adam/jarl
Watch
1
0
Fork
You've already forked jarl
 0
Code Issues 4 Pull requests Projects Releases 35 Packages Wiki Activity Actions
35 releases 35 tags
  • v0.6.4 65d71bcc29

    Jarl v0.6.4
    All checks were successful
    release / release (push) Successful in 5m15s
    Details
    Stable

    adam released this 2026-10-25 19:06:47 +00:00 | 0 commits to main since this release

    Added

    • Failed logins in the journal. A failed login (a wrong password, or
      a wrong two-factor code) and a refused API token are logged as well as
      audited, with the address first (msg="login failed" ip=… user=…,
      msg="token refused" ip=…), for Guard's jarl preset or a fail2ban
      filter to ban such addresses (docs/operations.md).
    • jarl cert get --combined PATH also writes the key and the full
      chain in one file (mode 600, written all at once), for HAProxy. It
      belongs outside --dir, so a directory of combined files can be
      HAProxy's crt directory. The hook gets it as JARL_CERT_COMBINED.
      Adding it to a certificate this host already has writes it from the
      files on disk and runs the hook; --combined '' removes it.
    • jarl cert get --local doesn't ask jarld: it writes the combined
      file and runs the hook from this host's files, to apply a changed
      setting or test a hook.
    • jarl cert saved NAME shows all of one certificate's saved
      settings (names, key type, dir, combined file, hook, server) and this
      host's copy. The token is never shown.
    • jarl cert list has a PULLED column: when the certificate was last
      downloaded, with (old) while a host hasn't fetched the renewed one.
      The owner of a certificate obtained with jarl cert get now sees their
      own downloads (pulled_by) in jarl cert list and jarl cert show, not
      only administrators.

    Changed

    • jarl cert list shows get as USES for a certificate obtained with
      jarl cert get, not -.
    • jarl cert get without a name refuses --dir, --hook, --key-type,
      --combined, --replace and --no-save, which change one
      certificate; they used to be ignored.
    Downloads
  • v0.6.4-rc.2 67a829be34

    Jarl v0.6.4-rc.2 Pre-release

    adam released this 2026-10-25 00:24:45 +01:00 | 1 commits to main since this release

    Added

    • Failed logins in the journal. A failed login (a wrong password, or
      a wrong two-factor code) and a refused API token are logged as well as
      audited, with the address first (msg="login failed" ip=… user=…,
      msg="token refused" ip=…), for Guard's jarl preset or a fail2ban
      filter to ban such addresses (docs/operations.md).
    • jarl cert get --combined PATH also writes the key and the full
      chain in one file (mode 600, written all at once), for HAProxy. It
      belongs outside --dir, so a directory of combined files can be
      HAProxy's crt directory. The hook gets it as JARL_CERT_COMBINED.
      Adding it to a certificate this host already has writes it from the
      files on disk and runs the hook; --combined '' removes it.
    • jarl cert get --local doesn't ask jarld: it writes the combined
      file and runs the hook from this host's files, to apply a changed
      setting or test a hook.
    • jarl cert saved NAME shows all of one certificate's saved
      settings (names, key type, dir, combined file, hook, server) and this
      host's copy. The token is never shown.
    • jarl cert list has a PULLED column: when the certificate was last
      downloaded, with (old) while a host hasn't fetched the renewed one.
      The owner of a certificate obtained with jarl cert get now sees their
      own downloads (pulled_by) in jarl cert list and jarl cert show, not
      only administrators.

    Changed

    • jarl cert list shows get as USES for a certificate obtained with
      jarl cert get, not -.
    • jarl cert get without a name refuses --dir, --hook, --key-type,
      --combined, --replace and --no-save, which change one
      certificate; they used to be ignored.
    Downloads
  • v0.6.4-rc.1 3fb159cf4d

    Jarl v0.6.4-rc.1 Pre-release

    adam released this 2026-10-22 18:58:56 +01:00 | 3 commits to main since this release

    Added

    • Failed logins in the journal. A failed login (a wrong password, or
      a wrong two-factor code) and a refused API token are logged as well as
      audited, with the address first (msg="login failed" ip=… user=…,
      msg="token refused" ip=…), for Guard's jarl preset or a fail2ban
      filter to ban such addresses (docs/operations.md).
    Downloads
  • v0.6.2 3d1911dd38

    Jarl v0.6.2 Stable

    adam released this 2026-10-21 22:08:54 +01:00 | 7 commits to main since this release

    Added

    • A certificates role (template): certificates:write, for tokens and
      users that get certificates for other hosts with jarl cert get. In
      the web UI's user and token forms it is in "Insert a template…", to
      narrow with names=; in the CLI, --role certificates.
    Downloads
  • v0.6.1 b367e0c830

    Jarl v0.6.1 Stable

    adam released this 2026-10-20 22:42:42 +01:00 | 9 commits to main since this release

    Added

    • Certificates for other hosts: jarl cert get NAME -d DOMAIN --dir DIR --hook CMD on a mail server or proxy has jarld obtain the certificate
      (and renew it), waits, downloads it when it is newer than the host's
      copy, and runs the hook with the file paths in JARL_CERT_*
      variables. Its settings are saved, so jarl cert get alone refreshes
      them all; jarl cert schedule writes a daily systemd timer for that;
      jarl cert saved lists them with their expiry; jarl cert forget
      stops one. A certificate belongs to the user that asked for it (other
      users can't take the name), is obtained again only when a name is
      added or removed, and the Certificates page shows its owner and who
      downloaded it, flagging hosts that haven't fetched a renewal. A new
      certificates grant (certificates:write names=*.adbraun.lol) says
      which names a user may have; it is never part of *. Users may own
      certificates.max_per_user certificates (10), or their own
      --cert-limit. API: POST /certificates/{name}/request.
    • Certificates can be exported for use outside Jarl: Export… on the
      Certificates page (download, or copy to the clipboard),
      jarl cert export NAME [--dir DIR | --part PART]
      and GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
      Administrators only; every export of the private key is audited
      (certificate.export_key).
    • A reverse zone's "addresses have no PTR record" banner lists them, with
      the name each would get, instead of only counting them
      (ptr_missing_list in the zone API).
    • A zone's page links to the same zone in the other views ("also in
      external"), in each view's colour, keeping the tab you are on. It
      works for zones that aren't linked too, and the zone API's new
      in_views lists them.
    • jarl.service has the alias jarld.service, so systemctl restart jarld works too. The alias is linked when the unit is enabled; the
      package relinks a unit enabled by an older version on upgrade.

