ysk-server-core 1.0.0

package/dist/hosting/powerdns-apply.js

@@ -0,0 +1,790 @@
+/**
+ * PowerDNS dual-mode: probe tools + load managed BIND zone files.
+ *
+ * Public product rules:
+ * - Zone set is always **dataDir/dns/zones/*.zone** (any customer domain) — never hard-coded.
+ * - Paths under /etc/powerdns and /var/lib/powerdns are **distro defaults** (Debian/Ubuntu),
+ *   overridable only by platform layout, not by a single host identity.
+ * - dataDir itself is always the panel config (`--data-dir` / config.json).
+ *
+ * Ubuntu packages use **pdns-backend-bind**: zones come from named.conf, not from
+ * writing `dataDir/dns/zones/*.zone` alone. dig REFUSED + "Parsing 0 domain(s)"
+ * means the zone file exists but was never registered / rediscovered.
+ *
+ * Load path (honest):
+ *   1. Write managed zone file under dataDir
+ *   2. Sync BIND named.conf include with all managed zones
+ *   3. pdns_control rediscover|reload (or systemctl reload pdns)
+ *   4. Optional pdnsutil load-zone for non-bind backends
+ *
+ * Never fakes success — system apply needs YSK_EXECUTE + root.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { listManagedDnsZones, writeManagedDnsZone } from './dns-zone.js';
+import { resolveBin, shellBinExists } from './software-probe/index.js';
+/** Runtime dir for copies readable by pdns user (avoid world-chmod on dataDir). */
+export const POWERDNS_RUNTIME_ZONES_DIR = '/var/lib/powerdns/zones';
+/** Path PowerDNS bindbackend should read for a managed zone name. */
+export function powerDnsRuntimeZonePath(zone) {
+    const name = zone.trim().toLowerCase().replace(/\.$/, '');
+    return `${POWERDNS_RUNTIME_ZONES_DIR}/${name}.zone`;
+}
+/** Render BIND-style zone stanzas for PowerDNS bindbackend. */
+export function renderPowerDnsNamedZonesConf(zones, opts) {
+    const lines = [
+        '// Managed by YSK Server — PowerDNS BIND backend zone list',
+        '// Do not edit by hand; regenerated by syncPowerDnsBindZones / applyPowerDnsZone',
+        '',
+    ];
+    for (const z of zones) {
+        const name = z.zone.trim().toLowerCase().replace(/\.$/, '');
+        if (!name)
+            continue;
+        const filePath = opts?.runtimePaths ? powerDnsRuntimeZonePath(name) : z.zonePath;
+        lines.push(`zone "${name}" {`);
+        lines.push('  type master;');
+        lines.push(`  file "${filePath}";`);
+        lines.push('};');
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+/**
+ * Bash: copy zone files for pdns user, install named include, rediscover.
+ * Safe to re-run. Does not world-chmod dataDir; uses /var/lib/powerdns/zones.
