Clusters (DDI_CLUSTER), Kea HA pairs (DDI_KEA_HA), dynamic zones
(DDI_DYNAMIC_ZONES) and SSO (DDI_SSO) now need the matching Keygen
entitlement; the trial grants all of them. Only taking a feature into
use is blocked (403 license_feature): existing clusters, HA pairs,
dynamic zones and enabled SSO keep working and stay editable.
maxAgents is checked when creating an enrollment token and, under an
advisory lock, at enrollment; revoked agents do not count. GET /license
reports available_features and the agent usage. The UI shows the
features on the license page and disables locked controls, and
keygen-setup.sh creates the entitlements and assigns them to licenses
(ADR 0027).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Netlogon registers A records below _msdcs (gc._msdcs.<domain>), which the
default check-names of primary zones refuses; dynamic zones now get
check-names ignore. Troubleshooting for dcdiag in ACTIVE-DIRECTORY.md, an
end-to-end check of such an update.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Its container ends without output in CI; the path is covered by the agent
role's integration test against real BIND and by the end-to-end test.
Recorded as open point 19 in the project log.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The output of the failing dynamic update test did not show up in the CI
log; escape control characters and log each line.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
named -g logs "running as: named ..." right at the start, so waiting for
"running" returned at once and nsupdate met a server that did not listen
yet. Wait for the line that ends in " running".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The attached output of docker start can end early; the failure of the
dynamic update test was cut off mid-line in CI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Starts named with a revision whose dynamic zones still hold the previous
initial files, applies dynamic-records.json with nsupdate -k as the DNS
agent will, and checks the records with dig, the per-record delete next
to a foreign record, and that unsigned updates from 127.0.0.1 are still
refused. The cluster check now covers the update key on the primary only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The server creates the system key ddi-agent-update (hmac-sha256, sealed
like every key) with the first dynamic zone and at start, marks it in the
new column tsig_keys.system (migration 00007) and puts it into the
generator input (Source version 4). System keys are listed, rotatable and
not deletable (key_system); their name is reserved (key_exists). The
address check no longer reports dynamic_zone (ADR 0026).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Targets that serve a dynamic zone as primary get the DNS agents' update
key (Source version 4, UpdateKeyID) in the update ACLs and two more
artifacts: ddi-suite-update.key (secret) and dynamic-records.json with
the records DDI owns in each dynamic zone (ADR 0026). Older sources and
targets without dynamic primary zones render byte-identically.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An agent installed without token and enrolled with the command of the web
interface never ran as a service: the installer left the unit disabled and
the root-run enrollment left an identity the service user could not read.
The installer now always enables the agent unit (it waits for the
identity via ConditionPathExists), enroll as root hands the state over to
the service user and enables and starts the unit, and rerunning or
upgrading the installer repairs agents enrolled by hand. The web interface
shows the matching installer command next to the enroll command.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On the user's server the check reported "socket: permission denied" for
ping and asked only the server's own resolver. Ping now falls back to a
raw ICMP socket (the server unit gets CAP_NET_RAW, like /bin/ping); DNS
asks the DNS agents outside clusters when no name server addresses are
configured, gives every server its own timeout, and explains missing
records (dynamic zone, system resolver, not deployed yet).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Go resolver reads /etc/hosts first, so a hosts entry could make a
missing DNS record look fine. Checks against configured servers now use a
small DNS client (UDP, TCP on truncation, random query IDs).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ADR 0025 on the server:
- Migration 00006 turns the free addresses of every pool into dynamic
entries with random host names (dyn- and 8 characters), names unnamed
dynamic entries, moves colliding lease names to the new column
lease_hostname, extends the unique FQDN index to dynamic entries and
drops dhcp_pools. Down rebuilds pools from runs of dynamic entries.
- Networks no longer take pools; Network.pools is derived from the
dynamic entries, also for the generator input.
- Dynamic entries without host name get a random one (create, update,
CSV import, bulk type change, range assign), drawn again on an FQDN
collision.
- Leases only update existing entries (lease fields, lease_hostname, the
MAC of dynamic entries) and never create entries or change host names.