    Changed

    • The Statistics page's range buttons follow stats.retention: ranges
      longer than any data kept are left out, and 1y and 2y appear
      when retention.day (or retention.hour) covers them (with the
      default 730d, both do). The busiest-times heatmap says how far back it
      really goes (at most retention.hour), and links to the Explore page
      keep within retention.queries instead of assuming 7 days.
      GET /stats/status and GET /stats/explore add retention_seconds.

    • A reverse zone's missing PTR records count only its own view's A and
      AAAA records. An address only another view's records use (an internal
      host, seen from the vps view's copy of 10.0.10.in-addr.arpa) is no
      longer reported as missing; it shows apart, as Other views in jarl zone show, ptr_other_views in the API and a note on the zone's page.
      Filling (--fill, jarl zone fill-ptr, the page's button) names those
      from the other view only when asked, with --other-views
      (fill_other_views, ?other_views=1, a checkbox in the New reverse
      zone dialog), so one view's host names don't leak into another. When
      there is nothing else to fill, Jarl says how many there are and how to
      add them. The page and jarl zone show list those addresses with the
      name each would get, and the view it comes from
      (ptr_other_views_list); jarl zone show lists the missing ones too.

    • Records, zones and validation findings sort numeric labels by value, so
      2.10.0.10.in-addr.arpa comes before 101.10.0.10.in-addr.arpa in the
      web UI, the CLI and the rendered zone files. Names still group by label
      from the right (subdomains stay under their parent); other labels keep
      the old byte order (host10 before host2). Zone files are rewritten
      in the new order the next time they change; named doesn't care about
      record order.

    • cname_chain no longer warns about one CNAME pointing at another (a
      service name at a host alias is common, and named answers the chain at
      once). A chain of three or more CNAMEs gets an info note that shows
      it.

    • A certificate's private key is only exported over HTTPS, the local
      socket, or to the server itself (plain HTTP from another host is
      refused with https_required).

    • The Certificates page's "Used for" column says DoT and DoH for named,
      with the addresses in the tooltip, instead of listing every address. A
      certificate with no use says "not used by Jarl" rather than "nothing
      yet": it may well be used elsewhere.

    • Deleting a linked zone's local records (an override) removes that name
      and type from that view only. It used to bring the shared records back
      into the view, so a delete looked undone. The other views keep their
      records, local to each now; Share one view's version (jarl record update ID --shared) to have it everywhere again.

    • A linked zone's Compare views tab starts with a view it is linked to,
      not the first other view.

    • The New token form only offers templates within what the token's user
      may do. A token never does more than its user, so offering more only
      misled.

    • A zone update that changes nothing is no change: saving a zone's
      settings without changing them says "Nothing changed" instead of
      staging an empty change. Staging operations that change nothing
      (POST /changesets/{id}/ops, or ?stage=) is a 400 "nothing to
      change".

    Fixed

    • jarl cert get NAME no longer takes over a name this host has saved
      for another Jarl server, which overwrote that certificate's settings
      (and, with the default --dir, its files), so it stopped being
      renewed. It is refused, as is a --dir holding another certificate's
      files; --replace takes the name or directory over.

    • The "query log is off" error named a setting that doesn't exist,
      stats.query_retention; it's stats.retention.queries.

    • jarl zone show for a reverse zone printed only "and 1 more" under
      "Other views:" when the server was older than the CLI (0.6.1-rc.2
      sends the count but not the addresses). It now prints just the count
      line then.

    • jarl changeset show printed its Created and Applied times in UTC,
      while jarl history and jarl status print local time. It uses local
      time now too.

    • The statistics' "Busiest times" grid drew hours without data taller
      than the others (they picked up the page's padding for empty
      messages).

    • A token for one view of a linked zone (such as an ACME token with
      views=external) couldn't add records: a new record is shared, and
      that reached the other view. A new name and type is now local to the
      view when the user may not change it in the other views.

    • A zone name in several views had to be given with --view even when
      the user could see it in only one (jarl record list adbraun.lol with
      a one-view token), and the error named views the user can't see. Now
      the one they can see is used.

    • jarl view list was empty for a user without views:read, though
      they can see zones in views. It now lists those views by name, colour
      and visible zone count (marked limited in the API), without their
      settings.

    • The DNSSEC tab told you to give the DS record to your registrar for
      every zone whose parent isn't in Jarl in the same view. Now it (and
      jarl zone dnssec status, and the API's new ds_at, ds_place and
      ds_note) says where it really goes: the parent zone in Jarl (in any
      view now, the zone's own first), the registrar for a registered
      domain, the parent zone wherever it is hosted for a subdomain, your
      ISP or RIR for a reverse zone, and nowhere for a private name such as
      home.lan (signing it has no effect).

    • The Registrar tab (and jarl zone registrar, and the DNSSEC page's
      registrar button) was offered for every zone when porkbun.domains is
      empty, and always failed for subdomain zones (lab.adbraun.lol),
      reverse zones and private names (home.lan): Porkbun only knows
      registered domains. Only zones that are a registered domain (by the
      public suffix list) get it now; the others say what delegates them
      instead.

