A client group has no members |
+| `blocklist_step_unused` | warning | A list is at a step that no client group reaches, so it blocks nothing |
+
 ## Security lints
 
+These and the exposure checks below only look at views that are
+reachable from the internet ([exposure.md](exposure.md)); without views,
+the open resolver and open transfer checks look at the server. Any of them
+can be acknowledged (it then shows as info, with who accepted it and why),
+and a change that newly introduces an open resolver, open transfers, cache
+snooping, open NOTIFY or an open management interface on a public view
+must be confirmed (`--accept-risk`).
+
 | Code | Severity | What it catches |
 |------|----------|-----------------|
 | `security_open_resolver` | warning | A view (or the server) where recursion is on and reachable by any client. This includes the BIND trap where `allow-recursion` is unset and inherits `allow-query { any; }`. Open resolvers are abused for DDoS amplification. Set `allow-recursion` to your own networks |
 | `security_open_transfer` | warning | `allow-transfer` open to anyone. Restrict it to your secondaries or a TSIG key |
 | `dynamic_update_unsupported` | error | `allow-update` / `update-policy` on a Jarl zone. named would write to files that Jarl regenerates, losing the updates. Use the API (e.g. `jarl acme`) instead |
+| `exposure_rate_limit` | warning | A public view without response rate limiting (`rate-limit`) |
+| `exposure_rate_limit_log_only` | info | Rate limiting in log-only mode: check what it would limit, then enforce |
+| `exposure_minimal_any` | warning | A public view answering ANY queries in full (`minimal-any` off) |
+| `exposure_cache_snooping` | warning | A public view without recursion whose cache anyone may query (`allow-query-cache`) |
+| `exposure_open_notify` | warning | A public view accepting NOTIFY from anyone (`allow-notify`) |
+| `exposure_version`, `exposure_hostname` | warning | The server is public and shows its BIND version or host name to anyone (`version none`, `hostname none`) |
+| `exposure_management` | warning | `controls` or `statistics-channels` on an address that isn't loopback, open to anyone, while the server is public |
 
 ## What only BIND checks
 
@@ -95,3 +167,10 @@ values Jarl accepts as raw named.conf syntax, such as `logging` channels
 and `rrset-order`, are the main example. Their errors come back as
 `validation_failed` (HTTP 422) with the checker's messages in `check`, each
 tied to the object it belongs to.
+
+named-checkconf's warnings don't block a change. They are shown with the
+change, and the dashboard's configuration checks list them for as long as
+they apply (`named_warning`; `named_error` if the running configuration no
+longer passes, after a hand edit say). Jarl runs named-checkconf on the
+running configuration for this, without loading zones, when the dashboard
+asks and the configuration changed, or at most every 10 minutes.

docs/views.md

@@ -81,21 +81,34 @@ avoids named-checkconf's warning that `allow-recursion` is still active in a
 view with recursion off. Jarl warns (`security_open_resolver`) if a view
 ever offers recursion to everyone.
 
+Jarl counts the external view as reachable from the internet (its
+match-clients end in `any`) and checks it: rate limiting, ANY queries,
+the version string and more. See the **Exposure** page or `jarl exposure`,
+and [exposure.md](exposure.md) to set up response rate limiting.
+
 ### 4. Give the external view its zones
 
-**Different data per view (split DNS).** Copy the zone, then change what
-should differ:
+**Mostly the same, a few differences (split DNS).** Create the external
+copy *linked* ([below](#linked-zones)): Jarl keeps the shared records the
+same in both views, and each view can have records of its own:
+
+```sh
+jarl zone create adbraun.lol --view external --link-with internal
+jarl record set adbraun.lol www A 203.0.113.20 --view external --local   # public address, external only
+jarl record delete adbraun.lol nas-internal A --view external            # gone from both: it was shared
+```
+
+Delete records you don't want outside before you link, or make them local
+to the internal view first (`jarl record update ID --local`): a shared
+record is in both views.
+
+**Two separate copies.** `--clone-from` copies the zone once; from then on
+the two are separate zones, and a record added to one isn't in the other:
 
 ```sh
 jarl zone create adbraun.lol --view external --clone-from adbraun.lol --clone-view internal
-jarl record list adbraun.lol --view external
-jarl record update <id> --data 203.0.113.20          # public address instead of 10.10.0.20
-jarl record delete adbraun.lol nas-internal A --view external
 ```
 
-From then on the two copies are separate zones. A record added to one isn't
-in the other, and the serials are separate.
-
 **The same data in both views.** Use an `in-view` zone. The external view
 then serves the internal view's zone, so there is one copy to maintain:
 
@@ -116,7 +129,105 @@ dig @<public-ip> example.com                            # from outside: status R
 jarl check
 ```
 
-On the server, `dig -b <source address>` picks which view you test.
+On the server, `dig -b <source address>` picks which view you test, or,
+from anywhere, sign the query with the view's key (below):
+
+```sh
+jarl view key external --named-conf > external.key
+dig -k external.key @ns1.adbraun.lol nas.adbraun.lol +short   # 203.0.113.20, even from the LAN
+```
+
+## View keys
+
+named picks a view by where a query comes from, so a query this server
+sends to its own public address usually lands in the internal view: its
+source is one of your own networks. That makes checks of the external view
+from the server itself (such as Jarl's delegation check) see the wrong
+view.
+
+So Jarl gives every view a TSIG key, `jarl-view-NAME`, and puts it at the
+front of the view's `match-clients`:
+
+```
+view "internal" {
+	match-clients { !key jarl-view-external; key jarl-view-internal; homelab; };
+	...
+view "external" {
+	match-clients { key jarl-view-external; any; };
+```
+
+A query signed with a view's key lands in that view, whatever its source;
+the `!key` stops an earlier view from taking a later view's queries.
+Clients don't send these keys, so for them nothing changes. Jarl signs its
+own queries to this server's addresses with the key of the zone's view.
+The keys live in `keys.conf` with your other keys, never in diffs or in
+`jarl tsig list`; their secrets are derived from a random value in Jarl's
+database (and in its backups), so they stay the same from one apply to
+the next. `jarl view key VIEW`
+shows one (it needs `tsig:write` and is audited). Key names starting with
+`jarl-view-` are reserved, and the view keys can be used in your own
+options (`allow-transfer { key jarl-view-external; }`).
+
+## Linked zones
+
+Most split-horizon zones are the same in every view apart from a few
+names. Linking zones of the same name in different views lets Jarl keep
+the shared records in step, while each view can still have records of its
+own and its own zone options.
+
+* **Shared records** are in every linked view. Adding, changing,
+  disabling or deleting one in any view does the same in the others, in
+  the same changeset: the diff shows every view, and history, undo and
+  `jarl check` treat them together.
+* **Local records** are in one view only (`--local`, or **Only here** in
+  the web UI). A local record overrides the shared records of the same name
+  and type in that view: `www A 10.0.10.5` local to internal, while the
+  external view keeps the shared `www A 203.0.113.20`. Delete the local
+  records and the view gets the shared ones back.
+* A new record joins the set of the same name and type: local if that set
+  is local in its view, shared otherwise.
+* **Sharing a version** (`jarl record update ID --shared`, **Share** in the
+  web UI) makes that view's records of that name and type the shared
+  version: the other views' records of that name and type are replaced.
+* Zones stay separate in named, so each keeps its own serial, options
+  (allow-transfer, DNSSEC signing, ...) and file, and the views keep their
+  own `match-clients`, recursion and order.
+
+```sh
+jarl zone link adbraun.lol --view internal --with external   # link two existing zones
+jarl zone create adbraun.lol --view vps --link-with external # a new zone, linked from the start
+jarl record list adbraun.lol --view internal                 # LINK column: shared or local
+jarl record add adbraun.lol nas A 10.0.10.20 --view internal --local
+jarl record update 1234 --local                              # this name and type: only this view
+jarl record update 1234 --shared                             # this view's version, everywhere
+jarl zone unlink adbraun.lol --view vps                      # records stay, all local
+```
+
+**Linking never changes what named answers.** A name and type with the
+same records in every view becomes shared; one that differs stays local to
+each view (Jarl lists them). Share the right version afterwards. Unlinking
+keeps every record, all local; a link left with one zone is dissolved, as
+when the other zone is deleted.
+
+**Permissions** are checked in every view a change reaches. A token with
+a grant for one view only (`views=internal`) can change that view's local
+records and make overrides, but not a shared record, since that would
+change the other views too: Jarl says so and suggests a local record. A
+grant without a view (the usual `zones=adbraun.lol`) covers every view.
+
+**Importing a zone file** into a linked zone (`jarl zone import`) adds
+the records like any others: shared, unless the name and type is local
+there. With `--replace`, shared records missing from the file are deleted
+in every linked view.
+
+**ACME challenges** are written once per link, and so reach every linked
+view; `jarl acme`, lego's httpreq and certificates Jarl obtains all do
+this.
+
+**Compared with BIND's `in-view`**, where one view serves another's zone
+as it is: linked zones can differ per view, keep their own options, and
+don't depend on the view order (`in-view` can only use a view defined
+before it).
 
 ## Living with views
 
@@ -125,10 +236,20 @@ On the server, `dig -b <source address>` picks which view you test.
   guess.
 * `jarl acme` writes challenge records into **every** view that has the
   zone, so Let's Encrypt (external) and internal clients see the same
-  thing. Use `--view` to limit it.
+  thing (once per link, for linked zones). Use `--view` to limit it.
+* `--view all` (or a list) on record commands changes each linked zone
+  once: the change reaches the others through the link. With `--local` it
+  goes to each view named.
 * `jarl view order internal external` changes the match order, and
   `jarl view list` shows it.
 * Deleting a view is refused while it still has zones, unless you pass
   `--cascade`.
+* Each view has its own page (Views → the view's name): its settings,
+  options and zones.
+* Give each view a colour (the view's page → Settings → Colour, or
+  `jarl view color internal green`) to tell the zones of each view apart
+  in the zone list. The colour only affects the web UI, so it applies at
+  once, with no changeset or deploy. `jarl view color internal default`
+  goes back to the link colour.
 * Zone files are stored per view: `/var/lib/bind/jarl/internal/adbraun.lol.zone`,
   `/var/lib/bind/jarl/external/adbraun.lol.zone`.

go.mod

@@ -4,6 +4,7 @@ go 1.27.1
 
 require (
 	github.com/aymanbagabas/go-udiff v0.4.1
+	github.com/go-acme/lego/v4 v4.35.2
 	github.com/miekg/dns v1.1.73
 	github.com/spf13/cobra v1.10.2
 	go.yaml.in/yaml/v3 v3.0.5
@@ -11,10 +12,13 @@ require (
 	golang.org/x/net v0.58.0
 	golang.org/x/term v0.46.0
 	modernc.org/sqlite v1.60.1
+	rsc.io/qr v0.2.0
 )
 
 require (
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect

go.sum

@@ -1,8 +1,16 @@
 github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/go-acme/lego/v4 v4.35.2 h1:uVQg+KC/yj9R2g7Q9W5wDqhvQvxV5SMu5eqFVoN5xZU=
+github.com/go-acme/lego/v4 v4.35.2/go.mod h1:pX2jN5n8OphMGY1IaMjYm5DAEzguBaKRt8AvJAgJXpc=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -24,6 +32,8 @@ github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
@@ -72,3 +82,5 @@ modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+rsc.io/qr v0.2.0 h1:6vBLea5/NRMVTz8V66gipeLycZMl/+UlFmk8DvqQ6WY=
+rsc.io/qr v0.2.0/go.mod h1:IF+uZjkb9fqyeF/4tlBoynqmQxUoPfWEKh921coOuXs=

internal/acme/acme.go

@@ -21,6 +21,10 @@ const Comment = "ACME DNS-01 challenge"
 type Zone struct {
 	Name string // as Jarl stores it, e.g. "adbraun.lol."
 	View string // "" when views are not used
+	// Link is the zone's link group (0: not linked). A record written
+	// into one zone of a link reaches the others (docs/views.md#linked-zones),
+	// so only one of them is written to.
+	Link int64
 }
 
 // Zones returns the zones that hold name: the longest matching zone, in
@@ -46,7 +50,19 @@ func Zones(name string, zones []Zone, view string) []Zone {
 			out = append(out, z)
 		}
 	}
-	return out
+	// One zone per link: Jarl writes the shared record into the others.
+	var dedup []Zone
+	links := map[int64]bool{}
+	for _, z := range out {
+		if z.Link != 0 {
+			if links[z.Link] {
+				continue
+			}
+			links[z.Link] = true
+		}
+		dedup = append(dedup, z)
+	}
+	return dedup
 }
 
 // Requests returns the changes that set (or, with set false, remove) the

internal/api/types.go

@@ -6,8 +6,11 @@ import (
 	"encoding/json"
 	"time"
 
+	"jarl/internal/dnssec"
 	"jarl/internal/model"
 	"jarl/internal/nscheck"
+	"jarl/internal/porkbun"
+	"jarl/internal/version"
 )
 
 // Version is the API path prefix.
@@ -16,11 +19,21 @@ const Prefix = "/api/v1"
 // Zone is a zone as returned by the API.
 type Zone struct {
 	model.Zone
-	Display  string `json:"display_name"`
-	View     string `json:"view,omitempty"`
-	Records  int    `json:"record_count"`
-	ZoneFile string `json:"zone_file,omitempty"` // the file named loads
-	RName    string `json:"rname_email,omitempty"`
+	Display string `json:"display_name"`
+	View    string `json:"view,omitempty"`
+	Records int    `json:"record_count"`
+	// DisabledRecords is how many of the records are disabled.
+	DisabledRecords int    `json:"disabled_count,omitempty"`
+	ZoneFile        string `json:"zone_file,omitempty"` // the file named loads
+	RName           string `json:"rname_email,omitempty"`
+	// Registrar names the registrar Jarl can manage the domain at
+	// ("porkbun"), when one is configured for it.
+	Registrar string `json:"registrar,omitempty"`
+	// LinkedWith are the views of the zones this one is linked with
+	// (docs/views.md#linked-zones).
+	LinkedWith []string `json:"linked_with,omitempty"`
+	// Links are the zones this one is linked with, with their views.
+	Links []ZoneLink `json:"links,omitempty"`
 	// Pending is set when listing with a changeset: add, change or delete.
 	Pending string `json:"pending,omitempty"`
 }
@@ -32,16 +45,25 @@ type Record struct {
 	View         string `json:"view,omitempty"`
 	RelativeName string `json:"relative_name"`
 	EffectiveTTL uint32 `json:"effective_ttl"`
+	// Linked is "shared" or "local" for a record of a linked zone ("" otherwise).
+	Linked string `json:"linked,omitempty"`
 	// Text is the decoded value of TXT and SPF records.
 	Text *string `json:"text,omitempty"`
-	// Pending is set when listing with a changeset: add, change or delete.
+	// Pending is set when listing with a changeset: add, change, delete,
+	// disable or enable.
 	Pending string `json:"pending,omitempty"`
 }
 
 // View is a view with its zone count.
 type View struct {
 	model.View
-	Zones int `json:"zone_count"`
+	Zones int    `json:"zone_count"`
+	Color string `json:"color,omitempty"` // web UI colour, see model.ViewColors
+}
+
+// ViewColor sets the colour the web UI shows a view in.
+type ViewColor struct {
+	Color string `json:"color"`
 }
 
 // ACL is an ACL with the objects that use it.
@@ -62,12 +84,19 @@ type Option struct {
 	Where       string `json:"where"` // e.g. "view internal"
 	Description string `json:"description,omitempty"`
 	Status      string `json:"status,omitempty"`
+	// Formatted is the value laid out over several lines, as in
+	// named.conf, when it has a block (for display and editing; Value is
+	// the same on one line).
+	Formatted string `json:"formatted,omitempty"`
 }
 
 // User is a user with formatted grants.
 type User struct {
 	model.User
 	GrantStrings []string `json:"grant_strings"`
+	// TOTPRequired says that totp.require in jarl.yaml makes two-factor
+	// login compulsory for the user.
+	TOTPRequired bool `json:"totp_required,omitempty"`
 }
 
 // Token is an API token. Secret is only set when the token is created.
@@ -86,6 +115,69 @@ type Whoami struct {
 	Permissions []string `json:"permissions"`
 	Admin       bool     `json:"admin"`
 	Version     string   `json:"version"`
+	// TOTP is the user's two-factor login (sessions only).
+	TOTP *TOTPStatus `json:"totp,omitempty"`
+	// TOTPSetupRequired: the user must set up two-factor login before
+	// doing anything else (totp.require).
+	TOTPSetupRequired bool `json:"totp_setup_required,omitempty"`
+	// Build is what the server was built from (release or commit).
+	Build version.Build `json:"build"`
+}
+
+// LoginChallenge answers a correct password of a user with two-factor
+// login: send a code with the challenge to POST /auth/login/totp.
+type LoginChallenge struct {
+	TOTPRequired bool   `json:"totp_required"`
+	Challenge    string `json:"challenge"`
+}
+
+// LoginTOTP is the second login step.
+type LoginTOTP struct {
+	Challenge string `json:"challenge"`
+	// Code is the current code from the authenticator app, or a recovery
+	// code.
+	Code string `json:"code"`
+}
+
+// TOTPStatus is a user's two-factor login (GET /me/totp).
+type TOTPStatus struct {
+	Enabled           bool       `json:"enabled"`
+	EnabledAt         *time.Time `json:"enabled_at,omitempty"`
+	Required          bool       `json:"required"`
+	RecoveryCodesLeft int        `json:"recovery_codes_left"`
+	// Policy is totp.require: none, admins or all.
+	Policy string `json:"policy"`
+}
+
+// TOTPSetupRequest starts setting up two-factor login.
+type TOTPSetupRequest struct {
+	Password string `json:"password"`
+}
+
+// TOTPSetup is a new secret to put into an authenticator app: QR is the
+// QR code of URI, as an image data: URI.
+type TOTPSetup struct {
+	Secret  string `json:"secret"`
+	URI     string `json:"uri"`
+	QR      string `json:"qr"`
+	Issuer  string `json:"issuer"`
+	Account string `json:"account"`
+}
+
+// TOTPCode confirms a setup.
+type TOTPCode struct {
+	Code string `json:"code"`
+}
+
+// TOTPDisable turns two-factor login off.
+type TOTPDisable struct {
+	Password string `json:"password"`
+	Code     string `json:"code"`
+}
+
+// RecoveryCodes are new recovery codes, shown once.
+type RecoveryCodes struct {
+	Codes []string `json:"recovery_codes"`
 }
 
 // LoginRequest logs in.
@@ -123,6 +215,9 @@ type BatchRequest struct {
 	Ops         []ChangeRequest `json:"ops"`
 	DryRun      bool            `json:"dry_run,omitempty"`
 	Force       bool            `json:"force,omitempty"`
+	// AcceptRisk confirms a change that opens the server up
+	// (docs/exposure.md).
+	AcceptRisk bool `json:"accept_risk,omitempty"`
 	// Apply (for POST /changesets) applies the new changeset at once.
 	Apply bool `json:"apply,omitempty"`
 }
@@ -150,6 +245,7 @@ type Changeset struct {
 // StatusResponse is GET /status.
 type StatusResponse struct {
 	Version string          `json:"version"`
+	Build   version.Build   `json:"build"`
 	Engine  json.RawMessage `json:"engine"`
 	Time    time.Time       `json:"time"`
 	// ExpiringTokens are tokens that expire within TokenExpiryWarning or
@@ -158,6 +254,59 @@ type StatusResponse struct {
 	ExpiringTokens []Token `json:"expiring_tokens"`
 	// Backup is the state of database backups (administrators only).
 	Backup *BackupStatus `json:"backup,omitempty"`
+	// TOTP is about two-factor login across users (administrators only).
+	TOTP *TOTPOverview `json:"totp,omitempty"`
+	// BlocklistErrors are blocklists whose last update failed (for those
+	// who may see blocking).
+	BlocklistErrors []BlocklistError `json:"blocklist_errors,omitempty"`
+	// BlockingPausedUntil is set while blocking is paused for a time,
+	// BlockingPausedIndefinitely while it is paused until resumed.
+	BlockingPausedUntil        *time.Time `json:"blocking_paused_until,omitempty"`
+	BlockingPausedIndefinitely bool       `json:"blocking_paused_indefinitely,omitempty"`
+	// Certificates sums up the TLS certificates Jarl manages
+	// (administrators only, when there are any).
+	Certificates *CertSummary `json:"certificates,omitempty"`
+}
+
+// CertSummary is what the dashboard reports about certificates.
+type CertSummary struct {
+	Total int `json:"total"`
+	// Problems are the certificates that aren't fine: failing, expiring,
+	// expired (not ones still being obtained for the first time).
+	Problems []CertProblem `json:"problems"`
+	// Next is the certificate that expires first, and when.
+	Next      string     `json:"next,omitempty"`
+	NextAfter *time.Time `json:"next_after,omitempty"`
+	// Serving is the certificate jarld serves HTTPS with ("" for none or tls.cert_file).
+	Serving string `json:"serving,omitempty"`
+}
+
+// CertProblem is a certificate that needs attention.
+type CertProblem struct {
+	Name    string `json:"name"`
+	State   string `json:"state"`
+	Message string `json:"message"`
+}
+
+// BlocklistError is a blocklist whose last update failed. UpdatedAt is
+// the version named keeps using (nil: none yet).
+type BlocklistError struct {
+	Name      string     `json:"name"`
+	Error     string     `json:"error"`
+	UpdatedAt *time.Time `json:"updated_at,omitempty"`
+}
+
+// TOTPOverview is what the dashboard reports about two-factor login.
+type TOTPOverview struct {
+	// Policy is totp.require: none, admins or all.
+	Policy string `json:"policy"`
+	// Missing are enabled users who must use two-factor login and
+	// haven't set it up (they can do nothing else until they do).
+	Missing []string `json:"missing"`
+	// SharedAdmin is set when an enabled administrator called "admin"
+	// (the usual first account) exists next to other enabled
+	// administrators: it is probably shared, and worth disabling.
+	SharedAdmin string `json:"shared_admin,omitempty"`
 }
 
 // TokenExpiresHeader is sent with responses to a token that expires
@@ -267,3 +416,162 @@ type DelegationResponse struct {
 	Notes     []string  `json:"notes"`
 	CheckedAt time.Time `json:"checked_at"`
 }
+
+// DNSSECResponse is GET /zones/{zone}/dnssec.
+type DNSSECResponse struct {
+	Zone string `json:"zone"`
+	View string `json:"view,omitempty"`
+	Type string `json:"type"`
+	*dnssec.Status
+	// ParentZone is set when the parent zone is a primary zone in Jarl
+	// (in the same view): the DS record then goes there, as a record.
+	ParentZone   string `json:"parent_zone,omitempty"`
+	ParentZoneID int64  `json:"parent_zone_id,omitempty"`
+	ParentView   string `json:"parent_view,omitempty"`
+	// ParentDS is the DS records the parent zone in Jarl has for the
+	// zone (record data, e.g. "51126 13 2 FFBE...").
+	ParentDS []string `json:"parent_ds,omitempty"`
+	// Registrar names the registrar Jarl can publish the DS at
+	// ("porkbun"), when one is configured in jarl.yaml.
+	Registrar string `json:"registrar,omitempty"`
+}
+
+// CheckDSResponse is POST /zones/{zone}/dnssec/check-ds: what the parent
+// zone has, and what named was told.
+type CheckDSResponse struct {
+	Parent *nscheck.ParentDSReport `json:"parent"`
+	Marked []string                `json:"marked"`
+	Notes  []string                `json:"notes"`
+	Status *dnssec.Status          `json:"status"`
+}
+
+// DNSSECWipe is POST /zones/{zone}/dnssec/wipe.
+type DNSSECWipe struct {
+	// Force wipes although the parent zone's DS records couldn't be
+	// checked, or named still counts a removed DS as cached.
+	Force  bool `json:"force,omitempty"`
+	DryRun bool `json:"dry_run,omitempty"`
+}
+
+// DNSSECWipeResponse is the result of a wipe.
+type DNSSECWipeResponse struct {
+	Removed     []string                `json:"removed"`
+	DryRun      bool                    `json:"dry_run,omitempty"`
+	ChangesetID int64                   `json:"changeset_id,omitempty"`
+	Parent      *nscheck.ParentDSReport `json:"parent,omitempty"`
+}
+
+// RegistrarResponse is GET /zones/{zone}/registrar: the domain's
+// delegation at the registrar, next to what the zone says.
+type RegistrarResponse struct {
+	Registrar string `json:"registrar"` // "porkbun"
+	Domain    string `json:"domain"`
+	// NS are the name servers at the registry, JarlNS those in the
+	// zone's NS records (both without trailing dots).
+	NS      []string `json:"ns"`
+	JarlNS  []string `json:"jarl_ns"`
+	NSMatch bool     `json:"ns_match"`
+	// Glue covers every glue record at the registry and every name server
+	// inside the zone that needs one.
+	Glue []GlueStatus `json:"glue"`
+	// DS are the DS records at the registry.
+	DS       []RegistrarDS     `json:"ds"`
+	Findings []nscheck.Finding `json:"findings"`
+	// Error is set when the registrar couldn't be asked; the rest is
+	// then empty.
+	Error string `json:"error,omitempty"`
+}
+
+// GlueStatus compares a glue record at the registry with the zone.
+type GlueStatus struct {
+	Host     string   `json:"host"`
+	Registry []string `json:"registry"` // addresses at the registry (none: no glue record)
+	Jarl     []string `json:"jarl"`     // the zone's A and AAAA records for the host
+	// Needed: a name server in the zone's NS records that is inside the
+	// domain, so resolvers need its glue. InUse: in the registry's NS.
+	Needed bool `json:"needed"`
+	InUse  bool `json:"in_use"`
+	// Action is what syncing the glue does: "create", "update" or "".
+	Action string `json:"action,omitempty"`
+}
+
+// RegistrarDS is a DS record at the registry.
+type RegistrarDS struct {
+	porkbun.DS
+	// Matches: it points at a key named publishes for the zone.
+	Matches bool `json:"matches"`
+}
+
+// RegistrarChange asks for a change at the registrar.
+type RegistrarChange struct {
+	// NS (set-ns) are the name servers to set (default: the zone's NS
+	// records).
+	NS []string `json:"ns,omitempty"`
+	// KeyTag (publish DS) picks the key (default: every key that needs
+	// one).
+	KeyTag uint16 `json:"key_tag,omitempty"`
+	// Force skips the checks that the change won't break the domain.
+	Force  bool `json:"force,omitempty"`
+	DryRun bool `json:"dry_run,omitempty"`
+}
+
+// RegistrarChangeResponse is the result of a change at the registrar.
+type RegistrarChangeResponse struct {
+	// Done lists what was changed (or would be, in a dry run).
+	Done     []string          `json:"done"`
+	DryRun   bool              `json:"dry_run,omitempty"`
+	Checks   []nscheck.Finding `json:"checks"`
+	Warnings []string          `json:"warnings"`
+}
+
+// Blocklist is a blocklist as returned by the API (docs/blocking.md).
+type Blocklist struct {
+	model.Blocklist
+	// Views are the views it applies to; AutoViews is set when that is
+	// "every view that offers recursion" (view_ids is empty).
+	Views     []string `json:"views"`
+	AutoViews bool     `json:"auto_views,omitempty"`
+	// State is ok, waiting (not downloaded yet), error (the last update
+	// failed; the previous version stays in use), disabled, or idle (it
+	// applies to no view).
+	State  string                 `json:"state"`
+	Status *model.BlocklistStatus `json:"status,omitempty"`
+	// MemoryMB estimates what named needs for the list, in all its views.
+	MemoryMB int    `json:"memory_mb,omitempty"`
+	Pending  string `json:"pending,omitempty"`
+	// Step is the name of the step the list starts at ("normal" or one
+	// above it).
+	Step string `json:"step"`
+}
+
+// BlockStep is a blocking step above normal as returned by the API, with
+// what uses it.
+type BlockStep struct {
+	model.BlockStep
+	Lists   []string `json:"lists"`
+	Groups  []string `json:"groups"`
+	Pending string   `json:"pending,omitempty"`
+}
+
+// ClientGroup is a client group as returned by the API.
+type ClientGroup struct {
+	model.ClientGroup
+	Step      string   `json:"step"`
+	Views     []string `json:"views"`
+	AutoViews bool     `json:"auto_views,omitempty"`
+	Pending   string   `json:"pending,omitempty"`
+}
+
+// BlockRule is a block or allow rule as returned by the API.
+type BlockRule struct {
+	model.BlockRule
+	Views     []string `json:"views"`
+	AutoViews bool     `json:"auto_views,omitempty"`
+	Pending   string   `json:"pending,omitempty"`
+}
+
+// ZoneLink is a zone a zone is linked with.
+type ZoneLink struct {
+	ID   int64  `json:"id"`
+	View string `json:"view"`
+}

internal/auth/grants.go

@@ -12,19 +12,20 @@ import (
 
 // Resources that grants apply to.
 const (
-	ResZones   = "zones"   // zone definitions and zone options
-	ResRecords = "records" // records in zones
-	ResViews   = "views"   // views and view options
-	ResACLs    = "acls"
-	ResTSIG    = "tsig"    // TSIG keys
-	ResOptions = "options" // server options, top-level statements, settings
-	ResAudit   = "audit"   // audit log and everyone's changesets
-	ResStats   = "stats"   // query statistics
-	ResAll     = "*"
+	ResZones    = "zones"   // zone definitions and zone options
+	ResRecords  = "records" // records in zones
+	ResViews    = "views"   // views and view options
+	ResACLs     = "acls"
+	ResTSIG     = "tsig"     // TSIG keys
+	ResOptions  = "options"  // server options, top-level statements, settings
+	ResAudit    = "audit"    // audit log and everyone's changesets
+	ResStats    = "stats"    // query statistics
+	ResBlocking = "blocking" // blocklists and block/allow rules
+	ResAll      = "*"
 )
 
 // Resources lists the resources in display order.
-var Resources = []string{ResZones, ResRecords, ResViews, ResACLs, ResTSIG, ResOptions, ResAudit, ResStats}
+var Resources = []string{ResZones, ResRecords, ResViews, ResACLs, ResTSIG, ResOptions, ResAudit, ResStats, ResBlocking}
 
 // Access levels.
 const (
@@ -377,6 +378,7 @@ var RoleTemplates = map[string][]model.Grant{
 		{Resource: ResViews, Access: Read},
 		{Resource: ResACLs, Access: Read},
 		{Resource: ResOptions, Access: Read},
+		{Resource: ResBlocking, Access: Read},
 	},
 	"operator": {{Resource: ResAll, Access: Write}},
 	"acme":     {{Resource: ResRecords, Access: Write, Names: []string{"_acme-challenge.*"}, Types: []string{"TXT"}}},

internal/backup/backup.go

@@ -59,9 +59,11 @@ func parse(name string) (kind string, t time.Time, ok bool) {
 }
 
 // Write makes a consistent copy of the live SQLite database src as
-// dir/Name(kind, now), and checks the copy before giving it its final
-// name: a file with a backup's name is always a complete, intact backup.
-func Write(ctx context.Context, src, dir, kind string, now time.Time) (*File, error) {
+// dir/Name(kind, now), stores the files under filesDir in it (the DNSSEC
+// keys; "" for none, see AddFiles), and checks the copy before giving it
+// its final name: a file with a backup's name is always a complete,
+// intact backup.
+func Write(ctx context.Context, src, dir, kind string, now time.Time, filesDir string) (*File, error) {
 	if _, err := os.Stat(src); err != nil {
 		return nil, err
 	}
@@ -78,6 +80,12 @@ func Write(ctx context.Context, src, dir, kind string, now time.Time) (*File, er
 		os.Remove(tmp)
 		return nil, err
 	}
+	if filesDir != "" {
+		if _, err := AddFiles(ctx, tmp, filesDir); err != nil {
+			os.Remove(tmp)
+			return nil, err
+		}
+	}
 	if err := Verify(ctx, tmp); err != nil {
 		os.Remove(tmp)
 		return nil, fmt.Errorf("the new backup failed its check: %w", err)
@@ -144,6 +152,130 @@ func openCopy(path string) (*sql.DB, error) {
 	return sql.Open("sqlite", "file:"+escape(path)+"?mode=ro&immutable=1")
 }
 
+// FilesTable holds the files a backup stores next to the database. It
+// exists only in backups: 'jarld restore' writes the files back and drops
+// the table.
+const FilesTable = "backup_files"
+
+// StoredFile is a file stored in a backup.
+type StoredFile struct {
+	// Path is relative to the directory the files came from (Root).
+	Path string
+	Mode os.FileMode
+	Data []byte
+}
+
+// AddFiles stores every regular file under root in the backup database
+// at path (the DNSSEC keys named keeps under Jarl's key directory,
+// private keys included). A missing root stores nothing. Files that can't
+// be read are an error: named's private keys are readable only by named's
+// user, so the backup must run as root or with CAP_DAC_READ_SEARCH (as
+// jarl-backup.service does).
+func AddFiles(ctx context.Context, path, root string) (int, error) {
+	var files []StoredFile
+	err := filepath.WalkDir(root, func(p string, d os.DirEntry, err error) error {
+		if err != nil {
+			if os.IsNotExist(err) && p == root {
+				return filepath.SkipAll
+			}
+			return err
+		}
+		if !d.Type().IsRegular() {
+			return nil
+		}
+		b, err := os.ReadFile(p)
+		if err != nil {
+			return err
+		}
+		fi, err := d.Info()
+		if err != nil {
+			return err
+		}
+		rel, _ := filepath.Rel(root, p)
+		files = append(files, StoredFile{Path: rel, Mode: fi.Mode().Perm(), Data: b})
+		return nil
+	})
+	if err != nil {
+		if os.IsPermission(err) {
+			return 0, fmt.Errorf("reading the DNSSEC keys: %w (named's private keys are readable only by its own user: back up as root, or through jarl-backup.service)", err)
+		}
+		return 0, fmt.Errorf("reading the DNSSEC keys: %w", err)
+	}
+	db, err := sql.Open("sqlite", "file:"+escape(path)+"?mode=rw")
+	if err != nil {
+		return 0, err
+	}
+	defer db.Close()
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return 0, err
+	}
+	defer tx.Rollback()
+	if _, err := tx.ExecContext(ctx, `CREATE TABLE `+FilesTable+` (root TEXT NOT NULL, path TEXT NOT NULL, mode INTEGER NOT NULL, data BLOB NOT NULL, PRIMARY KEY (root, path))`); err != nil {
+		return 0, err
+	}
+	for _, f := range files {
+		if _, err := tx.ExecContext(ctx, `INSERT INTO `+FilesTable+` (root, path, mode, data) VALUES (?, ?, ?, ?)`, root, f.Path, int(f.Mode), f.Data); err != nil {
+			return 0, err
+		}
+	}
+	return len(files), tx.Commit()
+}
+
+// Files returns the files stored in a backup and the directory they came
+// from ("" and none for a backup without files).
+func Files(ctx context.Context, path string) (string, []StoredFile, error) {
+	db, err := openCopy(path)
+	if err != nil {
+		return "", nil, err
+	}
+	defer db.Close()
+	if !hasTable(ctx, db, FilesTable) {
+		return "", nil, nil
+	}
+	rows, err := db.QueryContext(ctx, `SELECT root, path, mode, data FROM `+FilesTable+` ORDER BY path`)
+	if err != nil {
+		return "", nil, err
+	}
+	defer rows.Close()
+	var root string
+	var out []StoredFile
+	for rows.Next() {
+		var f StoredFile
+		var mode int
+		if err := rows.Scan(&root, &f.Path, &mode, &f.Data); err != nil {
+			return "", nil, err
+		}
+		f.Mode = os.FileMode(mode).Perm()
+		out = append(out, f)
+	}
+	return root, out, rows.Err()
+}
+
+func hasTable(ctx context.Context, db *sql.DB, name string) bool {
+	var n int
+	db.QueryRowContext(ctx, `SELECT count(*) FROM sqlite_master WHERE type = 'table' AND name = ?`, name).Scan(&n)
+	return n > 0
+}
+
+// DropFiles removes the stored files from a database restored from a
+// backup, and vacuums it so the private keys don't linger in free pages.
+func DropFiles(ctx context.Context, path string) error {
+	db, err := sql.Open("sqlite", "file:"+escape(path)+"?mode=rw")
+	if err != nil {
+		return err
+	}
+	defer db.Close()
+	if !hasTable(ctx, db, FilesTable) {
+		return nil
+	}
+	if _, err := db.ExecContext(ctx, `DROP TABLE `+FilesTable); err != nil {
+		return err
+	}
+	_, err = db.ExecContext(ctx, `VACUUM`)
+	return err
+}
+
 // Info describes the contents of a configuration database (KindJarl).
 type Info struct {
 	Schema     int        `json:"schema"`
@@ -151,6 +283,10 @@ type Info struct {
 	Records    int        `json:"records"`
 	Users      int        `json:"users"`
 	LastChange *time.Time `json:"last_change,omitempty"`
+	// KeyFiles is the number of DNSSEC key files stored in a backup, and
+	// SignedZones how many zones were signed.
+	KeyFiles    int `json:"key_files"`
+	SignedZones int `json:"signed_zones"`
 }
 
 // Inspect reads a configuration database's schema version and size. It
@@ -168,6 +304,11 @@ func Inspect(ctx context.Context, path string) (*Info, error) {
 	db.QueryRowContext(ctx, `SELECT count(*) FROM zones`).Scan(&in.Zones)
 	db.QueryRowContext(ctx, `SELECT count(*) FROM records`).Scan(&in.Records)
 	db.QueryRowContext(ctx, `SELECT count(*) FROM users`).Scan(&in.Users)
+	if hasTable(ctx, db, FilesTable) {
+		db.QueryRowContext(ctx, `SELECT count(*) FROM `+FilesTable).Scan(&in.KeyFiles)
+	}
+	// dnssec_policy exists from schema 3 on.
+	db.QueryRowContext(ctx, `SELECT count(*) FROM zones WHERE dnssec_policy != ''`).Scan(&in.SignedZones)
 	var last sql.NullString
 	db.QueryRowContext(ctx, `SELECT max(applied_at) FROM changesets`).Scan(&last)
 	if t, err := time.Parse(time.RFC3339Nano, last.String); err == nil {

internal/backup/backup_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -26,7 +27,7 @@ func TestWriteVerifyInspect(t *testing.T) {
 	src := newDB(t)
 	dir := filepath.Join(t.TempDir(), "backups")
 	now := time.Date(2026, 10, 8, 3, 15, 12, 0, time.UTC)
-	f, err := Write(ctx, src, dir, KindJarl, now)
+	f, err := Write(ctx, src, dir, KindJarl, now, "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -44,7 +45,7 @@ func TestWriteVerifyInspect(t *testing.T) {
 		t.Errorf("inspect: %+v %v", in, err)
 	}
 	// The same second again is refused rather than overwritten.
-	if _, err := Write(ctx, src, dir, KindJarl, now); err == nil {
+	if _, err := Write(ctx, src, dir, KindJarl, now, ""); err == nil {
 		t.Error("overwrote a backup")
 	}
 	// No temporary files are left.
@@ -54,7 +55,7 @@ func TestWriteVerifyInspect(t *testing.T) {
 	}
 	// A missing database is an error, and isn't created.
 	missing := filepath.Join(t.TempDir(), "nope.db")
-	if _, err := Write(ctx, missing, dir, KindJarl, now.Add(time.Second)); err == nil {
+	if _, err := Write(ctx, missing, dir, KindJarl, now.Add(time.Second), ""); err == nil {
 		t.Error("backed up a missing database")
 	}
 	if _, err := os.Stat(missing); err == nil {
@@ -149,3 +150,52 @@ func TestPruneTempFiles(t *testing.T) {
 		t.Error("a running backup's temporary file was deleted")
 	}
 }
+
+func TestKeyFiles(t *testing.T) {
+	ctx := context.Background()
+	src := newDB(t)
+	keys := t.TempDir()
+	os.MkdirAll(filepath.Join(keys, "view-3"), 0o755)
+	os.WriteFile(filepath.Join(keys, "view-3", "Kexample.com.+013+12345.key"), []byte("public"), 0o644)
+	os.WriteFile(filepath.Join(keys, "view-3", "Kexample.com.+013+12345.private"), []byte("private-key-material-xyz"), 0o600)
+	dir := t.TempDir()
+	f, err := Write(ctx, src, dir, KindJarl, time.Now(), keys)
+	if err != nil {
+		t.Fatal(err)
+	}
+	root, files, err := Files(ctx, f.Path)
+	if err != nil || root != keys || len(files) != 2 {
+		t.Fatalf("files: %q %+v %v", root, files, err)
+	}
+	if files[1].Path != "view-3/Kexample.com.+013+12345.private" || string(files[1].Data) != "private-key-material-xyz" || files[1].Mode != 0o600 {
+		t.Errorf("private key: %+v", files[1])
+	}
+	if in, err := Inspect(ctx, f.Path); err != nil || in.KeyFiles != 2 {
+		t.Errorf("inspect: %+v %v", in, err)
+	}
+	// A restored database loses the table again.
+	restored := filepath.Join(t.TempDir(), "jarl.db")
+	b, _ := os.ReadFile(f.Path)
+	os.WriteFile(restored, b, 0o600)
+	if err := DropFiles(ctx, restored); err != nil {
+		t.Fatal(err)
+	}
+	if _, files, _ := Files(ctx, restored); len(files) != 0 {
+		t.Error("files left after DropFiles")
+	}
+	if b, _ := os.ReadFile(restored); strings.Contains(string(b), "private-key-material-xyz") {
+		t.Error("the private key is still in the file")
+	}
+	// No key directory: nothing stored. An unreadable key: an error.
+	if f, err := Write(ctx, src, dir, KindJarl, time.Now().Add(time.Second), filepath.Join(keys, "missing")); err != nil {
+		t.Error(err)
+	} else if _, files, _ := Files(ctx, f.Path); len(files) != 0 {
+		t.Errorf("files from a missing directory: %v", files)
+	}
+	if os.Geteuid() != 0 {
+		os.Chmod(filepath.Join(keys, "view-3", "Kexample.com.+013+12345.private"), 0)
+		if _, err := Write(ctx, src, dir, KindJarl, time.Now().Add(2*time.Second), keys); err == nil || !strings.Contains(err.Error(), "back up as root") {
+			t.Errorf("unreadable key: %v", err)
+		}
+	}
+}

internal/bind/bind.go

@@ -223,6 +223,24 @@ func (t *Tools) ReloadZone(ctx context.Context, zone, view string) error {
 	return err
 }
 
+// CheckDS tells named that the parent zone has published (or withdrawn)
+// the DS record for key tag of a zone it signs (rndc dnssec -checkds).
+func (t *Tools) CheckDS(ctx context.Context, zone, view string, tag uint16, alg uint8, published bool) (string, error) {
+	which := "withdrawn"
+	if published {
+		which = "published"
+	}
+	z := zoneArgs("", zone, view)[1:]
+	args := append([]string{"dnssec", "-checkds", "-key", strconv.Itoa(int(tag)), "-alg", strconv.Itoa(int(alg)), which}, z...)
+	return t.RNDCRun(ctx, args...)
+}
+
+// ZoneCommand is the rndc command line for a zone command, as shown to
+// users ("rndc zonestatus example.org IN internal").
+func ZoneCommand(cmd, zone, view string) string {
+	return "rndc " + strings.Join(zoneArgs(cmd, zone, view), " ")
+}
+
 func zoneArgs(cmd, zone, view string) []string {
 	z := strings.TrimSuffix(zone, ".")
 	if z == "" {
@@ -236,16 +254,32 @@ func zoneArgs(cmd, zone, view string) []string {
 
 // ZoneStatus is the result of rndc zonestatus.
 type ZoneStatus struct {
-	Name       string `json:"name"`
-	Type       string `json:"type"`
-	Files      string `json:"files"`
-	Serial     uint32 `json:"serial"`
-	HasSerial  bool   `json:"-"`
-	Nodes      int    `json:"nodes"`
-	LastLoaded string `json:"last_loaded"`
-	Secure     bool   `json:"secure"`
-	Dynamic    bool   `json:"dynamic"`
-	Raw        string `json:"raw"`
+	Name  string `json:"name"`
+	Type  string `json:"type"`
+	Files string `json:"files"`
+	// Serial is the serial of the zone file named loaded. For a zone
+	// named signs (inline signing) that is the unsigned zone Jarl wrote;
+	// the signed zone that named serves has its own serial, SignedSerial.
+	Serial          uint32 `json:"serial"`
+	HasSerial       bool   `json:"-"`
+	SignedSerial    uint32 `json:"signed_serial,omitempty"`
+	HasSignedSerial bool   `json:"-"`
+	Nodes           int    `json:"nodes"`
+	LastLoaded      string `json:"last_loaded"`
+	Secure          bool   `json:"secure"`
+	InlineSigning   bool   `json:"inline_signing"`
+	NextKeyEvent    string `json:"next_key_event,omitempty"`
+	Dynamic         bool   `json:"dynamic"`
+	Raw             string `json:"raw"`
+}
+
+// ServedSerial is the serial named answers queries with: the signed
+// zone's for a zone it signs, otherwise the loaded one.
+func (zs *ZoneStatus) ServedSerial() (uint32, bool) {
+	if zs.HasSignedSerial {
+		return zs.SignedSerial, true
+	}
+	return zs.Serial, zs.HasSerial
 }
 
 // ZoneStatus returns named's view of a zone.
@@ -277,6 +311,14 @@ func ParseZoneStatus(out string) *ZoneStatus {
 			if n, err := strconv.ParseUint(v, 10, 32); err == nil {
 				zs.Serial, zs.HasSerial = uint32(n), true
 			}
+		case "signed serial":
+			if n, err := strconv.ParseUint(v, 10, 32); err == nil {
+				zs.SignedSerial, zs.HasSignedSerial = uint32(n), true
+			}
+		case "inline signing":
+			zs.InlineSigning = v == "yes"
+		case "next key event":
+			zs.NextKeyEvent = v
 		case "nodes":
 			zs.Nodes, _ = strconv.Atoi(v)
 		case "last loaded":
@@ -298,7 +340,14 @@ type ServerStatus struct {
 	ConfigFile     string `json:"config_file"`
 	Zones          string `json:"zones"`
 	Running        bool   `json:"running"`
-	Raw            string `json:"raw"`
+	// RecursiveClients is "now/soft limit/hard limit" (the soft limit is
+	// where named starts dropping the oldest queries), TCPClients
+	// "now/limit".
+	RecursiveClients string `json:"recursive_clients,omitempty"`
+	TCPClients       string `json:"tcp_clients,omitempty"`
+	CPUs             string `json:"cpus,omitempty"`
+	WorkerThreads    string `json:"worker_threads,omitempty"`
+	Raw              string `json:"raw"`
 }
 
 // Status returns named's status.
@@ -321,6 +370,14 @@ func (t *Tools) Status(ctx context.Context) (*ServerStatus, error) {
 			st.ConfigFile = v
 		case ok && k == "number of zones":
 			st.Zones = v
+		case ok && k == "recursive clients":
+			st.RecursiveClients = v
+		case ok && k == "tcp clients":
+			st.TCPClients = v
+		case ok && k == "CPUs found":
+			st.CPUs = v
+		case ok && k == "worker threads":
+			st.WorkerThreads = v
 		case strings.Contains(line, "server is up and running"):
 			st.Running = true
 		}

internal/bind/bind_test.go

@@ -17,3 +17,33 @@ zone example.com/IN/internal: loaded serial 1
 		t.Errorf("exit 1: %+v", bad)
 	}
 }
+
+func TestParseZoneStatusSigned(t *testing.T) {
+	// rndc zonestatus of a zone named signs with dnssec-policy (BIND 9.20).
+	zs := ParseZoneStatus(`name: example.test
+type: primary
+files: /var/lib/bind/jarl/_default/example.test.zone
+serial: 2026100802
+signed serial: 2026100804
+nodes: 4
+last loaded: Thu, 08 Oct 2026 19:03:31 GMT
+secure: yes
+inline signing: yes
+key maintenance: automatic
+next key event: Thu, 08 Oct 2026 21:08:31 GMT
+next resign node: new.example.test/A
+next resign time: Sat, 17 Oct 2026 07:32:59 GMT
+dynamic: no
+reconfigurable via modzone: no
+`)
+	if zs.Serial != 2026100802 || zs.SignedSerial != 2026100804 || !zs.Secure || !zs.InlineSigning || zs.NextKeyEvent != "Thu, 08 Oct 2026 21:08:31 GMT" {
+		t.Errorf("%+v", zs)
+	}
+	if s, ok := zs.ServedSerial(); !ok || s != 2026100804 {
+		t.Errorf("served serial %d %v", s, ok)
+	}
+	plain := ParseZoneStatus("name: example.com\nserial: 7\nsecure: no\n")
+	if s, ok := plain.ServedSerial(); !ok || s != 7 || plain.HasSignedSerial {
+		t.Errorf("unsigned: %+v", plain)
+	}
+}

internal/blocking/blocking_test.go

@@ -0,0 +1,180 @@
+package blocking
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestParse(t *testing.T) {
+	src := "\uFEFF[Adblock Plus]\r\n" + `! Title: test list
+# a comment
+
+||ads.example^
+||Tracker.Example.^$important
+||cosmetic.example^$third-party
+@@||allowed.example^
+example.org##.banner
+|https://url.example/path
+0.0.0.0 hosts.example other.example  # two names
+127.0.0.1 localhost
+127.0.0.1 localhost.localdomain
+::1 ip6-localhost
+0.0.0.0 0.0.0.0
+plain.example
+*.wild.example
+single
+1.2.3.4
+bad_label!.example
+münchen.example
+www.ads.example
+` + strings.Repeat("a", 64) + ".example\n"
+	l, err := Parse(strings.NewReader(src), Limits{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]uint8{
+		"ads.example": Exact | Below, "tracker.example": Exact | Below,
+		"hosts.example": Exact, "other.example": Exact, "plain.example": Exact,
+		"wild.example": Exact | Below, "xn--mnchen-3ya.example": Exact, "www.ads.example": Exact,
+	}
+	if len(l.Domains) != len(want) {
+		t.Errorf("domains = %v", l.Domains)
+	}
+	for n, f := range want {
+		if l.Domains[n] != f {
+			t.Errorf("%s = %d, want %d", n, l.Domains[n], f)
+		}
+	}
+	// Skipped: $third-party, @@, ##, |url, localhost (x3), 0.0.0.0, single, 1.2.3.4, bad_label!, 64-char label.
+	if l.Skipped != 12 || l.Lines != 19 {
+		t.Errorf("lines %d, skipped %d", l.Lines, l.Skipped)
+	}
+
+	Compact(l)
+	if _, ok := l.Domains["www.ads.example"]; ok {
+		t.Error("www.ads.example is covered by ||ads.example^ and should be dropped")
+	}
+	var sb strings.Builder
+	n, hash, err := FeedZone(&sb, "test", 7, l)
+	if err != nil || n != 10 {
+		t.Fatalf("FeedZone: %d records, %v", n, err)
+	}
+	for _, line := range []string{"ads.example\tCNAME\t.\n", "*.ads.example\tCNAME\t.\n", "plain.example\tCNAME\t.\n", "@\tSOA\tlocalhost. hostmaster.localhost. 7 "} {
+		if !strings.Contains(sb.String(), line) {
+			t.Errorf("zone lacks %q:\n%s", line, sb.String())
+		}
+	}
+	if strings.Contains(sb.String(), "*.plain.example") || strings.Contains(sb.String(), "$ORIGIN") {
+		t.Errorf("zone:\n%s", sb.String())
+	}
+	// The hash ignores the serial.