+ */
+export function installPowerDnsBindZonesShell(input) {
+    const confBody = renderPowerDnsNamedZonesConf(input.zones, { runtimePaths: true });
+    const b64 = Buffer.from(confBody, 'utf8').toString('base64');
+    const dataPath = JSON.stringify(input.dataDirZonesConf);
+    const dataDirJson = JSON.stringify(input.dataDir);
+    const copyLines = [
+        `RUNTIME_ZONES=${JSON.stringify(POWERDNS_RUNTIME_ZONES_DIR)}`,
+        'mkdir -p "$RUNTIME_ZONES"',
+    ];
+    for (const z of input.zones) {
+        const name = z.zone.trim().toLowerCase().replace(/\.$/, '');
+        if (!name)
+            continue;
+        copyLines.push(`if [ -f ${JSON.stringify(z.zonePath)} ]; then`, `  cp -f ${JSON.stringify(z.zonePath)} ${JSON.stringify(powerDnsRuntimeZonePath(name))}`, `  chown pdns:pdns ${JSON.stringify(powerDnsRuntimeZonePath(name))} 2>/dev/null || chown root:root ${JSON.stringify(powerDnsRuntimeZonePath(name))} 2>/dev/null || true`, `  chmod 640 ${JSON.stringify(powerDnsRuntimeZonePath(name))} 2>/dev/null || true`, 'fi');
+    }
+    return [
+        'set -euo pipefail',
+        'CONF_DIR=/etc/powerdns',
+        'PDNS_CONF="$CONF_DIR/pdns.conf"',
+        'NAMED="$CONF_DIR/named.conf"',
+        'YSK_INC="$CONF_DIR/ysk-named-zones.conf"',
+        'mkdir -p "$CONF_DIR" "$CONF_DIR/pdns.d"',
+        // Copy sources → runtime paths owned by pdns (no world-read on dataDir secrets)
+        ...copyLines,
+        // Ensure dataDir parents are traversable by pdns only if we ever fall back; prefer runtime copy
+        `DATA_DIR=${dataDirJson}`,
+        'if [ -d "$DATA_DIR/dns/zones" ]; then',
+        '  chmod o+x "$DATA_DIR" 2>/dev/null || true',
+        '  chmod o+x "$DATA_DIR/dns" 2>/dev/null || true',
+        '  # do NOT chmod -R a+r on dataDir (may hold secrets)',
+        '  chgrp -R pdns "$DATA_DIR/dns/zones" 2>/dev/null || true',
+        '  chmod g+rX "$DATA_DIR/dns/zones" 2>/dev/null || true',
+        '  chmod g+r "$DATA_DIR/dns/zones"/*.zone 2>/dev/null || true',
+        'fi',
+        `echo ${JSON.stringify(b64)} | base64 -d > "$YSK_INC"`,
+        `cp -f "$YSK_INC" ${dataPath} 2>/dev/null || true`,
+        'if [ ! -f "$NAMED" ]; then',
+        '  printf "%s\\n" \'// YSK Server — PowerDNS bind-config\' \'options { directory "/var/lib/powerdns"; };\' "" > "$NAMED"',
+        'fi',
+        'if ! grep -qF \'ysk-named-zones.conf\' "$NAMED" 2>/dev/null; then',
+        '  printf "\\n// YSK Server managed zones\\ninclude \\"%s\\";\\n" "$YSK_INC" >> "$NAMED"',
+        'fi',
+        'DROP="$CONF_DIR/pdns.d/ysk-bind-backend.conf"',
+        'cat > "$DROP" <<\'EOF\'',
+        '# Managed by YSK Server — BIND backend zone config path',
+        'bind-config=/etc/powerdns/named.conf',
+        'EOF',
+        'if [ -f "$PDNS_CONF" ] && ! grep -qE "^[[:space:]]*include-dir=" "$PDNS_CONF" 2>/dev/null; then',
+        '  echo "include-dir=$CONF_DIR/pdns.d" >> "$PDNS_CONF"',
+        'fi',
+        'if ! grep -RqsE "^[[:space:]]*launch=" "$PDNS_CONF" "$CONF_DIR/pdns.d" 2>/dev/null; then',
+        '  echo "launch=bind" >> "$DROP"',
+        'fi',
+        'ZONE_COUNT=$(grep -cE "^zone " "$YSK_INC" 2>/dev/null || echo 0)',
+        'echo "YSK_PDNS_ZONE_COUNT=$ZONE_COUNT"',
+        'echo "YSK_PDNS_NAMED_INC=$YSK_INC"',
+        'echo "YSK_PDNS_RUNTIME_ZONES=$RUNTIME_ZONES"',
+        '# Rediscover; prefer reload over restart',
+        'if command -v pdns_control >/dev/null 2>&1; then',
+        '  pdns_control rediscover 2>/dev/null || true',
+        '  pdns_control reload 2>/dev/null || true',
+        'fi',
+        'if systemctl is-active --quiet pdns 2>/dev/null; then',
+        '  systemctl reload pdns 2>/dev/null || true',