    • Auto-PTR in linked zones changed PTR records in every linked view, not
      just where the address record is. A record local to one view got PTR
      records in the other views too; deleting or changing the address in
      one view deleted or moved the PTR records of views that still had it.
      PTR records now follow each view's own address records, are local to
      their view in a linked reverse zone, and each zone's Reverse DNS
      setting counts for its own view. Fill also adds local PTR records
      now, not shared ones. The same applies to Update PTR (--ptr).

    • Saving the settings of a zone whose primary name server is outside it
      (ns1.adbraun.lol. for wg.adbraun.lol) changed the name server to
      ns1.adbraun.lol.wg.adbraun.lol.. The form showed the name without its
      final dot, which the server reads as relative to the zone. Names outside
      the zone now keep the dot, and the name server is only sent when it was
      changed.

    Upgrading

    • Tested: a 0.6.0 install with views, linked and reverse zones and
      statistics, opened by 0.6.1-rc.1: every zone, record and view kept,
      named answered as before, and the new grant and limits worked.
    • The database gains a migration (certificate owners, per-user
      certificate limits, certificate downloads). Going back to an older
      version afterwards means restoring a backup made before the upgrade.
    Downloads
  • v0.6.1-rc.4 3ddd32f97f

    Jarl v0.6.1-rc.4 Pre-release

    adam released this 2026-10-20 22:32:19 +01:00 | 11 commits to main since this release

    Added

    • Certificates for other hosts: jarl cert get NAME -d DOMAIN --dir DIR --hook CMD on a mail server or proxy has jarld obtain the certificate
      (and renew it), waits, downloads it when it is newer than the host's
      copy, and runs the hook with the file paths in JARL_CERT_*
      variables. Its settings are saved, so jarl cert get alone refreshes
      them all; jarl cert schedule writes a daily systemd timer for that;
      jarl cert saved lists them with their expiry; jarl cert forget
      stops one. A certificate belongs to the user that asked for it (other
      users can't take the name), is obtained again only when a name is
      added or removed, and the Certificates page shows its owner and who
      downloaded it, flagging hosts that haven't fetched a renewal. A new
      certificates grant (certificates:write names=*.adbraun.lol) says
      which names a user may have; it is never part of *. Users may own
      certificates.max_per_user certificates (10), or their own
      --cert-limit. API: POST /certificates/{name}/request.
    • Certificates can be exported for use outside Jarl: Export… on the
      Certificates page (download, or copy to the clipboard),
      jarl cert export NAME [--dir DIR | --part PART]
      and GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
      Administrators only; every export of the private key is audited
      (certificate.export_key).
    • A reverse zone's "addresses have no PTR record" banner lists them, with
      the name each would get, instead of only counting them
      (ptr_missing_list in the zone API).
    • A zone's page links to the same zone in the other views ("also in
      external"), in each view's colour, keeping the tab you are on. It
      works for zones that aren't linked too, and the zone API's new
      in_views lists them.
    • jarl.service has the alias jarld.service, so systemctl restart jarld works too. The alias is linked when the unit is enabled; the
      package relinks a unit enabled by an older version on upgrade.

    Changed

    • The Statistics page's range buttons follow stats.retention: ranges
      longer than any data kept are left out, and 1y and 2y appear
      when retention.day (or retention.hour) covers them (with the
      default 730d, both do). The busiest-times heatmap says how far back it
      really goes (at most retention.hour), and links to the Explore page
      keep within retention.queries instead of assuming 7 days.
      GET /stats/status and GET /stats/explore add retention_seconds.

    • A reverse zone's missing PTR records count only its own view's A and
      AAAA records. An address only another view's records use (an internal
      host, seen from the vps view's copy of 10.0.10.in-addr.arpa) is no
      longer reported as missing; it shows apart, as Other views in jarl zone show, ptr_other_views in the API and a note on the zone's page.
      Filling (--fill, jarl zone fill-ptr, the page's button) names those
      from the other view only when asked, with --other-views
      (fill_other_views, ?other_views=1, a checkbox in the New reverse
      zone dialog), so one view's host names don't leak into another. When
      there is nothing else to fill, Jarl says how many there are and how to
      add them. The page and jarl zone show list those addresses with the
      name each would get, and the view it comes from
      (ptr_other_views_list); jarl zone show lists the missing ones too.

    • Records, zones and validation findings sort numeric labels by value, so
      2.10.0.10.in-addr.arpa comes before 101.10.0.10.in-addr.arpa in the
      web UI, the CLI and the rendered zone files. Names still group by label
      from the right (subdomains stay under their parent); other labels keep
      the old byte order (host10 before host2). Zone files are rewritten
      in the new order the next time they change; named doesn't care about
      record order.

    • cname_chain no longer warns about one CNAME pointing at another (a
      service name at a host alias is common, and named answers the chain at
      once). A chain of three or more CNAMEs gets an info note that shows
      it.

    • A certificate's private key is only exported over HTTPS, the local
      socket, or to the server itself (plain HTTP from another host is
      refused with https_required).

    • The Certificates page's "Used for" column says DoT and DoH for named,
      with the addresses in the tooltip, instead of listing every address. A
      certificate with no use says "not used by Jarl" rather than "nothing
      yet": it may well be used elsewhere.

    • Deleting a linked zone's local records (an override) removes that name
      and type from that view only. It used to bring the shared records back
      into the view, so a delete looked undone. The other views keep their
      records, local to each now; Share one view's version (jarl record update ID --shared) to have it everywhere again.

    • A linked zone's Compare views tab starts with a view it is linked to,
      not the first other view.

    • The New token form only offers templates within what the token's user
      may do. A token never does more than its user, so offering more only
      misled.

