Release 0.4.1-rc.5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -40,6 +40,24 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Added
 
+- Statistics per view ([docs/stats.md](docs/stats.md#views)): the
+  Statistics page has a toggle per view, with All and None, remembered in
+  the browser, to see some views only or several together (linked views,
+  say). Answers, result codes, record types, zones, blocking, rate
+  limiting and the top lists follow it; named's own counters stay for the
+  whole server, and the page says so. `jarl stats --view`, API
+  `?views=`. Per-view figures start with this version.
+- DNS over TLS and HTTPS ([docs/encrypted-dns.md](docs/encrypted-dns.md)):
+  `jarl encrypted-dns setup --hostname NAME --address ADDR` (and the
+  Encrypted DNS page) obtains a certificate for the host name if needed,
+  checks that nothing else listens on port 853 and the DoH port (443 by
+  default) at those addresses, offering a free port, and stages named's
+  `tls` statement and listeners as one change, keeping port 53 where it
+  was, plus the host name's records in your private views (local to the
+  view in a linked zone). The page and `jarl encrypted-dns` say what to
+  give Android, Linux, Firefox, Chrome and Windows. A `tls` statement whose
+  files are missing is refused (`tls_file_missing`), and a certificate
+  named uses can't be deleted.
 - Linked zones ([docs/views.md](docs/views.md#linked-zones)): zones of the
   same name in different views can be linked, and Jarl keeps their shared
   records in step: a change in one view reaches the others in the same

README.md

@@ -97,6 +97,9 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
   serves the domain, decided at every renewal. Use them for the web UI
   (HTTPS without a restart) and for named's DNS over TLS and HTTPS (named
   rereads them on renewal), or bring your own.
+* **DNS over TLS and HTTPS** for your own devices in one step: the
+  certificate, named's listeners on the addresses you choose (after
+  checking the ports are free) and the host name in your private views.
 * **Linked zones for split DNS**: the same zone in several views, with the
   shared records kept in step by Jarl and a few records of each view's own
   (an internal address for a public name, say).
@@ -141,6 +144,7 @@ in `/etc/jarl/jarl.yaml` to reach it from your management network.
 | [docs/views.md](docs/views.md) | Split DNS: adding views to a server that has none |
 | [docs/dnssec.md](docs/dnssec.md) | DNSSEC signing, going public with your own name servers, Porkbun |
 | [docs/acme.md](docs/acme.md) | Let's Encrypt DNS-01 with certbot, acme.sh, lego and Traefik |
+| [docs/encrypted-dns.md](docs/encrypted-dns.md) | DNS over TLS and HTTPS for your clients: setup, ports, client settings |
 | [docs/certificates.md](docs/certificates.md) | TLS certificates Jarl obtains and renews for its web UI and named's DNS over TLS/HTTPS |
 | [docs/stats.md](docs/stats.md) | Query statistics: enabling, what is collected, retention |
 | [docs/exposure.md](docs/exposure.md) | Internet exposure: which views are public, hardening checks, response rate limiting |
@@ -197,10 +201,11 @@ review step.
 ## Status
 
 Version 0.4.0 is the current release, and 0.4.1 is in testing
-(0.4.1-rc.3): it adds Prometheus metrics, address ranges in ACLs and
+(0.4.1-rc.5): it adds Prometheus metrics, address ranges in ACLs and
 other address match lists, safer changeset handling, internet exposure
 checks with response rate limiting, TLS certificates Jarl obtains and
-renews itself, and linked zones for split DNS. 0.4.0 added blocking (blocklists and
+renews itself, linked zones for split DNS, DNS over TLS and HTTPS, and statistics
+per view. 0.4.0 added blocking (blocklists and
 your own rules, like Pi-hole, done by named, with different blocking for
 different devices), disabling zones, server statistics and view keys, on
 top of 0.3.0's disabled records, script-friendly CLI output and client

VERSION

@@ -1 +1 @@
-0.4.1-rc.3
+0.4.1-rc.5

cmd/jarl/encdns.go

@@ -0,0 +1,339 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+type encEndpoint struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+}
+
+type encStatus struct {
+	Enabled     bool          `json:"enabled"`
+	Certificate string        `json:"certificate"`
+	Hostname    string        `json:"hostname"`
+	DoTHost     string        `json:"dot_host"`
+	DoHURL      string        `json:"doh_url"`
+	DoT         []encEndpoint `json:"dot"`
+	DoH         []encEndpoint `json:"doh"`
+	Other       bool          `json:"other"`
+	Addresses   []struct {
+		Address string `json:"address"`
+		Private bool   `json:"private"`
+	} `json:"addresses"`
+	Views []struct {
+		Name    string `json:"name"`
+		Public  bool   `json:"public"`
+		HasZone bool   `json:"has_zone"`
+	} `json:"views"`
+	Certificates []struct {
+		Name     string   `json:"name"`
+		Names    []string `json:"names"`
+		Domains  []string `json:"domains"`
+		DNS      bool     `json:"dns"`
+		Obtained bool     `json:"obtained"`
+	} `json:"certificates"`
+}
+
+type encConflict struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+	What    string `json:"what"`
+}
+
+func endpoints(es []encEndpoint) string {
+	var out []string
+	for _, e := range es {
+		out = append(out, fmt.Sprintf("%s port %d", e.Address, e.Port))
+	}
+	return strings.Join(out, ", ")
+}
+
+func encryptedDNSCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "encrypted-dns",
+		Aliases: []string{"encdns"},
+		Short:   "DNS over TLS and HTTPS for your clients (docs/encrypted-dns.md)",
+		Long: `Shows whether named serves DNS over TLS (DoT) and DNS over HTTPS (DoH),
+where, and what to give clients. 'setup' sets it up: a certificate for the
+host name (obtained if needed), named's tls statement and listeners on the
+addresses you choose, and the host name's address records in your private
+views.`,
+		Example: `  jarl encrypted-dns
+  jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 --address 2a02:8013:7f3d:10::5
+  jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 --no-doh
+  jarl encrypted-dns check --address 10.0.10.5 --doh-port 443
+  jarl encrypted-dns disable`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var s encStatus
+			if err := c.Get(ctx(), "/encrypted-dns", nil, &s); err != nil {
+				return err
+			}
+			return output(s, func(w io.Writer) {
+				if !s.Enabled {
+					fmt.Fprintln(w, "Encrypted DNS:\toff (jarl encrypted-dns setup --hostname NAME --address ADDR)")
+				} else {
+					fmt.Fprintf(w, "Certificate:\t%s\n", s.Certificate)
+					if len(s.DoT) > 0 {
+						fmt.Fprintf(w, "DNS over TLS:\t%s\n", endpoints(s.DoT))
+					}
+					if len(s.DoH) > 0 {
+						fmt.Fprintf(w, "DNS over HTTPS:\t%s\n", endpoints(s.DoH))
+					}
+					if s.DoTHost != "" {
+						fmt.Fprintf(w, "For DoT clients:\t%s   (Android: Private DNS hostname; Linux: DNS=ADDRESS#%s, DNSOverTLS=yes)\n", s.DoTHost, s.Hostname)
+					}
+					if s.DoHURL != "" {
+						fmt.Fprintf(w, "For DoH clients:\t%s   (Firefox, Chrome, Windows 11)\n", s.DoHURL)
+					}
+				}
+				if s.Other {
+					fmt.Fprintln(w, "Note:\tnamed has DoT or DoH listeners written by hand too; setup leaves them alone")
+				}
+				var addrs []string
+				for _, a := range s.Addresses {
+					t := a.Address
+					if !a.Private {
+						t += " (public)"
+					}
+					addrs = append(addrs, t)
+				}
+				fmt.Fprintf(w, "This server's addresses:\t%s\n", strings.Join(addrs, ", "))
+			})
+		},
+	}
+	var host, certName string
+	var addrs, views []string
+	var noDoT, noDoH bool
+	var dohPort, dotPort int
+	setup := &cobra.Command{
+		Use:   "setup --hostname NAME --address ADDR...",
+		Short: "Set up DNS over TLS and HTTPS (obtaining a certificate if needed)",
+		Long: `Sets up DoT (port 853) and DoH (port 443, or --doh-port) on the addresses
+given, which should be this server's addresses on your own networks:
+
+  - the certificate: --certificate, or one with the dns use whose names
+    cover the host name, or a new one Jarl obtains for it (and waits for);
+  - a check that nothing else listens on those ports there;
+  - named's tls statement and listen-on statements (and an explicit
+    listen-on { any; } when there was none, as the first listen-on would
+    otherwise stop named listening on port 53 everywhere);
+  - the host name's A and AAAA records, in the private views that have its
+    zone (or --view), local to the view when the zone is linked.
+
+It is one change, staged or applied like any other. Running it again
+replaces the earlier setup.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			host = strings.ToLower(strings.TrimSuffix(host, "."))
+			if host == "" {
+				return errors.New("give --hostname, the name clients connect to (e.g. dns.adbraun.lol)")
+			}
+			var s encStatus
+			if err := c.Get(ctx(), "/encrypted-dns", q("hostname", host), &s); err != nil {
+				return err
+			}
+			if len(addrs) == 0 {
+				var list []string
+				for _, a := range s.Addresses {
+					list = append(list, a.Address)
+				}
+				return fmt.Errorf("give --address (this server's addresses on your own networks); it has %s", strings.Join(list, ", "))
+			}
+			// The certificate.
+			if certName == "" {
+				for _, ci := range s.Certificates {
+					if coversName(append(ci.Names, ci.Domains...), host) {
+						certName = ci.Name
+						break
+					}
+				}
+			}
+			if certName == "" {
+				certName = strings.SplitN(host, ".", 2)[0]
+				fmt.Printf("Creating certificate %s for %s\n", certName, host)
+				var r struct {
+					Certificate certInfo `json:"certificate"`
+				}
+				if err := c.Do(ctx(), "POST", "/certificates", nil, map[string]any{"name": certName, "domains": []string{host}, "uses": []string{"dns"}}, &r); err != nil {
+					return err
+				}
+				if err := waitIssue(c, certName); err != nil {
+					return err
+				}
+			} else {
+				var ci certInfo
+				if err := c.Get(ctx(), certPath(certName), nil, &ci); err != nil {
+					return err
+				}
+				if !contains(ci.Uses, "dns") {
+					fmt.Printf("Adding the dns use to certificate %s\n", certName)
+					if err := c.Do(ctx(), "PATCH", certPath(certName), nil, map[string]any{"uses": append(ci.Uses, "dns")}, nil); err != nil {
+						return err
+					}
+				}
+				if ci.NotAfter == nil {
+					if ci.IssuingSince == nil {
+						if err := c.Do(ctx(), "POST", certPath(certName)+"/issue", nil, map[string]any{}, nil); err != nil {
+							return err
+						}
+					}
+					if err := waitIssue(c, certName); err != nil {
+						return err
+					}
+				}
+			}
+			body := map[string]any{"hostname": host, "certificate": certName, "addresses": addrs, "dot": !noDoT, "doh": !noDoH}
+			if cmd.Flags().Changed("doh-port") {
+				body["doh_port"] = dohPort
+			}
+			if cmd.Flags().Changed("dot-port") {
+				body["dot_port"] = dotPort
+			}
+			// Nothing else may listen there.
+			var chk struct {
+				Conflicts   []encConflict `json:"conflicts"`
+				FreeDoHPort int           `json:"free_doh_port"`
+				Error       string        `json:"error"`
+			}
+			if err := c.Do(ctx(), "POST", "/encrypted-dns/check", nil, body, &chk); err != nil {
+				return err
+			}
+			if len(chk.Conflicts) > 0 {
+				var msgs []string
+				for _, cf := range chk.Conflicts {
+					msgs = append(msgs, fmt.Sprintf("%s listens on %s port %d", cf.What, cf.Address, cf.Port))
+				}
+				hint := ""
+				if chk.FreeDoHPort != 0 && !noDoH {
+					hint = fmt.Sprintf("; for DoH, port %d is free there (--doh-port %d)", chk.FreeDoHPort, chk.FreeDoHPort)
+				}
+				return fmt.Errorf("%s%s", strings.Join(msgs, "; "), hint)
+			}
+			if chk.Error != "" && !flagQuiet {
+				fmt.Println("Note:", chk.Error)
+			}
+			if len(views) == 0 {
+				for _, v := range s.Views {
+					if !v.Public && v.HasZone {
+						views = append(views, v.Name)
+					}
+				}
+			}
+			body["views"] = views
+			resp, err := c.Mutate(ctx(), "POST", "/encrypted-dns", nil, body)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	f := setup.Flags()
+	f.StringVar(&host, "hostname", "", "the name clients connect to (the certificate's)")
+	f.StringVar(&certName, "certificate", "", "the Jarl certificate to serve (default: one for the host name, obtained if there is none)")
+	f.StringArrayVar(&addrs, "address", nil, "this server's address to listen on (repeat for several)")
+	f.BoolVar(&noDoT, "no-dot", false, "no DNS over TLS")
+	f.BoolVar(&noDoH, "no-doh", false, "no DNS over HTTPS")
+	f.IntVar(&dohPort, "doh-port", 443, "port for DNS over HTTPS")
+	f.IntVar(&dotPort, "dot-port", 853, "port for DNS over TLS (clients expect 853)")
+	f.StringArrayVar(&views, "view", nil, "views to add the host name's records to (default: the private views that have its zone)")
+
+	var cAddrs []string
+	var cDoH int
+	check := &cobra.Command{
+		Use:   "check --address ADDR...",
+		Short: "See whether something already listens on the DoT and DoH ports",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var r struct {
+				Conflicts   []encConflict `json:"conflicts"`
+				FreeDoHPort int           `json:"free_doh_port"`
+				Error       string        `json:"error"`
+			}
+			if err := c.Do(ctx(), "POST", "/encrypted-dns/check", nil, map[string]any{"addresses": cAddrs, "dot": true, "doh": true, "doh_port": cDoH}, &r); err != nil {
+				return err
+			}
+			return output(r, func(w io.Writer) {
+				if r.Error != "" {
+					fmt.Fprintln(w, r.Error)
+				}
+				if len(r.Conflicts) == 0 {
+					fmt.Fprintln(w, "The ports are free.")
+				}
+				for _, cf := range r.Conflicts {
+					fmt.Fprintf(w, "%s port %d:\t%s listens there\n", cf.Address, cf.Port, cf.What)
+				}
+				if r.FreeDoHPort != 0 {
+					fmt.Fprintf(w, "Free for DoH:\tport %d\n", r.FreeDoHPort)
+				}
+			})
+		},
+	}
+	check.Flags().StringArrayVar(&cAddrs, "address", nil, "address to check (repeat for several)")
+	check.Flags().IntVar(&cDoH, "doh-port", 443, "port for DNS over HTTPS")
+
+	disable := &cobra.Command{
+		Use:   "disable",
+		Short: "Turn DNS over TLS and HTTPS off (the certificate and records stay)",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			resp, err := c.Mutate(ctx(), "DELETE", "/encrypted-dns", url.Values{}, nil)
+			if err != nil {
+				return err
+			}
+			return report(resp)
+		},
+	}
+	cmd.AddCommand(setup, check, disable)
+	return cmd
+}
+
+// coversName reports whether certificate names cover host (a wildcard
+// covers one label).
+func coversName(names []string, host string) bool {
+	for _, n := range names {
+		n = strings.ToLower(strings.TrimSuffix(n, "."))
+		if n == host {
+			return true
+		}
+		if base, ok := strings.CutPrefix(n, "*."); ok {
+			if _, rest, ok := strings.Cut(host, "."); ok && rest == base {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func contains(list []string, s string) bool {
+	for _, x := range list {
+		if x == s {
+			return true
+		}
+	}
+	return false
+}

cmd/jarl/main.go

@@ -259,7 +259,7 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 	}
 	add("dns", zoneCmd(), recordCmd(), viewCmd(), aclCmd(), tsigCmd(), optionCmd(), settingsCmd(), blockCmd(), blocklistCmd(), acmeCmd(), searchCmd(), statsCmd())
 	add("changes", applyCmd(), changesetCmd(), historyCmd())
-	add("admin", statusCmd(), exposureCmd(), certCmd(), whoamiCmd(), userCmd(), tokenCmd(), auditCmd(), checkCmd(), resyncCmd(), configCmd())
+	add("admin", statusCmd(), exposureCmd(), certCmd(), encryptedDNSCmd(), whoamiCmd(), userCmd(), tokenCmd(), auditCmd(), checkCmd(), resyncCmd(), configCmd())
 	setupCompletion(root)
 	return root
 }

cmd/jarl/stats.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"math"
+	"net/url"
 	"slices"
 	"strconv"
 	"strings"
@@ -21,8 +22,22 @@ func statsCmd() *cobra.Command {
 		Long: `Query statistics collected from named (see docs/stats.md). They must be
 enabled in /etc/jarl/jarl.yaml (stats.enabled: true).
 