+	var other strings.Builder
+	if _, h2, _ := FeedZone(&other, "test", 8, l); h2 != hash {
+		t.Error("hash depends on the serial")
+	}
+}
+
+func TestParseLimits(t *testing.T) {
+	_, err := Parse(strings.NewReader("a.example\nb.example\na.example\nc.example\n"), Limits{MaxEntries: 2})
+	if !errors.Is(err, ErrTooManyEntries) {
+		t.Errorf("err = %v", err)
+	}
+	if _, err := Parse(strings.NewReader("a.example\nb.example\na.example\n"), Limits{MaxEntries: 2}); err != nil {
+		t.Errorf("a repeated name counted against the limit: %v", err)
+	}
+	l, _ := Parse(strings.NewReader("long-name.example\nshort.example\n"), Limits{MaxNameLen: 15})
+	if len(l.Domains) != 1 || l.Skipped != 1 {
+		t.Errorf("max name length: %v", l.Domains)
+	}
+}
+
+func TestRuleEntries(t *testing.T) {
+	rules := []Rule{
+		{Name: "ads.example", Action: ActionBlock},                        // and everything below
+		{Name: "cdn.ads.example", Action: ActionAllow, Exact: true},       // just this name
+		{Name: "wide.example", Action: ActionBlock},                       // and below
+		{Name: "ok.wide.example", Action: ActionAllow},                    // and below
+		{Name: "deep.x.y.wide.example", Action: ActionAllow, Exact: true}, // two empty names in between
+		{Name: "solo.example", Action: ActionBlock, Exact: true},
+	}
+	e := RuleEntries(rules)
+	for name, want := range map[string]string{
+		"ads.example":                 ActionBlock,
+		"x.ads.example":               ActionBlock,
+		"cdn.ads.example":             ActionAllow,
+		"y.cdn.ads.example":           ActionBlock, // the wildcard above still applies
+		"ok.wide.example":             ActionAllow,
+		"a.ok.wide.example":           ActionAllow,
+		"y.wide.example":              ActionBlock, // exists only because of a deeper rule
+		"x.y.wide.example":            ActionBlock,
+		"z.x.y.wide.example":          ActionBlock,
+		"deep.x.y.wide.example":       ActionAllow,
+		"below.deep.x.y.wide.example": ActionBlock,
+		"solo.example":                ActionBlock,
+		"other.example":               "",
+		"sub.solo.example":            "",
+		"example":                     "",
+		"unrelated.org":               "",
+	} {
+		_, act, ok := MatchRules(e, name)
+		if !ok {
+			act = ""
+		}
+		if act != want {
+			t.Errorf("%s: %q, want %q", name, act, want)
+		}
+	}
+	z := RulesZoneFile("rules", rules)
+	if !strings.Contains(z, "cdn.ads.example\tCNAME\trpz-passthru.\n*.cdn.ads.example\tCNAME\t.\n") {
+		t.Errorf("rules zone:\n%s", z)
+	}
+	if strings.Index(z, "ads.example\t") > strings.Index(z, "*.ads.example\t") {
+		t.Errorf("a name should come before its wildcard:\n%s", z)
+	}
+}
+
+func TestMatchFeed(t *testing.T) {
+	l, _ := Parse(strings.NewReader("||tracker.example^\nexact.example\n||deep.a.example^\n"), Limits{})
+	Compact(l)
+	path := filepath.Join(t.TempDir(), "list.rpz")
+	f, _ := os.Create(path)
+	FeedZone(f, "t", 1, l)
+	f.Close()
+	for name, want := range map[string]string{
+		"tracker.example":     "tracker.example",
+		"a.b.tracker.example": "*.tracker.example",
+		"exact.example":       "exact.example",
+		"sub.exact.example":   "",
+		"x.deep.a.example":    "*.deep.a.example",
+		"a.example":           "",
+		"example":             "",
+	} {
+		owner, ok, err := MatchFeed(path, name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !ok {
+			owner = ""
+		}
+		if owner != want {
+			t.Errorf("%s: %q, want %q", name, owner, want)
+		}
+	}
+}
+
+func TestNames(t *testing.T) {
+	if ListZone("hagezi") != "hagezi.blocklist.jarl.invalid" || ListName("hagezi.blocklist.jarl.invalid.") != "hagezi" || ListName(RulesZone) != "" || ListName("x.y.blocklist.jarl.invalid") != "" {
+		t.Error("zone names")
+	}
+	if n, err := NormalizeName("Ads.Example.COM."); err != nil || n != "ads.example.com" {
+		t.Errorf("NormalizeName = %q, %v", n, err)
+	}
+	for _, bad := range []string{"com", "1.2.3.4", "a b.example", "*.example.com", ""} {
+		if _, err := NormalizeName(bad); err == nil {
+			t.Errorf("%q accepted", bad)
+		}
+	}
+}

internal/blocking/clients.go

@@ -0,0 +1,180 @@
+package blocking
+
+import (
+	"fmt"
+	"math"
+	"net/netip"
+	"sort"
+	"strings"
+)
+
+// Client steps (docs/blocking.md): named checks policy zones in order and
+// the first match decides, so a "gate" zone that lets some clients through
+// (rpz-passthru, matched on the client's address) keeps them from every
+// zone after it. Jarl puts a gate in front of the lists of each step,
+// letting through the clients whose step is below it.
+
+// GateSuffix follows a gate's name: off.gate.jarl.invalid,
+// strict.gate.jarl.invalid.
+const GateSuffix = ".gate.jarl.invalid"
+
+// v4Mapped holds the IPv4-mapped IPv6 addresses.
+var v4Mapped = netip.MustParsePrefix("::ffff:0:0/96")
+
+// GateZone returns the policy zone name of the gate in front of a step's
+// lists ("off" for the gate in front of the normal lists).
+func GateZone(step string) string { return step + GateSuffix }
+
+// Assignment gives the addresses in Prefix a step rank (-1 off, 0 normal,
+// 1, 2, ... the steps above it).
+type Assignment struct {
+	Prefix netip.Prefix
+	Rank   int
+}
+
+// PassBelow returns the fewest prefixes that cover exactly the addresses whose
+// rank is below k. An address has the rank of the most specific
+// assignment containing it, and rank 0 (normal) when none does. When two
+// assignments have the same prefix, the higher rank counts (validation
+// refuses that anyway).
+func PassBelow(assigns []Assignment, k int) []netip.Prefix {
+	var out []netip.Prefix
+	for _, root := range []netip.Prefix{netip.MustParsePrefix("0.0.0.0/0"), netip.MustParsePrefix("::/0")} {
+		var mine []Assignment
+		if !root.Addr().Is4() {
+			// named matches IPv4 clients as IPv4-mapped IPv6 addresses:
+			// keep IPv6 prefixes clear of them, so only the IPv4 ones
+			// decide for IPv4 clients.
+			mine = append(mine, Assignment{v4Mapped, math.MaxInt})
+		}
+		rank := 0
+		for _, a := range assigns {
+			p := a.Prefix.Masked()
+			if p.Addr().Is4() != root.Addr().Is4() {
+				continue
+			}
+			if p.Bits() == 0 {
+				rank = max(rank, a.Rank)
+				continue
+			}
+			mine = append(mine, Assignment{p, a.Rank})
+		}
+		for _, p := range cover(root, rank, mine, k) {
+			if p.Bits() == 0 {
+				// A trigger needs at least one bit: use both halves.
+				lo, hi := halves(p)
+				out = append(out, lo, hi)
+				continue
+			}
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// cover returns the prefixes inside p whose addresses have a rank below k.
+// rank is p's own; inside are the assignments strictly inside p.
+func cover(p netip.Prefix, rank int, inside []Assignment, k int) []netip.Prefix {
+	if len(inside) == 0 {
+		if rank < k {
+			return []netip.Prefix{p}
+		}
+		return nil
+	}
+	var out []netip.Prefix
+	lo, hi := halves(p)
+	full := 0
+	for _, h := range []netip.Prefix{lo, hi} {
+		var sub []Assignment
+		for _, a := range inside {
+			if a.Prefix.Bits() > h.Bits() && h.Contains(a.Prefix.Addr()) {
+				sub = append(sub, a)
+			}
+		}
+		c := cover(h, ownRank(inside, h, rank), sub, k)
+		if len(c) == 1 && c[0] == h {
+			full++
+		}
+		out = append(out, c...)
+	}
+	if full == 2 {
+		return []netip.Prefix{p}
+	}
+	return out
+}
+
+// ownRank is the rank of h: its own assignments' (the highest), or the
+// inherited one without any.
+func ownRank(inside []Assignment, h netip.Prefix, inherited int) int {
+	r, found := 0, false
+	for _, a := range inside {
+		if a.Prefix == h {
+			if !found || a.Rank > r {
+				r = a.Rank
+			}
+			found = true
+		}
+	}
+	if !found {
+		return inherited
+	}
+	return r
+}
+
+// halves splits a prefix into its two halves.
+func halves(p netip.Prefix) (netip.Prefix, netip.Prefix) {
+	bits := p.Bits() + 1
+	lo := netip.PrefixFrom(p.Addr(), bits).Masked()
+	b := lo.Addr().AsSlice()
+	i := (bits - 1) / 8
+	b[i] |= 0x80 >> ((bits - 1) % 8)
+	a, _ := netip.AddrFromSlice(b)
+	return lo, netip.PrefixFrom(a, bits)
+}
+
+// ClientIPOwner returns the policy zone owner name that matches clients
+// in p (an rpz-client-ip trigger): 32.37.0.10.10.rpz-client-ip for
+// 10.10.0.37/32, 64.zz.3d7f.8013.2a02.rpz-client-ip for 2a02:8013:3d7f::/64.
+func ClientIPOwner(p netip.Prefix) string {
+	p = p.Masked()
+	a := p.Addr()
+	var labels []string
+	if a.Is4() {
+		b := a.As4()
+		labels = []string{fmt.Sprint(b[3]), fmt.Sprint(b[2]), fmt.Sprint(b[1]), fmt.Sprint(b[0])}
+	} else {
+		// RFC 5952 text, with "zz" for the "::" and the words reversed.
+		s := a.String()
+		var words []string
+		if left, right, ok := strings.Cut(s, "::"); ok {
+			if left != "" {
+				words = append(words, strings.Split(left, ":")...)
+			}
+			words = append(words, "zz")
+			if right != "" {
+				words = append(words, strings.Split(right, ":")...)
+			}
+		} else {
+			words = strings.Split(s, ":")
+		}
+		for i := len(words) - 1; i >= 0; i-- {
+			labels = append(labels, words[i])
+		}
+	}
+	return fmt.Sprint(p.Bits()) + "." + strings.Join(labels, ".") + ".rpz-client-ip"
+}
+
+// GateZoneFile renders a gate: every client in prefixes passes.
+func GateZoneFile(title string, prefixes []netip.Prefix) string {
+	owners := make([]string, 0, len(prefixes))
+	for _, p := range prefixes {
+		owners = append(owners, ClientIPOwner(p))
+	}
+	sort.Strings(owners)
+	var sb strings.Builder
+	sb.WriteString(header(title, 1))
+	for _, o := range owners {
+		sb.WriteString(o + "\tCNAME\trpz-passthru.\n")
+	}
+	return sb.String()
+}

internal/blocking/clients_test.go

@@ -0,0 +1,96 @@
+package blocking
+
+import (
+	"net/netip"
+	"slices"
+	"strings"
+	"testing"
+)
+
+func pfx(s string) netip.Prefix { return netip.MustParsePrefix(s) }
+
+// rankOf is the rank PassBelow's model gives an address.
+func rankOf(assigns []Assignment, a netip.Addr) int {
+	best, bits := 0, -1
+	for _, x := range assigns {
+		if x.Prefix.Contains(a) && x.Prefix.Bits() >= bits {
+			if x.Prefix.Bits() > bits || x.Rank > best {
+				best = x.Rank
+			}
+			bits = x.Prefix.Bits()
+		}
+	}
+	return best
+}
+
+func covered(ps []netip.Prefix, a netip.Addr) bool {
+	for _, p := range ps {
+		if p.Contains(a) {
+			return true
+		}
+	}
+	return false
+}
+
+func TestPassBelow(t *testing.T) {
+	assigns := []Assignment{
+		{pfx("10.10.0.20/32"), -1},   // work laptop: off
+		{pfx("10.10.0.0/24"), 2},     // the kids' network: very strict
+		{pfx("10.10.0.50/32"), 1},    // except one tablet: strict
+		{pfx("2a02:db8::/64"), 1},    // an IPv6 network: strict
+		{pfx("2a02:db8::99/128"), 0}, // one device in it: normal
+	}
+	probe := []string{"10.10.0.20", "10.10.0.21", "10.10.0.50", "10.10.0.51", "10.10.1.1", "192.168.1.1", "0.0.0.1", "255.255.255.255",
+		"2a02:db8::1", "2a02:db8::99", "2a02:db8:0:1::1", "::1", "ffff::1"}
+	for k := 0; k <= 3; k++ {
+		gate := PassBelow(assigns, k)
+		for _, s := range probe {
+			a := netip.MustParseAddr(s)
+			if want := rankOf(assigns, a) < k; covered(gate, a) != want {
+				t.Errorf("k=%d %s: passes=%v, want %v (rank %d)", k, s, !want, want, rankOf(assigns, a))
+			}
+		}
+		for _, p := range gate {
+			if p.Bits() == 0 {
+				t.Errorf("k=%d: a /0 trigger", k)
+			}
+			// named matches IPv4 clients as ::ffff:a.b.c.d: no IPv6
+			// prefix may reach them.
+			if p.Addr().Is6() && p.Overlaps(v4Mapped) {
+				t.Errorf("k=%d: %s covers IPv4-mapped addresses", k, p)
+			}
+		}
+	}
+	// Off clients only, before the normal lists.
+	if got := PassBelow(assigns, 0); !slices.Equal(got, []netip.Prefix{pfx("10.10.0.20/32")}) {
+		t.Errorf("off gate = %v", got)
+	}
+	// Nobody above normal: everyone passes the gate of step 1: two IPv4
+	// halves, and IPv6 around the IPv4-mapped /96 (96 prefixes).
+	if got := PassBelow(nil, 1); len(got) != 2+96 {
+		t.Errorf("empty step-1 gate = %v", got)
+	}
+	// The complement of one IPv4 address is 32 prefixes (plus IPv6's 96).
+	if got := PassBelow([]Assignment{{pfx("10.10.0.50/32"), 1}}, 1); len(got) != 32+96 {
+		t.Errorf("complement of one address: %d prefixes", len(got))
+	}
+}
+
+func TestClientIPOwner(t *testing.T) {
+	for p, want := range map[string]string{
+		"10.10.0.37/32":            "32.37.0.10.10.rpz-client-ip",
+		"10.10.0.0/24":             "24.0.0.10.10.rpz-client-ip",
+		"2a02:db8::/64":            "64.zz.db8.2a02.rpz-client-ip",
+		"2a02:db8::1/128":          "128.1.zz.db8.2a02.rpz-client-ip",
+		"::/1":                     "1.zz.rpz-client-ip",
+		"2001:db8:1:2:3:4:5:6/128": "128.6.5.4.3.2.1.db8.2001.rpz-client-ip",
+	} {
+		if got := ClientIPOwner(pfx(p)); got != want {
+			t.Errorf("%s: %s, want %s", p, got, want)
+		}
+	}
+	z := GateZoneFile("t", []netip.Prefix{pfx("10.10.0.20/32")})
+	if !strings.Contains(z, "32.20.0.10.10.rpz-client-ip\tCNAME\trpz-passthru.\n") {
+		t.Errorf("gate zone:\n%s", z)
+	}
+}

internal/blocking/parse.go

@@ -0,0 +1,198 @@
+// Package blocking turns blocklists and block/allow rules into BIND
+// response policy zones (RPZ), and answers which rule or list matches a
+// name.
+//
+// A policy zone holds one rule per owner name: "ads.example CNAME ."
+// answers NXDOMAIN for ads.example, "*.ads.example CNAME ." for every name
+// below it, and "CNAME rpz-passthru." answers normally (an exception).
+// named looks names up in a policy zone like in any zone, so wildcards
+// follow DNS rules: a wildcard doesn't apply below a name that exists in
+// the zone. The writers here add the rules that keep "the most specific
+// rule wins" true despite that (see RulesZone).
+package blocking
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"net/netip"
+	"strings"
+	"unicode/utf8"
+
+	"jarl/internal/dnsname"
+)
+
+// Flags say what a list entry covers.
+const (
+	Exact uint8 = 1 << iota // the name itself
+	Below                   // every name below it
+)
+
+// List is a parsed blocklist.
+type List struct {
+	// Domains maps names (lowercase, without the final dot) to flags.
+	Domains map[string]uint8
+	// Lines is the number of lines with an entry (not comments or blank
+	// lines); Skipped how many of them were not usable.
+	Lines, Skipped int
+}
+
+// Limits bound what Parse accepts.
+type Limits struct {
+	MaxEntries int // distinct domains (0: no limit)
+	MaxNameLen int // longest name in characters (0: 253)
+}
+
+// ErrTooManyEntries is returned when a list has more than MaxEntries
+// domains.
+var ErrTooManyEntries = errors.New("too many entries")
+
+// Parse reads a blocklist. Each line is one of:
+//
+//	||ads.example^          Adblock style: the name and everything below it
+//	*.ads.example           the name and everything below it
+//	0.0.0.0 ads.example     hosts file (any address; several names allowed)
+//	ads.example             just this name
+//
+// Comments (#, !), Adblock headers ([Adblock Plus]) and blank lines are
+// ignored. Lines that can't be used for DNS blocking (exceptions,
+// cosmetic and URL rules, addresses, single-label names, invalid names)
+// are counted as skipped.
+func Parse(r io.Reader, lim Limits) (*List, error) {
+	maxLen := lim.MaxNameLen
+	if maxLen <= 0 || maxLen > 253 {
+		maxLen = 253
+	}
+	l := &List{Domains: map[string]uint8{}}
+	full := false // a new name was refused because of MaxEntries
+	add := func(name string, flags uint8) bool {
+		name, ok := normalize(name, maxLen)
+		if !ok {
+			return false
+		}
+		if _, seen := l.Domains[name]; !seen && lim.MaxEntries > 0 && len(l.Domains) >= lim.MaxEntries {
+			full = true
+			return false
+		}
+		l.Domains[name] |= flags
+		return true
+	}
+	sc := bufio.NewScanner(r)
+	sc.Buffer(make([]byte, 64*1024), 1024*1024)
+	first := true
+	for sc.Scan() {
+		line := sc.Text()
+		if first {
+			line = strings.TrimPrefix(line, "\uFEFF")
+			first = false
+		}
+		line = strings.TrimSpace(line)
+		if line == "" || line[0] == '#' || line[0] == '!' || line[0] == '[' {
+			continue
+		}
+		l.Lines++
+		ok := false
+		switch {
+		case strings.HasPrefix(line, "||"):
+			ok = add(adblockDomain(line[2:]), Exact|Below)
+		case strings.ContainsAny(line, "|/$^@") || strings.Contains(line, "##"):
+			// Exceptions (@@), URL and cosmetic rules: not for DNS.
+		default:
+			if i := strings.Index(line, "#"); i >= 0 {
+				line = strings.TrimSpace(line[:i])
+			}
+			fields := strings.Fields(line)
+			switch {
+			case len(fields) == 1 && strings.HasPrefix(fields[0], "*."):
+				ok = add(fields[0][2:], Exact|Below)
+			case len(fields) == 1:
+				ok = add(fields[0], Exact)
+			case len(fields) > 1 && isAddr(fields[0]):
+				for _, f := range fields[1:] {
+					if add(f, Exact) {
+						ok = true
+					}
+				}
+			}
+		}
+		if full {
+			return l, fmt.Errorf("%w: the list has more than %d domains", ErrTooManyEntries, lim.MaxEntries)
+		}
+		if !ok {
+			l.Skipped++
+		}
+	}
+	if err := sc.Err(); err != nil {
+		return l, err
+	}
+	return l, nil
+}
+
+// adblockDomain returns the domain of an Adblock rule's body
+// ("ads.example^" or "ads.example^$important"), or "" when the rule
+// does more than block a domain (other modifiers, paths, wildcards).
+func adblockDomain(s string) string {
+	d, rest, _ := strings.Cut(s, "^")
+	if rest != "" && rest != "$important" {
+		return ""
+	}
+	if strings.ContainsAny(d, "*/:|$") {
+		return ""
+	}
+	return d
+}
+
+func isAddr(s string) bool {
+	_, err := netip.ParseAddr(s)
+	return err == nil
+}
+
+// localNames are hosts-file names that aren't blocklist entries.
+var localNames = map[string]bool{"localhost.localdomain": true, "ip6-localhost": true, "ip6-loopback": true}
+
+// normalize lowercases a name, removes the final dot, converts
+// international names to their ASCII form, and checks it is usable: at
+// least two labels of letters, digits, hyphens and underscores, and not an
+// address.
+func normalize(name string, maxLen int) (string, bool) {
+	name = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(name)), ".")
+	if name == "" || localNames[name] || isAddr(name) {
+		return "", false
+	}
+	for i := 0; i < len(name); i++ {
+		if name[i] >= utf8.RuneSelf {
+			a, err := dnsname.ToASCII(name)
+			if err != nil {
+				return "", false
+			}
+			name = strings.TrimSuffix(strings.ToLower(a), ".")
+			break
+		}
+	}
+	if len(name) > maxLen || !strings.Contains(name, ".") {
+		return "", false
+	}
+	for _, label := range strings.Split(name, ".") {
+		if label == "" || len(label) > 63 {
+			return "", false
+		}
+		for i := 0; i < len(label); i++ {
+			c := label[i]
+			if !(c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '-' || c == '_') {
+				return "", false
+			}
+		}
+	}
+	return name, true
+}
+
+// NormalizeName checks and normalizes a domain the way list entries are
+// (for rules entered by hand). The name must have at least two labels.
+func NormalizeName(name string) (string, error) {
+	n, ok := normalize(name, 253-len(RulesZone)-2)
+	if !ok {
+		return "", fmt.Errorf("%q is not a domain name that can be blocked (it needs at least two labels of letters, digits, hyphens or underscores, like ads.example.com)", name)
+	}
+	return n, nil
+}

internal/blocking/zone.go

@@ -0,0 +1,316 @@
+package blocking
+
+import (
+	"bufio"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+	"sort"
+	"strings"
+)
+
+// Policy zone names. They are under .invalid (RFC 6761), so they can
+// never clash with a real zone, and named only uses them internally.
+const (
+	// RulesZone holds the rules entered in Jarl (one copy per view).
+	RulesZone = "rules.jarl.invalid"
+	// listSuffix follows a list's name: hagezi.blocklist.jarl.invalid.
+	listSuffix = ".blocklist.jarl.invalid"
+)
+
+// ListZone returns the policy zone name of a blocklist.
+func ListZone(name string) string { return name + listSuffix }
+
+// ListName returns the blocklist name of a policy zone ("" for the rules
+// zone and zones that aren't Jarl's).
+func ListName(zone string) string {
+	zone = strings.TrimSuffix(strings.ToLower(zone), ".")
+	if n, ok := strings.CutSuffix(zone, listSuffix); ok && !strings.Contains(n, ".") {
+		return n
+	}
+	return ""
+}
+
+// Match says what blocking does with a name in one view.
+type Match struct {
+	View   string `json:"view,omitempty"`
+	Result string `json:"result"`          // blocked, allowed or none
+	Entry  string `json:"entry,omitempty"` // the matching entry: the name, or *.parent
+	RuleID int64  `json:"rule_id,omitempty"`
+	List   string `json:"list,omitempty"` // the blocklist, when a list matched
+	// Step is the list's step when it is above normal: only clients at
+	// that step or above get this answer (others: none).
+	Step string `json:"step,omitempty"`
+}
+
+// Actions of rules.
+const (
+	ActionBlock = "block"
+	ActionAllow = "allow"
+)
+
+// cname is the CNAME target of each action: "." answers NXDOMAIN,
+// rpz-passthru. answers as if there were no rule.
+var cname = map[string]string{ActionBlock: ".", ActionAllow: "rpz-passthru."}
+
+// header starts a policy zone file. There is no $ORIGIN: names are
+// relative to the zone, so a list can be renamed without rewriting its
+// file. The short TTLs make a change reach clients' caches quickly.
+func header(title string, serial uint32) string {
+	return fmt.Sprintf("; %s\n; Generated by Jarl. DO NOT EDIT.\n$TTL 60\n@\tSOA\tlocalhost. hostmaster.localhost. %d 3600 600 86400 60\n\tNS\tlocalhost.\n", title, serial)
+}
+
+// Placeholder is the content of a list's zone file before the list has
+// been downloaded: a valid, empty policy zone.
+func Placeholder() string {
+	return header("Blocklist not downloaded yet.", 1)
+}
+
+// Rule is a block or allow rule entered by hand.
+type Rule struct {
+	Name   string // lowercase, without the final dot
+	Action string // ActionBlock or ActionAllow
+	Exact  bool   // only the name itself, not the names below it
+}
+
+// RuleEntries returns the policy zone owners for rules (relative names,
+// "*." for wildcards) and their actions, with the entries that make the
+// most specific rule win added: named won't apply a wildcard below a name
+// that exists in the zone, so every name below a wildcard that exists
+// (because a more specific rule mentions it) gets the wildcard's action
+// for itself and for the names below it, unless a rule says otherwise.
+// Callers make sure no two rules have the same name and scope.
+func RuleEntries(rules []Rule) map[string]string {
+	e := map[string]string{}
+	for _, r := range rules {
+		e[r.Name] = r.Action
+		if !r.Exact {
+			e["*."+r.Name] = r.Action
+		}
+	}
+	// Every name that exists in the zone: owners and their ancestors.
+	nodes := map[string]bool{}
+	for owner := range e {
+		n := strings.TrimPrefix(owner, "*.")
+		for {
+			nodes[n] = true
+			i := strings.IndexByte(n, '.')
+			if i < 0 {
+				break
+			}
+			n = n[i+1:]
+		}
+	}
+	ordered := make([]string, 0, len(nodes))
+	for n := range nodes {
+		ordered = append(ordered, n)
+	}
+	// Shallow names first, so a filled-in wildcard is inherited further
+	// down.
+	sort.Slice(ordered, func(i, j int) bool {
+		di, dj := strings.Count(ordered[i], "."), strings.Count(ordered[j], ".")
+		if di != dj {
+			return di < dj
+		}
+		return ordered[i] < ordered[j]
+	})
+	for _, n := range ordered {
+		inherited := ""
+		for a := n; ; {
+			i := strings.IndexByte(a, '.')
+			if i < 0 {
+				break
+			}
+			a = a[i+1:]
+			if act, ok := e["*."+a]; ok {
+				inherited = act
+				break
+			}
+		}
+		if inherited == "" {
+			continue
+		}
+		if _, ok := e[n]; !ok {
+			e[n] = inherited
+		}
+		if _, ok := e["*."+n]; !ok {
+			e["*."+n] = inherited
+		}
+	}
+	return e
+}
+
+// PausedZoneFile renders a rules zone that lets every name through, for
+// while blocking is paused: the rules zone comes first, and its match
+// stops named from looking at the lists.
+func PausedZoneFile(title string) string {
+	return header(title+" (blocking is paused)", 1) + "*\tCNAME\trpz-passthru.\n"
+}
+
+// RulesZoneFile renders the rules zone of a view.
+func RulesZoneFile(title string, rules []Rule) string {
+	e := RuleEntries(rules)
+	owners := make([]string, 0, len(e))
+	for o := range e {
+		owners = append(owners, o)
+	}
+	sort.Slice(owners, func(i, j int) bool { return ownerLess(owners[i], owners[j]) })
+	var sb strings.Builder
+	sb.WriteString(header(title, 1))
+	for _, o := range owners {
+		fmt.Fprintf(&sb, "%s\tCNAME\t%s\n", o, cname[e[o]])
+	}
+	return sb.String()
+}
+
+// ownerLess sorts names by their labels from the right (example,
+// ads.example, *.ads.example, cdn.ads.example), so related rules are next
+// to each other.
+func ownerLess(a, b string) bool {
+	ka, kb := reverseLabels(a), reverseLabels(b)
+	return ka < kb
+}
+
+func reverseLabels(n string) string {
+	labels := strings.Split(n, ".")
+	for i, j := 0, len(labels)-1; i < j; i, j = i+1, j-1 {
+		labels[i], labels[j] = labels[j], labels[i]
+	}
+	// A wildcard sorts right after the name it belongs to.
+	return strings.ReplaceAll(strings.Join(labels, "\x00"), "*", "\x01")
+}
+
+// MatchRules finds the rule entry named would apply to name (lowercase,
+// without the final dot) in a rules zone with entries e: the name itself,
+// or else the wildcard of its closest existing ancestor. ok is false when
+// no entry applies.
+func MatchRules(e map[string]string, name string) (owner, action string, ok bool) {
+	if act, found := e[name]; found {
+		return name, act, true
+	}
+	nodes := map[string]bool{}
+	for o := range e {
+		n := strings.TrimPrefix(o, "*.")
+		for {
+			nodes[n] = true
+			i := strings.IndexByte(n, '.')
+			if i < 0 {
+				break
+			}
+			n = n[i+1:]
+		}
+	}
+	if nodes[name] {
+		return "", "", false // the name exists without a rule of its own
+	}
+	for a := name; ; {
+		i := strings.IndexByte(a, '.')
+		if i < 0 {
+			return "", "", false
+		}
+		a = a[i+1:]
+		if nodes[a] {
+			if act, found := e["*."+a]; found {
+				return "*." + a, act, true
+			}
+			return "", "", false
+		}
+	}
+}
+
+// Compact drops entries another entry already covers (a name below a
+// name whose subdomains are blocked). That keeps the zone small, and it
+// matters for correctness: no name exists below a wildcard, so every
+// wildcard applies to all names below it.
+func Compact(l *List) {
+	for n := range l.Domains {
+		for a := n; ; {
+			i := strings.IndexByte(a, '.')
+			if i < 0 {
+				break
+			}
+			a = a[i+1:]
+			if l.Domains[a]&Below != 0 {
+				delete(l.Domains, n)
+				break
+			}
+		}
+	}
+}
+
+// FeedZone writes a list's policy zone to w and returns the number of
+// records and a hash of them (the serial isn't part of the hash, so it
+// tells whether the content changed). l must be compacted.
+func FeedZone(w io.Writer, title string, serial uint32, l *List) (records int, hash string, err error) {
+	names := make([]string, 0, len(l.Domains))
+	for n := range l.Domains {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	bw := bufio.NewWriterSize(w, 256*1024)
+	h := sha256.New()
+	if _, err := bw.WriteString(header(title, serial)); err != nil {
+		return 0, "", err
+	}
+	write := func(owner string) error {
+		line := owner + "\tCNAME\t.\n"
+		h.Write([]byte(line))
+		records++
+		_, err := bw.WriteString(line)
+		return err
+	}
+	for _, n := range names {
+		f := l.Domains[n]
+		if f&Exact != 0 {
+			if err := write(n); err != nil {
+				return 0, "", err
+			}
+		}
+		if f&Below != 0 {
+			if err := write("*." + n); err != nil {
+				return 0, "", err
+			}
+		}
+	}
+	if err := bw.Flush(); err != nil {
+		return 0, "", err
+	}
+	return records, hex.EncodeToString(h.Sum(nil)), nil
+}
+
+// MatchFeed reports which entry of a list's zone file blocks name: the
+// name itself, or a wildcard of one of its ancestors (the closest).
+// Lists are compacted, so no name exists below a wildcard and the
+// closest wildcard ancestor is the one named uses.
+func MatchFeed(path, name string) (owner string, ok bool, err error) {
+	want := map[string]int{name: 0}
+	depth := 1
+	for a := name; ; depth++ {
+		i := strings.IndexByte(a, '.')
+		if i < 0 {
+			break
+		}
+		a = a[i+1:]
+		want["*."+a] = depth
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		return "", false, err
+	}
+	defer f.Close()
+	best := -1
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		line := sc.Text()
+		o, _, found := strings.Cut(line, "\t")
+		if !found {
+			continue
+		}
+		if d, hit := want[o]; hit && (best < 0 || d < best) {
+			best, owner = d, o
+		}
+	}
+	return owner, best >= 0, sc.Err()
+}

internal/catalog/catalog.go

@@ -102,13 +102,25 @@ var managed = map[string]map[string]string{
 		"match-recursive-only": "the view's match-recursive-only field",
 		"key":                  "TSIG keys (define keys at the top level)",
 		"zone":                 "zones",
+		"dnssec-policy":        dnssecManaged,
+	},
+	ScopeOptions: {
+		"dnssec-policy": dnssecManaged,
 	},
 }
 
+// dnssecManaged: Jarl turns signing on and off per zone, so that it can
+// guard the steps (a zone mustn't go unsigned while the parent zone still
+// has a DS record for it). dnssec-policy statements that define custom
+// policies (at the top level) are still options.
+const dnssecManaged = "each zone's DNSSEC setting (jarl zone dnssec enable ZONE; see docs/dnssec.md)"
+
 var zoneManaged = map[string]string{
-	"type":    "the zone's type field",
-	"file":    "the zone's file (generated by Jarl)",
-	"in-view": "the zone's in-view field",
+	"type":          "the zone's type field",
+	"file":          "the zone's file (generated by Jarl)",
+	"in-view":       "the zone's in-view field",
+	"dnssec-policy": dnssecManaged,
+	"key-directory": "Jarl (signed zones keep their keys in Jarl's key directory, which its backups include)",
 }
 
 // synonyms are older spellings that named 9.20 still accepts.
@@ -415,3 +427,87 @@ func classify(name, grammar string) (string, []string) {
 	}
 	return KindRaw, nil
 }
+
+// listParam matches an optional parameter before a statement's list, such
+// as "[ port <integer> ]" in allow-transfer's grammar.
+var listParam = regexp.MustCompile(`\[ ([a-z0-9-]+) `)
+
+// WrapList adds the braces to a list value given without them, for
+// statements that end in a list ("allow-transfer [ port <integer> ] {
+// <address_match_element>; ... }"): "10.0.0.53" becomes "{ 10.0.0.53; }",
+// "port 5353 10.0.0.53; key xfer" becomes "port 5353 { 10.0.0.53; key
+// xfer; }". Elements are separated by ";", "," or new lines, or by spaces
+// when they are all addresses. Values with a brace, and values of other
+// statements, are returned as they are.
+func (st *Statement) WrapList(v string) string {
+	g, _, _ := strings.Cut(st.Grammar, "\n")
+	open := strings.Index(g, " {")
+	if strings.Contains(v, "{") || open < 0 || !strings.HasSuffix(g, "; ... };") {
+		return v
+	}
+	params := map[string]bool{}
+	for _, m := range listParam.FindAllStringSubmatch(g[:open], -1) {
+		params[m[1]] = true
+	}
+	fields := strings.Fields(v)
+	i := 0
+	for i+1 < len(fields) && params[strings.ToLower(fields[i])] {
+		i += 2
+	}
+	head := strings.Join(fields[:i], " ")
+	rest := strings.Join(fields[i:], " ")
+	var elems []string
+	if !strings.ContainsAny(rest, ";,\n") {
+		elems = spaceElements(fields[i:])
+	} else {
+		for _, e := range strings.FieldsFunc(rest, func(r rune) bool { return r == ';' || r == ',' || r == '\n' }) {
+			if e = strings.TrimSpace(e); e != "" {
+				elems = append(elems, e)
+			}
+		}
+	}
+	if len(elems) == 0 {
+		return v
+	}
+	list := "{ " + strings.Join(elems, "; ") + "; }"
+	if head != "" {
+		return head + " " + list
+	}
+	return list
+}
+
+// spaceElements splits list elements separated by spaces: "key NAME"
+// is one element, and "port N" and "tls NAME" belong to the address
+// before them (forwarders { 192.0.2.1 port 53; }).
+func spaceElements(fields []string) []string {
+	var out []string
+	for i := 0; i < len(fields); i++ {
+		f := fields[i]
+		switch strings.ToLower(f) {
+		case "key", "!key", "!":
+			if i+1 < len(fields) {
+				f += " " + fields[i+1]
+				i++
+			}
+			if f[0] == '!' && strings.HasPrefix(strings.ToLower(f), "! key") && i+1 < len(fields) {
+				f += " " + fields[i+1]
+				i++
+			}
+		case "-":
+			// A range with spaces around the dash: 10.0.0.1 - 10.0.0.9.
+			if len(out) > 0 && i+1 < len(fields) {
+				out[len(out)-1] += " - " + fields[i+1]
+				i++
+				continue
+			}
+		case "port", "tls":
+			if len(out) > 0 && i+1 < len(fields) {
+				out[len(out)-1] += " " + f + " " + fields[i+1]
+				i++
+				continue
+			}
+		}
+		out = append(out, f)
+	}
+	return out
+}

internal/catalog/catalog_test.go

@@ -77,3 +77,28 @@ func TestCatalog(t *testing.T) {
 		t.Errorf("zone types = %s", types)
 	}
 }
+
+func TestWrapList(t *testing.T) {
+	c := Default()
+	for _, tc := range []struct{ scope, name, in, want string }{
+		{ScopeOptions, "allow-transfer", "10.0.10.53", "{ 10.0.10.53; }"},
+		{ScopeOptions, "allow-transfer", "localhost 10.0.10.53 key xfer ! key old !10.0.0.1", "{ localhost; 10.0.10.53; key xfer; ! key old; !10.0.0.1; }"},
+		{ScopeOptions, "forwarders", "1.1.1.1 port 853 tls cf 9.9.9.9", "{ 1.1.1.1 port 853 tls cf; 9.9.9.9; }"},
+		{ScopeOptions, "allow-transfer", "localhost; 10.0.10.53", "{ localhost; 10.0.10.53; }"},
+		{ScopeOptions, "allow-transfer", "port 5353 key xfer, !10.0.0.1", "port 5353 { key xfer; !10.0.0.1; }"},
+		{ScopeOptions, "allow-transfer", "{ any; }", "{ any; }"},
+		{ScopeOptions, "allow-query", "10.0.0.0/8 192.168.1.0/24", "{ 10.0.0.0/8; 192.168.1.0/24; }"},
+		{ScopeOptions, "forwarders", "1.1.1.1 9.9.9.9", "{ 1.1.1.1; 9.9.9.9; }"},
+		{ScopeOptions, "listen-on", "port 53 10.0.10.5", "port 53 { 10.0.10.5; }"},
+		{ScopeOptions, "recursion", "yes", "yes"},
+		{ScopeOptions, "directory", `"/var/cache/bind"`, `"/var/cache/bind"`},
+	} {
+		st, ok := c.Lookup(tc.scope, tc.name)
+		if !ok {
+			t.Fatalf("%s not found", tc.name)
+		}
+		if got := st.WrapList(tc.in); got != tc.want {
+			t.Errorf("%s %q = %q, want %q", tc.name, tc.in, got, tc.want)
+		}
+	}
+}

internal/certs/acme.go

@@ -0,0 +1,406 @@
+package certs
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"regexp"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/go-acme/lego/v4/certcrypto"
+	"github.com/go-acme/lego/v4/certificate"
+	"github.com/go-acme/lego/v4/challenge/dns01"
+	"github.com/go-acme/lego/v4/lego"
+	"github.com/go-acme/lego/v4/registration"
+
+	"jarl/internal/acme"
+	"jarl/internal/auth"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+)
+
+// Account is the ACME account certificates are obtained with. Its key is
+// kept in Jarl's database (and so in backups), like TSIG secrets.
+type Account struct {
+	Directory    string    `json:"directory"`
+	Email        string    `json:"email,omitempty"`
+	URI          string    `json:"uri,omitempty"` // the account at the CA
+	RegisteredAt time.Time `json:"registered_at"`
+	KeyPEM       string    `json:"key_pem,omitempty"`
+}
+
+const metaAccount = "acme.account"
+
+// account returns the stored account (nil when there is none).
+func (m *Manager) account(ctx context.Context) *Account {
+	raw, err := m.store.GetMeta(ctx, metaAccount)
+	if err != nil {
+		return nil
+	}
+	var a Account
+	if json.Unmarshal([]byte(raw), &a) != nil {
+		return nil
+	}
+	return &a
+}
+
+type legoUser struct {
+	email string
+	reg   *registration.Resource
+	key   crypto.PrivateKey
+}
+
+func (u *legoUser) GetEmail() string                        { return u.email }
+func (u *legoUser) GetRegistration() *registration.Resource { return u.reg }
+func (u *legoUser) GetPrivateKey() crypto.PrivateKey        { return u.key }
+
+// ErrTermsNotAgreed means acme.account.agree_tos isn't set.
+var ErrTermsNotAgreed = errors.New("acme.account.agree_tos isn't set")
+
+func (m *Manager) httpClient() (*http.Client, error) {
+	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS12}
+	if m.cfg.CABundle != "" {
+		pem, err := os.ReadFile(m.cfg.CABundle)
+		if err != nil {
+			return nil, fmt.Errorf("acme.ca_bundle: %w", err)
+		}
+		pool, err := x509.SystemCertPool()
+		if err != nil || pool == nil {
+			pool = x509.NewCertPool()
+		}
+		if !pool.AppendCertsFromPEM(pem) {
+			return nil, fmt.Errorf("acme.ca_bundle: no certificates in %s", m.cfg.CABundle)
+		}
+		tr.TLSClientConfig.RootCAs = pool
+	}
+	return &http.Client{Timeout: 2 * time.Minute, Transport: tr}, nil
+}
+
+// client returns a lego client for the account (registering it when
+// needed) that makes keys of keyType.
+func (m *Manager) client(ctx context.Context, keyType string) (*lego.Client, error) {
+	dir := m.cfg.Directory
+	hc, err := m.httpClient()
+	if err != nil {
+		return nil, err
+	}
+	a := m.account(ctx)
+	user := &legoUser{email: m.cfg.Email}
+	if a != nil && a.Directory == dir && a.KeyPEM != "" {
+		if user.key, err = parseKey(a.KeyPEM); err != nil {
+			return nil, fmt.Errorf("the stored ACME account key: %w", err)
+		}
+		if a.URI != "" {
+			user.reg = &registration.Resource{URI: a.URI}
+		}
+	} else {
+		k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		if err != nil {
+			return nil, err
+		}
+		user.key = k
+	}
+	cfg := lego.NewConfig(user)
+	cfg.CADirURL, cfg.HTTPClient, cfg.UserAgent = dir, hc, "jarl/"+m.cfg.Version
+	cfg.Certificate.KeyType = legoKeyType(keyType)
+	cfg.Certificate.Timeout = 90 * time.Second
+	c, err := lego.NewClient(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("ACME server %s: %w", dir, err)
+	}
+	if user.reg != nil && (a.Email == m.cfg.Email) {
+		return c, nil
+	}
+	if user.reg != nil {
+		// Only the email changed: update the account.
+		if reg, err := c.Registration.UpdateRegistration(registration.RegisterOptions{TermsOfServiceAgreed: true}); err == nil {
+			user.reg = reg
+			return c, m.saveAccount(ctx, user, dir)
+		}
+	}
+	if !m.cfg.AgreeTOS {
+		tos := c.GetToSURL()
+		if tos == "" {
+			tos = "on the CA's website"
+		}
+		return nil, fmt.Errorf("%w: Jarl registers an account with %s only after you accept its terms of service (%s): set acme.account.agree_tos: true in jarl.yaml and restart jarld", ErrTermsNotAgreed, dir, tos)
+	}
+	var reg *registration.Resource
+	if m.cfg.EABKeyID != "" {
+		reg, err = c.Registration.RegisterWithExternalAccountBinding(registration.RegisterEABOptions{TermsOfServiceAgreed: true, Kid: m.cfg.EABKeyID, HmacEncoded: m.cfg.EABHMAC})
+	} else {
+		if c.GetExternalAccountRequired() {
+			return nil, fmt.Errorf("%s needs External Account Binding: set acme.account.eab_kid and eab_hmac in jarl.yaml (from the CA's dashboard)", dir)
+		}
+		reg, err = c.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
+	}
+	if err != nil {
+		return nil, fmt.Errorf("registering the ACME account: %w", err)
+	}
+	user.reg = reg
+	m.log.Info("ACME account registered", "directory", dir, "account", reg.URI)
+	return c, m.saveAccount(ctx, user, dir)
+}
+
+func (m *Manager) saveAccount(ctx context.Context, u *legoUser, dir string) error {
+	der, err := x509.MarshalPKCS8PrivateKey(u.key)
+	if err != nil {
+		return err
+	}
+	a := Account{Directory: dir, Email: u.email, URI: u.reg.URI, RegisteredAt: time.Now().UTC(),
+		KeyPEM: string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der}))}
+	b, _ := json.Marshal(a)
+	return m.store.SetMeta(ctx, metaAccount, string(b))
+}
+
+func parseKey(s string) (crypto.PrivateKey, error) {
+	b, _ := pem.Decode([]byte(s))
+	if b == nil {
+		return nil, errors.New("not PEM")
+	}
+	return x509.ParsePKCS8PrivateKey(b.Bytes)
+}
+
+func legoKeyType(t string) certcrypto.KeyType {
+	switch t {
+	case "ec384":
+		return certcrypto.EC384
+	case "rsa2048":
+		return certcrypto.RSA2048
+	case "rsa3072":
+		return certcrypto.RSA3072
+	case "rsa4096":
+		return certcrypto.RSA4096
+	}
+	return certcrypto.EC256
+}
+
+// KeyTypes are the key types a certificate Jarl obtains can have.
+var KeyTypes = []string{"ec256", "ec384", "rsa2048", "rsa3072", "rsa4096"}
+
+// provider answers DNS-01 challenges for one issue: in a zone Jarl serves,
+// or at Porkbun, as route decides for each name.
+type provider struct {
+	m        *Manager
+	ctx      context.Context
+	cert     *model.Certificate
+	mu       sync.Mutex
+	cleanups map[string]func() error
+	routes   []Route
+}
+
+func (p *provider) Present(domain, token, keyAuth string) error {
+	info := dns01.GetChallengeInfo(domain, keyAuth)
+	st, err := p.m.store.LoadState(p.ctx)
+	if err != nil {
+		return err
+	}
+	r := p.m.route(p.ctx, st, p.cert.Challenge, domain, info.EffectiveFQDN)
+	p.mu.Lock()
+	p.routes = append(p.routes, r)
+	p.mu.Unlock()
+	if r.Error != "" {
+		return errors.New(r.Error)
+	}
+	key := info.EffectiveFQDN + " " + info.Value
+	var cleanup func() error
+	switch r.Route {
+	case model.ChallengeJarl:
+		if err := p.m.publish(p.ctx, p.cert, info.EffectiveFQDN, info.Value, true); err != nil {
+			return err
+		}
+		cleanup = func() error {
+			return p.m.publish(context.WithoutCancel(p.ctx), p.cert, info.EffectiveFQDN, info.Value, false)
+		}
+	case model.ChallengePorkbun:
+		zone := strings.TrimSuffix(r.Zone, ".")
+		id, err := p.m.cfg.Porkbun.CreateTXT(p.ctx, zone, strings.TrimSuffix(info.EffectiveFQDN, "."), info.Value)
+		if err != nil {
+			return fmt.Errorf("publishing the challenge for %s at Porkbun: %w", domain, err)
+		}
+		cleanup = func() error { return p.m.cfg.Porkbun.DeleteRecord(context.WithoutCancel(p.ctx), zone, id) }
+	}
+	p.mu.Lock()
+	p.cleanups[key] = cleanup
+	p.mu.Unlock()
+	return nil
+}
+
+func (p *provider) CleanUp(domain, token, keyAuth string) error {
+	info := dns01.GetChallengeInfo(domain, keyAuth)
+	key := info.EffectiveFQDN + " " + info.Value
+	p.mu.Lock()
+	f := p.cleanups[key]
+	delete(p.cleanups, key)
+	p.mu.Unlock()
+	if f == nil {
+		return nil
+	}
+	if err := f(); err != nil {
+		p.m.log.Warn("removing an ACME challenge record failed", "certificate", p.cert.Name, "record", info.EffectiveFQDN, "err", err)
+		return err
+	}
+	return nil
+}
+
+// Timeout is how long lego waits for the record to reach every name
+// server of the zone: Porkbun's take a few minutes.
+func (p *provider) Timeout() (timeout, interval time.Duration) {
+	if p.m.cfg.PropagationTimeout > 0 {
+		return p.m.cfg.PropagationTimeout, 2 * time.Second
+	}
+	return 10 * time.Minute, 10 * time.Second
+}
+
+// publish writes (or removes) a challenge TXT record in the Jarl zone that
+// holds name, in every view that has it, and returns once named serves it.
+func (m *Manager) publish(ctx context.Context, c *model.Certificate, name, value string, set bool) error {
+	st, err := m.store.LoadState(ctx)
+	if err != nil {
+		return err
+	}
+	zones := acme.Zones(name, primaryZones(st), "")
+	if len(zones) == 0 {
+		return fmt.Errorf("no primary zone in Jarl contains %s", strings.TrimSuffix(name, "."))
+	}
+	var reqs []engine.Request
+	for _, r := range acme.Requests(name, zones, []string{value}, set, acme.DefaultTTL) {
+		reqs = append(reqs, engine.Request{Op: r.Op, ID: r.ID, BaseVersion: r.BaseVersion, Data: r.Data})
+	}
+	desc := acme.Description(name, set) + " (certificate " + c.Name + ")"
+	if _, err := m.eng.Submit(ctx, reqs, auth.System, "acme", desc, engine.ApplyOptions{}); err != nil {
+		return fmt.Errorf("writing the challenge record %s: %w", strings.TrimSuffix(name, "."), err)
+	}
+	return nil
+}
+
+// obtain gets a new certificate for c from the CA. old is the certificate
+// it replaces (nil for the first), so the CA can link them (ARI).
+func (m *Manager) obtain(ctx context.Context, c *model.Certificate, old *x509.Certificate) (*certificate.Resource, []Route, error) {
+	m.legoMu.Lock()
+	defer m.legoMu.Unlock()
+	client, err := m.client(ctx, c.KeyType)
+	if err != nil {
+		return nil, nil, err
+	}
+	p := &provider{m: m, ctx: ctx, cert: c, cleanups: map[string]func() error{}}
+	opts := []dns01.ChallengeOption{dns01.AddRecursiveNameservers(m.cfg.Resolvers), dns01.AddDNSTimeout(10 * time.Second)}
+	if m.cfg.SkipPropagationCheck {
+		opts = append(opts, dns01.DisableAuthoritativeNssPropagationRequirement())
+	}
+	if err := client.Challenge.SetDNS01Provider(p, opts...); err != nil {
+		return nil, nil, err
+	}
+	req := certificate.ObtainRequest{Domains: c.Domains, Bundle: true}
+	if old != nil {
+		if id, err := certificate.MakeARICertID(old); err == nil {
+			req.ReplacesCertID = id
+		}
+	}
+	res, err := client.Certificate.Obtain(req)
+	if err != nil && req.ReplacesCertID != "" && len(p.routes) == 0 && ctx.Err() == nil {
+		// The CA refused the order itself, before any challenge: it may
+		// not link the new certificate to the old one (another CA, one
+		// already replaced, or its own bug). Ask for a plain new one.
+		m.log.Info("the CA refused to link the renewal to the old certificate; asking for a new one", "certificate", c.Name, "err", cleanLegoError(err))
+		req.ReplacesCertID = ""
+		res, err = client.Certificate.Obtain(req)
+	}
+	if err != nil {
+		return nil, p.routes, cleanLegoError(err)
+	}
+	return res, p.routes, nil
+}
+
+// renewalInfo asks the CA when to renew (ARI, RFC 9773). nil, nil when
+// it doesn't say.