+        'elif systemctl list-unit-files pdns.service >/dev/null 2>&1; then',
+        '  systemctl start pdns 2>/dev/null || systemctl restart pdns 2>/dev/null || true',
+        'fi',
+        'sleep 1',
+        'UNIT_STATE=$(systemctl is-active pdns 2>/dev/null || echo inactive)',
+        'echo "YSK_PDNS_UNIT=$UNIT_STATE"',
+        'echo "YSK_PDNS_LIST_ZONES_BEGIN"',
+        'if command -v pdns_control >/dev/null 2>&1; then',
+        '  pdns_control list-zones 2>/dev/null || true',
+        'fi',
+        'echo "YSK_PDNS_LIST_ZONES_END"',
+    ].join('\n');
+}
+/** Parse list-zones block from sync shell stdout. */
+export function parsePdnsListZonesOutput(out) {
+    const listMatch = out.match(/YSK_PDNS_LIST_ZONES_BEGIN\n([\s\S]*?)\nYSK_PDNS_LIST_ZONES_END/);
+    const block = listMatch?.[1] ?? '';
+    // Also accept bare list-zones output without markers
+    const raw = block || out;
+    return raw
+        .split('\n')
+        .map((l) => l.trim().replace(/\.$/, '').toLowerCase())
+        .filter((l) => l &&
+        !l.startsWith('all') &&
+        !l.startsWith('#') &&
+        !l.startsWith('ysk_pdns') &&
+        !/^zonecount/i.test(l) &&
+        !l.includes('=') &&
+        /^[a-z0-9._-]+$/.test(l));
+}
+/**
+ * Write managed named-zones.conf (dataDir + system) and rediscover PowerDNS BIND backend.
+ * This is the fix for: zone file on disk + pdns listening but dig REFUSED (0 domains).
+ */
+export async function syncPowerDnsBindZones(input) {
+    const notes = [];
+    const written = [];
+    const commandResults = [];
+    const managed = listManagedDnsZones(input.dataDir);
+    const zones = managed.map((z) => ({ zone: z.zone, zonePath: z.zonePath }));
+    // Plan conf shows runtime paths (what pdns will read after apply)
+    const confBody = renderPowerDnsNamedZonesConf(zones, { runtimePaths: true });
+    const helperDir = join(input.dataDir, 'dns', 'powerdns');
+    mkdirSync(helperDir, { recursive: true });
+    const zonesConfPath = join(helperDir, 'named-zones.conf');
+    writeFileSync(zonesConfPath, confBody, 'utf8');
+    written.push(zonesConfPath);
+    notes.push(`Managed named-zones.conf: ${zonesConfPath} (${zones.length} zone(s))`);
+    for (const z of zones) {
+        notes.push(`  - ${z.zone} → ${z.zonePath} (runtime ${powerDnsRuntimeZonePath(z.zone)})`);
+    }
+    const wantApply = Boolean(input.apply);
+    if (!wantApply) {
+        return {
+            ok: true,
+            mode: 'plan',
+            zones: zones.map((z) => z.zone),
+            zonesConfPath,
+            notes: [
+                ...notes,
+                tl('notes.dns.planOnly'),
+            ],
+            written,
+            commandResults,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot(),
+        };
+    }
+    const execute = input.host.executeEnabled() && input.host.isRoot();
+    if (!execute) {
+        return {
+            ok: false,
+            mode: 'refused',
+            zones: zones.map((z) => z.zone),
+            zonesConfPath,
+            notes: [
+                ...notes,
+                tl('notes.auto.n1163'),
+                tl('notes.dns.needRootNamed'),
+            ],
+            written,
+            commandResults,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot(),
+        };
+    }
+    if (zones.length === 0) {
+        notes.push(tl('notes.dns.noManagedZonesClear'));
+    }
+    const script = installPowerDnsBindZonesShell({
+        zones,
+        dataDirZonesConf: zonesConfPath,
+        dataDir: input.dataDir,
+    });
+    const r = await input.host.runCommand(['bash', '-c', script], { timeoutMs: 90_000 });