-Ranges are given with --since: 90m, 24h, 7d, 2w. Use -o json or -o yaml to
-export the data.`,
+Ranges are given with --since: 90m, 24h, 7d, 2w. --view limits the figures
+to some views (repeat it, or separate with commas): answers from named's
+response log, per view; named's own counters stay for the whole server.
+Use -o json or -o yaml to export the data.`,
+	}
+	var statsViews []string
+	cmd.PersistentFlags().StringSliceVar(&statsViews, "view", nil, "only these views (repeat, or comma separated)")
+	// withViews adds the --view filter to a query.
+	withViews := func(v url.Values) url.Values {
+		if len(statsViews) > 0 {
+			if v == nil {
+				v = url.Values{}
+			}
+			v.Set("views", strings.Join(statsViews, ","))
+		}
+		return v
 	}
 	// Each command has its own --since variable: their defaults differ, and
 	// a shared variable would take the last default for all of them.
@@ -77,12 +92,21 @@ export the data.`,
 				return err
 			}
 			var s stats.Summary
-			if err := c.Get(ctx(), "/stats/summary", q("since", summarySince, "top", strconv.Itoa(topN)), &s); err != nil {
+			if err := c.Get(ctx(), "/stats/summary", withViews(q("since", summarySince, "top", strconv.Itoa(topN))), &s); err != nil {
 				return err
 			}
 			return output(s, func(w io.Writer) {
 				fmt.Fprintf(w, "Range:\t%s to %s\n", s.From.Local().Format("2006-01-02 15:04"), s.To.Local().Format("2006-01-02 15:04"))
-				fmt.Fprintf(w, "Queries:\t%d (%.2f per second on average)\n", s.Queries, s.AvgQPS)
+				if len(s.FilterViews) > 0 {
+					since := ""
+					if s.ViewsSince != nil {
+						since = ", per view since " + s.ViewsSince.Local().Format("2006-01-02 15:04")
+					}
+					fmt.Fprintf(w, "Views:\t%s (from the response log%s; named's own counters are left out)\n", strings.Join(s.FilterViews, ", "), since)
+					fmt.Fprintf(w, "Answers:\t%d (%.2f per second on average)\n", s.Queries, s.AvgQPS)
+				} else {
+					fmt.Fprintf(w, "Queries:\t%d (%.2f per second on average)\n", s.Queries, s.AvgQPS)
+				}
 				if s.Peak != nil {
 					fmt.Fprintf(w, "Busiest %s:\t%s with %d queries\n", s.Peak.Per, s.Peak.Time.Local().Format("2006-01-02 15:04"), s.Peak.Queries)
 				}
@@ -157,7 +181,7 @@ export the data.`,
 				return err
 			}
 			var es []stats.Entry
-			if err := c.Get(ctx(), "/stats/top", q("kind", kind, "since", topSince, "limit", strconv.Itoa(limit)), &es); err != nil {
+			if err := c.Get(ctx(), "/stats/top", withViews(q("kind", kind, "since", topSince, "limit", strconv.Itoa(limit))), &es); err != nil {
 				return err
 			}
 			return output(es, func(w io.Writer) {
@@ -207,7 +231,7 @@ export the data.`,
 				qv.Add("key", k)
 			}
 			var tl stats.Timeline
-			if err := c.Get(ctx(), "/stats/timeline", qv, &tl); err != nil {
+			if err := c.Get(ctx(), "/stats/timeline", withViews(qv), &tl); err != nil {
 				return err
 			}
 			return output(tl, func(w io.Writer) {
@@ -256,7 +280,7 @@ export the data.`,
 				return err
 			}
 			var hm stats.Heatmap
-			if err := c.Get(ctx(), "/stats/heatmap", q("since", heatmapSince, "key", hmKey), &hm); err != nil {
+			if err := c.Get(ctx(), "/stats/heatmap", withViews(q("since", heatmapSince, "key", hmKey)), &hm); err != nil {
 				return err
 			}
 			return output(hm, func(w io.Writer) {
@@ -308,7 +332,7 @@ export the data.`,
 				return err
 			}
 			var es []stats.Entry
-			if err := c.Get(ctx(), "/stats/breakdown", q("group", args[0], "since", breakdownSince), &es); err != nil {
+			if err := c.Get(ctx(), "/stats/breakdown", withViews(q("group", args[0], "since", breakdownSince)), &es); err != nil {
 				return err
 			}
 			return output(es, func(w io.Writer) {

docs/api.md

@@ -539,6 +539,10 @@ in it and its records.
 
 ### Query statistics
 
+Every statistics endpoint below takes `views=internal,vps` to limit the
+figures to those views ([stats.md](stats.md#views)); a breakdown that only
+exists for the whole server then answers `400 not_per_view`.
+
 Needs `stats:read`. When statistics are disabled, every endpoint but
 `status` answers 404 `stats_disabled`. See [stats.md](stats.md).
 
@@ -556,6 +560,11 @@ Needs `stats:read`. When statistics are disabled, every endpoint but
 curl -sf -H "$AUTH" "$API/stats/top?kind=nxdomain&since=7d&limit=10" | jq -r '.[] | "\(.count)\t\(.key)"'
 ```
 
+### Encrypted DNS
+
+See [encrypted-dns.md](encrypted-dns.md#api): `GET`, `POST` and `DELETE
+/encrypted-dns`, `POST /encrypted-dns/check`.
+
 ### Certificates
 
 Administrators only. See [certificates.md](certificates.md#api).

docs/certificates.md

@@ -183,16 +183,17 @@ configuration names them, Jarl runs `rndc reconfig`, and named serves the
 new certificate at once (checked with BIND 9.20: DoT keeps working, with
 the new certificate).
 
-Until Jarl sets up DNS over TLS and HTTPS for you, add it by hand:
+`jarl encrypted-dns setup` sets up DNS over TLS and HTTPS with it
+([encrypted-dns.md](encrypted-dns.md)). By hand, a `tls` statement names
+the files:
 
 ```sh
 jarl option set tls 'dot { cert-file "/etc/bind/jarl/tls/ns1/fullchain.pem"; key-file "/etc/bind/jarl/tls/ns1/privkey.pem"; }' --toplevel
-jarl option set listen-on 'port 853 tls dot { 10.0.10.5; }' --add               # DoT
-jarl option set listen-on 'port 443 tls dot http default { 10.0.10.5; }' --add  # DoH at /dns-query
+jarl option set listen-on 'port 853 tls dot { 10.0.10.5; }' --add
 ```
 
-Listen on internal addresses only, unless you mean to run a public
-resolver ([exposure.md](exposure.md)).
+A certificate named uses can't be deleted or lose its `dns` use until
+named no longer names its files.
 
 ## A certificate you renew yourself
 

docs/cli.md

@@ -409,6 +409,17 @@ jarl view update external --exposure public|private|auto
 
 See [exposure.md](exposure.md).
 
+## Encrypted DNS
+
+```sh
+jarl encrypted-dns                                   # what is set up, what to give clients
+jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 [--address IPv6] [--doh-port 8443] [--no-doh]
+jarl encrypted-dns check --address 10.0.10.5 --doh-port 443
+jarl encrypted-dns disable
+```
+
+See [encrypted-dns.md](encrypted-dns.md).
+
 ## Certificates
 
 ```sh
@@ -517,6 +528,9 @@ working.
 