    • A zone update that changes nothing is no change: saving a zone's
      settings without changing them says "Nothing changed" instead of
      staging an empty change. Staging operations that change nothing
      (POST /changesets/{id}/ops, or ?stage=) is a 400 "nothing to
      change".

    Fixed

    • The "query log is off" error named a setting that doesn't exist,
      stats.query_retention; it's stats.retention.queries.

    • jarl zone show for a reverse zone printed only "and 1 more" under
      "Other views:" when the server was older than the CLI (0.6.1-rc.2
      sends the count but not the addresses). It now prints just the count
      line then.

    • jarl changeset show printed its Created and Applied times in UTC,
      while jarl history and jarl status print local time. It uses local
      time now too.

    • The statistics' "Busiest times" grid drew hours without data taller
      than the others (they picked up the page's padding for empty
      messages).

    • A token for one view of a linked zone (such as an ACME token with
      views=external) couldn't add records: a new record is shared, and
      that reached the other view. A new name and type is now local to the
      view when the user may not change it in the other views.

    • A zone name in several views had to be given with --view even when
      the user could see it in only one (jarl record list adbraun.lol with
      a one-view token), and the error named views the user can't see. Now
      the one they can see is used.

    • jarl view list was empty for a user without views:read, though
      they can see zones in views. It now lists those views by name, colour
      and visible zone count (marked limited in the API), without their
      settings.

    • The DNSSEC tab told you to give the DS record to your registrar for
      every zone whose parent isn't in Jarl in the same view. Now it (and
      jarl zone dnssec status, and the API's new ds_at, ds_place and
      ds_note) says where it really goes: the parent zone in Jarl (in any
      view now, the zone's own first), the registrar for a registered
      domain, the parent zone wherever it is hosted for a subdomain, your
      ISP or RIR for a reverse zone, and nowhere for a private name such as
      home.lan (signing it has no effect).

    • The Registrar tab (and jarl zone registrar, and the DNSSEC page's
      registrar button) was offered for every zone when porkbun.domains is
      empty, and always failed for subdomain zones (lab.adbraun.lol),
      reverse zones and private names (home.lan): Porkbun only knows
      registered domains. Only zones that are a registered domain (by the
      public suffix list) get it now; the others say what delegates them
      instead.

    • Auto-PTR in linked zones changed PTR records in every linked view, not
      just where the address record is. A record local to one view got PTR
      records in the other views too; deleting or changing the address in
      one view deleted or moved the PTR records of views that still had it.
      PTR records now follow each view's own address records, are local to
      their view in a linked reverse zone, and each zone's Reverse DNS
      setting counts for its own view. Fill also adds local PTR records
      now, not shared ones. The same applies to Update PTR (--ptr).

    • Saving the settings of a zone whose primary name server is outside it
      (ns1.adbraun.lol. for wg.adbraun.lol) changed the name server to
      ns1.adbraun.lol.wg.adbraun.lol.. The form showed the name without its
      final dot, which the server reads as relative to the zone. Names outside
      the zone now keep the dot, and the name server is only sent when it was
      changed.

    Upgrading

    • Tested: a 0.6.0 install with views, linked and reverse zones and
      statistics, opened by 0.6.1-rc.1: every zone, record and view kept,
      named answered as before, and the new grant and limits worked.
    • The database gains a migration (certificate owners, per-user
      certificate limits, certificate downloads). Going back to an older
      version afterwards means restoring a backup made before the upgrade.
    Downloads
  • v0.6.1-rc.3 71d9a06e43

    Jarl v0.6.1-rc.3 Pre-release

    adam released this 2026-10-20 14:46:12 +01:00 | 15 commits to main since this release

    Added

    • Certificates for other hosts: jarl cert get NAME -d DOMAIN --dir DIR --hook CMD on a mail server or proxy has jarld obtain the certificate
      (and renew it), waits, downloads it when it is newer than the host's
      copy, and runs the hook with the file paths in JARL_CERT_*
      variables. Its settings are saved, so jarl cert get alone refreshes
      them all; jarl cert schedule writes a daily systemd timer for that;
      jarl cert saved lists them with their expiry; jarl cert forget
      stops one. A certificate belongs to the user that asked for it (other
      users can't take the name), is obtained again only when a name is
      added or removed, and the Certificates page shows its owner and who
      downloaded it, flagging hosts that haven't fetched a renewal. A new
      certificates grant (certificates:write names=*.adbraun.lol) says
      which names a user may have; it is never part of *. Users may own
      certificates.max_per_user certificates (10), or their own
      --cert-limit. API: POST /certificates/{name}/request.
    • Certificates can be exported for use outside Jarl: Export… on the
      Certificates page (download, or copy to the clipboard),
      jarl cert export NAME [--dir DIR | --part PART]
      and GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
      Administrators only; every export of the private key is audited
      (certificate.export_key).
    • A reverse zone's "addresses have no PTR record" banner lists them, with
      the name each would get, instead of only counting them
      (ptr_missing_list in the zone API).
    • A zone's page links to the same zone in the other views ("also in
      external"), in each view's colour, keeping the tab you are on. It
      works for zones that aren't linked too, and the zone API's new
      in_views lists them.
    • jarl.service has the alias jarld.service, so systemctl restart jarld works too. The alias is linked when the unit is enabled; the
      package relinks a unit enabled by an older version on upgrade.

    Changed

    • A reverse zone's missing PTR records count only its own view's A and
      AAAA records. An address only another view's records use (an internal
      host, seen from the vps view's copy of 10.0.10.in-addr.arpa) is no
      longer reported as missing; it shows apart, as Other views in jarl zone show, ptr_other_views in the API and a note on the zone's page.
      Filling (--fill, jarl zone fill-ptr, the page's button) names those
      from the other view only when asked, with --other-views
      (fill_other_views, ?other_views=1, a checkbox in the New reverse
      zone dialog), so one view's host names don't leak into another. When
      there is nothing else to fill, Jarl says how many there are and how to
      add them. The page and jarl zone show list those addresses with the
      name each would get, and the view it comes from
      (ptr_other_views_list); jarl zone show lists the missing ones too.