+func (m *Manager) renewalInfo(ctx context.Context, c *model.Certificate, leaf *x509.Certificate) (*time.Time, error) {
+	m.legoMu.Lock()
+	defer m.legoMu.Unlock()
+	client, err := m.client(ctx, c.KeyType)
+	if err != nil {
+		return nil, err
+	}
+	ri, err := client.Certificate.GetRenewalInfo(certificate.RenewalInfoRequest{Cert: leaf})
+	if err != nil {
+		if strings.Contains(err.Error(), "does not advertise a renewal info endpoint") {
+			return nil, nil
+		}
+		return nil, err
+	}
+	// A time within the CA's window (now if it has started); never later
+	// than two thirds into the lifetime, in case the window is odd.
+	at := ri.ShouldRenewAt(time.Now(), 10*365*24*time.Hour)
+	if at == nil {
+		return nil, nil
+	}
+	t := at.UTC().Truncate(time.Second)
+	if limit := twoThirds(leaf.NotBefore, leaf.NotAfter); t.After(limit) {
+		t = limit
+	}
+	return &t, nil
+}
+
+func twoThirds(nb, na time.Time) time.Time {
+	return nb.Add(na.Sub(nb) * 2 / 3).UTC().Truncate(time.Second)
+}
+
+// cleanLegoError shortens lego's errors, which wrap each name's problem in
+// several prefixes and the whole ACME problem document:
+//
+//	error: one or more domains had a problem:
+//	[a.example.com] [a.example.com] acme: error presenting token: MSG
+//	[b.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: MSG
+//
+// becomes "a.example.com: MSG; b.example.com: the CA refused (unauthorized): MSG".
+func cleanLegoError(err error) error {
+	msg := strings.TrimSpace(strings.Replace(err.Error(), "error: one or more domains had a problem:", "", 1))
+	var out []string
+	for _, line := range strings.Split(msg, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		domain := ""
+		for strings.HasPrefix(line, "[") {
+			end := strings.Index(line, "] ")
+			if end < 0 {
+				break
+			}
+			if domain == "" {
+				domain = line[1:end]
+			}
+			line = line[end+2:]
+		}
+		for _, p := range []string{"acme: error presenting token: ", "acme: error: ", "acme: "} {
+			line = strings.TrimPrefix(line, p)
+		}
+		if m := acmeProblemRe.FindStringSubmatch(line); m != nil {
+			line = "the CA refused (" + m[2] + "): " + m[3]
+		}
+		if domain != "" {
+			line = domain + ": " + line
+		}
+		out = append(out, line)
+	}
+	if len(out) == 0 {
+		return err
+	}
+	return errors.New(strings.Join(out, "; "))
+}
+
+// acmeProblemRe matches "403 :: urn:ietf:params:acme:error:unauthorized :: detail".
+var acmeProblemRe = regexp.MustCompile(`^(\d+) :: urn:ietf:params:acme:error:(\w+) :: (.*)$`)

internal/certs/certs_test.go

@@ -0,0 +1,490 @@
+package certs
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"errors"
+	"io"
+	"log/slog"
+	"math/big"
+	"net"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/go-acme/lego/v4/challenge/dns01"
+	"github.com/miekg/dns"
+
+	"jarl/internal/auth"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+	"jarl/internal/porkbun"
+	"jarl/internal/render"
+	"jarl/internal/store"
+)
+
+// fakeDNS answers like the internet would: zones with their public name
+// servers, CNAME records, and TXT records (Porkbun's, from the fake API).
+type fakeDNS struct {
+	mu     sync.Mutex
+	zones  map[string][]string // zone -> NS
+	cnames map[string]string
+	txt    func(name string) []string
+	addr   string
+}
+
+func newFakeDNS(t *testing.T) *fakeDNS {
+	f := &fakeDNS{zones: map[string][]string{}, cnames: map[string]string{}, txt: func(string) []string { return nil }}
+	pc, err := net.ListenPacket("udp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := &dns.Server{PacketConn: pc, Handler: f}
+	go srv.ActivateAndServe()
+	t.Cleanup(func() { srv.Shutdown() })
+	f.addr = pc.LocalAddr().String()
+	return f
+}
+
+func (f *fakeDNS) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	m := new(dns.Msg)
+	m.SetReply(r)
+	q := r.Question[0]
+	name := strings.ToLower(q.Name)
+	zone := ""
+	for z := range f.zones {
+		if dns.IsSubDomain(z, name) && len(z) > len(zone) {
+			zone = z
+		}
+	}
+	if zone == "" {
+		m.Rcode = dns.RcodeNameError
+		w.WriteMsg(m)
+		return
+	}
+	soa := &dns.SOA{Hdr: dns.RR_Header{Name: zone, Rrtype: dns.TypeSOA, Class: dns.ClassINET, Ttl: 60}, Ns: f.zones[zone][0], Mbox: "h." + zone, Serial: 1, Refresh: 1, Retry: 1, Expire: 1, Minttl: 60}
+	switch {
+	case q.Qtype == dns.TypeSOA && name == zone:
+		m.Answer = append(m.Answer, soa)
+	case q.Qtype == dns.TypeNS && name == zone:
+		for _, ns := range f.zones[zone] {
+			m.Answer = append(m.Answer, &dns.NS{Hdr: dns.RR_Header{Name: zone, Rrtype: dns.TypeNS, Class: dns.ClassINET, Ttl: 60}, Ns: ns})
+		}
+	case f.cnames[name] != "":
+		m.Answer = append(m.Answer, &dns.CNAME{Hdr: dns.RR_Header{Name: name, Rrtype: dns.TypeCNAME, Class: dns.ClassINET, Ttl: 60}, Target: f.cnames[name]})
+	case q.Qtype == dns.TypeTXT && len(f.txt(name)) > 0:
+		for _, v := range f.txt(name) {
+			m.Answer = append(m.Answer, &dns.TXT{Hdr: dns.RR_Header{Name: name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 60}, Txt: []string{v}})
+		}
+	default:
+		m.Ns = append(m.Ns, soa)
+	}
+	w.WriteMsg(m)
+}
+
+type env struct {
+	t   *testing.T
+	m   *Manager
+	st  *store.Store
+	eng *engine.Engine
+	dns *fakeDNS
+	pb  *porkbun.Fake
+	dir string
+}
+
+// newEnv sets up Jarl with zone example.com (name server
+// ns1.example.com, which the internet also uses), a fake internet and a
+// fake Porkbun account with pb.test.
+func newEnv(t *testing.T, withPorkbun bool) *env {
+	dir := t.TempDir()
+	st, err := store.Open(filepath.Join(dir, "jarl.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	quiet := slog.New(slog.NewTextHandler(io.Discard, nil))
+	eng := engine.New(st, nil, engine.Config{
+		Paths:      render.Paths{ConfigDir: filepath.Join(dir, "etc"), ZoneDir: filepath.Join(dir, "zones"), CacheDir: filepath.Join(dir, "cache")},
+		StagingDir: filepath.Join(dir, "staging"), NoReload: true, SkipCheck: true,
+	}, quiet)
+	e := &env{t: t, st: st, eng: eng, dns: newFakeDNS(t), dir: dir}
+	e.submit(engine.NewRequest(engine.OpSettingsUpdate, 0, engine.SettingsInput{Nameservers: &[]string{"ns1.example.net."}}),
+		engine.NewRequest(engine.OpZoneCreate, 0, engine.ZoneInput{Name: model.Ptr("example.com")}))
+	e.dns.mu.Lock()
+	e.dns.zones["example.com."] = []string{"ns1.example.net."}
+	e.dns.zones["pb.test."] = []string{"curitiba.ns.porkbun.com.", "fortaleza.ns.porkbun.com."}
+	e.dns.zones["other.test."] = []string{"a.ns.cloudflare.com."}
+	e.dns.mu.Unlock()
+	cfg := Config{Resolvers: []string{e.dns.addr}, Dir: filepath.Join(dir, "tls"), Directory: "https://acme.invalid/dir"}
+	if withPorkbun {
+		e.pb = porkbun.NewFake("pk1_test", "sk1_test", "pb.test")
+		ts := httptest.NewServer(e.pb)
+		t.Cleanup(ts.Close)
+		cfg.Porkbun = &porkbun.Client{BaseURL: ts.URL + "/api/json/v3", APIKey: "pk1_test", Secret: "sk1_test"}
+		e.dns.mu.Lock()
+		e.dns.txt = func(name string) []string { return e.pb.TXT(name) }
+		e.dns.mu.Unlock()
+	}
+	e.m = New(cfg, st, eng, quiet)
+	// lego's own lookups (CNAME following) use the fake internet too.
+	dns01.AddRecursiveNameservers([]string{e.dns.addr})(nil)
+	return e
+}
+
+func (e *env) submit(reqs ...engine.Request) {
+	e.t.Helper()
+	if _, err := e.eng.Submit(context.Background(), reqs, auth.System, "test", "", engine.ApplyOptions{}); err != nil {
+		e.t.Fatal(err)
+	}
+}
+
+func (e *env) state() *model.State {
+	st, err := e.st.LoadState(context.Background())
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	return st
+}
+
+func TestRoute(t *testing.T) {
+	e := newEnv(t, true)
+	ctx := context.Background()
+	e.dns.mu.Lock()
+	e.dns.cnames["_acme-challenge.www.other.test."] = "www-other.acme.example.com."
+	e.dns.mu.Unlock()
+	cases := []struct {
+		challenge, domain string
+		route             string // "" for an error
+		target            string
+		errHas            string
+	}{
+		{"auto", "www.example.com", "jarl", "_acme-challenge.www.example.com.", ""},
+		{"auto", "*.example.com", "jarl", "_acme-challenge.example.com.", ""},
+		{"auto", "ns1.pb.test", "porkbun", "_acme-challenge.ns1.pb.test.", ""},
+		{"auto", "www.other.test", "jarl", "www-other.acme.example.com.", ""},
+		{"auto", "mail.other.test", "", "", "Point _acme-challenge.mail.other.test with a CNAME"},
+		{"porkbun", "www.example.com", "", "", "not Porkbun"},
+		{"jarl", "ns1.pb.test", "", "", "no primary zone in Jarl is pb.test"},
+		{"jarl", "www.example.com", "jarl", "_acme-challenge.www.example.com.", ""},
+	}
+	for _, c := range cases {
+		r := e.m.route(ctx, e.state(), c.challenge, c.domain, "")
+		if r.Route != c.route || c.target != "" && r.Target != c.target || c.errHas != "" && !strings.Contains(r.Error, c.errHas) {
+			t.Errorf("%s %s: route %q target %q error %q", c.challenge, c.domain, r.Route, r.Target, r.Error)
+		}
+	}
+
+	// The move from Porkbun to Jarl: while the internet still asks
+	// Porkbun, auto goes there even though Jarl has the zone; once the
+	// name servers change, it comes to Jarl.
+	e.submit(engine.NewRequest(engine.OpZoneCreate, 0, engine.ZoneInput{Name: model.Ptr("pb.test")}))
+	if r := e.m.route(ctx, e.state(), "auto", "ns1.pb.test", ""); r.Route != "porkbun" {
+		t.Errorf("before the move: %+v", r)
+	}
+	if r := e.m.route(ctx, e.state(), "jarl", "ns1.pb.test", ""); !strings.Contains(r.Error, "not by the name servers in Jarl's zone (ns1.example.net)") {
+		t.Errorf("jarl before the move: %+v", r)
+	}
+	e.dns.mu.Lock()
+	e.dns.zones["pb.test."] = []string{"ns1.example.net."}
+	e.dns.mu.Unlock()
+	if r := e.m.route(ctx, e.state(), "auto", "ns1.pb.test", ""); r.Route != "jarl" {
+		t.Errorf("after the move: %+v", r)
+	}
+	if r := e.m.route(ctx, e.state(), "porkbun", "ns1.pb.test", ""); !strings.Contains(r.Error, "not Porkbun") {
+		t.Errorf("porkbun after the move: %+v", r)
+	}
+
+	// Without a Porkbun key, a Porkbun domain says what is missing.
+	e2 := newEnv(t, false)
+	if r := e2.m.route(ctx, e2.state(), "auto", "ns1.pb.test", ""); !strings.Contains(r.Error, "no porkbun.api_key") {
+		t.Errorf("without a key: %+v", r)
+	}
+}
+
+func TestProvider(t *testing.T) {
+	e := newEnv(t, true)
+	ctx := context.Background()
+	c := &model.Certificate{Name: "t", Challenge: "auto"}
+	p := &provider{m: e.m, ctx: ctx, cert: c, cleanups: map[string]func() error{}}
+
+	// Porkbun: the record goes in through the API and is removed again.
+	info := dns01.GetChallengeInfo("ns1.pb.test", "key-auth-1")
+	if err := p.Present("ns1.pb.test", "tok", "key-auth-1"); err != nil {
+		t.Fatal(err)
+	}
+	if got := e.pb.TXT("_acme-challenge.ns1.pb.test"); len(got) != 1 || got[0] != info.Value {
+		t.Fatalf("Porkbun TXT = %v, want %s", got, info.Value)
+	}
+	if err := p.CleanUp("ns1.pb.test", "tok", "key-auth-1"); err != nil {
+		t.Fatal(err)
+	}
+	if got := e.pb.TXT("_acme-challenge.ns1.pb.test"); len(got) != 0 {
+		t.Fatalf("Porkbun TXT after cleanup = %v", got)
+	}
+
+	// Jarl: the record goes into the zone, in a changeset by the system.
+	txt := func() []string {
+		var out []string
+		st := e.state()
+		for _, r := range st.Records {
+			if r.Type == "TXT" && r.Name == "_acme-challenge.www.example.com." {
+				out = append(out, r.Data)
+			}
+		}
+		return out
+	}
+	info = dns01.GetChallengeInfo("www.example.com", "key-auth-2")
+	if err := p.Present("www.example.com", "tok", "key-auth-2"); err != nil {
+		t.Fatal(err)
+	}
+	if got := txt(); len(got) != 1 || !strings.Contains(got[0], info.Value) {
+		t.Fatalf("Jarl TXT = %v, want %s", got, info.Value)
+	}
+	if err := p.CleanUp("www.example.com", "tok", "key-auth-2"); err != nil {
+		t.Fatal(err)
+	}
+	if got := txt(); len(got) != 0 {
+		t.Fatalf("Jarl TXT after cleanup = %v", got)
+	}
+	if len(p.routes) != 2 || p.routes[0].Route != "porkbun" || p.routes[1].Route != "jarl" {
+		t.Errorf("routes = %+v", p.routes)
+	}
+
+	// A name nobody can answer for fails before anything is published.
+	if err := p.Present("mail.other.test", "tok", "k"); err == nil || !strings.Contains(err.Error(), "CNAME") {
+		t.Errorf("other.test: %v", err)
+	}
+}
+
+// makeCert returns a certificate for names (signed by a CA unless
+// selfSigned) and its key, as PEM; withCA appends the CA certificate.
+func makeCert(t *testing.T, names []string, notBefore, notAfter time.Time, withCA bool) (certPEM, keyPEM []byte) {
+	t.Helper()
+	caKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	ca := &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "Test CA", Organization: []string{"Jarl"}},
+		NotBefore: notBefore, NotAfter: notAfter.Add(time.Hour), IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign}
+	caDER, _ := x509.CreateCertificate(rand.Reader, ca, ca, &caKey.PublicKey, caKey)
+	caCert, _ := x509.ParseCertificate(caDER)
+	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	leaf := &x509.Certificate{SerialNumber: big.NewInt(time.Now().UnixNano()), Subject: pkix.Name{CommonName: names[0]}, DNSNames: names,
+		NotBefore: notBefore, NotAfter: notAfter, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}}
+	der, err := x509.CreateCertificate(rand.Reader, leaf, caCert, &key.PublicKey, caKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certPEM = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	if withCA {
+		certPEM = append(certPEM, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: caDER})...)
+	}
+	kd, _ := x509.MarshalPKCS8PrivateKey(key)
+	return certPEM, pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: kd})
+}
+
+func TestInspect(t *testing.T) {
+	now := time.Now()
+	cert, key := makeCert(t, []string{"ns1.example.com", "*.example.com"}, now, now.Add(90*24*time.Hour), true)
+	in, pair, err := Inspect(cert, key)
+	if err != nil || pair == nil {
+		t.Fatal(err)
+	}
+	if strings.Join(in.Names, " ") != "ns1.example.com *.example.com" || in.Issuer != "Jarl Test CA" || in.KeyType != "ec256" || len(in.Warnings) != 0 {
+		t.Errorf("info = %+v", in)
+	}
+	leafOnly, _ := makeCert(t, []string{"a.example.com"}, now, now.Add(time.Hour), false)
+	_, otherKey := makeCert(t, []string{"b.example.com"}, now, now.Add(time.Hour), false)
+	if _, _, err := Inspect(cert, otherKey); err == nil || !strings.Contains(err.Error(), "doesn't belong") {
+		t.Errorf("mismatched key: %v", err)
+	}
+	leafCert, leafKey := makeCert(t, []string{"a.example.com"}, now, now.Add(time.Hour), false)
+	if in, _, err := Inspect(leafCert, leafKey); err != nil || len(in.Warnings) != 1 || !strings.Contains(in.Warnings[0], "full chain") {
+		t.Errorf("leaf only: %+v %v", in, err)
+	}
+	_ = leafOnly
+	if !Covers([]string{"*.example.com"}, []string{"www.example.com"}) || Covers([]string{"*.example.com"}, []string{"a.b.example.com"}) || Covers([]string{"example.com"}, []string{"www.example.com"}) {
+		t.Error("Covers")
+	}
+}
+
+func TestDueAndStatus(t *testing.T) {
+	m := &Manager{now: time.Now}
+	now := time.Now().UTC().Truncate(time.Second)
+	nb, na := now.Add(-80*24*time.Hour), now.Add(10*24*time.Hour)
+	c := &model.Certificate{Source: model.CertSourceACME, CreatedAt: now.Add(-time.Hour)}
+	if got := m.Due(c); !got.Equal(c.CreatedAt) {
+		t.Errorf("never obtained: due %v", got)
+	}
+	if s := m.StatusOf(c); s.State != "pending" {
+		t.Errorf("pending: %+v", s)
+	}
+	c.CertPEM, c.NotBefore, c.NotAfter = "x", &nb, &na
+	if got, want := m.Due(c), twoThirds(nb, na); !got.Equal(want) {
+		t.Errorf("due %v, want two thirds %v", got, want)
+	}
+	ari := now.Add(time.Hour)
+	c.RenewAt = &ari
+	if got := m.Due(c); !got.Equal(ari) {
+		t.Errorf("due %v, want the CA's %v", got, ari)
+	}
+	// 10 days left of 90 is less than a sixth: expiring.
+	if s := m.StatusOf(c); s.State != "expiring" {
+		t.Errorf("status %+v", s)
+	}
+	// After three failures it waits four hours from the last attempt.
+	last := now.Add(-time.Hour)
+	c.Failures, c.LastAttempt, c.LastError = 3, &last, "boom"
+	if got := m.Due(c); !got.Equal(last.Add(4 * time.Hour)) {
+		t.Errorf("backoff: due %v", got)
+	}
+	if s := m.StatusOf(c); s.State != "failing" || !strings.Contains(s.Message, "boom") {
+		t.Errorf("failing: %+v", s)
+	}
+	c.Failures = 30
+	if got := m.Due(c); !got.Equal(last.Add(24 * time.Hour)) {
+		t.Errorf("backoff is at most a day: due %v", got)
+	}
+	old := now.Add(-time.Hour)
+	c.NotAfter = &old
+	if s := m.StatusOf(c); s.State != "expired" {
+		t.Errorf("expired: %+v", s)
+	}
+}
+
+func TestInput(t *testing.T) {
+	e := newEnv(t, false)
+	ctx := context.Background()
+	admin := &auth.Principal{User: &model.User{Username: "admin", Admin: true}}
+	bad := []Input{
+		{Name: model.Ptr("Bad Name"), Domains: &[]string{"a.example.com"}},
+		{Name: model.Ptr("x"), Domains: &[]string{"localhost"}},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.*.example.com"}},
+		{Name: model.Ptr("x"), Domains: &[]string{}},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.example.com"}, Uses: &[]string{"mail"}},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.example.com"}, Challenge: model.Ptr("http")},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.example.com"}, KeyType: model.Ptr("rsa1024")},
+		{Name: model.Ptr("x"), Source: model.Ptr("file"), CertFile: model.Ptr("rel.pem"), KeyFile: model.Ptr("/k.pem")},
+		{Name: model.Ptr("x"), Domains: &[]string{"a.example.com"}, CertFile: model.Ptr("/c.pem")},
+	}
+	for _, in := range bad {
+		if _, err := e.m.Create(ctx, in, admin); err == nil {
+			t.Errorf("accepted %+v", in)
+		}
+	}
+	c, err := e.m.Create(ctx, Input{Name: model.Ptr("web"), Domains: &[]string{"WWW.Example.com.", "www.example.com", "*.example.com"}, Uses: &[]string{"web", "dns", "web"}}, admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Join(c.Domains, " ") != "www.example.com *.example.com" || strings.Join(c.Uses, ",") != "dns,web" || c.Challenge != "auto" || c.KeyType != "ec256" {
+		t.Errorf("normalized: %+v", c)
+	}
+	// Only one certificate serves jarld's HTTPS.
+	if _, err := e.m.Create(ctx, Input{Name: model.Ptr("web2"), Domains: &[]string{"a.example.com"}, Uses: &[]string{"web"}}, admin); err == nil || !strings.Contains(err.Error(), "already used for jarld's HTTPS") {
+		t.Errorf("second web certificate: %v", err)
+	}
+	if _, err := e.m.Create(ctx, Input{Name: model.Ptr("web"), Domains: &[]string{"a.example.com"}}, admin); err != ErrConflict {
+		t.Errorf("duplicate name: %v", err)
+	}
+	if _, err := e.m.Update(ctx, "web", Input{Name: model.Ptr("renamed")}, admin); err == nil {
+		t.Error("rename accepted")
+	}
+}
+
+func TestFileSource(t *testing.T) {
+	e := newEnv(t, false)
+	ctx := context.Background()
+	admin := &auth.Principal{User: &model.User{Username: "admin", Admin: true}}
+	now := time.Now()
+	certFile, keyFile := filepath.Join(e.dir, "fullchain.pem"), filepath.Join(e.dir, "privkey.pem")
+	cert, key := makeCert(t, []string{"ns1.example.com"}, now.Add(-time.Hour), now.Add(60*24*time.Hour), true)
+	os.WriteFile(certFile, cert, 0o600)
+	os.WriteFile(keyFile, key, 0o600)
+
+	c, err := e.m.Create(ctx, Input{Name: model.Ptr("own"), Source: model.Ptr("file"), CertFile: &certFile, KeyFile: &keyFile, Uses: &[]string{"web", "dns"}}, admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, _ = e.m.Get(ctx, "own")
+	if strings.Join(c.Domains, " ") != "ns1.example.com" || c.NotAfter == nil || c.CertPEM != "" {
+		t.Errorf("read: %+v", c)
+	}
+	if e.m.WebCertificate() == nil || e.m.WebName() != "own" {
+		t.Error("not served for HTTPS")
+	}
+	chain := filepath.Join(e.m.FilesDir("own"), ChainFile)
+	if b, err := os.ReadFile(chain); err != nil || string(b) != string(cert) {
+		t.Fatalf("files for named: %v", err)
+	}
+	if fi, err := os.Stat(filepath.Join(e.m.FilesDir("own"), KeyFile)); err != nil || fi.Mode().Perm() != 0o640 {
+		t.Errorf("key file: %v %v", fi, err)
+	}
+
+	// Renewed by its owner: the loop notices and puts the new one in place.
+	cert2, key2 := makeCert(t, []string{"ns1.example.com", "dns.example.com"}, now, now.Add(90*24*time.Hour), true)
+	os.WriteFile(certFile, cert2, 0o600)
+	os.WriteFile(keyFile, key2, 0o600)
+	future := now.Add(time.Minute)
+	os.Chtimes(certFile, future, future)
+	e.m.Tick(ctx)
+	c, _ = e.m.Get(ctx, "own")
+	if strings.Join(c.Domains, " ") != "ns1.example.com dns.example.com" {
+		t.Errorf("not reread: %v", c.Domains)
+	}
+	if b, _ := os.ReadFile(chain); string(b) != string(cert2) {
+		t.Error("files for named not updated")
+	}
+	if got := e.m.WebCertificate(); got == nil || len(got.Leaf.DNSNames) != 2 {
+		t.Error("HTTPS still serves the old certificate")
+	}
+
+	// A broken renewal keeps the last good certificate in place.
+	os.WriteFile(keyFile, key, 0o600)
+	os.Chtimes(keyFile, future.Add(time.Minute), future.Add(time.Minute))
+	e.m.Tick(ctx)
+	c, _ = e.m.Get(ctx, "own")
+	if !strings.Contains(c.LastError, "doesn't belong") || e.m.StatusOf(c).State != "failing" {
+		t.Errorf("mismatch not reported: %+v", c)
+	}
+	if b, _ := os.ReadFile(chain); string(b) != string(cert2) {
+		t.Error("files for named replaced by a broken pair")
+	}
+
+	// Without the dns use the files go; deleting stops HTTPS.
+	if _, err := e.m.Update(ctx, "own", Input{Uses: &[]string{"web"}}, admin); err != nil {
+		// The pair is broken now; put the good key back first.
+		t.Log(err)
+	}
+	os.WriteFile(keyFile, key2, 0o600)
+	if _, err := e.m.Update(ctx, "own", Input{Uses: &[]string{"web"}}, admin); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(e.m.FilesDir("own")); !os.IsNotExist(err) {
+		t.Errorf("files for named left behind: %v", err)
+	}
+	if err := e.m.Delete(ctx, "own", admin); err != nil {
+		t.Fatal(err)
+	}
+	if e.m.WebCertificate() != nil {
+		t.Error("still serving a deleted certificate")
+	}
+}
+
+func TestCleanLegoError(t *testing.T) {
+	in := errors.New("error: one or more domains had a problem:\n[www.example.org] [www.example.org] acme: error presenting token: example.org is served by x, which Jarl can't write to\n[a.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Incorrect TXT record \"abc\" found at _acme-challenge.a.example.com\n")
+	want := `www.example.org: example.org is served by x, which Jarl can't write to; a.example.com: the CA refused (unauthorized): Incorrect TXT record "abc" found at _acme-challenge.a.example.com`
+	if got := cleanLegoError(in).Error(); got != want {
+		t.Errorf("got  %s\nwant %s", got, want)
+	}
+	if got := cleanLegoError(errors.New("acme: error: 429 :: urn:ietf:params:acme:error:rateLimited :: too many")).Error(); got != "the CA refused (rateLimited): too many" {
+		t.Errorf("rate limit: %s", got)
+	}
+}

internal/certs/inspect.go

@@ -0,0 +1,118 @@
+// Package certs manages TLS certificates (docs/certificates.md): ones Jarl
+// obtains and renews itself over ACME, answering the DNS-01 challenges in
+// its own zones or at Porkbun, and ones you renew yourself that Jarl only
+// reads. A certificate is used for jarld's HTTPS ("web") and/or written
+// where named can read it ("dns", for DNS over TLS and HTTPS).
+package certs
+
+import (
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+// Info is what a certificate says about itself.
+type Info struct {
+	Names     []string
+	NotBefore time.Time
+	NotAfter  time.Time
+	Issuer    string
+	Serial    string
+	KeyType   string // ec256, ec384, rsa2048, ...
+	Leaf      *x509.Certificate
+	// Warnings are problems that don't stop it working everywhere (a
+	// missing intermediate certificate).
+	Warnings []string
+}
+
+// Inspect checks that certPEM (the certificate, then its intermediates)
+// and keyPEM belong together and returns what the certificate says, and
+// the pair ready to serve.
+func Inspect(certPEM, keyPEM []byte) (*Info, *tls.Certificate, error) {
+	pair, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		msg := err.Error()
+		switch {
+		case strings.Contains(msg, "private key does not match public key"):
+			return nil, nil, errors.New("the key doesn't belong to the certificate")
+		case strings.Contains(msg, "failed to find any PEM data in certificate"):
+			return nil, nil, errors.New("no certificate found (expected PEM: -----BEGIN CERTIFICATE-----)")
+		case strings.Contains(msg, "failed to find any PEM data in key"), strings.Contains(msg, "failed to find PEM block with type ending in \"PRIVATE KEY\""):
+			return nil, nil, errors.New("no private key found (expected PEM: -----BEGIN ... PRIVATE KEY-----)")
+		}
+		return nil, nil, err
+	}
+	leaf := pair.Leaf
+	if leaf == nil {
+		if leaf, err = x509.ParseCertificate(pair.Certificate[0]); err != nil {
+			return nil, nil, err
+		}
+		pair.Leaf = leaf
+	}
+	in := &Info{NotBefore: leaf.NotBefore, NotAfter: leaf.NotAfter, Serial: fmt.Sprintf("%x", leaf.SerialNumber), Leaf: leaf, KeyType: keyType(leaf)}
+	in.Names = append(in.Names, leaf.DNSNames...)
+	for _, ip := range leaf.IPAddresses {
+		in.Names = append(in.Names, ip.String())
+	}
+	if len(in.Names) == 0 && leaf.Subject.CommonName != "" {
+		in.Names = []string{leaf.Subject.CommonName}
+	}
+	in.Issuer = leaf.Issuer.CommonName
+	if len(leaf.Issuer.Organization) > 0 {
+		if in.Issuer == "" {
+			in.Issuer = leaf.Issuer.Organization[0]
+		} else {
+			in.Issuer = leaf.Issuer.Organization[0] + " " + in.Issuer
+		}
+	}
+	selfSigned := leaf.Issuer.String() == leaf.Subject.String()
+	if len(pair.Certificate) == 1 && !selfSigned {
+		in.Warnings = append(in.Warnings, "the file holds only the certificate, without its intermediate certificate: many clients will reject it; use the full chain (fullchain.pem)")
+	}
+	return in, &pair, nil
+}
+
+func keyType(c *x509.Certificate) string {
+	switch k := c.PublicKey.(type) {
+	case *ecdsa.PublicKey:
+		return fmt.Sprintf("ec%d", k.Curve.Params().BitSize)
+	case *rsa.PublicKey:
+		return fmt.Sprintf("rsa%d", k.N.BitLen())
+	case ed25519.PublicKey:
+		return "ed25519"
+	}
+	return "unknown"
+}
+
+// Covers reports whether the certificate names cover every name in want
+// (a wildcard covers one label).
+func Covers(names, want []string) bool {
+	for _, w := range want {
+		if !covered(names, w) {
+			return false
+		}
+	}
+	return true
+}
+
+func covered(names []string, want string) bool {
+	want = strings.ToLower(strings.TrimSuffix(want, "."))
+	for _, n := range names {
+		n = strings.ToLower(n)
+		if n == want {
+			return true
+		}
+		if base, ok := strings.CutPrefix(n, "*."); ok && !strings.HasPrefix(want, "*.") {
+			if _, rest, ok := strings.Cut(want, "."); ok && rest == base {
+				return true
+			}
+		}
+	}
+	return false
+}

internal/certs/lookup.go

@@ -0,0 +1,128 @@
+package certs
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+// resolver asks recursive resolvers (acme.resolvers: public ones by
+// default), to see a domain as the CA does rather than as this server's
+// own views answer it.
+type resolver struct {
+	servers []string
+	timeout time.Duration
+}
+
+func (r resolver) query(ctx context.Context, name string, qtype uint16) (*dns.Msg, error) {
+	if len(r.servers) == 0 {
+		return nil, errors.New("no resolvers configured (acme.resolvers)")
+	}
+	m := new(dns.Msg)
+	m.SetQuestion(dns.Fqdn(name), qtype)
+	m.SetEdns0(1232, false)
+	m.RecursionDesired = true
+	timeout := r.timeout
+	if timeout == 0 {
+		timeout = 5 * time.Second
+	}
+	var errs []error
+	for _, s := range r.servers {
+		c := &dns.Client{Timeout: timeout}
+		in, _, err := c.ExchangeContext(ctx, m, s)
+		if err == nil && in.Truncated {
+			c.Net = "tcp"
+			in, _, err = c.ExchangeContext(ctx, m, s)
+		}
+		if err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", s, err))
+			continue
+		}
+		if in.Rcode == dns.RcodeServerFailure || in.Rcode == dns.RcodeRefused {
+			errs = append(errs, fmt.Errorf("%s answered %s", s, dns.RcodeToString[in.Rcode]))
+			continue
+		}
+		return in, nil
+	}
+	return nil, fmt.Errorf("looking up %s %s: %w", strings.TrimSuffix(name, "."), dns.TypeToString[qtype], errors.Join(errs...))
+}
+
+// zoneOf returns the zone that name is in on the internet (the owner of
+// the SOA record that answers for it).
+func (r resolver) zoneOf(ctx context.Context, name string) (string, error) {
+	name = dns.Fqdn(strings.ToLower(name))
+	for cand := name; ; {
+		in, err := r.query(ctx, cand, dns.TypeSOA)
+		if err != nil {
+			return "", err
+		}
+		for _, sec := range [][]dns.RR{in.Answer, in.Ns} {
+			for _, rr := range sec {
+				if soa, ok := rr.(*dns.SOA); ok && dns.IsSubDomain(soa.Hdr.Name, name) {
+					return strings.ToLower(soa.Hdr.Name), nil
+				}
+			}
+		}
+		i, end := dns.NextLabel(cand, 0)
+		if end {
+			return "", fmt.Errorf("no zone found for %s", strings.TrimSuffix(name, "."))
+		}
+		cand = cand[i:]
+	}
+}
+
+// nameServers returns the zone's name servers on the internet (lowercase,
+// without trailing dots, sorted).
+func (r resolver) nameServers(ctx context.Context, zone string) ([]string, error) {
+	in, err := r.query(ctx, zone, dns.TypeNS)
+	if err != nil {
+		return nil, err
+	}
+	var out []string
+	for _, rr := range in.Answer {
+		if ns, ok := rr.(*dns.NS); ok && strings.EqualFold(ns.Hdr.Name, dns.Fqdn(zone)) {
+			out = append(out, normName(ns.Ns))
+		}
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("%s has no name servers on the internet (%s)", strings.TrimSuffix(zone, "."), dns.RcodeToString[in.Rcode])
+	}
+	slices.Sort(out)
+	return slices.Compact(out), nil
+}
+
+// follow returns where name leads after its CNAME records (name itself
+// when it has none).
+func (r resolver) follow(ctx context.Context, name string) (string, error) {
+	name = dns.Fqdn(strings.ToLower(name))
+	for range 10 {
+		in, err := r.query(ctx, name, dns.TypeCNAME)
+		if err != nil {
+			return "", err
+		}
+		next := ""
+		for _, rr := range in.Answer {
+			if c, ok := rr.(*dns.CNAME); ok && strings.EqualFold(c.Hdr.Name, name) {
+				next = strings.ToLower(c.Target)
+			}
+		}
+		if next == "" {
+			return name, nil
+		}
+		name = next
+	}
+	return "", fmt.Errorf("%s: more than 10 CNAME records in a row", name)
+}
+
+func normName(n string) string { return strings.ToLower(strings.TrimSuffix(n, ".")) }
+
+// challengeName is the DNS-01 record name for a certificate name (a
+// wildcard shares its base name's).
+func challengeName(domain string) string {
+	return "_acme-challenge." + dns.Fqdn(strings.TrimPrefix(strings.ToLower(domain), "*."))
+}

internal/certs/manager.go

@@ -0,0 +1,923 @@
+package certs
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io/fs"
+	"log"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	legolog "github.com/go-acme/lego/v4/log"
+
+	"jarl/internal/auth"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+	"jarl/internal/porkbun"
+	"jarl/internal/store"
+)
+
+// Config configures the manager (acme and certificates in jarl.yaml).
+type Config struct {
+	Directory string // ACME directory URL
+	Email     string
+	AgreeTOS  bool
+	EABKeyID  string
+	EABHMAC   string
+	Resolvers []string
+	CABundle  string
+	// Dir is where certificates with the dns use are written for named.
+	Dir     string
+	Version string
+	// Porkbun publishes challenges for domains Porkbun serves (nil
+	// without an API key); PorkbunAllows limits it to porkbun.domains.
+	Porkbun       *porkbun.Client
+	PorkbunAllows func(domain string) bool
+	// CheckPropagation makes lego wait until every name server of the
+	// zone serves the challenge before telling the CA (acme.check_propagation).
+	CheckPropagation bool
+	// PropagationTimeout is how long to wait for that (default 10 minutes).
+	PropagationTimeout time.Duration
+	// SkipPropagationCheck is !CheckPropagation (set by New).
+	SkipPropagationCheck bool
+}
+
+// Manager keeps certificates current and serves jarld's own.
+type Manager struct {
+	cfg   Config
+	store *store.Store
+	eng   *engine.Engine
+	log   *slog.Logger
+	res   resolver
+
+	// legoMu: lego keeps its DNS settings in package variables, so one
+	// client works at a time. issueMu: one issue at a time.
+	legoMu  sync.Mutex
+	issueMu sync.Mutex
+
+	web   atomic.Pointer[webCert]
+	mu    sync.Mutex
+	files map[int64]fileStamp // file-source certificates: what was read last
+	kick  chan struct{}
+	now   func() time.Time
+	// issuing holds the names being obtained now, with when it started.
+	issuing sync.Map
+	// base is the context background issues run in (jarld's lifetime).
+	base context.Context
+}
+
+type webCert struct {
+	name string
+	pair *tls.Certificate
+}
+
+type fileStamp struct {
+	certMod, keyMod time.Time
+	certSize        int64
+}
+
+// New returns a manager. Call Start before serving, then Run.
+func New(cfg Config, st *store.Store, eng *engine.Engine, logger *slog.Logger) *Manager {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	cfg.SkipPropagationCheck = !cfg.CheckPropagation
+	m := &Manager{cfg: cfg, store: st, eng: eng, log: logger, res: resolver{servers: cfg.Resolvers},
+		files: map[int64]fileStamp{}, kick: make(chan struct{}, 1), now: time.Now, base: context.Background()}
+	// lego logs every step; keep it at debug level.
+	legolog.Logger = log.New(slogWriter{logger}, "", 0)
+	return m
+}
+
+type slogWriter struct{ l *slog.Logger }
+
+func (w slogWriter) Write(p []byte) (int, error) {
+	w.l.Debug("lego: " + strings.TrimSpace(string(p)))
+	return len(p), nil
+}
+
+// Errors for the API.
+var (
+	ErrNotFound = errors.New("no such certificate")
+	ErrConflict = errors.New("a certificate with that name exists")
+)
+
+// InputError is a request Jarl refuses.
+type InputError struct{ Msg string }
+
+func (e *InputError) Error() string { return e.Msg }
+
+func inputErr(format string, a ...any) error { return &InputError{Msg: fmt.Sprintf(format, a...)} }
+
+// Input creates or changes a certificate; nil fields are left alone.
+type Input struct {
+	Name      *string   `json:"name"`
+	Source    *string   `json:"source"`
+	Domains   *[]string `json:"domains"`
+	CertFile  *string   `json:"cert_file"`
+	KeyFile   *string   `json:"key_file"`
+	Uses      *[]string `json:"uses"`
+	Challenge *string   `json:"challenge"`
+	KeyType   *string   `json:"key_type"`
+	Comment   *string   `json:"comment"`
+}
+
+var nameRe = regexp.MustCompile(`^[a-z0-9][a-z0-9_-]{0,62}$`)
+var labelRe = regexp.MustCompile(`^[a-z0-9_]([a-z0-9_-]{0,61}[a-z0-9_])?$`)
+
+func normDomains(in []string) ([]string, error) {
+	var out []string
+	for _, d := range in {
+		d = strings.ToLower(strings.TrimSuffix(strings.TrimSpace(d), "."))
+		if d == "" {
+			continue
+		}
+		labels := strings.Split(d, ".")
+		if len(labels) < 2 {
+			return nil, inputErr("%q isn't a domain name a CA will sign (it needs at least two labels)", d)
+		}
+		for i, l := range labels {
+			if l == "*" && i == 0 {
+				continue
+			}
+			if !labelRe.MatchString(l) {
+				return nil, inputErr("%q isn't a valid domain name (a wildcard is only allowed as the first label: *.example.com)", d)
+			}
+		}
+		if len(d) > 253 {
+			return nil, inputErr("%q is too long", d)
+		}
+		if !slices.Contains(out, d) {
+			out = append(out, d)
+		}
+	}
+	if len(out) == 0 {
+		return nil, inputErr("give at least one domain name")
+	}
+	if len(out) > 100 {
+		return nil, inputErr("at most 100 names per certificate")
+	}
+	return out, nil
+}
+
+func (m *Manager) apply(c *model.Certificate, in Input, creating bool) error {
+	if in.Name != nil {
+		if !creating && *in.Name != c.Name {
+			return inputErr("a certificate can't be renamed (its files for named are named after it): create a new one and delete this one")
+		}
+		c.Name = *in.Name
+	}
+	if !nameRe.MatchString(c.Name) {
+		return inputErr("name %q: use lowercase letters, digits, - and _ (at most 63)", c.Name)
+	}
+	if in.Source != nil {
+		if !creating && *in.Source != c.Source {
+			return inputErr("a certificate's source can't change: create a new one")
+		}
+		c.Source = *in.Source
+	}
+	if c.Source == "" {
+		c.Source = model.CertSourceACME
+	}
+	if in.Uses != nil {
+		c.Uses = nil
+		for _, u := range *in.Uses {
+			u = strings.ToLower(strings.TrimSpace(u))
+			if u != model.CertUseWeb && u != model.CertUseDNS {
+				return inputErr("unknown use %q: web (jarld's HTTPS) or dns (for named: DNS over TLS and HTTPS)", u)
+			}
+			if !slices.Contains(c.Uses, u) {
+				c.Uses = append(c.Uses, u)
+			}
+		}
+		slices.Sort(c.Uses)
+	}
+	if c.Uses == nil {
+		c.Uses = []string{}
+	}
+	if in.Comment != nil {
+		c.Comment = *in.Comment
+	}
+	switch c.Source {
+	case model.CertSourceACME:
+		if in.CertFile != nil && *in.CertFile != "" || in.KeyFile != nil && *in.KeyFile != "" {
+			return inputErr("cert_file and key_file are for --source file; Jarl keeps the files of certificates it obtains itself")
+		}
+		if in.Domains != nil {
+			d, err := normDomains(*in.Domains)
+			if err != nil {
+				return err
+			}
+			c.Domains = d
+		}
+		if len(c.Domains) == 0 {
+			return inputErr("give the domain names the certificate is for")
+		}
+		if in.Challenge != nil {
+			c.Challenge = *in.Challenge
+		}
+		switch c.Challenge {
+		case "":
+			c.Challenge = model.ChallengeAuto
+		case model.ChallengeAuto, model.ChallengeJarl, model.ChallengePorkbun:
+		default:
+			return inputErr("challenge must be auto, jarl or porkbun")
+		}
+		if in.KeyType != nil {
+			c.KeyType = *in.KeyType
+		}
+		if c.KeyType == "" {
+			c.KeyType = "ec256"
+		}
+		if !slices.Contains(KeyTypes, c.KeyType) {
+			return inputErr("key type must be one of %s", strings.Join(KeyTypes, ", "))
+		}
+	case model.CertSourceFile:
+		if in.Challenge != nil && *in.Challenge != "" || in.KeyType != nil && *in.KeyType != "" {
+			return inputErr("challenge and key type are for certificates Jarl obtains (--source acme)")
+		}
+		if in.CertFile != nil {
+			c.CertFile = *in.CertFile
+		}
+		if in.KeyFile != nil {
+			c.KeyFile = *in.KeyFile
+		}
+		if !filepath.IsAbs(c.CertFile) || !filepath.IsAbs(c.KeyFile) {
+			return inputErr("cert_file and key_file must be absolute paths (the full chain, and its key)")
+		}
+		c.Challenge, c.KeyType = "", ""
+	default:
+		return inputErr("source must be acme (Jarl obtains and renews it) or file (you renew it)")
+	}
+	return nil
+}
+
+// checkUses refuses a second certificate for jarld's HTTPS.
+func (m *Manager) checkUses(ctx context.Context, c *model.Certificate) error {
+	if !c.HasUse(model.CertUseWeb) {
+		return nil
+	}
+	all, err := m.store.Certificates(ctx)
+	if err != nil {
+		return err
+	}
+	for _, o := range all {
+		if o.ID != c.ID && o.HasUse(model.CertUseWeb) {
+			return inputErr("certificate %s is already used for jarld's HTTPS; take the web use off it first (jarl cert update %s --use ...)", o.Name, o.Name)
+		}
+	}
+	return nil
+}
+
+// List returns every certificate.
+func (m *Manager) List(ctx context.Context) ([]*model.Certificate, error) {
+	return m.store.Certificates(ctx)
+}
+
+// Get returns one certificate.
+func (m *Manager) Get(ctx context.Context, name string) (*model.Certificate, error) {
+	c, err := m.store.CertificateByName(ctx, name)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil, ErrNotFound
+	}
+	return c, err
+}
+
+// Create adds a certificate. A file-source certificate is read at once;
+// one Jarl obtains is left for Issue (or the background loop).
+func (m *Manager) Create(ctx context.Context, in Input, p *auth.Principal) (*model.Certificate, error) {
+	c := &model.Certificate{CreatedBy: p.Name(), UpdatedBy: p.Name()}
+	if err := m.apply(c, in, true); err != nil {
+		return nil, err
+	}
+	if err := m.checkUses(ctx, c); err != nil {
+		return nil, err
+	}
+	if c.Source == model.CertSourceFile {
+		if _, err := m.readFiles(c); err != nil {
+			return nil, inputErr("%v", err)
+		}
+	}
+	if err := m.store.CreateCertificate(ctx, c); err != nil {
+		if errors.Is(err, store.ErrConflict) {
+			return nil, ErrConflict
+		}
+		return nil, err
+	}
+	m.eng.Audit(ctx, p, "certificate.create", "certificate", c.ID, c.Name, "ok", describe(c))
+	if c.Source == model.CertSourceFile {
+		m.refreshFile(ctx, c, true)
+	}
+	return c, nil
+}
+
+// Update changes a certificate. New names or a new key type make one Jarl
+// obtains due at once.
+func (m *Manager) Update(ctx context.Context, name string, in Input, p *auth.Principal) (*model.Certificate, error) {
+	c, err := m.Get(ctx, name)
+	if err != nil {
+		return nil, err
+	}
+	before := *c
+	if err := m.apply(c, in, false); err != nil {
+		return nil, err
+	}
+	if err := m.checkUses(ctx, c); err != nil {
+		return nil, err
+	}
+	if c.Source == model.CertSourceFile && (c.CertFile != before.CertFile || c.KeyFile != before.KeyFile) {
+		if _, err := m.readFiles(c); err != nil {
+			return nil, inputErr("%v", err)
+		}
+	}
+	if c.Source == model.CertSourceACME && c.CertPEM != "" && (!slices.Equal(c.Domains, before.Domains) || c.KeyType != before.KeyType) {
+		now := m.now().UTC()
+		c.RenewAt, c.Failures = &now, 0
+	}
+	c.UpdatedBy = p.Name()
+	if err := m.store.UpdateCertificate(ctx, c); err != nil {
+		return nil, err
+	}
+	m.eng.Audit(ctx, p, "certificate.update", "certificate", c.ID, c.Name, "ok", describe(c))
+	if c.Source == model.CertSourceFile {
+		m.mu.Lock()
+		delete(m.files, c.ID)
+		m.mu.Unlock()
+		m.refreshFile(ctx, c, true)
+	} else if c.CertPEM != "" {
+		if err := m.deploy(ctx, c, []byte(c.CertPEM), []byte(c.KeyPEM)); err != nil {
+			m.log.Warn("writing certificate files failed", "certificate", c.Name, "err", err)
+		}
+	}
+	if before.HasUse(model.CertUseWeb) && !c.HasUse(model.CertUseWeb) {
+		m.dropWeb(c.Name)
+	}
+	m.Kick()
+	return c, nil
+}
+
+// Delete removes a certificate and its files for named.
+func (m *Manager) Delete(ctx context.Context, name string, p *auth.Principal) error {
+	c, err := m.Get(ctx, name)
+	if err != nil {
+		return err
+	}
+	if err := m.store.DeleteCertificate(ctx, c.ID); err != nil {
+		return err
+	}
+	m.dropWeb(c.Name)
+	if err := m.removeFiles(c.Name); err != nil {
+		m.log.Warn("removing certificate files failed", "certificate", c.Name, "err", err)
+	}
+	m.mu.Lock()
+	delete(m.files, c.ID)
+	m.mu.Unlock()
+	m.eng.Audit(ctx, p, "certificate.delete", "certificate", c.ID, c.Name, "ok", "")
+	return nil
+}
+
+func describe(c *model.Certificate) string {
+	s := c.Source
+	if c.Source == model.CertSourceACME {
+		s += " " + strings.Join(c.Domains, " ") + ", challenge " + c.Challenge
+	} else {
+		s += " " + c.CertFile
+	}
+	if len(c.Uses) > 0 {
+		s += ", uses " + strings.Join(c.Uses, ",")
+	}
+	return s
+}
+
+// Preview checks a new certificate's fields without saving it.
+func (m *Manager) Preview(in Input) (*model.Certificate, error) {
+	c := &model.Certificate{}
+	if err := m.apply(c, in, true); err != nil {
+		return nil, err
+	}
+	return c, nil
+}
+
+// Check works out where each name's challenge would go, without asking
+// the CA for anything.
+func (m *Manager) Check(ctx context.Context, c *model.Certificate) ([]Route, error) {
+	if c.Source != model.CertSourceACME {
+		return nil, inputErr("certificate %s is renewed by you (source file); there is nothing to check", c.Name)
+	}
+	st, err := m.store.LoadState(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out []Route
+	for _, d := range c.Domains {
+		out = append(out, m.route(ctx, st, c.Challenge, d, ""))
+	}
+	return out, nil
+}
+
+// IssueResult is the outcome of an issue.
+type IssueResult struct {
+	Certificate *model.Certificate `json:"certificate"`
+	Routes      []Route            `json:"routes"`
+}
+
+// Issuing reports since when the certificate is being obtained (zero when
+// it isn't).
+func (m *Manager) Issuing(name string) time.Time {
+	if v, ok := m.issuing.Load(name); ok {
+		return v.(time.Time)
+	}
+	return time.Time{}
+}
+
+// IssueAsync starts obtaining a certificate in the background and returns
+// at once: talking to the CA and waiting for every name server to serve
+// the challenge can take minutes. Issuing tells when it is done; the
+// outcome is in the certificate (last_success, last_error).
+func (m *Manager) IssueAsync(ctx context.Context, name string, p *auth.Principal) (*model.Certificate, error) {
+	c, err := m.Get(ctx, name)
+	if err != nil {
+		return nil, err
+	}
+	if c.Source == model.CertSourceFile {
+		res, err := m.Issue(ctx, name, p)
+		if res != nil {
+			return res.Certificate, err
+		}
+		return nil, err
+	}
+	if _, busy := m.issuing.LoadOrStore(name, m.now()); busy {
+		return c, nil
+	}
+	go func() {
+		defer m.issuing.Delete(name)
+		m.issue(m.base, c, p)
+	}()
+	return c, nil
+}
+
+// Issue obtains a new certificate for c now (a file-source certificate is
+// reread instead).
+func (m *Manager) Issue(ctx context.Context, name string, p *auth.Principal) (*IssueResult, error) {
+	c, err := m.Get(ctx, name)
+	if err != nil {
+		return nil, err
+	}
+	if c.Source == model.CertSourceFile {
+		m.mu.Lock()
+		delete(m.files, c.ID)
+		m.mu.Unlock()
+		if err := m.refreshFile(ctx, c, true); err != nil {
+			return &IssueResult{Certificate: c}, err
+		}
+		return &IssueResult{Certificate: c}, nil
+	}
+	return m.issue(ctx, c, p)
+}
+
+func (m *Manager) issue(ctx context.Context, c *model.Certificate, p *auth.Principal) (*IssueResult, error) {
+	m.issueMu.Lock()
+	defer m.issueMu.Unlock()
+	// Reload: another issue may have finished while this one waited.