 ## Query statistics
 
+`--view internal,vps` (or repeated) limits any `jarl stats` command to those
+views ([stats.md](stats.md#views)).
+
 ```sh
 jarl stats status
 jarl stats summary --since 7d

docs/encrypted-dns.md

@@ -0,0 +1,131 @@
+# DNS over TLS and HTTPS
+
+named (BIND 9.20) can answer over encrypted connections itself: DNS over
+TLS (DoT, port 853) and DNS over HTTPS (DoH, at `/dns-query`). Your
+phones, laptops and browsers then ask this server without anyone on the
+network seeing or changing their queries, and they get exactly what plain
+DNS gives them: the same views, the same records and the same blocking.
+
+Jarl sets it up in one step: a certificate for the host name clients
+connect to (obtained and renewed by Jarl, [certificates.md](certificates.md)),
+named's `tls` statement and listeners on the addresses you choose, and the
+host name's address records in your private views.
+
+In the web UI: **Encrypted DNS** (administrators). In the CLI: `jarl
+encrypted-dns`. In the API: `/api/v1/encrypted-dns`.
+
+## Setting it up
+
+```sh
+jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 --address 2a02:8013:7f3d:10::5
+```
+
+This:
+
+1. **finds or obtains the certificate**: one Jarl manages whose names cover
+   the host name (`--certificate NAME` to pick one), or a new one named
+   after the host name's first label, which Jarl obtains from the CA (the
+   command waits). The certificate gets the `dns` use, so it is written
+   where named can read it, and named rereads it on every renewal.
+2. **checks the ports**: nothing else may listen on the chosen addresses
+   on port 853 or the DoH port. Jarl looks at the host's listening sockets
+   (it binds nothing) and says what is in the way, e.g. `jarld (Jarl's web
+   UI and API) listens on 10.0.10.5 port 443`, and which port is free
+   instead (`--doh-port 8443`).
+3. **stages named's configuration**, as one change you can review:
+
+   ```
+   tls jarl-dns { cert-file ".../tls/dns/fullchain.pem"; key-file ".../tls/dns/privkey.pem"; protocols { TLSv1.2; TLSv1.3; }; };
+   options {
+       listen-on port 853 tls jarl-dns { 10.0.10.5; };
+       listen-on port 443 tls jarl-dns http default { 10.0.10.5; };
+       listen-on-v6 port 853 tls jarl-dns { 2a02:8013:7f3d:10::5; };
+       ...
+   ```
+
+   named listens on port 53 on every address only while there is no
+   `listen-on` statement at all. The first one, for DoT, would end that, so
+   when you have none the setup adds `listen-on { any; };` (and the same
+   for IPv6) to keep plain DNS where it was.
+4. **adds the host name's A and AAAA records** with the chosen addresses,
+   in the private views that have a zone for it (`--view` to choose). In a
+   linked zone they are local to the view, so the name doesn't reach your
+   external view.
+
+Running it again replaces the earlier setup (other addresses, ports, DoT
+or DoH only with `--no-doh` / `--no-dot`). `jarl encrypted-dns disable`
+takes the listeners and the `tls` statement out; the certificate and the
+records stay.
+
+| Option | Default | |
+|--|--|--|
+| `--hostname` | | The name clients connect to; the certificate is for it |
+| `--address` | | This server's addresses to listen on (repeat). Choose your own networks' addresses: a listener on a public address answers anyone who reaches it, like port 53 there |
+| `--certificate` | one for the host name, obtained if needed | A certificate Jarl manages |
+| `--no-dot`, `--no-doh` | both on | |
+| `--dot-port` | 853 | Clients expect 853 |
+| `--doh-port` | 443 | Any free port; clients take it in the URL |
+| `--view` | private views with the zone | Where the host name's records go |
+
+In the web UI the same form checks the ports as you choose, offers the
+free port, and obtains the certificate before setting up.
+
+## Which view clients get
+
+A DoT or DoH client gets the view its address matches, as over plain DNS:
+your phone at home gets the internal view, with its records and blocking.
+Choosing a view by key (`match-clients { key ...; }`) doesn't work over
+DoT and DoH, as clients don't sign their queries.
+
+## Clients
+
+`jarl encrypted-dns` (and the page) shows what to give them:
+
+```
+For DoT clients:   dns.adbraun.lol
+For DoH clients:   https://dns.adbraun.lol/dns-query
+```
+
+| Client | Where |
+|--|--|
+| Android 9+ | Settings → Network → Private DNS → Private DNS provider hostname: `dns.adbraun.lol` (DoT) |
+| Linux (systemd-resolved) | `/etc/systemd/resolved.conf`: `DNS=10.0.10.5#dns.adbraun.lol` and `DNSOverTLS=yes` (or `opportunistic`, which falls back to plain DNS) |
+| Firefox | Settings → Privacy & Security → DNS over HTTPS → Increased protection → Custom: the DoH URL |
+| Chrome, Edge | Settings → Privacy and security → Security → Use secure DNS → custom: the DoH URL |
+| Windows 11 | Settings → Network → your connection → DNS server assignment → Edit: the server's address, DNS over HTTPS on (manual template), the DoH URL |
+
+Test from a machine on your network:
+
+```sh
+kdig +tls-ca +tls-host=dns.adbraun.lol @10.0.10.5 example.com
+dig +https @10.0.10.5 example.com
+curl -s -H 'accept: application/dns-json' 'https://dns.adbraun.lol/dns-query?name=example.com'
+```
+
+**Android away from home.** Private DNS in hostname mode applies on every
+network. Away from home, your server can't be reached, and Android then
+resolves nothing at all ("Private DNS server cannot be accessed"). Use a
+VPN home (WireGuard) when you're out, or switch Private DNS to
+*Automatic* when you leave. Firefox's *Increased protection* and
+systemd-resolved's `opportunistic` fall back to normal DNS by themselves.
+
+Clients check the certificate against the host name, so the name must
+resolve to this server for them: the setup adds it to your private views.
+Open the ports in the server's firewall for your own networks only.
+
+## What Jarl checks
+
+* A `tls` statement whose files don't exist is an error
+  (`tls_file_missing`): named won't load its configuration without them.
+* A certificate named uses can't be deleted, nor lose its `dns` use: turn
+  encrypted DNS off first.
+* Listeners you wrote yourself are left alone; the page notes them.
+
+## API
+
+| Method | Path | Body |
+|--------|------|------|
+| GET | `/encrypted-dns` | `enabled`, `certificate`, `hostname`, `dot` and `doh` (address and port), `dot_host`, `doh_url`, `listeners`; for the form: `addresses` (this server's, with `private`), `views` (with `public`, and `has_zone` for `?hostname=`), `certificates` |
+| POST | `/encrypted-dns/check` | `{"addresses", "dot", "doh", "dot_port", "doh_port"}`: `conflicts` (address, port, what) and `free_doh_port` |
+| POST | `/encrypted-dns` | `{"hostname", "certificate", "addresses", "dot", "doh", "dot_port", "doh_port", "views"}`: staged or applied like any change; 409 while the certificate hasn't been obtained |
+| DELETE | `/encrypted-dns` | Turns it off |

docs/stats.md

@@ -184,6 +184,26 @@ jarl stats summary --since 30d -o json     # export (also -o yaml)
 `operator` roles include it, `dns-editor` doesn't. Statistics show client
 addresses and what they look up, so grant it with care.
 
+## Views
+
+With views, the Statistics page has a toggle per view (and **All** and
+**None**): switch some off to see only the others, for example your
+internal and VPS views without the internet's noise on the external one,
+or several linked views together. The choice is remembered in your
+browser. The CLI takes `--view` on every `jarl stats` command (repeat it,
+or separate views with commas), and the API `?views=internal,vps`.
+
+Only what named's response log says can be split by view: answers (shown
+as *answers* instead of queries), result codes, record types, zones,
+blocking, rate limiting and the top lists. named's own counters (answer
+sources, transport, upstream response times, DNSSEC, the cache and the
+server) are for the whole server, and the page says so; asking for them
+per view (`jarl stats breakdown answer --view internal`) is refused.
+
+Per-view figures are kept from the version that added them (Jarl 0.4.1);
+the page says since when. They take some more room in the statistics
+database, roughly in proportion to the number of views.
+
 ## How data is kept
 
 - Minute counters are kept for `retention.minute`, hourly counters and top

docs/validation.md

@@ -104,6 +104,12 @@ applied.
 | `dnssec_old_keys` | info | Signing a zone whose key directory still has old keys |
 | `serial_not_higher` | error | An explicit serial on a signed zone must be above the one named has loaded (automatic serials are raised by themselves) |
 
+## TLS
+
+| Code | Severity | Check |
+|------|----------|-------|
+| `tls_file_missing` | error | The files a top-level `tls` statement names (certificate, key, CA) exist: named doesn't load its configuration without them |
+
 ## Linked zones
 
 See [views.md](views.md#linked-zones). Jarl keeps linked zones in step

internal/certs/manager.go

@@ -336,6 +336,9 @@ func (m *Manager) Update(ctx context.Context, name string, in Input, p *auth.Pri
 	if err := m.checkUses(ctx, c); err != nil {
 		return nil, err
 	}
+	if before.HasUse(model.CertUseDNS) && !c.HasUse(model.CertUseDNS) && m.namedUses(ctx, m.FilesDir(c.Name)) {
+		return nil, inputErr("named's configuration uses certificate %s (a tls statement names its files), so it keeps the dns use: take it out of named first (jarl encrypted-dns disable)", c.Name)
+	}
 	if c.Source == model.CertSourceFile && (c.CertFile != before.CertFile || c.KeyFile != before.KeyFile) {
 		if _, err := m.readFiles(c); err != nil {
 			return nil, inputErr("%v", err)
@@ -373,6 +376,9 @@ func (m *Manager) Delete(ctx context.Context, name string, p *auth.Principal) er
 	if err != nil {
 		return err
 	}
+	if c.HasUse(model.CertUseDNS) && m.namedUses(ctx, m.FilesDir(c.Name)) {
+		return inputErr("named's configuration uses certificate %s (a tls statement names its files): take it out first (jarl encrypted-dns disable, or remove the tls statement)", c.Name)
+	}
 	if err := m.store.DeleteCertificate(ctx, c.ID); err != nil {
 		return err
 	}

internal/encdns/encdns.go

@@ -0,0 +1,395 @@
+// Package encdns sets up DNS over TLS (DoT) and DNS over HTTPS (DoH) in
+// named (docs/encrypted-dns.md): a tls statement naming a certificate Jarl
+// manages, and listen-on statements for port 853 (DoT) and the DoH port.
+// Its state is read from named's configuration, so what the setup stages
+// stays ordinary, visible configuration.
+package encdns
+
+import (
+	"fmt"
+	"net/netip"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"jarl/internal/engine"
+	"jarl/internal/model"
+	"jarl/internal/namedconf"
+)
+
+// Prefix starts the names of the tls statements the setup writes.
+const Prefix = "jarl-"
+
+// DoTPort is the port for DNS over TLS (RFC 7858).
+const DoTPort = 853
+
+// Listener is a listen-on or listen-on-v6 statement.
+type Listener struct {
+	OptionID int64    `json:"option_id"`
+	V6       bool     `json:"v6"`
+	Port     int      `json:"port"`           // as written; 0 when it isn't
+	TLS      string   `json:"tls,omitempty"`  // tls statement ("" for plain DNS)
+	HTTP     string   `json:"http,omitempty"` // http endpoints: DNS over HTTPS
+	Addrs    []string `json:"addresses"`      // the address match list
+}
+
+// EffectivePort is the port named listens on: as written, or its
+// default for the kind of listener.
+func (l Listener) EffectivePort() int {
+	switch {
+	case l.Port != 0:
+		return l.Port
+	case l.HTTP != "" && l.TLS != "" && l.TLS != "none":
+		return 443
+	case l.HTTP != "":
+		return 80
+	case l.TLS != "":
+		return DoTPort
+	}
+	return 53
+}
+
+// Kind is plain, dot or doh.
+func (l Listener) Kind() string {
+	switch {
+	case l.HTTP != "":
+		return "doh"
+	case l.TLS != "" && l.TLS != "none":
+		return "dot"
+	}
+	return "plain"
+}
+
+// Managed reports whether the setup wrote the listener.
+func (l Listener) Managed() bool { return strings.HasPrefix(l.TLS, Prefix) }
+
+// Listeners returns the server's listen-on and listen-on-v6 statements.
+func Listeners(st *model.State) []Listener {
+	var out []Listener
+	for _, o := range st.ScopedOptions(model.ScopeOptions, 0) {
+		if o.Name != "listen-on" && o.Name != "listen-on-v6" {
+			continue
+		}
+		l, err := parseListener(o.Name, o.Value)
+		if err != nil {
+			continue
+		}
+		l.OptionID, l.V6 = o.ID, o.Name == "listen-on-v6"
+		out = append(out, l)
+	}
+	return out
+}
+
+func parseListener(name, value string) (Listener, error) {
+	var l Listener
+	stmt, err := namedconf.ParseOptionValue(name, value)
+	if err != nil {
+		return l, err
+	}
+	items := stmt.Items[1:]
+	for i := 0; i < len(items); i++ {
+		it := items[i]
+		if it.Block != nil {
+			for _, s := range it.Block.Stmts {
+				l.Addrs = append(l.Addrs, namedconf.Compact(s.Items))
+			}
+			continue
+		}
+		if it.Value == nil || i+1 >= len(items) || items[i+1].Value == nil {
+			continue
+		}
+		arg := items[i+1].Value.Text
+		switch strings.ToLower(it.Value.Text) {
+		case "port":
+			l.Port, _ = strconv.Atoi(arg)
+		case "tls":
+			l.TLS = arg
+		case "http":
+			l.HTTP = arg
+		}
+		i++
+	}
+	return l, nil
+}
+
+// TLSBlock is a top-level tls statement.
+type TLSBlock struct {
+	OptionID int64  `json:"option_id"`
+	Name     string `json:"name"`
+	CertFile string `json:"cert_file"`
+	KeyFile  string `json:"key_file"`
+}
+
+// TLSBlocks returns the top-level tls statements.
+func TLSBlocks(st *model.State) []TLSBlock {
+	var out []TLSBlock
+	for _, o := range st.ScopedOptions(model.ScopeTopLevel, 0) {
+		if o.Name != "tls" {
+			continue
+		}
+		stmt, err := namedconf.ParseOptionValue("tls", o.Value)
+		if err != nil {
+			continue
+		}
+		b := TLSBlock{OptionID: o.ID, Name: stmt.Arg(0)}
+		if blk := stmt.FirstBlock(); blk != nil {
+			for _, s := range blk.Stmts {
+				switch s.Keyword() {
+				case "cert-file":
+					b.CertFile = s.Arg(0)
+				case "key-file":
+					b.KeyFile = s.Arg(0)
+				}
+			}
+		}
+		out = append(out, b)
+	}
+	return out
+}
+
+// Endpoint is an address and port named serves DoT or DoH on.
+type Endpoint struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+}
+
+// Status is what is set up.
+type Status struct {
+	Enabled bool `json:"enabled"`
+	// TLS is the tls statement the setup wrote, and Certificate the
+	// certificate it names (a Jarl certificate's name, when it is one).
+	TLS         *TLSBlock  `json:"tls,omitempty"`
+	Certificate string     `json:"certificate,omitempty"`
+	DoT         []Endpoint `json:"dot"`
+	DoH         []Endpoint `json:"doh"`
+	// Listeners are all listen-on statements, the setup's and others.
+	Listeners []Listener `json:"listeners"`
+	// Other are DoT or DoH listeners written by hand.
+	Other bool `json:"other,omitempty"`
+}
+
+// GetStatus reads the setup from the configuration. certDir is where Jarl
+// writes certificates for named (certificates.dir).
+func GetStatus(st *model.State, certDir string) Status {
+	s := Status{Listeners: Listeners(st), DoT: []Endpoint{}, DoH: []Endpoint{}}
+	if s.Listeners == nil {
+		s.Listeners = []Listener{}
+	}
+	for _, b := range TLSBlocks(st) {
+		if strings.HasPrefix(b.Name, Prefix) {
+			b := b
+			s.TLS = &b
+			if dir := filepath.Dir(b.CertFile); filepath.Dir(dir) == filepath.Clean(certDir) {
+				s.Certificate = filepath.Base(dir)
+			}
+			break
+		}
+	}
+	for _, l := range s.Listeners {
+		if l.Kind() == "plain" {
+			continue
+		}
+		if !l.Managed() {
+			s.Other = true
+			continue
+		}
+		for _, a := range l.Addrs {
+			e := Endpoint{Address: a, Port: l.EffectivePort()}
+			if l.Kind() == "doh" {
+				s.DoH = append(s.DoH, e)
+			} else {
+				s.DoT = append(s.DoT, e)
+			}
+		}
+	}
+	s.Enabled = len(s.DoT)+len(s.DoH) > 0
+	return s
+}
+
+// Setup is what to set up.
+type Setup struct {
+	// Hostname is the name clients connect to (the certificate's).
+	Hostname string `json:"hostname"`
+	// Certificate is the Jarl certificate (with the dns use) to serve.
+	Certificate string `json:"certificate"`
+	// Addresses are the addresses of this server to listen on.
+	Addresses []string `json:"addresses"`
+	DoT       bool     `json:"dot"`
+	DoH       bool     `json:"doh"`
+	DoHPort   int      `json:"doh_port"` // default 443
+	DoTPort   int      `json:"dot_port"` // default 853 (clients expect it)
