jarl/CHANGELOG.md

# Changelog

All notable changes to Jarl are documented here. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
[Semantic Versioning](https://semver.org/).

## [Unreleased]

The first version, to be released as 0.1.0.

### Added

- **Query statistics** (off by default; `stats` in jarl.yaml, docs/stats.md).
  When enabled, Jarl adds a loopback statistics channel and a response log to
  named's configuration (merged into existing `logging` and
  `statistics-channels` statements) and switches response logging with
  `rndc responselog`. jarld aggregates named's counters and the log into a
  separate SQLite database: per-minute, hourly and daily counters (queries,
  result codes, record types, views, zones, cache hits, upstream latency,
  DNSSEC) and hourly and daily top lists (names, clients, NXDOMAIN and
  SERVFAIL names, refused clients), each with its own retention. Clients can
  be anonymized or excluded. It is shown on a new Statistics page in the web
  UI (KPI tiles, queries and failed answers over time, a weekday x hour
  heatmap, top lists and breakdowns, each chart with a table view), in
  `jarl stats status|summary|top|timeline|heatmap|breakdown`, and in the API
  under `/api/v1/stats/`, behind the new `stats` permission. Works with the
  bind9 packages of Debian 13 and Ubuntu 26.04.
- At startup jarld brings named's configuration up to date with jarl.yaml
  settings that affect it (such as statistics), through the usual checked
  pipeline. Files changed by hand are never overwritten.
- **jarld daemon**: REST API (`/api/v1`) and embedded web UI, with SQLite as
  the source of truth for the whole BIND configuration. Runs under systemd
  (`Type=notify`, sandboxed, unprivileged `jarl` user in group `bind`).
  SIGHUP and certificate file changes reload TLS.
- **Configuration model**: views (ordered, match-clients/destinations,
  recursive-only), ACLs (nested, negation, keys, reference tracking with
  rename and delete protection), TSIG keys (kept in a separate `keys.conf`,
  never in diffs), zones of every type (primary, secondary, stub,
  static-stub, forward, mirror, hint, redirect, in-view), reverse zones
  from a CIDR, records of every type, options at server, view, zone and
  top-level scope, and defaults for new zones.
- **BIND 9.20 option catalog**: all 353 statements with grammar, allowed
  scopes, value kinds, deprecation status and ARM descriptions, used for
  validation and by the UI's option editor.
- **Changesets**: immediate one-operation changes by default; staging into
  named changesets (`?changeset=`, `X-Jarl-Changeset`, `--changeset`),
  batches (`POST /apply`, `jarl apply -f`), dry runs, previews with diffs,
  and revert of applied changesets. Optimistic locking with object versions.
- **Apply pipeline**: whole-configuration validation, rendering, `named-checkconf -z`
  and `named-checkzone` in a staging directory, atomic install, `rndc reconfig`
  and per-zone reload, verification with `rndc zonestatus`, and automatic
  rollback when named doesn't load the change. Automatic serials (date,
  increment or unixtime policy, RFC 1982), bumped only when DNS data
  changes. Drift detection for files changed outside Jarl.
- **Validation**: CNAME/DNAME rules, NS/MX/SRV targets, glue and
  delegations, RRset TTL consistency, BIND 9.20 RRset/type limits, SPF/DMARC
  sanity, ACL/key references and cycles, option syntax and scope, and
  security lints (open resolver, open zone transfers, dynamic updates on
  managed zones).
- **Records**: TXT entered as plain text (automatic quoting and 255-byte
  splitting), relative and absolute names with detection of doubled
  origins, PTR records kept in step with A/AAAA (`ptr`), RRset replace,
  delete by match, zone file import (merge or replace).
- **Import and adoption**: `jarld import` reads an existing named.conf tree
  and zone files (comments, `$INCLUDE`, `$GENERATE`, legacy
  `master`/`slave` spellings); `jarld adopt` switches named to Jarl's
  configuration with a backup and automatic fallback.
- **Authentication**: web logins with argon2id passwords, sessions
  (HttpOnly, SameSite=Strict) and CSRF tokens, rate limiting per user and
  IP; hashed API tokens (`jarl_...`) with optional expiry.
- **Permissions**: granular grants (resource × read/write, filtered by zone,
  view, record name pattern and type), roles (`readonly`, `dns-editor`,
  `operator`, `acme`), tokens restricted to a subset of their user's
  rights, administrators.
- **Audit log** of logins, changes, users, tokens and secret reveals, with
  user, token, IP and outcome, searchable and written to the journal.
- **Web UI**: dashboard, zones and records with inline editing and pending
  markers, views, ACLs, TSIG keys, the option editor, review and apply,
  history with revert, audit log, users, account and tokens, search.
  Review mode by default, with an "apply immediately" switch.
- **jarl CLI**: zones, records, views, ACLs, TSIG keys, options, settings,
  changesets, batches, history, users, tokens, audit, search, status, check
  and resync. Table, JSON and YAML output, and documented exit codes.
- **ACME DNS-01**: `jarl acme set|unset`, certbot hooks
  (`jarl acme certbot-auth|certbot-cleanup`), an acme.sh DNS API hook
  (`contrib/acme.sh/dns_jarl.sh`), automatic zone and view discovery,
  idempotent retries, and `--follow-cname` / `--resolver` for a dedicated
  ACME zone.
- **Operations**: `jarld backup` (online), `jarld resync`, `jarld check`,
  `jarld render`, local user recovery commands, audit retention.
- **Packaging**: Makefile (build, test, e2e, install, dist), systemd unit,
  sysusers.d and tmpfiles.d files, example configuration
  (`jarld config --example`).
- **Tests**: unit tests for every package, integration tests against the
  real named 9.20 (checkers, reload and rollback, import and adopt), and an
  end-to-end script (`scripts/e2e.sh`) that drives every CLI command
  against a running named.
- **Documentation**: concepts, install and adoption, configuration, CLI,
  API, permissions, ACME, validation, operations and development guides, and
  a split-DNS guide for adding views to a server that has none.

### Changed

- `jarl resync` / `jarld resync` refuse to overwrite files that were changed
  outside Jarl unless `--force` is given, as documented. Before, they always
  overwrote them.

### Fixed

- The negative-caching warning now uses the effective negative TTL, which
  is the smaller of the SOA minimum and the zone's default TTL (RFC 2308).
  It explains the real effect (new names can stay invisible to resolvers
  that already asked) and gives the command that fixes it. Before, it
  fired on the SOA minimum alone and wrongly blamed BIND's resolver cap.
- Problems printed by `jarld check` show zone names without the trailing dot.
- `jarl` now shows the warnings a change introduces when it is applied or
  staged, not only on dry runs.
- `jarl check` and `jarl resync` no longer print named-checkconf's routine
  "loaded serial" lines, only its errors and warnings.
- `jarl zone list` showed only primary zones: `zone create`'s default
  `--type primary` leaked into the list filter through a shared variable.
  Hint, secondary, forward and other zones are listed again.
- named-checkconf and named-checkzone output is classified by the tools'
  exit code. Their warnings (e.g. `both "recursion no;" and "allow-recursion"
  active`) were shown as errors. They are now shown as warnings in the
  CLI, `jarld check` and the web UI.
- The `zone_outside_view` error says how to fix it (`--adopt-zones`).
- The end-to-end test starts named with `-f` like the Debian unit; with `-g`,
  named sends all logging to stderr.