+    commandResults.push({
+        argv: ['bash', '-c', 'sync-powerdns-bind-zones'],
+        exitCode: r.exitCode,
+        stderr: r.stderr,
+    });
+    const out = `${r.stdout || ''}\n${r.stderr || ''}`;
+    for (const line of out.split('\n').map((l) => l.trim()).filter(Boolean).slice(0, 40)) {
+        notes.push(line);
+    }
+    const listed = parsePdnsListZonesOutput(out);
+    const expected = zones.map((z) => z.zone.toLowerCase());
+    const foundExpected = expected.length === 0 ||
+        expected.every((z) => listed.some((l) => l === z || l === `${z}.` || l.startsWith(`${z}`)));
+    const unitActive = /YSK_PDNS_UNIT=active/.test(out);
+    // Honest: empty expected (clear all) is ok if script ran; otherwise require list-zones confirm
+    const ok = r.exitCode === 0 &&
+        (expected.length === 0 ? true : foundExpected && (unitActive || listed.length > 0));
+    if (ok && expected.length > 0) {
+        notes.push(tl('notes.dns.bindRegistered', { count: expected.length }));
+    }
+    else if (r.exitCode === 0 && expected.length > 0 && !foundExpected) {
+        notes.push(tl('notes.dns.listZonesIncomplete'));
+    }
+    return {
+        ok,
+        mode: ok ? 'loaded' : 'refused',
+        zones: zones.map((z) => z.zone),
+        listedZones: listed,
+        zonesConfPath,
+        notes,
+        written,
+        commandResults,
+        requiresExecute: false,
+        requiresRoot: false,
+    };
+}
+/**
+ * Single entry for register/load managed zones into the local nameserver.
+ * Prefer this from apply / heal / delete / zone-file so scripts do not drift.
+ */
+export async function registerManagedDnsWithNameserver(input) {
+    return syncPowerDnsBindZones(input);
+}
+/** Read launch= from pdns conf to pick load strategy. */
+export async function detectPowerDnsBackend(host) {
+    const notes = [];
+    const r = await host.runCommand([
+        'bash',
+        '-c',
+        'grep -hRE "^[[:space:]]*launch=" /etc/powerdns/pdns.conf /etc/powerdns/pdns.d 2>/dev/null | head -5 || true',
+    ], { timeoutMs: 5_000 });
+    const launch = (r.stdout || '')
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l.startsWith('launch='))
+        .map((l) => l.replace(/^launch=/, '').trim())
+        .join(',');
+    if (!launch) {
+        notes.push(tl('notes.dns.noLaunchDefaultBind'));
+        return { kind: 'bind', notes };
+    }
+    notes.push(`launch=${launch}`);
+    if (/\bbind\b/i.test(launch))
+        return { kind: 'bind', launch, notes };
+    if (/gsqlite|gmysql|gpgsql|lmdb|godbc/i.test(launch)) {
+        return { kind: 'pdnsutil', launch, notes };
+    }
+    return { kind: 'unknown', launch, notes };
+}
+/**
+ * Detect PowerDNS CLI tools on PATH.
+ */
+export async function probePowerDns(host) {
+    const notes = [];
+    const find = async (bin) => {
+        const p = await resolveBin(host, bin);
+        return p || undefined;
+    };
+    // Prefer catalog presence for server; CLI tools via unified resolveBin
+    const pdnsutil = await find('pdnsutil');
+    const pdnsControl = await find('pdns_control');
+    const pdnsServer = await find('pdns_server');
+    if (pdnsutil)
+        notes.push(`pdnsutil: ${pdnsutil}`);
+    if (pdnsControl)
+        notes.push(`pdns_control: ${pdnsControl}`);
+    if (pdnsServer)
+        notes.push(`pdns_server: ${pdnsServer}`);
+    if (!pdnsutil && !pdnsControl) {
+        notes.push(tl('notes.auto.n0846'));
+    }
+    return {
+        pdnsutil,
+        pdnsControl,
+        pdnsServer,
+        available: Boolean(pdnsutil || pdnsControl),
+        notes,
+    };
+}
+/**
+ * Ensure managed zone file exists, then optionally load into PowerDNS.