+	// Views get the hostname's A/AAAA records (default: none). In a
+	// linked zone they are local to the view.
+	Views []string `json:"views"`
+}
+
+// Plan returns the requests that set up encrypted DNS as s says,
+// replacing an earlier setup, and notes for the user. certDir is where
+// the certificate's files are.
+func Plan(st *model.State, s Setup, certDir string) ([]engine.Request, []string, error) {
+	var notes []string
+	if !s.DoT && !s.DoH {
+		return nil, nil, fmt.Errorf("choose DNS over TLS, DNS over HTTPS or both")
+	}
+	if s.DoHPort == 0 {
+		s.DoHPort = 443
+	}
+	if s.DoTPort == 0 {
+		s.DoTPort = DoTPort
+	}
+	for _, p := range []int{s.DoHPort, s.DoTPort} {
+		if p < 1 || p > 65535 || p == 53 {
+			return nil, nil, fmt.Errorf("port %d: use a free port other than 53", p)
+		}
+	}
+	if s.DoT && s.DoH && s.DoHPort == s.DoTPort {
+		return nil, nil, fmt.Errorf("DoT and DoH need different ports (both are %d)", s.DoHPort)
+	}
+	if s.Certificate == "" {
+		return nil, nil, fmt.Errorf("choose the certificate to serve")
+	}
+	host := strings.ToLower(strings.TrimSuffix(strings.TrimSpace(s.Hostname), "."))
+	if host == "" || !strings.Contains(host, ".") {
+		return nil, nil, fmt.Errorf("give the host name clients connect to, e.g. dns.example.com")
+	}
+	var v4, v6 []string
+	for _, a := range s.Addresses {
+		ip, err := netip.ParseAddr(strings.TrimSpace(a))
+		if err != nil {
+			return nil, nil, fmt.Errorf("%q isn't an address of this server", a)
+		}
+		ip = ip.Unmap()
+		if ip.IsUnspecified() {
+			return nil, nil, fmt.Errorf("listen on this server's addresses, not on %s (that would include public ones)", ip)
+		}
+		if ip.Is4() {
+			v4 = append(v4, ip.String())
+		} else {
+			v6 = append(v6, ip.String())
+		}
+	}
+	if len(v4)+len(v6) == 0 {
+		return nil, nil, fmt.Errorf("choose at least one address to listen on")
+	}
+	tlsName := Prefix + s.Certificate
+	dir := filepath.Join(certDir, s.Certificate)
+	tlsValue := fmt.Sprintf(`%s { cert-file "%s"; key-file "%s"; protocols { TLSv1.2; TLSv1.3; }; }`,
+		tlsName, filepath.Join(dir, "fullchain.pem"), filepath.Join(dir, "privkey.pem"))
+
+	var reqs []engine.Request
+	// Take out the earlier setup's listeners and tls statements.
+	current := Listeners(st)
+	for _, l := range current {
+		if l.Managed() {
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionDelete, l.OptionID, nil))
+		}
+	}
+	haveTLS := false
+	for _, b := range TLSBlocks(st) {
+		switch {
+		case b.Name == tlsName:
+			haveTLS = true
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionUpdate, b.OptionID, engine.OptionInput{Value: model.Ptr(tlsValue)}))
+		case strings.HasPrefix(b.Name, Prefix):
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionDelete, b.OptionID, nil))
+		}
+	}
+	if !haveTLS {
+		reqs = append(reqs, option(model.ScopeTopLevel, "tls", tlsValue))
+	}
+	// named listens on port 53 everywhere only while there is no
+	// listen-on statement at all: adding the first one for DoT would end
+	// that, so keep it explicitly.
+	plain := func(v6 bool) bool {
+		for _, l := range current {
+			if l.V6 == v6 && !l.Managed() && l.Kind() == "plain" {
+				return true
+			}
+		}
+		return false
+	}
+	add := func(name string, addrs []string) {
+		if len(addrs) == 0 {
+			return
+		}
+		list := "{ " + strings.Join(addrs, "; ") + "; }"
+		if !plain(name == "listen-on-v6") {
+			reqs = append(reqs, option(model.ScopeOptions, name, "{ any; }"))
+			notes = append(notes, fmt.Sprintf("named listened on port 53 on every address by default; %s { any; } keeps that, as the first %s statement would otherwise end it", name, name))
+		}
+		if s.DoT {
+			reqs = append(reqs, option(model.ScopeOptions, name, fmt.Sprintf("port %d tls %s %s", s.DoTPort, tlsName, list)))
+		}
+		if s.DoH {
+			reqs = append(reqs, option(model.ScopeOptions, name, fmt.Sprintf("port %d tls %s http default %s", s.DoHPort, tlsName, list)))
+		}
+	}
+	add("listen-on", v4)
+	add("listen-on-v6", v6)
+
+	// The host name's addresses, in the views asked for.
+	fqdn := host + "."
+	for _, vn := range s.Views {
+		v := st.ViewByName(vn)
+		if v == nil {
+			return nil, nil, fmt.Errorf("view %q does not exist", vn)
+		}
+		z := zoneFor(st, fqdn, v.ID)
+		if z == nil {
+			notes = append(notes, fmt.Sprintf("view %s has no zone for %s, so no address records were added there; clients must find it some other way", v.Name, host))
+			continue
+		}
+		var local *bool
+		if z.LinkGroup != 0 {
+			local = model.Ptr(true)
+		}
+		for _, set := range []struct {
+			typ   string
+			addrs []string
+		}{{"A", v4}, {"AAAA", v6}} {
+			if len(set.addrs) == 0 {
+				continue
+			}
+			reqs = append(reqs, engine.NewRequest(engine.OpRRSetReplace, 0, engine.RRSetInput{ZoneID: z.ID, Name: fqdn, Type: set.typ, Data: set.addrs, Local: local}))
+		}
+	}
+	return reqs, notes, nil
+}
+
+func option(scope, name, value string) engine.Request {
+	return engine.NewRequest(engine.OpOptionCreate, 0, engine.OptionInput{Scope: model.Ptr(scope), Name: model.Ptr(name), Value: model.Ptr(value)})
+}
+
+// zoneFor returns the primary zone in a view that holds name.
+func zoneFor(st *model.State, name string, viewID int64) *model.Zone {
+	var best *model.Zone
+	for _, z := range st.ZonesInView(viewID) {
+		if z.Type == model.ZonePrimary && (name == z.Name || strings.HasSuffix(name, "."+z.Name)) && (best == nil || len(z.Name) > len(best.Name)) {
+			best = z
+		}
+	}
+	return best
+}
+
+// Disable returns the requests that take the setup out: its listeners and
+// tls statement. Plain listeners and the host name's records stay.
+func Disable(st *model.State) []engine.Request {
+	var reqs []engine.Request
+	for _, l := range Listeners(st) {
+		if l.Managed() {
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionDelete, l.OptionID, nil))
+		}
+	}
+	for _, b := range TLSBlocks(st) {
+		if strings.HasPrefix(b.Name, Prefix) {
+			reqs = append(reqs, engine.NewRequest(engine.OpOptionDelete, b.OptionID, nil))
+		}
+	}
+	return reqs
+}
+
+// Private reports whether an address is private (RFC 1918, ULA, ...).
+func Private(a netip.Addr) bool {
+	a = a.Unmap()
+	return a.IsPrivate() || a.IsLoopback() || a.IsLinkLocalUnicast() || netip.MustParsePrefix("100.64.0.0/10").Contains(a)
+}

internal/encdns/encdns_test.go

@@ -0,0 +1,188 @@
+package encdns
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"jarl/internal/auth"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+	"jarl/internal/render"
+	"jarl/internal/store"
+)
+
+type env struct {
+	t       *testing.T
+	eng     *engine.Engine
+	st      *store.Store
+	certDir string
+}
+
+func newEnv(t *testing.T) *env {
+	dir := t.TempDir()
+	st, err := store.Open(filepath.Join(dir, "jarl.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	eng := engine.New(st, nil, engine.Config{
+		Paths:      render.Paths{ConfigDir: filepath.Join(dir, "etc"), ZoneDir: filepath.Join(dir, "zones"), CacheDir: filepath.Join(dir, "cache")},
+		StagingDir: filepath.Join(dir, "staging"), NoReload: true, SkipCheck: true,
+	}, slog.New(slog.NewTextHandler(io.Discard, nil)))
+	e := &env{t: t, eng: eng, st: st, certDir: filepath.Join(dir, "tls")}
+	os.MkdirAll(filepath.Join(e.certDir, "dns"), 0o755)
+	os.WriteFile(filepath.Join(e.certDir, "dns", "fullchain.pem"), []byte("x"), 0o644)
+	os.WriteFile(filepath.Join(e.certDir, "dns", "privkey.pem"), []byte("x"), 0o600)
+	e.submit(engine.NewRequest(engine.OpSettingsUpdate, 0, engine.SettingsInput{Nameservers: &[]string{"ns1.example.net."}}),
+		engine.NewRequest(engine.OpViewCreate, 0, engine.ViewInput{Name: model.Ptr("internal"), MatchClients: &[]string{"10.0.0.0/8"}}),
+		engine.NewRequest(engine.OpViewCreate, 0, engine.ViewInput{Name: model.Ptr("external"), MatchClients: &[]string{"any"}}))
+	e.submit(engine.NewRequest(engine.OpZoneCreate, 0, engine.ZoneInput{Name: model.Ptr("example.com"), View: model.Ptr("internal")}))
+	return e
+}
+
+func (e *env) submit(reqs ...engine.Request) *engine.Result {
+	e.t.Helper()
+	res, err := e.eng.Submit(context.Background(), reqs, auth.System, "test", "", engine.ApplyOptions{})
+	if err != nil {
+		e.t.Fatalf("%v (%+v)", err, res)
+	}
+	return res
+}
+
+func (e *env) state() *model.State {
+	st, err := e.st.LoadState(context.Background())
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	return st
+}
+
+func values(st *model.State, scope, name string) []string {
+	var out []string
+	for _, o := range st.ScopedOptions(scope, 0) {
+		if o.Name == name {
+			out = append(out, o.Value)
+		}
+	}
+	return out
+}
+
+func TestSetup(t *testing.T) {
+	e := newEnv(t)
+	setup := Setup{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"10.0.10.5", "2001:db8::5"}, DoT: true, DoH: true, Views: []string{"internal", "external"}}
+	reqs, notes, err := Plan(e.state(), setup, e.certDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	e.submit(reqs...)
+	st := e.state()
+	tls := values(st, model.ScopeTopLevel, "tls")
+	if len(tls) != 1 || !strings.HasPrefix(tls[0], "jarl-dns {") || !strings.Contains(tls[0], filepath.Join(e.certDir, "dns", "fullchain.pem")) {
+		t.Errorf("tls = %q", tls)
+	}
+	// The plain listeners named had by default are kept explicitly.
+	want4 := []string{"{ any; }", "port 853 tls jarl-dns { 10.0.10.5; }", "port 443 tls jarl-dns http default { 10.0.10.5; }"}
+	if got := values(st, model.ScopeOptions, "listen-on"); !slices.Equal(got, want4) {
+		t.Errorf("listen-on = %q, want %q", got, want4)
+	}
+	if got := values(st, model.ScopeOptions, "listen-on-v6"); len(got) != 3 || got[0] != "{ any; }" {
+		t.Errorf("listen-on-v6 = %q", got)
+	}
+	if len(notes) != 3 || !strings.Contains(strings.Join(notes, " "), "external has no zone") {
+		t.Errorf("notes = %q", notes)
+	}
+	// The host name's addresses in the internal view.
+	z := st.FindZone("example.com.", st.ViewByName("internal").ID)
+	var addrs []string
+	for _, r := range st.ZoneRecords(z.ID) {
+		if r.Name == "dns.example.com." {
+			addrs = append(addrs, r.Type+" "+r.Data)
+		}
+	}
+	if !slices.Equal(addrs, []string{"A 10.0.10.5", "AAAA 2001:db8::5"}) {
+		t.Errorf("records = %q", addrs)
+	}
+	s := GetStatus(st, e.certDir)
+	if !s.Enabled || s.Certificate != "dns" || len(s.DoT) != 2 || len(s.DoH) != 2 || s.DoH[0].Port != 443 || s.Other {
+		t.Errorf("status = %+v", s)
+	}
+
+	// Setting up again replaces the setup: DoT only, one address, and the
+	// plain listeners aren't doubled.
+	reqs, _, err = Plan(st, Setup{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"10.0.10.5"}, DoT: true}, e.certDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	e.submit(reqs...)
+	st = e.state()
+	if got := values(st, model.ScopeOptions, "listen-on"); !slices.Equal(got, []string{"{ any; }", "port 853 tls jarl-dns { 10.0.10.5; }"}) {
+		t.Errorf("after the second setup: %q", got)
+	}
+	if got := values(st, model.ScopeOptions, "listen-on-v6"); !slices.Equal(got, []string{"{ any; }"}) {
+		t.Errorf("listen-on-v6 after the second setup: %q", got)
+	}
+	if got := values(st, model.ScopeTopLevel, "tls"); len(got) != 1 {
+		t.Errorf("tls statements: %q", got)
+	}
+
+	// Off: the setup's listeners and tls statement go, the rest stays.
+	e.submit(Disable(st)...)
+	st = e.state()
+	if got := values(st, model.ScopeOptions, "listen-on"); !slices.Equal(got, []string{"{ any; }"}) || len(values(st, model.ScopeTopLevel, "tls")) != 0 || GetStatus(st, e.certDir).Enabled {
+		t.Errorf("after disabling: listen-on %q tls %q", got, values(st, model.ScopeTopLevel, "tls"))
+	}
+}
+
+func TestSetupRefuses(t *testing.T) {
+	e := newEnv(t)
+	st := e.state()
+	for _, s := range []Setup{
+		{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"10.0.10.5"}},                         // neither DoT nor DoH
+		{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"0.0.0.0"}, DoT: true},                // every address
+		{Hostname: "dns.example.com", Certificate: "dns", DoT: true},                                                // no address
+		{Hostname: "dns.example.com", Certificate: "dns", Addresses: []string{"10.0.10.5"}, DoH: true, DoHPort: 53}, // port 53
+		{Hostname: "dns", Certificate: "dns", Addresses: []string{"10.0.10.5"}, DoT: true},                          // not a host name
+	} {
+		if _, _, err := Plan(st, s, e.certDir); err == nil {
+			t.Errorf("accepted %+v", s)
+		}
+	}
+	// A tls statement whose files are missing is refused by validation.
+	_, err := e.eng.Submit(context.Background(), []engine.Request{engine.NewRequest(engine.OpOptionCreate, 0, engine.OptionInput{
+		Scope: model.Ptr(model.ScopeTopLevel), Name: model.Ptr("tls"), Value: model.Ptr(`x { cert-file "/nonexistent/c.pem"; key-file "/nonexistent/k.pem"; }`)})},
+		auth.System, "test", "", engine.ApplyOptions{})
+	if err == nil || !strings.Contains(err.Error(), "doesn't exist") {
+		t.Errorf("missing files: %v", err)
+	}
+}
+
+func TestPorts(t *testing.T) {
+	s, err := parseProcAddr("0100007F:0035")
+	if err != nil || s.Addr != netip.MustParseAddr("127.0.0.1") || s.Port != 53 {
+		t.Errorf("v4: %+v %v", s, err)
+	}
+	s, err = parseProcAddr("00000000000000000000000001000000:01BB")
+	if err != nil || s.Addr != netip.MustParseAddr("::1") || s.Port != 443 {
+		t.Errorf("v6: %+v %v", s, err)
+	}
+	e := newEnv(t)
+	old := ListeningSockets
+	t.Cleanup(func() { ListeningSockets = old })
+	ListeningSockets = func() ([]Socket, error) {
+		return []Socket{{netip.MustParseAddr("0.0.0.0"), 443}, {netip.MustParseAddr("10.0.10.5"), 8443}, {netip.MustParseAddr("::"), 853}}, nil
+	}
+	c, err := PortCheck(e.state(), []string{"10.0.10.5"}, []int{853, 443, 8443}, []string{"0.0.0.0:443"})
+	if err != nil || len(c) != 3 || c[1].What != "jarld (Jarl's web UI and API)" || c[2].What != "another program" {
+		t.Errorf("conflicts = %+v %v", c, err)
+	}
+	if p := FreeDoHPort(e.state(), []string{"10.0.10.5"}, nil); p != 4443 {
+		t.Errorf("free DoH port = %d, want 4443", p)
+	}
+}

internal/encdns/ports.go

@@ -0,0 +1,149 @@
+package encdns
+
+import (
+	"bufio"
+	"encoding/hex"
+	"fmt"
+	"net/netip"
+	"os"
+	"strconv"
+	"strings"
+
+	"jarl/internal/model"
+)
+
+// Socket is a listening TCP socket on this host.
+type Socket struct {
+	Addr netip.Addr
+	Port int
+}
+
+// ListeningSockets reads the host's listening TCP sockets from
+// /proc/net/tcp and tcp6 (Linux; nil elsewhere). It needs no privileges
+// and binds nothing. Tests replace it.
+var ListeningSockets = func() ([]Socket, error) {
+	var out []Socket
+	for _, f := range []string{"/proc/net/tcp", "/proc/net/tcp6"} {
+		socks, err := parseProcNet(f)
+		if err != nil {
+			if os.IsNotExist(err) {
+				continue
+			}
+			return nil, err
+		}
+		out = append(out, socks...)
+	}
+	return out, nil
+}
+
+func parseProcNet(path string) ([]Socket, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	var out []Socket
+	sc := bufio.NewScanner(f)
+	sc.Scan() // header
+	for sc.Scan() {
+		fields := strings.Fields(sc.Text())
+		if len(fields) < 4 || fields[3] != "0A" { // 0A: LISTEN
+			continue
+		}
+		s, err := parseProcAddr(fields[1])
+		if err == nil {
+			out = append(out, s)
+		}
+	}
+	return out, sc.Err()
+}
+
+// parseProcAddr parses "0100007F:0035": the address in 32-bit words of
+// host byte order (little-endian here), then the port.
+func parseProcAddr(s string) (Socket, error) {
+	ha, hp, ok := strings.Cut(s, ":")
+	if !ok {
+		return Socket{}, fmt.Errorf("bad address %q", s)
+	}
+	b, err := hex.DecodeString(ha)
+	if err != nil || (len(b) != 4 && len(b) != 16) {
+		return Socket{}, fmt.Errorf("bad address %q", s)
+	}
+	for i := 0; i+4 <= len(b); i += 4 {
+		b[i], b[i+1], b[i+2], b[i+3] = b[i+3], b[i+2], b[i+1], b[i]
+	}
+	addr, _ := netip.AddrFromSlice(b)
+	port, err := strconv.ParseUint(hp, 16, 16)
+	if err != nil {
+		return Socket{}, err
+	}
+	return Socket{Addr: addr.Unmap(), Port: int(port)}, nil
+}
+
+// Conflict is something else listening where a listener would go.
+type Conflict struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+	What    string `json:"what"` // who it is, when Jarl knows
+}
+
+// PortCheck says which of addresses × ports something else listens on
+// already. named's own listeners (the setup's, now) and jarld's (known
+// listen addresses) are told apart.
+func PortCheck(st *model.State, addresses []string, ports []int, jarld []string) ([]Conflict, error) {
