abrown38andClaude Opus 5.5
3b7bee67f8
Off by default (stats in jarl.yaml). When enabled, Jarl adds a loopback statistics channel and a response log to named's configuration (merged into existing logging/statistics-channels statements) and switches response logging with rndc responselog, because the responselog option only counts when named starts. jarld polls named's counters every minute and tails the response log (resuming after restarts and across rotation). It stores aggregates, never individual queries, in a separate SQLite database: per-minute, hourly and daily counters (queries, result codes, record types, views, zones, cache hits, upstream latency, DNSSEC) and hourly/daily top lists (names, clients, NXDOMAIN and SERVFAIL names, refused clients), each with its own retention. Clients can be anonymized or excluded. - Web UI: Statistics page with KPI tiles, queries and failed answers over time, a weekday x hour heatmap, top lists and breakdowns; SVG charts with hover/keyboard readouts, a table view and light/dark palettes validated for colour-vision deficiency. - CLI: jarl stats status|summary|top|timeline|heatmap|breakdown. - API: /api/v1/stats/*, behind a new "stats" permission resource. - jarld brings named's configuration up to date with jarl.yaml at startup (engine.SyncConfig), never overwriting hand-edited files. - resync now refuses to overwrite drifted files without force, as documented. - tmpfiles.d creates /var/log/named (allowed by named's AppArmor profile on Debian 13 and Ubuntu). - The e2e harness runs named with -f like the Debian unit. - docs/stats.md, plus API, CLI, configuration, permissions and README updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 lines
842 B
Plaintext
17 lines
842 B
Plaintext
# Directories Jarl needs (installed as /usr/lib/tmpfiles.d/jarl.conf).
|
|
# Apply with: systemd-tmpfiles --create jarl.conf
|
|
#
|
|
# Type Path Mode User Group
|
|
d /etc/jarl 0750 root jarl
|
|
d /var/lib/jarl 0750 jarl jarl
|
|
# Generated named configuration: named reads it (AppArmor allows /etc/bind).
|
|
d /etc/bind/jarl 2750 jarl bind
|
|
# Primary zone files: named may write journals here (/var/lib/bind is writable for named).
|
|
d /var/lib/bind/jarl 2770 jarl bind
|
|
# Files named writes for secondary, stub and mirror zones.
|
|
d /var/cache/bind/jarl 2770 jarl bind
|
|
# Query statistics (stats in jarl.yaml): named writes its response log here
|
|
# (Debian's AppArmor profile allows /var/log/named) and jarld reads it as a
|
|
# member of group bind.
|
|
d /var/log/named 0750 bind bind
|