adamandClaude Opus 5.5
bdd7acfd3b
Jarl works out which views are reachable from the internet (match-clients
ending in a catch-all, not private-looking addresses: an internal view of a
global IPv6 prefix is still yours; a server without views: open allow-query
and a non-private listen address), with a per-view override (schema 9), and
checks public ones: rate limiting, open resolver, minimal-any, cache
snooping, open NOTIFY and transfers, version and host name, management
interfaces. Fixes are staged like any change, including rate limiting from
ISC's example in log-only mode with the secondaries exempt, then enforcing.
named logs what rate limiting limits (or would, in log-only mode, where its
counters don't move) as query-errors; Jarl routes those lines to its log
and counts them (rrl breakdown, ratelimited top lists, Prometheus
jarl_ratelimit_logged_total), shown on the new Exposure page.
A change that newly opens a public view up must be confirmed (accept_risk,
--accept-risk, a checkbox on the Changes page; 409 confirm_risk
otherwise). Findings can be acknowledged with a reason and stay visible as
info. GET /exposure, POST /exposure/fix|ack|unack, jarl exposure,
docs/exposure.md.
Also fixes query statistics skipping TSIG-signed queries ("IP#port/key
NAME" in named's log).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
123 lines
8.0 KiB
JavaScript
123 lines
8.0 KiB
JavaScript
import { h, mount, time, fmtTime, relTime, problemsList, badge, plural } from "../ui.js";
|
||
import { get, state } from "../api.js";
|
||
|
||
export async function render(el) {
|
||
const [st, mine, exposure] = await Promise.all([get("/status"), get("/changesets", { status: "open", mine: 1, limit: 50 }).catch(() => []), get("/exposure").catch(() => null)]);
|
||
const s = st.engine || {};
|
||
// The user's own changesets with something in them: what the Changes page shows.
|
||
const pending = mine.filter((c) => (c.ops || []).length).length;
|
||
const n = s.named;
|
||
const cards = h("div", { class: "cards" },
|
||
card("named", n ? (n.running ? badge("running", "ok") : badge("unknown", "warn")) : badge(s.named_error ? "unreachable" : "not checked", s.named_error ? "err" : ""),
|
||
n ? [n.version, h("br"), "last configured " + (n.last_configured || "?")] : (s.named_error || "")),
|
||
card("Jarl", s.adopted ? badge("active", "ok") : badge("not adopted", "warn"),
|
||
s.adopted ? "named loads Jarl's configuration" : "named does not load Jarl's configuration yet — run 'jarld adopt' on the server"),
|
||
card("Zones", (s.counts || {}).zones ?? "–", plural((s.counts || {}).records || 0, "record") + " · " + plural((s.counts || {}).views || 0, "view")),
|
||
card("Access", plural((s.counts || {}).acls || 0, "ACL"), plural((s.counts || {}).tsig_keys || 0, "TSIG key")),
|
||
card("Options", (s.counts || {}).options ?? "–", "server, view, zone and top-level"),
|
||
st.backup ? backupCard(st.backup) : null,
|
||
exposure ? exposureCard(exposure) : null,
|
||
);
|
||
const last = s.last_applied;
|
||
const parts = [h("div", { class: "page-head" },
|
||
h("div", { class: "grow" }, h("h1", null, "Dashboard"), h("div", { class: "muted" }, "Signed in as " + state.me.user.username + " · " + (state.me.permissions || []).join(", "))),
|
||
h("div", { class: "actions" },
|
||
h("a", { class: "button primary", href: "#/zones?new=1" }, "New zone"),
|
||
h("a", { class: "button", href: "#/changes" }, "Pending changes" + (pending ? " (" + pending + " open)" : "")))),
|
||
cards];
|
||
if (s.drift && s.drift.length) {
|
||
parts.push(h("div", { class: "msg warn" },
|
||
h("strong", null, "Files changed outside Jarl: "),
|
||
s.drift.map((d) => d.path + " (" + d.reason + ")").join(", "),
|
||
h("div", { class: "small" }, "The next apply refuses to overwrite them unless forced. An administrator can rewrite them with 'jarld resync' (or System → Resync).")));
|
||
}
|
||
const b = st.backup;
|
||
if (b && b.stale) {
|
||
parts.push(h("div", { class: "msg warn" },
|
||
h("strong", null, "The newest backup is " + relTime(b.last_at).replace(" ago", "") + " old. "),
|
||
"Backups should run daily: check 'systemctl status jarl-backup.timer' and 'journalctl -u jarl-backup' on the server."));
|
||
}
|
||
if (b && b.last_error) {
|
||
parts.push(h("div", { class: "msg err" },
|
||
h("strong", null, "The last backup failed "), time(b.last_error_at), ": " + b.last_error,
|
||
h("div", { class: "small" }, "See 'journalctl -u jarl-backup' on the server.")));
|
||
}
|
||
if (st.blocking_paused_until) {
|
||
parts.push(h("div", { class: "msg info" },
|
||
h("strong", null, "Blocking is paused until " + fmtTime(st.blocking_paused_until) + "."), " It resumes by itself. ", h("a", { href: "#/blocking" }, "Blocking")));
|
||
}
|
||
if (st.blocking_paused_indefinitely) {
|
||
parts.push(h("div", { class: "msg warn" },
|
||