+	socks, err := ListeningSockets()
+	if err != nil {
+		return nil, err
+	}
+	// What named listens on now with DoT or DoH (it will again).
+	ours := map[string]bool{}
+	for _, l := range Listeners(st) {
+		if l.Kind() != "plain" {
+			for _, a := range l.Addrs {
+				ours[a+"#"+strconv.Itoa(l.EffectivePort())] = true
+			}
+		}
+	}
+	jarldOn := map[string]bool{}
+	for _, l := range jarld {
+		jarldOn[l] = true
+	}
+	var out []Conflict
+	for _, as := range addresses {
+		a, err := netip.ParseAddr(as)
+		if err != nil {
+			continue
+		}
+		a = a.Unmap()
+		for _, p := range ports {
+			if ours[a.String()+"#"+strconv.Itoa(p)] {
+				continue
+			}
+			for _, s := range socks {
+				if s.Port != p || !(s.Addr == a || s.Addr.IsUnspecified() && s.Addr.Is4() == a.Is4() || s.Addr.IsUnspecified() && s.Addr.Is6()) {
+					continue
+				}
+				what := "another program"
+				for l := range jarldOn {
+					if strings.HasSuffix(l, ":"+strconv.Itoa(p)) {
+						what = "jarld (Jarl's web UI and API)"
+					}
+				}
+				out = append(out, Conflict{Address: a.String(), Port: p, What: what})
+				break
+			}
+		}
+	}
+	return out, nil
+}
+
+// FreeDoHPort returns the first of the usual DoH ports nothing listens on
+// at the addresses (0 when none is free).
+func FreeDoHPort(st *model.State, addresses []string, jarld []string) int {
+	for _, p := range []int{443, 8443, 4443, 9443} {
+		if c, err := PortCheck(st, addresses, []int{p}, jarld); err == nil && len(c) == 0 {
+			return p
+		}
+	}
+	return 0
+}

internal/server/h_encdns.go

@@ -0,0 +1,236 @@
+package server
+
+import (
+	"net/http"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+
+	"jarl/internal/auth"
+	"jarl/internal/certs"
+	"jarl/internal/encdns"
+	"jarl/internal/model"
+	"jarl/internal/nscheck"
+)
+
+// DNS over TLS and HTTPS (docs/encrypted-dns.md).
+
+type encAddress struct {
+	Address string `json:"address"`
+	Private bool   `json:"private"`
+}
+
+type encView struct {
+	Name    string `json:"name"`
+	Public  bool   `json:"public"`
+	HasZone bool   `json:"has_zone,omitempty"` // has a zone for the host name
+}
+
+type encCert struct {
+	Name     string       `json:"name"`
+	Names    []string     `json:"names"`
+	Domains  []string     `json:"domains"`
+	DNS      bool         `json:"dns"` // has the dns use
+	Status   certs.Status `json:"status"`
+	Obtained bool         `json:"obtained"`
+}
+
+type encStatus struct {
+	encdns.Status
+	// Hostname is the name clients connect to (the certificate's first).
+	Hostname string `json:"hostname,omitempty"`
+	// DoTHost and DoHURL are what to give clients.
+	DoTHost string `json:"dot_host,omitempty"`
+	DoHURL  string `json:"doh_url,omitempty"`
+	// For the setup form.
+	Addresses    []encAddress `json:"addresses"`
+	Views        []encView    `json:"views"`
+	Certificates []encCert    `json:"certificates"`
+}
+
+func (s *Server) encReady(p *auth.Principal, write bool) error {
+	if err := require(p, auth.Action{Resource: auth.ResOptions, Write: write}); err != nil {
+		return err
+	}
+	if s.cfg.Certs == nil {
+		return &httpError{http.StatusNotFound, "disabled", "certificates aren't available in this jarld"}
+	}
+	return nil
+}
+
+// localAddrs returns this host's addresses (a test may replace it).
+var localAddrs = nscheck.LocalAddrs
+
+// encryptedDNS: GET /encrypted-dns.
+func (s *Server) encryptedDNS(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := s.encReady(p, false); err != nil {
+		return err
+	}
+	st, err := s.store.LoadState(r.Context())
+	if err != nil {
+		return err
+	}
+	m := s.cfg.Certs
+	out := encStatus{Status: encdns.GetStatus(st, m.FilesDir("")), Addresses: []encAddress{}, Views: []encView{}, Certificates: []encCert{}}
+	all, err := m.List(r.Context())
+	if err != nil {
+		return err
+	}
+	for _, c := range all {
+		out.Certificates = append(out.Certificates, encCert{Name: c.Name, Names: c.Names, Domains: c.Domains, DNS: c.HasUse(model.CertUseDNS),
+			Status: m.StatusOf(c), Obtained: c.NotAfter != nil})
+		if c.Name == out.Certificate {
+			for _, n := range append(c.Names, c.Domains...) {
+				if !strings.HasPrefix(n, "*.") {
+					out.Hostname = n
+					break
+				}
+			}
+		}
+	}
+	if out.Hostname != "" {
+		if len(out.DoT) > 0 {
+			out.DoTHost = out.Hostname
+			if out.DoT[0].Port != encdns.DoTPort {
+				out.DoTHost += ":" + strconv.Itoa(out.DoT[0].Port)
+			}
+		}
+		if len(out.DoH) > 0 {
+			out.DoHURL = "https://" + out.Hostname
+			if out.DoH[0].Port != 443 {
+				out.DoHURL += ":" + strconv.Itoa(out.DoH[0].Port)
+			}
+			out.DoHURL += "/dns-query"
+		}
+	}
+	seen := map[netip.Addr]bool{}
+	for _, a := range localAddrs() {
+		a = a.Unmap()
+		if seen[a] || a.IsLinkLocalUnicast() {
+			continue
+		}
+		seen[a] = true
+		out.Addresses = append(out.Addresses, encAddress{Address: a.String(), Private: encdns.Private(a)})
+	}
+	slices.SortFunc(out.Addresses, func(a, b encAddress) int { return strings.Compare(a.Address, b.Address) })
+	host := strings.TrimSuffix(r.URL.Query().Get("hostname"), ".")
+	if host == "" {
+		host = out.Hostname
+	}
+	for _, x := range s.eng.Exposures(st) {
+		if x.View == "" {
+			continue
+		}
+		v := encView{Name: x.View, Public: x.Public}
+		if host != "" {
+			if vv := st.ViewByName(x.View); vv != nil {
+				for _, z := range st.ZonesInView(vv.ID) {
+					if z.Type == model.ZonePrimary && (host+"." == z.Name || strings.HasSuffix(host+".", "."+z.Name)) {
+						v.HasZone = true
+					}
+				}
+			}
+		}
+		out.Views = append(out.Views, v)
+	}
+	writeJSON(w, http.StatusOK, out)
+	return nil
+}
+
+// encryptedDNSCheck: POST /encrypted-dns/check {"addresses", "dot", "doh",
+// "doh_port"} says what already listens where the listeners would go.
+func (s *Server) encryptedDNSCheck(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := s.encReady(p, false); err != nil {
+		return err
+	}
+	var in encdns.Setup
+	if err := decodeJSON(r, &in); err != nil {
+		return err
+	}
+	st, err := s.store.LoadState(r.Context())
+	if err != nil {
+		return err
+	}
+	if in.DoHPort == 0 {
+		in.DoHPort = 443
+	}
+	if in.DoTPort == 0 {
+		in.DoTPort = encdns.DoTPort
+	}
+	var ports []int
+	if in.DoT {
+		ports = append(ports, in.DoTPort)
+	}
+	if in.DoH {
+		ports = append(ports, in.DoHPort)
+	}
+	conflicts, err := encdns.PortCheck(st, in.Addresses, ports, s.cfg.Listen)
+	out := map[string]any{"conflicts": conflicts}
+	if err != nil {
+		out["error"] = "can't see which ports are in use: " + err.Error()
+	}
+	if conflicts == nil {
+		out["conflicts"] = []encdns.Conflict{}
+	}
+	if in.DoH {
+		out["free_doh_port"] = encdns.FreeDoHPort(st, in.Addresses, s.cfg.Listen)
+	}
+	writeJSON(w, http.StatusOK, out)
+	return nil
+}
+
+// encryptedDNSSetup: POST /encrypted-dns stages (or applies) the setup.
+func (s *Server) encryptedDNSSetup(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := s.encReady(p, true); err != nil {
+		return err
+	}
+	var in encdns.Setup
+	if err := decodeJSON(r, &in); err != nil {
+		return err
+	}
+	c, err := s.cfg.Certs.Get(r.Context(), in.Certificate)
+	if err != nil {
+		return certErr(err)
+	}
+	switch {
+	case !c.HasUse(model.CertUseDNS):
+		return badRequest("certificate %s doesn't have the dns use, so named can't read it: jarl cert update %s --use dns (and keep its other uses)", c.Name, c.Name)
+	case c.NotAfter == nil:
+		return conflict("certificate %s hasn't been obtained yet (%s); set up encrypted DNS once it has", c.Name, s.cfg.Certs.StatusOf(c).Message)
+	case in.Hostname != "" && !certs.Covers(c.Names, []string{in.Hostname}):
+		return badRequest("certificate %s is for %s, not %s: clients would reject it", c.Name, strings.Join(c.Names, ", "), in.Hostname)
+	}
+	st, err := s.store.LoadState(r.Context())
+	if err != nil {
+		return err
+	}
+	reqs, notes, err := encdns.Plan(st, in, s.cfg.Certs.FilesDir(""))
+	if err != nil {
+		return badRequest("%v", err)
+	}
+	what := []string{}
+	if in.DoT {
+		what = append(what, "DNS over TLS")
+	}
+	if in.DoH {
+		what = append(what, "DNS over HTTPS")
+	}
+	return s.mutateNotes(w, r, p, "set up "+strings.Join(what, " and ")+" for "+in.Hostname, reqs, nil, notes)
+}
+
+// encryptedDNSDisable: DELETE /encrypted-dns.
+func (s *Server) encryptedDNSDisable(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := s.encReady(p, true); err != nil {
+		return err
+	}
+	st, err := s.store.LoadState(r.Context())
+	if err != nil {
+		return err
+	}
+	reqs := encdns.Disable(st)
+	if len(reqs) == 0 {
+		return conflict("encrypted DNS isn't set up")
+	}
+	return s.mutate(w, r, p, "turn DNS over TLS and HTTPS off", reqs, nil)
+}

internal/server/h_stats.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"errors"
 	"net/http"
 	"net/netip"
 	"path/filepath"
@@ -14,14 +15,24 @@ import (
 	"jarl/internal/stats"
 )
 
-// statsQuerier checks permission and that statistics are enabled.
-func (s *Server) statsQuerier(p *auth.Principal) (*stats.Querier, error) {
+// statsQuerier checks permission and that statistics are enabled. With
+// ?views=internal,vps the figures are for those views only.
+func (s *Server) statsQuerier(r *http.Request, p *auth.Principal) (*stats.Querier, error) {
 	if err := require(p, auth.Action{Resource: auth.ResStats}); err != nil {
 		return nil, err
 	}
 	if s.statsQ == nil {
 		return nil, &httpError{http.StatusNotFound, "stats_disabled", "query statistics are disabled; set stats.enabled: true in /etc/jarl/jarl.yaml and restart jarl (see docs/stats.md)"}
 	}
+	var views []string
+	for _, v := range strings.Split(r.URL.Query().Get("views"), ",") {
+		if v = strings.TrimSpace(v); v != "" {
+			views = append(views, v)
+		}
+	}
+	if len(views) > 0 {
+		return s.statsQ.ForViews(views), nil
+	}
 	return s.statsQ, nil
 }
 
@@ -46,7 +57,7 @@ func (s *Server) statsStatus(w http.ResponseWriter, r *http.Request, p *auth.Pri
 }
 
 func (s *Server) statsSummary(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	q, err := s.statsQuerier(p)
+	q, err := s.statsQuerier(r, p)
 	if err != nil {
 		return err
 	}
@@ -66,7 +77,7 @@ func (s *Server) statsSummary(w http.ResponseWriter, r *http.Request, p *auth.Pr
 }
 
 func (s *Server) statsTop(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	q, err := s.statsQuerier(p)
+	q, err := s.statsQuerier(r, p)
 	if err != nil {
 		return err
 	}
@@ -93,7 +104,7 @@ func (s *Server) statsTop(w http.ResponseWriter, r *http.Request, p *auth.Princi
 }
 
 func (s *Server) statsTimeline(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	q, err := s.statsQuerier(p)
+	q, err := s.statsQuerier(r, p)
 	if err != nil {
 		return err
 	}
@@ -124,7 +135,7 @@ func (s *Server) statsTimeline(w http.ResponseWriter, r *http.Request, p *auth.P
 }
 
 func (s *Server) statsHeatmap(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	q, err := s.statsQuerier(p)
+	q, err := s.statsQuerier(r, p)
 	if err != nil {
 		return err
 	}
@@ -143,7 +154,7 @@ func (s *Server) statsHeatmap(w http.ResponseWriter, r *http.Request, p *auth.Pr
 }
 
 func (s *Server) statsBreakdown(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	q, err := s.statsQuerier(p)
+	q, err := s.statsQuerier(r, p)
 	if err != nil {
 		return err
 	}
@@ -152,6 +163,9 @@ func (s *Server) statsBreakdown(w http.ResponseWriter, r *http.Request, p *auth.
 		return err
 	}
 	es, err := q.Breakdown(r.Context(), r.URL.Query().Get("group"), since)
+	if errors.Is(err, stats.ErrNotPerView) {
+		return &httpError{http.StatusBadRequest, "not_per_view", r.URL.Query().Get("group") + ": " + err.Error()}
+	}
 	if err != nil {
 		return badRequest("%v", err)
 	}
@@ -247,7 +261,7 @@ func clientNames(st *model.State, want map[netip.Addr]bool, readable func(*model
 // limits (rndc status), and the space left on the file systems Jarl and
 // named write to.
 func (s *Server) statsServer(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
-	if _, err := s.statsQuerier(p); err != nil {
+	if _, err := s.statsQuerier(r, p); err != nil {
 		return err
 	}
 	out := map[string]any{"server": s.cfg.Stats.Server()}

internal/server/routes.go

@@ -172,6 +172,10 @@ func (s *Server) routes() {
 	m.HandleFunc("DELETE "+p+"/certificates/{name}", s.authed(s.certDelete))
 	m.HandleFunc("POST "+p+"/certificates/{name}/issue", s.authed(s.certIssue))
 	m.HandleFunc("POST "+p+"/certificates/{name}/check", s.authed(s.certCheck))
+	m.HandleFunc("GET "+p+"/encrypted-dns", s.authed(s.encryptedDNS))
+	m.HandleFunc("POST "+p+"/encrypted-dns", s.authed(s.encryptedDNSSetup))
+	m.HandleFunc("DELETE "+p+"/encrypted-dns", s.authed(s.encryptedDNSDisable))
+	m.HandleFunc("POST "+p+"/encrypted-dns/check", s.authed(s.encryptedDNSCheck))
 	m.HandleFunc("GET "+p+"/exposure", s.authed(s.exposure))
 	m.HandleFunc("POST "+p+"/exposure/fix", s.authed(s.exposureFix))
 	m.HandleFunc("POST "+p+"/exposure/ack", s.authed(s.exposureAck(true)))
@@ -253,6 +257,11 @@ func changesetTarget(r *http.Request) (int64, error) {
 // mutate applies (or stages, or previews) requests and writes the
 // response. object, if set, returns the resulting object to include.
 func (s *Server) mutate(w http.ResponseWriter, r *http.Request, p *auth.Principal, description string, reqs []engine.Request, object func(st *model.State, created int64) any) error {
+	return s.mutateNotes(w, r, p, description, reqs, object, nil)
+}
+
+// mutateNotes is mutate with notes for the user, shown as warnings.
+func (s *Server) mutateNotes(w http.ResponseWriter, r *http.Request, p *auth.Principal, description string, reqs []engine.Request, object func(st *model.State, created int64) any, notes []string) error {
 	csID, err := changesetTarget(r)
 	if err != nil {
 		return err
@@ -263,7 +272,7 @@ func (s *Server) mutate(w http.ResponseWriter, r *http.Request, p *auth.Principa
 			return err
 		}
 		res.Changeset.Ops = engine.RedactOps(res.Changeset.Ops)
-		writeJSON(w, http.StatusAccepted, api.MutationResponse{Staged: true, ChangesetID: csID, Changeset: raw(res.Changeset), Added: engine.RedactOps(res.Added), Warnings: res.Warnings, Problems: raw(res.Problems)})
+		writeJSON(w, http.StatusAccepted, api.MutationResponse{Staged: true, ChangesetID: csID, Changeset: raw(res.Changeset), Added: engine.RedactOps(res.Added), Warnings: append(notes, res.Warnings...), Problems: raw(res.Problems)})
 		return nil
 	}
 	opts := engine.ApplyOptions{DryRun: queryBool(r, "dry_run"), Force: queryBool(r, "force"), AcceptRisk: queryBool(r, "accept_risk")}
@@ -272,7 +281,7 @@ func (s *Server) mutate(w http.ResponseWriter, r *http.Request, p *auth.Principa
 		s.writeErr(w, r, err, res)
 		return nil
 	}
-	out := api.MutationResponse{Applied: res.Applied, DryRun: res.DryRun, ChangesetID: res.ChangesetID, Result: raw(res), Warnings: res.Warnings}
+	out := api.MutationResponse{Applied: res.Applied, DryRun: res.DryRun, ChangesetID: res.ChangesetID, Result: raw(res), Warnings: append(notes, res.Warnings...)}
 	if object != nil && res.Applied {
 		st, err := s.store.LoadState(r.Context())
 		if err == nil {

internal/server/stats_test.go

@@ -35,7 +35,10 @@ func TestStatsAPI(t *testing.T) {
 	minute := now.Unix() - now.Unix()%60 - 120
 	hour := minute - minute%3600
 	b := &stats.Batch{}
-	vals := map[string]int64{"queries": 50, "rcode:NOERROR": 45, "rcode:NXDOMAIN": 5, "qtype:A": 30, "qtype:AAAA": 20, "zone:example.com": 40, "zone:-": 10}
+	vals := map[string]int64{"queries": 50, "rcode:NOERROR": 45, "rcode:NXDOMAIN": 5, "qtype:A": 30, "qtype:AAAA": 20, "zone:example.com": 40, "zone:-": 10,
+		"view:internal": 30, "view:external": 20, stats.ViewKey("internal", "responses"): 30, stats.ViewKey("external", "responses"): 20,
+		stats.ViewKey("internal", "rcode:NOERROR"): 30, stats.ViewKey("external", "rcode:NOERROR"): 15, stats.ViewKey("external", "rcode:NXDOMAIN"): 5,
+		"answer:authoritative": 40}
 	b.AddCounters(stats.ResMinute, minute, vals)
 	b.AddCounters(stats.ResHour, hour, vals)
 	b.SetTops(stats.ResHour, hour, stats.KindName, []stats.Entry{{Key: "www.example.com", Count: 30}, {Key: "mail.example.com", Count: 10}})
@@ -47,6 +50,16 @@ func TestStatsAPI(t *testing.T) {
 	c := stats.NewCollector(ss, opts, nil, slog.New(slog.NewTextHandler(io.Discard, nil)))
 	e := newAPIEnv(t, c)
 
+	// Some views only.
+	if sum := e.do("GET", "/stats/summary?since=1h&views=external", e.token, nil, 200); sum["queries"].(float64) != 20 || len(sum["rcodes"].([]any)) != 2 || sum["filter_views"] == nil {