+ *
+ * Preferred for Ubuntu bind backend (pdns-backend-bind):
+ *   sync named.conf include + pdns_control rediscover
+ * Fallback:
+ *   pdnsutil load-zone <zone> <zonefile>
+ */
+export async function applyPowerDnsZone(input) {
+    const zone = input.zone.trim().toLowerCase().replace(/\.$/, '');
+    if (!zone) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1391'), { httpStatus: 400 });
+    }
+    const notes = [];
+    const written = [];
+    const commandResults = [];
+    const probe = await probePowerDns(input.host);
+    notes.push(...probe.notes);
+    let zonePath = join(input.dataDir, 'dns', 'zones', `${zone}.zone`);
+    if (input.rewriteZone !== false || !existsSync(zonePath)) {
+        const w = await writeManagedDnsZone({
+            dataDir: input.dataDir,
+            zone,
+            serverIp: input.serverIp,
+            serverIpv6: input.serverIpv6,
+            mailHost: input.mailHost,
+            host: input.host,
+            validate: false,
+        });
+        zonePath = w.zonePath;
+        written.push(...w.written);
+        notes.push(...w.notes.filter((n) => !notes.includes(n)));
+    }
+    else {
+        notes.push(tl('notes.dns.usingExistingZone', { path: zonePath }));
+    }
+    if (!existsSync(zonePath)) {
+        return {
+            ok: false,
+            zone,
+            zonePath,
+            mode: 'refused',
+            notes: [...notes, 'Zone file missing'],
+            written,
+            commandResults,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot(),
+            probe,
+            loadMethod: 'none',
+        };
+    }
+    // Always write a load helper script for operators (bind path + pdnsutil)
+    const helperDir = join(input.dataDir, 'dns', 'powerdns');
+    const helper = join(helperDir, `load-${zone}.sh`);
+    mkdirSync(helperDir, { recursive: true });
+    writeFileSync(helper, [
+        '#!/usr/bin/env bash',
+        `# YSK Server — load zone ${zone} into PowerDNS (BIND backend preferred)`,
+        'set -euo pipefail',
+        `ZONE=${JSON.stringify(zone)}`,
+        `FILE=${JSON.stringify(zonePath)}`,
+        'CONF_DIR=/etc/powerdns',
+        'YSK_INC="$CONF_DIR/ysk-named-zones.conf"',
+        'mkdir -p "$CONF_DIR"',
+        'if [ -f "$YSK_INC" ] && grep -qF "zone \\"$ZONE\\"" "$YSK_INC" 2>/dev/null; then',
+        '  echo "zone already listed in $YSK_INC"',
+        'else',
+        '  {',
+        '    echo "zone \\"$ZONE\\" {"',
+        '    echo "  type master;"',
+        '    echo "  file \\"$FILE\\";"',
+        '    echo "};"',
+        '  } >> "$YSK_INC"',
+        'fi',
+        'if [ -f "$CONF_DIR/named.conf" ] && ! grep -qF ysk-named-zones.conf "$CONF_DIR/named.conf"; then',
+        '  echo "include \\"$YSK_INC\\";" >> "$CONF_DIR/named.conf"',
+        'fi',
+        'if command -v pdns_control >/dev/null 2>&1; then',
+        '  pdns_control rediscover || true',
+        '  pdns_control reload || true',
+        '  pdns_control list-zones || true',
+        `elif ${shellBinExists('pdnsutil')}; then`,
+        '  pdnsutil load-zone "$ZONE" "$FILE"',
+        '  pdnsutil rectify-zone "$ZONE" || true',
+        '  echo "loaded $ZONE via pdnsutil"',
+        'else',
+        tl('notes.auto.n0052'),
+        '  exit 1',
+        'fi',
+        '',
+    ].join('\n'), 'utf8');
+    written.push(helper);
+    notes.push(`Helper script: ${helper}`);
+    // Always materialize named-zones plan under dataDir (even without load)
+    const bindPlan = await syncPowerDnsBindZones({
+        dataDir: input.dataDir,
+        host: input.host,
+        apply: false,
+    });
+    written.push(...bindPlan.written.filter((p) => !written.includes(p)));
+    notes.push(...bindPlan.notes.filter((n) => !notes.includes(n) && !n.startsWith('  -')));
+    const wantLoad = Boolean(input.load);
+    if (!wantLoad) {
+        return {
+            ok: true,
+            zone,
+            zonePath,
+            mode: 'plan',
+            notes: [
+                ...notes,
+                tl('notes.auto.n0715'),
+                tl('notes.dns.writeNotAnswerDig'),
+                `Preview (first 400 chars):\n${readFileSync(zonePath, 'utf8').slice(0, 400)}`,
+            ],
+            written,
+            commandResults,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot(),
+            probe,
+            loadMethod: 'none',
+        };
+    }
+    if (!input.host.executeEnabled()) {
+        return {
+            ok: false,
+            zone,
+            zonePath,