    • Records, zones and validation findings sort numeric labels by value, so
      2.10.0.10.in-addr.arpa comes before 101.10.0.10.in-addr.arpa in the
      web UI, the CLI and the rendered zone files. Names still group by label
      from the right (subdomains stay under their parent); other labels keep
      the old byte order (host10 before host2). Zone files are rewritten
      in the new order the next time they change; named doesn't care about
      record order.

    • cname_chain no longer warns about one CNAME pointing at another (a
      service name at a host alias is common, and named answers the chain at
      once). A chain of three or more CNAMEs gets an info note that shows
      it.

    • A certificate's private key is only exported over HTTPS, the local
      socket, or to the server itself (plain HTTP from another host is
      refused with https_required).

    • The Certificates page's "Used for" column says DoT and DoH for named,
      with the addresses in the tooltip, instead of listing every address. A
      certificate with no use says "not used by Jarl" rather than "nothing
      yet": it may well be used elsewhere.

    • Deleting a linked zone's local records (an override) removes that name
      and type from that view only. It used to bring the shared records back
      into the view, so a delete looked undone. The other views keep their
      records, local to each now; Share one view's version (jarl record update ID --shared) to have it everywhere again.

    • A linked zone's Compare views tab starts with a view it is linked to,
      not the first other view.

    • The New token form only offers templates within what the token's user
      may do. A token never does more than its user, so offering more only
      misled.

    • A zone update that changes nothing is no change: saving a zone's
      settings without changing them says "Nothing changed" instead of
      staging an empty change. Staging operations that change nothing
      (POST /changesets/{id}/ops, or ?stage=) is a 400 "nothing to
      change".

    Fixed

    • The statistics' "Busiest times" grid drew hours without data taller
      than the others (they picked up the page's padding for empty
      messages).

    • A token for one view of a linked zone (such as an ACME token with
      views=external) couldn't add records: a new record is shared, and
      that reached the other view. A new name and type is now local to the
      view when the user may not change it in the other views.

    • A zone name in several views had to be given with --view even when
      the user could see it in only one (jarl record list adbraun.lol with
      a one-view token), and the error named views the user can't see. Now
      the one they can see is used.

    • jarl view list was empty for a user without views:read, though
      they can see zones in views. It now lists those views by name, colour
      and visible zone count (marked limited in the API), without their
      settings.

    • The DNSSEC tab told you to give the DS record to your registrar for
      every zone whose parent isn't in Jarl in the same view. Now it (and
      jarl zone dnssec status, and the API's new ds_at, ds_place and
      ds_note) says where it really goes: the parent zone in Jarl (in any
      view now, the zone's own first), the registrar for a registered
      domain, the parent zone wherever it is hosted for a subdomain, your
      ISP or RIR for a reverse zone, and nowhere for a private name such as
      home.lan (signing it has no effect).

    • The Registrar tab (and jarl zone registrar, and the DNSSEC page's
      registrar button) was offered for every zone when porkbun.domains is
      empty, and always failed for subdomain zones (lab.adbraun.lol),
      reverse zones and private names (home.lan): Porkbun only knows
      registered domains. Only zones that are a registered domain (by the
      public suffix list) get it now; the others say what delegates them
      instead.

    • Auto-PTR in linked zones changed PTR records in every linked view, not
      just where the address record is. A record local to one view got PTR
      records in the other views too; deleting or changing the address in
      one view deleted or moved the PTR records of views that still had it.
      PTR records now follow each view's own address records, are local to
      their view in a linked reverse zone, and each zone's Reverse DNS
      setting counts for its own view. Fill also adds local PTR records
      now, not shared ones. The same applies to Update PTR (--ptr).

    • Saving the settings of a zone whose primary name server is outside it
      (ns1.adbraun.lol. for wg.adbraun.lol) changed the name server to
      ns1.adbraun.lol.wg.adbraun.lol.. The form showed the name without its
      final dot, which the server reads as relative to the zone. Names outside
      the zone now keep the dot, and the name server is only sent when it was
      changed.

    Upgrading

    • Tested: a 0.6.0 install with views, linked and reverse zones and
      statistics, opened by 0.6.1-rc.1: every zone, record and view kept,
      named answered as before, and the new grant and limits worked.
    • The database gains a migration (certificate owners, per-user
      certificate limits, certificate downloads). Going back to an older
      version afterwards means restoring a backup made before the upgrade.
    Downloads
  • v0.6.1-rc.2 a93373687e

    Jarl v0.6.1-rc.2 Pre-release

    adam released this 2026-10-20 11:42:34 +01:00 | 17 commits to main since this release

    Added

    • Certificates for other hosts: jarl cert get NAME -d DOMAIN --dir DIR --hook CMD on a mail server or proxy has jarld obtain the certificate
      (and renew it), waits, downloads it when it is newer than the host's
      copy, and runs the hook with the file paths in JARL_CERT_*
      variables. Its settings are saved, so jarl cert get alone refreshes
      them all; jarl cert schedule writes a daily systemd timer for that;
      jarl cert saved lists them with their expiry; jarl cert forget
      stops one. A certificate belongs to the user that asked for it (other
      users can't take the name), is obtained again only when a name is
      added or removed, and the Certificates page shows its owner and who
      downloaded it, flagging hosts that haven't fetched a renewal. A new
      certificates grant (certificates:write names=*.adbraun.lol) says
      which names a user may have; it is never part of *. Users may own
      certificates.max_per_user certificates (10), or their own
      --cert-limit. API: POST /certificates/{name}/request.
    • Certificates can be exported for use outside Jarl: Export… on the
      Certificates page (download, or copy to the clipboard),
      jarl cert export NAME [--dir DIR | --part PART]
      and GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
      Administrators only; every export of the private key is audited
      (certificate.export_key).
    • A reverse zone's "addresses have no PTR record" banner lists them, with
      the name each would get, instead of only counting them
      (ptr_missing_list in the zone API).
    • A zone's page links to the same zone in the other views ("also in
      external"), in each view's colour, keeping the tab you are on. It
      works for zones that aren't linked too, and the zone API's new
      in_views lists them.
    • jarl.service has the alias jarld.service, so systemctl restart jarld works too. The alias is linked when the unit is enabled; the
      package relinks a unit enabled by an older version on upgrade.

