adam/jarl
Watch
1
0
Fork
You've already forked jarl
 0
Code Issues 4 Pull requests Projects Releases 35 Packages Wiki Activity Actions
35 releases 35 tags
  • v0.6.1-rc.4 3ddd32f97f

    Jarl v0.6.1-rc.4 Pre-release

    adam released this 2026-10-20 22:32:19 +01:00 | 11 commits to main since this release

    Added

    • Certificates for other hosts: jarl cert get NAME -d DOMAIN --dir DIR --hook CMD on a mail server or proxy has jarld obtain the certificate
      (and renew it), waits, downloads it when it is newer than the host's
      copy, and runs the hook with the file paths in JARL_CERT_*
      variables. Its settings are saved, so jarl cert get alone refreshes
      them all; jarl cert schedule writes a daily systemd timer for that;
      jarl cert saved lists them with their expiry; jarl cert forget
      stops one. A certificate belongs to the user that asked for it (other
      users can't take the name), is obtained again only when a name is
      added or removed, and the Certificates page shows its owner and who
      downloaded it, flagging hosts that haven't fetched a renewal. A new
      certificates grant (certificates:write names=*.adbraun.lol) says
      which names a user may have; it is never part of *. Users may own
      certificates.max_per_user certificates (10), or their own
      --cert-limit. API: POST /certificates/{name}/request.
    • Certificates can be exported for use outside Jarl: Export… on the
      Certificates page (download, or copy to the clipboard),
      jarl cert export NAME [--dir DIR | --part PART]
      and GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
      Administrators only; every export of the private key is audited
      (certificate.export_key).
    • A reverse zone's "addresses have no PTR record" banner lists them, with
      the name each would get, instead of only counting them
      (ptr_missing_list in the zone API).
    • A zone's page links to the same zone in the other views ("also in
      external"), in each view's colour, keeping the tab you are on. It
      works for zones that aren't linked too, and the zone API's new
      in_views lists them.
    • jarl.service has the alias jarld.service, so systemctl restart jarld works too. The alias is linked when the unit is enabled; the
      package relinks a unit enabled by an older version on upgrade.

    Changed

    • The Statistics page's range buttons follow stats.retention: ranges
      longer than any data kept are left out, and 1y and 2y appear
      when retention.day (or retention.hour) covers them (with the
      default 730d, both do). The busiest-times heatmap says how far back it
      really goes (at most retention.hour), and links to the Explore page
      keep within retention.queries instead of assuming 7 days.
      GET /stats/status and GET /stats/explore add retention_seconds.

    • A reverse zone's missing PTR records count only its own view's A and
      AAAA records. An address only another view's records use (an internal
      host, seen from the vps view's copy of 10.0.10.in-addr.arpa) is no
      longer reported as missing; it shows apart, as Other views in jarl zone show, ptr_other_views in the API and a note on the zone's page.
      Filling (--fill, jarl zone fill-ptr, the page's button) names those
      from the other view only when asked, with --other-views
      (fill_other_views, ?other_views=1, a checkbox in the New reverse
      zone dialog), so one view's host names don't leak into another. When
      there is nothing else to fill, Jarl says how many there are and how to
      add them. The page and jarl zone show list those addresses with the
      name each would get, and the view it comes from
      (ptr_other_views_list); jarl zone show lists the missing ones too.

    • Records, zones and validation findings sort numeric labels by value, so
      2.10.0.10.in-addr.arpa comes before 101.10.0.10.in-addr.arpa in the
      web UI, the CLI and the rendered zone files. Names still group by label
      from the right (subdomains stay under their parent); other labels keep
      the old byte order (host10 before host2). Zone files are rewritten
      in the new order the next time they change; named doesn't care about
      record order.

    • cname_chain no longer warns about one CNAME pointing at another (a
      service name at a host alias is common, and named answers the chain at
      once). A chain of three or more CNAMEs gets an info note that shows
      it.

    • A certificate's private key is only exported over HTTPS, the local
      socket, or to the server itself (plain HTTP from another host is
      refused with https_required).