+	if fresh, err := m.Get(ctx, c.Name); err == nil {
+		c = fresh
+	}
+	var old *x509.Certificate
+	if c.CertPEM != "" {
+		if in, _, err := Inspect([]byte(c.CertPEM), []byte(c.KeyPEM)); err == nil {
+			old = in.Leaf
+		}
+	}
+	m.log.Info("obtaining certificate", "certificate", c.Name, "domains", strings.Join(c.Domains, " "), "by", p.Name())
+	now := m.now().UTC()
+	c.LastAttempt = &now
+	res, routes, err := m.obtain(ctx, c, old)
+	c.LastRoutes = nil
+	for _, r := range routes {
+		if r.Error == "" {
+			c.LastRoutes = append(c.LastRoutes, r.String())
+		}
+	}
+	var info *Info
+	if err == nil {
+		info, _, err = Inspect(res.Certificate, res.PrivateKey)
+		if err != nil {
+			err = fmt.Errorf("the CA's certificate is unusable: %w", err)
+		}
+	}
+	if err != nil {
+		c.Failures++
+		c.LastError = err.Error()
+		if serr := m.store.UpdateCertificate(ctx, c); serr != nil {
+			m.log.Error("saving certificate state failed", "certificate", c.Name, "err", serr)
+		}
+		m.log.Warn("obtaining certificate failed", "certificate", c.Name, "failures", c.Failures, "err", err)
+		m.eng.Audit(ctx, p, "certificate.issue", "certificate", c.ID, c.Name, "error", err.Error())
+		return &IssueResult{Certificate: c, Routes: routes}, err
+	}
+	c.CertPEM, c.KeyPEM = string(res.Certificate), string(res.PrivateKey)
+	setInfo(c, info)
+	done := m.now().UTC()
+	c.LastSuccess, c.Failures, c.LastError = &done, 0, ""
+	at := twoThirds(info.NotBefore, info.NotAfter)
+	c.RenewAt, c.ARICheckedAt = &at, nil
+	if t, err := m.renewalInfo(ctx, c, info.Leaf); err == nil && t != nil {
+		c.RenewAt, c.ARICheckedAt = t, &done
+	}
+	if err := m.store.UpdateCertificate(ctx, c); err != nil {
+		return nil, err
+	}
+	m.log.Info("certificate obtained", "certificate", c.Name, "expires", info.NotAfter.Format(time.DateOnly), "renew_at", c.RenewAt.Format(time.RFC3339), "routes", strings.Join(c.LastRoutes, "; "))
+	m.eng.Audit(ctx, p, "certificate.issue", "certificate", c.ID, c.Name, "ok", fmt.Sprintf("%s, valid until %s, from %s", strings.Join(info.Names, " "), info.NotAfter.Format(time.DateOnly), info.Issuer))
+	if err := m.deploy(ctx, c, res.Certificate, res.PrivateKey); err != nil {
+		m.log.Error("writing certificate files failed", "certificate", c.Name, "err", err)
+		return &IssueResult{Certificate: c, Routes: routes}, fmt.Errorf("the certificate was obtained, but writing it for named failed: %w", err)
+	}
+	return &IssueResult{Certificate: c, Routes: routes}, nil
+}
+
+func setInfo(c *model.Certificate, in *Info) {
+	nb, na := in.NotBefore.UTC(), in.NotAfter.UTC()
+	c.Names, c.NotBefore, c.NotAfter, c.Issuer, c.Serial = in.Names, &nb, &na, in.Issuer, in.Serial
+}
+
+// readFiles reads a file-source certificate and checks it.
+func (m *Manager) readFiles(c *model.Certificate) (*Info, error) {
+	cert, err := os.ReadFile(c.CertFile)
+	if err != nil {
+		return nil, fileErr(err)
+	}
+	key, err := os.ReadFile(c.KeyFile)
+	if err != nil {
+		return nil, fileErr(err)
+	}
+	in, _, err := Inspect(cert, key)
+	if err != nil {
+		return nil, fmt.Errorf("%s and %s: %w", c.CertFile, c.KeyFile, err)
+	}
+	return in, nil
+}
+
+func fileErr(err error) error {
+	if errors.Is(err, fs.ErrPermission) {
+		return fmt.Errorf("%w: jarld runs as its own user (jarl) and must be able to read the certificate and its key; e.g. give the files group jarl (chgrp jarl FILE; chmod 640 FILE), or copy them somewhere it can read in your renewal hook", err)
+	}
+	return err
+}
+
+// refreshFile rereads a file-source certificate when its files changed
+// (always with force) and deploys it.
+func (m *Manager) refreshFile(ctx context.Context, c *model.Certificate, force bool) error {
+	cs, err1 := os.Stat(c.CertFile)
+	ks, err2 := os.Stat(c.KeyFile)
+	var stamp fileStamp
+	if err1 == nil && err2 == nil {
+		stamp = fileStamp{certMod: cs.ModTime(), keyMod: ks.ModTime(), certSize: cs.Size()}
+		m.mu.Lock()
+		prev, ok := m.files[c.ID]
+		m.mu.Unlock()
+		if ok && prev == stamp && !force {
+			return nil
+		}
+	}
+	in, err := m.readFiles(c)
+	now := m.now().UTC()
+	c.LastAttempt = &now
+	if err != nil {
+		if c.LastError != err.Error() {
+			m.log.Warn("reading certificate failed", "certificate", c.Name, "err", err)
+		}
+		c.LastError = err.Error()
+		c.Failures = max(c.Failures, 1)
+		m.store.UpdateCertificate(ctx, c)
+		return err
+	}
+	if c.Serial != in.Serial {
+		m.log.Info("certificate read", "certificate", c.Name, "file", c.CertFile, "expires", in.NotAfter.Format(time.DateOnly))
+	}
+	setInfo(c, in)
+	c.Domains = in.Names
+	c.LastSuccess, c.LastError, c.Failures = &now, "", 0
+	if len(in.Warnings) > 0 {
+		c.LastError = in.Warnings[0]
+	}
+	if err := m.store.UpdateCertificate(ctx, c); err != nil {
+		return err
+	}
+	cert, _ := os.ReadFile(c.CertFile)
+	key, _ := os.ReadFile(c.KeyFile)
+	if err := m.deploy(ctx, c, cert, key); err != nil {
+		return err
+	}
+	m.mu.Lock()
+	m.files[c.ID] = stamp
+	m.mu.Unlock()
+	return nil
+}
+
+// FilesDir is where a certificate with the dns use is written for named.
+func (m *Manager) FilesDir(name string) string { return filepath.Join(m.cfg.Dir, name) }
+
+// Files names a certificate's files for named.
+const (
+	ChainFile = "fullchain.pem"
+	KeyFile   = "privkey.pem"
+)
+
+// deploy puts a certificate where it is used: jarld's HTTPS and/or the
+// files named reads. When those files change and named's configuration
+// names them, named rereads it.
+func (m *Manager) deploy(ctx context.Context, c *model.Certificate, cert, key []byte) error {
+	_, pair, err := Inspect(cert, key)
+	if err != nil {
+		return err
+	}
+	if c.HasUse(model.CertUseWeb) {
+		m.web.Store(&webCert{name: c.Name, pair: pair})
+	} else {
+		m.dropWeb(c.Name)
+	}
+	if !c.HasUse(model.CertUseDNS) {
+		return m.removeFiles(c.Name)
+	}
+	dir := m.FilesDir(c.Name)
+	changed := false
+	for _, f := range []struct {
+		name    string
+		content []byte
+		mode    fs.FileMode
+	}{{ChainFile, cert, 0o644}, {KeyFile, key, 0o640}} {
+		path := filepath.Join(dir, f.name)
+		if old, err := os.ReadFile(path); err == nil && bytes.Equal(old, f.content) {
+			continue
+		}
+		if err := m.eng.WriteFile(path, f.content, f.mode); err != nil {
+			return err
+		}
+		changed = true
+	}
+	if changed && m.namedUses(ctx, dir) {
+		if err := m.eng.Reconfig(ctx); err != nil {
+			return fmt.Errorf("named didn't reread its configuration for the new certificate: %w", err)
+		}
+		m.log.Info("named rereads the new certificate", "certificate", c.Name)
+	}
+	return nil
+}
+
+// namedUses reports whether named's configuration names files in dir.
+func (m *Manager) namedUses(ctx context.Context, dir string) bool {
+	st, err := m.store.LoadState(ctx)
+	if err != nil {
+		return false
+	}
+	for _, o := range st.Options {
+		if strings.Contains(o.Value, dir+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+func (m *Manager) removeFiles(name string) error {
+	if name == "" || strings.ContainsAny(name, "/.") {
+		return nil
+	}
+	dir := m.FilesDir(name)
+	if _, err := os.Stat(dir); err != nil {
+		return nil
+	}
+	return os.RemoveAll(dir)
+}
+
+func (m *Manager) dropWeb(name string) {
+	if w := m.web.Load(); w != nil && w.name == name {
+		m.web.CompareAndSwap(w, nil)
+	}
+}
+
+// WebCertificate is the certificate for jarld's HTTPS (nil when no
+// certificate has the web use, or it has none yet).
+func (m *Manager) WebCertificate() *tls.Certificate {
+	if w := m.web.Load(); w != nil {
+		return w.pair
+	}
+	return nil
+}
+
+// WebName is the name of the certificate jarld serves ("" for none).
+func (m *Manager) WebName() string {
+	if w := m.web.Load(); w != nil {
+		return w.name
+	}
+	return ""
+}
+
+// HasWeb reports whether a certificate has the web use (whether or not
+// it has been obtained yet).
+func (m *Manager) HasWeb(ctx context.Context) bool {
+	all, err := m.store.Certificates(ctx)
+	if err != nil {
+		return false
+	}
+	return slices.ContainsFunc(all, func(c *model.Certificate) bool { return c.HasUse(model.CertUseWeb) })
+}
+
+// Kick makes the loop look at the certificates now.
+func (m *Manager) Kick() {
+	select {
+	case m.kick <- struct{}{}:
+	default:
+	}
+}
+
+// Start loads the certificates and puts them in place (jarld's HTTPS, the
+// files for named). Call it before serving.
+func (m *Manager) Start(ctx context.Context) {
+	all, err := m.store.Certificates(ctx)
+	if err != nil {
+		m.log.Error("loading certificates failed", "err", err)
+		return
+	}
+	for _, c := range all {
+		switch {
+		case c.Source == model.CertSourceFile:
+			m.refreshFile(ctx, c, true)
+		case c.CertPEM != "":
+			if err := m.deploy(ctx, c, []byte(c.CertPEM), []byte(c.KeyPEM)); err != nil {
+				m.log.Warn("putting certificate in place failed", "certificate", c.Name, "err", err)
+			}
+		}
+	}
+}
+
+// Run renews certificates when they are due and rereads file-source ones
+// when their files change, until ctx ends.
+func (m *Manager) Run(ctx context.Context) {
+	m.base = ctx
+	select {
+	case <-ctx.Done():
+		return
+	case <-time.After(20 * time.Second): // let jarld finish starting
+	}
+	for {
+		m.Tick(ctx)
+		t := time.NewTimer(10 * time.Minute)
+		select {
+		case <-ctx.Done():
+			t.Stop()
+			return
+		case <-t.C:
+		case <-m.kick:
+			t.Stop()
+		}
+	}
+}
+
+// Tick does one round of the loop.
+func (m *Manager) Tick(ctx context.Context) {
+	all, err := m.store.Certificates(ctx)
+	if err != nil {
+		m.log.Error("loading certificates failed", "err", err)
+		return
+	}
+	now := m.now()
+	for _, c := range all {
+		if ctx.Err() != nil {
+			return
+		}
+		if c.Source == model.CertSourceFile {
+			m.refreshFile(ctx, c, false)
+			continue
+		}
+		if at := m.Due(c); !at.After(now) {
+			if _, busy := m.issuing.LoadOrStore(c.Name, now); !busy {
+				m.issue(ctx, c, auth.System)
+				m.issuing.Delete(c.Name)
+			}
+			continue
+		}
+		// Ask the CA about the renewal window twice a day (it moves it
+		// earlier when a certificate must be replaced, e.g. revoked).
+		if c.CertPEM != "" && (c.ARICheckedAt == nil || now.Sub(*c.ARICheckedAt) > 12*time.Hour) {
+			in, _, err := Inspect([]byte(c.CertPEM), []byte(c.KeyPEM))
+			if err != nil {
+				continue
+			}
+			t, err := m.renewalInfo(ctx, c, in.Leaf)
+			checked := now.UTC()
+			c.ARICheckedAt = &checked
+			if err == nil && t != nil && (c.RenewAt == nil || !t.Equal(*c.RenewAt)) {
+				m.log.Info("renewal time from the CA", "certificate", c.Name, "renew_at", t.Format(time.RFC3339))
+				c.RenewAt = t
+			}
+			m.store.UpdateCertificate(ctx, c)
+		}
+	}
+}
+
+// Due is when c should be obtained (again): at once when it has no
+// certificate yet or its names changed; else at its renewal time. After
+// failures it waits 1, 2, 4 ... hours (at most a day) between attempts.
+func (m *Manager) Due(c *model.Certificate) time.Time {
+	var at time.Time
+	switch {
+	case c.CertPEM == "":
+		at = c.CreatedAt
+	case c.RenewAt != nil:
+		at = *c.RenewAt
+	case c.NotBefore != nil && c.NotAfter != nil:
+		at = twoThirds(*c.NotBefore, *c.NotAfter)
+	}
+	if c.Failures > 0 && c.LastAttempt != nil {
+		wait := time.Hour << min(c.Failures-1, 5)
+		at = maxTime(at, c.LastAttempt.Add(min(wait, 24*time.Hour)))
+	}
+	return at
+}
+
+func maxTime(a, b time.Time) time.Time {
+	if a.After(b) {
+		return a
+	}
+	return b
+}
+
+// Status is a certificate's health.
+type Status struct {
+	State   string `json:"state"` // ok, pending, failing, expiring, expired
+	Message string `json:"message,omitempty"`
+}
+
+// StatusOf says how c is doing.
+func (m *Manager) StatusOf(c *model.Certificate) Status {
+	now := m.now()
+	if c.NotAfter == nil {
+		if c.Failures > 0 {
+			return Status{"failing", "not obtained yet: " + c.LastError}
+		}
+		return Status{"pending", "not obtained yet"}
+	}
+	left := c.NotAfter.Sub(now)
+	life := c.NotAfter.Sub(*c.NotBefore)
+	switch {
+	case left <= 0:
+		return Status{"expired", "expired on " + c.NotAfter.Format(time.DateOnly)}
+	case c.Failures > 0 && c.Source == model.CertSourceACME:
+		return Status{"failing", fmt.Sprintf("renewing failed %d times (next try %s): %s", c.Failures, m.Due(c).Local().Format("2 Jan 15:04"), c.LastError)}
+	case c.Failures > 0:
+		return Status{"failing", c.LastError}
+	case left < life/6 || (c.Source == model.CertSourceFile && left < 14*24*time.Hour):
+		return Status{"expiring", fmt.Sprintf("expires in %s (%s)", days(left), c.NotAfter.Format(time.DateOnly))}
+	}
+	return Status{"ok", ""}
+}
+
+func days(d time.Duration) string {
+	n := int(d.Hours() / 24)
+	if n == 1 {
+		return "1 day"
+	}
+	if n < 1 {
+		return fmt.Sprintf("%d hours", int(d.Hours()))
+	}
+	return fmt.Sprintf("%d days", n)
+}
+
+// AccountInfo is the ACME account as the API shows it.
+type AccountInfo struct {
+	Directory     string     `json:"directory"`
+	Email         string     `json:"email,omitempty"`
+	AgreeTOS      bool       `json:"agree_tos"`
+	EAB           bool       `json:"eab"`
+	Registered    bool       `json:"registered"`
+	URI           string     `json:"uri,omitempty"`
+	RegisteredAt  *time.Time `json:"registered_at,omitempty"`
+	Porkbun       bool       `json:"porkbun"`
+	Resolvers     []string   `json:"resolvers"`
+	Dir           string     `json:"dir"`
+	ActiveWebCert string     `json:"active_web_certificate,omitempty"`
+}
+
+// AccountInfo describes the ACME account and settings.
+func (m *Manager) AccountInfo(ctx context.Context) AccountInfo {
+	ai := AccountInfo{Directory: m.cfg.Directory, Email: m.cfg.Email, AgreeTOS: m.cfg.AgreeTOS, EAB: m.cfg.EABKeyID != "",
+		Porkbun: m.cfg.Porkbun != nil, Resolvers: m.cfg.Resolvers, Dir: m.cfg.Dir, ActiveWebCert: m.WebName()}
+	if a := m.account(ctx); a != nil && a.Directory == m.cfg.Directory && a.URI != "" {
+		ai.Registered, ai.URI = true, a.URI
+		t := a.RegisteredAt
+		ai.RegisteredAt = &t
+	}
+	return ai
+}

internal/certs/route.go

@@ -0,0 +1,146 @@
+package certs
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"jarl/internal/acme"
+	"jarl/internal/model"
+)
+
+// Route says where the DNS-01 challenge for one certificate name goes,
+// and why.
+type Route struct {
+	Domain string `json:"domain"` // the name on the certificate
+	Record string `json:"record"` // _acme-challenge.<domain>
+	// Target is where the TXT record is written: Record, or where its
+	// CNAME points.
+	Target   string   `json:"target"`
+	Route    string   `json:"route,omitempty"` // jarl or porkbun; "" when there is none
+	Zone     string   `json:"zone,omitempty"`  // the zone on the internet that holds Target
+	PublicNS []string `json:"public_ns,omitempty"`
+	Why      string   `json:"why"`
+	Error    string   `json:"error,omitempty"`
+}
+
+func (r Route) String() string {
+	s := r.Domain + ": " + r.Route
+	if r.Target != r.Record {
+		s += " via CNAME " + strings.TrimSuffix(r.Target, ".")
+	}
+	return s + " (zone " + strings.TrimSuffix(r.Zone, ".") + ")"
+}
+
+func isPorkbunNS(ns []string) bool {
+	for _, n := range ns {
+		if strings.HasSuffix(n, ".porkbun.com") {
+			return true
+		}
+	}
+	return false
+}
+
+// route decides where the challenge for domain goes. challenge is the
+// certificate's setting: auto picks from the zone's public name servers.
+// target is the record name after CNAMEs ("" to look it up).
+func (m *Manager) route(ctx context.Context, st *model.State, challenge, domain, target string) Route {
+	r := Route{Domain: domain, Record: challengeName(domain)}
+	fail := func(format string, a ...any) Route {
+		r.Error = fmt.Sprintf(format, a...)
+		return r
+	}
+	if target == "" {
+		t, err := m.res.follow(ctx, r.Record)
+		if err != nil {
+			return fail("%v", err)
+		}
+		target = t
+	}
+	r.Target = target
+	zone, err := m.res.zoneOf(ctx, target)
+	if err != nil {
+		return fail("%v", err)
+	}
+	r.Zone = zone
+	ns, err := m.res.nameServers(ctx, zone)
+	if err != nil {
+		return fail("%v", err)
+	}
+	r.PublicNS = ns
+	zoneName, nsList := strings.TrimSuffix(zone, "."), strings.Join(ns, ", ")
+
+	// Jarl can answer when it has the zone and the internet asks the name
+	// servers listed in it.
+	var jarlNS []string
+	jarlHas := false
+	for _, z := range st.SortedZones() {
+		if z.Type != model.ZonePrimary || z.Disabled || normName(z.Name) != normName(zone) {
+			continue
+		}
+		jarlHas = true
+		for _, rec := range st.ZoneRecords(z.ID) {
+			if rec.Type == "NS" && !rec.Disabled && normName(rec.Name) == normName(zone) {
+				jarlNS = append(jarlNS, normName(rec.Data))
+			}
+		}
+	}
+	slices.Sort(jarlNS)
+	jarlNS = slices.Compact(jarlNS)
+	servedByJarl := jarlHas && slices.ContainsFunc(ns, func(n string) bool { return slices.Contains(jarlNS, n) })
+	porkbunOK := m.cfg.Porkbun != nil && (m.cfg.PorkbunAllows == nil || m.cfg.PorkbunAllows(zoneName))
+
+	porkbun := func() Route {
+		r.Route, r.Why = model.ChallengePorkbun, fmt.Sprintf("%s is served by Porkbun (%s), so the record goes in through Porkbun's API", zoneName, nsList)
+		return r
+	}
+	jarl := func() Route {
+		r.Route, r.Why = model.ChallengeJarl, fmt.Sprintf("%s is served by this server's name servers (%s), so Jarl writes the record itself", zoneName, nsList)
+		return r
+	}
+	switch challenge {
+	case model.ChallengePorkbun:
+		switch {
+		case m.cfg.Porkbun == nil:
+			return fail("the challenge is set to porkbun, but jarl.yaml has no porkbun.api_key")
+		case !porkbunOK:
+			return fail("the challenge is set to porkbun, but %s isn't in porkbun.domains in jarl.yaml", zoneName)
+		case !isPorkbunNS(ns):
+			return fail("the challenge is set to porkbun, but on the internet %s is served by %s, not Porkbun: the CA would never see the record (set the challenge to auto)", zoneName, nsList)
+		}
+		return porkbun()
+	case model.ChallengeJarl:
+		switch {
+		case !jarlHas:
+			return fail("the challenge is set to jarl, but no primary zone in Jarl is %s (where %s is on the internet)", zoneName, strings.TrimSuffix(target, "."))
+		case !servedByJarl:
+			return fail("the challenge is set to jarl, but on the internet %s is served by %s, not by the name servers in Jarl's zone (%s): the CA would never see the record (set the challenge to auto)", zoneName, nsList, strings.Join(jarlNS, ", "))
+		}
+		return jarl()
+	}
+	switch {
+	case isPorkbunNS(ns) && porkbunOK:
+		return porkbun()
+	case servedByJarl:
+		return jarl()
+	case isPorkbunNS(ns) && m.cfg.Porkbun == nil:
+		return fail("%s is served by Porkbun (%s) and jarl.yaml has no porkbun.api_key. Add the key, or point %s with a CNAME at a name in a zone this server serves on the internet", zoneName, nsList, strings.TrimSuffix(r.Record, "."))
+	case isPorkbunNS(ns):
+		return fail("%s is served by Porkbun (%s) but isn't in porkbun.domains in jarl.yaml", zoneName, nsList)
+	case jarlHas:
+		return fail("on the internet %s is served by %s, not by the name servers in Jarl's zone (%s), so the CA would never see a record Jarl writes. Delegate the zone to this server, or point %s with a CNAME at a name in a zone it serves", zoneName, nsList, strings.Join(jarlNS, ", "), strings.TrimSuffix(r.Record, "."))
+	}
+	return fail("%s is served by %s, which Jarl can't write to. Point %s with a CNAME at a name in a zone this server serves on the internet (for example %s.acme.<your domain>, in a zone acme.<your domain> delegated here): Jarl follows the CNAME and answers there", zoneName, nsList, strings.TrimSuffix(r.Record, "."), strings.ReplaceAll(strings.TrimSuffix(strings.TrimPrefix(r.Record, "_acme-challenge."), "."), ".", "-"))
+}
+
+// primaryZones lists the zones Jarl can write challenge records into.
+func primaryZones(st *model.State) []acme.Zone {
+	var out []acme.Zone
+	for _, z := range st.SortedZones() {
+		if z.Type == model.ZonePrimary && !z.Disabled {
+			out = append(out, acme.Zone{Name: z.Name, View: st.ViewName(z), Link: z.LinkGroup})
+		}
+	}
+	return out
+}

internal/client/client.go

@@ -30,8 +30,17 @@ type Client struct {
 	// Changeset, if set, stages changes into this changeset instead of
 	// applying them.
 	Changeset int64
-	DryRun    bool
-	Force     bool
+	// CheckChangeset, if set, runs once before Changeset is first used,
+	// and its error stops the request. The CLI checks a changeset taken
+	// from JARL_CHANGESET with it.
+	CheckChangeset func(ctx context.Context) error
+	csChecked      bool
+	csErr          error
+	DryRun         bool
+	Force          bool
+	// AcceptRisk confirms changes that open the server up
+	// (docs/exposure.md).
+	AcceptRisk bool
 	// Preflight lets only requests through that can't change anything:
 	// reads and dry runs. Running a command on several servers uses it to
 	// check the command everywhere before running it anywhere.
@@ -183,7 +192,7 @@ func (c *Client) Do(ctx context.Context, method, path string, query url.Values,
 		req.Header.Set("Content-Type", "application/json")
 	}
 	req.Header.Set("Accept", "application/json")
-	req.Header.Set("User-Agent", "jarl-cli/"+version.Version)
+	req.Header.Set("User-Agent", "jarl-cli/"+version.Short())
 	if c.Token != "" {
 		req.Header.Set("Authorization", "Bearer "+c.Token)
 	}
@@ -243,6 +252,19 @@ func (c *Client) Get(ctx context.Context, path string, query url.Values, out any
 	return c.Do(ctx, http.MethodGet, path, query, nil, out)
 }
 
+// UseChangeset returns the changeset to stage into (0 for none), once
+// CheckChangeset has accepted it.
+func (c *Client) UseChangeset(ctx context.Context) (int64, error) {
+	if c.Changeset == 0 {
+		return 0, nil
+	}
+	if c.CheckChangeset != nil && !c.csChecked {
+		c.csChecked = true
+		c.csErr = c.CheckChangeset(ctx)
+	}
+	return c.Changeset, c.csErr
+}
+
 // Mutate sends a configuration change, honoring Changeset, DryRun and
 // Force.
 func (c *Client) Mutate(ctx context.Context, method, path string, query url.Values, body any) (*api.MutationResponse, error) {
@@ -250,8 +272,12 @@ func (c *Client) Mutate(ctx context.Context, method, path string, query url.Valu
 	for k, v := range query {
 		q[k] = v
 	}
-	if c.Changeset > 0 {
-		q.Set("changeset", fmt.Sprint(c.Changeset))
+	cs, err := c.UseChangeset(ctx)
+	if err != nil {
+		return &api.MutationResponse{}, err
+	}
+	if cs > 0 {
+		q.Set("changeset", fmt.Sprint(cs))
 	}
 	if c.DryRun {
 		q.Set("dry_run", "1")
@@ -259,8 +285,11 @@ func (c *Client) Mutate(ctx context.Context, method, path string, query url.Valu
 	if c.Force {
 		q.Set("force", "1")
 	}
+	if c.AcceptRisk {
+		q.Set("accept_risk", "1")
+	}
 	var out api.MutationResponse
-	err := c.Do(ctx, method, path, q, body, &out)
+	err = c.Do(ctx, method, path, q, body, &out)
 	return &out, err
 }
 

internal/config/config.go

@@ -4,7 +4,9 @@ package config
 import (
 	"bytes"
 	"fmt"
+	"net"
 	"net/netip"
+	"net/url"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -24,16 +26,155 @@ type Config struct {
 	TrustedProxies []string `yaml:"trusted_proxies"`
 	// Socket is a local unix socket for the API, where root and jarld's
 	// own user need no token ("" for none).
-	Socket     string  `yaml:"socket"`
-	Database   string  `yaml:"database"`
-	StagingDir string  `yaml:"staging_dir"`
-	Log        Log     `yaml:"log"`
-	Session    Session `yaml:"session"`
-	BIND       BIND    `yaml:"bind"`
-	Audit      Audit   `yaml:"audit"`
-	Backup     Backup  `yaml:"backup"`
-	Stats      Stats   `yaml:"stats"`
-	ACME       ACME    `yaml:"acme"`
+	Socket     string   `yaml:"socket"`
+	Database   string   `yaml:"database"`
+	StagingDir string   `yaml:"staging_dir"`
+	Log        Log      `yaml:"log"`
+	Session    Session  `yaml:"session"`
+	TOTP       TOTP     `yaml:"totp"`
+	BIND       BIND     `yaml:"bind"`
+	Audit      Audit    `yaml:"audit"`
+	Backup     Backup   `yaml:"backup"`
+	Stats      Stats    `yaml:"stats"`
+	ACME       ACME     `yaml:"acme"`
+	Porkbun    Porkbun  `yaml:"porkbun"`
+	Blocking   Blocking `yaml:"blocking"`
+	Metrics    Metrics  `yaml:"metrics"`
+	// Certificates configures TLS certificates Jarl manages
+	// (docs/certificates.md); the ACME account is under acme.
+	Certificates Certificates `yaml:"certificates"`
+}
+
+// Certificates configures the certificates Jarl manages.
+type Certificates struct {
+	// Dir is where certificates are written for named (DNS over TLS and
+	// HTTPS): one directory per certificate, readable by bind.file_group.
+	// "" is <bind.config_dir>/tls.
+	Dir string `yaml:"dir"`
+}
+
+// Metrics configures the Prometheus endpoint /metrics (docs/metrics.md).
+// A scrape is allowed from an address in Allow, or with Token as a bearer
+// token; root and jarld's own user may also scrape on the local socket.
+type Metrics struct {
+	Enabled bool `yaml:"enabled"`
+	// Listen are extra addresses that serve only /metrics, over plain
+	// HTTP. /metrics is always served on the main listeners too.
+	Listen []string `yaml:"listen"`
+	// Allow are the addresses or prefixes that may scrape without a token.
+	Allow []string `yaml:"allow"`
+	// Token, when set, lets any address that sends it as
+	// "Authorization: Bearer TOKEN" scrape.
+	Token string `yaml:"token"`
+}
+
+func (m *Metrics) check() error {
+	if !m.Enabled {
+		return nil
+	}
+	for _, a := range m.Listen {
+		if _, port, err := net.SplitHostPort(a); err != nil || port == "" {
+			return fmt.Errorf("listen %q must be ADDRESS:PORT, e.g. 0.0.0.0:9450", a)
+		}
+	}
+	for _, p := range m.Allow {
+		if _, err := ParsePrefix(p); err != nil {
+			return fmt.Errorf("allow: %v", err)
+		}
+	}
+	if m.Token != "" && (len(m.Token) < 16 || strings.ContainsAny(m.Token, " \t\r\n")) {
+		return fmt.Errorf("token must be at least 16 characters, without spaces (e.g. from 'openssl rand -hex 24')")
+	}
+	if len(m.Allow) == 0 && m.Token == "" {
+		return fmt.Errorf("set allow, token or both, or nobody can scrape")
+	}
+	return nil
+}
+
+// AllowPrefixes returns the parsed allow list.
+func (m *Metrics) AllowPrefixes() []netip.Prefix {
+	var out []netip.Prefix
+	for _, p := range m.Allow {
+		if pf, err := ParsePrefix(p); err == nil {
+			out = append(out, pf.Masked())
+		}
+	}
+	return out
+}
+
+// Blocking configures blocklist downloads (docs/blocking.md). The lists
+// and rules themselves are configuration in the database.
+type Blocking struct {
+	// Refresh is how often each list is checked for changes; a list is
+	// only downloaded again when it changed.
+	Refresh       Duration `yaml:"refresh"`
+	MaxDownloadMB int      `yaml:"max_download_mb"`
+	MaxEntries    int      `yaml:"max_entries"`
+}
+
+func (b *Blocking) check() error {
+	if b.Refresh < Duration(time.Hour) {
+		return fmt.Errorf("refresh must be at least 1h (list hosts ask not to be polled more often)")
+	}
+	if b.MaxDownloadMB < 1 || b.MaxEntries < 1 {
+		return fmt.Errorf("max_download_mb and max_entries must be at least 1")
+	}
+	return nil
+}
+
+// Porkbun lets Jarl manage domains' name servers, glue records and DNSSEC
+// DS records at the registrar Porkbun (docs/dnssec.md#porkbun). The key
+// lives only here, in a file root and jarld can read, and never in the
+// database (so not in backups either).
+type Porkbun struct {
+	APIKey       string `yaml:"api_key"`
+	SecretAPIKey string `yaml:"secret_api_key"`
+	// Domains limits which domains Jarl may manage at Porkbun (default:
+	// every Jarl zone the key can reach).
+	Domains []string `yaml:"domains"`
+	// APIURL is the API's base URL (for tests).
+	APIURL string `yaml:"api_url"`
+}
+
+// Enabled reports whether a Porkbun key is configured.
+func (p *Porkbun) Enabled() bool { return p.APIKey != "" }
+
+// Allows reports whether Jarl may manage domain (no trailing dot) at
+// Porkbun.
+func (p *Porkbun) Allows(domain string) bool {
+	if !p.Enabled() {
+		return false
+	}
+	if len(p.Domains) == 0 {
+		return true
+	}
+	for _, d := range p.Domains {
+		if strings.EqualFold(strings.TrimSuffix(d, "."), domain) {
+			return true
+		}
+	}
+	return false
+}
+
+func (p *Porkbun) check() error {
+	if (p.APIKey == "") != (p.SecretAPIKey == "") {
+		return fmt.Errorf("set both api_key and secret_api_key (or neither)")
+	}
+	if p.APIURL != "" {
+		u, err := url.Parse(p.APIURL)
+		if err != nil || (u.Scheme != "https" && !(u.Scheme == "http" && isLoopbackHost(u.Hostname()))) {
+			return fmt.Errorf("api_url must be an https:// URL")
+		}
+	}
+	return nil
+}
+
+func isLoopbackHost(h string) bool {
+	if h == "localhost" {
+		return true
+	}
+	a, err := netip.ParseAddr(h)
+	return err == nil && a.IsLoopback()
 }
 
 // Backup configures 'jarld backup' run without a file name, which is what
@@ -53,9 +194,85 @@ type Backup struct {
 	WarnAfter Duration `yaml:"warn_after"`
 }
 
-// ACME configures the ACME helpers.
+// ACME configures the ACME helpers and the account Jarl uses to obtain
+// certificates itself.
 type ACME struct {
-	HTTPReq HTTPReq `yaml:"httpreq"`
+	HTTPReq HTTPReq     `yaml:"httpreq"`
+	Account ACMEAccount `yaml:"account"`
+	// Resolvers are the recursive resolvers used to see a domain as the
+	// CA does: its zone, its public name servers and any CNAME on
+	// _acme-challenge. Public resolvers by default, because this server's
+	// own answers may come from an internal view.
+	Resolvers []string `yaml:"resolvers"`
+	// CABundle is a PEM file of extra CA certificates to trust when
+	// talking to the ACME server (a private CA such as step-ca).
+	CABundle string `yaml:"ca_bundle"`
+	// CheckPropagation waits until every name server of the zone serves
+	// a challenge before telling the CA to look.
+	CheckPropagation bool `yaml:"check_propagation"`
+}
+
+// ACMEAccount is the ACME account certificates are obtained with.
+type ACMEAccount struct {
+	// Directory is letsencrypt, letsencrypt-staging or an ACME directory URL.
+	Directory string `yaml:"directory"`
+	Email     string `yaml:"email"`
+	// AgreeTOS says you accept the CA's terms of service. Jarl doesn't
+	// register an account without it.
+	AgreeTOS bool `yaml:"agree_tos"`
+	// EABKeyID and EABHMAC are External Account Binding credentials, for
+	// CAs that need them (ZeroSSL, Google).
+	EABKeyID string `yaml:"eab_kid"`
+	EABHMAC  string `yaml:"eab_hmac"`
+}
+
+// Directory URLs for the names acme.account.directory accepts.
+const (
+	LetsEncrypt        = "https://acme-v02.api.letsencrypt.org/directory"
+	LetsEncryptStaging = "https://acme-staging-v02.api.letsencrypt.org/directory"
+)
+
+// DirectoryURL is the account's ACME directory URL.
+func (a ACMEAccount) DirectoryURL() string {
+	switch a.Directory {
+	case "", "letsencrypt":
+		return LetsEncrypt
+	case "letsencrypt-staging":
+		return LetsEncryptStaging
+	}
+	return a.Directory
+}
+
+func (a *ACME) check() error {
+	if d := a.Account.Directory; d != "" && d != "letsencrypt" && d != "letsencrypt-staging" {
+		u, err := url.Parse(d)
+		if err != nil || u.Scheme != "https" || u.Host == "" {
+			return fmt.Errorf("account.directory must be letsencrypt, letsencrypt-staging or an https:// URL")
+		}
+	}
+	if a.Account.Email != "" && !strings.Contains(a.Account.Email, "@") {
+		return fmt.Errorf("account.email %q isn't an email address", a.Account.Email)
+	}
+	if (a.Account.EABKeyID == "") != (a.Account.EABHMAC == "") {
+		return fmt.Errorf("account: set both eab_kid and eab_hmac, or neither")
+	}
+	for _, r := range a.Resolvers {
+		if _, _, err := net.SplitHostPort(r); err != nil {
+			return fmt.Errorf("resolvers: %q must be address:port, e.g. 1.1.1.1:53 or [2606:4700:4700::1111]:53", r)
+		}
+	}
+	if a.CABundle != "" && !filepath.IsAbs(a.CABundle) {
+		return fmt.Errorf("ca_bundle must be an absolute path")
+	}
+	return nil
+}
+
+// CertDir is certificates.dir, or <bind.config_dir>/tls.
+func (c *Config) CertDir() string {
+	if c.Certificates.Dir != "" {
+		return c.Certificates.Dir
+	}
+	return filepath.Join(c.BIND.ConfigDir, "tls")
 }
 
 // HTTPReq configures the endpoint for lego's httpreq DNS provider
@@ -93,12 +310,37 @@ type Session struct {
 }
 
 // BIND says where BIND's files and tools are.
+// TOTP configures two-factor login to the web UI (docs/permissions.md).
+type TOTP struct {
+	// Require is who must use it: none (each user decides), admins or
+	// all (every user who logs in with a password).
+	Require string `yaml:"require"`
+	// Issuer is the name authenticator apps show for the account ("" is
+	// "Jarl <hostname>").
+	Issuer string `yaml:"issuer"`
+}
+
+// IssuerName is Issuer, or "Jarl <short hostname>".
+func (t TOTP) IssuerName() string {
+	if t.Issuer != "" {
+		return t.Issuer
+	}
+	h, _ := os.Hostname()
+	if h, _, _ = strings.Cut(h, "."); h == "" {
+		return "Jarl"
+	}
+	return "Jarl " + h
+}
+
 type BIND struct {
-	MainConfig     string   `yaml:"main_config"`
-	ConfigDir      string   `yaml:"config_dir"`
-	ZoneDir        string   `yaml:"zone_dir"`
-	CacheDir       string   `yaml:"cache_dir"`
-	FileGroup      string   `yaml:"file_group"`
+	MainConfig string `yaml:"main_config"`
+	ConfigDir  string `yaml:"config_dir"`
+	ZoneDir    string `yaml:"zone_dir"`
+	CacheDir   string `yaml:"cache_dir"`
+	FileGroup  string `yaml:"file_group"`
+	// NamedUser is the user named runs as. 'jarld restore' gives it the
+	// DNSSEC keys it puts back.
+	NamedUser      string   `yaml:"named_user"`
 	NamedCheckConf string   `yaml:"named_checkconf"`
 	NamedCheckZone string   `yaml:"named_checkzone"`
 	RNDC           string   `yaml:"rndc"`
@@ -194,12 +436,14 @@ func Default() *Config {
 		StagingDir: "/var/lib/jarl/staging",
 		Log:        Log{Level: "info", Format: "text"},
 		Session:    Session{Lifetime: Duration(12 * time.Hour), IdleTimeout: Duration(2 * time.Hour), CookieSecure: "auto"},
+		TOTP:       TOTP{Require: "none"},
 		BIND: BIND{
 			MainConfig:     "/etc/bind/named.conf",
 			ConfigDir:      "/etc/bind/jarl",
 			ZoneDir:        "/var/lib/bind/jarl",
 			CacheDir:       "/var/cache/bind/jarl",
 			FileGroup:      "bind",
+			NamedUser:      "bind",
 			NamedCheckConf: "/usr/bin/named-checkconf",
 			NamedCheckZone: "/usr/bin/named-checkzone",
 			RNDC:           "/usr/sbin/rndc",
@@ -215,8 +459,11 @@ func Default() *Config {
 			Retention:         StatsRetention{Minute: Duration(7 * 24 * time.Hour), Hour: Duration(90 * 24 * time.Hour), Day: Duration(730 * 24 * time.Hour)},
 			TopN:              100,
 		},
-		ACME:   ACME{HTTPReq: HTTPReq{RequireHTTPS: true}},
-		Backup: Backup{Dir: "/var/backups/jarl", Retention: Duration(30 * 24 * time.Hour), KeepAtLeast: 7, WarnAfter: Duration(2 * 24 * time.Hour)},
+		ACME: ACME{HTTPReq: HTTPReq{RequireHTTPS: true}, Account: ACMEAccount{Directory: "letsencrypt"},
+			Resolvers: []string{"1.1.1.1:53", "9.9.9.9:53", "8.8.8.8:53"}, CheckPropagation: true},
+		Blocking: Blocking{Refresh: Duration(24 * time.Hour), MaxDownloadMB: 64, MaxEntries: 1_000_000},
+		Metrics:  Metrics{Allow: []string{"127.0.0.1", "::1"}},
+		Backup:   Backup{Dir: "/var/backups/jarl", Retention: Duration(30 * 24 * time.Hour), KeepAtLeast: 7, WarnAfter: Duration(2 * 24 * time.Hour)},
 	}
 }
 
@@ -267,12 +514,35 @@ func (c *Config) check() error {
 	default:
 		return fmt.Errorf("session.cookie_secure must be auto, always or never")
 	}
+	switch c.TOTP.Require {
+	case "none", "admins", "all":
+	default:
+		return fmt.Errorf("totp.require must be none, admins or all")
+	}
+	if len(c.TOTP.Issuer) > 64 || strings.ContainsAny(c.TOTP.Issuer, ":") {
+		return fmt.Errorf("totp.issuer must be at most 64 characters, without ':'")
+	}
 	if err := c.Stats.check(); err != nil {
 		return fmt.Errorf("stats: %w", err)
 	}
 	if err := c.Backup.check(); err != nil {
 		return fmt.Errorf("backup: %w", err)
 	}
+	if err := c.Porkbun.check(); err != nil {
+		return fmt.Errorf("porkbun: %w", err)
+	}
+	if err := c.Blocking.check(); err != nil {
+		return fmt.Errorf("blocking: %w", err)
+	}
+	if err := c.Metrics.check(); err != nil {
+		return fmt.Errorf("metrics: %w", err)
+	}
+	if err := c.ACME.check(); err != nil {
+		return fmt.Errorf("acme: %w", err)
+	}
+	if d := c.Certificates.Dir; d != "" && !filepath.IsAbs(d) {
+		return fmt.Errorf("certificates.dir must be an absolute path")
+	}
 	switch c.Log.Format {
 	case "text", "json":
 	default:
@@ -376,8 +646,10 @@ const Example = `# Jarl daemon configuration (/etc/jarl/jarl.yaml).
 listen:
   - "127.0.0.1:8053"
 
-# HTTPS. The certificate is reread when the file changes (or on SIGHUP),
-# so renewed Let's Encrypt certificates are picked up automatically.
+# HTTPS from a certificate file you renew yourself. The certificate is
+# reread when the file changes (or on SIGHUP). Easier: let Jarl obtain one
+# ('jarl cert create ... --use web', docs/certificates.md), which then
+# takes over from this.
 tls:
   cert_file: ""
   key_file: ""
@@ -404,6 +676,15 @@ session:
   idle_timeout: 2h   # ...or after this long without activity
   cookie_secure: auto  # auto, always or never
 
+# Two-factor login to the web UI with an authenticator app (TOTP). Each
+# user can turn it on under Account. require makes it compulsory: none,
+# admins, or all (every user with a password). A user who must use it and
+# hasn't set it up can only set it up after logging in. API tokens and
+# the local socket are not affected. See docs/permissions.md.
+totp:
+  require: none
+  issuer: ""         # the name in the app; "" is "Jarl <hostname>"
+
 bind:
   # The file named loads. 'jarld adopt' makes it include Jarl's config.
   main_config: /etc/bind/named.conf
@@ -415,6 +696,8 @@ bind:
   cache_dir: /var/cache/bind/jarl
   # Group of generated files; named must be able to read them.
   file_group: bind
+  # The user named runs as ('jarld restore' gives it the DNSSEC keys back).
+  named_user: bind
   named_checkconf: /usr/bin/named-checkconf
   named_checkzone: /usr/bin/named-checkzone
   rndc: /usr/sbin/rndc
@@ -434,7 +717,9 @@ audit:
 # 'systemctl edit jarl-backup.timer'. Each run writes
 # DIR/jarl-<UTC time>.db, checks it, then deletes backups older than
 # 'retention', always keeping the newest 'keep_at_least'. Only files named
-# like that are ever deleted. Restore with 'jarld restore'.
+# like that are ever deleted. Each backup also holds the DNSSEC keys of
+# signed zones (private keys included), so keep the directory private.
+# Restore with 'jarld restore'.
 backup:
   dir: /var/backups/jarl   # the timer's sandbox may write only here (see the docs to move it)
   retention: 30d           # 0 keeps every backup
@@ -478,4 +763,73 @@ acme:
     # this server. Leave false if a reverse proxy runs on this server but
     # isn't in trusted_proxies: its requests would look local.
     allow_loopback_http: false
+  # The account Jarl obtains certificates with (docs/certificates.md).
+  # Nothing is registered until you create a certificate. Read the CA's
+  # terms (https://letsencrypt.org/repository/) and set agree_tos: true.
+  # Try letsencrypt-staging first: its certificates aren't trusted, but
+  # its rate limits are generous.
+  account:
+    directory: letsencrypt   # letsencrypt, letsencrypt-staging or a directory URL
+    email: ""                # optional
+    agree_tos: false
+    eab_kid: ""              # External Account Binding, only for CAs that need it
+    eab_hmac: ""
+  # Resolvers to see your domains as the CA does (their public name
+  # servers, a CNAME on _acme-challenge). Not this server: it may answer
+  # from an internal view.
+  resolvers: ["1.1.1.1:53", "9.9.9.9:53", "8.8.8.8:53"]
+  ca_bundle: ""              # extra CA certificates for a private ACME server
+  # Wait until every name server of the zone serves a challenge before
+  # telling the CA to look (they are asked directly, on port 53).
+  check_propagation: true
+
+# Where certificates with the "dns" use are written for named, one
+# directory per certificate (fullchain.pem, privkey.pem), readable by
+# bind.file_group. Default: <bind.config_dir>/tls.
+certificates:
+  dir: ""
+
+# Porkbun, as registrar and as DNS host. With an API key, Jarl can:
+#  - show and set a domain's name servers, glue records and DNSSEC DS
+#    records there, after checking that the change won't break the domain
+#    (docs/dnssec.md#porkbun);
+#  - publish the DNS-01 challenges of certificates Jarl obtains while
+#    Porkbun still serves the domain's DNS (docs/certificates.md): it adds
+#    and removes TXT records at _acme-challenge names only.
+# Off without a key. Create the key at porkbun.com (Account -> API Access),
+# switch on "API Access" for the domain, and limit the key to that domain
+# if you can. The key can move your domain elsewhere: it lives only in this
+# file (keep it readable by root and jarld only: chown root:jarl, chmod
+# 640), never in Jarl's database or backups.
+porkbun:
+  api_key: ""          # pk1_...
+  secret_api_key: ""   # sk1_...
+  domains: []          # only these domains (default: any Jarl zone the key reaches)
+
+# Downloading blocklists (docs/blocking.md). The lists and rules are set up
+# in the web UI or with 'jarl blocklist' and 'jarl block'; this only sets
+# how jarld downloads them.
+blocking:
+  refresh: 24h           # check each list for changes this often (at least 1h)
+  max_download_mb: 64    # refuse larger downloads
+  max_entries: 1000000   # refuse lists with more domains
+
+# Prometheus metrics at /metrics (docs/metrics.md): named's counters and
+# Jarl's own (blocking, zones, views), plus health gauges to alert on
+# (named up, validation problems, blocklist errors, backup age, DNSSEC
+# steps, token expiry). Off by default. /metrics is served on the
+# addresses in 'listen' at the top of this file; a scrape is allowed from
+# an address in 'allow' below, or with the token. Query counters need
+# stats.enabled.
+metrics:
+  enabled: false
+  # Extra addresses that serve only /metrics, over plain HTTP, e.g.
+  # ["0.0.0.0:9450"] for a Prometheus server elsewhere on the network.
+  listen: []
+  # Addresses or prefixes that may scrape without a token.
+  allow: ["127.0.0.1", "::1"]
+  # A bearer token (at least 16 characters) that lets any address scrape:
+  # in Prometheus, 'authorization: { credentials: TOKEN }'. Keep this file
+  # readable by root and jarld only when you set it.
+  token: ""
 `

internal/config/config_test.go

@@ -3,6 +3,7 @@ package config
 import (
 	"os"
 	"path/filepath"
+	"reflect"
 	"testing"
 	"time"
 )
@@ -18,7 +19,7 @@ func TestExampleParses(t *testing.T) {
 	if c.BIND.ZoneDir != d.BIND.ZoneDir || time.Duration(c.Session.IdleTimeout) != 2*time.Hour || c.Listen[0] != "127.0.0.1:8053" {
 		t.Errorf("example differs from defaults: %+v", c)
 	}
-	if c.ACME != d.ACME || c.ACME.HTTPReq.Enabled || !c.ACME.HTTPReq.RequireHTTPS {
+	if !reflect.DeepEqual(c.ACME, d.ACME) || !reflect.DeepEqual(c.Certificates, d.Certificates) || c.ACME.HTTPReq.Enabled || !c.ACME.HTTPReq.RequireHTTPS {
 		t.Errorf("acme = %+v, want the defaults %+v", c.ACME, d.ACME)
 	}
 }
@@ -87,3 +88,31 @@ func TestStatsConfig(t *testing.T) {
 		}
 	}
 }
+
+func TestMetricsConfig(t *testing.T) {
+	d := Default()
+	if d.Metrics.Enabled || len(d.Metrics.AllowPrefixes()) != 2 || d.Metrics.Token != "" {
+		t.Errorf("defaults = %+v", d.Metrics)
+	}
+	path := filepath.Join(t.TempDir(), "jarl.yaml")
+	for _, tc := range []struct {
+		yaml string
+		ok   bool
+	}{
+		{"metrics: {enabled: true}", true},
+		{"metrics: {enabled: true, listen: [\"0.0.0.0:9450\", \"[::]:9450\"], allow: [10.0.0.5, 192.168.1.0/24]}", true},
+		{"metrics: {enabled: true, allow: [], token: 0123456789abcdef}", true},
+		{"metrics: {enabled: true, allow: []}", false}, // nobody could scrape
+		{"metrics: {enabled: true, token: short}", false},
+		{"metrics: {enabled: true, token: \"has space 0123456789\"}", false},
+		{"metrics: {enabled: true, listen: [\"9450\"]}", false},
+		{"metrics: {enabled: true, allow: [prometheus.lan]}", false},
+		{"metrics: {enabled: false, listen: [nonsense]}", true}, // only checked when enabled
+	} {
+		os.WriteFile(path, []byte(tc.yaml+"\n"), 0o644)
+		_, err := Load(path, false)
+		if (err == nil) != tc.ok {
+			t.Errorf("%s: err = %v, want ok=%v", tc.yaml, err, tc.ok)
+		}
+	}
+}

internal/dnssec/dnssec.go

@@ -0,0 +1,320 @@
+// Package dnssec reads the DNSSEC keys named keeps for the zones it signs
+// (dnssec-policy with inline signing) and works out where a zone is in the
+// steps of turning signing on or off.