    Changed

    • A reverse zone's missing PTR records count only its own view's A and
      AAAA records. An address only another view's records use (an internal
      host, seen from the vps view's copy of 10.0.10.in-addr.arpa) is no
      longer reported as missing; it shows apart, as Other views in jarl zone show, ptr_other_views in the API and a note on the zone's page.
      Filling (--fill, jarl zone fill-ptr, the page's button) names those
      from the other view only when asked, with --other-views
      (fill_other_views, ?other_views=1, a checkbox in the New reverse
      zone dialog), so one view's host names don't leak into another. When
      there is nothing else to fill, Jarl says how many there are and how to
      add them.

    • Records, zones and validation findings sort numeric labels by value, so
      2.10.0.10.in-addr.arpa comes before 101.10.0.10.in-addr.arpa in the
      web UI, the CLI and the rendered zone files. Names still group by label
      from the right (subdomains stay under their parent); other labels keep
      the old byte order (host10 before host2). Zone files are rewritten
      in the new order the next time they change; named doesn't care about
      record order.

    • cname_chain no longer warns about one CNAME pointing at another (a
      service name at a host alias is common, and named answers the chain at
      once). A chain of three or more CNAMEs gets an info note that shows
      it.

    • A certificate's private key is only exported over HTTPS, the local
      socket, or to the server itself (plain HTTP from another host is
      refused with https_required).

    • The Certificates page's "Used for" column says DoT and DoH for named,
      with the addresses in the tooltip, instead of listing every address. A
      certificate with no use says "not used by Jarl" rather than "nothing
      yet": it may well be used elsewhere.

    • Deleting a linked zone's local records (an override) removes that name
      and type from that view only. It used to bring the shared records back
      into the view, so a delete looked undone. The other views keep their
      records, local to each now; Share one view's version (jarl record update ID --shared) to have it everywhere again.

    • A linked zone's Compare views tab starts with a view it is linked to,
      not the first other view.

    • The New token form only offers templates within what the token's user
      may do. A token never does more than its user, so offering more only
      misled.

    • A zone update that changes nothing is no change: saving a zone's
      settings without changing them says "Nothing changed" instead of
      staging an empty change. Staging operations that change nothing
      (POST /changesets/{id}/ops, or ?stage=) is a 400 "nothing to
      change".

    Fixed

    • The statistics' "Busiest times" grid drew hours without data taller
      than the others (they picked up the page's padding for empty
      messages).

    • A token for one view of a linked zone (such as an ACME token with
      views=external) couldn't add records: a new record is shared, and
      that reached the other view. A new name and type is now local to the
      view when the user may not change it in the other views.

    • A zone name in several views had to be given with --view even when
      the user could see it in only one (jarl record list adbraun.lol with
      a one-view token), and the error named views the user can't see. Now
      the one they can see is used.

    • jarl view list was empty for a user without views:read, though
      they can see zones in views. It now lists those views by name, colour
      and visible zone count (marked limited in the API), without their
      settings.

    • The DNSSEC tab told you to give the DS record to your registrar for
      every zone whose parent isn't in Jarl in the same view. Now it (and
      jarl zone dnssec status, and the API's new ds_at, ds_place and
      ds_note) says where it really goes: the parent zone in Jarl (in any
      view now, the zone's own first), the registrar for a registered
      domain, the parent zone wherever it is hosted for a subdomain, your
      ISP or RIR for a reverse zone, and nowhere for a private name such as
      home.lan (signing it has no effect).

    • The Registrar tab (and jarl zone registrar, and the DNSSEC page's
      registrar button) was offered for every zone when porkbun.domains is
      empty, and always failed for subdomain zones (lab.adbraun.lol),
      reverse zones and private names (home.lan): Porkbun only knows
      registered domains. Only zones that are a registered domain (by the
      public suffix list) get it now; the others say what delegates them
      instead.

    • Auto-PTR in linked zones changed PTR records in every linked view, not
      just where the address record is. A record local to one view got PTR
      records in the other views too; deleting or changing the address in
      one view deleted or moved the PTR records of views that still had it.
      PTR records now follow each view's own address records, are local to
      their view in a linked reverse zone, and each zone's Reverse DNS
      setting counts for its own view. Fill also adds local PTR records
      now, not shared ones. The same applies to Update PTR (--ptr).

    • Saving the settings of a zone whose primary name server is outside it
      (ns1.adbraun.lol. for wg.adbraun.lol) changed the name server to
      ns1.adbraun.lol.wg.adbraun.lol.. The form showed the name without its
      final dot, which the server reads as relative to the zone. Names outside
      the zone now keep the dot, and the name server is only sent when it was
      changed.