    • The Certificates page's "Used for" column says DoT and DoH for named,
      with the addresses in the tooltip, instead of listing every address. A
      certificate with no use says "not used by Jarl" rather than "nothing
      yet": it may well be used elsewhere.

    • Deleting a linked zone's local records (an override) removes that name
      and type from that view only. It used to bring the shared records back
      into the view, so a delete looked undone. The other views keep their
      records, local to each now; Share one view's version (jarl record update ID --shared) to have it everywhere again.

    • A linked zone's Compare views tab starts with a view it is linked to,
      not the first other view.

    • The New token form only offers templates within what the token's user
      may do. A token never does more than its user, so offering more only
      misled.

    • A zone update that changes nothing is no change: saving a zone's
      settings without changing them says "Nothing changed" instead of
      staging an empty change. Staging operations that change nothing
      (POST /changesets/{id}/ops, or ?stage=) is a 400 "nothing to
      change".

    Fixed

    • The "query log is off" error named a setting that doesn't exist,
      stats.query_retention; it's stats.retention.queries.

    • jarl zone show for a reverse zone printed only "and 1 more" under
      "Other views:" when the server was older than the CLI (0.6.1-rc.2
      sends the count but not the addresses). It now prints just the count
      line then.

    • jarl changeset show printed its Created and Applied times in UTC,
      while jarl history and jarl status print local time. It uses local
      time now too.

    • The statistics' "Busiest times" grid drew hours without data taller
      than the others (they picked up the page's padding for empty
      messages).

    • A token for one view of a linked zone (such as an ACME token with
      views=external) couldn't add records: a new record is shared, and
      that reached the other view. A new name and type is now local to the
      view when the user may not change it in the other views.

    • A zone name in several views had to be given with --view even when
      the user could see it in only one (jarl record list adbraun.lol with
      a one-view token), and the error named views the user can't see. Now
      the one they can see is used.

    • jarl view list was empty for a user without views:read, though
      they can see zones in views. It now lists those views by name, colour
      and visible zone count (marked limited in the API), without their
      settings.

    • The DNSSEC tab told you to give the DS record to your registrar for
      every zone whose parent isn't in Jarl in the same view. Now it (and
      jarl zone dnssec status, and the API's new ds_at, ds_place and
      ds_note) says where it really goes: the parent zone in Jarl (in any
      view now, the zone's own first), the registrar for a registered
      domain, the parent zone wherever it is hosted for a subdomain, your
      ISP or RIR for a reverse zone, and nowhere for a private name such as
      home.lan (signing it has no effect).

    • The Registrar tab (and jarl zone registrar, and the DNSSEC page's
      registrar button) was offered for every zone when porkbun.domains is
      empty, and always failed for subdomain zones (lab.adbraun.lol),
      reverse zones and private names (home.lan): Porkbun only knows
      registered domains. Only zones that are a registered domain (by the
      public suffix list) get it now; the others say what delegates them
      instead.

    • Auto-PTR in linked zones changed PTR records in every linked view, not
      just where the address record is. A record local to one view got PTR
      records in the other views too; deleting or changing the address in
      one view deleted or moved the PTR records of views that still had it.
      PTR records now follow each view's own address records, are local to
      their view in a linked reverse zone, and each zone's Reverse DNS
      setting counts for its own view. Fill also adds local PTR records
      now, not shared ones. The same applies to Update PTR (--ptr).

    • Saving the settings of a zone whose primary name server is outside it
      (ns1.adbraun.lol. for wg.adbraun.lol) changed the name server to
      ns1.adbraun.lol.wg.adbraun.lol.. The form showed the name without its
      final dot, which the server reads as relative to the zone. Names outside
      the zone now keep the dot, and the name server is only sent when it was
      changed.

    Upgrading

    • Tested: a 0.6.0 install with views, linked and reverse zones and
      statistics, opened by 0.6.1-rc.1: every zone, record and view kept,
      named answered as before, and the new grant and limits worked.
    • The database gains a migration (certificate owners, per-user
      certificate limits, certificate downloads). Going back to an older
      version afterwards means restoring a backup made before the upgrade.
    Downloads