abrown38andClaude Opus 5.5
5630e7a848
Zones get a DNSSEC setting: named signs them with BIND's default (or a custom) dnssec-policy and inline signing, with keys in a per-view key directory. Jarl shows the keys, the DS record and when it is safe to publish it, checks the parent's DS records (check-ds, which also tells named), and refuses steps that would break a signed domain: switching straight to unsigned, finishing a turn-off too early, deleting or moving a signed zone, TTLs above max-zone-ttl. Turning off goes through the insecure policy; wipe starts over once the parent has no DS. Backups store the DNSSEC keys and restore puts them back for named; the backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's serial above named's whenever it writes an older one (after a restore). The serials check compares the signed serial. With a Porkbun API key in jarl.yaml, the registrar's name servers, glue records and DS records can be shown and changed, each change checked first (dry run, force to override). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
53 lines
1.8 KiB
Desktop File
53 lines
1.8 KiB
Desktop File
# Jarl: one database backup (with the DNSSEC keys), run daily by
|
|
# jarl-backup.timer.
|
|
# Installed as /etc/systemd/system/jarl-backup.service (see
|
|
# docs/operations.md#backups). What to keep, and where, is in the backup:
|
|
# section of /etc/jarl/jarl.yaml; when it runs is in jarl-backup.timer.
|
|
[Unit]
|
|
Description=Jarl database backup
|
|
Documentation=file:///usr/local/share/doc/jarl/docs/operations.md
|
|
# Nothing to back up before 'jarld init'. (If you moved the database in
|
|
# jarl.yaml, change this with 'systemctl edit jarl-backup.service'.)
|
|
ConditionPathExists=/var/lib/jarl/jarl.db
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/jarld --config /etc/jarl/jarl.yaml backup
|
|
User=jarl
|
|
Group=jarl
|
|
UMask=0077
|
|
Nice=10
|
|
IOSchedulingClass=idle
|
|
|
|
# The database (read, and the backup's record written) and the backup
|
|
# directory. If you change backup.dir in jarl.yaml, allow the new one too:
|
|
# 'systemctl edit jarl-backup.service' and add ReadWritePaths=/new/dir.
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/jarl -/var/backups/jarl
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
PrivateNetwork=yes
|
|
NoNewPrivileges=yes
|
|
# Read access to every file, and nothing else: named's DNSSEC private keys
|
|
# (under /var/lib/bind/jarl/dnssec-keys) are readable only by named's user,
|
|
# and the backup includes them. Everything outside the paths above stays
|
|
# read-only (ProtectSystem=strict).
|
|
CapabilityBoundingSet=CAP_DAC_READ_SEARCH
|
|
AmbientCapabilities=CAP_DAC_READ_SEARCH
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|