- GET /networks/{id}/ips, POST /networks/{id}/range (assign/clear, dry
run, one audit entry) and POST /addresses/check (unprivileged ICMP echo,
forward and reverse lookup at the zone's servers).
- Bulk changes: set_description, regenerate_hostnames and dry runs with
summarized effects.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
derive.BuildDNS creates A/AAAA and PTR records for dynamic entries only for
sources of version 3 or later, so that stored older sources render byte
for byte as before (rollbacks; TestM4Compatibility now covers versions 0
and 2). Dynamic entries in networks without domain produce no warning,
which would otherwise repeat for every address of a large DHCP range.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ADR 0025: dynamic entries publish A/PTR records and form the DHCP range of
their network; pools are no longer part of the network. Dynamic entries
need DHCP, IPv4 and must not be the gateway. Ranges() merges addresses into
runs of consecutive addresses, utilization counts dynamic entries, the
address map loses the pool state, previews report entering and leaving the
DHCP range by type. Helpers for the IP list and range operations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ADR 0025 and the REST API: per-address DHCP instead of pools, DNS for
dynamic entries, all IPs of a network, range operations, bulk dry runs
and ping/DNS checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Per-row network and address searches limited imports to ~300 rows/s, so a
file at the row limit outlasted the write timeout. The import now loads
networks and the affected entries once and gets a 10-minute deadline. The
master key mode in ADR 0024 follows the server's check (0400).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A refresh that fails because the primary is not up yet is retried only
after the zone's retry interval, longer than the test waits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
retention.audit_days and retention.revisions_keep (DDI_RETENTION_*) drive
a cleanup five minutes after the start and then daily. The latest
revision, revisions agents run, fall back to or target, and revisions
with pending deployments are never deleted; deployment rows stay. A
cleanup that deletes anything records retention.cleanup in the audit log.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Validates and activates the key like PUT /api/v1/license (same service
call, audited as the system actor) and prints the license state without
the key. Exit codes: 2 bad input, 3 key rejected, 4 license server
unreachable or untrusted (nothing stored).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The DHCP agent writes the HA credentials only as ddi-suite-ha-password and
ddi-suite-ha-user; other names are now rejected when the settings are
saved instead of when a revision is generated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kea 3.x rejects clear-text users and passwords in HTTP authentication
("use of clear text 'user' is NOT SECURE"). Control socket clients now
use user-file and password-file, HA peers basic-auth-user-file and
basic-auth-password-file. The new secret artifact ddi-suite-ha-user
sits next to the password file (HAConfig.UserFile, set by derive);
keagen requires the file names ddi-suite-ha-password and
ddi-suite-ha-user. The DHCP agent handles both credential files alike:
consistent references in one directory, validation copy pointing at
the revision's files, written before the configuration, restored on a
failed reload, removed when HA goes away, compared by the health check.
Integration test and e2e read the user from the file; ADR 0023 updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kea's load-balancing mode needs non-overlapping pools per server: every
pool is split into a lower half for the primary (HA_primary) and an upper
half for the secondary (HA_secondary). The Kea integration test now covers
both HA modes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Generator targets replace the temporary server shim. The keys file header
carries no revision number, so that diffs only show it when a key changed.
API test of cluster targets with the real generator.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Aligns with the warning codes the web UI translates: missing update and
transfer keys are reported as dns.unknown_key with the params zone and
key (the key ID).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
named.conf includes the keys file before ddi-suite.conf. New cases check
a cluster primary (also-notify, allow-transfer, update keys) and its
secondary with named-checkconf/named-checkzone, run both in one
container until every zone is transferred with the TSIG key, and check
the HA configuration with kea-dhcp4 -t on Kea 3.x, start it and probe
the authenticated HTTP control socket with ha-heartbeat.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Implements the M5 endpoints of the contract (ADR 0023): clusters with
member validation, transfer keys and HA credentials, TSIG keys with
audited secret access and rotation, explicit zones and typed records,
the DHCP cluster of networks, the cluster of agents and the default
clusters and HA password file of the generator settings. Revisions are
stored per target with sealed secret files and sealed source secrets
(restored for rollbacks); bundles carry an agent's own target or the
default group. Active leases are adopted as dynamic addresses.