+//
+// named writes three files per key into the zone's key-directory:
+// K<zone>.+<alg>+<tag>.key (the public DNSKEY, world-readable),
+// .private (the private key, readable only by named's user) and .state
+// (the key's timing and state, see the dnssec-keymgr states in the BIND
+// ARM). Jarl only reads the .key and .state files.
+package dnssec
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+// Key states, as named writes them in .state files.
+const (
+	Hidden      = "hidden"      // not in the zone (or the parent)
+	Rumoured    = "rumoured"    // published, but caches may not have it yet
+	Omnipresent = "omnipresent" // published long enough that everyone has it
+	Unretentive = "unretentive" // removed, but caches may still have it
+)
+
+// Status describes how a zone is signed.
+type Status struct {
+	Policy string `json:"policy"`
+	// KeyDir is the zone's key-directory.
+	KeyDir string        `json:"key_dir"`
+	Keys   []*Key        `json:"keys"`
+	Phase  Phase         `json:"phase"`
+	Named  *NamedSigning `json:"named,omitempty"`
+	// NamedError says why named couldn't be asked.
+	NamedError string `json:"named_error,omitempty"`
+	// KeyError says why the key directory couldn't be read.
+	KeyError string `json:"key_error,omitempty"`
+	// Policies are the policies the zone could use: default and the
+	// custom dnssec-policy statements.
+	Policies []string `json:"policies"`
+}
+
+// NamedSigning is what named reports about a zone it signs.
+type NamedSigning struct {
+	Secure        bool   `json:"secure"`
+	InlineSigning bool   `json:"inline_signing"`
+	Serial        uint32 `json:"serial"`
+	SignedSerial  uint32 `json:"signed_serial,omitempty"`
+	NextKeyEvent  string `json:"next_key_event,omitempty"`
+}
+
+// DS is a DS record for a key: what the parent zone publishes to vouch
+// for it.
+type DS struct {
+	KeyTag     uint16 `json:"key_tag"`
+	Algorithm  uint8  `json:"algorithm"`
+	DigestType uint8  `json:"digest_type"`
+	Digest     string `json:"digest"`
+	// Record is the DS record in zone file format.
+	Record string `json:"record"`
+}
+
+// Key is one DNSSEC key of a zone.
+type Key struct {
+	Tag           uint16 `json:"tag"`
+	Algorithm     uint8  `json:"algorithm"`
+	AlgorithmName string `json:"algorithm_name"`
+	// Role is CSK (signs everything: BIND's default policy), KSK (signs
+	// the DNSKEY set; the parent's DS points at it) or ZSK.
+	Role string `json:"role"`
+	// DNSKEY is the public key record, and DS its DS record (KSK and CSK
+	// only).
+	DNSKEY string `json:"dnskey,omitempty"`
+	DS     *DS    `json:"ds,omitempty"`
+	// States from the .state file.
+	Goal        string `json:"goal,omitempty"`
+	DNSKEYState string `json:"dnskey_state,omitempty"`
+	DSState     string `json:"ds_state,omitempty"`
+	ZoneRRSIG   string `json:"zone_rrsig_state,omitempty"`
+	KeyRRSIG    string `json:"key_rrsig_state,omitempty"`
+	// Times from the .state file.
+	Created   *time.Time `json:"created,omitempty"`
+	Published *time.Time `json:"published,omitempty"`
+	Active    *time.Time `json:"active,omitempty"`
+	Retired   *time.Time `json:"retired,omitempty"`
+	Removed   *time.Time `json:"removed,omitempty"`
+	// PublishCDS is when named publishes CDS/CDNSKEY records: from then on
+	// the DS can safely be added at the parent.
+	PublishCDS *time.Time `json:"publish_cds,omitempty"`
+	// DSPublished and DSRemoved are when named was told (or saw) that the
+	// parent added or removed the DS.
+	DSPublished *time.Time `json:"ds_published,omitempty"`
+	DSRemoved   *time.Time `json:"ds_removed,omitempty"`
+	// Files are the key's file names in the key directory.
+	Files []string `json:"files"`
+}
+
+// SigningKey reports whether the parent's DS should point at the key.
+func (k *Key) SigningKey() bool { return k.Role == "CSK" || k.Role == "KSK" }
+
+// Gone reports whether named has finished removing the key: every state
+// is hidden.
+func (k *Key) Gone() bool {
+	for _, s := range []string{k.Goal, k.DNSKEYState, k.DSState, k.ZoneRRSIG, k.KeyRRSIG} {
+		if s != "" && s != Hidden {
+			return false
+		}
+	}
+	return true
+}
+
+// FilePrefix is how named's key files for zone (a name with the trailing
+// dot) begin.
+func FilePrefix(zone string) string { return "K" + strings.ToLower(zone) + "+" }
+
+// Files lists the names of zone's key files in dir (every .key, .private
+// and .state file, and any other file named with the zone's key prefix).
+// A missing directory has none.
+func Files(dir, zone string) ([]string, error) {
+	ents, err := os.ReadDir(dir)
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	prefix := FilePrefix(zone)
+	var out []string
+	for _, e := range ents {
+		if !e.IsDir() && strings.HasPrefix(strings.ToLower(e.Name()), strings.ToLower(prefix)) {
+			out = append(out, e.Name())
+		}
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+// Keys reads zone's keys from dir, ordered with the signing keys first.
+func Keys(dir, zone string) ([]*Key, error) {
+	files, err := Files(dir, zone)
+	if err != nil {
+		return nil, err
+	}
+	byBase := map[string]*Key{}
+	var order []string
+	for _, f := range files {
+		ext := filepath.Ext(f)
+		base := strings.TrimSuffix(f, ext)
+		k := byBase[base]
+		if k == nil {
+			k = &Key{}
+			byBase[base] = k
+			order = append(order, base)
+		}
+		k.Files = append(k.Files, f)
+		switch ext {
+		case ".key":
+			if err := k.readPublic(filepath.Join(dir, f)); err != nil {
+				return nil, err
+			}
+		case ".state":
+			if err := k.readState(filepath.Join(dir, f)); err != nil {
+				return nil, err
+			}
+		}
+	}
+	var out []*Key
+	for _, b := range order {
+		k := byBase[b]
+		if k.DNSKEY == "" && k.Goal == "" {
+			continue // only a .private file: nothing to show
+		}
+		out = append(out, k)
+	}
+	sort.SliceStable(out, func(i, j int) bool {
+		if out[i].SigningKey() != out[j].SigningKey() {
+			return out[i].SigningKey()
+		}
+		return out[i].Tag < out[j].Tag
+	})
+	return out, nil
+}
+
+func (k *Key) readPublic(path string) error {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+	zp := dns.NewZoneParser(strings.NewReader(string(b)), "", path)
+	for rr, ok := zp.Next(); ok; rr, ok = zp.Next() {
+		key, isKey := rr.(*dns.DNSKEY)
+		if !isKey {
+			continue
+		}
+		k.Tag = key.KeyTag()
+		k.Algorithm = key.Algorithm
+		k.AlgorithmName = dns.AlgorithmToString[key.Algorithm]
+		k.DNSKEY = key.String()
+		if k.Role == "" {
+			switch {
+			case key.Flags&dns.SEP != 0:
+				k.Role = "KSK"
+			default:
+				k.Role = "ZSK"
+			}
+		}
+		if key.Flags&dns.SEP != 0 {
+			if ds := key.ToDS(dns.SHA256); ds != nil {
+				k.DS = &DS{KeyTag: ds.KeyTag, Algorithm: ds.Algorithm, DigestType: ds.DigestType, Digest: strings.ToUpper(ds.Digest), Record: ds.String()}
+			}
+		}
+		return nil
+	}
+	if err := zp.Err(); err != nil {
+		return fmt.Errorf("%s: %w", path, err)
+	}
+	return fmt.Errorf("%s: no DNSKEY record", path)
+}
+
+func (k *Key) readState(path string) error {
+	f, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	var ksk, zsk bool
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		line := sc.Text()
+		if strings.HasPrefix(line, ";") {
+			continue
+		}
+		name, v, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		v = strings.TrimSpace(v)
+		t := func() *time.Time {
+			// 20261008190331 (Thu Oct  8 19:03:31 2026)
+			f := strings.Fields(v)
+			if len(f) == 0 {
+				return nil
+			}
+			ts, err := time.Parse("20060102150405", f[0])
+			if err != nil {
+				return nil
+			}
+			return &ts
+		}
+		switch name {
+		case "Algorithm":
+			if n, err := strconv.Atoi(v); err == nil && k.Algorithm == 0 {
+				k.Algorithm = uint8(n)
+				k.AlgorithmName = dns.AlgorithmToString[uint8(n)]
+			}
+		case "KSK":
+			ksk = v == "yes"
+		case "ZSK":
+			zsk = v == "yes"
+		case "Generated":
+			k.Created = t()
+		case "Published":
+			k.Published = t()
+		case "Active":
+			k.Active = t()
+		case "Retired":
+			k.Retired = t()
+		case "Removed":
+			k.Removed = t()
+		case "PublishCDS":
+			k.PublishCDS = t()
+		case "DSPublish":
+			k.DSPublished = t()
+		case "DSRemoved":
+			k.DSRemoved = t()
+		case "GoalState":
+			k.Goal = v
+		case "DNSKEYState":
+			k.DNSKEYState = v
+		case "DSState":
+			k.DSState = v
+		case "ZRRSIGState":
+			k.ZoneRRSIG = v
+		case "KRRSIGState":
+			k.KeyRRSIG = v
+		}
+	}
+	switch {
+	case ksk && zsk:
+		k.Role = "CSK"
+	case ksk:
+		k.Role = "KSK"
+	case zsk:
+		k.Role = "ZSK"
+	}
+	return sc.Err()
+}
+
+// ZoneFileSuffixes are the files named keeps next to a zone file: the
+// journal of the zone Jarl wrote (.jnl, and .jbk while it rewrites it) and,
+// for a signed zone, the signed copy and its journal.
+var ZoneFileSuffixes = []string{".jnl", ".jbk", ".signed", ".signed.jnl", ".signed.jbk"}
+
+// DerivedFiles returns the files named made next to zoneFile that exist.
+func DerivedFiles(zoneFile string) []string {
+	var out []string
+	for _, s := range ZoneFileSuffixes {
+		if _, err := os.Lstat(zoneFile + s); err == nil {
+			out = append(out, zoneFile+s)
+		}
+	}
+	return out
+}

internal/dnssec/dnssec_test.go

@@ -0,0 +1,117 @@
+package dnssec
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// testdata holds key files written by named 9.20 with dnssec-policy:
+// example.test just signed (default policy), fast.test turned insecure
+// after its DS was removed, fast2.test turned insecure before any DS.
+
+func TestKeys(t *testing.T) {
+	keys, err := Keys("testdata", "example.test.")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(keys) != 1 {
+		t.Fatalf("%d keys", len(keys))
+	}
+	k := keys[0]
+	if k.Tag != 22642 || k.Role != "CSK" || k.Algorithm != 13 || k.AlgorithmName != "ECDSAP256SHA256" || len(k.Files) != 3 {
+		t.Errorf("key: %+v", k)
+	}
+	if k.DS == nil || k.DS.KeyTag != 22642 || k.DS.DigestType != 2 || len(k.DS.Digest) != 64 || !strings.HasPrefix(k.DS.Record, "example.test.\t3600\tIN\tDS\t22642 13 2 ") {
+		t.Errorf("DS: %+v", k.DS)
+	}
+	if k.DNSKEYState != Rumoured || k.Goal != Omnipresent || k.PublishCDS == nil || k.PublishCDS.Format("2006-01-02 15:04") != "2026-10-09 19:08" {
+		t.Errorf("state: %+v", k)
+	}
+	// "fast.test." mustn't pick up fast2.test's keys, nor "test." anyone's.
+	if keys, _ := Keys("testdata", "fast.test."); len(keys) != 1 || keys[0].Tag != 642 {
+		t.Errorf("fast.test: %+v", keys)
+	}
+	if files, _ := Files("testdata", "test."); len(files) != 0 {
+		t.Errorf("test.: %v", files)
+	}
+	if files, _ := Files("no-such-dir", "test."); files != nil {
+		t.Errorf("missing dir: %v", files)
+	}
+}
+
+func TestAssess(t *testing.T) {
+	load := func(zone string) []*Key {
+		keys, err := Keys("testdata", zone)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return keys
+	}
+	check := func(name string, p Phase, code string) {
+		t.Helper()
+		if p.Code != code {
+			t.Errorf("%s: %s (%s), want %s", name, p.Code, p.Summary, code)
+		}
+	}
+	check("unsigned", Assess("", nil), PhaseOff)
+	check("left over", Assess("", load("example.test.")), PhaseLeftover)
+	check("no keys yet", Assess("default", nil), PhaseStarting)
+	p := Assess("default", load("example.test."))
+	check("new", p, PhaseSigning)
+	if p.CanPublishDS || p.DSReadyAt == nil {
+		t.Errorf("new: %+v", p)
+	}
+	check("DS removed", Assess("insecure", load("fast.test.")), PhaseDSExpiring)
+	if Assess("insecure", load("fast.test.")).CanFinish {
+		t.Error("DNSSEC mustn't be switched off while resolvers may still have the DS cached")
+	}
+	p = Assess("insecure", load("fast2.test."))
+	check("no DS ever", p, PhaseRemovingKeys)
+	if !p.CanFinish {
+		t.Error("no DS: switching off is safe")
+	}
+	check("insecure, no keys", Assess("insecure", nil), PhaseUnsigned)
+
+	// The rest of the life cycle, from edited state files.
+	edit := func(zone string, repl ...string) []*Key {
+		dir := t.TempDir()
+		files, _ := Files("testdata", zone)
+		for _, f := range files {
+			b, _ := os.ReadFile(filepath.Join("testdata", f))
+			s := strings.NewReplacer(repl...).Replace(string(b))
+			os.WriteFile(filepath.Join(dir, f), []byte(s), 0o644)
+		}
+		keys, err := Keys(dir, zone)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return keys
+	}
+	ready := edit("example.test.", "DNSKEYState: rumoured", "DNSKEYState: omnipresent", "KRRSIGState: rumoured", "KRRSIGState: omnipresent", "DSState: hidden", "DSState: rumoured")
+	p = Assess("default", ready)
+	check("ready", p, PhaseReady)
+	if !p.CanPublishDS || len(p.NeedsDS) != 1 || p.NeedsDS[0] != 22642 {
+		t.Errorf("ready: %+v", p)
+	}
+	check("DS added", Assess("default", edit("example.test.", "DNSKEYState: rumoured", "DNSKEYState: omnipresent", "KRRSIGState: rumoured", "KRRSIGState: omnipresent", "DSChange:", "DSPublish: 20261010000000\nDSChange:")), PhaseDSPending)
+	check("secure", Assess("default", edit("example.test.", "DNSKEYState: rumoured", "DNSKEYState: omnipresent", "KRRSIGState: rumoured", "KRRSIGState: omnipresent", "DSState: hidden", "DSState: omnipresent")), PhaseSecure)
+	p = Assess("insecure", edit("fast.test.", "DSRemoved:", "XDSRemoved:"))
+	check("turning off with the DS still there", p, PhaseRemovingDS)
+	if p.CanFinish {
+		t.Error("the DS is still at the parent")
+	}
+}
+
+func TestDerivedFiles(t *testing.T) {
+	dir := t.TempDir()
+	zf := filepath.Join(dir, "example.com.zone")
+	for _, f := range []string{zf, zf + ".jnl", zf + ".signed", zf + ".signed.jnl", zf + ".other"} {
+		os.WriteFile(f, nil, 0o644)
+	}
+	got := DerivedFiles(zf)
+	if len(got) != 3 {
+		t.Errorf("%v", got)
+	}
+}

internal/dnssec/phase.go

@@ -0,0 +1,170 @@
+package dnssec
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// Phases of a zone, from unsigned to signed and back. Turning signing on:
+// off -> starting -> signing -> ready (add the DS at the parent) ->
+// ds_pending -> secure. Turning it off: secure -> removing_ds (remove the
+// DS at the parent) -> ds_expiring -> removing_keys -> unsigned -> off.
+const (
+	PhaseOff          = "off"           // not signed, no keys
+	PhaseLeftover     = "leftover_keys" // not signed, but old keys are still in the key directory
+	PhaseStarting     = "starting"      // signing is on in Jarl; named hasn't made keys yet
+	PhaseSigning      = "signing"       // keys made, zone signed; not yet safe to add the DS
+	PhaseReady        = "ready"         // safe to add the DS at the parent
+	PhaseDSPending    = "ds_pending"    // the DS is at the parent; named waits for its TTL
+	PhaseSecure       = "secure"        // signed, and the parent's DS is in place
+	PhaseRemovingDS   = "removing_ds"   // turning off: the DS must go from the parent first
+	PhaseDSExpiring   = "ds_expiring"   // the DS is gone; named waits until caches forget it
+	PhaseRemovingKeys = "removing_keys" // named removes the keys and signatures
+	PhaseUnsigned     = "unsigned"      // turning off has finished; switch DNSSEC off
+)
+
+// Phase says where a zone is and what comes next.
+type Phase struct {
+	Code    string `json:"code"`
+	Summary string `json:"summary"`
+	Next    string `json:"next,omitempty"`
+	// DSReadyAt is when the DS can safely be added at the parent (phase
+	// signing).
+	DSReadyAt *time.Time `json:"ds_ready_at,omitempty"`
+	// CanPublishDS: the zone is ready for (or already has) a DS at the
+	// parent.
+	CanPublishDS bool `json:"can_publish_ds"`
+	// CanFinish: the zone is being turned off and the parent has no DS
+	// any more (as far as named knows), so DNSSEC can be switched off.
+	CanFinish bool `json:"can_finish"`
+	// NeedsDS lists the signing keys whose DS should be at the parent,
+	// and StaleDS those whose DS should be removed from it.
+	NeedsDS []uint16 `json:"needs_ds,omitempty"`
+	StaleDS []uint16 `json:"stale_ds,omitempty"`
+}
+
+// Assess works out the phase of a zone signed with policy ("" when Jarl
+// doesn't sign it, "insecure" while signing is being removed) that has
+// keys.
+func Assess(policy string, keys []*Key) Phase {
+	var live []*Key // signing keys named keeps (or is introducing)
+	for _, k := range keys {
+		if k.SigningKey() && k.Goal == Omnipresent {
+			live = append(live, k)
+		}
+	}
+	switch {
+	case policy == "":
+		if len(keys) == 0 {
+			return Phase{Code: PhaseOff, Summary: "DNSSEC is off."}
+		}
+		return Phase{Code: PhaseLeftover, Summary: "DNSSEC is off, but keys from when the zone was signed are still in its key directory.",
+			Next: "Wipe them (jarl zone dnssec wipe) once you're sure the parent zone has no DS record for them, or turn signing on again to reuse them."}
+	case policy == "insecure":
+		return assessOff(keys)
+	}
+	if len(live) == 0 {
+		return Phase{Code: PhaseStarting, Summary: "Signing is on; named hasn't created the zone's keys yet.",
+			Next: "Wait a moment: named makes the keys when it loads the configuration."}
+	}
+	p := Phase{}
+	var notReady []*Key
+	for _, k := range live {
+		if k.DNSKEYState != Omnipresent || k.KeyRRSIG != Omnipresent {
+			notReady = append(notReady, k)
+		}
+	}
+	for _, k := range keys {
+		if k.SigningKey() && k.Goal == Hidden && k.DSState != Hidden && k.DSRemoved == nil {
+			p.StaleDS = append(p.StaleDS, k.Tag)
+		}
+	}
+	if len(notReady) > 0 {
+		p.Code = PhaseSigning
+		p.Summary = "named is signing the zone. Resolvers still treat it as unsigned, because the parent zone has no DS record for it."
+		for _, k := range notReady {
+			if k.PublishCDS != nil && (p.DSReadyAt == nil || k.PublishCDS.After(*p.DSReadyAt)) {
+				t := *k.PublishCDS
+				p.DSReadyAt = &t
+			}
+		}
+		if p.DSReadyAt != nil {
+			p.Next = fmt.Sprintf("Wait until %s before adding the DS at the parent: until then some resolvers may still have unsigned answers cached, and would reject them once the DS appears.", p.DSReadyAt.UTC().Format("Mon 2 Jan 15:04 MST"))
+		} else {
+			p.Next = "Wait until named has published the keys long enough for caches to pick them up before adding the DS."
+		}
+		return p
+	}
+	p.CanPublishDS = true
+	var pending, secure int
+	for _, k := range live {
+		switch {
+		case k.DSState == Omnipresent:
+			secure++
+		case k.DSPublished != nil:
+			pending++
+		default:
+			p.NeedsDS = append(p.NeedsDS, k.Tag)
+		}
+	}
+	switch {
+	case len(p.NeedsDS) > 0:
+		p.Code = PhaseReady
+		p.Summary = "The zone is signed and ready: add the DS record at the parent zone (your registrar) to turn validation on."
+		p.Next = "Add the DS record (" + tags(p.NeedsDS) + ") at your registrar, then run the DS check so named knows it's there."
+	case pending > 0:
+		p.Code = PhaseDSPending
+		p.Summary = "The parent zone has the DS record. named waits for the parent's TTL before it treats it as in place."
+	default:
+		p.Code = PhaseSecure
+		p.Summary = "The zone is signed and the parent zone's DS record points at its key: validating resolvers check its answers."
+	}
+	if len(p.StaleDS) > 0 && p.Next == "" {
+		p.Next = "Remove the DS record of the retired key " + tags(p.StaleDS) + " at your registrar, then run the DS check."
+	}
+	return p
+}
+
+func assessOff(keys []*Key) Phase {
+	var dsUp, dsGoing, keysLeft bool
+	for _, k := range keys {
+		if !k.SigningKey() {
+			if !k.Gone() {
+				keysLeft = true
+			}
+			continue
+		}
+		switch {
+		case k.DSState == Hidden || k.DSState == "":
+		case k.DSRemoved != nil:
+			dsGoing = true
+		default:
+			dsUp = true
+		}
+		if !k.Gone() {
+			keysLeft = true
+		}
+	}
+	switch {
+	case dsUp:
+		return Phase{Code: PhaseRemovingDS, Summary: "Turning DNSSEC off: named keeps the zone signed until the parent zone's DS record is gone.",
+			Next: "Remove the DS record at your registrar, then run the DS check so named knows. Don't switch DNSSEC off before that: the zone would fail to validate."}
+	case dsGoing:
+		return Phase{Code: PhaseDSExpiring, Summary: "Turning DNSSEC off: the parent's DS record is gone; named keeps signing until resolvers' cached copies of it expire (the parent's DS TTL, often a day).",
+			Next: "Wait: switching DNSSEC off now would make the zone fail to validate for resolvers that still have the DS cached."}
+	case keysLeft:
+		return Phase{Code: PhaseRemovingKeys, Summary: "Turning DNSSEC off: the parent has no DS any more, and named is removing the keys and signatures.",
+			Next: "Wait until named has finished, then switch DNSSEC off.", CanFinish: true}
+	}
+	return Phase{Code: PhaseUnsigned, Summary: "Turning DNSSEC off has finished: the zone is no longer signed.",
+		Next: "Switch DNSSEC off for the zone to finish (jarl zone dnssec disable), and wipe the old keys if you like.", CanFinish: true}
+}
+
+func tags(ts []uint16) string {
+	var s []string
+	for _, t := range ts {
+		s = append(s, fmt.Sprintf("key %d", t))
+	}
+	return strings.Join(s, ", ")
+}

internal/dnssec/testdata/Kexample.test.+013+22642.key

@@ -0,0 +1,6 @@
+; This is a key-signing key, keyid 22642, for example.test.
+; Created: 20261008190331 (Thu Oct  8 19:03:31 2026)
+; Publish: 20261008190331 (Thu Oct  8 19:03:31 2026)
+; Activate: 20261008190331 (Thu Oct  8 19:03:31 2026)
+; SyncPublish: 20261009190831 (Fri Oct  9 19:08:31 2026)
+example.test. 3600 IN DNSKEY 257 3 13 fiSDgJJGHyAp36ZNGOeb45gn+O1pF3hCbTUPHeJ3ztIuisGoywmo7Be3 +vUPyC6e9BmTCIRIeElB4f2o9HoPXg==

internal/dnssec/testdata/Kexample.test.+013+22642.private

@@ -0,0 +1 @@
+Private-key-format: v1.3 (test data, not a real key)

internal/dnssec/testdata/Kexample.test.+013+22642.state

@@ -0,0 +1,19 @@
+; This is the state of key 22642, for example.test.
+Algorithm: 13
+Length: 256
+Lifetime: 0
+KSK: yes
+ZSK: yes
+Generated: 20261008190331 (Thu Oct  8 19:03:31 2026)
+Published: 20261008190331 (Thu Oct  8 19:03:31 2026)
+Active: 20261008190331 (Thu Oct  8 19:03:31 2026)
+PublishCDS: 20261009190831 (Fri Oct  9 19:08:31 2026)
+DNSKEYChange: 20261008190331 (Thu Oct  8 19:03:31 2026)
+ZRRSIGChange: 20261008190331 (Thu Oct  8 19:03:31 2026)
+KRRSIGChange: 20261008190331 (Thu Oct  8 19:03:31 2026)
+DSChange: 20261008190331 (Thu Oct  8 19:03:31 2026)
+DNSKEYState: rumoured
+ZRRSIGState: rumoured
+KRRSIGState: rumoured
+DSState: hidden
+GoalState: omnipresent

internal/dnssec/testdata/Kfast.test.+013+00642.key

@@ -0,0 +1,8 @@
+; This is a key-signing key, keyid 642, for fast.test.
+; Created: 20261008203220 (Thu Oct  8 20:32:20 2026)
+; Publish: 20261008203220 (Thu Oct  8 20:32:20 2026)
+; Activate: 20261008203220 (Thu Oct  8 20:32:20 2026)
+; Inactive: 20261008203319 (Thu Oct  8 20:33:19 2026)
+; Delete: 20261024213819 (Sat Oct 24 21:38:19 2026)
+; SyncPublish: 20261008203234 (Thu Oct  8 20:32:34 2026)
+fast.test. 3600 IN DNSKEY 257 3 13 D6O3u6ZWXwKPu/Y4acS2eRm1zKQ8LaN8zhvkr6KNWP+fEPgko6yLib94 J5KcUXpFcG6Y/jdxKM8FgeASRDq/ow==

internal/dnssec/testdata/Kfast.test.+013+00642.private

@@ -0,0 +1 @@
+Private-key-format: v1.3 (test data, not a real key)

internal/dnssec/testdata/Kfast.test.+013+00642.state

@@ -0,0 +1,23 @@
+; This is the state of key 642, for fast.test.
+Algorithm: 13
+Length: 256
+Lifetime: 0
+KSK: yes
+ZSK: yes
+Generated: 20261008203220 (Thu Oct  8 20:32:20 2026)
+Published: 20261008203220 (Thu Oct  8 20:32:20 2026)
+Active: 20261008203220 (Thu Oct  8 20:32:20 2026)
+Retired: 20261008203319 (Thu Oct  8 20:33:19 2026)
+Removed: 20261024213819 (Sat Oct 24 21:38:19 2026)
+DSPublish: 20261008203249 (Thu Oct  8 20:32:49 2026)
+DSRemoved: 20261008203329 (Thu Oct  8 20:33:29 2026)
+PublishCDS: 20261008203234 (Thu Oct  8 20:32:34 2026)
+DNSKEYChange: 20261008203234 (Thu Oct  8 20:32:34 2026)
+ZRRSIGChange: 20261008203232 (Thu Oct  8 20:32:32 2026)
+KRRSIGChange: 20261008203234 (Thu Oct  8 20:32:34 2026)
+DSChange: 20261008203319 (Thu Oct  8 20:33:19 2026)
+DNSKEYState: omnipresent
+ZRRSIGState: omnipresent
+KRRSIGState: omnipresent
+DSState: unretentive
+GoalState: hidden

internal/dnssec/testdata/Kfast2.test.+013+28643.key

@@ -0,0 +1,8 @@
+; This is a key-signing key, keyid 28643, for fast2.test.
+; Created: 20261008203340 (Thu Oct  8 20:33:40 2026)
+; Publish: 20261008203340 (Thu Oct  8 20:33:40 2026)
+; Activate: 20261008203340 (Thu Oct  8 20:33:40 2026)
+; Inactive: 20261008203344 (Thu Oct  8 20:33:44 2026)
+; Delete: 20261024213844 (Sat Oct 24 21:38:44 2026)
+; SyncPublish: 20261008203354 (Thu Oct  8 20:33:54 2026)
+fast2.test. 3600 IN DNSKEY 257 3 13 6WkqPp3kxXxMJtC9clsF4zTnZGPXaFRikSdMLG1eFExa4d0Uo+PtMbqo KHR/Qe601tO7yZoY8itie0aZzPaMiA==

internal/dnssec/testdata/Kfast2.test.+013+28643.private

@@ -0,0 +1 @@
+Private-key-format: v1.3 (test data, not a real key)

internal/dnssec/testdata/Kfast2.test.+013+28643.state

@@ -0,0 +1,21 @@
+; This is the state of key 28643, for fast2.test.
+Algorithm: 13
+Length: 256
+Lifetime: 0
+KSK: yes
+ZSK: yes
+Generated: 20261008203340 (Thu Oct  8 20:33:40 2026)
+Published: 20261008203340 (Thu Oct  8 20:33:40 2026)
+Active: 20261008203340 (Thu Oct  8 20:33:40 2026)
+Retired: 20261008203344 (Thu Oct  8 20:33:44 2026)
+Removed: 20261024213844 (Sat Oct 24 21:38:44 2026)
+PublishCDS: 20261008203354 (Thu Oct  8 20:33:54 2026)
+DNSKEYChange: 20261008203344 (Thu Oct  8 20:33:44 2026)
+ZRRSIGChange: 20261008203344 (Thu Oct  8 20:33:44 2026)
+KRRSIGChange: 20261008203344 (Thu Oct  8 20:33:44 2026)
+DSChange: 20261008203340 (Thu Oct  8 20:33:40 2026)
+DNSKEYState: unretentive
+ZRRSIGState: unretentive
+KRRSIGState: unretentive
+DSState: hidden
+GoalState: hidden

internal/engine/blocking_test.go

@@ -0,0 +1,299 @@
+package engine
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"jarl/internal/blocking"
+	"jarl/internal/model"
+)
+
+func blockRule(name, action string, exact bool, views ...string) Request {
+	in := BlockRuleInput{Name: &name, Action: &action, Exact: &exact}
+	if len(views) > 0 {
+		in.Views = &views
+	}
+	return NewRequest(OpBlockRuleCreate, 0, in)
+}
+
+func blocklist(name, url string, views ...string) Request {
+	in := BlocklistInput{Name: &name, URL: &url}
+	if len(views) > 0 {
+		in.Views = &views
+	}
+	return NewRequest(OpBlocklistCreate, 0, in)
+}
+
+// listServer serves a blocklist with an ETag, and counts the downloads
+// that sent content.
+type listServer struct {
+	body  atomic.Value
+	full  atomic.Int32
+	calls atomic.Int32
+}
+
+func newListServer(t *testing.T, body string) (*listServer, *httptest.Server) {
+	ls := &listServer{}
+	ls.body.Store(body)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ls.calls.Add(1)
+		b := ls.body.Load().(string)
+		etag := `"` + string(rune('a'+len(b)%26)) + "x" + string(rune('a'+len(b)/26%26)) + `"`
+		if r.Header.Get("If-None-Match") == etag {
+			w.WriteHeader(http.StatusNotModified)
+			return
+		}
+		w.Header().Set("ETag", etag)
+		ls.full.Add(1)
+		w.Write([]byte(b))
+	}))
+	t.Cleanup(srv.Close)
+	return ls, srv
+}
+
+func TestBlockingRender(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin,
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("internal"), MatchClients: &[]string{"10.0.0.0/8"}, AdoptZones: true}),
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("external")}),
+	)
+	st := env.state()
+	ext := st.ViewByName("external")
+	env.submit(env.admin, NewRequest(OpOptionCreate, 0, OptionInput{Scope: model.Ptr(model.ScopeView), ScopeID: &ext.ID, Name: model.Ptr("recursion"), Value: model.Ptr("no")}))
+
+	_, srv := newListServer(t, "||ads.example^\n")
+	res := env.submit(env.admin,
+		blocklist("ads", srv.URL+"/list.txt"),
+		blockRule("tracker.example", "block", false),
+		blockRule("cdn.tracker.example", "allow", true),
+	)
+	if res.Ops[1].Summary != "block tracker.example (and below)" || res.Ops[2].Summary != "allow cdn.tracker.example" {
+		t.Errorf("summaries: %q, %q", res.Ops[1].Summary, res.Ops[2].Summary)
+	}
+	conf, _ := os.ReadFile(filepath.Join(env.dir, "etc/named.conf"))
+	c := string(conf)
+	// Automatic views: only internal offers recursion.
+	internal := c[strings.Index(c, `view "internal"`):strings.Index(c, `view "external"`)]
+	for _, want := range []string{
+		"response-policy {\n\t\tzone \"rules.jarl.invalid\" min-update-interval 0 log no;\n\t\tzone \"ads.blocklist.jarl.invalid\" min-update-interval 0 log no;\n\t} qname-wait-recurse no break-dnssec yes;",
+		`zone "rules.jarl.invalid" {`,
+		"allow-query { none; };",
+	} {
+		if !strings.Contains(internal, want) {
+			t.Errorf("view internal lacks %q:\n%s", want, internal)
+		}
+	}
+	if strings.Contains(c[strings.Index(c, `view "external"`):], "response-policy") {
+		t.Error("view external, without recursion, got blocking")
+	}
+	rules, err := os.ReadFile(filepath.Join(env.dir, "zones/internal/rules.jarl.invalid.rpz"))
+	if err != nil || !strings.Contains(string(rules), "cdn.tracker.example\tCNAME\trpz-passthru.\n*.cdn.tracker.example\tCNAME\t.\n") {
+		t.Errorf("rules zone: %v\n%s", err, rules)
+	}
+	// The list's file exists as an empty policy zone until downloaded.
+	b := env.state().BlocklistByName("ads")
+	listFile := filepath.Join(env.dir, "cache/blocklists/list-"+strconv.FormatInt(b.ID, 10)+".rpz")
+	if f, err := os.ReadFile(listFile); err != nil || !strings.Contains(string(f), "not downloaded yet") {
+		t.Errorf("placeholder: %v %s", err, f)
+	}
+
+	// A view a list or rule names can't be deleted.
+	res = env.submit(env.admin, NewRequest(OpBlocklistUpdate, b.ID, BlocklistInput{Views: &[]string{"external"}}))
+	if len(res.Problems) != 1 || res.Problems[0].Code != "blocking_no_recursion" {
+		t.Errorf("a list in a view without recursion: %+v", res.Problems)
+	}
+	if e := env.submitErr(env.admin, NewRequest(OpViewDelete, ext.ID, DeleteInput{Cascade: true})); e.Kind != KindConflict || !strings.Contains(e.Message, "blocklist ads") {
+		t.Errorf("deleting a used view: %+v", e)
+	}
+	st = env.state()
+	// A second rule for the same name and view is refused.
+	if e := env.submitErr(env.admin, blockRule("tracker.example", "allow", true)); e.Kind != KindValidation || !strings.Contains(e.Message, "two rules for tracker.example") {
+		t.Errorf("duplicate rule: %+v", e)
+	}
+	// So is a response-policy option where Jarl writes one.
+	in := st.ViewByName("internal")
+	if e := env.submitErr(env.admin, NewRequest(OpOptionCreate, 0, OptionInput{Scope: model.Ptr(model.ScopeView), ScopeID: &in.ID, Name: model.Ptr("response-policy"), Value: model.Ptr(`{ zone "x"; }`)})); e.Kind != KindValidation {
+		t.Errorf("response-policy option: %+v", e)
+	}
+	// Bad input.
+	for _, req := range []Request{blocklist("Bad Name", srv.URL), blocklist("ok", "ftp://x/list"), blockRule("com", "block", false), blockRule("a.example", "deny", false), blockRule("a.example", "block", false, "nope")} {
+		if e := env.submitErr(env.admin, req); e.Kind != KindBadRequest {
+			t.Errorf("%s: %+v", req.Data, e)
+		}
+	}
+}
+
+func TestBlocklistRefresh(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	ls, srv := newListServer(t, "# test\n||ads.example^\n0.0.0.0 tracker.example\nnot a domain line\n")
+	env.submit(env.admin, blocklist("ads", srv.URL), blockRule("good.ads.example", "allow", false))
+	b := env.state().BlocklistByName("ads")
+	ctx := context.Background()
+
+	env.e.RefreshDue(ctx)
+	s, _ := env.st.BlocklistStatuses(ctx)
+	st := s[b.ID]
+	if st == nil || st.Error != "" || st.Entries != 2 || st.Records != 3 || st.Skipped != 1 || st.UpdatedAt == nil {
+		t.Fatalf("status after the first download: %+v", st)
+	}
+	file := env.e.cfg.Paths.BlocklistFile(b.ID)
+	if f, _ := os.ReadFile(file); !strings.Contains(string(f), "*.ads.example\tCNAME\t.\n") || !strings.Contains(string(f), "tracker.example\tCNAME\t.\n") {
+		t.Errorf("list zone:\n%s", f)
+	}
+	// Not due again: nothing is fetched.
+	env.e.RefreshDue(ctx)
+	if ls.calls.Load() != 1 {
+		t.Errorf("downloads after a second RefreshDue: %d", ls.calls.Load())
+	}
+	// A cleared cache leaves an empty placeholder: downloaded again at once.
+	os.Remove(file)
+	env.e.RefreshDue(ctx)
+	if ls.calls.Load() != 2 {
+		t.Errorf("downloads after the file was lost: %d", ls.calls.Load())
+	}
+	if f, _ := os.ReadFile(file); !strings.Contains(string(f), "*.ads.example\tCNAME\t.\n") {
+		t.Errorf("list zone after the file was lost:\n%s", f)
+	}
+	// Unchanged on the server: 304, no rewrite.
+	firstHash := st.SHA256
+	fullBefore := ls.full.Load()
+	env.e.RefreshBlocklist(ctx, b.ID, false)
+	if ls.full.Load() != fullBefore {
+		t.Errorf("a conditional download fetched the list again")
+	}
+	// Changed: rewritten.
+	ls.body.Store("||ads.example^\n||more.example^\n")
+	st, err := env.e.RefreshBlocklist(ctx, b.ID, false)
+	if err != nil || st.Entries != 2 || st.Records != 4 || st.SHA256 == firstHash {
+		t.Errorf("after a change: %+v, %v", st, err)
+	}
+	// A broken download keeps the previous version and reports why.
+	before, _ := os.ReadFile(file)
+	ls.body.Store("<html><body>Not found</body></html>\n")
+	st, err = env.e.RefreshBlocklist(ctx, b.ID, true)
+	if err == nil || !strings.Contains(st.Error, "no domains found") {
+		t.Errorf("garbage: %+v, %v", st, err)
+	}
+	if after, _ := os.ReadFile(file); string(after) != string(before) {
+		t.Error("a failed update changed the list's file")
+	}
+	// A failed attempt is retried after RetryAfter, not at every check.
+	calls := ls.calls.Load()
+	env.e.RefreshDue(ctx)
+	if ls.calls.Load() != calls {
+		t.Error("a failed list was tried again before RetryAfter")
+	}
+	// Too big.
+	env.e.Limits.MaxBytes = 10
+	ls.body.Store("||ads.example^\n||more.example^\n||third.example^\n")
+	if st, _ = env.e.RefreshBlocklist(ctx, b.ID, true); !strings.Contains(st.Error, "larger than") {
+		t.Errorf("size limit: %+v", st)
+	}
+	env.e.Limits = DefaultBlocklistLimits()
+	env.e.RefreshBlocklist(ctx, b.ID, true)
+
+	// What blocks what.
+	check := func(name string) blocking.Match {
+		m, err := env.e.CheckBlocking(env.state(), name)
+		if err != nil || len(m) != 1 {
+			t.Fatalf("check %s: %+v %v", name, m, err)
+		}
+		return m[0]
+	}
+	if m := check("x.ads.example"); m.Result != "blocked" || m.List != "ads" || m.Entry != "*.ads.example" {
+		t.Errorf("x.ads.example: %+v", m)
+	}
+	if m := check("a.good.ads.example"); m.Result != "allowed" || m.RuleID == 0 || m.Entry != "*.good.ads.example" {
+		t.Errorf("a.good.ads.example: %+v", m)
+	}
+	if m := check("fine.example"); m.Result != "none" {
+		t.Errorf("fine.example: %+v", m)
+	}
+
+	// Deleting the list removes its file and status.
+	env.submit(env.admin, NewRequest(OpBlocklistDelete, b.ID, nil))
+	env.e.RefreshDue(ctx)
+	if _, err := os.Stat(file); !os.IsNotExist(err) {
+		t.Errorf("the deleted list's file is still there: %v", err)
+	}
+	if s, _ := env.st.BlocklistStatuses(ctx); s[b.ID] != nil {
+		t.Error("the deleted list's status is still there")
+	}
+}
+
+func TestBlockingPause(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin, blocklist("ads", "https://example.org/list"))
+	rulesFile := filepath.Join(env.dir, "zones/_default/rules.jarl.invalid.rpz")
+	if _, err := os.Stat(rulesFile); !os.IsNotExist(err) {
+		t.Fatal("a rules zone without rules or a pause")
+	}
+	until := env.e.Now().Add(10 * time.Minute)
+	res := env.submit(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{Until: &until}))
+	if !strings.HasPrefix(res.Ops[0].Summary, "pause blocking until ") {
+		t.Errorf("summary = %q", res.Ops[0].Summary)
+	}
+	f, err := os.ReadFile(rulesFile)
+	if err != nil || !strings.HasSuffix(string(f), "NS\tlocalhost.\n*\tCNAME\trpz-passthru.\n") {
+		t.Fatalf("paused rules zone: %v\n%s", err, f)
+	}
+	conf, _ := os.ReadFile(filepath.Join(env.dir, "etc/named.conf"))
+	if !strings.Contains(string(conf), "zone \"rules.jarl.invalid\" min-update-interval 0 log no;\n\t\tzone \"ads.") {
+		t.Errorf("the paused rules zone must come first:\n%s", conf)
+	}
+	// Not yet time: nothing happens.
+	if got := env.e.ResumeBlocking(context.Background()); !got.Equal(until) {
+		t.Errorf("ResumeBlocking before the end = %v", got)
+	}
+	// Time is up: resumed, and the rules zone is gone again.
+	env.submit(env.admin, blockRule("ads.example", "block", false))
+	env.e.Now = func() time.Time { return until.Add(time.Second) }
+	if got := env.e.ResumeBlocking(context.Background()); !got.IsZero() || env.state().Settings.BlockingPausedUntil != nil {
+		t.Fatalf("after the pause: %v, %v", got, env.state().Settings.BlockingPausedUntil)
+	}
+	if f, _ := os.ReadFile(rulesFile); !strings.Contains(string(f), "*.ads.example\tCNAME\t.\n") || strings.Contains(string(f), "passthru") {
+		t.Errorf("rules zone after the pause:\n%s", f)
+	}
+	// Reverting a pause resumes blocking.
+	until = env.e.Now().Add(time.Hour)
+	res = env.submit(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{Until: &until}))
+	rev, err := env.e.Revert(context.Background(), res.ChangesetID, env.admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := env.e.Apply(context.Background(), rev.ID, env.admin, ApplyOptions{}); err != nil || env.state().Settings.BlockingPausedUntil != nil {
+		t.Errorf("revert of a pause: %v, %v", err, env.state().Settings.BlockingPausedUntil)
+	}
+	// Until resumed: jarld never ends it, a resume does.
+	res = env.submit(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{Indefinitely: true}))
+	if res.Ops[0].Summary != "pause blocking until resumed" || !env.state().Settings.BlockingPaused() {
+		t.Errorf("indefinite pause: %q", res.Ops[0].Summary)
+	}
+	if f, _ := os.ReadFile(rulesFile); !strings.Contains(string(f), "*\tCNAME\trpz-passthru.\n") {
+		t.Errorf("rules zone while paused indefinitely:\n%s", f)
+	}
+	env.e.Now = func() time.Time { return until.Add(1000 * time.Hour) }
+	if got := env.e.ResumeBlocking(context.Background()); !got.IsZero() || !env.state().Settings.BlockingPausedIndefinitely {
+		t.Errorf("an indefinite pause ended by itself: %v", got)
+	}
+	env.submit(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{}))
+	if env.state().Settings.BlockingPaused() {
+		t.Error("resume didn't end an indefinite pause")
+	}
+	// At most a day.
+	long := env.e.Now().Add(48 * time.Hour)
+	if e := env.submitErr(env.admin, NewRequest(OpBlockingPause, 0, BlockingPauseInput{Until: &long})); e.Kind != KindBadRequest {
+		t.Errorf("a two-day pause: %+v", e)
+	}
+}

internal/engine/blocklists.go

@@ -0,0 +1,409 @@
+package engine
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"jarl/internal/blocking"
+	"jarl/internal/model"
+	"jarl/internal/render"
+	"jarl/internal/version"
+)
+
+// BlocklistLimits bound blocklist downloads (blocking in jarl.yaml).
+type BlocklistLimits struct {
+	Refresh    time.Duration // how often a list is checked for changes
+	RetryAfter time.Duration // after a failed attempt
+	MaxBytes   int64         // per download
+	MaxEntries int           // domains per list
+	Timeout    time.Duration // per download
+}
+
+// DefaultBlocklistLimits are the limits without configuration.
+func DefaultBlocklistLimits() BlocklistLimits {
+	return BlocklistLimits{Refresh: 24 * time.Hour, RetryAfter: time.Hour, MaxBytes: 64 << 20, MaxEntries: 1_000_000, Timeout: 2 * time.Minute}
+}
+
+// KickBlocklists asks the download loop to look for work now (a list was
+// added or changed).
+func (e *Engine) KickBlocklists() {
+	select {
+	case e.blKick <- struct{}{}:
+	default:
+	}
+}
+
+// BlocklistKicks delivers KickBlocklists' signals to the download loop.
+func (e *Engine) BlocklistKicks() <-chan struct{} { return e.blKick }
+
+// ensureBlocklistFiles creates missing blocklist zone files as empty
+// policy zones, so named can load its configuration before a list has
+// been downloaded. Existing files are never touched.
+func (e *Engine) ensureBlocklistFiles(paths []string) error {
+	var errs []error
+	for _, path := range paths {
+		if _, err := os.Stat(path); err == nil {
+			continue
+		}
+		if err := e.deploy.writeNew(path, []byte(blocking.Placeholder()), 0o640); err != nil && !errors.Is(err, fs.ErrExist) {
+			errs = append(errs, err)
+		}
+	}
+	return errors.Join(errs...)
+}
+
+// RefreshDue downloads the blocklists that are due: never tried, URL
+// changed, file missing or empty (the cache was cleared), last check older
+// than Refresh, or a failed attempt older than RetryAfter. Lists that are
+// disabled or apply to no view are skipped. It also removes the files and
+// status of deleted lists.
+func (e *Engine) RefreshDue(ctx context.Context) {
+	st, err := e.store.LoadState(ctx)
+	if err != nil {
+		e.log.Warn("blocklists: loading the configuration failed", "err", err)
+		return
+	}
+	statuses, err := e.store.BlocklistStatuses(ctx)
+	if err != nil {
+		e.log.Warn("blocklists: loading their status failed", "err", err)
+		return
+	}
+	out := render.Render(st, e.cfg.Paths, e.extras(ctx))
+	if err := e.ensureBlocklistFiles(out.Blocklists); err != nil {
+		e.log.Warn("blocklists: creating empty zone files failed", "err", err)
+	}
+	e.cleanBlocklists(ctx, st, statuses)
+	now := e.Now()
+	for _, b := range st.SortedBlocklists() {
+		if b.Disabled || len(st.BlockingViews(b.ViewIDs)) == 0 {
+			continue
+		}
+		s := statuses[b.ID]
+		due := s == nil || s.URL != b.URL || s.CheckedAt == nil
+		if !due {
+			wait := e.Limits.Refresh
+			if s.Error != "" {
+				wait = e.Limits.RetryAfter
+			}
+			due = now.Sub(*s.CheckedAt) >= wait || s.Error == "" && isPlaceholder(e.cfg.Paths.BlocklistFile(b.ID))
+		}
+		if !due {
+			continue
+		}
+		if ctx.Err() != nil {
+			return
+		}
+		if _, err := e.RefreshBlocklist(ctx, b.ID, false); err != nil && ctx.Err() == nil {
+			e.log.Warn("blocklist update failed; named keeps using the previous version", "list", b.Name, "err", err)
+		}
+	}
+}
+
+// isPlaceholder reports whether a list's zone file is missing or still the
+// empty policy zone written before its download.
+func isPlaceholder(path string) bool {
+	f, err := os.Open(path)
+	if err != nil {
+		return true
+	}
+	defer f.Close()
+	head := make([]byte, len(blocking.Placeholder()))
+	n, _ := io.ReadFull(f, head)
+	return string(head[:n]) == blocking.Placeholder()
+}
+
+// cleanBlocklists removes the zone files and status of deleted lists.
+func (e *Engine) cleanBlocklists(ctx context.Context, st *model.State, statuses map[int64]*model.BlocklistStatus) {
+	for id := range statuses {
+		if st.Blocklists[id] == nil {
+			e.store.DeleteBlocklistStatus(ctx, id)
+		}
+	}
+	dir := e.cfg.Paths.BlocklistsDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return
+	}
+	for _, ent := range entries {
+		n := ent.Name()
+		idText, ok := strings.CutPrefix(strings.TrimSuffix(n, ".rpz"), "list-")
+		id, err := strconv.ParseInt(idText, 10, 64)
+		if !ok || !strings.HasSuffix(n, ".rpz") || err != nil || st.Blocklists[id] != nil {
+			continue
+		}
+		if err := os.Remove(filepath.Join(dir, n)); err == nil {
+			e.log.Info("removed the zone file of a deleted blocklist", "file", n)
+		}
+	}
+}
+
+// errNotModified means the server said the list hasn't changed.
+var errNotModified = errors.New("not modified")
+
+// RefreshBlocklist downloads a list now and, when its content changed,
+// replaces its zone file and makes named reload it. force downloads even
+// when the server says nothing changed. A failure keeps the previous
+// version. It returns the new status.
+func (e *Engine) RefreshBlocklist(ctx context.Context, id int64, force bool) (*model.BlocklistStatus, error) {
+	e.blMu.Lock()
+	defer e.blMu.Unlock()
+	st, err := e.store.LoadState(ctx)
+	if err != nil {
+		return nil, err
+	}
+	b := st.Blocklists[id]
+	if b == nil {
+		return nil, errf(KindNotFound, "blocklist %d does not exist", id)
+	}
+	statuses, err := e.store.BlocklistStatuses(ctx)
+	if err != nil {
+		return nil, err
+	}
+	prev := statuses[id]
+	if prev == nil {
+		prev = &model.BlocklistStatus{ID: id}
+	}
+	file := e.cfg.Paths.BlocklistFile(id)
+	now := e.Now()
+	next := *prev
+	next.CheckedAt = &now
+	conditional := !force && prev.URL == b.URL && prev.SHA256 != "" && !isPlaceholder(file)
+	err = e.downloadBlocklist(ctx, st, b, &next, conditional, file)
+	next.URL, next.Error = b.URL, ""
+	if err != nil && !errors.Is(err, errNotModified) {
+		next.Error = err.Error()
+	}
+	if serr := e.store.SetBlocklistStatus(ctx, &next); serr != nil && err == nil {
+		err = serr
+	}
+	if errors.Is(err, errNotModified) {
+		err = nil
+	}
+	return &next, err
+}
+
+// downloadBlocklist fetches, parses, checks and installs a list, filling
+// in s. It returns errNotModified when there is nothing to do.