    Upgrading

    • Tested: a 0.6.0 install with views, linked and reverse zones and
      statistics, opened by 0.6.1-rc.1: every zone, record and view kept,
      named answered as before, and the new grant and limits worked.
    • The database gains a migration (certificate owners, per-user
      certificate limits, certificate downloads). Going back to an older
      version afterwards means restoring a backup made before the upgrade.
    Downloads
  • v0.6.1-rc.1 fa8feb6bd9

    Jarl v0.6.1-rc.1 Pre-release

    adam released this 2026-10-18 17:00:20 +01:00 | 20 commits to main since this release

    Added

    • Certificates for other hosts: jarl cert get NAME -d DOMAIN --dir DIR --hook CMD on a mail server or proxy has jarld obtain the certificate
      (and renew it), waits, downloads it when it is newer than the host's
      copy, and runs the hook with the file paths in JARL_CERT_*
      variables. Its settings are saved, so jarl cert get alone refreshes
      them all; jarl cert schedule writes a daily systemd timer for that;
      jarl cert saved lists them with their expiry; jarl cert forget
      stops one. A certificate belongs to the user that asked for it (other
      users can't take the name), is obtained again only when a name is
      added or removed, and the Certificates page shows its owner and who
      downloaded it, flagging hosts that haven't fetched a renewal. A new
      certificates grant (certificates:write names=*.adbraun.lol) says
      which names a user may have; it is never part of *. Users may own
      certificates.max_per_user certificates (10), or their own
      --cert-limit. API: POST /certificates/{name}/request.
    • Certificates can be exported for use outside Jarl: Export… on the
      Certificates page (download, or copy to the clipboard),
      jarl cert export NAME [--dir DIR | --part PART]
      and GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
      Administrators only; every export of the private key is audited
      (certificate.export_key).
    • A reverse zone's "addresses have no PTR record" banner lists them, with
      the name each would get, instead of only counting them
      (ptr_missing_list in the zone API).
    • A zone's page links to the same zone in the other views ("also in
      external"), in each view's colour, keeping the tab you are on. It
      works for zones that aren't linked too, and the zone API's new
      in_views lists them.
    • jarl.service has the alias jarld.service, so systemctl restart jarld works too. The alias is linked when the unit is enabled; the
      package relinks a unit enabled by an older version on upgrade.

    Changed

    • cname_chain no longer warns about one CNAME pointing at another (a
      service name at a host alias is common, and named answers the chain at
      once). A chain of three or more CNAMEs gets an info note that shows
      it.

    • A certificate's private key is only exported over HTTPS, the local
      socket, or to the server itself (plain HTTP from another host is
      refused with https_required).

    • The Certificates page's "Used for" column says DoT and DoH for named,
      with the addresses in the tooltip, instead of listing every address. A
      certificate with no use says "not used by Jarl" rather than "nothing
      yet": it may well be used elsewhere.

    • Deleting a linked zone's local records (an override) removes that name
      and type from that view only. It used to bring the shared records back
      into the view, so a delete looked undone. The other views keep their
      records, local to each now; Share one view's version (jarl record update ID --shared) to have it everywhere again.

    • A linked zone's Compare views tab starts with a view it is linked to,
      not the first other view.

    • The New token form only offers templates within what the token's user
      may do. A token never does more than its user, so offering more only
      misled.

    • A zone update that changes nothing is no change: saving a zone's
      settings without changing them says "Nothing changed" instead of
      staging an empty change. Staging operations that change nothing
      (POST /changesets/{id}/ops, or ?stage=) is a 400 "nothing to
      change".

    Fixed

    • The statistics' "Busiest times" grid drew hours without data taller
      than the others (they picked up the page's padding for empty
      messages).

    • A token for one view of a linked zone (such as an ACME token with
      views=external) couldn't add records: a new record is shared, and
      that reached the other view. A new name and type is now local to the
      view when the user may not change it in the other views.

    • A zone name in several views had to be given with --view even when
      the user could see it in only one (jarl record list adbraun.lol with
      a one-view token), and the error named views the user can't see. Now
      the one they can see is used.

    • jarl view list was empty for a user without views:read, though
      they can see zones in views. It now lists those views by name, colour
      and visible zone count (marked limited in the API), without their
      settings.

    • The DNSSEC tab told you to give the DS record to your registrar for
      every zone whose parent isn't in Jarl in the same view. Now it (and
      jarl zone dnssec status, and the API's new ds_at, ds_place and
      ds_note) says where it really goes: the parent zone in Jarl (in any
      view now, the zone's own first), the registrar for a registered
      domain, the parent zone wherever it is hosted for a subdomain, your
      ISP or RIR for a reverse zone, and nowhere for a private name such as
      home.lan (signing it has no effect).

    • The Registrar tab (and jarl zone registrar, and the DNSSEC page's
      registrar button) was offered for every zone when porkbun.domains is
      empty, and always failed for subdomain zones (lab.adbraun.lol),
      reverse zones and private names (home.lan): Porkbun only knows
      registered domains. Only zones that are a registered domain (by the
      public suffix list) get it now; the others say what delegates them
      instead.

    • Auto-PTR in linked zones changed PTR records in every linked view, not
      just where the address record is. A record local to one view got PTR
      records in the other views too; deleting or changing the address in
      one view deleted or moved the PTR records of views that still had it.
      PTR records now follow each view's own address records, are local to
      their view in a linked reverse zone, and each zone's Reverse DNS
      setting counts for its own view. Fill also adds local PTR records
      now, not shared ones. The same applies to Update PTR (--ptr).

    • Saving the settings of a zone whose primary name server is outside it
      (ns1.adbraun.lol. for wg.adbraun.lol) changed the name server to
      ns1.adbraun.lol.wg.adbraun.lol.. The form showed the name without its
      final dot, which the server reads as relative to the zone. Names outside
      the zone now keep the dot, and the name server is only sent when it was
      changed.

