adam/jarl
1
0 Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases 34 Wiki Activity

34 Releases 34 Tags

RSS Feed
  • v0.6.0-rc.3 d4399cf630
    Compare

    Jarl v0.6.0-rc.3
    release / release (push) Successful in 2m11s
    Details
    Pre-Release

    adam released this 2026-10-13 18:40:52 +00:00 | 26 commits to main since this release

    Added

    • Reverse zones made easy (docs/reverse.md):

      • Missing reverse zones: the Zones page and jarl zone suggest-reverse list the reverse zones the private views lack for
        their A and AAAA records' addresses: the /24 of a private IPv4 network,
        a /32 for a public address (the rest of its /24 belongs to others),
        the /48 of IPv6 addresses. Create one, or all (--create), filled.
      • Fill: jarl zone create 10.0.10.0/24 --fill (ticked in the New
        zone dialog) adds a PTR record for each address the view's records use
        there; jarl zone fill-ptr and the reverse zone's page add the ones
        missing later. An address with several names gets its mail or name
        server's name, else a host's.
      • The right view: a reverse zone created without a view goes to the
        private view whose records use its addresses.
      • PTR records kept in step per zone (jarl zone update ZONE --auto-ptr, zone settings → Reverse DNS): adding, changing,
        disabling or deleting an A or AAAA record does the same to its PTR
        record, as the Update PTR box does for one change.
      • Suggestions come in two groups: yours (private networks, a ULA or
        an IPv6 /48 this server has an address in), which Create all
        creates, and public addresses, each a /32 or /128 to create only
        if it is yours (not a web host's) or Dismiss. A view can turn
        suggestions off (jarl view update vps --reverse-suggestions=false),
        e.g. one only a VPS uses.

    • A zone created inside another in the same view (a /24 inside a /8,
      lab.adbraun.lol inside adbraun.lol) takes the parent's records
      under it, which named would no longer serve from the parent; a
      delegation and its glue stay.

    • Zone commands take a network for a reverse zone: jarl zone show 10.0.10.0/24.

    • New reverse zone (Zones page) lists the networks your records use
      without a reverse zone, in every view, also where nothing is suggested
      (suggestions off, dismissed, public views); pick one, change its size
      (/48, /56, /64, /128 for IPv6, around the records' address) and create
      it filled. With a view chosen, it also lists the addresses only other
      views' records use, and fill names them from there (a VPS's AAAA in
      external, its PTR in internal). jarl zone suggest-reverse --all [--view V]. Both lists have a search, so hundreds of addresses stay
      manageable: the public addresses fold away, show 25 at a time, and
      Dismiss these N dismisses everything a search found in one change
      (--dismiss takes several networks).

    • Encrypted DNS: several host names (one certificate for all; the
      health check says when the served certificate misses one), and each
      listen address gets its own views       for the host names' records
      (--address 10.0.10.5=internal, a view checkbox per address in the
      form), local to the view, with a warning when a public view would get
      a private address. A view no longer ticked loses the address. The form
      starts from where the records are now. The Certificates page and jarl cert show say what named uses a certificate for (DNS over TLS or HTTPS,
      on which addresses and ports).

    • docs/encrypted-dns.md: forwarding to Quad9 or Cloudflare over TLS, how to
      check it works, and why not over HTTPS.

    • Comparing one name across views: jarl zone diff adbraun.lol nas [A],
      and a Compare button on each record.

    • Exploring the statistics: jarld keeps every answer for a while
      (stats.retention.queries, default 7 days), and every client, name,
      view, record type, result and blocklist on the Statistics page leads to
      an explore page for it: answers over time, the top clients, names,
      views, types, results and blocklists among them (each a link that
      narrows it further), and the latest answers. "NXDOMAIN in external" →
      the clients asking → everything one of them asks. A filter bar types
      filters in, several values each (any of them), !value to leave one
      out and *.example.com for a domain and below; hide on a list entry
      leaves it out. Explore the answers opens the page from the
      Statistics page. GET /stats/explore.

    • Storage on the dashboard: the size of Jarl's databases (and how many
      answers the query log holds), and per disk Jarl uses a bar of how full it
      is and how much of it the databases take. The Statistics page shows the
      statistics database's size too, and its disk tiles get the same bar.

    Changed

    • jarl option set tls NAME … (and key, remote-servers, http,
      dnssec-policy, server …) replaces only the statement with that name:
      setting tls cloudflare used to replace tls quad9. jarl option unset tls cloudflare removes one by its name.
    • Compare views and jarl zone diff are rebuilt around the view
      you're on (docs/views.md#comparing-views): a summary per view, then
      what is answered differently (a view's own records in linked zones,
      drift otherwise) with Use this everywhere, the names only some
      views have, grouped, with Add to VIEW, and how many are the same.
      One line per record: the CLI cuts long TXT records to the terminal
      (--wide shows them whole). --with picks the views to compare with.
      GET /zones/{zone}/compare returns these sections instead of rows.

    Fixed

    • Encrypted DNS: the client hints tested with kdig (Knot's, often not
      installed) and with curl's JSON API, which named's DoH doesn't speak;
      they use BIND's dig +tls / dig +https now.
    • Server options → Added by Jarl: long statements didn't wrap, and the
      browser console reported a Content Security Policy violation (an inline
      style the page's policy blocks).

    Upgrading from 0.5

    • Tested: 0.5.2 packages with views, a linked zone, a reverse zone,
      blocking, a tls statement and statistics, upgraded in place in Debian
      13 (BIND 9.20.29): everything kept and answered as before, the new
      features worked on the upgraded data, and a 0.5.2 backup restored.
    • The database gets two new versions (12 and 13), applied when jarld
      starts; a 0.5 jarld can't open it afterwards, so take a backup first (sudo jarld backup). Nothing changes until you turn auto_ptr on for a
      zone.
    • The statistics database gets a new version too (the query log); 0.5
      can't open it afterwards either. It starts empty and fills from then on.
    Downloads