h("strong", null, "Blocking is paused until someone resumes it."), " Every name is answered normally. ", h("a", { href: "#/blocking" }, "Blocking")));
|
||
}
|
||
for (const e of st.blocklist_errors || []) {
|
||
parts.push(h("div", { class: "msg warn" },
|
||
h("strong", null, "Blocklist " + e.name + " couldn't be updated: "), e.error + ". ",
|
||
e.updated_at ? ["named keeps using the version from ", time(e.updated_at), ". "] : "It isn't in use yet. ",
|
||
"jarld tries again within the hour. ", h("a", { href: "#/blocking" }, "Blocking")));
|
||
}
|
||
const tf = st.totp;
|
||
if (tf && tf.missing && tf.missing.length) {
|
||
parts.push(h("div", { class: "msg warn" },
|
||
h("strong", null, "Two-factor login is required (" + tf.policy + ") but not set up by: "), tf.missing.join(", "), ". ",
|
||
"They can only set it up when they next log in. ", h("a", { href: "#/users" }, "Users")));
|
||
}
|
||
if (tf && tf.shared_admin) {
|
||
parts.push(h("div", { class: "msg info" },
|
||
h("strong", null, "The first account, " + tf.shared_admin + ", is still active "), "next to personal administrator accounts. If it is shared, disable it under ",
|
||
h("a", { href: "#/users" }, "Users"), ": everyone then logs in as themselves, with their own two-factor login, and the audit log shows who did what. Root on the server can always get back in with 'jarld user passwd'."));
|
||
}
|
||
const exp = st.expiring_tokens || [];
|
||
if (exp.length) {
|
||
const now = new Date();
|
||
parts.push(h("div", { class: "msg warn" },
|
||
h("strong", null, exp.length === 1 ? "An API token expires soon: " : "API tokens expire soon: "),
|
||
exp.map((t, i) => [i ? ", " : "", h("a", { href: state.me.admin ? "#/users" : "#/account" }, t.username + "/" + t.name), " ",
|
||
new Date(t.expires_at) < now ? h("span", null, "expired ", time(t.expires_at)) : h("span", null, "expires ", time(t.expires_at))]),
|
||
h("div", { class: "small" }, "Rotate a token to give it a new lifetime and secret, keeping its permissions (API tokens → Rotate, or 'jarl token rotate'). Then update whatever uses it.")));
|
||
}
|
||
parts.push(h("div", { class: "panel" },
|
||
h("h2", null, "Last change"),
|
||
last ? h("div", null,
|
||
h("a", { href: "#/history/" + last.id }, "#" + last.id + " " + (last.description || "")), " ",
|
||
h("span", { class: "muted" }, "by " + last.username + " via " + last.via + ", "), time(last.applied_at))
|
||
: h("div", { class: "muted" }, "Nothing applied yet.")));
|
||
const problems = s.problems || [];
|
||
const real = problems.filter((p) => p.severity !== "info");
|
||
parts.push(h("div", { class: "panel" },
|
||
h("h2", null, "Configuration checks"),
|
||
real.length ? problemsList(real) : h("div", { class: "msg ok" }, "No problems found in the current configuration."),
|
||
problems.length > real.length ? h("details", null, h("summary", { class: "muted" }, plural(problems.length - real.length, "note")), problemsList(problems.filter((p) => p.severity === "info"))) : null));
|
||
if (s.paths) {
|
||
parts.push(h("div", { class: "panel" }, h("h2", null, "Files"), h("dl", { class: "kv" },
|
||
h("dt", null, "named's main config"), h("dd", { class: "mono" }, s.main_config || "–"),
|
||
h("dt", null, "Jarl's named.conf"), h("dd", { class: "mono" }, s.paths.config_dir + "/named.conf"),
|
||
h("dt", null, "Zone files"), h("dd", { class: "mono" }, s.paths.zone_dir),
|
||
h("dt", null, "BIND tools"), h("dd", null, s.bind_version || "–"))));
|
||
}
|
||
mount(el, parts);
|
||
}
|
||
|
||
function backupCard(b) {
|
||
let value;
|
||
if (b.last_error) value = badge("failed", "err");
|
||
else if (!b.last_at) value = badge("none yet", "");
|
||
else value = badge(relTime(b.last_at), b.stale ? "warn" : "ok");
|
||
const sub = b.last_at ? h("span", { class: "mono small", title: b.last_file }, b.last_file.split("/").pop()) : "jarl-backup.timer writes to " + b.dir;
|
||
return card("Backup", value, sub);
|
||
}
|
||
|
||
// exposureCard sums up the internet exposure page.
|
||
function exposureCard(r) {
|
||
const pub = r.scopes.filter((s) => s.public);
|
||
let warn = r.server.filter((f) => f.severity === "warning").length;
|
||
for (const s of r.scopes) warn += s.findings.filter((f) => f.severity === "warning").length;
|
||
const value = !pub.length ? badge("nothing public", "ok") : warn ? badge(plural(warn, "warning"), "warn") : badge("hardened", "ok");
|
||
const sub = pub.length ? "public: " + pub.map((s) => s.view || "the server").join(", ") : "no view is reachable from the internet";
|
||
return h("a", { class: "card link", href: "#/exposure" }, h("div", { class: "label" }, "Exposure"), h("div", { class: "value" }, value), h("div", { class: "sub" }, sub));
|
||
}
|
||
|
||
function card(label, value, sub) {
|
||
return h("div", { class: "card" }, h("div", { class: "label" }, label), h("div", { class: "value" }, value), sub ? h("div", { class: "sub" }, sub) : null);
|
||
}
|