+func (e *Engine) downloadBlocklist(ctx context.Context, st *model.State, b *model.Blocklist, s *model.BlocklistStatus, conditional bool, file string) error {
+	ctx, cancel := context.WithTimeout(ctx, e.Limits.Timeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, b.URL, nil)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("User-Agent", "Jarl/"+version.Short()+" (blocklist download)")
+	if conditional {
+		if s.ETag != "" {
+			req.Header.Set("If-None-Match", s.ETag)
+		}
+		if s.LastModified != "" {
+			req.Header.Set("If-Modified-Since", s.LastModified)
+		}
+	}
+	client := e.HTTP
+	if client == nil {
+		client = http.DefaultClient
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("download failed: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusNotModified && conditional {
+		return errNotModified
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("download failed: the server answered %s", resp.Status)
+	}
+	zone := blocking.ListZone(b.Name)
+	body := &limitedReader{r: resp.Body, left: e.Limits.MaxBytes}
+	l, err := blocking.Parse(body, blocking.Limits{MaxEntries: e.Limits.MaxEntries, MaxNameLen: 253 - len(zone) - 3})
+	if body.over {
+		return fmt.Errorf("the list is larger than %d MB (blocking.max_download_mb in jarl.yaml)", e.Limits.MaxBytes>>20)
+	}
+	if errors.Is(err, blocking.ErrTooManyEntries) {
+		return fmt.Errorf("%v (blocking.max_entries in jarl.yaml)", err)
+	}
+	if err != nil {
+		return fmt.Errorf("download failed: %w", err)
+	}
+	if len(l.Domains) == 0 {
+		return fmt.Errorf("no domains found in %d lines: is this a blocklist in hosts, domains or Adblock format?", l.Lines)
+	}
+	entries, skipped := len(l.Domains), l.Skipped
+	blocking.Compact(l)
+
+	dir := filepath.Dir(file)
+	if err := e.deploy.EnsureDir(dir, e.deploy.dirMode(dir)); err != nil {
+		return err
+	}
+	tmp, err := os.CreateTemp(dir, ".list-*.rpz")
+	if err != nil {
+		return err
+	}
+	tmpName := tmp.Name()
+	defer os.Remove(tmpName) // after a successful rename, there's nothing to remove
+	records, hash, err := blocking.FeedZone(tmp, fmt.Sprintf("Blocklist %s from %s, %s", b.Name, b.URL, e.Now().UTC().Format(time.RFC3339)), uint32(e.Now().Unix()), l)
+	if cerr := tmp.Close(); err == nil {
+		err = cerr
+	}
+	if err != nil {
+		return err
+	}
+	s.ETag, s.LastModified = resp.Header.Get("ETag"), resp.Header.Get("Last-Modified")
+	s.Entries, s.Skipped = entries, skipped
+	if hash == s.SHA256 && s.URL == b.URL && !isPlaceholder(file) {
+		return errNotModified // same content: named keeps what it has
+	}
+	if e.tools != nil && !e.cfg.SkipCheck {
+		res, err := e.tools.CheckZone(ctx, zone, tmpName)
+		if err != nil {
+			return fmt.Errorf("running named-checkzone failed: %w", err)
+		}
+		if !res.OK {
+			msg := "named-checkzone rejected the list's zone"
+			for _, m := range res.Messages {
+				if m.Error {
+					msg += ": " + m.Text
+					break
+				}
+			}
+			return errors.New(msg)
+		}
+	}
+	if err := e.deploy.finish(tmpName, file, 0o640); err != nil {
+		return err
+	}
+	now := e.Now()
+	s.UpdatedAt, s.Records, s.SHA256 = &now, records, hash
+	e.log.Info("blocklist updated", "list", b.Name, "domains", entries, "records", records, "skipped_lines", skipped)
+	return e.reloadBlocklist(ctx, st, b)
+}
+
+// reloadBlocklist makes named load a list's new file in every view that
+// uses it.
+func (e *Engine) reloadBlocklist(ctx context.Context, st *model.State, b *model.Blocklist) error {
+	if e.cfg.NoReload || e.tools == nil {
+		return nil
+	}
+	if adopted, err := e.Adopted(); err != nil || !adopted {
+		return nil // the file is ready for when named loads Jarl's configuration
+	}
+	for _, z := range render.PolicyZones(st, e.cfg.Paths) {
+		if z.ListID != b.ID {
+			continue
+		}
+		if err := e.tools.ReloadZone(ctx, z.Name, z.View); err != nil {
+			return fmt.Errorf("the list was downloaded, but named didn't reload it: %w", err)
+		}
+	}
+	return nil
+}
+
+// limitedReader reads at most left bytes and notes when there was more.
+type limitedReader struct {
+	r    io.Reader
+	left int64
+	over bool
+}
+
+func (l *limitedReader) Read(p []byte) (int, error) {
+	if l.left <= 0 {
+		var one [1]byte
+		if n, _ := l.r.Read(one[:]); n > 0 {
+			l.over = true
+		}
+		return 0, io.EOF
+	}
+	if int64(len(p)) > l.left {
+		p = p[:l.left]
+	}
+	n, err := l.r.Read(p)
+	l.left -= int64(n)
+	return n, err
+}
+
+// CheckBlocking reports, for every view with blocking, whether name is
+// blocked or allowed there, and by which rule or list. It looks names up
+// the way named does: rules first, then the lists in order. The answer is
+// for clients at the normal step; a list of a higher step that blocks the
+// name says so (Match.Step), and clients at step off skip every list.
+func (e *Engine) CheckBlocking(st *model.State, name string) ([]blocking.Match, error) {
+	n, err := blocking.NormalizeName(name)
+	if err != nil {
+		return nil, errf(KindBadRequest, "%v", err)
+	}
+	var out []blocking.Match
+	feeds := map[string]string{} // file -> matching entry ("" none)
+	var cur *blocking.Match
+	for _, z := range render.PolicyZones(st, e.cfg.Paths) {
+		if cur == nil || cur.View != z.View {
+			out = append(out, blocking.Match{View: z.View, Result: "none"})
+			cur = &out[len(out)-1]
+		}
+		if cur.Result != "none" || z.IsGate() {
+			continue // an earlier zone decided, or a gate (it never blocks)
+		}
+		if z.ListID == 0 {
+			owner, act, ok := blocking.MatchRules(blocking.RuleEntries(render.ViewRules(st, z.ViewID)), n)
+			if ok {
+				cur.Entry, cur.RuleID = owner, ruleFor(st, z.ViewID, owner)
+				cur.Result = map[string]string{blocking.ActionBlock: "blocked", blocking.ActionAllow: "allowed"}[act]
+			}
+			continue
+		}
+		entry, seen := feeds[z.File]
+		if !seen {
+			owner, ok, err := blocking.MatchFeed(z.File, n)
+			if err != nil && !errors.Is(err, fs.ErrNotExist) {
+				return nil, err
+			}
+			if ok {
+				entry = owner
+			}
+			feeds[z.File] = entry
+		}
+		if entry != "" {
+			b := st.Blocklists[z.ListID]
+			cur.Result, cur.Entry, cur.List = "blocked", entry, b.Name
+			if b.StepID != model.StepNormal {
+				cur.Step = st.StepName(b.StepID)
+			}
+		}
+	}
+	return out, nil
+}
+
+// ruleFor finds the rule behind a rules-zone entry: the rule for the
+// entry's name, or (for entries added so the most specific rule wins) the
+// closest rule above it that covers the names below it.
+func ruleFor(st *model.State, viewID int64, owner string) int64 {
+	name := strings.TrimPrefix(owner, "*.")
+	wild := name != owner
+	var best *model.BlockRule
+	for _, r := range st.SortedBlockRules() {
+		if !slices.Contains(st.BlockingViews(r.ViewIDs), viewID) {
+			continue
+		}
+		if r.Name == name && (!wild || !r.Exact) {
+			return r.ID
+		}
+		if !r.Exact && strings.HasSuffix(name, "."+r.Name) && (best == nil || len(r.Name) > len(best.Name)) {
+			best = r
+		}
+	}
+	if best != nil {
+		return best.ID
+	}
+	return 0
+}

internal/engine/blockops.go

@@ -0,0 +1,327 @@
+package engine
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"regexp"
+	"slices"
+	"strings"
+	"time"
+
+	"jarl/internal/auth"
+	"jarl/internal/blocking"
+	"jarl/internal/model"
+)
+
+// ---- blocking: blocklists and rules (docs/blocking.md)
+
+var blocklistNameRe = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$`)
+
+func blockingAction() auth.Action { return auth.Action{Resource: auth.ResBlocking, Write: true} }
+
+// viewIDs resolves the views of a blocklist or rule input: names or IDs,
+// in view order, without duplicates. nil, nil means "not given".
+func viewIDs(st *model.State, names *[]string, ids *[]int64) ([]int64, error) {
+	if names == nil && ids == nil {
+		return nil, nil
+	}
+	want := map[int64]bool{}
+	if names != nil {
+		for _, n := range *names {
+			v := st.ViewByName(strings.TrimSpace(n))
+			if v == nil {
+				return nil, errf(KindBadRequest, "view %q does not exist", n)
+			}
+			want[v.ID] = true
+		}
+	}
+	if ids != nil {
+		for _, id := range *ids {
+			if st.Views[id] == nil {
+				return nil, errf(KindBadRequest, "view %d does not exist", id)
+			}
+			want[id] = true
+		}
+	}
+	out := []int64{}
+	for _, v := range st.OrderedViews() {
+		if want[v.ID] {
+			out = append(out, v.ID)
+		}
+	}
+	return out, nil
+}
+
+// CheckBlocklistURL checks a blocklist URL: http or https, with a host.
+func CheckBlocklistURL(raw string) (string, error) {
+	raw = strings.TrimSpace(raw)
+	u, err := url.Parse(raw)
+	if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
+		return "", fmt.Errorf("%q is not an http or https URL", raw)
+	}
+	return raw, nil
+}
+
+func applyBlocklistPut(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	var in BlocklistInput
+	if err := decode(op.Data, &in); err != nil {
+		return err
+	}
+	var b *model.Blocklist
+	if op.Kind == OpBlocklistCreate {
+		if op.ID == 0 || st.Blocklists[op.ID] != nil {
+			return errf(KindConflict, "blocklist ID %d is already in use", op.ID)
+		}
+		if in.Name == nil || in.URL == nil {
+			return errf(KindBadRequest, "a blocklist needs a name and a URL")
+		}
+		b = &model.Blocklist{ID: op.ID, ViewIDs: []int64{}}
+	} else {
+		b = st.Blocklists[op.ID]
+		if b == nil {
+			return errf(KindNotFound, "blocklist %d does not exist", op.ID)
+		}
+		if err := checkVersion(op, b.Version, "blocklist "+b.Name); err != nil {
+			return err
+		}
+	}
+	if in.Name != nil {
+		name := strings.ToLower(strings.TrimSpace(*in.Name))
+		if !blocklistNameRe.MatchString(name) {
+			return errf(KindBadRequest, "blocklist name %q: use 1 to 40 lowercase letters, digits and hyphens, like hagezi-pro", *in.Name)
+		}
+		if other := st.BlocklistByName(name); other != nil && other.ID != b.ID {
+			return errf(KindConflict, "blocklist %s already exists", name)
+		}
+		b.Name = name
+	}
+	if in.URL != nil {
+		u, err := CheckBlocklistURL(*in.URL)
+		if err != nil {
+			return errf(KindBadRequest, "%v", err)
+		}
+		b.URL = u
+	}
+	ids, err := viewIDs(st, in.Views, in.ViewIDs)
+	if err != nil {
+		return err
+	}
+	if ids != nil {
+		b.ViewIDs = ids
+	}
+	if in.Disabled != nil {
+		b.Disabled = *in.Disabled
+	}
+	step, given, err := stepRef(st, in.Step, in.StepID)
+	if err != nil {
+		return err
+	}
+	if given {
+		if step == model.StepOff {
+			return errf(KindBadRequest, "a blocklist starts at normal or a step above it, not off")
+		}
+		b.StepID = step
+	}
+	if in.Comment != nil {
+		b.Comment = *in.Comment
+	}
+	b.Touch(c.user(), c.now)
+	st.Blocklists[b.ID] = b
+	return nil
+}
+
+func applyBlocklistDelete(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	b := st.Blocklists[op.ID]
+	if b == nil {
+		return errf(KindNotFound, "blocklist %d does not exist", op.ID)
+	}
+	if err := checkVersion(op, b.Version, "blocklist "+b.Name); err != nil {
+		return err
+	}
+	delete(st.Blocklists, b.ID)
+	return nil
+}
+
+func applyBlockRulePut(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	var in BlockRuleInput
+	if err := decode(op.Data, &in); err != nil {
+		return err
+	}
+	var r *model.BlockRule
+	if op.Kind == OpBlockRuleCreate {
+		if op.ID == 0 || st.BlockRules[op.ID] != nil {
+			return errf(KindConflict, "rule ID %d is already in use", op.ID)
+		}
+		if in.Name == nil {
+			return errf(KindBadRequest, "a rule needs a domain name")
+		}
+		r = &model.BlockRule{ID: op.ID, Action: model.BlockActionBlock, ViewIDs: []int64{}}
+	} else {
+		r = st.BlockRules[op.ID]
+		if r == nil {
+			return errf(KindNotFound, "rule %d does not exist", op.ID)
+		}
+		if err := checkVersion(op, r.Version, "rule "+r.Name); err != nil {
+			return err
+		}
+	}
+	if in.Name != nil {
+		n, err := blocking.NormalizeName(*in.Name)
+		if err != nil {
+			return errf(KindBadRequest, "%v", err)
+		}
+		r.Name = n
+	}
+	if in.Action != nil {
+		a := strings.ToLower(strings.TrimSpace(*in.Action))
+		if a != model.BlockActionBlock && a != model.BlockActionAllow {
+			return errf(KindBadRequest, "a rule's action is block or allow, not %q", *in.Action)
+		}
+		r.Action = a
+	}
+	if in.Exact != nil {
+		r.Exact = *in.Exact
+	}
+	ids, err := viewIDs(st, in.Views, in.ViewIDs)
+	if err != nil {
+		return err
+	}
+	if ids != nil {
+		r.ViewIDs = ids
+	}
+	if in.Comment != nil {
+		r.Comment = *in.Comment
+	}
+	r.Touch(c.user(), c.now)
+	st.BlockRules[r.ID] = r
+	return nil
+}
+
+func applyBlockRuleDelete(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	r := st.BlockRules[op.ID]
+	if r == nil {
+		return errf(KindNotFound, "rule %d does not exist", op.ID)
+	}
+	if err := checkVersion(op, r.Version, "rule "+r.Name); err != nil {
+		return err
+	}
+	delete(st.BlockRules, r.ID)
+	return nil
+}
+
+// blockingUsers lists the blocklists and rules that name a view.
+func blockingUsers(st *model.State, viewID int64) []string {
+	var out []string
+	for _, b := range st.SortedBlocklists() {
+		if slices.Contains(b.ViewIDs, viewID) {
+			out = append(out, "blocklist "+b.Name)
+		}
+	}
+	for _, r := range st.SortedBlockRules() {
+		if slices.Contains(r.ViewIDs, viewID) {
+			out = append(out, ruleLabel(r))
+		}
+	}
+	for _, g := range st.SortedClientGroups() {
+		if slices.Contains(g.ViewIDs, viewID) {
+			out = append(out, "client group "+g.Name)
+		}
+	}
+	return out
+}
+
+// ruleLabel describes a rule: "block ads.example (and below)".
+func ruleLabel(r *model.BlockRule) string {
+	s := r.Action + " " + r.Name
+	if !r.Exact {
+		s += " (and below)"
+	}
+	return s
+}
+
+// ---- expansion
+
+func (x *expander) blocklistCreate(req Request) ([]model.Op, error) {
+	return x.simpleCreate(req, OpBlocklistCreate, func(data json.RawMessage) (string, error) {
+		var in BlocklistInput
+		if err := decode(data, &in); err != nil {
+			return "", err
+		}
+		if in.Name == nil || in.URL == nil {
+			return "", errf(KindBadRequest, "a blocklist needs a name and a URL")
+		}
+		return "add blocklist " + *in.Name + " (" + *in.URL + ")", nil
+	})
+}
+
+func (x *expander) blockRuleCreate(req Request) ([]model.Op, error) {
+	return x.simpleCreate(req, OpBlockRuleCreate, func(data json.RawMessage) (string, error) {
+		var in BlockRuleInput
+		if err := decode(data, &in); err != nil {
+			return "", err
+		}
+		if in.Name == nil {
+			return "", errf(KindBadRequest, "a rule needs a domain name")
+		}
+		r := &model.BlockRule{Name: strings.ToLower(strings.TrimSuffix(strings.TrimSpace(*in.Name), ".")), Action: model.BlockActionBlock}
+		if in.Action != nil {
+			r.Action = strings.ToLower(*in.Action)
+		}
+		if in.Exact != nil {
+			r.Exact = *in.Exact
+		}
+		return ruleLabel(r), nil
+	})
+}
+
+func applyBlockingPause(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	var in BlockingPauseInput
+	if err := decode(op.Data, &in); err != nil {
+		return err
+	}
+	if in.Until != nil && in.Until.Sub(c.now) > MaxBlockingPause+time.Minute {
+		return errf(KindBadRequest, "blocking can be paused for at most %s, or until it is resumed", MaxBlockingPause)
+	}
+	if in.Indefinitely && in.Until != nil {
+		return errf(KindBadRequest, "a pause is either until a time or until resumed, not both")
+	}
+	st.Settings.BlockingPausedUntil = in.Until
+	st.Settings.BlockingPausedIndefinitely = in.Indefinitely
+	return nil
+}
+
+// ResumeBlocking ends a pause whose time is up, and returns when the
+// current pause ends (zero when blocking isn't paused).
+func (e *Engine) ResumeBlocking(ctx context.Context) time.Time {
+	st, err := e.store.LoadState(ctx)
+	if err != nil || st.Settings.BlockingPausedUntil == nil {
+		return time.Time{}
+	}
+	until := *st.Settings.BlockingPausedUntil
+	if e.Now().Before(until) {
+		return until
+	}
+	if _, err := e.Submit(ctx, []Request{NewRequest(OpBlockingPause, 0, BlockingPauseInput{})}, auth.System, "system", "resume blocking after the pause", ApplyOptions{}); err != nil {
+		e.log.Warn("resuming blocking after the pause failed; it will be tried again", "err", err)
+		return e.Now().Add(time.Minute)
+	}
+	e.log.Info("blocking resumed after the pause")
+	return time.Time{}
+}

internal/engine/clientgroups.go

@@ -0,0 +1,270 @@
+package engine
+
+import (
+	"encoding/json"
+	"net/netip"
+	"strings"
+
+	"jarl/internal/iprange"
+	"jarl/internal/model"
+)
+
+// ---- blocking steps and client groups (docs/blocking.md)
+
+// stepRef resolves a step given by name or ID. ok is false when neither
+// is given.
+func stepRef(st *model.State, name *string, id *int64) (int64, bool, error) {
+	switch {
+	case name != nil:
+		s, found := st.StepByName(*name)
+		if !found {
+			return 0, true, errf(KindBadRequest, "blocking step %q does not exist (steps: %s)", *name, stepNames(st))
+		}
+		return s, true, nil
+	case id != nil:
+		if _, found := st.StepRank(*id); !found {
+			return 0, true, errf(KindBadRequest, "blocking step %d does not exist", *id)
+		}
+		return *id, true, nil
+	}
+	return 0, false, nil
+}
+
+// stepNames lists the steps for messages: "off, normal, strict".
+func stepNames(st *model.State) string {
+	names := []string{"off", "normal"}
+	for _, s := range st.OrderedBlockSteps() {
+		names = append(names, s.Name)
+	}
+	return strings.Join(names, ", ")
+}
+
+// NormalizeMember checks a client group member: an address, a prefix or
+// an ACL name (an ACL's own elements are checked by validation). It
+// returns the canonical form.
+func NormalizeMember(st *model.State, m string) (string, error) {
+	m = strings.TrimSpace(m)
+	if a, err := netip.ParseAddr(m); err == nil {
+		if a.Zone() != "" {
+			return "", errf(KindBadRequest, "%q: an address with a zone can't be matched", m)
+		}
+		return a.Unmap().String(), nil
+	}
+	if p, err := netip.ParsePrefix(m); err == nil {
+		return p.Masked().String(), nil
+	}
+	if r, ok, err := iprange.Parse(m); ok {
+		if err != nil {
+			return "", errf(KindBadRequest, "%v", err)
+		}
+		return r.String(), nil
+	}
+	if a := st.ACLByName(m); a != nil {
+		return a.Name, nil
+	}
+	return "", errf(KindBadRequest, "%q is not an address, a prefix (10.10.0.0/24), a range (10.10.0.20-10.10.0.49) or an ACL", m)
+}
+
+func applyBlockStepPut(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	var in BlockStepInput
+	if err := decode(op.Data, &in); err != nil {
+		return err
+	}
+	var s *model.BlockStep
+	if op.Kind == OpBlockStepCreate {
+		if op.ID <= 0 || st.BlockSteps[op.ID] != nil {
+			return errf(KindConflict, "step ID %d is already in use", op.ID)
+		}
+		if in.Name == nil {
+			return errf(KindBadRequest, "a blocking step needs a name")
+		}
+		pos := 0
+		for _, o := range st.BlockSteps {
+			pos = max(pos, o.Position+1)
+		}
+		s = &model.BlockStep{ID: op.ID, Position: pos}
+	} else {
+		s = st.BlockSteps[op.ID]
+		if s == nil {
+			return errf(KindNotFound, "blocking step %d does not exist", op.ID)
+		}
+		if err := checkVersion(op, s.Version, "step "+s.Name); err != nil {
+			return err
+		}
+	}
+	if in.Name != nil {
+		name := strings.ToLower(strings.TrimSpace(*in.Name))
+		if !blocklistNameRe.MatchString(name) || name == "off" || name == "normal" {
+			return errf(KindBadRequest, "step name %q: use 1 to 40 lowercase letters, digits and hyphens, like strict (off and normal are built in)", *in.Name)
+		}
+		if id, found := st.StepByName(name); found && id != s.ID {
+			return errf(KindConflict, "step %s already exists", name)
+		}
+		s.Name = name
+	}
+	if in.Position != nil {
+		s.Position = *in.Position
+	}
+	if in.Comment != nil {
+		s.Comment = *in.Comment
+	}
+	s.Touch(c.user(), c.now)
+	st.BlockSteps[s.ID] = s
+	return nil
+}
+
+func applyBlockStepDelete(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	s := st.BlockSteps[op.ID]
+	if s == nil {
+		return errf(KindNotFound, "blocking step %d does not exist", op.ID)
+	}
+	if err := checkVersion(op, s.Version, "step "+s.Name); err != nil {
+		return err
+	}
+	if users := stepUsers(st, s.ID); len(users) > 0 {
+		return errf(KindConflict, "step %s is used by %s; move them to another step first", s.Name, strings.Join(users, ", "))
+	}
+	delete(st.BlockSteps, s.ID)
+	return nil
+}
+
+// stepUsers lists the blocklists and client groups at a step.
+func stepUsers(st *model.State, id int64) []string {
+	var out []string
+	for _, b := range st.SortedBlocklists() {
+		if b.StepID == id {
+			out = append(out, "blocklist "+b.Name)
+		}
+	}
+	for _, g := range st.SortedClientGroups() {
+		if g.StepID == id {
+			out = append(out, "client group "+g.Name)
+		}
+	}
+	return out
+}
+
+func applyClientGroupPut(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	var in ClientGroupInput
+	if err := decode(op.Data, &in); err != nil {
+		return err
+	}
+	var g *model.ClientGroup
+	if op.Kind == OpClientGroupCreate {
+		if op.ID <= 0 || st.ClientGroups[op.ID] != nil {
+			return errf(KindConflict, "client group ID %d is already in use", op.ID)
+		}
+		if in.Name == nil {
+			return errf(KindBadRequest, "a client group needs a name")
+		}
+		g = &model.ClientGroup{ID: op.ID, Members: []string{}, StepID: model.StepNormal, ViewIDs: []int64{}}
+	} else {
+		g = st.ClientGroups[op.ID]
+		if g == nil {
+			return errf(KindNotFound, "client group %d does not exist", op.ID)
+		}
+		if err := checkVersion(op, g.Version, "client group "+g.Name); err != nil {
+			return err
+		}
+	}
+	if in.Name != nil {
+		name := strings.ToLower(strings.TrimSpace(*in.Name))
+		if !blocklistNameRe.MatchString(name) {
+			return errf(KindBadRequest, "client group name %q: use 1 to 40 lowercase letters, digits and hyphens, like kids", *in.Name)
+		}
+		if other := st.ClientGroupByName(name); other != nil && other.ID != g.ID {
+			return errf(KindConflict, "client group %s already exists", name)
+		}
+		g.Name = name
+	}
+	if in.Members != nil {
+		members := []string{}
+		seen := map[string]bool{}
+		for _, m := range *in.Members {
+			if strings.TrimSpace(m) == "" {
+				continue
+			}
+			n, err := NormalizeMember(st, m)
+			if err != nil {
+				return err
+			}
+			if !seen[n] {
+				seen[n] = true
+				members = append(members, n)
+			}
+		}
+		g.Members = members
+	}
+	step, given, err := stepRef(st, in.Step, in.StepID)
+	if err != nil {
+		return err
+	}
+	if given {
+		g.StepID = step
+	}
+	ids, err := viewIDs(st, in.Views, in.ViewIDs)
+	if err != nil {
+		return err
+	}
+	if ids != nil {
+		g.ViewIDs = ids
+	}
+	if in.Comment != nil {
+		g.Comment = *in.Comment
+	}
+	g.Touch(c.user(), c.now)
+	st.ClientGroups[g.ID] = g
+	return nil
+}
+
+func applyClientGroupDelete(st *model.State, op model.Op, c *applyCtx) error {
+	if err := c.require(blockingAction()); err != nil {
+		return err
+	}
+	g := st.ClientGroups[op.ID]
+	if g == nil {
+		return errf(KindNotFound, "client group %d does not exist", op.ID)
+	}
+	if err := checkVersion(op, g.Version, "client group "+g.Name); err != nil {
+		return err
+	}
+	delete(st.ClientGroups, g.ID)
+	return nil
+}
+
+// ---- expansion
+
+func (x *expander) blockStepCreate(req Request) ([]model.Op, error) {
+	return x.simpleCreate(req, OpBlockStepCreate, func(data json.RawMessage) (string, error) {
+		var in BlockStepInput
+		if err := decode(data, &in); err != nil {
+			return "", err
+		}
+		if in.Name == nil {
+			return "", errf(KindBadRequest, "a blocking step needs a name")
+		}
+		return "add blocking step " + strings.ToLower(*in.Name), nil
+	})
+}
+
+func (x *expander) clientGroupCreate(req Request) ([]model.Op, error) {
+	return x.simpleCreate(req, OpClientGroupCreate, func(data json.RawMessage) (string, error) {
+		var in ClientGroupInput
+		if err := decode(data, &in); err != nil {
+			return "", err
+		}
+		if in.Name == nil {
+			return "", errf(KindBadRequest, "a client group needs a name")
+		}
+		return "add client group " + strings.ToLower(*in.Name), nil
+	})
+}

internal/engine/clientgroups_test.go

@@ -0,0 +1,123 @@
+package engine
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+)
+
+func clientGroup(name, step string, members ...string) Request {
+	return NewRequest(OpClientGroupCreate, 0, ClientGroupInput{Name: &name, Step: &step, Members: &members})
+}
+
+func TestClientGroups(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	_, srv := newListServer(t, "||ads.example^\n")
+	env.submit(env.admin,
+		NewRequest(OpBlockStepCreate, 0, BlockStepInput{Name: model.Ptr("strict")}),
+		NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("tablets"), Elements: &[]string{"10.0.0.50", "10.0.0.51"}}),
+	)
+	env.submit(env.admin,
+		blocklist("ads", srv.URL+"/a.txt"),
+		NewRequest(OpBlocklistCreate, 0, BlocklistInput{Name: model.Ptr("social"), URL: model.Ptr(srv.URL + "/s.txt"), Step: model.Ptr("strict")}),
+		clientGroup("work", "off", "10.0.0.20"),
+		clientGroup("kids", "strict", "tablets", "2001:db8:1::/64"),
+	)
+	conf, _ := os.ReadFile(filepath.Join(env.dir, "etc/named.conf"))
+	c := string(conf)
+	// Off clients pass before the normal lists, everyone below strict
+	// before the strict ones; gates aren't logged.
+	want := "response-policy {\n" +
+		"\t\tzone \"off.gate.jarl.invalid\" min-update-interval 0 log no;\n" +
+		"\t\tzone \"ads.blocklist.jarl.invalid\" min-update-interval 0 log no;\n" +
+		"\t\tzone \"strict.gate.jarl.invalid\" min-update-interval 0 log no;\n" +
+		"\t\tzone \"social.blocklist.jarl.invalid\" min-update-interval 0 log no;\n"
+	if !strings.Contains(c, want) {
+		t.Errorf("response-policy:\n%s", c)
+	}
+	gate := func(name string) string {
+		b, err := os.ReadFile(filepath.Join(env.dir, "zones/_default", name+".gate.jarl.invalid.rpz"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		return string(b)
+	}
+	if g := gate("off"); !strings.Contains(g, "32.20.0.0.10.rpz-client-ip\tCNAME\trpz-passthru.\n") || strings.Count(g, "rpz-client-ip") != 1 {
+		t.Errorf("off gate:\n%s", g)
+	}
+	// Everyone but the kids' tablets (via the ACL) and network passes.
+	sg := gate("strict")
+	for _, notIn := range []string{"32.50.0.0.10.rpz-client-ip", "32.51.0.0.10.rpz-client-ip", "64.zz.1.db8.2001.rpz-client-ip"} {
+		if strings.Contains(sg, notIn) {
+			t.Errorf("strict gate lets %s through:\n%s", notIn, sg)
+		}
+	}
+	// 10.0.0.0/27 holds the work laptop, 10.0.0.52/30 the next addresses
+	// after the tablets, 128.0.0.0/1 the upper half of IPv4.
+	for _, in := range []string{"27.0.0.0.10.rpz-client-ip", "30.52.0.0.10.rpz-client-ip", "1.0.0.0.128.rpz-client-ip"} {
+		if !strings.Contains(sg, in) {
+			t.Errorf("strict gate lacks %s:\n%s", in, sg)
+		}
+	}
+
+	st := env.state()
+	strict, _ := st.StepByName("strict")
+	// A step that lists or groups use can't be deleted.
+	if e := env.submitErr(env.admin, NewRequest(OpBlockStepDelete, strict, nil)); e.Kind != KindConflict || !strings.Contains(e.Message, "blocklist social") {
+		t.Errorf("deleting a used step: %+v", e)
+	}
+	// One client, one group; ACLs must hold addresses only.
+	if e := env.submitErr(env.admin, clientGroup("dup", "normal", "10.0.0.20")); e.Kind != KindValidation || !strings.Contains(e.Message, "10.0.0.20/32 is in client groups") {
+		t.Errorf("an address in two groups: %+v", e)
+	}
+	env.submit(env.admin, NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("keyed"), Elements: &[]string{"localnets"}}))
+	if e := env.submitErr(env.admin, clientGroup("bad", "normal", "keyed")); e.Kind != KindValidation || !strings.Contains(e.Message, "isn't an address") {
+		t.Errorf("an ACL with a key: %+v", e)
+	}
+	for _, req := range []Request{clientGroup("x", "nope", "10.1.1.1"), clientGroup("y", "normal", "not-an-acl"), clientGroup("Bad Name", "normal")} {
+		if e := env.submitErr(env.admin, req); e.Kind != KindBadRequest {
+			t.Errorf("%s: %+v", req.Data, e)
+		}
+	}
+	// A more specific address in another group is fine: it wins.
+	env.submit(env.admin, clientGroup("guest", "normal", "2001:db8:1::9"))
+	if sg := gate("strict"); !strings.Contains(sg, "128.9.zz.1.db8.2001.rpz-client-ip") {
+		t.Errorf("the guest inside the kids' network passes the strict gate:\n%s", sg)
+	}
+
+	// The kids' group gone: the strict list blocks nobody (a warning).
+	kids := env.state().ClientGroupByName("kids")
+	res := env.submit(env.admin, NewRequest(OpClientGroupDelete, kids.ID, nil))
+	found := false
+	for _, p := range res.Problems {
+		found = found || p.Code == "blocklist_step_unused"
+	}
+	if !found {
+		t.Errorf("no warning for a step no group reaches: %+v", res.Problems)
+	}
+	// Reverting brings it back.
+	rev, err := env.e.Revert(context.Background(), res.ChangesetID, env.admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rev.Ops) != 1 {
+		t.Errorf("revert ops: %+v (only the deleted group should come back)", rev.Ops)
+	}
+	if _, err := env.e.Apply(context.Background(), rev.ID, env.admin, ApplyOptions{}); err != nil || env.state().ClientGroupByName("kids") == nil {
+		t.Fatalf("revert: %v", err)
+	}
+	// Renaming the ACL renames the member; deleting it is refused.
+	tablets := env.state().ACLByName("tablets")
+	env.submit(env.admin, NewRequest(OpACLUpdate, tablets.ID, ACLInput{Name: model.Ptr("pads")}))
+	if g := env.state().ClientGroupByName("kids"); g.Members[0] != "pads" {
+		t.Errorf("ACL rename: members %v", g.Members)
+	}
+	if e := env.submitErr(env.admin, NewRequest(OpACLDelete, tablets.ID, nil)); e.Kind != KindConflict || !strings.Contains(e.Message, "client group kids") {
+		t.Errorf("deleting an ACL a group uses: %+v", e)
+	}
+}

internal/engine/deploy.go

@@ -183,6 +183,48 @@ func (d *Deployer) writeAtomic(path string, content []byte, mode fs.FileMode) er
 	return nil
 }
 
+// writeNew creates a file that doesn't exist yet (fs.ErrExist if it
+// does), with the deploy group.
+func (d *Deployer) writeNew(path string, content []byte, mode fs.FileMode) error {
+	dir := filepath.Dir(path)
+	if err := d.EnsureDir(dir, d.dirMode(dir)); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
+	if err != nil {
+		return err
+	}
+	_, err = f.Write(content)
+	if gid, gerr := d.groupID(); err == nil && gerr == nil && gid >= 0 {
+		err = f.Chown(-1, gid)
+	}
+	if cerr := f.Close(); err == nil {
+		err = cerr
+	}
+	if err != nil {
+		os.Remove(path)
+	}
+	return err
+}
+
+// finish gives a temporary file written next to path its mode and the
+// deploy group, and moves it into place.
+func (d *Deployer) finish(tmp, path string, mode fs.FileMode) error {
+	if err := os.Chmod(tmp, mode); err != nil {
+		return err
+	}
+	gid, err := d.groupID()
+	if err != nil {
+		return err
+	}
+	if gid >= 0 {
+		if err := os.Chown(tmp, -1, gid); err != nil {
+			return fmt.Errorf("chgrp %s: %w", path, err)
+		}
+	}
+	return os.Rename(tmp, path)
+}
+
 // Install writes files and removes paths, returning a backup that undoes
 // the changes. On error the files already written are restored.
 func (d *Deployer) Install(files []*render.File, remove []string, dirs []string) (*Backup, error) {
@@ -293,5 +335,8 @@ func fileDiff(path string, old []byte, existed bool, new []byte, removed, secret
 	if d != "" && !strings.HasSuffix(d, "\n") {
 		d += "\n"
 	}
+	if strings.HasSuffix(path, ".conf") {
+		d = labelHunks(d, string(old), string(new))
+	}
 	return d
 }

internal/engine/diffcontext.go

@@ -0,0 +1,136 @@
+package engine
+
+import (
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// hunkHeader matches a unified diff hunk header; the line counts are left
+// out when they are 1.
+var hunkHeader = regexp.MustCompile(`^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@$`)
+
+// labelHunks adds the blocks a hunk's first change is in to its header,
+// like git does with function names, so a change to named.conf says where
+// it is:
+//
+//	@@ -50,6 +49,8 @@ view "internal" {
+//
+// Removed lines are looked up in the old file, added ones in the new.
+func labelHunks(diff, old, new string) string {
+	if !strings.Contains(diff, "\n@@ ") {
+		return diff
+	}
+	oldCtx, newCtx := blockContext(old), blockContext(new)
+	lines := strings.SplitAfter(diff, "\n")
+	for i, line := range lines {
+		m := hunkHeader.FindStringSubmatch(strings.TrimSuffix(line, "\n"))
+		if m == nil {
+			continue
+		}
+		o, _ := strconv.Atoi(m[1])
+		n, _ := strconv.Atoi(m[2])
+		label := ""
+	hunk:
+		for _, l := range lines[i+1:] {
+			switch {
+			case strings.HasPrefix(l, "-"):
+				label = at(oldCtx, o)
+				break hunk
+			case strings.HasPrefix(l, "+"):
+				label = at(newCtx, n)
+				break hunk
+			case strings.HasPrefix(l, " "):
+				o, n = o+1, n+1
+			case strings.HasPrefix(l, `\`):
+			default:
+				break hunk
+			}
+		}
+		if label != "" {
+			lines[i] = strings.TrimSuffix(line, "\n") + " " + label + "\n"
+		}
+	}
+	return strings.Join(lines, "")
+}
+
+// at returns the context of line n (1-based), or "".
+func at(ctx []string, n int) string {
+	if n < 1 || n > len(ctx) {
+		return ""
+	}
+	return ctx[n-1]
+}
+
+// blockContext returns, for each line of a named.conf file, the blocks
+// open at its start: `view "internal" { zone "example.com" {`, or "" at
+// the top level. It knows named.conf's strings and comments.
+func blockContext(text string) []string {
+	var (
+		out     []string
+		stack   []string
+		stmt    strings.Builder // the current statement, up to a { or ;
+		inStr   bool
+		inBlock bool // in a /* */ comment
+	)
+	label := func() string {
+		if len(stack) == 0 {
+			return ""
+		}
+		return strings.Join(stack, " { ") + " {"
+	}
+	for _, line := range strings.SplitAfter(text, "\n") {
+		if line == "" {
+			continue
+		}
+		out = append(out, label())
+		for i := 0; i < len(line); i++ {
+			c := line[i]
+			switch {
+			case inBlock:
+				if c == '*' && i+1 < len(line) && line[i+1] == '/' {
+					inBlock = false
+					i++
+				}
+			case inStr:
+				stmt.WriteByte(c)
+				if c == '\\' && i+1 < len(line) {
+					stmt.WriteByte(line[i+1])
+					i++
+				} else if c == '"' {
+					inStr = false
+				}
+			case c == '"':
+				inStr = true
+				stmt.WriteByte(c)
+			case c == '#' || c == '/' && i+1 < len(line) && line[i+1] == '/':
+				i = len(line) // a comment to the end of the line
+			case c == '/' && i+1 < len(line) && line[i+1] == '*':
+				inBlock = true
+				i++
+			case c == '{':
+				stack = append(stack, shortLabel(stmt.String()))
+				stmt.Reset()
+			case c == '}':
+				if len(stack) > 0 {
+					stack = stack[:len(stack)-1]
+				}
+				stmt.Reset()
+			case c == ';':
+				stmt.Reset()
+			default:
+				stmt.WriteByte(c)
+			}
+		}
+	}
+	return out
+}
+
+// shortLabel tidies the text before a { for a hunk header.
+func shortLabel(s string) string {
+	s = strings.Join(strings.Fields(s), " ")
+	if len(s) > 60 {
+		s = s[:57] + "..."
+	}
+	return s
+}

internal/engine/diffcontext_test.go

@@ -0,0 +1,63 @@
+package engine
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestLabelHunks(t *testing.T) {
+	old := `// header
+options {
+	directory "/var/cache/bind";
+	forwarders { 1.1.1.1; 9.9.9.9; };
+	listen-on { any; };
+	recursion no;
+	version "a { b"; # a { in a string and comments: /* {
+	dnssec-validation auto;
+};
+
+view "internal" {
+	match-clients { 10.0.0.0/8; };
+	recursion yes;
+	allow-transfer { localhost; };
+	/* a { comment
+	   over lines */
+	zone "example.com" {
+		type primary;
+		file "example.com.db";
+		notify yes;
+	};
+	zone "other.example" { type primary; file "o.db"; };
+};
+`
+	new := strings.Replace(old, "\tforwarders { 1.1.1.1; 9.9.9.9; };\n", "", 1)
+	new = strings.Replace(new, "\tallow-transfer { localhost; };\n", "\tallow-transfer { localhost; };\n\tforward first;\n\tforwarders { 1.1.1.1; 9.9.9.9; };\n", 1)
+	new = strings.Replace(new, "\t\tnotify yes;\n", "\t\tnotify no;\n", 1)
+	d := fileDiff("/etc/bind/named.conf", []byte(old), true, []byte(new), false, false)
+	var headers []string
+	for _, l := range strings.Split(d, "\n") {
+		if strings.HasPrefix(l, "@@") {
+			headers = append(headers, l)
+		}
+	}
+	want := []string{
+		`@@ -1,7 +1,6 @@ options {`,
+		`@@ -12,12 +11,14 @@ view "internal" {`,
+	}
+	if strings.Join(headers, "\n") != strings.Join(want, "\n") {
+		t.Errorf("headers:\n%s\n\ndiff:\n%s", strings.Join(headers, "\n"), d)
+	}
+
+	// The first change of a hunk decides, and a change inside a zone
+	// names both blocks.
+	new2 := strings.Replace(old, "\t\tnotify yes;\n", "\t\tnotify no;\n", 1)
+	d = fileDiff("/etc/bind/named.conf", []byte(old), true, []byte(new2), false, false)
+	if !strings.Contains(d, ` @@ view "internal" { zone "example.com" {`+"\n") {
+		t.Errorf("zone change:\n%s", d)
+	}
+	// Zone files aren't named.conf syntax.
+	d = fileDiff("/var/lib/bind/example.com.db", []byte(old), true, []byte(new2), false, false)
+	if strings.Contains(d, "@@ view") {
+		t.Errorf("zone file labelled:\n%s", d)
+	}
+}

internal/engine/diffops.go

@@ -3,6 +3,7 @@ package engine
 import (
 	"fmt"
 	"reflect"
+	"slices"
 	"sort"
 
 	"jarl/internal/dnsname"
@@ -17,10 +18,14 @@ func DiffOps(from, to *model.State) []model.Op {
 	add := func(kind string, id int64, base int, data any, summary string) {
 		ops = append(ops, newOp(kind, id, base, data, summary))
 	}
+	if !reflect.DeepEqual(from.Settings.BlockingPausedUntil, to.Settings.BlockingPausedUntil) || from.Settings.BlockingPausedIndefinitely != to.Settings.BlockingPausedIndefinitely {
+		add(OpBlockingPause, 0, 0, BlockingPauseInput{Until: to.Settings.BlockingPausedUntil, Indefinitely: to.Settings.BlockingPausedIndefinitely}, map[bool]string{true: "pause blocking", false: "resume blocking"}[to.Settings.BlockingPaused()])
+	}
 	if !reflect.DeepEqual(stripVersion(from.Settings), stripVersion(to.Settings)) {
 		s := to.Settings
 		add(OpSettingsUpdate, 0, 0, SettingsInput{DefaultTTL: &s.DefaultTTL, Nameservers: model.Ptr(append([]string{}, s.Nameservers...)), RName: &s.RName,
-			Refresh: &s.Refresh, Retry: &s.Retry, Expire: &s.Expire, NegativeTTL: &s.NegativeTTL, SerialPolicy: &s.SerialPolicy}, "restore settings")
+			Refresh: &s.Refresh, Retry: &s.Retry, Expire: &s.Expire, NegativeTTL: &s.NegativeTTL, SerialPolicy: &s.SerialPolicy,
+			Exposure: &s.Exposure, Acknowledged: model.Ptr(slices.Clone(s.Acknowledged))}, "restore settings")
 	}
 
 	for _, k := range sortedKeys(to.Keys) {
@@ -44,7 +49,8 @@ func DiffOps(from, to *model.State) []model.Op {
 	for _, k := range sortedKeys(to.Views) {
 		n := to.Views[k]
 		in := ViewInput{Name: &n.Name, MatchClients: model.Ptr(append([]string{}, n.MatchClients...)),
-			MatchDestinations: model.Ptr(append([]string{}, n.MatchDestinations...)), Comment: &n.Comment, Position: model.Ptr(n.Position)}
+			MatchDestinations: model.Ptr(append([]string{}, n.MatchDestinations...)), Comment: &n.Comment, Position: model.Ptr(n.Position),
+			Exposure: model.Ptr(n.Exposure), Acknowledged: model.Ptr(slices.Clone(n.Acknowledged))}
 		if n.MatchRecursiveOnly != nil {
 			in.MatchRecursiveOnly = model.Some(*n.MatchRecursiveOnly)
 		} else {
@@ -60,7 +66,7 @@ func DiffOps(from, to *model.State) []model.Op {
 		n := to.Zones[k]
 		s := n.SOA
 		in := ZoneInput{Name: &n.Name, ViewID: &n.ViewID, Type: &n.Type, InView: &n.InView, File: &n.File,
-			DefaultTTL: &n.DefaultTTL, SerialPolicy: &n.SerialPolicy, Comment: &n.Comment}
+			DefaultTTL: &n.DefaultTTL, SerialPolicy: &n.SerialPolicy, DNSSECPolicy: &n.DNSSECPolicy, Comment: &n.Comment, Disabled: &n.Disabled, LinkGroup: model.Ptr(n.LinkGroup)}
 		if n.Type == model.ZonePrimary {
 			in.SOA = &SOAInput{MName: &s.MName, RName: &s.RName, Serial: &s.Serial, Refresh: &s.Refresh, Retry: &s.Retry, Expire: &s.Expire, Minimum: &s.Minimum}
 		}
@@ -88,7 +94,7 @@ func DiffOps(from, to *model.State) []model.Op {
 	}
 	for _, k := range sortedKeys(to.Records) {
 		n := to.Records[k]
-		in := RecordInput{ZoneID: n.ZoneID, Name: &n.Name, Type: &n.Type, Data: &n.Data, Comment: &n.Comment}
+		in := RecordInput{ZoneID: n.ZoneID, Name: &n.Name, Type: &n.Type, Data: &n.Data, Comment: &n.Comment, Disabled: &n.Disabled, SharedID: model.Ptr(n.SharedID)}
 		if n.TTL != nil {
 			in.TTL = model.Some(*n.TTL)
 		} else {
@@ -101,7 +107,64 @@ func DiffOps(from, to *model.State) []model.Op {
 			add(OpRecordUpdate, k, o.Version, in, fmt.Sprintf("restore %s %s %s", n.Name, n.Type, n.Data))
 		}
 	}
+	// Steps before the lists and groups that use them.
+	for _, k := range sortedKeys(to.BlockSteps) {
+		n := to.BlockSteps[k]
+		in := BlockStepInput{Name: &n.Name, Position: model.Ptr(n.Position), Comment: &n.Comment}
+		if o, ok := from.BlockSteps[k]; !ok {
+			add(OpBlockStepCreate, k, 0, in, "add blocking step "+n.Name)
+		} else if !sameObject(o, n) {
+			add(OpBlockStepUpdate, k, o.Version, in, "restore blocking step "+n.Name)
+		}
+	}
+	for _, k := range sortedKeys(to.Blocklists) {
+		n := to.Blocklists[k]
+		in := BlocklistInput{Name: &n.Name, URL: &n.URL, ViewIDs: model.Ptr(append([]int64{}, n.ViewIDs...)), Disabled: &n.Disabled, Comment: &n.Comment, StepID: model.Ptr(n.StepID)}
+		if o, ok := from.Blocklists[k]; !ok {
+			add(OpBlocklistCreate, k, 0, in, "add blocklist "+n.Name)
+		} else if !sameObject(o, n) {
+			add(OpBlocklistUpdate, k, o.Version, in, "restore blocklist "+n.Name)
+		}
+	}
+	for _, k := range sortedKeys(to.BlockRules) {
+		n := to.BlockRules[k]
+		in := BlockRuleInput{Name: &n.Name, Action: &n.Action, Exact: &n.Exact, ViewIDs: model.Ptr(append([]int64{}, n.ViewIDs...)), Comment: &n.Comment}
+		if o, ok := from.BlockRules[k]; !ok {
+			add(OpBlockRuleCreate, k, 0, in, "add rule: "+ruleLabel(n))
+		} else if !sameObject(o, n) {
+			add(OpBlockRuleUpdate, k, o.Version, in, "restore rule: "+ruleLabel(n))
+		}
+	}
+	for _, k := range sortedKeys(to.ClientGroups) {
+		n := to.ClientGroups[k]
+		in := ClientGroupInput{Name: &n.Name, Members: model.Ptr(append([]string{}, n.Members...)), StepID: model.Ptr(n.StepID), ViewIDs: model.Ptr(append([]int64{}, n.ViewIDs...)), Comment: &n.Comment}
+		if o, ok := from.ClientGroups[k]; !ok {
+			add(OpClientGroupCreate, k, 0, in, "add client group "+n.Name)
+		} else if !sameObject(o, n) {
+			add(OpClientGroupUpdate, k, o.Version, in, "restore client group "+n.Name)
+		}
+	}
 	// Deletions, most dependent objects first.
+	for _, k := range sortedKeys(from.ClientGroups) {
+		if _, ok := to.ClientGroups[k]; !ok {
+			add(OpClientGroupDelete, k, from.ClientGroups[k].Version, nil, "delete client group "+from.ClientGroups[k].Name)
+		}
+	}
+	for _, k := range sortedKeys(from.BlockRules) {
+		if _, ok := to.BlockRules[k]; !ok {
+			add(OpBlockRuleDelete, k, from.BlockRules[k].Version, nil, "delete rule: "+ruleLabel(from.BlockRules[k]))
+		}
+	}
+	for _, k := range sortedKeys(from.Blocklists) {
+		if _, ok := to.Blocklists[k]; !ok {
+			add(OpBlocklistDelete, k, from.Blocklists[k].Version, nil, "delete blocklist "+from.Blocklists[k].Name)
+		}
+	}
+	for _, k := range sortedKeys(from.BlockSteps) {
+		if _, ok := to.BlockSteps[k]; !ok {
+			add(OpBlockStepDelete, k, from.BlockSteps[k].Version, nil, "delete blocking step "+from.BlockSteps[k].Name)
+		}
+	}
 	for _, k := range sortedKeys(from.Records) {
 		if _, ok := to.Records[k]; !ok {
 			o := from.Records[k]
@@ -156,6 +219,7 @@ func DiffOps(from, to *model.State) []model.Op {
 
 func stripVersion(s model.Settings) model.Settings {
 	s.Version = 0
+	s.BlockingPausedUntil, s.BlockingPausedIndefinitely = nil, false // their own operation
 	return s
 }
 

internal/engine/disable_test.go

@@ -0,0 +1,176 @@
+package engine
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+)
+
+func disableReq(id int64, ptr bool) Request {
+	return NewRequest(OpRecordDisable, id, RecordInput{PTR: ptr})
+}
+
+func enableReq(id int64, ptr bool) Request {
+	return NewRequest(OpRecordEnable, id, RecordInput{PTR: ptr})
+}
+
+func (env *testEnv) zoneFile(name string) string {
+	env.t.Helper()
+	b, err := os.ReadFile(filepath.Join(env.dir, "zones/_default", name+".zone"))
+	if err != nil {
+		env.t.Fatal(err)
+	}
+	return string(b)
+}
+
+func serialOf(env *testEnv, zone string) uint32 {
+	return env.state().ZonesNamed(zone)[0].SOA.Serial
+}
+
+func TestDisableRecord(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin, rec("example.com", "www", "A", "192.0.2.10"))
+	www := findRec(env.state(), "www.example.com.", "A")
+	serial := serialOf(env, "example.com")
+
+	res := env.submit(env.admin, disableReq(www.ID, false))
+	if len(res.Ops) != 1 || res.Ops[0].Summary != "disable www.example.com. A 192.0.2.10" {
+		t.Fatalf("ops = %+v", res.Ops)
+	}
+	if r := env.state().Records[www.ID]; r == nil || !r.Disabled {
+		t.Fatalf("record = %+v", r)
+	}
+	zf := env.zoneFile("example.com")
+	if !strings.Contains(zf, "; disabled: www\t\tIN\tA\t192.0.2.10\n") || strings.Contains(zf, "\nwww\t") {
+		t.Errorf("zone file:\n%s", zf)
+	}
+	if s := serialOf(env, "example.com"); s != serial+1 {
+		t.Errorf("serial after disable = %d, want %d", s, serial+1)
+	}
+	// Editing a disabled record changes nothing that is served.