+            mode: 'refused',
+            notes: [...notes, tl('notes.auto.n1192')],
+            written,
+            commandResults,
+            requiresExecute: true,
+            requiresRoot: !input.host.isRoot(),
+            probe,
+            loadMethod: 'none',
+        };
+    }
+    const backend = await detectPowerDnsBackend(input.host);
+    notes.push(...backend.notes);
+    let bindAttempted = false;
+    let bindOk = false;
+    // Primary for bind / unknown: BIND backend named.conf + rediscover
+    if (backend.kind === 'bind' || backend.kind === 'unknown') {
+        bindAttempted = true;
+        const bind = await registerManagedDnsWithNameserver({
+            dataDir: input.dataDir,
+            host: input.host,
+            apply: true,
+        });
+        commandResults.push(...bind.commandResults);
+        notes.push(...bind.notes.filter((n) => !notes.includes(n)));
+        written.push(...bind.written.filter((p) => !written.includes(p)));
+        bindOk = Boolean(bind.ok && bind.mode === 'loaded');
+        if (bindOk) {
+            // Post-condition dig — do not claim loaded if still REFUSED
+            const { digLocalAuthoritative } = await import('./dns-health.js');
+            const dig = await digLocalAuthoritative({
+                host: input.host,
+                name: zone,
+                type: 'SOA',
+            });
+            notes.push(...dig.notes);
+            if (!dig.ok) {
+                notes.push(`${tl('notes.dns.bindDigFailed')} (${dig.notes[0] ?? 'empty'})`);
+                bindOk = false;
+            }
+            else {
+                notes.push(tl('notes.dns.bindLoadedOk', { zone }));
+                return {
+                    ok: true,
+                    zone,
+                    zonePath,
+                    mode: 'loaded',
+                    notes,
+                    written,
+                    commandResults,
+                    requiresExecute: false,
+                    requiresRoot: !input.host.isRoot(),
+                    probe,
+                    loadMethod: 'bind-named',
+                };
+            }
+        }
+    }
+    // pdnsutil path (gsqlite/gmysql/lmdb or bind path failed)
+    if (!probe.pdnsutil) {
+        return {
+            ok: false,
+            zone,
+            zonePath,
+            mode: 'refused',
+            notes: [
+                ...notes,
+                bindAttempted
+                    ? bindOk
+                        ? 'BIND incomplete'
+                        : tl('notes.dns.bindSyncFailed')
+                    : tl('notes.dns.bindSkipPdnsutil'),
+                probe.pdnsControl
+                    ? tl('notes.dns.pdnsCtlNoConfirm')
+                    : tl('notes.auto.n0370'),
+            ],
+            written,
+            commandResults,
+            requiresExecute: false,
+            requiresRoot: !input.host.isRoot(),
+            probe,
+            loadMethod: 'none',
+        };
+    }
+    const load = await input.host.runCommand(['pdnsutil', 'load-zone', zone, zonePath], { timeoutMs: 60_000 });
+    commandResults.push({
+        argv: ['pdnsutil', 'load-zone', zone, zonePath],
+        exitCode: load.exitCode,
+        stderr: load.stderr,
+    });
+    if (load.exitCode !== 0) {
+        notes.push(tl('notes.auto.t0293', { v0: (load.stderr || load.stdout) }));
+        return {
+            ok: false,
+            zone,
+            zonePath,
+            mode: 'refused',
+            notes,
+            written,
+            commandResults,
+            requiresExecute: false,
+            requiresRoot: !input.host.isRoot(),
+            probe,
+            loadMethod: 'none',
+        };
+    }
+    notes.push(tl('notes.auto.t0294', { v0: (zone) }));
+    const rect = await input.host.runCommand(['pdnsutil', 'rectify-zone', zone], {
+        timeoutMs: 30_000,
+    });
+    commandResults.push({
+        argv: ['pdnsutil', 'rectify-zone', zone],
+        exitCode: rect.exitCode,
+        stderr: rect.stderr,
+    });
+    if (rect.exitCode === 0)
+        notes.push(tl('notes.auto.n0482'));
+    else
+        notes.push(`rectify-zone exit=${rect.exitCode} (non-fatal)`);
+    return {
+        ok: true,
+        zone,
+        zonePath,
+        mode: 'loaded',
+        notes,
+        written,
+        commandResults,
+        requiresExecute: false,
+        requiresRoot: !input.host.isRoot(),
+        probe,
+        loadMethod: 'pdnsutil',
+    };
+}
+/**
+ * List managed zones with PowerDNS probe (for UI status).