    Upgrading

    • Tested: a 0.6.0 install with views, linked and reverse zones and
      statistics, opened by 0.6.1-rc.1: every zone, record and view kept,
      named answered as before, and the new grant and limits worked.
    • The database gains a migration (certificate owners, per-user
      certificate limits, certificate downloads). Going back to an older
      version afterwards means restoring a backup made before the upgrade.
    Downloads
  • v0.6.0 48f0082d8b

    Jarl v0.6.0 Stable

    adam released this 2026-10-13 19:44:10 +01:00 | 34 commits to main since this release

    Added

    • Reverse zones made easy (docs/reverse.md):

      • Missing reverse zones: the Zones page and jarl zone suggest-reverse list the reverse zones the private views lack for
        their A and AAAA records' addresses: the /24 of a private IPv4 network,
        a /32 for a public address (the rest of its /24 belongs to others),
        the /48 of IPv6 addresses. Create one, or all (--create), filled.
      • Fill: jarl zone create 10.0.10.0/24 --fill (ticked in the New
        zone dialog) adds a PTR record for each address the view's records use
        there; jarl zone fill-ptr and the reverse zone's page add the ones
        missing later. An address with several names gets its mail or name
        server's name, else a host's.
      • The right view: a reverse zone created without a view goes to the
        private view whose records use its addresses.
      • PTR records kept in step per zone (jarl zone update ZONE --auto-ptr, zone settings → Reverse DNS): adding, changing,
        disabling or deleting an A or AAAA record does the same to its PTR
        record, as the Update PTR box does for one change.
      • Suggestions come in two groups: yours (private networks, a ULA or
        an IPv6 /48 this server has an address in), which Create all
        creates, and public addresses, each a /32 or /128 to create only
        if it is yours (not a web host's) or Dismiss. A view can turn
        suggestions off (jarl view update vps --reverse-suggestions=false),
        e.g. one only a VPS uses.

    • A zone created inside another in the same view (a /24 inside a /8,
      lab.adbraun.lol inside adbraun.lol) takes the parent's records
      under it, which named would no longer serve from the parent; a
      delegation and its glue stay.

    • Zone commands take a network for a reverse zone: jarl zone show 10.0.10.0/24.

    • New reverse zone (Zones page) lists the networks your records use
      without a reverse zone, in every view, also where nothing is suggested
      (suggestions off, dismissed, public views); pick one, change its size
      (/48, /56, /64, /128 for IPv6, around the records' address) and create
      it filled. With a view chosen, it also lists the addresses only other
      views' records use, and fill names them from there (a VPS's AAAA in
      external, its PTR in internal). jarl zone suggest-reverse --all [--view V]. Both lists have a search, so hundreds of addresses stay
      manageable: the public addresses fold away, show 25 at a time, and
      Dismiss these N dismisses everything a search found in one change
      (--dismiss takes several networks).

    • Encrypted DNS: several host names (one certificate for all; the
      health check says when the served certificate misses one), and each
      listen address gets its own views       for the host names' records
      (--address 10.0.10.5=internal, a view checkbox per address in the
      form), local to the view, with a warning when a public view would get
      a private address. A view no longer ticked loses the address. The form
      starts from where the records are now. The Certificates page and jarl cert show say what named uses a certificate for (DNS over TLS or HTTPS,
      on which addresses and ports).

    • docs/encrypted-dns.md: forwarding to Quad9 or Cloudflare over TLS, how to
      check it works, and why not over HTTPS.

    • Comparing one name across views: jarl zone diff adbraun.lol nas [A],
      and a Compare button on each record.

    • Exploring the statistics: jarld keeps every answer for a while
      (stats.retention.queries, default 7 days), and every client, name,
      view, record type, result and blocklist on the Statistics page leads to
      an explore page for it: answers over time, the top clients, names,
      views, types, results and blocklists among them (each a link that
      narrows it further), and the latest answers. "NXDOMAIN in external" →
      the clients asking → everything one of them asks. A filter bar types
      filters in, several values each (any of them), !value to leave one
      out and *.example.com for a domain and below; hide on a list entry
      leaves it out. Explore the answers opens the page from the
      Statistics page. GET /stats/explore.

    • Storage on the dashboard: the size of Jarl's databases (and how many
      answers the query log holds), and per disk Jarl uses a bar of how full it
      is and how much of it the databases take. The Statistics page shows the
      statistics database's size too, and its disk tiles get the same bar.

    Changed

    • jarl option set tls NAME … (and key, remote-servers, http,
      dnssec-policy, server …) replaces only the statement with that name:
      setting tls cloudflare used to replace tls quad9. jarl option unset tls cloudflare removes one by its name.
    • Compare views and jarl zone diff are rebuilt around the view
      you're on (docs/views.md#comparing-views): a summary per view, then
      what is answered differently (a view's own records in linked zones,
      drift otherwise) with Use this everywhere, the names only some
      views have, grouped, with Add to VIEW, and how many are the same.
      One line per record: the CLI cuts long TXT records to the terminal
      (--wide shows them whole). --with picks the views to compare with.
      GET /zones/{zone}/compare returns these sections instead of rows.

    Fixed

    • Encrypted DNS: the client hints tested with kdig (Knot's, often not
      installed) and with curl's JSON API, which named's DoH doesn't speak;
      they use BIND's dig +tls / dig +https now.
    • Server options → Added by Jarl: long statements didn't wrap, and the
      browser console reported a Content Security Policy violation (an inline
      style the page's policy blocks).

    Upgrading from 0.5

    • Tested: 0.5.2 packages with views, a linked zone, a reverse zone,
      blocking, a tls statement and statistics, upgraded in place in Debian
      13 (BIND 9.20.29): everything kept and answered as before, the new
      features worked on the upgraded data, and a 0.5.2 backup restored.
    • The database gets two new versions (12 and 13), applied when jarld
      starts; a 0.5 jarld can't open it afterwards, so take a backup first (sudo jarld backup). Nothing changes until you turn auto_ptr on for a
      zone.
    • The statistics database gets a new version too (the query log); 0.5
      can't open it afterwards either. It starts empty and fills from then on.
    Downloads