+	env.submit(env.admin, NewRequest(OpRecordUpdate, www.ID, RecordInput{Comment: model.Ptr("old web server"), Data: model.Ptr("192.0.2.11")}))
+	if s := serialOf(env, "example.com"); s != serial+1 {
+		t.Errorf("serial after editing a disabled record = %d", s)
+	}
+	// Disabling it again says so.
+	if e := env.submitErr(env.admin, disableReq(www.ID, false)); e.Kind != KindConflict || !strings.Contains(e.Message, "already disabled") {
+		t.Errorf("second disable: %+v", e)
+	}
+
+	env.submit(env.admin, enableReq(www.ID, false))
+	r := env.state().Records[www.ID]
+	if r.Disabled || r.Data != "192.0.2.11" || r.Comment != "old web server" {
+		t.Errorf("enabled record = %+v", r)
+	}
+	if zf := env.zoneFile("example.com"); !strings.Contains(zf, "\nwww\t\tIN\tA\t192.0.2.11\t; old web server\n") || strings.Contains(zf, "disabled") {
+		t.Errorf("zone file after enable:\n%s", zf)
+	}
+}
+
+func TestDisableValidation(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	// The zone must keep a name server.
+	ns := findRec(env.state(), "example.com.", "NS")
+	if e := env.submitErr(env.admin, disableReq(ns.ID, false)); e.Kind != KindValidation {
+		t.Errorf("disabling the only NS: %+v", e)
+	}
+
+	// A disabled record doesn't count for the CNAME rule...
+	env.submit(env.admin, rec("example.com", "www", "A", "192.0.2.10"))
+	www := findRec(env.state(), "www.example.com.", "A")
+	env.submit(env.admin, disableReq(www.ID, false))
+	res := env.submit(env.admin, rec("example.com", "www", "CNAME", "ns1"))
+	// ...but there's a warning that it can't come back,
+	if len(res.Problems) != 1 || res.Problems[0].Code != "disabled_conflict" || res.Problems[0].ObjectID != www.ID {
+		t.Errorf("problems = %+v", res.Problems)
+	}
+	// and enabling it is checked like adding it.
+	if e := env.submitErr(env.admin, enableReq(www.ID, false)); e.Kind != KindValidation || !strings.Contains(e.Message, "CNAME") {
+		t.Errorf("enabling next to a CNAME: %+v", e)
+	}
+}
+
+func TestDisableByMatchAndPTR(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("192.0.2.0/24")}))
+	env.submit(env.admin, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", Name: model.Ptr("nas"), Type: model.Ptr("A"), Data: model.Ptr("192.0.2.20"), PTR: true}))
+	ptrDisabled := func() bool {
+		return findRec(env.state(), "20.2.0.192.in-addr.arpa.", "PTR").Disabled
+	}
+
+	// By match, with the PTR record.
+	match := RecordInput{Zone: "example.com", Name: model.Ptr("nas"), Type: model.Ptr("A"), PTR: true}
+	res := env.submit(env.admin, NewRequest(OpRecordDisable, 0, match))
+	if len(res.Ops) != 2 || res.Ops[1].Summary != "disable 20.2.0.192.in-addr.arpa. PTR nas.example.com." {
+		t.Fatalf("ops = %+v", res.Ops)
+	}
+	if !findRec(env.state(), "nas.example.com.", "A").Disabled || !ptrDisabled() {
+		t.Fatal("A or PTR not disabled")
+	}
+	env.submit(env.admin, NewRequest(OpRecordEnable, 0, match))
+	if findRec(env.state(), "nas.example.com.", "A").Disabled || ptrDisabled() {
+		t.Fatal("A or PTR not enabled")
+	}
+	// Without ptr, the PTR record stays as it is.
+	a := findRec(env.state(), "nas.example.com.", "A")
+	env.submit(env.admin, disableReq(a.ID, false))
+	if ptrDisabled() {
+		t.Error("PTR disabled without ptr")
+	}
+
+	// Data narrows the match; nothing matching is an error unless missing_ok.
+	env.submit(env.admin, rec("example.com", "api", "A", "192.0.2.30"), rec("example.com", "api", "A", "192.0.2.31"))
+	one := RecordInput{Zone: "example.com", Name: model.Ptr("api"), Type: model.Ptr("A"), Data: model.Ptr("192.0.2.31")}
+	env.submit(env.admin, NewRequest(OpRecordDisable, 0, one))
+	if findRecData(env.state(), "api.example.com.", "192.0.2.30").Disabled || !findRecData(env.state(), "api.example.com.", "192.0.2.31").Disabled {
+		t.Error("data match wrong")
+	}
+	none := RecordInput{Zone: "example.com", Name: model.Ptr("nope"), Type: model.Ptr("A")}
+	if e := env.submitErr(env.admin, NewRequest(OpRecordDisable, 0, none)); e.Kind != KindNotFound {
+		t.Errorf("no match: %+v", e)
+	}
+	// missing_ok: nothing to do (an error the CLI's --missing-ok accepts).
+	none.MissingOK = true
+	if e := env.submitErr(env.admin, NewRequest(OpRecordDisable, 0, none)); e.Message != "nothing to do" {
+		t.Errorf("missing_ok: %+v", e)
+	}
+}
+
+func TestDisableRRSetAndRevert(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin, rec("example.com", "api", "A", "192.0.2.30"), rec("example.com", "api", "A", "192.0.2.31"))
+	r30 := findRecData(env.state(), "api.example.com.", "192.0.2.30")
+	r31 := findRecData(env.state(), "api.example.com.", "192.0.2.31")
+	env.submit(env.admin, disableReq(r30.ID, false), disableReq(r31.ID, false))
+
+	// Setting the RRset enables a disabled record with a given value and
+	// leaves the other disabled one alone.
+	env.submit(env.admin, NewRequest(OpRRSetReplace, 0, RRSetInput{Zone: "example.com", Name: "api", Type: "A", Data: []string{"192.0.2.30", "192.0.2.40"}}))
+	s := env.state()
+	if r := s.Records[r30.ID]; r == nil || r.Disabled {
+		t.Errorf(".30 = %+v, want kept and enabled", r)
+	}
+	if r := s.Records[r31.ID]; r == nil || !r.Disabled {
+		t.Errorf(".31 = %+v, want kept and disabled", r)
+	}
+
+	// Reverting a disabling changeset enables the record again.
+	res := env.submit(env.admin, disableReq(r30.ID, false))
+	rev, err := env.e.Revert(env.ctx, res.ChangesetID, env.admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := env.e.Apply(env.ctx, rev.ID, env.admin, ApplyOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	if env.state().Records[r30.ID].Disabled {
+		t.Error("revert did not enable the record")
+	}
+}

internal/engine/dnssec.go

@@ -0,0 +1,239 @@
+package engine
+
+// DNSSEC signing (docs/dnssec.md). named signs zones itself (dnssec-policy
+// with inline signing) and keeps their keys in a key directory Jarl
+// chooses (render.KeyDir). Jarl's part is to keep the steps in order: a
+// zone must never become unsigned while the parent zone may still have a
+// DS record for it, or validating resolvers reject the whole domain.
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"jarl/internal/auth"
+	"jarl/internal/dnssec"
+	"jarl/internal/model"
+	"jarl/internal/render"
+	"jarl/internal/validate"
+)
+
+// DNSSEC returns the signing status of zone z.
+func (e *Engine) DNSSEC(ctx context.Context, st *model.State, z *model.Zone) *dnssec.Status {
+	s := &dnssec.Status{Policy: z.DNSSECPolicy, KeyDir: render.KeyDir(st, z, e.cfg.Paths), Keys: []*dnssec.Key{}, Policies: []string{model.DNSSECDefault}}
+	for name := range validate.Policies(st) {
+		s.Policies = append(s.Policies, name)
+	}
+	sort.Strings(s.Policies[1:])
+	keys, err := dnssec.Keys(s.KeyDir, z.Name)
+	if err != nil {
+		s.KeyError = err.Error()
+	} else if keys != nil {
+		s.Keys = keys
+	}
+	s.Phase = dnssec.Assess(z.DNSSECPolicy, s.Keys)
+	if z.Type == model.ZonePrimary && !e.cfg.NoReload && e.tools != nil {
+		zs, err := e.tools.ZoneStatus(ctx, z.Name, e.namedView(st, z))
+		if err != nil {
+			s.NamedError = err.Error()
+		} else {
+			s.Named = &dnssec.NamedSigning{Secure: zs.Secure, InlineSigning: zs.InlineSigning, Serial: zs.Serial, SignedSerial: zs.SignedSerial, NextKeyEvent: zs.NextKeyEvent}
+		}
+	}
+	return s
+}
+
+// dnssecChanges checks the DNSSEC side of going from base to work: the
+// steps that would make a signed zone fail to validate, or give it new
+// keys its parent's DS doesn't match.
+func (e *Engine) dnssecChanges(base, work *model.State, opts ApplyOptions) []validate.Problem {
+	var out []validate.Problem
+	problem := func(sev validate.Severity, st *model.State, z *model.Zone, code, format string, args ...any) {
+		out = append(out, validate.Problem{Severity: sev, Code: code, Message: fmt.Sprintf(format, args...), ObjectType: "zone", ObjectID: z.ID, Zone: z.Name, View: st.ViewName(z)})
+	}
+	for _, old := range base.SortedZones() {
+		if !old.Signed() {
+			continue
+		}
+		z := work.Zones[old.ID]
+		if z == nil {
+			problem(validate.Error, base, old, "dnssec_delete_signed", "the zone is signed: turn DNSSEC off before deleting it (jarl zone dnssec disable, and remove the DS record at your registrar), or the domain fails to validate while the parent still points at its keys")
+			continue
+		}
+		if z.Type != model.ZonePrimary {
+			continue // reported by validate (dnssec_zone_type)
+		}
+		if render.KeyDir(base, old, e.cfg.Paths) != render.KeyDir(work, z, e.cfg.Paths) {
+			problem(validate.Error, work, z, "dnssec_keys_moved", "the zone is signed, and moving it to another view would make named sign it with new keys that the parent's DS record doesn't match; turn DNSSEC off first, or create the zone anew in the other view")
+			continue
+		}
+		switch {
+		case z.DNSSECPolicy == "" && opts.wipeZone == z.ID:
+			// WipeDNSSEC: the caller checked that the parent has no DS.
+		case z.DNSSECPolicy == "" && old.DNSSECPolicy != model.DNSSECInsecure:
+			problem(validate.Error, work, z, "dnssec_off_unsafe", "switching DNSSEC off at once makes named serve the zone unsigned immediately, and if the parent zone has a DS record for it, validating resolvers then reject the whole domain. Turn it off in steps: 'jarl zone dnssec disable' (the insecure policy) keeps the zone signed while you remove the DS at your registrar, and Jarl says when it's safe to finish. If the zone never had a DS at its parent, wipe it instead ('jarl zone dnssec wipe')")
+		case z.DNSSECPolicy == "":
+			keys, err := dnssec.Keys(render.KeyDir(base, old, e.cfg.Paths), old.Name)
+			if err != nil {
+				problem(validate.Error, work, z, "dnssec_off_unknown", "can't tell whether turning DNSSEC off has finished, because the zone's keys can't be read: %v", err)
+				continue
+			}
+			if ph := dnssec.Assess(model.DNSSECInsecure, keys); !ph.CanFinish {
+				problem(validate.Error, work, z, "dnssec_off_too_early", "turning DNSSEC off hasn't finished yet: %s %s", ph.Summary, ph.Next)
+			}
+		case z.DNSSECPolicy != old.DNSSECPolicy && z.DNSSECPolicy != model.DNSSECInsecure && old.DNSSECPolicy != model.DNSSECInsecure:
+			problem(validate.Warning, work, z, "dnssec_policy_change", "changing the zone's DNSSEC policy from %s to %s can make named replace its keys; when its key-signing key changes, the DS record at the parent must change too (Jarl shows when)", old.DNSSECPolicy, z.DNSSECPolicy)
+		}
+	}
+	for _, z := range work.SortedZones() {
+		if !z.Signed() || z.DNSSECPolicy == model.DNSSECInsecure {
+			continue
+		}
+		if old := base.Zones[z.ID]; old != nil && old.Signed() {
+			continue
+		}
+		if files, _ := dnssec.Files(render.KeyDir(work, z, e.cfg.Paths), z.Name); len(files) > 0 {
+			problem(validate.Info, work, z, "dnssec_old_keys", "the zone's key directory still has keys from when it was signed before; named only reuses keys it hasn't retired, and makes new ones otherwise (wipe the old ones first for a clean start)")
+		}
+	}
+	return out
+}
+
+// removeDerived deletes what named kept for zones that are gone after a
+// change: the journals and signed copies next to their files and, for a
+// deleted zone, keys left over from when it was signed (a signed zone
+// can't be deleted). Failures are only logged.
+func (e *Engine) removeDerived(pl *plan) {
+	for _, path := range pl.removed {
+		for _, f := range dnssec.DerivedFiles(path) {
+			if err := os.Remove(f); err != nil && !errors.Is(err, fs.ErrNotExist) {
+				e.log.Warn("removing a file named kept for a deleted zone failed", "file", f, "err", err)
+			}
+		}
+	}
+	for id, old := range pl.base.Zones {
+		if old.Type != model.ZonePrimary || pl.work.Zones[id] != nil || pl.work.FindZone(old.Name, old.ViewID) != nil {
+			continue
+		}
+		dir := render.KeyDir(pl.base, old, e.cfg.Paths)
+		files, _ := dnssec.Files(dir, old.Name)
+		for _, f := range files {
+			if err := os.Remove(filepath.Join(dir, f)); err != nil && !errors.Is(err, fs.ErrNotExist) {
+				e.log.Warn("removing a deleted zone's old DNSSEC key failed", "file", f, "err", err)
+			}
+		}
+	}
+}
+
+// WipeResult is the outcome of WipeDNSSEC.
+type WipeResult struct {
+	Result  *Result  `json:"result,omitempty"` // the change that switched signing off, if one was needed
+	Removed []string `json:"removed"`
+	DryRun  bool     `json:"dry_run,omitempty"`
+}
+
+// WipeDNSSEC switches signing off for a zone at once, skipping the
+// insecure policy, and deletes its keys and named's signed copy of it, so
+// that signing it again starts from scratch. The caller must make sure the
+// parent zone has no DS record for the zone: otherwise the domain stops
+// validating.
+func (e *Engine) WipeDNSSEC(ctx context.Context, zoneID int64, p *auth.Principal, via string, opts ApplyOptions) (*WipeResult, error) {
+	st, err := e.store.LoadState(ctx)
+	if err != nil {
+		return nil, err
+	}
+	z := st.Zones[zoneID]
+	if z == nil {
+		return nil, errf(KindNotFound, "zone %d not found", zoneID)
+	}
+	if z.Type != model.ZonePrimary {
+		return nil, errf(KindBadRequest, "only primary zones are signed by Jarl")
+	}
+	if !p.Can(zoneAction(st, z, true)) {
+		return nil, errf(KindForbidden, "permission denied: this needs write access to zone %s", zoneDesc(st, z))
+	}
+	out := &WipeResult{Removed: []string{}, DryRun: opts.DryRun}
+	dir := render.KeyDir(st, z, e.cfg.Paths)
+	keyFiles, err := dnssec.Files(dir, z.Name)
+	if err != nil {
+		return nil, fmt.Errorf("reading the key directory: %w", err)
+	}
+	zoneFile := render.ZoneFilePath(st, z, e.cfg.Paths)
+	var signed []string
+	for _, f := range dnssec.DerivedFiles(zoneFile) {
+		if strings.Contains(filepath.Base(f), ".signed") {
+			signed = append(signed, f)
+		}
+	}
+	if z.DNSSECPolicy == "" && len(keyFiles) == 0 && len(signed) == 0 {
+		return nil, errf(KindConflict, "zone %s isn't signed and has no keys or signed files left: there is nothing to wipe", zoneDesc(st, z))
+	}
+	if z.DNSSECPolicy != "" {
+		opts.wipeZone = z.ID
+		res, err := e.Submit(ctx, []Request{NewRequest(OpZoneUpdate, z.ID, ZoneInput{DNSSECPolicy: model.Ptr("")})}, p, via, "wipe DNSSEC from zone "+zoneDesc(st, z), opts)
+		out.Result = res
+		if err != nil {
+			return out, err
+		}
+	}
+	for _, f := range keyFiles {
+		out.Removed = append(out.Removed, filepath.Join(dir, f))
+	}
+	out.Removed = append(out.Removed, signed...)
+	if opts.DryRun {
+		return out, nil
+	}
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	var failed []string
+	for _, f := range out.Removed {
+		if err := os.Remove(f); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			failed = append(failed, err.Error())
+		}
+	}
+	msg := fmt.Sprintf("%d files removed", len(out.Removed))
+	if len(failed) > 0 {
+		e.audit(ctx, p, "dnssec.wipe", "zone", z.ID, zoneDesc(st, z), 0, "failure", strings.Join(failed, "; "), nil)
+		return out, fmt.Errorf("signing is off, but removing files failed: %s", strings.Join(failed, "; "))
+	}
+	e.audit(ctx, p, "dnssec.wipe", "zone", z.ID, zoneDesc(st, z), 0, "success", msg, nil)
+	return out, nil
+}
+
+// MarkDS tells named that the parent zone now has (published) or no
+// longer has (withdrawn) the DS record of each key, as a DS check found.
+// named moves to the next step of signing or unsigning the zone once it
+// knows, and (unless it can query the parent itself) waits until told.
+func (e *Engine) MarkDS(ctx context.Context, st *model.State, z *model.Zone, p *auth.Principal, published, withdrawn []*dnssec.Key) ([]string, error) {
+	if e.cfg.NoReload || e.tools == nil {
+		return nil, errf(KindConflict, "jarld doesn't control named here (bind.no_reload)")
+	}
+	var out []string
+	run := func(k *dnssec.Key, pub bool) error {
+		msg, err := e.tools.CheckDS(ctx, z.Name, e.namedView(st, z), k.Tag, k.Algorithm, pub)
+		if err != nil {
+			return err
+		}
+		out = append(out, fmt.Sprintf("key %d: %s", k.Tag, strings.TrimSpace(msg)))
+		return nil
+	}
+	for _, k := range published {
+		if err := run(k, true); err != nil {
+			return out, err
+		}
+	}
+	for _, k := range withdrawn {
+		if err := run(k, false); err != nil {
+			return out, err
+		}
+	}
+	if len(out) > 0 {
+		e.audit(ctx, p, "dnssec.checkds", "zone", z.ID, zoneDesc(st, z), 0, "success", strings.Join(out, "; "), nil)
+	}
+	return out, nil
+}

internal/engine/dnssec_integration_test.go

@@ -0,0 +1,148 @@
+package engine
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"jarl/internal/dnssec"
+	"jarl/internal/model"
+	"jarl/internal/render"
+	"jarl/internal/store"
+)
+
+// waitPhase polls the zone's DNSSEC status until ok accepts it.
+func (n *namedEnv) waitPhase(z *model.Zone, what string, ok func(*dnssec.Status) bool) *dnssec.Status {
+	n.t.Helper()
+	deadline := time.Now().Add(15 * time.Second)
+	for {
+		st := n.state()
+		s := n.e.DNSSEC(n.ctx, st, st.Zones[z.ID])
+		if ok(s) {
+			return s
+		}
+		if time.Now().After(deadline) {
+			n.t.Fatalf("waiting for %s: %+v (phase %+v)", what, s, s.Phase)
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+}
+
+func TestDNSSECWithRealNamed(t *testing.T) {
+	n := newNamedEnv(t)
+	z := n.state().ZonesNamed("example.test")[0]
+	zoneFile := filepath.Join(n.dir, "zones/_default/example.test.zone")
+
+	// Switching signing on for an existing zone: named makes a key and
+	// signs the zone (inline signing, keeping Jarl's file as it is).
+	n.submit(n.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{DNSSECPolicy: model.Ptr("default")}))
+	conf, _ := os.ReadFile(n.e.cfg.Paths.MainConfig())
+	if !strings.Contains(string(conf), `dnssec-policy "default";`) || !strings.Contains(string(conf), `key-directory "`+filepath.Join(n.dir, "zones/dnssec-keys/_default")+`";`) {
+		t.Errorf("named.conf:\n%s", conf)
+	}
+	s := n.waitPhase(z, "signing", func(s *dnssec.Status) bool { return len(s.Keys) == 1 && s.Named != nil && s.Named.Secure })
+	k := s.Keys[0]
+	if s.Phase.Code != dnssec.PhaseSigning || k.Role != "CSK" || k.Algorithm != 13 || k.DS == nil || s.Phase.DSReadyAt == nil {
+		t.Errorf("status: %+v, key %+v", s.Phase, k)
+	}
+	if got := n.dig("example.test", "DNSKEY"); !strings.HasPrefix(got, "257 3 13 ") {
+		t.Errorf("DNSKEY = %q", got)
+	}
+	// Changes still load (Jarl's serial is the unsigned zone's), and the
+	// serial check sees the signed zone's serial.
+	r := findRec(n.state(), "www.example.test.", "A")
+	n.submit(n.admin, NewRequest(OpRecordUpdate, r.ID, RecordInput{Data: model.Ptr("192.0.2.12")}))
+	if got := n.dig("www.example.test", "A"); got != "192.0.2.12" {
+		t.Errorf("www = %q", got)
+	}
+	cur := n.state()
+	served, ok, err := n.e.LoadedSerial(n.ctx, cur, cur.Zones[z.ID])
+	if !ok || err != nil || !serialGreater(served, cur.Zones[z.ID].SOA.Serial) {
+		t.Errorf("served serial %d (%v %v), Jarl's %d", served, ok, err, cur.Zones[z.ID].SOA.Serial)
+	}
+
+	// Unsafe steps are refused.
+	if e := n.submitErr(n.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{DNSSECPolicy: model.Ptr("")})); !strings.Contains(e.Message, "switching DNSSEC off at once") {
+		t.Errorf("switching off directly: %v", e)
+	}
+	if e := n.submitErr(n.admin, NewRequest(OpZoneDelete, z.ID, nil)); !strings.Contains(e.Message, "turn DNSSEC off before deleting") {
+		t.Errorf("deleting: %v", e)
+	}
+	r = findRec(n.state(), "www.example.test.", "A")
+	if e := n.submitErr(n.admin, NewRequest(OpRecordUpdate, r.ID, RecordInput{TTL: model.Some(uint32(172800))})); !strings.Contains(e.Message, "max-zone-ttl") {
+		t.Errorf("long TTL: %v", e)
+	}
+
+	// A restore of an older database: Jarl's serial is now below named's,
+	// which named refuses for a signed zone. Resync raises it.
+	before := n.state()
+	older := before.Clone()
+	older.Zones[z.ID].SOA.Serial -= 5
+	findRec(older, "www.example.test.", "A").Data = "192.0.2.10"
+	if err := n.st.InTx(n.ctx, func(tx *store.Tx) error { return tx.SaveState(before, older) }); err != nil {
+		t.Fatal(err)
+	}
+	res, err := n.e.Resync(n.ctx, n.admin, ApplyOptions{Force: true})
+	if err != nil {
+		t.Fatalf("resync: %v", err)
+	}
+	if len(res.Serials) != 1 || !serialGreater(res.Serials[0].New, before.Zones[z.ID].SOA.Serial) {
+		t.Errorf("serials: %+v (named had %d)", res.Serials, before.Zones[z.ID].SOA.Serial)
+	}
+	if got := n.dig("www.example.test", "A"); got != "192.0.2.10" {
+		t.Errorf("www after restore = %q", got)
+	}
+	if n.state().Zones[z.ID].SOA.Serial != res.Serials[0].New {
+		t.Error("raised serial not saved")
+	}
+
+	// Turning off: insecure first. The DS was never at the parent, so
+	// named removes the keys at once and finishing is allowed.
+	n.submit(n.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{DNSSECPolicy: model.Ptr("insecure")}))
+	n.waitPhase(z, "removal", func(s *dnssec.Status) bool { return s.Phase.CanFinish })
+	n.submit(n.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{DNSSECPolicy: model.Ptr("")}))
+	if got := n.dig("example.test", "DNSKEY"); got != "" {
+		t.Errorf("DNSKEY after switching off = %q", got)
+	}
+	s = n.waitPhase(z, "leftover keys", func(s *dnssec.Status) bool { return true })
+	if s.Phase.Code != dnssec.PhaseLeftover {
+		t.Errorf("after switching off: %+v", s.Phase)
+	}
+
+	// Signing again makes a new key (the old one stays retired); a wipe
+	// switches off at once and deletes keys and signed files.
+	n.submit(n.admin, NewRequest(OpZoneUpdate, z.ID, ZoneInput{DNSSECPolicy: model.Ptr("default")}))
+	s = n.waitPhase(z, "signing again", func(s *dnssec.Status) bool { return len(s.Keys) == 2 && s.Named != nil && s.Named.Secure })
+	if s.Phase.Code != dnssec.PhaseSigning || s.Keys[0].Tag == k.Tag && s.Keys[0].Goal == dnssec.Omnipresent {
+		t.Errorf("signing again: %+v %+v", s.Phase, s.Keys[0])
+	}
+	if _, err := os.Stat(zoneFile + ".signed"); err != nil {
+		t.Errorf("signed copy: %v", err)
+	}
+	w, err := n.e.WipeDNSSEC(n.ctx, z.ID, n.admin, "test", ApplyOptions{})
+	if err != nil {
+		t.Fatalf("wipe: %v", err)
+	}
+	if len(w.Removed) < 4 || w.Result == nil || !w.Result.Applied {
+		t.Errorf("wipe: %+v", w)
+	}
+	if files, _ := dnssec.Files(render.KeyDir(n.state(), z, n.e.cfg.Paths), z.Name); len(files) != 0 {
+		t.Errorf("keys left: %v", files)
+	}
+	if _, err := os.Stat(zoneFile + ".signed"); !os.IsNotExist(err) {
+		t.Errorf("signed copy left: %v", err)
+	}
+	if got := n.dig("www.example.test", "A"); got != "192.0.2.10" {
+		t.Errorf("www after wipe = %q", got)
+	}
+	if _, err := n.e.WipeDNSSEC(n.ctx, z.ID, n.admin, "test", ApplyOptions{}); err == nil {
+		t.Error("a second wipe found something")
+	}
+	// Deleting the zone also removes named's journal.
+	n.submit(n.admin, NewRequest(OpZoneDelete, z.ID, nil))
+	if left, _ := filepath.Glob(zoneFile + "*"); len(left) != 0 {
+		t.Errorf("left after deleting the zone: %v", left)
+	}
+}

internal/engine/engine.go

@@ -14,8 +14,11 @@ import (
 	"fmt"
 	"io/fs"
 	"log/slog"
+	"net/http"
+	"net/netip"
 	"os"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strings"
 	"sync"
@@ -23,6 +26,7 @@ import (
 
 	"jarl/internal/auth"
 	"jarl/internal/bind"
+	"jarl/internal/blocking"
 	"jarl/internal/dnsname"
 	"jarl/internal/model"
 	"jarl/internal/namedconf"
@@ -53,6 +57,10 @@ type Config struct {
 	NoReload bool
 	// SkipCheck disables named-checkconf (only for tests without BIND).
 	SkipCheck bool
+	// LocalAddrs returns this host's addresses, for working out whether a
+	// server without views is reachable from the internet
+	// (docs/exposure.md). nil: none known.
+	LocalAddrs func() []netip.Addr
 }
 
 // Engine applies changesets.
@@ -64,6 +72,17 @@ type Engine struct {
 	deploy *Deployer
 	mu     sync.Mutex // serializes applies
 	Now    func() time.Time
+
+	// Blocklist downloads (blocklists.go).
+	blMu   sync.Mutex    // serializes downloads
+	blKick chan struct{} // a list was added or changed
+	HTTP   *http.Client  // for downloads; nil: a default client
+	Limits BlocklistLimits
+
+	namedCheck namedCheck // named-checkconf on the running configuration (namedwarn.go)
+
+	seedMu sync.Mutex
+	seed   []byte // the view keys' seed (viewkeys.go)
 }
 
 // New creates an engine.
@@ -78,6 +97,8 @@ func New(st *store.Store, tools *bind.Tools, cfg Config, log *slog.Logger) *Engi
 		store: st, tools: tools, cfg: cfg, log: log,
 		deploy: &Deployer{Group: cfg.FileGroup, NamedWritable: []string{cfg.Paths.ZoneDir, cfg.Paths.CacheDir}},
 		Now:    time.Now,
+		blKick: make(chan struct{}, 1),
+		Limits: DefaultBlocklistLimits(),
 	}
 }
 
@@ -94,17 +115,20 @@ type Result struct {
 	DryRun      bool               `json:"dry_run,omitempty"`
 	Valid       bool               `json:"valid"`
 	Problems    []validate.Problem `json:"problems"` // problems this change introduces
-	Existing    []validate.Problem `json:"existing_problems,omitempty"`
-	Check       []CheckMessage     `json:"check,omitempty"`
-	CheckOK     bool               `json:"check_ok"`
-	Diff        string             `json:"diff"`
-	Files       []string           `json:"files_changed"`
-	Serials     []SerialChange     `json:"serials,omitempty"`
-	Reloaded    []string           `json:"reloaded,omitempty"`
-	Warnings    []string           `json:"warnings,omitempty"`
-	Drift       []DriftEntry       `json:"drift,omitempty"`
-	Ops         []model.Op         `json:"ops,omitempty"`
-	Error       *Error             `json:"error,omitempty"`
+	// Risks are the introduced problems that open the server up; applying
+	// needs AcceptRisk (docs/exposure.md).
+	Risks    []validate.Problem `json:"risks,omitempty"`
+	Existing []validate.Problem `json:"existing_problems,omitempty"`
+	Check    []CheckMessage     `json:"check,omitempty"`
+	CheckOK  bool               `json:"check_ok"`
+	Diff     string             `json:"diff"`
+	Files    []string           `json:"files_changed"`
+	Serials  []SerialChange     `json:"serials,omitempty"`
+	Reloaded []string           `json:"reloaded,omitempty"`
+	Warnings []string           `json:"warnings,omitempty"`
+	Drift    []DriftEntry       `json:"drift,omitempty"`
+	Ops      []model.Op         `json:"ops,omitempty"`
+	Error    *Error             `json:"error,omitempty"`
 }
 
 // stored is what is kept in a changeset's result column.
@@ -122,6 +146,11 @@ type ApplyOptions struct {
 	Force bool
 	// NoReload writes the files without reloading named.
 	NoReload bool
+	// AcceptRisk confirms a change that opens the server up, such as an
+	// open resolver on a public view (validate.RiskCodes).
+	AcceptRisk bool
+	// wipeZone lets WipeDNSSEC switch signing off for this zone at once.
+	wipeZone int64
 }
 
 func (e *Engine) replay(base *model.State, ops []model.Op, p *auth.Principal) (*model.State, []string, error) {
@@ -162,7 +191,46 @@ func ValidateOptions(st *model.State) validate.Options {
 }
 
 func (e *Engine) validate(st *model.State) []validate.Problem {
-	return validate.State(st, ValidateOptions(st))
+	return validate.State(st, e.validateOptions(st))
+}
+
+func (e *Engine) validateOptions(st *model.State) validate.Options {
+	opts := ValidateOptions(st)
+	if e.cfg.LocalAddrs != nil {
+		opts.LocalAddrs = e.cfg.LocalAddrs()
+	}
+	return opts
+}
+
+// Validate checks a state as applying it would.
+func (e *Engine) Validate(st *model.State) []validate.Problem { return e.validate(st) }
+
+// Exposures says which views (or the server, without views) are
+// reachable from the internet, and why (docs/exposure.md).
+func (e *Engine) Exposures(st *model.State) []validate.Exposure {
+	return validate.Exposures(st, e.validateOptions(st))
+}
+
+// risks returns the introduced problems that open a public view (or a
+// public server) up: risky warnings that weren't there before at all. One
+// that was there already, acknowledged (taking the acknowledgement back)
+// or not, opens nothing new.
+func risks(before, introduced []validate.Problem, public map[string]bool) []validate.Problem {
+	type key struct {
+		code, objType, view string
+		id                  int64
+	}
+	had := map[key]bool{}
+	for _, p := range before {
+		had[key{p.Code, p.ObjectType, p.View, p.ObjectID}] = true
+	}
+	var out []validate.Problem
+	for _, p := range introduced {
+		if p.Severity == validate.Warning && validate.RiskCodes[p.Code] && public[p.View] && !had[key{p.Code, p.ObjectType, p.View, p.ObjectID}] {
+			out = append(out, p)
+		}
+	}
+	return out
 }
 
 // ---- changeset management
@@ -371,6 +439,8 @@ type plan struct {
 	base, work    *model.State
 	introduced    []validate.Problem
 	existing      []validate.Problem
+	before        []validate.Problem // the problems before the change
+	public        map[string]bool    // public views by name ("": the server), after the change
 	serials       []SerialChange
 	out           *render.Output
 	changed       []*render.File
@@ -381,6 +451,7 @@ type plan struct {
 	drift         []DriftEntry
 	configChanged bool
 	reloadZones   []*model.Zone
+	reloadPolicy  []render.PolicyZone // rules zones whose file changed
 	verify        map[int64]uint32
 	newZones      bool
 	backup        *Backup
@@ -397,11 +468,18 @@ func (pl *plan) files() []string {
 	return out
 }
 
-func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user string) (*plan, error) {
+func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user string, opts ApplyOptions) (*plan, error) {
 	pl := &plan{base: base, work: work, verify: map[int64]uint32{}}
 	before := e.validate(base)
+	pl.before = before
+	pl.public = map[string]bool{}
+	for _, x := range e.Exposures(work) {
+		pl.public[x.View] = x.Public
+		// Server-wide findings (no view) count when anything is public.
+		pl.public[""] = pl.public[""] || x.Public
+	}
 	after := e.validate(work)
-	pl.introduced = validate.Introduced(before, after)
+	pl.introduced = append(validate.Introduced(before, after), e.dnssecChanges(base, work, opts)...)
 	introducedKeys := map[string]bool{}
 	for _, p := range pl.introduced {
 		introducedKeys[p.Key()] = true
@@ -415,7 +493,13 @@ func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user str
 		return pl, nil
 	}
 	pl.serials = bumpSerials(base, work, e.Now(), user)
-	pl.out = render.Render(work, e.cfg.Paths, e.cfg.Extras)
+	guarded, problems := e.guardSerials(ctx, base, work, pl.serials, user)
+	pl.serials = append(pl.serials, guarded...)
+	if validate.HasErrors(problems) {
+		pl.introduced = append(pl.introduced, problems...)
+		return pl, nil
+	}
+	pl.out = render.Render(work, e.cfg.Paths, e.extras(ctx))
 	deployed, err := e.store.DeployedFiles(ctx)
 	if err != nil {
 		return nil, err
@@ -438,7 +522,7 @@ func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user str
 		}
 	}
 	for path, df := range deployed {
-		if pl.out.File(path) != nil || df.Kind != render.KindZone {
+		if pl.out.File(path) != nil || df.Kind != render.KindZone && df.Kind != render.KindPolicy {
 			continue
 		}
 		old, existed, _ := readFile(path)
@@ -451,18 +535,18 @@ func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user str
 	pl.diff = diff.String()
 
 	// Which zones named must reload, and which serials to verify.
-	baseOut := render.Render(base, e.cfg.Paths, e.cfg.Extras)
+	baseOut := render.Render(base, e.cfg.Paths, e.extras(ctx))
 	changedPaths := map[string]bool{}
 	for _, f := range pl.changed {
 		changedPaths[f.Path] = true
 	}
 	for _, z := range work.SortedZones() {
-		if z.Type != model.ZonePrimary {
-			continue
+		if z.Type != model.ZonePrimary || z.Disabled {
+			continue // disabled zones aren't in named: nothing to reload
 		}
 		path := pl.out.ZoneFiles[z.ID]
 		old := base.Zones[z.ID]
-		existedInNamed := old != nil && old.Type == model.ZonePrimary && baseOut.ZoneFiles[old.ID] == path
+		existedInNamed := old != nil && old.Type == model.ZonePrimary && !old.Disabled && baseOut.ZoneFiles[old.ID] == path
 		if !existedInNamed {
 			pl.newZones = true
 			pl.verify[z.ID] = z.SOA.Serial
@@ -476,6 +560,18 @@ func (e *Engine) makePlan(ctx context.Context, base, work *model.State, user str
 	if len(work.Zones) != len(base.Zones) {
 		pl.configChanged = true
 	}
+	// Rules zones and gates whose content changed. New ones come with a
+	// change to named.conf, and reconfig loads them.
+	for _, z := range pl.out.Policy {
+		if z.ListID != 0 || !changedPaths[z.File] {
+			continue
+		}
+		if slices.ContainsFunc(baseOut.Policy, func(o render.PolicyZone) bool {
+			return o.Name == z.Name && o.ViewID == z.ViewID && o.File == z.File
+		}) {
+			pl.reloadPolicy = append(pl.reloadPolicy, z)
+		}
+	}
 
 	if !e.cfg.SkipCheck {
 		if err := e.stagingCheck(ctx, pl); err != nil {
@@ -497,7 +593,12 @@ func (e *Engine) stagingCheck(ctx context.Context, pl *plan) error {
 	}
 	defer os.RemoveAll(dir)
 	sp := render.Paths{ConfigDir: filepath.Join(dir, "config"), ZoneDir: filepath.Join(dir, "zones"), CacheDir: filepath.Join(dir, "cache")}
-	sout := render.Render(pl.work, sp, e.cfg.Extras)
+	sout := render.Render(pl.work, sp, e.extras(ctx))
+	for _, d := range sout.Dirs {
+		if err := os.MkdirAll(d, 0o750); err != nil {
+			return err
+		}
+	}
 	for _, f := range sout.Files {
 		if err := os.MkdirAll(filepath.Dir(f.Path), 0o750); err != nil {
 			return err
@@ -506,6 +607,16 @@ func (e *Engine) stagingCheck(ctx context.Context, pl *plan) error {
 			return err
 		}
 	}
+	// Blocklists as empty policy zones: their content is checked when
+	// they are downloaded.
+	for _, path := range sout.Blocklists {
+		if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
+			return err
+		}
+		if err := os.WriteFile(path, []byte(blocking.Placeholder()), 0o640); err != nil {
+			return err
+		}
+	}
 	main, err := e.stagingMain(dir, sp.MainConfig())
 	if err != nil {
 		return err
@@ -600,6 +711,7 @@ func (pl *plan) result() *Result {
 		Files:    pl.files(),
 		Serials:  pl.serials,
 		Drift:    pl.drift,
+		Risks:    risks(pl.before, pl.introduced, pl.public),
 	}
 	r.Valid = r.Valid && r.CheckOK
 	if r.Files == nil {
@@ -635,7 +747,7 @@ func (e *Engine) Preview(ctx context.Context, csID int64, p *auth.Principal) (*R
 		res.Error = ee
 		return res, nil
 	}
-	pl, err := e.makePlan(ctx, base, work, p.Name())
+	pl, err := e.makePlan(ctx, base, work, p.Name(), ApplyOptions{})
 	if err != nil {
 		return nil, err
 	}
@@ -714,7 +826,7 @@ func (e *Engine) applyOps(ctx context.Context, cs *model.Changeset, reqs []Reque
 			cs.Description += fmt.Sprintf(" (+%d more)", len(cs.Ops)-1)
 		}
 	}
-	pl, err := e.makePlan(ctx, base, work, p.Name())
+	pl, err := e.makePlan(ctx, base, work, p.Name(), opts)
 	if err != nil {
 		return nil, err
 	}
@@ -729,6 +841,13 @@ func (e *Engine) applyOps(ctx context.Context, cs *model.Changeset, reqs []Reque
 	if opts.DryRun {
 		return res, nil
 	}
+	if rs := risks(pl.before, pl.introduced, pl.public); len(rs) > 0 && !opts.AcceptRisk {
+		msg := rs[0].Message
+		if len(rs) > 1 {
+			msg += fmt.Sprintf(" (and %d more)", len(rs)-1)
+		}
+		return res, &Error{Kind: KindRisk, Message: "this change opens the server up: " + msg + "; apply it again with accept_risk to confirm (jarl: --accept-risk), or acknowledge the finding for good", Problems: rs}
+	}
 	if len(pl.drift) > 0 && !opts.Force {
 		var paths []string
 		for _, d := range pl.drift {
@@ -782,6 +901,13 @@ func (e *Engine) applyOps(ctx context.Context, cs *model.Changeset, reqs []Reque
 	}
 	res.ChangesetID = cs.ID
 	res.Applied = true
+	e.removeDerived(pl)
+	for _, op := range cs.Ops {
+		if strings.HasPrefix(op.Kind, "blocklist.") || op.Kind == OpBlockingPause {
+			e.KickBlocklists()
+			break
+		}
+	}
 	e.log.Info("changeset applied", "changeset", cs.ID, "user", p.Name(), "ops", len(cs.Ops), "files", len(res.Files), "description", cs.Description)
 	return res, nil
 }
@@ -815,6 +941,9 @@ func (e *Engine) deployAndReload(ctx context.Context, pl *plan, res *Result, rel
 		return &Error{Kind: KindBIND, Message: "writing configuration files failed (nothing was changed): " + err.Error()}
 	}
 	pl.backup = backup
+	if err := e.ensureBlocklistFiles(pl.out.Blocklists); err != nil {
+		e.log.Warn("creating a blocklist's empty zone file failed", "err", err)
+	}
 	pl.reloaded = reload
 	if !reload {
 		return nil
@@ -846,6 +975,11 @@ func (e *Engine) rollback(ctx context.Context, pl *plan) {
 			e.log.Error("rndc reload after restore failed", "zone", z.Name, "err", err)
 		}
 	}
+	for _, z := range pl.reloadPolicy {
+		if err := e.tools.ReloadZone(ctx, z.Name, z.View); err != nil {
+			e.log.Error("rndc reload after restore failed", "zone", z.Name, "err", err)
+		}
+	}
 }
 
 // namedView returns the view name to pass to rndc for a zone ("" without
@@ -871,6 +1005,16 @@ func (e *Engine) reload(ctx context.Context, pl *plan) ([]string, error) {
 		}
 		done = append(done, "reload "+zoneDesc(pl.work, z))
 	}
+	for _, z := range pl.reloadPolicy {
+		label := "blocking rules"
+		if z.View != "" {
+			label += " [view " + z.View + "]"
+		}
+		if err := e.tools.ReloadZone(ctx, z.Name, z.View); err != nil {
+			return done, fmt.Errorf("reloading %s failed: %v", label, err)
+		}
+		done = append(done, "reload "+label)
+	}
 	// named reloads zones asynchronously and reports load errors only in
 	// its log, so wait until it serves the new serials.
 	deadline := time.Now().Add(e.cfg.ReloadTimeout)
@@ -956,15 +1100,16 @@ func (e *Engine) Resync(ctx context.Context, p *auth.Principal, opts ApplyOption
 		return nil, err
 	}
 	work := base.Clone()
-	pl, err := e.makePlan(ctx, base, work, p.Name())
+	pl, err := e.makePlan(ctx, base, work, p.Name(), opts)
 	if err != nil {
 		return nil, err
 	}
 	res := pl.result()
 	res.DryRun = opts.DryRun
-	if validate.HasErrors(pl.existing) {
+	if validate.HasErrors(pl.existing) || validate.HasErrors(pl.introduced) {
 		// Resync deploys the stored state as is; it must be valid.
-		return res, &Error{Kind: KindValidation, Message: "the stored configuration has errors: " + describeErrors(pl.existing), Problems: validate.Errors(pl.existing)}
+		ps := append(append([]validate.Problem{}, pl.existing...), pl.introduced...)
+		return res, &Error{Kind: KindValidation, Message: "the stored configuration has errors: " + describeErrors(ps), Problems: validate.Errors(ps)}
 	}
 	if pl.check != nil && !pl.check.OK {
 		return res, &Error{Kind: KindValidation, Message: "named-checkconf rejected the configuration: " + firstCheckError(pl.checkMsgs), Check: pl.checkMsgs}
@@ -983,11 +1128,17 @@ func (e *Engine) Resync(ctx context.Context, p *auth.Principal, opts ApplyOption
 	pl.configChanged = true
 	pl.reloadZones = nil
 	for _, z := range work.SortedZones() {
-		if z.Type == model.ZonePrimary {
+		if z.Type == model.ZonePrimary && !z.Disabled {
 			pl.reloadZones = append(pl.reloadZones, z)
 			pl.verify[z.ID] = z.SOA.Serial
 		}
 	}
+	pl.reloadPolicy = nil
+	for _, z := range pl.out.Policy {
+		if z.ListID == 0 {
+			pl.reloadPolicy = append(pl.reloadPolicy, z)
+		}
+	}
 	reload := !e.cfg.NoReload && !opts.NoReload
 	if adopted, aerr := e.Adopted(); reload && (aerr != nil || !adopted) {
 		reload = false
@@ -998,15 +1149,26 @@ func (e *Engine) Resync(ctx context.Context, p *auth.Principal, opts ApplyOption
 	}
 	deployed := deployedList(pl.out, 0, e.Now())
 	err = e.store.InTx(ctx, func(tx *store.Tx) error {
+		// Serials raised above named's (guardSerials) are kept.
+		if len(pl.serials) > 0 {
+			if err := tx.SaveState(base, work); err != nil {
+				return err
+			}
+		}
 		if err := tx.SetDeployedFiles(deployed); err != nil {
 			return err
 		}
-		return tx.AddAudit(e.auditEvent(p, "system.resync", "", 0, "", 0, "success", fmt.Sprintf("%d files written", len(res.Files)), nil))
+		var details json.RawMessage
+		if len(pl.serials) > 0 {
+			details, _ = json.Marshal(map[string]any{"serials": pl.serials})
+		}
+		return tx.AddAudit(e.auditEvent(p, "system.resync", "", 0, "", 0, "success", fmt.Sprintf("%d files written", len(res.Files)), details))
 	})
 	if err != nil {
 		return res, err
 	}
 	res.Applied = true
+	e.removeDerived(pl)
 	return res, nil
 }
 
@@ -1058,7 +1220,7 @@ func (e *Engine) CheckCurrent(ctx context.Context) (*Result, error) {
 	if err != nil {
 		return nil, err
 	}
-	pl, err := e.makePlan(ctx, base, base.Clone(), "")
+	pl, err := e.makePlan(ctx, base, base.Clone(), "", ApplyOptions{})
 	if err != nil {
 		return nil, err
 	}
@@ -1087,6 +1249,14 @@ type Status struct {
 	MainConfig     string             `json:"main_config"`
 }
 
+// NamedStatus asks named for its status (rndc status).
+func (e *Engine) NamedStatus(ctx context.Context) (*bind.ServerStatus, error) {
+	if e.cfg.NoReload || e.tools == nil {
+		return nil, errors.New("named is not managed by this jarld (no_reload)")
+	}
+	return e.tools.Status(ctx)
+}
+
 // Status returns the current status.
 func (e *Engine) Status(ctx context.Context) (*Status, error) {
 	st, err := e.store.LoadState(ctx)
@@ -1130,7 +1300,7 @@ func (e *Engine) Status(ctx context.Context) (*Status, error) {
 			}
 		}
 	}
-	s.Problems = nonNilProblems(e.validate(st))
+	s.Problems = nonNilProblems(append(e.validate(st), e.namedProblems(ctx, st, deployed)...))
 	s.Counts = map[string]int{"views": len(st.Views), "zones": len(st.Zones), "records": len(st.Records), "acls": len(st.ACLs), "tsig_keys": len(st.Keys), "options": len(st.Options)}
 	return s, nil
 }
@@ -1192,8 +1362,19 @@ func (e *Engine) WorkingState(ctx context.Context, csID int64, p *auth.Principal
 }
 
 // LoadedSerial returns the serial named serves for zone z, from rndc
-// zonestatus. ok is false when named isn't asked (no_reload) or doesn't
+// zonestatus: for a zone named signs, the signed zone's serial (which
+// secondaries and the rest of the world see), not that of the zone file
+// Jarl wrote. ok is false when named isn't asked (no_reload) or doesn't
 // report a serial (the zone isn't loaded yet).
+// LoadedSerialCommand is the command LoadedSerial runs, or "" when it
+// doesn't ask named.
+func (e *Engine) LoadedSerialCommand(st *model.State, z *model.Zone) string {
+	if e.cfg.NoReload || e.tools == nil {
+		return ""
+	}
+	return bind.ZoneCommand("zonestatus", z.Name, e.namedView(st, z))
+}
+
 func (e *Engine) LoadedSerial(ctx context.Context, st *model.State, z *model.Zone) (serial uint32, ok bool, err error) {
 	if e.cfg.NoReload || e.tools == nil {
 		return 0, false, nil
@@ -1202,5 +1383,6 @@ func (e *Engine) LoadedSerial(ctx context.Context, st *model.State, z *model.Zon
 	if err != nil {
 		return 0, false, err
 	}
-	return zs.Serial, zs.HasSerial, nil
+	serial, ok = zs.ServedSerial()
+	return serial, ok, nil
 }

internal/engine/errors.go

@@ -21,19 +21,26 @@ const (
 	KindBIND       ErrorKind = "bind_failed"       // named-checkconf or rndc failed
 	KindDrift      ErrorKind = "drift"             // files were changed outside Jarl
 	KindNotAdopted ErrorKind = "not_adopted"       // named does not load Jarl's config yet
+	KindRisk       ErrorKind = "confirm_risk"      // the change opens the server up and needs confirming
 )
 
 // Error is an engine error with details for the caller.
 type Error struct {
-	Kind     ErrorKind          `json:"code"`
-	Message  string             `json:"message"`
-	OpSeq    int                `json:"op,omitempty"` // the operation that failed
-	Problems []validate.Problem `json:"problems,omitempty"`
-	Check    []CheckMessage     `json:"check,omitempty"`
-	Diff     string             `json:"diff,omitempty"`
+	Kind    ErrorKind `json:"code"`
+	Message string    `json:"message"`
+	OpSeq   int       `json:"op,omitempty"` // the operation that failed
+	// OpSummary describes that operation, so people can find it in the
+	// changeset (record IDs mean little to them).