The derivation is called through a temporary adapter until derive
implements the M5 contract.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An HA member (Kea >= 3.0) loads libdhcp_ha.so after
libdhcp_lease_cmds.so, switches to "control-sockets" with the agent's
UNIX socket plus an HTTP socket on its own peer address that requires
basic authentication, disables the dedicated HA listener (it checks no
credentials) and sends basic-auth-user and the password file to its
peer. The password goes into the secret artifact ddi-suite-ha-password.
Output without HA is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Migration 00005: clusters with members (composite foreign keys keep the
roles of agents, clusters, zones and networks apart), TSIG keys with sealed
secrets, zones with update keys, typed DNS records, the DHCP cluster of a
network, revision files per target with a secret flag and sealed revision
secrets. Repositories for the new tables and for the lease adoption.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Render always writes the secret ddi-suite-keys.conf (only a comment
without keys). Primary zones of a cluster get "notify explicit",
"also-notify" and "allow-transfer" with the transfer key; secondary
zones transfer from their primaries with the key into
<zone_dir>/secondary/ and have no artifact. Dynamic zones accept the
update keys in their ACL. Keys are validated (name, algorithm
whitelist, canonical base64) and every referenced key must exist.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
BuildDNS and BuildDHCP return one configuration per target (ADR 0023):
the default group first, then every cluster member by agent ID. DNS
gains explicit zones and records, longest-suffix placement of address
records, primary/secondary zones with NOTIFY and transfer keys, dynamic
zones with update keys and CNAME conflict resolution; DHCP gains the
Kea HA setup of cluster pairs. DerivedZones lists the zones derived
from networks. An M4 source still renders byte-identical files
(testdata/m4 holds the output of the M4 generator).
The service renders only the default target until the server part of
M5 follows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ADR 0023, generator input and output types per target, and the REST API
for clusters, TSIG keys, zones and records.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- PATCH /agents/{id} switches the mode and reconnects the agent
- POST /revisions/{n}/deploy creates pending push deployments, sends
ApplyRevisionCommand with the deployment ID, re-sends open pushes on
connect and announces them in GetDesiredState; reports with the ID
complete the deployment
- POST /revisions/{n}/rollback re-renders the stored generator input
with the next revision number
- GET /revisions/{n}/diff and GET /config/pending with unified diffs
- GET /events streams agent, deployment, revision and pending events
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fan-out to subscribers with bounded buffers; slow subscribers miss
events instead of blocking publishers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agents get a target revision (manual mode), revisions store their
generator input (jsonb) for rollbacks, deployments gain the outcomes
pending and superseded, a nullable end and the requesting user. The
duplicate protection now covers agent reports only. Transactions can
register hooks that run after the commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ADR 0022, OpenAPI additions (agent mode, deploy, rollback, diff, pending
changes, server-sent events), deployment_id in GetDesiredStateResponse
for pushes picked up by polling, and the textdiff package (Myers,
unified format).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Docker Hub timed out on the shared runner; pulls now retry and fall back
to a local image. The e2e scripts were committed without the executable
bit. The truncation test checked letters that the marker itself contains.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
test/e2e runs server, PostgreSQL, BIND and Kea with both agents in
containers (make test-e2e, CI job End-to-end): enrollment with the
command from the API, revision 1 and 2 applied and served by BIND and
Kea, unchanged data creates no revision, revoking disconnects the agent
while BIND keeps serving.
Fixes from the first CI run: quote a spec description containing a
comma, exempt the agent lock-out routes in the route protection test,
whole-second certificate lifetimes, a push replacing queued pulls, the
truncation marker containing the letter checked, and curl|grep -q under
pipefail in the server smoke test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Revoking or deleting an agent and deleting enrollment tokens lock agents
out, a security function that must stay available when the license is
read-only. Translations for the new problem codes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Loads or creates the agent PKI at startup, serves the gRPC agent API on
agent_api.listen with graceful shutdown, exports ddi_agents_connected
and removes old enrollment tokens periodically.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keepalive MinTime 20 s (agents ping every 30 s, also without a stream),
send limit above bundle.MaxTotalSize, and resent deployment reports
(same agent, revision and start time) are dropped without error and
without touching the agent's state.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