+		t.Errorf("external summary = %v", sum)
+	}
+	if b := e.list("/stats/breakdown?group=rcode&since=1h&views=internal,external", e.token); len(b) != 2 || b[0]["count"].(float64) != 45 {
+		t.Errorf("rcodes of both views = %v", b)
+	}
+	if out, status := e.req("GET", "/stats/breakdown?group=answer&since=1h&views=internal", e.token, nil); status != 400 || !strings.Contains(string(out), "not_per_view") {
+		t.Errorf("answers per view = %d %s", status, out)
+	}
 	if st := e.do("GET", "/stats/status", e.token, nil, 200); st["enabled"] != true {
 		t.Errorf("status = %v", st)
 	}

internal/stats/collector.go

@@ -33,6 +33,13 @@ const (
 	KindRateLimitedName = "ratelimited_name"
 )
 
+// ViewKey is the key of a counter for one view: per-view copies of the
+// counters that come from named's response log (docs/stats.md).
+func ViewKey(view, key string) string { return "@" + view + "/" + key }
+
+// ViewKind is the kind of a top list for one view.
+func ViewKind(kind, view string) string { return kind + "@" + view }
+
 // Kinds lists the top-list kinds.
 var Kinds = []string{KindName, KindClient, KindNXDomain, KindServFail, KindRefused, KindBlocked, KindBlockedClient, KindRateLimited, KindRateLimitedName}
 
@@ -115,6 +122,9 @@ type Collector struct {
 	// rewritten holds queries named blocked (client#port|name) until their
 	// response line arrives.
 	rewritten map[string]bool
+	// viewsSince is set once per-view counters exist (meta views_since).
+	viewsSince   bool
+	viewsSinceAt int64
 	// proc is the last sample of named's process, server the latest server
 	// statistics (server.go).
 	proc   *namedProc
@@ -212,6 +222,9 @@ func (c *Collector) start(ctx context.Context) {
 			}
 		}
 	}
+	if v, _ := c.store.Meta(ctx, "views_since"); v != "" {
+		c.viewsSince = true
+	}
 	if v, _ := c.store.Meta(ctx, "first_data"); v != "" {
 		if n, err := strconv.ParseInt(v, 10, 64); err == nil {
 			t := time.Unix(n, 0)
@@ -227,7 +240,8 @@ func (c *Collector) start(ctx context.Context) {
 	if last, err := strconv.ParseInt(merged, 10, 64); err == nil {
 		from := max(last+3600, cur-48*3600)
 		for h := from; h < cur; h += 3600 {
-			for _, k := range Kinds {
+			kinds, _ := c.store.KindsAt(ctx, ResHour, h)
+			for _, k := range kinds {
 				if es, err := c.store.TopsAt(ctx, ResHour, h, k); err == nil && len(es) > 0 {
 					b.AddTops(ResDay, c.dayOf(time.Unix(h, 0)), k, es, 3*c.opts.TopN)
 				}
@@ -235,7 +249,8 @@ func (c *Collector) start(ctx context.Context) {
 		}
 	}
 	b.SetMeta("merged_through", strconv.FormatInt(cur-3600, 10))
-	for _, k := range Kinds {
+	curKinds, _ := c.store.KindsAt(ctx, ResHour, cur)
+	for _, k := range curKinds {
 		es, err := c.store.TopsAt(ctx, ResHour, cur, k)
 		if err != nil || len(es) == 0 {
 			continue
@@ -294,7 +309,7 @@ func (c *Collector) count(minute int64, key string, n int64) {
 		c.minutes[minute] = m
 	}
 	m[key] += n
-	if !strings.HasPrefix(key, "g:") && !strings.HasPrefix(key, "gn:") {
+	if !strings.HasPrefix(key, "g:") && !strings.HasPrefix(key, "gn:") && !strings.HasPrefix(key, "@") {
 		c.totals[key] += n
 	}
 }
@@ -365,33 +380,55 @@ func (c *Collector) handleLine(line string) {
 	if view == "" {
 		view = "_default"
 	}
+	zone := c.zoneOf(ev.Name, ev.View)
 	c.count(minute, "responses", 1)
 	c.count(minute, "view:"+view, 1)
-	c.count(minute, "zone:"+c.zoneOf(ev.Name, ev.View), 1)
+	c.count(minute, "zone:"+zone, 1)
+	// The same, per view, for the statistics of chosen views.
+	c.countView(minute, view, "responses", 1)
+	c.countView(minute, view, "zone:"+zone, 1)
+	c.countView(minute, view, "rcode:"+ev.RCode, 1)
+	c.countView(minute, view, "qtype:"+ev.Type, 1)
 	client := clientKey(ev.Client, c.opts.Anonymize)
 	hours := c.hours
 	if hour < c.liveHour {
 		hours = c.late
 	}
 	hours[hour] = c.hourMaps(hours, hour)
-	tops := hours[hour]
-	tops[KindName][ev.Name]++
-	tops[KindClient][client]++
-	switch {
-	case blocked:
-		// Counted by handleRewrite; not a name that doesn't exist.
-	case ev.RCode == "NXDOMAIN":
-		tops[KindNXDomain][ev.Name]++
-	case ev.RCode == "SERVFAIL":
-		tops[KindServFail][ev.Name]++
-	case ev.RCode == "REFUSED":
-		tops[KindRefused][client]++
-	}
-	for _, m := range tops {
+	add := func(kind, key string) {
+		hours[hour][kind][key]++
+		m := c.topsMap(hours, hour, ViewKind(kind, view))
+		m[key]++
 		if len(m) > maxKeys {
 			shrink(m)
 		}
 	}
+	add(KindName, ev.Name)
+	add(KindClient, client)
+	switch {
+	case blocked:
+		// Counted by handleRewrite; not a name that doesn't exist.
+	case ev.RCode == "NXDOMAIN":
+		add(KindNXDomain, ev.Name)
+	case ev.RCode == "SERVFAIL":
+		add(KindServFail, ev.Name)
+	case ev.RCode == "REFUSED":
+		add(KindRefused, client)
+	}
+	for _, k := range Kinds {
+		if m := hours[hour][k]; len(m) > maxKeys {
+			shrink(m)
+		}
+	}
+}
+
+// countView counts a per-view copy of a counter.
+func (c *Collector) countView(minute int64, view, key string, n int64) {
+	if !c.viewsSince {
+		c.viewsSince = true
+		c.viewsSinceAt = minute
+	}
+	c.count(minute, ViewKey(view, key), n)
 }
 
 // handleRewrite counts a query that blocking answered: "blocked", and
@@ -412,15 +449,24 @@ func (c *Collector) handleRewrite(rw Rewrite) {
 	}
 	c.rewritten[rw.Client.String()+"#"+rw.Port+"|"+rw.Name] = true
 	minute, hour := c.minuteOf(rw.Time), c.hourOf(rw.Time)
+	view := rw.View
+	if view == "" {
+		view = "_default"
+	}
 	c.count(minute, "blocked", 1)
 	c.count(minute, "blocklist:"+policySource(rw.Via), 1)
+	c.countView(minute, view, "blocked", 1)
+	c.countView(minute, view, "blocklist:"+policySource(rw.Via), 1)
 	hours := c.hours
 	if hour < c.liveHour {
 		hours = c.late
 	}
 	hours[hour] = c.hourMaps(hours, hour)
+	client := clientKey(rw.Client, c.opts.Anonymize)
 	hours[hour][KindBlocked][rw.Name]++
-	hours[hour][KindBlockedClient][clientKey(rw.Client, c.opts.Anonymize)]++
+	hours[hour][KindBlockedClient][client]++
+	c.topsMap(hours, hour, ViewKind(KindBlocked, view))[rw.Name]++
+	c.topsMap(hours, hour, ViewKind(KindBlockedClient, view))[client]++
 }
 
 // handleRateLimit counts a response rate limiting limited, or would have:
@@ -437,7 +483,12 @@ func (c *Collector) handleRateLimit(rl RateLimit) {
 		key = "rrl:would-" + rl.Action
 	}
 	minute, hour := c.minuteOf(rl.Time), c.hourOf(rl.Time)
+	view := rl.View
+	if view == "" {
+		view = "_default"
+	}
 	c.count(minute, key, 1)
+	c.countView(minute, view, key, 1)
 	hours := c.hours
 	if hour < c.liveHour {
 		hours = c.late
@@ -445,6 +496,8 @@ func (c *Collector) handleRateLimit(rl RateLimit) {
 	hours[hour] = c.hourMaps(hours, hour)
 	hours[hour][KindRateLimited][rl.Prefix]++
 	hours[hour][KindRateLimitedName][rl.Name+" "+rl.Type]++
+	c.topsMap(hours, hour, ViewKind(KindRateLimited, view))[rl.Prefix]++
+	c.topsMap(hours, hour, ViewKind(KindRateLimitedName, view))[rl.Name+" "+rl.Type]++
 }
 
 // policySource names what a rewrite came from: a blocklist's name, "rules"
@@ -547,6 +600,10 @@ func (c *Collector) flush(ctx context.Context, final bool) {
 		b.AddCounters(ResHour, c.hourOf(t), vals)
 		b.AddCounters(ResDay, c.dayOf(t), vals)
 		delete(c.minutes, m)
+		if c.viewsSinceAt != 0 {
+			b.SetMeta("views_since", strconv.FormatInt(c.viewsSinceAt, 10))
+			c.viewsSinceAt = 0
+		}
 		if first && len(vals) > 0 {
 			ft := t
 			c.status.FirstData = &ft

internal/stats/query.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"fmt"
 	"slices"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -14,6 +15,110 @@ type Querier struct {
 	Store *Store
 	Opts  Options
 	Now   func() time.Time
+	// Views limits the figures to these views (none: every view). Only
+	// what named's response log says can be split by view; named's own
+	// counters (cache, transport, round trips, ...) can't.
+	Views []string
+}
+
+// ForViews returns a querier limited to views (all views when empty).
+func (q *Querier) ForViews(views []string) *Querier {
+	c := *q
+	c.Views = views
+	return &c
+}
+
+func (q *Querier) filtered() bool { return len(q.Views) > 0 }
+
+// perView reports whether a counter key exists per view, and its name
+// there ("queries" is counted as responses).
+func perView(key string) (string, bool) {
+	if key == "queries" || key == "responses" {
+		return "responses", true
+	}
+	if key == "blocked" {
+		return key, true
+	}
+	for _, p := range []string{"rcode:", "qtype:", "zone:", "blocklist:", "rrl:"} {
+		if strings.HasPrefix(key, p) || key+":" == p {
+			return key, true
+		}
+	}
+	return key, false
+}
+
+// PerViewGroups are the Breakdown groups that exist per view.
+var PerViewGroups = []string{"qtype", "rcode", "view", "zone", "blocklist", "rrl"}
+
+// ErrNotPerView is returned for figures named only keeps for the whole server.
+var ErrNotPerView = fmt.Errorf("named keeps this for the whole server only, not per view")
+
+// sums is Store.sums, limited to the querier's views.
+func (q *Querier) sums(ctx context.Context, res string, from, to int64, prefix string) (map[string]int64, error) {
+	if !q.filtered() {
+		return q.Store.sums(ctx, res, from, to, prefix)
+	}
+	if prefix == "view:" {
+		all, err := q.Store.sums(ctx, res, from, to, prefix)
+		if err != nil {
+			return nil, err
+		}
+		out := map[string]int64{}
+		for _, v := range q.Views {
+			if n := all["view:"+v]; n != 0 {
+				out["view:"+v] = n
+			}
+		}
+		return out, nil
+	}
+	if _, ok := perView(prefix); !ok {
+		// Not kept per view (named's own counters): the whole server's.
+		return q.Store.sums(ctx, res, from, to, prefix)
+	}
+	out := map[string]int64{}
+	for _, v := range q.Views {
+		m, err := q.Store.sums(ctx, res, from, to, ViewKey(v, prefix))
+		if err != nil {
+			return nil, err
+		}
+		for k, n := range m {
+			out[strings.TrimPrefix(k, ViewKey(v, ""))] += n
+		}
+	}
+	return out, nil
+}
+
+// series is Store.series, limited to the querier's views.
+func (q *Querier) series(ctx context.Context, res string, from, to int64, key string) (map[int64]int64, error) {
+	pv, ok := perView(key)
+	if !q.filtered() || !ok {
+		return q.Store.series(ctx, res, from, to, key)
+	}
+	out := map[int64]int64{}
+	for _, v := range q.Views {
+		m, err := q.Store.series(ctx, res, from, to, ViewKey(v, pv))
+		if err != nil {
+			return nil, err
+		}
+		for ts, n := range m {
+			out[ts] += n
+		}
+	}
+	return out, nil
+}
+
+// ViewsSince is when per-view figures start (nil before any).
+func (q *Querier) ViewsSince(ctx context.Context) *time.Time {
+	v, err := q.Store.Meta(ctx, "views_since")
+	if err != nil || v == "" {
+		return nil
+	}
+	n, err := strconv.ParseInt(v, 10, 64)
+	if err != nil {
+		return nil
+	}
+	t := time.Unix(n, 0)
+	return &t
 }
 
 // NewQuerier returns a querier for a collector's data.
@@ -105,10 +210,15 @@ func (s *Store) series(ctx context.Context, res string, from, to int64, key stri
 	return out, rows.Err()
 }
 
-// tops sums top lists in [from, to).
-func (s *Store) tops(ctx context.Context, res, kind string, from, to int64, limit int) ([]Entry, error) {
-	rows, err := s.db.QueryContext(ctx, `SELECT key, SUM(count) AS n FROM tops WHERE res = ? AND kind = ? AND ts >= ? AND ts < ?
-		GROUP BY key ORDER BY n DESC, key LIMIT ?`, res, kind, from, to, limit)
+// tops sums top lists (of one or more kinds) in [from, to).
+func (s *Store) tops(ctx context.Context, res string, kinds []string, from, to int64, limit int) ([]Entry, error) {
+	args := []any{res}
+	for _, k := range kinds {
+		args = append(args, k)
+	}
+	args = append(args, from, to, limit)
+	rows, err := s.db.QueryContext(ctx, `SELECT key, SUM(count) AS n FROM tops WHERE res = ? AND kind IN (`+strings.TrimSuffix(strings.Repeat("?,", len(kinds)), ",")+`) AND ts >= ? AND ts < ?
+		GROUP BY key ORDER BY n DESC, key LIMIT ?`, args...)
 	if err != nil {
 		return nil, err
 	}
@@ -167,6 +277,11 @@ type Summary struct {
 	BlockedRatio  *float64           `json:"blocked_ratio,omitempty"`
 	Blocklists    []Entry            `json:"blocklists,omitempty"`
 	Tops          map[string][]Entry `json:"tops,omitempty"`
+	// Views and ViewsSince are set when the figures are for some views
+	// only: queries then counts responses, and named's own counters
+	// (answers, transport, cache) are left out.
+	FilterViews []string   `json:"filter_views,omitempty"`
+	ViewsSince  *time.Time `json:"views_since,omitempty"`
 }
 
 // Summary summarizes the last since.
@@ -179,9 +294,32 @@ func (q *Querier) Summary(ctx context.Context, since time.Duration, topLimit int
 	if err != nil {
 		return nil, err
 	}
+	if q.filtered() {
+		// The chosen views' counters, under their usual names.
+		views := map[string]int64{}
+		for _, v := range q.Views {
+			views["view:"+v] = all["view:"+v]
+		}
+		picked := map[string]int64{}
+		for k, n := range all {
+			for _, v := range q.Views {
+				if rest, ok := strings.CutPrefix(k, ViewKey(v, "")); ok {
+					picked[rest] += n
+				}
+			}
+		}
+		for k, n := range views {
+			picked[k] = n
+		}
+		picked["queries"] = picked["responses"]
+		all = picked
+	}
 	s := &Summary{From: time.Unix(from, 0), To: now, Resolution: res, Queries: all["queries"],
 		RCodes: sorted(all, "rcode:"), QTypes: sorted(all, "qtype:"), Views: sorted(all, "view:"), Zones: sorted(all, "zone:"),
 		Answers: sorted(all, "answer:"), Transport: sorted(all, "transport:")}
+	if q.filtered() {
+		s.FilterViews, s.ViewsSince = q.Views, q.ViewsSince(ctx)
+	}
 	if h, m := all["cache:hits"], all["cache:misses"]; h+m > 0 {
 		r := float64(h) / float64(h+m)
 		s.CacheHitRatio = &r
@@ -195,7 +333,7 @@ func (q *Querier) Summary(ctx context.Context, since time.Duration, topLimit int
 			s.BlockedRatio = &b
 		}
 	}
-	per, err := q.Store.series(ctx, res, from, to, "queries")
+	per, err := q.series(ctx, res, from, to, "queries")
 	if err != nil {
 		return nil, err
 	}
@@ -237,7 +375,14 @@ func (q *Querier) Top(ctx context.Context, kind string, since time.Duration, lim
 	}
 	now := q.Now()
 	res := q.topsResolution(since)
-	return q.Store.tops(ctx, res, kind, q.bucketStart(res, now.Add(-since)), now.Unix()+1, limit)
+	kinds := []string{kind}
+	if q.filtered() {
+		kinds = nil
+		for _, v := range q.Views {
+			kinds = append(kinds, ViewKind(kind, v))
+		}
+	}
+	return q.Store.tops(ctx, res, kinds, q.bucketStart(res, now.Add(-since)), now.Unix()+1, limit)
 }
 
 // Breakdown returns the totals of a counter group (qtype, rcode, view,
@@ -246,9 +391,12 @@ func (q *Querier) Breakdown(ctx context.Context, group string, since time.Durati
 	if !slices.Contains(Groups, group) {
 		return nil, fmt.Errorf("unknown group %q (use %s)", group, strings.Join(Groups, ", "))
 	}
+	if q.filtered() && !slices.Contains(PerViewGroups, group) {
+		return nil, ErrNotPerView
+	}
 	now := q.Now()
 	res := q.Resolution(since)
-	m, err := q.Store.sums(ctx, res, q.bucketStart(res, now.Add(-since)), now.Unix()+1, group+":")
+	m, err := q.sums(ctx, res, q.bucketStart(res, now.Add(-since)), now.Unix()+1, group+":")
 	if err != nil {
 		return nil, err
 	}
@@ -329,7 +477,7 @@ func (q *Querier) Timeline(ctx context.Context, since time.Duration, step string
 	var expanded []string
 	for _, k := range keys {
 		if g, ok := strings.CutSuffix(k, ":*"); ok {
-			m, err := q.Store.sums(ctx, st.res, from, to, g+":")
+			m, err := q.sums(ctx, st.res, from, to, g+":")
 			if err != nil {
 				return nil, err
 			}
@@ -342,7 +490,7 @@ func (q *Querier) Timeline(ctx context.Context, since time.Duration, step string
 	}
 	tl := &Timeline{Step: st.name, Times: starts, Series: []*Series{}}
 	bucketed := func(key string) ([]int64, error) {
-		raw, err := q.Store.series(ctx, st.res, from, to, key)
+		raw, err := q.series(ctx, st.res, from, to, key)
 		if err != nil {
 			return nil, err
 		}
@@ -404,7 +552,7 @@ func (q *Querier) Heatmap(ctx context.Context, key string, since time.Duration)
 	since = min(since, q.Opts.RetainHour)
 	now := q.Now()
 	from := q.bucketStart(ResHour, now.Add(-since))
-	raw, err := q.Store.series(ctx, ResHour, from, now.Unix()+1, key)
+	raw, err := q.series(ctx, ResHour, from, now.Unix()+1, key)
 	if err != nil {
 		return nil, err
 	}

internal/stats/store.go

@@ -264,3 +264,22 @@ func (s *Store) TopsAt(ctx context.Context, res string, ts int64, kind string) (
 	}
 	return out, rows.Err()
 }
+
+// KindsAt returns the top-list kinds stored for one bucket (per-view
+// kinds included).