+	OpSummary string             `json:"op_summary,omitempty"`
+	Problems  []validate.Problem `json:"problems,omitempty"`
+	Check     []CheckMessage     `json:"check,omitempty"`
+	Diff      string             `json:"diff,omitempty"`
 }
 
 func (e *Error) Error() string {
+	if e.OpSeq > 0 && e.OpSummary != "" {
+		return fmt.Sprintf("operation %d (%s): %s", e.OpSeq, e.OpSummary, e.Message)
+	}
 	if e.OpSeq > 0 {
 		return fmt.Sprintf("operation %d: %s", e.OpSeq, e.Message)
 	}

internal/engine/expand.go

@@ -131,7 +131,24 @@ func dateSerial(now time.Time) uint32 {
 }
 
 func (x *expander) expand(req Request) ([]model.Op, error) {
+	ops, err := x.expandOne(req)
+	if err != nil {
+		return nil, err
+	}
 	switch req.Op {
+	case OpRecordCreate, OpRecordUpdate, OpRecordDelete, OpRRSetReplace, OpRecordDisable, OpRecordEnable:
+		// Changes to linked zones reach the other zones of the link.
+		return x.linkSync(ops)
+	}
+	return ops, nil
+}
+
+func (x *expander) expandOne(req Request) ([]model.Op, error) {
+	switch req.Op {
+	case OpZoneLink:
+		return x.zoneLink(req)
+	case OpZoneUnlink:
+		return x.zoneUnlink(req)
 	case OpZoneCreate:
 		return x.zoneCreate(req)
 	case OpZoneUpdate, OpZoneDelete:
@@ -145,8 +162,31 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 			if n := len(x.st.ZoneRecords(z.ID)); n > 0 {
 				verb += fmt.Sprintf(" (with its %d records)", n)
 			}
+		} else if d := zoneToggle(req, z); d != nil {
+			if *d {
+				x.warnings = append(x.warnings, disabledZoneEffect(x.st, z))
+				return []model.Op{x.versioned(req, z.Version, "disable zone "+zoneDesc(x.st, z))}, nil
+			}
+			return []model.Op{x.versioned(req, z.Version, "enable zone "+zoneDesc(x.st, z))}, nil
 		}
-		return []model.Op{x.versioned(req, z.Version, "zone "+verb+" "+zoneDesc(x.st, z))}, nil
+		ops := []model.Op{x.versioned(req, z.Version, "zone "+verb+" "+zoneDesc(x.st, z))}
+		if req.Op == OpZoneDelete {
+			if rest := x.st.LinkedWith(z); len(rest) == 1 {
+				ops = append(ops, x.unlinkOps(rest[0], "unlink zone "+zoneDesc(x.st, rest[0])+": the zone it was linked with is deleted")...)
+			}
+		} else {
+			var in ZoneInput
+			if err := decode(req.Data, &in); err != nil {
+				return nil, err
+			}
+			if in.LinkGroup != nil && *in.LinkGroup != z.LinkGroup {
+				return nil, errf(KindBadRequest, "link zones with zone.link and zone.unlink (jarl zone link / unlink)")
+			}
+			if in.LinkWith != "" {
+				return nil, errf(KindBadRequest, "link_with is for new zones; link existing ones with zone.link (jarl zone link)")
+			}
+		}
+		return ops, nil
 	case OpRecordCreate:
 		return x.recordCreate(req)
 	case OpRecordUpdate:
@@ -155,6 +195,8 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 		return x.recordDelete(req)
 	case OpRRSetReplace:
 		return x.rrsetReplace(req)
+	case OpRecordDisable, OpRecordEnable:
+		return x.recordSetDisabled(req, req.Op == OpRecordDisable)
 	case OpViewCreate:
 		return x.viewCreate(req)
 	case OpViewUpdate, OpViewDelete:
@@ -220,6 +262,68 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 		return []model.Op{x.versioned(req, o.Version, summary)}, nil
 	case OpSettingsUpdate:
 		return []model.Op{newOpRaw(OpSettingsUpdate, 0, 0, req.Data, "update settings")}, nil
+	case OpExposureAck, OpExposureUnack:
+		return x.exposureAck(req, req.Op == OpExposureAck)
+	case OpBlocklistCreate:
+		return x.blocklistCreate(req)
+	case OpBlocklistUpdate, OpBlocklistDelete:
+		b := x.st.Blocklists[req.ID]
+		if b == nil {
+			return nil, errf(KindNotFound, "blocklist %d does not exist", req.ID)
+		}
+		verb := "change"
+		if req.Op == OpBlocklistDelete {
+			verb = "delete"
+		}
+		return []model.Op{x.versioned(req, b.Version, verb+" blocklist "+b.Name)}, nil
+	case OpBlockingPause:
+		var in BlockingPauseInput
+		if err := decode(req.Data, &in); err != nil {
+			return nil, err
+		}
+		summary := "resume blocking"
+		if in.Until != nil {
+			summary = "pause blocking until " + in.Until.Local().Format("2006-01-02 15:04")
+		} else if in.Indefinitely {
+			summary = "pause blocking until resumed"
+		}
+		return []model.Op{newOpRaw(OpBlockingPause, 0, 0, req.Data, summary)}, nil
+	case OpBlockRuleCreate:
+		return x.blockRuleCreate(req)
+	case OpBlockRuleUpdate, OpBlockRuleDelete:
+		r := x.st.BlockRules[req.ID]
+		if r == nil {
+			return nil, errf(KindNotFound, "rule %d does not exist", req.ID)
+		}
+		verb := "change rule: "
+		if req.Op == OpBlockRuleDelete {
+			verb = "delete rule: "
+		}
+		return []model.Op{x.versioned(req, r.Version, verb+ruleLabel(r))}, nil
+	case OpBlockStepCreate:
+		return x.blockStepCreate(req)
+	case OpBlockStepUpdate, OpBlockStepDelete:
+		s := x.st.BlockSteps[req.ID]
+		if s == nil {
+			return nil, errf(KindNotFound, "blocking step %d does not exist", req.ID)
+		}
+		verb := "change blocking step "
+		if req.Op == OpBlockStepDelete {
+			verb = "delete blocking step "
+		}
+		return []model.Op{x.versioned(req, s.Version, verb+s.Name)}, nil
+	case OpClientGroupCreate:
+		return x.clientGroupCreate(req)
+	case OpClientGroupUpdate, OpClientGroupDelete:
+		g := x.st.ClientGroups[req.ID]
+		if g == nil {
+			return nil, errf(KindNotFound, "client group %d does not exist", req.ID)
+		}
+		verb := "change client group "
+		if req.Op == OpClientGroupDelete {
+			verb = "delete client group "
+		}
+		return []model.Op{x.versioned(req, g.Version, verb+g.Name)}, nil
 	}
 	return nil, errf(KindBadRequest, "unknown operation %q", req.Op)
 }
@@ -285,7 +389,25 @@ func (x *expander) zoneCreate(req Request) ([]model.Op, error) {
 	records := in.Records
 	cloneFrom := in.CloneFrom
 	zoneOpts := in.Options
-	in.Nameservers, in.Records, in.CloneFrom, in.Options = nil, nil, 0, nil
+	linkWith := in.LinkWith
+	in.Nameservers, in.Records, in.CloneFrom, in.Options, in.LinkWith, in.LinkGroup = nil, nil, 0, nil, "", nil
+	if linkWith != "" {
+		if cloneFrom != 0 {
+			return nil, errf(KindBadRequest, "give clone_from or link_with, not both")
+		}
+		v := x.st.ViewByName(linkWith)
+		if v == nil {
+			return nil, errf(KindNotFound, "view %q does not exist", linkWith)
+		}
+		o := x.st.FindZone(name, v.ID)
+		if o == nil {
+			return nil, errf(KindNotFound, "view %s has no zone %s to link with", v.Name, dnsname.Display(name))
+		}
+		if o.Type != model.ZonePrimary || zt != model.ZonePrimary {
+			return nil, errf(KindBadRequest, "only primary zones can be linked")
+		}
+		cloneFrom = o.ID
+	}
 
 	set := x.st.Settings
 	var src *model.Zone
@@ -410,9 +532,33 @@ func (x *expander) zoneCreate(req Request) ([]model.Op, error) {
 			return nil, err
 		}
 	}
+	var linkOps []model.Op
+	if src != nil && linkWith != "" {
+		// The new zone joins src's link, or starts one with src: then
+		// all of src's records become shared.
+		group := src.LinkGroup
+		if group == 0 {
+			group = src.ID
+			linkOps = x.shareAllOps(src, group)
+		}
+		in.LinkGroup = &group
+	}
 	if src != nil {
 		for _, r := range x.st.ZoneRecords(src.ID) {
+			if linkWith != "" && src.LinkGroup != 0 && r.SharedID == 0 {
+				continue // local to src's view
+			}
 			ri := RecordInput{Name: model.Ptr(r.Name), Type: model.Ptr(r.Type), Data: model.Ptr(r.Data), Comment: model.Ptr(r.Comment)}
+			if linkWith != "" {
+				id := r.SharedID
+				if id == 0 {
+					id = r.ID
+				}
+				ri.SharedID = &id
+			}
+			if r.Disabled {
+				ri.Disabled = model.Ptr(true)
+			}
 			if r.TTL != nil {
 				ri.TTL = model.Some(*r.TTL)
 			} else {
@@ -439,10 +585,12 @@ func (x *expander) zoneCreate(req Request) ([]model.Op, error) {
 			summary += " in view " + v.Name
 		}
 	}
-	if src != nil {
+	if src != nil && linkWith != "" {
+		summary += " (linked with " + zoneDesc(x.st, src) + ")"
+	} else if src != nil {
 		summary += " (copy of " + zoneDesc(x.st, src) + ")"
 	}
-	ops := []model.Op{newOp(OpZoneCreate, ids[0], 0, in, summary)}
+	ops := append(linkOps, newOp(OpZoneCreate, ids[0], 0, in, summary))
 	for i, zo := range zoneOpts {
 		oi := OptionInput{Scope: model.Ptr(model.ScopeZone), ScopeID: model.Ptr(ids[0]), Name: model.Ptr(zo.Name), Value: model.Ptr(zo.Value)}
 		if zo.Comment != "" {
@@ -502,6 +650,10 @@ func (x *expander) ptrCreate(z *model.Zone, owner string, p *rr.Parsed) ([]model
 	for _, r := range x.st.ZoneRecords(rz.ID) {
 		if r.Name == ptrName && r.Type == "PTR" {
 			if strings.EqualFold(r.Data, owner) {
+				if r.Disabled {
+					in := RecordInput{Disabled: model.Ptr(false)}
+					return []model.Op{newOp(OpRecordUpdate, r.ID, r.Version, in, fmt.Sprintf("enable %s PTR %s", r.Name, r.Data))}, nil
+				}
 				return nil, nil // already there
 			}
 			x.warnings = append(x.warnings, fmt.Sprintf("%s already has a PTR record (%s); adding another one", ptrName, r.Data))
@@ -515,6 +667,34 @@ func (x *expander) ptrCreate(z *model.Zone, owner string, p *rr.Parsed) ([]model
 	return []model.Op{newOp(OpRecordCreate, ids[0], 0, in, fmt.Sprintf("add %s IN PTR %s", ptrName, owner))}, nil
 }
 
+// ptrSetDisabled returns operations disabling or enabling the PTR record
+// of an address record.
+func (x *expander) ptrSetDisabled(z *model.Zone, owner string, p *rr.Parsed, disabled bool) []model.Op {
+	addr, ok := addrOf(p)
+	if !ok {
+		return nil
+	}
+	rz, ptrName := reverseZoneFor(x.st, z.ViewID, addr)
+	if rz == nil {
+		return nil
+	}
+	var ops []model.Op
+	for _, r := range x.st.ZoneRecords(rz.ID) {
+		if r.Name == ptrName && r.Type == "PTR" && strings.EqualFold(r.Data, owner) && r.Disabled != disabled {
+			in := RecordInput{Disabled: model.Ptr(disabled)}
+			ops = append(ops, newOp(OpRecordUpdate, r.ID, r.Version, in, fmt.Sprintf("%s %s PTR %s", enableWord(disabled), r.Name, r.Data)))
+		}
+	}
+	return ops
+}
+
+func enableWord(disabled bool) string {
+	if disabled {
+		return "disable"
+	}
+	return "enable"
+}
+
 func (x *expander) ptrDelete(z *model.Zone, owner string, p *rr.Parsed) []model.Op {
 	addr, ok := addrOf(p)
 	if !ok {
@@ -561,7 +741,27 @@ func (x *expander) recordCreate(req Request) ([]model.Op, error) {
 	if err != nil {
 		return nil, err
 	}
-	ops := []model.Op{newOp(OpRecordCreate, ids[0], 0, in, fmt.Sprintf("add %s%s IN %s %s", owner, ttlText(in.TTL), p.Type, p.Data))}
+	summary := fmt.Sprintf("add %s%s IN %s %s", owner, ttlText(in.TTL), p.Type, p.Data)
+	in.SharedID = nil
+	if z.LinkGroup != 0 {
+		local, err := x.localFor(z, owner, p.Type, in.Local)
+		if err != nil {
+			return nil, err
+		}
+		if local {
+			in.SharedID = model.Ptr(int64(0))
+			summary += " (local to view " + x.st.ViewName(z) + ")"
+		} else {
+			if x.st.HasLocal(z.ID, owner, p.Type) {
+				return nil, errf(KindConflict, "%s %s is local in view %s; share the set first (jarl record update ID --shared) or add this one as local", dnsname.Display(owner), p.Type, x.st.ViewName(z))
+			}
+			in.SharedID = &ids[0]
+		}
+	} else if in.Local != nil && *in.Local {
+		return nil, errf(KindBadRequest, "zone %s isn't linked with other views, so its records are local anyway", zoneDesc(x.st, z))
+	}
+	in.Local = nil
+	ops := []model.Op{newOp(OpRecordCreate, ids[0], 0, in, summary)}
 	if ptr {
 		more, err := x.ptrCreate(z, owner, p)
 		if err != nil {
@@ -585,6 +785,35 @@ func (x *expander) recordUpdate(req Request) ([]model.Op, error) {
 	ptr := in.PTR
 	in.PTR = false
 	in.Zone, in.View = "", ""
+	if in.SharedID != nil {
+		return nil, errf(KindBadRequest, "shared_id is managed by Jarl; use local: true or false to make a record local to its view or shared")
+	}
+	var pre []model.Op
+	if in.Local != nil {
+		if z.LinkGroup == 0 {
+			return nil, errf(KindBadRequest, "zone %s isn't linked with other views, so its records are local anyway", zoneDesc(x.st, z))
+		}
+		if want := *in.Local; want != (r.SharedID == 0) {
+			// The whole set of this name and type changes sides.
+			for _, o := range x.st.RRset(z.ID, r.Name, r.Type) {
+				id := int64(0)
+				what := fmt.Sprintf("make %s %s local to view %s", o.Name, o.Type, x.st.ViewName(z))
+				if !want {
+					id = o.ID
+					what = fmt.Sprintf("share %s %s %s with the linked views", o.Name, o.Type, o.Data)
+				}
+				pre = append(pre, newOp(OpRecordUpdate, o.ID, o.Version, RecordInput{SharedID: model.Ptr(id)}, what))
+			}
+			if !want {
+				// Sharing a version makes it every view's.
+				pre = append(pre, x.dropOverrides(z, r.Name, r.Type)...)
+			}
+		}
+		in.Local = nil
+		if string(mustJSON(in)) == "{}" {
+			return pre, nil
+		}
+	}
 	name, typ, data := r.Name, r.Type, r.Data
 	if in.Name != nil {
 		name = *in.Name
@@ -635,24 +864,50 @@ func (x *expander) recordUpdate(req Request) ([]model.Op, error) {
 	if in.Comment != nil && *in.Comment != r.Comment {
 		changes = append(changes, "comment")
 	}
+	toggled := in.Disabled != nil && *in.Disabled != r.Disabled
 	summary := fmt.Sprintf("change %s %s %s", r.Name, r.Type, r.Data)
-	if len(changes) > 0 {
+	switch {
+	case toggled && len(changes) == 0:
+		summary = fmt.Sprintf("%s %s %s %s", enableWord(*in.Disabled), r.Name, r.Type, r.Data)
+	case toggled:
+		changes = append(changes, enableWord(*in.Disabled)+"d")
+		fallthrough
+	case len(changes) > 0:
 		summary += ": " + strings.Join(changes, ", ")
 	}
+	if z.LinkGroup != 0 && r.SharedID != 0 && len(pre) == 0 && (owner != r.Name || p.Type != r.Type) && x.st.HasLocal(z.ID, owner, p.Type) {
+		return nil, errf(KindConflict, "%s %s is local in view %s, so a shared record can't move there", dnsname.Display(owner), p.Type, x.st.ViewName(z))
+	}
 	base := req.BaseVersion
 	if base == 0 {
 		base = r.Version
 	}
-	ops := []model.Op{newOp(OpRecordUpdate, r.ID, base, in, summary)}
-	if ptr && (p.Data != r.Data || owner != r.Name) {
+	if len(pre) > 0 {
+		base = 0 // the record was just updated by pre
+	}
+	ops := append(pre, newOp(OpRecordUpdate, r.ID, base, in, summary))
+	disabled := r.Disabled
+	if in.Disabled != nil {
+		disabled = *in.Disabled
+	}
+	moved := p.Data != r.Data || owner != r.Name
+	if ptr && moved {
 		if old, err := rr.Parse(z.Name, r.Name, r.Type, r.Data); err == nil {
 			ops = append(ops, x.ptrDelete(z, r.Name, old)...)
 		}
-		more, err := x.ptrCreate(z, owner, p)
-		if err != nil {
-			return nil, err
+		if !disabled {
+			more, err := x.ptrCreate(z, owner, p)
+			if err != nil {
+				return nil, err
+			}
+			ops = append(ops, more...)
 		}
-		ops = append(ops, more...)
+	}
+	if ptr && !moved && toggled {
+		if _, ok := addrOf(p); !ok {
+			return nil, errf(KindBadRequest, "ptr only applies to A and AAAA records")
+		}
+		ops = append(ops, x.ptrSetDisabled(z, owner, p, disabled)...)
 	}
 	return ops, nil
 }
@@ -725,6 +980,82 @@ func (x *expander) recordDelete(req Request) ([]model.Op, error) {
 	return ops, nil
 }
 
+// recordSetDisabled expands record.disable and record.enable: the record
+// with the request's ID, or the records matching zone, name, type and
+// (optionally) data.
+func (x *expander) recordSetDisabled(req Request, disabled bool) ([]model.Op, error) {
+	var in RecordInput
+	if err := decode(req.Data, &in); err != nil {
+		return nil, err
+	}
+	var recs []*model.Record
+	if req.ID != 0 {
+		r := x.st.Records[req.ID]
+		if r == nil {
+			return nil, errf(KindNotFound, "record %d does not exist", req.ID)
+		}
+		recs = append(recs, r)
+	} else {
+		z, err := x.resolveZone(in.ZoneID, in.Zone, in.View)
+		if err != nil {
+			return nil, err
+		}
+		if in.Name == nil || in.Type == nil {
+			return nil, errf(KindBadRequest, "finding records needs a name and a type (or give the record id)")
+		}
+		owner, err := dnsname.Owner(*in.Name, z.Name)
+		if err != nil {
+			return nil, errf(KindBadRequest, "%v", err)
+		}
+		typ, _, err := rr.NormalizeType(*in.Type)
+		if err != nil {
+			return nil, errf(KindBadRequest, "%v", err)
+		}
+		data, what := "", owner+" "+typ
+		if in.Data != nil && strings.TrimSpace(*in.Data) != "" {
+			_, p, err := parseRecord(z, owner, typ, *in.Data)
+			if err != nil {
+				return nil, err
+			}
+			data, what = p.Data, what+" "+p.Data
+		}
+		for _, r := range x.st.ZoneRecords(z.ID) {
+			if r.Name == owner && r.Type == typ && (data == "" || strings.EqualFold(r.Data, data)) {
+				recs = append(recs, r)
+			}
+		}
+		if len(recs) == 0 {
+			if in.MissingOK {
+				return nil, nil
+			}
+			return nil, errf(KindNotFound, "no record %s in zone %s", dnsname.Display(what), dnsname.Display(z.Name))
+		}
+	}
+	var ops []model.Op
+	for _, r := range recs {
+		if r.Disabled == disabled {
+			continue // already so
+		}
+		base := 0
+		if req.ID != 0 {
+			base = req.BaseVersion
+		}
+		more, err := x.recordUpdate(Request{Op: OpRecordUpdate, ID: r.ID, BaseVersion: base, Data: mustJSON(RecordInput{Disabled: model.Ptr(disabled), PTR: in.PTR})})
+		if err != nil {
+			return nil, err
+		}
+		ops = append(ops, more...)
+	}
+	if len(ops) == 0 && !in.MissingOK {
+		what := fmt.Sprintf("%s %s %s is", recs[0].Name, recs[0].Type, recs[0].Data)
+		if len(recs) > 1 {
+			what = fmt.Sprintf("all %d %s %s records are", len(recs), recs[0].Name, recs[0].Type)
+		}
+		return nil, errf(KindConflict, "%s already %sd", what, enableWord(disabled))
+	}
+	return ops, nil
+}
+
 func (x *expander) rrsetReplace(req Request) ([]model.Op, error) {
 	var in RRSetInput
 	if err := decode(req.Data, &in); err != nil {
@@ -752,17 +1083,35 @@ func (x *expander) rrsetReplace(req Request) ([]model.Op, error) {
 		canon = append(canon, p.Data)
 	}
 	in.ZoneID, in.Zone, in.View, in.Name, in.Type, in.Data = z.ID, "", "", owner, typ, canon
+	where := ""
+	var pre []model.Op
+	if z.LinkGroup != 0 {
+		local, err := x.localFor(z, owner, typ, in.Local)
+		if err != nil {
+			return nil, err
+		}
+		in.Shared = model.Ptr(!local)
+		if local {
+			where = " (local to view " + x.st.ViewName(z) + ")"
+		} else if in.Local != nil {
+			// Explicitly shared: this version becomes every view's.
+			pre = x.dropOverrides(z, owner, typ)
+		}
+	} else if in.Local != nil && *in.Local {
+		return nil, errf(KindBadRequest, "zone %s isn't linked with other views, so its records are local anyway", zoneDesc(x.st, z))
+	}
+	in.Local = nil
 	if len(canon) > 0 {
 		in.NewIDs, err = x.ids(len(canon))
 		if err != nil {
 			return nil, err
 		}
 	}
-	summary := fmt.Sprintf("set %s%s IN %s to [%s]", owner, ttlText(in.TTL), typ, strings.Join(canon, ", "))
+	summary := fmt.Sprintf("set %s%s IN %s to [%s]%s", owner, ttlText(in.TTL), typ, strings.Join(canon, ", "), where)
 	if len(canon) == 0 {
-		summary = fmt.Sprintf("delete all %s records of %s", typ, owner)
+		summary = fmt.Sprintf("delete all %s records of %s%s", typ, owner, where)
 	}
-	return []model.Op{newOp(OpRRSetReplace, 0, 0, in, summary)}, nil
+	return append(pre, newOp(OpRRSetReplace, 0, 0, in, summary)), nil
 }
 
 func (x *expander) viewCreate(req Request) ([]model.Op, error) {
@@ -862,3 +1211,92 @@ func RedactOps(ops []model.Op) []model.Op {
 	}
 	return out
 }
+
+// zoneToggle returns the new disabled state when a zone update only
+// disables or enables the zone (nil otherwise).
+func zoneToggle(req Request, z *model.Zone) *bool {
+	var in ZoneInput
+	if decode(req.Data, &in) != nil || in.Disabled == nil || *in.Disabled == z.Disabled {
+		return nil
+	}
+	only := ZoneInput{Disabled: in.Disabled}
+	if string(mustJSON(in)) != string(mustJSON(only)) {
+		return nil
+	}
+	return in.Disabled
+}
+
+// disabledZoneEffect says what clients get once named no longer loads a
+// zone: in a view that offers recursion, answers from recursion (the
+// internet's version of the zone, if it has one); elsewhere, REFUSED.
+func disabledZoneEffect(st *model.State, z *model.Zone) string {
+	where := "this server"
+	if v := st.ViewName(z); v != "" {
+		where = "view " + v
+	}
+	if st.RecursionOn(z.ViewID) {
+		return fmt.Sprintf("once zone %s is disabled, clients of %s that may use recursion get its names from recursion: the internet's version of the zone, if there is one", dnsname.Display(z.Name), where)
+	}
+	return fmt.Sprintf("once zone %s is disabled, %s answers REFUSED for its names", dnsname.Display(z.Name), where)
+}
+
+// exposureAck acknowledges an exposure finding of a view or the server,
+// or takes the acknowledgement back: the view's (or the settings')
+// acknowledgements are updated as a whole.
+func (x *expander) exposureAck(req Request, ack bool) ([]model.Op, error) {
+	var in AckInput
+	if err := decode(req.Data, &in); err != nil {
+		return nil, err
+	}
+	in.Code = strings.TrimSpace(in.Code)
+	if !validate.Ackable(in.Code) {
+		return nil, errf(KindBadRequest, "%q is not an exposure finding that can be acknowledged (exposure_... or security_open_...)", in.Code)
+	}
+	if ack && strings.TrimSpace(in.Reason) == "" {
+		return nil, errf(KindBadRequest, "say why %s is accepted (a reason is required)", in.Code)
+	}
+	var v *model.View
+	switch {
+	case in.ViewID != 0:
+		v = x.st.Views[in.ViewID]
+	case in.View != "":
+		v = x.st.ViewByName(in.View)
+	}
+	if (in.ViewID != 0 || in.View != "") && v == nil {
+		return nil, errf(KindNotFound, "no view %s", firstNonEmptyStr(in.View, fmt.Sprint(in.ViewID)))
+	}
+	acks := x.st.Settings.Acknowledged
+	where := "the server"
+	if v != nil {
+		acks, where = v.Acknowledged, "view "+v.Name
+	}
+	var out []model.Acknowledgement
+	for _, a := range acks {
+		if a.Code != in.Code {
+			out = append(out, a)
+		}
+	}
+	summary := "acknowledge " + in.Code + " for " + where + ": " + strings.TrimSpace(in.Reason)
+	if ack {
+		out = append(out, model.Acknowledgement{Code: in.Code, Reason: strings.TrimSpace(in.Reason), By: x.p.Name(), At: x.now})
+	} else {
+		if len(out) == len(acks) {
+			return nil, errf(KindConflict, "%s isn't acknowledged for %s", in.Code, where)
+		}
+		summary = "take back the acknowledgement of " + in.Code + " for " + where
+	}
+	if out == nil {
+		out = []model.Acknowledgement{}
+	}
+	if v != nil {
+		return []model.Op{newOp(OpViewUpdate, v.ID, v.Version, ViewInput{Acknowledged: &out}, summary)}, nil
+	}
+	return []model.Op{newOp(OpSettingsUpdate, 0, 0, SettingsInput{Acknowledged: &out}, summary)}, nil
+}
+
+func firstNonEmptyStr(a, b string) string {
+	if a != "" {
+		return a
+	}
+	return b
+}

internal/engine/exposure.go

@@ -0,0 +1,163 @@
+package engine
+
+import (
+	"net/netip"
+	"slices"
+	"strings"
+
+	"jarl/internal/model"
+	"jarl/internal/namedconf"
+)
+
+// ExposureFix returns the requests that fix an exposure finding of a view
+// (viewID 0: the server), and what they do, or nil when there is no
+// automatic fix: what to allow instead (your secondaries, your hosts)
+// is for you to decide. The requests go through a changeset like any
+// edit (docs/exposure.md).
+func ExposureFix(st *model.State, viewID int64, code string) ([]Request, string) {
+	v := st.Views[viewID]
+	scope, scopeID := model.ScopeOptions, int64(0)
+	if v != nil {
+		scope, scopeID = model.ScopeView, v.ID
+	}
+	set := func(name, value string) Request {
+		if o := st.FindOption(scope, scopeID, name); o != nil {
+			return NewRequest(OpOptionUpdate, o.ID, OptionInput{Value: &value})
+		}
+		return NewRequest(OpOptionCreate, 0, OptionInput{Scope: &scope, ScopeID: &scopeID, Name: &name, Value: &value})
+	}
+	server := func(name, value string) Request {
+		if o := st.FindOption(model.ScopeOptions, 0, name); o != nil {
+			return NewRequest(OpOptionUpdate, o.ID, OptionInput{Value: &value})
+		}
+		return NewRequest(OpOptionCreate, 0, OptionInput{Scope: model.Ptr(model.ScopeOptions), Name: &name, Value: &value})
+	}
+	switch code {
+	case "exposure_rate_limit":
+		value := RecommendedRateLimit(st, v)
+		return []Request{set("rate-limit", value)}, "start rate limiting in log-only mode: rate-limit " + value
+	case "exposure_rate_limit_log_only":
+		o := st.FindOption(scope, scopeID, "rate-limit")
+		if o == nil {
+			o = st.FindOption(model.ScopeOptions, 0, "rate-limit")
+		}
+		if o == nil {
+			return nil, ""
+		}
+		value := withoutLogOnly(o.Value)
+		return []Request{NewRequest(OpOptionUpdate, o.ID, OptionInput{Value: &value})}, "start enforcing the rate limit: rate-limit " + value
+	case "exposure_minimal_any":
+		return []Request{set("minimal-any", "yes")}, "answer ANY queries minimally: minimal-any yes"
+	case "exposure_cache_snooping":
+		return []Request{set("allow-query-cache", "{ none; }")}, "close the cache to everyone: allow-query-cache { none; }"
+	case "exposure_version":
+		return []Request{server("version", "none")}, "hide BIND's version: version none"
+	case "exposure_hostname":
+		return []Request{server("hostname", "none")}, "hide the host name: hostname none"
+	case "security_open_resolver":
+		if v == nil {
+			return nil, "" // a server without views is also your own resolver
+		}
+		return []Request{set("recursion", "no")}, "turn recursion off in view " + v.Name + ": recursion no"
+	}
+	return nil, ""
+}
+
+// RecommendedRateLimit is the rate-limit block Jarl suggests for a public
+// view (v nil: the server): ISC's example of 10 identical responses per
+// second per client network, in log-only mode until you have looked at
+// what it would limit, with your secondaries exempt so zone transfers
+// and their queries are never limited.
+func RecommendedRateLimit(st *model.State, v *model.View) string {
+	parts := []string{"responses-per-second 10;", "log-only yes;"}
+	if ex := secondaries(st, v); len(ex) > 0 {
+		parts = append(parts, "exempt-clients { "+strings.Join(ex, "; ")+"; };")
+	}
+	return "{ " + strings.Join(parts, " ") + " }"
+}
+
+// secondaries returns the addresses the view's zones notify and allow
+// transfers to (ACLs resolved), the servers that rate limiting must leave
+// alone.
+func secondaries(st *model.State, v *model.View) []string {
+	var opts []*model.Option
+	add := func(scope string, id int64) {
+		for _, name := range []string{"also-notify", "allow-transfer"} {
+			if o := st.FindOption(scope, id, name); o != nil {
+				opts = append(opts, o)
+			}
+		}
+	}
+	add(model.ScopeOptions, 0)
+	vid := int64(0)
+	if v != nil {
+		vid = v.ID
+		add(model.ScopeView, v.ID)
+	}
+	for _, z := range st.SortedZones() {
+		if z.ViewID == vid {
+			add(model.ScopeZone, z.ID)
+		}
+	}
+	seen := map[string]bool{}
+	var out []string
+	var addElems func(list []string, depth int)
+	addElems = func(list []string, depth int) {
+		for _, s := range list {
+			e, err := namedconf.ParseAMElement(s)
+			if err != nil || e.Negated {
+				continue
+			}
+			switch e.Kind {
+			case namedconf.AMPrefix, namedconf.AMRange:
+				if t := e.String(); !seen[t] {
+					seen[t] = true
+					out = append(out, t)
+				}
+			case namedconf.AMName:
+				if a := st.ACLByName(e.Name); a != nil && depth < 10 {
+					addElems(a.Elements, depth+1)
+				}
+			}
+		}
+	}
+	for _, o := range opts {
+		stmt, err := namedconf.ParseOptionValue(o.Name, o.Value)
+		if err != nil || stmt.FirstBlock() == nil {
+			continue
+		}
+		var list []string
+		for _, s := range stmt.FirstBlock().Stmts {
+			if o.Name == "also-notify" {
+				// "ADDRESS [port N] [key K]": the address only.
+				if len(s.Items) > 0 && s.Items[0].Value != nil {
+					if _, err := netip.ParseAddr(s.Items[0].Value.Text); err == nil {
+						list = append(list, s.Items[0].Value.Text)
+					}
+				}
+				continue
+			}
+			list = append(list, namedconf.Compact(s.Items))
+		}
+		addElems(list, 0)
+	}
+	slices.Sort(out)
+	return out
+}
+
+// withoutLogOnly removes "log-only ...;" from a rate-limit block.
+func withoutLogOnly(value string) string {
+	st, err := namedconf.ParseOptionValue("rate-limit", value)
+	if err != nil || st.FirstBlock() == nil {
+		return value
+	}
+	b := st.FirstBlock()
+	var keep []*namedconf.Stmt
+	for _, s := range b.Stmts {
+		if s.Keyword() != "log-only" {
+			keep = append(keep, s)
+		}
+	}
+	b.Stmts = keep
+	return namedconf.Compact(st.Items[1:])
+}

internal/engine/exposure_test.go

@@ -0,0 +1,142 @@
+package engine
+
+import (
+	"net/netip"
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+	"jarl/internal/validate"
+)
+
+func problemFor(ps []validate.Problem, code, view string) *validate.Problem {
+	for i, p := range ps {
+		if p.Code == code && (view == "" || p.View == view) {
+			return &ps[i]
+		}
+	}
+	return nil
+}
+
+func TestExposure(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin,
+		// An internal network with a global IPv6 prefix is still yours.
+		NewRequest(OpACLCreate, 0, ACLInput{Name: model.Ptr("internal-clients"), Elements: &[]string{"2a02:8013:7f3d:10::/64", "192.168.1.0/24"}}),
+		optionReq("allow-transfer", "{ 192.0.2.53; }"),
+	)
+	env.submit(env.admin,
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("internal"), MatchClients: &[]string{"internal-clients", "localhost"}, AdoptZones: true}),
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("external"), MatchClients: &[]string{"!internal-clients", "any"}}),
+		NewRequest(OpViewCreate, 0, ViewInput{Name: model.Ptr("dmz"), MatchClients: &[]string{"any"}, MatchDestinations: &[]string{"10.9.0.53"}}),
+	)
+	st := env.state()
+	exps := map[string]validate.Exposure{}
+	for _, x := range env.e.Exposures(st) {
+		exps[x.View] = x
+	}
+	if x := exps["internal"]; x.Public || !strings.Contains(x.Reason, "no catch-all") {
+		t.Errorf("internal = %+v", x)
+	}
+	if x := exps["external"]; !x.Public || x.Reason != "match-clients ends in any" {
+		t.Errorf("external = %+v", x)
+	}
+	if x := exps["dmz"]; x.Public || !strings.Contains(x.Reason, "match-destinations") {
+		t.Errorf("dmz = %+v", x)
+	}
+
+	ps := env.e.validate(st)
+	for _, code := range []string{"exposure_rate_limit", "exposure_minimal_any"} {
+		if problemFor(ps, code, "external") == nil {
+			t.Errorf("no %s for external", code)
+		}
+		if problemFor(ps, code, "internal") != nil || problemFor(ps, code, "dmz") != nil {
+			t.Errorf("%s for a private view", code)
+		}
+	}
+	for _, code := range []string{"exposure_version", "exposure_hostname"} {
+		if problemFor(ps, code, "") == nil {
+			t.Errorf("no %s", code)
+		}
+	}
+
+	// The rate limit fix starts in log-only mode and exempts the
+	// secondaries.
+	ext := st.ViewByName("external")
+	reqs, desc := ExposureFix(st, ext.ID, "exposure_rate_limit")
+	if len(reqs) != 1 || !strings.Contains(desc, "{ responses-per-second 10; log-only yes; exempt-clients { 192.0.2.53; }; }") {
+		t.Fatalf("fix = %v %q", reqs, desc)
+	}
+	env.submit(env.admin, reqs...)
+	ps = env.e.validate(env.state())
+	if problemFor(ps, "exposure_rate_limit", "external") != nil {
+		t.Error("rate limit warning stays after the fix")
+	}
+	if p := problemFor(ps, "exposure_rate_limit_log_only", "external"); p == nil || p.Severity != validate.Info {
+		t.Errorf("log-only = %+v", p)
+	}
+	reqs, desc = ExposureFix(env.state(), ext.ID, "exposure_rate_limit_log_only")
+	if !strings.Contains(desc, "{ responses-per-second 10; exempt-clients { 192.0.2.53; }; }") {
+		t.Errorf("enforce = %q", desc)
+	}
+	env.submit(env.admin, reqs...)
+	if p := problemFor(env.e.validate(env.state()), "exposure_rate_limit_log_only", "external"); p != nil {
+		t.Errorf("still log-only: %+v", p)
+	}
+
+	// Opening the server up needs confirming.
+	open := optionReqView("allow-recursion", "{ any; }", ext.ID)
+	if e := env.submitErr(env.admin, open); e.Kind != KindRisk || !strings.Contains(e.Message, "open resolver") {
+		t.Fatalf("open resolver without confirming: %+v", e)
+	}
+	if _, err := env.e.Submit(env.ctx, []Request{open}, env.admin, "test", "", ApplyOptions{AcceptRisk: true}); err != nil {
+		t.Fatalf("with accept risk: %v", err)
+	}
+	// Acknowledged, it stays as info, with who and why.
+	env.submit(env.admin, NewRequest(OpExposureAck, 0, AckInput{View: "external", Code: "security_open_resolver", Reason: "public resolver for the club"}))
+	p := problemFor(env.e.validate(env.state()), "security_open_resolver", "external")
+	if p == nil || p.Severity != validate.Info || p.Acknowledged == nil || !strings.Contains(p.Message, "acknowledged by admin on 7 Oct 2026: public resolver for the club") {
+		t.Errorf("acknowledged = %+v", p)
+	}
+	if e := env.submitErr(env.admin, NewRequest(OpExposureAck, 0, AckInput{View: "external", Code: "security_open_resolver"})); e.Kind != KindBadRequest {
+		t.Errorf("ack without a reason: %+v", e)
+	}
+	// Reverting the acknowledgement brings the warning back.
+	env.submit(env.admin, NewRequest(OpExposureUnack, 0, AckInput{View: "external", Code: "security_open_resolver"}))
+	if p := problemFor(env.e.validate(env.state()), "security_open_resolver", "external"); p == nil || p.Severity != validate.Warning {
+		t.Errorf("after unack = %+v", p)
+	}
+	// Marking a view private takes it out of the checks.
+	env.submit(env.admin, NewRequest(OpViewUpdate, ext.ID, ViewInput{Exposure: model.Ptr("private")}))
+	if p := problemFor(env.e.validate(env.state()), "security_open_resolver", "external"); p != nil {
+		t.Errorf("private view still checked: %+v", p)
+	}
+	if e := env.submitErr(env.admin, NewRequest(OpViewUpdate, ext.ID, ViewInput{Exposure: model.Ptr("internet")})); e.Kind != KindBadRequest {
+		t.Errorf("bad exposure: %+v", e)
+	}
+}
+
+// A server without views is public only when named listens on an
+// address that isn't private.
+func TestServerExposure(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	if x := env.e.Exposures(env.state())[0]; x.Public {
+		t.Errorf("no addresses known = %+v", x)
+	}
+	env.e.cfg.LocalAddrs = func() []netip.Addr {
+		return []netip.Addr{netip.MustParseAddr("192.168.1.2"), netip.MustParseAddr("2a02:8013:7f3d:10::53")}
+	}
+	if x := env.e.Exposures(env.state())[0]; !x.Public || !strings.Contains(x.Reason, "2a02:8013:7f3d:10::53") {
+		t.Errorf("GUA address = %+v", x)
+	}
+	env.submit(env.admin, NewRequest(OpSettingsUpdate, 0, SettingsInput{Exposure: model.Ptr("private")}))
+	if x := env.e.Exposures(env.state())[0]; x.Public || x.Override != "private" {
+		t.Errorf("marked private = %+v", x)
+	}
+}
+
+func optionReqView(name, value string, viewID int64) Request {
+	return NewRequest(OpOptionCreate, 0, OptionInput{Scope: model.Ptr(model.ScopeView), ScopeID: &viewID, Name: &name, Value: &value})
+}

internal/engine/files.go

@@ -0,0 +1,22 @@
+package engine
+
+import (
+	"context"
+	"io/fs"
+)
+
+// WriteFile writes a file outside the rendered configuration (a
+// certificate for named, docs/certificates.md) the way deployed files are
+// written: atomically, with bind.file_group, creating its directory.
+func (e *Engine) WriteFile(path string, content []byte, mode fs.FileMode) error {
+	return e.deploy.writeAtomic(path, content, mode)
+}
+
+// Reconfig makes named reread its configuration, and with it the files
+// its tls blocks name (nothing with bind.no_reload).
+func (e *Engine) Reconfig(ctx context.Context) error {
+	if e.cfg.NoReload {
+		return nil
+	}
+	return e.tools.Reconfig(ctx)
+}

internal/engine/inputs.go

@@ -2,6 +2,7 @@ package engine
 
 import (
 	"encoding/json"
+	"time"
 
 	"jarl/internal/model"
 )
@@ -29,12 +30,52 @@ const (
 	OpOptionUpdate   = "option.update"
 	OpOptionDelete   = "option.delete"
 	OpSettingsUpdate = "settings.update"
+
+	OpBlocklistCreate = "blocklist.create"
+	OpBlocklistUpdate = "blocklist.update"
+	OpBlocklistDelete = "blocklist.delete"
+	OpBlockRuleCreate = "blockrule.create"
+	OpBlockRuleUpdate = "blockrule.update"
+	OpBlockRuleDelete = "blockrule.delete"
+	OpBlockingPause   = "blocking.pause"
+
+	OpBlockStepCreate   = "blockstep.create"
+	OpBlockStepUpdate   = "blockstep.update"
+	OpBlockStepDelete   = "blockstep.delete"
+	OpClientGroupCreate = "clientgroup.create"
+	OpClientGroupUpdate = "clientgroup.update"
+	OpClientGroupDelete = "clientgroup.delete"
+
+	// Requests only: disabling and enabling records, by ID or by match
+	// (zone, name, type and optionally data), become record.update
+	// operations.
+	OpRecordDisable = "record.disable"
+	OpRecordEnable  = "record.enable"
+	// Acknowledging an exposure finding (docs/exposure.md), and taking it
+	// back, become view.update or settings.update operations.
+	OpExposureAck   = "exposure.ack"
+	OpExposureUnack = "exposure.unack"
+	// Linked zones (docs/views.md#linked-zones): requests that expand
+	// into zone and record updates.
+	OpZoneLink   = "zone.link"
+	OpZoneUnlink = "zone.unlink"
 )
 
+// AckInput acknowledges (or un-acknowledges) an exposure finding of a view
+// (by ID or name), or of the server (neither given).
+type AckInput struct {
+	ViewID int64  `json:"view_id,omitempty"`
+	View   string `json:"view,omitempty"`
+	Code   string `json:"code"`
+	Reason string `json:"reason,omitempty"`
+}
+
 // OpKinds lists all operation kinds.
 var OpKinds = []string{OpZoneCreate, OpZoneUpdate, OpZoneDelete, OpRecordCreate, OpRecordUpdate, OpRecordDelete, OpRRSetReplace,
 	OpViewCreate, OpViewUpdate, OpViewDelete, OpViewReorder, OpACLCreate, OpACLUpdate, OpACLDelete,
-	OpTSIGCreate, OpTSIGUpdate, OpTSIGDelete, OpOptionCreate, OpOptionUpdate, OpOptionDelete, OpSettingsUpdate}
+	OpTSIGCreate, OpTSIGUpdate, OpTSIGDelete, OpOptionCreate, OpOptionUpdate, OpOptionDelete, OpSettingsUpdate,
+	OpBlocklistCreate, OpBlocklistUpdate, OpBlocklistDelete, OpBlockRuleCreate, OpBlockRuleUpdate, OpBlockRuleDelete, OpBlockingPause,
+	OpBlockStepCreate, OpBlockStepUpdate, OpBlockStepDelete, OpClientGroupCreate, OpClientGroupUpdate, OpClientGroupDelete}
 
 // Request is an operation as submitted by a client. Requests are expanded
 // into one or more stored operations (for example an A record with "ptr"
@@ -87,7 +128,20 @@ type ZoneInput struct {
 	SOA          *SOAInput `json:"soa,omitempty"`
 	DefaultTTL   *uint32   `json:"default_ttl,omitempty"`
 	SerialPolicy *string   `json:"serial_policy,omitempty"`
-	Comment      *string   `json:"comment,omitempty"`
+	// DNSSECPolicy turns signing on ("default" or a custom policy's
+	// name), starts turning it off ("insecure") or, once that has
+	// finished, off ("").
+	DNSSECPolicy *string `json:"dnssec_policy,omitempty"`
+	Comment      *string `json:"comment,omitempty"`
+	// Disabled keeps the zone in Jarl but out of named's configuration.
+	Disabled *bool `json:"disabled,omitempty"`
+	// LinkGroup is the zone's link group (0: not linked). Set by zone.link
+	// and zone.unlink; requests use those.
+	LinkGroup *int64 `json:"link_group,omitempty"`
+	// LinkWith (create only) links the new zone with the zone of the same
+	// name in this view, copying its shared records (or all of its
+	// records, when it isn't linked yet).
+	LinkWith string `json:"link_with,omitempty"`
 
 	// Create only: name servers for the apex NS records (default: the
 	// configured default name servers), additional records, and a zone to
@@ -117,11 +171,32 @@ type RecordInput struct {
 	TTL     model.Opt[uint32] `json:"ttl,omitzero"` // null: use the zone default
 	Data    *string           `json:"data,omitempty"`
 	Comment *string           `json:"comment,omitempty"`
-	// PTR also creates (or deletes) the matching PTR record in the
-	// reverse zone, for A and AAAA records.
+	// Disabled keeps the record in Jarl but out of the zone.
+	Disabled *bool `json:"disabled,omitempty"`
+	// PTR also creates (or deletes, disables or enables) the matching PTR
+	// record in the reverse zone, for A and AAAA records.
 	PTR bool `json:"ptr,omitempty"`
 	// MissingOK makes a delete-by-match succeed when nothing matches.
 	MissingOK bool `json:"missing_ok,omitempty"`
+	// Local (requests, linked zones): true keeps the record in this view
+	// only (an override: the whole name and type becomes local here);
+	// false shares it with the linked zones. Unset: like the records of
+	// the same name and type, shared when there are none.
+	Local *bool `json:"local,omitempty"`
+	// SharedID (stored operations) ties the copies of a shared record
+	// together; 0 makes it local.
+	SharedID *int64 `json:"shared_id,omitempty"`
+}
+
+// LinkInput links zones of the same name in several views, or (unlink)
+// takes one out of its link.
+type LinkInput struct {
+	ZoneID int64  `json:"zone_id,omitempty"`
+	Zone   string `json:"zone,omitempty"`
+	View   string `json:"view,omitempty"`
+	// With are the views whose zone of the same name to link with (link
+	// only; default: every view that has one).
+	With []string `json:"with,omitempty"`
 }
 
 // RRSetInput replaces all records of one name and type.
@@ -136,6 +211,11 @@ type RRSetInput struct {
 	Comment *string           `json:"comment,omitempty"`
 	// NewIDs are allocated for records that need to be created.
 	NewIDs []int64 `json:"new_ids,omitempty"`
+	// Local (requests): like RecordInput.Local, for the whole set.
+	Local *bool `json:"local,omitempty"`
+	// Shared (stored operations, linked zones): the records are shared
+	// (true) or local (false).
+	Shared *bool `json:"shared,omitempty"`
 }
 
 // ViewInput creates or updates a view.
@@ -152,6 +232,9 @@ type ViewInput struct {
 	AdoptZones bool `json:"adopt_zones,omitempty"`
 	// Cascade (delete) also deletes the view's zones.
 	Cascade bool `json:"cascade,omitempty"`
+	// Exposure is "auto" (or ""), "public" or "private" (docs/exposure.md).
+	Exposure     *string                  `json:"exposure,omitempty"`
+	Acknowledged *[]model.Acknowledgement `json:"acknowledged,omitempty"`
 }
 
 // ReorderInput sets the order of views.
@@ -195,9 +278,71 @@ type SettingsInput struct {
 	Expire       *uint32   `json:"expire,omitempty"`
 	NegativeTTL  *uint32   `json:"negative_ttl,omitempty"`
 	SerialPolicy *string   `json:"serial_policy,omitempty"`
+	// Exposure and Acknowledged are the server's (docs/exposure.md).
+	Exposure     *string                  `json:"exposure,omitempty"`
+	Acknowledged *[]model.Acknowledgement `json:"acknowledged,omitempty"`
 }
 
 // DeleteInput carries options for delete operations.
 type DeleteInput struct {
 	Cascade bool `json:"cascade,omitempty"`
 }
+
+// BlocklistInput creates or updates a blocklist. Views are given by name
+// (Views) or ID (ViewIDs); an empty list means every view that offers
+// recursion.
+type BlocklistInput struct {
+	Name     *string   `json:"name,omitempty"`
+	URL      *string   `json:"url,omitempty"`
+	Views    *[]string `json:"views,omitempty"`
+	ViewIDs  *[]int64  `json:"view_ids,omitempty"`
+	Disabled *bool     `json:"disabled,omitempty"`
+	Comment  *string   `json:"comment,omitempty"`
+	// Step is the step the list starts at, by name ("normal" or a step
+	// above it) or ID (StepID; 0 is normal).
+	Step   *string `json:"step,omitempty"`
+	StepID *int64  `json:"step_id,omitempty"`
+}
+
+// BlockStepInput creates or updates a blocking step above Normal.
+// Position orders the steps (new steps go on top).
+type BlockStepInput struct {
+	Name     *string `json:"name,omitempty"`
+	Position *int    `json:"position,omitempty"`
+	Comment  *string `json:"comment,omitempty"`
+}
+
+// ClientGroupInput creates or updates a client group. Members are
+// addresses, prefixes or ACL names; the step is given by name ("off",
+// "normal" or a step) or ID; views as for BlocklistInput.
+type ClientGroupInput struct {
+	Name    *string   `json:"name,omitempty"`
+	Members *[]string `json:"members,omitempty"`
+	Step    *string   `json:"step,omitempty"`
+	StepID  *int64    `json:"step_id,omitempty"`
+	Views   *[]string `json:"views,omitempty"`
+	ViewIDs *[]int64  `json:"view_ids,omitempty"`
+	Comment *string   `json:"comment,omitempty"`
+}
+
+// BlockRuleInput creates or updates a block or allow rule. Views as for
+// BlocklistInput.
+type BlockRuleInput struct {
+	Name    *string   `json:"name,omitempty"`
+	Action  *string   `json:"action,omitempty"` // block (default) or allow
+	Exact   *bool     `json:"exact,omitempty"`  // only the name, not the names below it
+	Views   *[]string `json:"views,omitempty"`
+	ViewIDs *[]int64  `json:"view_ids,omitempty"`
+	Comment *string   `json:"comment,omitempty"`
+}
+
+// BlockingPauseInput pauses blocking until a time, or resumes it (null).
+type BlockingPauseInput struct {
+	Until *time.Time `json:"until"`
+	// Indefinitely pauses until someone resumes blocking (Until is nil).
+	Indefinitely bool `json:"indefinitely,omitempty"`
+}
+
+// MaxBlockingPause is the longest pause: blocking shouldn't stay off by
+// mistake (disable lists to stop using them).
+const MaxBlockingPause = 24 * time.Hour