+func (s *Store) KindsAt(ctx context.Context, res string, ts int64) ([]string, error) {
+	rows, err := s.db.QueryContext(ctx, `SELECT DISTINCT kind FROM tops WHERE res = ? AND ts = ?`, res, ts)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []string
+	for rows.Next() {
+		var k string
+		if err := rows.Scan(&k); err != nil {
+			return nil, err
+		}
+		out = append(out, k)
+	}
+	return out, rows.Err()
+}

internal/stats/views_test.go

@@ -0,0 +1,103 @@
+package stats
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// Figures for chosen views: from the response log, per view, and added
+// up for several.
+func TestViewFilter(t *testing.T) {
+	ctx := context.Background()
+	loc := time.FixedZone("test", 0)
+	dir := t.TempDir()
+	logFile := filepath.Join(dir, "responses.log")
+	store, err := OpenStore(filepath.Join(dir, "stats.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	named := newFakeNamed(t)
+	clk := &clock{time.Date(2026, 10, 5, 10, 0, 30, 0, loc)}
+	opts := Options{QueryLog: true, LogFile: logFile, StatisticsChannel: "unused", TopN: 10,
+		RetainMinute: 7 * 24 * time.Hour, RetainHour: 90 * 24 * time.Hour, RetainDay: 730 * 24 * time.Hour, Location: loc}
+	zones := func() map[string][]string {
+		return map[string][]string{"internal": {"adbraun.lol"}, "external": {"adbraun.lol"}}
+	}
+	c := NewCollector(store, opts, zones, slog.New(slog.NewTextHandler(io.Discard, nil)))
+	c.poller.URL = named.srv.URL
+	c.now = clk.now
+	c.start(ctx)
+	at := time.Date(2026, 10, 5, 10, 0, 40, 0, loc)
+	lines := []string{
+		logLine(at, "10.10.0.37", "internal", "nas.adbraun.lol", "A", "NOERROR"),
+		logLine(at, "10.10.0.37", "internal", "nas.adbraun.lol", "AAAA", "NOERROR"),
+		logLine(at, "10.10.0.42", "internal", "nope.adbraun.lol", "A", "NXDOMAIN"),
+		logLine(at, "203.0.113.9", "external", "www.adbraun.lol", "A", "NOERROR"),
+		logLine(at, "203.0.113.9", "external", "x.example", "A", "REFUSED"),
+		logLine(at, "192.0.2.5", "vps", "debian.org", "AAAA", "NOERROR"),
+	}
+	f, _ := os.Create(logFile)
+	for _, l := range lines {
+		f.WriteString(l)
+	}
+	f.Close()
+	c.readLog()
+	named.add(6, 1)
+	clk.t = time.Date(2026, 10, 5, 10, 1, 2, 0, loc)
+	c.flush(ctx, false)
+	clk.t = time.Date(2026, 10, 5, 11, 0, 2, 0, loc)
+	c.flush(ctx, false)
+
+	all := &Querier{Store: store, Opts: opts, Now: clk.now}
+	s, err := all.Summary(ctx, 24*time.Hour, 5)
+	if err != nil || s.Queries != 6 || s.FilterViews != nil {
+		t.Fatalf("all views: %+v %v", s, err)
+	}
+	in := all.ForViews([]string{"internal"})
+	s, err = in.Summary(ctx, 24*time.Hour, 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.Queries != 3 || len(s.Views) != 1 || s.Views[0].Key != "internal" || s.ViewsSince == nil {
+		t.Errorf("internal: queries %d views %v since %v", s.Queries, s.Views, s.ViewsSince)
+	}
+	if len(s.RCodes) != 2 || s.RCodes[0] != (Entry{Key: "NOERROR", Count: 2}) || len(s.QTypes) != 2 {
+		t.Errorf("internal rcodes %v qtypes %v", s.RCodes, s.QTypes)
+	}
+	if s.Tops[KindName][0] != (Entry{Key: "nas.adbraun.lol", Count: 2}) || len(s.Tops[KindNXDomain]) != 1 || len(s.Answers) != 0 {
+		t.Errorf("internal tops %v answers %v", s.Tops, s.Answers)
+	}
+	// Linked views, say: two together.
+	two := all.ForViews([]string{"internal", "external"})
+	s, _ = two.Summary(ctx, 24*time.Hour, 5)
+	if s.Queries != 5 || len(s.Views) != 2 {
+		t.Errorf("internal+external: %d %v", s.Queries, s.Views)
+	}
+	if es, _ := two.Top(ctx, KindClient, 24*time.Hour, 5); len(es) != 3 || es[2].Key != "10.10.0.42" {
+		t.Errorf("clients of two views: %v", es)
+	}
+	if es, _ := two.Breakdown(ctx, "rcode", 24*time.Hour); len(es) != 3 {
+		t.Errorf("rcodes of two views: %v", es)
+	}
+	if _, err := two.Breakdown(ctx, "answer", 24*time.Hour); !errors.Is(err, ErrNotPerView) {
+		t.Errorf("answers per view: %v", err)
+	}
+	tl, err := all.ForViews([]string{"vps"}).Timeline(ctx, 2*time.Hour, "1m", []string{"queries", "rcode:*"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var total int64
+	for _, v := range tl.Series[0].Values {
+		total += v
+	}
+	if total != 1 || len(tl.Series) != 2 || tl.Series[1].Key != "rcode:NOERROR" {
+		t.Errorf("vps timeline: %d %+v", total, tl.Series)
+	}
+}

internal/validate/tls.go

@@ -0,0 +1,34 @@
+package validate
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+
+	"jarl/internal/model"
+	"jarl/internal/namedconf"
+)
+
+// checkTLSFiles checks that the files a top-level tls statement names
+// exist: named fails to load the whole configuration otherwise. (Files
+// jarld can't look at are left to named.)
+func (c *checker) checkTLSFiles() {
+	for _, o := range c.s.ScopedOptions(model.ScopeTopLevel, 0) {
+		if o.Name != "tls" {
+			continue
+		}
+		stmt, err := namedconf.ParseOptionValue("tls", o.Value)
+		if err != nil || stmt.FirstBlock() == nil {
+			continue
+		}
+		for _, s := range stmt.FirstBlock().Stmts {
+			switch s.Keyword() {
+			case "cert-file", "key-file", "ca-file", "dhparam-file":
+				path := s.Arg(0)
+				if _, err := os.Stat(path); errors.Is(err, fs.ErrNotExist) {
+					c.errf("tls_file_missing", "option", o.ID, "tls %s: %s %s doesn't exist, and named won't load its configuration without it (a certificate Jarl obtains is written once it has been obtained: jarl cert list)", stmt.Arg(0), s.Keyword(), path)
+				}
+			}
+		}
+	}
+}

internal/validate/validate.go

@@ -152,6 +152,7 @@ func State(s *model.State, opts Options) []Problem {
 	c.checkDNSSEC()
 	c.checkBlocking()
 	c.checkLinked()
+	c.checkTLSFiles()
 	c.applyAcks()
 	sortProblems(c.problems)
 	return c.problems

internal/web/static/assets/app.js

@@ -20,6 +20,7 @@ import * as stats from "./pages/stats.js";
 import * as blocking from "./pages/blocking.js";
 import * as exposure from "./pages/exposure.js";
 import * as certificates from "./pages/certificates.js";
+import * as encdns from "./pages/encdns.js";
 
 const routes = [
   { pattern: /^$/, page: dashboard, nav: "dashboard" },
@@ -41,6 +42,7 @@ const routes = [
   { pattern: /^blocking$/, page: blocking, nav: "blocking" },
   { pattern: /^exposure$/, page: exposure, nav: "exposure" },
   { pattern: /^certificates$/, page: certificates, nav: "certificates" },
+  { pattern: /^encrypted-dns$/, page: encdns, nav: "encdns" },
 ];
 
 const navItems = [
@@ -51,6 +53,7 @@ const navItems = [
   ["views", "#/views", "Views"],
   ["exposure", "#/exposure", "Exposure"],
   ["certificates", "#/certificates", "Certificates", "admin"],
+  ["encdns", "#/encrypted-dns", "Encrypted DNS", "admin"],
   ["acls", "#/acls", "ACLs"],
   ["keys", "#/keys", "TSIG keys"],
   ["options", "#/options", "Server options"],

internal/web/static/assets/pages/encdns.js

@@ -0,0 +1,225 @@
+// DNS over TLS and HTTPS for your clients (docs/encrypted-dns.md): what is
+// set up and what to give clients, and a setup that obtains the
+// certificate if needed, checks the ports and stages named's
+// configuration like any change.
+import { h, mount, field, input, badge, toast, errorBox, confirmDialog, copyBox, checkbox } from "../ui.js";
+import { api, get, change, describeResult, state } from "../api.js";
+import { rerender } from "../app.js";
+
+export async function render(el) {
+  if (!state.me.admin) {
+    mount(el, h("h1", null, "Encrypted DNS"), h("div", { class: "msg warn" }, "Only administrators can set up DNS over TLS and HTTPS."));
+    return;
+  }
+  const s = await get("/encrypted-dns");
+  const parts = [h("div", { class: "page-head" },
+    h("div", { class: "grow" }, h("h1", null, "Encrypted DNS"),
+      h("div", { class: "muted" }, "DNS over TLS (DoT) and DNS over HTTPS (DoH) for your own devices: phones, laptops and browsers ask this server over an encrypted connection, and get the same answers (and blocking) as over plain DNS. Clients get the view their address matches, as with plain DNS.")),
+    s.enabled ? h("div", { class: "actions" }, h("button", { class: "danger", onclick: disable }, "Turn off")) : null)];
+
+  if (s.enabled) parts.push(statusPanel(s));
+  if (s.other) parts.push(h("div", { class: "msg info" }, "named also has DoT or DoH listeners written by hand (Server options → listen-on). The setup leaves them alone."));
+  parts.push(setupPanel(s));
+  mount(el, parts);
+}
+
+function statusPanel(s) {
+  const eps = (list) => list.map((e) => e.address + " port " + e.port).join(", ");
+  const rows = [
+    h("dt", null, "Certificate"), h("dd", null, h("a", { href: "#/certificates" }, s.certificate || "?"), s.hostname ? " (" + s.hostname + ")" : null),
+    s.dot.length ? [h("dt", null, "DNS over TLS"), h("dd", { class: "mono" }, eps(s.dot))] : null,
+    s.doh.length ? [h("dt", null, "DNS over HTTPS"), h("dd", { class: "mono" }, eps(s.doh))] : null,
+  ];
+  const addr = (s.dot[0] || s.doh[0] || {}).address || "ADDRESS";
+  const dotPortArg = s.dot[0] && s.dot[0].port !== 853 ? " -p " + s.dot[0].port : "";
+  const clients = [];
+  if (s.dot_host) {
+    clients.push(h("h3", null, "DNS over TLS"), copyBox(s.dot_host),
+      h("ul", { class: "small" },
+        h("li", null, h("strong", null, "Android: "), "Settings → Network → Private DNS → hostname: ", h("code", null, s.hostname), ". Away from home Android can't reach this server and then resolves nothing, so use a VPN home (WireGuard) or switch Private DNS to Automatic when you leave."),
+        h("li", null, h("strong", null, "Linux (systemd-resolved): "), h("code", null, "DNS=" + addr + "#" + s.hostname), " and ", h("code", null, "DNSOverTLS=yes"), " in /etc/systemd/resolved.conf (", h("code", null, "opportunistic"), " falls back to plain DNS away from home)."),
+        h("li", null, h("strong", null, "Test: "), h("code", null, "kdig +tls-ca +tls-host=" + s.hostname + dotPortArg + " @" + addr + " example.com"))));
+  }
+  if (s.doh_url) {
+    clients.push(h("h3", null, "DNS over HTTPS"), copyBox(s.doh_url),
+      h("ul", { class: "small" },
+        h("li", null, h("strong", null, "Firefox: "), "Settings → Privacy & Security → DNS over HTTPS → Increased protection (falls back to normal DNS) → Custom: the URL above."),
+        h("li", null, h("strong", null, "Chrome, Edge: "), "Settings → Privacy and security → Security → Use secure DNS → custom: the URL above."),
+        h("li", null, h("strong", null, "Windows 11: "), "Settings → Network → your connection → DNS server assignment → Edit: " + addr + ", DNS over HTTPS on (manual template), the URL above."),
+        h("li", null, h("strong", null, "Test: "), h("code", null, "curl -s -H 'accept: application/dns-json' '" + s.doh_url + "?name=example.com'"), " (or ", h("code", null, "dig +https @" + addr + " example.com"), ")")));
+  }
+  return [
+    h("div", { class: "panel" }, h("h2", null, "Set up ", badge("on", "ok")), h("dl", { class: "kv" }, rows)),
+    h("div", { class: "panel" }, h("h2", null, "For your clients"),
+      h("p", { class: "muted small" }, "Clients check the certificate against the host name, so it must resolve to this server for them (Jarl added it to the private views you chose). Open the ports in the server's firewall for your networks only."),
+      clients),
+  ];
+}
+
+function setupPanel(s) {
+  const host = input({ value: s.hostname || "", placeholder: "dns.adbraun.lol", class: "mono", style: { maxWidth: "320px" } });
+  const certSel = h("select");
+  const dot = checkbox("DNS over TLS", s.enabled ? s.dot.length > 0 : true);
+  const doh = checkbox("DNS over HTTPS", s.enabled ? s.doh.length > 0 : true);
+  const dotPort = input({ type: "number", value: (s.dot[0] || {}).port || 853, style: { width: "90px" } });
+  const dohPort = input({ type: "number", value: (s.doh[0] || {}).port || 443, style: { width: "90px" } });
+  const current = new Set([...s.dot, ...s.doh].map((e) => e.address));
+  const picked = new Set(current);
+  const portOut = h("div");
+  const err = h("div");
+  const progress = h("div", { class: "muted small" });
+
+  // Addresses: one per row, nothing ticked (but the current setup's).
+  const addrRows = s.addresses.map((a) => pickRow(a.address, picked, [a.private ? h("span", { class: "muted" }, "private")
+    : a.address.includes(":") ? h("span", { class: "muted", title: "A global IPv6 address: reachable from the internet unless the firewall stops it" }, "global")
+    : badge("public", "warn")],
+    "Listen on " + a.address, () => checkPorts()));
+  // Views for the host name's records: the private ones that have its zone.
+  const viewPicked = new Set();
+  const viewBody = h("tbody");
+  const drawViews = (views) => {
+    viewPicked.clear();
+    mount(viewBody, views.map((v) => {
+      if (!v.public && v.has_zone) viewPicked.add(v.name);
+      return pickRow(v.name, viewPicked, [v.public ? badge("public", "warn") : h("span", { class: "muted" }, "private"), " ",
+        v.has_zone ? h("span", { class: "muted small" }, "has the zone") : h("span", { class: "muted small" }, "no zone for this name: skipped")], "Add the host name to view " + v.name);
+    }));
+  };
+  drawViews(s.views);
+
+  const fillCerts = () => {
+    const name = host.value.trim().toLowerCase().replace(/\.$/, "");
+    const fit = s.certificates.filter((c) => covers([...(c.names || []), ...(c.domains || [])], name));
+    mount(certSel,
+      fit.map((c) => h("option", { value: c.name, selected: c.name === s.certificate }, c.name + " (" + (c.names || c.domains).join(", ") + (c.obtained ? "" : ", not obtained yet") + ")")),
+      name ? h("option", { value: "" }, "Obtain a new certificate for " + name) : h("option", { value: "" }, "Type the host name first"));
+  };
+  fillCerts();
+  let viewTimer = null;
+  host.addEventListener("input", () => {
+    fillCerts();
+    clearTimeout(viewTimer);
+    viewTimer = setTimeout(async () => {
+      const r = await get("/encrypted-dns", { hostname: host.value.trim() }).catch(() => null);
+      if (r) drawViews(r.views);
+    }, 300);
+  });
+
+  let checkTimer = null, checkSeq = 0;
+  const checkPorts = () => {
+    clearTimeout(checkTimer);
+    checkTimer = setTimeout(async () => {
+      const seq = ++checkSeq;
+      if (!picked.size) { mount(portOut); return; }
+      const r = await api("POST", "/encrypted-dns/check", { body: body(false) }).catch((e) => ({ error: e.message, conflicts: [] }));
+      if (seq !== checkSeq) return;
+      const msgs = r.conflicts.map((c) => h("div", null, c.what + " listens on " + c.address + " port " + c.port + "."));
+      if (r.conflicts.some((c) => c.port === Number(dohPort.value)) && r.free_doh_port) {
+        msgs.push(h("div", null, "Port " + r.free_doh_port + " is free for DoH: ",
+          h("button", { type: "button", class: "small", onclick: () => { dohPort.value = r.free_doh_port; checkPorts(); } }, "Use " + r.free_doh_port)));
+      }
+      mount(portOut, r.error ? h("div", { class: "msg warn small" }, r.error)
+        : msgs.length ? h("div", { class: "msg err small" }, msgs)
+        : h("div", { class: "msg ok small" }, "The ports are free on the chosen addresses."));
+    }, 250);
+  };
+  for (const x of [dotPort, dohPort]) x.addEventListener("input", checkPorts);
+  for (const x of [dot, doh]) x.input.addEventListener("change", checkPorts);
+  if (picked.size) checkPorts();
+
+  const body = (full) => {
+    const b = { hostname: host.value.trim(), addresses: [...picked], dot: dot.input.checked, doh: doh.input.checked, dot_port: Number(dotPort.value) || 853, doh_port: Number(dohPort.value) || 443 };
+    if (full) { b.certificate = certSel.value; b.views = [...viewPicked]; }
+    return b;
+  };
+
+  const submit = async (btn) => {
+    mount(err);
+    const b = body(true);
+    if (!b.hostname) return mount(err, h("div", { class: "msg err" }, "Give the host name clients connect to."));
+    if (!b.addresses.length) return mount(err, h("div", { class: "msg err" }, "Choose at least one address to listen on."));
+    btn.disabled = true;
+    try {
+      if (!b.certificate) {
+        // Obtain one for the host name, for named, and wait for it.
+        b.certificate = b.hostname.split(".")[0].replace(/[^a-z0-9_-]/g, "-");
+        mount(progress, "Obtaining a certificate for " + b.hostname + " from the CA…");
+        await api("POST", "/certificates", { body: { name: b.certificate, domains: [b.hostname], uses: ["dns"] } });
+        await waitObtained(b.certificate, progress);
+      } else {
+        const c = await get("/certificates/" + encodeURIComponent(b.certificate));
+        if (!c.uses.includes("dns")) await api("PATCH", "/certificates/" + encodeURIComponent(b.certificate), { body: { uses: [...c.uses, "dns"] } });
+        if (!c.not_after) {
+          if (!c.issuing_since) await api("POST", "/certificates/" + encodeURIComponent(b.certificate) + "/issue", { body: {} });
+          await waitObtained(b.certificate, progress);
+        }
+      }
+      mount(progress, "Setting up named…");
+      const r = await change("POST", "/encrypted-dns", b);
+      toast(describeResult(r));
+      (r.warnings || []).forEach((w) => toast(w, "warn", 10000));
+      rerender();
+    } catch (e) {
+      mount(progress);
+      mount(err, errorBox(e));
+    } finally { btn.disabled = false; }
+  };
+
+  const go = h("button", { class: "primary", onclick: (e) => submit(e.target) }, s.enabled ? "Change setup" : "Set up");
+  return h("div", { class: "panel" },
+    h("h2", null, s.enabled ? "Change the setup" : "Set up"),
+    h("div", { class: "form-grid" },
+      field("Host name", host, "The name clients connect to. The certificate is for it, and it gets this server's addresses in the views below."),
+      field("Certificate", certSel, "One with this name, or a new one Jarl obtains and renews (docs/certificates.md)."),
+      field("Listen on", h("div", null, h("div", { class: "table-wrap" }, h("table", { class: "pick-list" }, h("tbody", null, addrRows))), portOut),
+        "This server's addresses on your own networks. A public address works too, but then anyone who reaches it can use these listeners, as with port 53 there."),
+      field("Serve", h("div", { class: "enc-ports" }, h("div", null, dot, " on port ", dotPort), h("div", null, doh, " on port ", dohPort, h("span", { class: "muted small" }, "  at /dns-query"))),
+        "Clients expect DoT on port 853. DoH can use any free port; 443 is the default, and needs nothing else listening there."),
+      field("Host name in views", h("div", { class: "table-wrap" }, h("table", { class: "pick-list" }, viewBody)),
+        "Where the host name gets the chosen addresses (A and AAAA), local to the view in a linked zone. Clients outside these views can't find it.")),
+    err, progress,
+    h("div", { class: "buttons" }, go));
+}
+
+// pickRow is a table row that toggles value in set when clicked.
+function pickRow(value, set, extra, label, onChange) {
+  const box = h("input", { type: "checkbox", checked: set.has(value), "aria-label": label });
+  const tr = h("tr", { class: "pick" + (set.has(value) ? " selected" : "") }, h("td", null, box), h("td", { class: "mono" }, value), h("td", null, extra));
+  box.addEventListener("change", () => {
+    if (box.checked) set.add(value); else set.delete(value);
+    tr.classList.toggle("selected", box.checked);
+    if (onChange) onChange();
+  });
+  tr.addEventListener("click", (e) => { if (e.target !== box) { box.checked = !box.checked; box.dispatchEvent(new Event("change")); } });
+  return tr;
+}
+
+function covers(names, host) {
+  if (!host) return false;
+  return names.some((n) => {
+    n = n.toLowerCase().replace(/\.$/, "");
+    if (n === host) return true;
+    return n.startsWith("*.") && host.split(".").slice(1).join(".") === n.slice(2);
+  });
+}
+
+async function waitObtained(name, progress) {
+  const started = Date.now();
+  for (;;) {
+    await new Promise((r) => setTimeout(r, 2500));
+    const c = await get("/certificates/" + encodeURIComponent(name));
+    if (!c.issuing_since) {
+      if (!c.not_after) throw new Error("Obtaining the certificate failed: " + (c.last_error || "see the Certificates page"));
+      return c;
+    }
+    mount(progress, "Obtaining a certificate for " + (c.domains || []).join(", ") + " from the CA… " + Math.round((Date.now() - started) / 1000) + "s (the challenges must reach every name server)");
+  }
+}
+
+async function disable() {
+  if (!await confirmDialog("Turn encrypted DNS off", "named stops serving DNS over TLS and HTTPS. The certificate and the host name's records stay.", "Turn off", "danger")) return;
+  try {
+    toast(describeResult(await change("DELETE", "/encrypted-dns")));
+    rerender();
+  } catch (e) { toast(e.message, "err", 8000); }
+}

internal/web/static/assets/pages/stats.js

@@ -1,5 +1,6 @@
 import { h, mount, fmtTime, relTime, errorBox } from "../ui.js";
 import { get } from "../api.js";
+import { rerender } from "../app.js";
 import { lineChart, chartCard, legend, timeTable, heatmap, heatmapTable, barList, compact, stepSeconds, endLabelWidth } from "../charts.js";
 
 const ranges = [["1h", "1 hour"], ["6h", "6 hours"], ["24h", "24 hours"], ["7d", "7 days"], ["30d", "30 days"], ["90d", "90 days"]];
@@ -17,6 +18,20 @@ const rttOrder = ["<10ms", "10-100ms", "100-500ms", "500-800ms", "800-1600ms", "
 
 let generation = 0;
 
+// The views shown are remembered per browser: the ones switched off, so a
+// new view shows up switched on.
+const offKey = "jarl.stats.views.off";
+function viewsOff() {
+  try { return new Set(JSON.parse(localStorage.getItem(offKey) || "[]")); } catch { return new Set(); }
+}
+function saveViewsOff(set) {
+  try { localStorage.setItem(offKey, JSON.stringify([...set])); } catch { /* private window: not remembered */ }
+}
+
+// Breakdowns that exist per view; the others are named's own counters,
+// for the whole server.
+const perViewGroups = ["qtype", "rcode", "view", "zone", "blocklist"];
+
 export async function render(el, params, query) {
   const gen = ++generation;
   const want = query && query.get ? query.get("since") : null;
@@ -33,11 +48,21 @@ export async function render(el, params, query) {
     return;
   }
   const heatSince = rangeSecs[since] < 7 * 86400 ? "7d" : since;
+  // Which views: all of them unless some are switched off.
+  const allViews = status.query_log ? (await get("/views").catch(() => [])).map((v) => v.name) : [];
+  const off = viewsOff();
+  const shown = allViews.filter((v) => !off.has(v));
+  const filtered = allViews.length > 0 && shown.length < allViews.length;
+  const vf = filtered ? { views: shown.join(",") } : {};
+  if (filtered && !shown.length) {
+    mount(el, head, filterRow(since, allViews, off), h("div", { class: "empty" }, "No views chosen: switch one on above."));
+    return;
+  }
   let data;
   try {
-    data = await loadAll(since, heatSince, status.query_log);
+    data = await loadAll(since, heatSince, status.query_log, vf, filtered);
   } catch (e) {
-    mount(el, head, errorBox(e));
+    mount(el, head, filterRow(since, allViews, off), errorBox(e));
     return;
   }
   if (gen !== generation) return; // the user moved on
@@ -46,13 +71,17 @@ export async function render(el, params, query) {
   // sudden drop in traffic.
   const timeline = complete(data.timeline), errors = complete(data.errors);
   const step = stepSeconds[timeline.step];
-  const parts = [head, filterRow(since)];
+  const parts = [head, filterRow(since, allViews, off)];
   for (const w of status.warnings || []) parts.push(h("div", { class: "msg warn" }, w));
+  if (filtered) {
+    parts.push(h("div", { class: "msg info small" }, "Showing view" + (shown.length > 1 ? "s " : " ") + shown.join(", ") + ": answers from named's response log" +
+      (s.views_since ? ", per view since " + fmtTime(s.views_since) : "") + ". named's own figures (answer sources, upstream times, cache, the server) are for the whole server."));
+  }
 
   // Headline numbers.
   const rangeLabel = "in the last " + ranges.find((r) => r[0] === since)[1];
   parts.push(h("div", { class: "cards" },
-    tile("Queries", compact(s.queries), rangeLabel),
+    tile(filtered ? "Answers" : "Queries", compact(s.queries), rangeLabel),
     tile("Per second", s.avg_qps < 10 ? s.avg_qps.toFixed(2) : Math.round(s.avg_qps).toLocaleString(), "on average"),
     s.peak ? tile("Busiest " + s.peak.per, compact(s.peak.queries), fmtTime(s.peak.time)) : null,
     s.nxdomain_ratio != null ? tile("NXDOMAIN", pct(s.nxdomain_ratio), "of queries named no existing name") : null,
@@ -62,7 +91,7 @@ export async function render(el, params, query) {
   // Volume over time: one series, so no legend box; the title names it.
   // With blocking, a second line shows how many of them were blocked.
   const q = timeline.series.find((x) => x.key === "queries") || { values: timeline.times.map(() => 0) };
-  const qSeries = [{ label: "Queries", values: q.values, slot: 1 }];
+  const qSeries = [{ label: filtered ? "Answers" : "Queries", values: q.values, slot: 1 }];
   const bl = timeline.series.find((x) => x.key === "blocked");
   if (bl && bl.values.some((v) => v > 0)) qSeries.push({ label: "Blocked", values: bl.values, slot: 2 });
   // Failed answers: three fixed series, legend plus end labels.
@@ -71,7 +100,8 @@ export async function render(el, params, query) {
   // The two charts are one above the other: the same room for labels on
   // both sides keeps their time axes in line.
   const gutter = { left: 52, right: Math.max(endLabelWidth(qSeries), anyFailures ? endLabelWidth(fSeries) : 0) };
-  parts.push(chartCard(qSeries.length > 1 ? "Queries and blocked queries" : "Queries", "per " + stepName(timeline.step) + ", " + rangeLabel,
+  const qWord = filtered ? "Answers" : "Queries";
+  parts.push(chartCard(qSeries.length > 1 ? qWord + " and blocked queries" : qWord, "per " + stepName(timeline.step) + ", " + rangeLabel,
     lineChart({ series: qSeries, times: timeline.times, step, area: true, gutter }), timeTable(qSeries, timeline.times, step),
     { wide: true, legend: qSeries.length > 1 ? legend(qSeries) : null }));
 
@@ -117,19 +147,20 @@ export async function render(el, params, query) {
   scheduleRefresh(el, params, query, gen);
 }
 
-async function loadAll(since, heatSince, queryLog) {
+async function loadAll(since, heatSince, queryLog, vf, filtered) {
   const p = {
-    summary: get("/stats/summary", { since, top: 0 }),
-    timeline: get("/stats/timeline", { since, key: "queries,blocked" }),
-    errors: get("/stats/timeline", { since, key: failures.map((f) => f.key).join(",") }),
-    heat: get("/stats/heatmap", { since: heatSince }),
+    summary: get("/stats/summary", { since, top: 0, ...vf }),
+    timeline: get("/stats/timeline", { since, key: "queries,blocked", ...vf }),
+    errors: get("/stats/timeline", { since, key: failures.map((f) => f.key).join(","), ...vf }),
+    heat: get("/stats/heatmap", { since: heatSince, ...vf }),
     server: get("/stats/server").catch(() => null),
     gauges: get("/stats/timeline", { since, key: gaugeKeys.join(",") }),
   };
   const groups = ["qtype", "rcode", "view", "zone", "answer", "rtt", "blocklist"];
-  groups.forEach((g) => { p["b_" + g] = get("/stats/breakdown", { group: g, since }); });
+  // With some views only, named's own counters aren't asked for.
+  groups.forEach((g) => { p["b_" + g] = filtered && !perViewGroups.includes(g) ? Promise.resolve([]) : get("/stats/breakdown", { group: g, since, ...vf }); });
   if (queryLog) {
-    for (const k of ["name", "client", "nxdomain", "refused", "servfail", "blocked", "blocked_client"]) p["t_" + k] = get("/stats/top", { kind: k, since, limit: 15 });
+    for (const k of ["name", "client", "nxdomain", "refused", "servfail", "blocked", "blocked_client"]) p["t_" + k] = get("/stats/top", { kind: k, since, limit: 15, ...vf });
   }
   const keys = Object.keys(p);
   const vals = await Promise.all(Object.values(p));
@@ -162,11 +193,26 @@ function complete(tl) {
   return tl;
 }
 
-function filterRow(since) {
-  return h("div", { class: "filter-row", role: "group", "aria-label": "Time range" },
+function filterRow(since, views, off) {
+  const range = h("div", { class: "filter-row", role: "group", "aria-label": "Time range" },
     h("span", { class: "muted" }, "Range"),
     h("div", { class: "segmented" }, ranges.map(([k, label]) =>
       h("a", { href: "#/stats?since=" + k, class: k === since ? "active" : "", "aria-current": k === since ? "true" : null, title: "last " + label }, k))));
+  if (!views || views.length < 2) return range;
+  // A toggle per view (together: linked views, say), and all or none.
+  const set = (next) => { saveViewsOff(next); rerender(); };
+  const toggles = views.map((v) => {
+    const on = !off.has(v);
+    return h("button", { type: "button", class: "chip toggle-chip" + (on ? " on" : ""), "aria-pressed": on ? "true" : "false",
+      title: on ? "Leave view " + v + " out" : "Include view " + v,
+      onclick: () => { const n = new Set(off); if (on) n.add(v); else n.delete(v); set(n); } }, v);
+  });
+  return h("div", { class: "filter-rows" }, range,
+    h("div", { class: "filter-row", role: "group", "aria-label": "Views" },
+      h("span", { class: "muted" }, "Views"),
+      h("div", { class: "chips" }, toggles),
+      h("button", { type: "button", class: "small", disabled: off.size === 0, onclick: () => set(new Set()) }, "All"),
+      h("button", { type: "button", class: "small", disabled: off.size === views.length, onclick: () => set(new Set(views)) }, "None")));
 }
 
 const gaugeKeys = ["g:named:rss", "g:named:mem", "g:cache:mem", "g:named:cpu"];

internal/web/static/assets/style.css

@@ -518,3 +518,14 @@ td textarea.code { min-width: min(72ch, 50vw); }
 table.pick-list tr.pick { cursor: pointer; }
 table.pick-list tr.pick td:first-child { width: 2em; }
 table.pick-list tr.pick.selected { background: var(--accent-soft); }
+
+/* Encrypted DNS: a protocol per line with its port. */
+.enc-ports > div { margin: 2px 0; }
+.enc-ports input[type=number] { display: inline-block; }
+
+/* Statistics: views switched on and off. */
+.filter-rows { display: flex; flex-direction: column; gap: 8px; margin-bottom: 12px; }
+.filter-rows .filter-row { margin-bottom: 0; }
+.filter-row .chips { display: flex; flex-wrap: wrap; gap: 6px; }
+.chip.toggle-chip { opacity: 0.55; font-size: 13px; padding: 3px 12px; }
+.chip.toggle-chip.on { opacity: 1; text-decoration: none; background: var(--accent-soft); border-color: var(--accent); }

scripts/e2e.sh

@@ -764,6 +764,30 @@ if [ -n "$PEBBLE" ]; then
 	run "a second certificate for the web UI is refused (exit 6)" 6 $J cert create other --domain nas.adbraun.test --use web
 	run "certificate metrics" 0 curl -sf http://127.0.0.1:$HTTP/metrics
 	contains '^jarl_certificate_failing{certificate="ns1",source="acme"} 0$'
+	# Encrypted DNS set up by Jarl (docs/encrypted-dns.md), next to the
+	# hand-written listener above.
+	EDOT=${EDOT_PORT:-25855}; EDOH=${EDOH_PORT:-25856}
+	run "encrypted-dns: off" 0 $J encrypted-dns
+	contains "Encrypted DNS: *off"
+	run "encrypted-dns check: the ports are free" 0 $J encrypted-dns check --address 127.0.0.1 --doh-port $EDOH
+	contains "The ports are free"
+	run "encrypted-dns check: jarld's port is taken" 0 $J encrypted-dns check --address 127.0.0.1 --doh-port $HTTP
+	contains "jarld (Jarl's web UI and API) listens there"
+	run "encrypted-dns setup" 0 $J encrypted-dns setup --hostname ns1.adbraun.test --address 127.0.0.1 --dot-port $EDOT --doh-port $EDOH
+	run "status: on, with what to give clients" 0 $J encrypted-dns
+	contains "DNS over TLS: *127.0.0.1 port $EDOT"
+	contains "For DoH clients: *https://ns1.adbraun.test:$EDOH/dns-query"
+	run "DoT through the setup" 0 $DIG +tls +tls-ca=$E/pebble-root.pem +tls-hostname=ns1.adbraun.test +short -p $EDOT @127.0.0.1 nas.adbraun.test A
+	contains "^192.168.1.20$"
+	run "DoH through the setup" 0 $DIG +https +tls-ca=$E/pebble-root.pem +tls-hostname=ns1.adbraun.test +short -p $EDOH @127.0.0.1 nas.adbraun.test A
+	contains "^192.168.1.20$"
+	run "plain DNS still answers on port 53's listener" 0 $DIG +short -p $DNS @127.0.0.1 nas.adbraun.test A
+	contains "^192.168.1.20$"
+	run "a certificate named uses can't be deleted (exit 6)" 6 $J cert delete ns1 --yes
+	contains "take it out first"
+	run "encrypted-dns disable" 0 $J encrypted-dns disable
+	run "encrypted-dns: off again" 0 $J encrypted-dns
+	contains "Encrypted DNS: *off"
 	dot_id=$($J option list -o field=id,name,value | awk -F'\t' '$2 == "listen-on" && /tls e2e/ {print $1}')
 	run "named: remove the DoT listener" 0 $J option unset --id "$dot_id"
 	run "named: remove the tls block" 0 $J option unset tls --toplevel