+ */
+export async function powerDnsStatus(input) {
+    const probe = await probePowerDns(input.host);
+    return { probe, zones: listManagedDnsZones(input.dataDir) };
+}
+/**
+ * Bash: set local-address via pdns.d drop-in (public IPv4 only).
+ * Avoids 0.0.0.0:53 which conflicts with systemd-resolved on 127.0.0.53/54:53.
+ * Override with env YSK_PDNS_LOCAL_ADDRESS=x.x.x.x
+ */
+export function configurePdnsLocalAddressShell() {
+    return [
+        'set -euo pipefail',
+        'CONF_DIR=/etc/powerdns',
+        'CONF="$CONF_DIR/pdns.conf"',
+        'DROP="$CONF_DIR/pdns.d/ysk-local-address.conf"',
+        'mkdir -p "$CONF_DIR/pdns.d" 2>/dev/null || true',
+        'if [ -n "${YSK_PDNS_LOCAL_ADDRESS:-}" ]; then',
+        '  PUB="$YSK_PDNS_LOCAL_ADDRESS"',
+        'else',
+        '  PUB=$(ip -4 route get 1.1.1.1 2>/dev/null | awk \'{for(i=1;i<=NF;i++) if($i=="src"){print $(i+1); exit}}\')',
+        '  if [ -z "$PUB" ] || [ "$PUB" = "127.0.0.1" ]; then',
+        '    PUB=$(hostname -I 2>/dev/null | tr " " "\\n" | grep -E "^[0-9]+\\." | grep -vE "^(127\\.)" | head -1)',
+        '  fi',
+        'fi',
+        'if [ -z "$PUB" ]; then',
+        '  echo "YSK_PDNS_NO_PUBLIC_IP" >&2',
+        '  exit 2',
+        'fi',
+        'echo "YSK_PDNS_LOCAL_ADDRESS=$PUB"',
+        'cat > "$DROP" <<EOF',
+        '# Managed by YSK Server — bind only public IP (avoid systemd-resolved 127.0.0.53:53 conflict)',
+        'local-address=$PUB',
+        'local-port=53',
+        'EOF',
+        'if [ -f "$CONF" ]; then',
+        '  sed -i -E "s/^[[:space:]]*local-address=.*/# &  # disabled by ysk (see pdns.d\\/ysk-local-address.conf)/" "$CONF" || true',
+        '  sed -i -E "s/^[[:space:]]*local-ipv6=.*/# &  # disabled by ysk/" "$CONF" || true',
+        'fi',
+        'if [ -f "$CONF" ] && ! grep -qE "^[[:space:]]*include-dir=" "$CONF" 2>/dev/null; then',
+        '  echo "include-dir=$CONF_DIR/pdns.d" >> "$CONF"',
+        'fi',
+        'systemctl stop pdns 2>/dev/null || true',
+        'systemctl reset-failed pdns 2>/dev/null || true',
+        'systemctl enable pdns 2>/dev/null || true',
+        'systemctl start pdns',
+        'sleep 1',
+        'systemctl is-active pdns',
+        'ss -ulnp 2>/dev/null | grep -E ":53\\s" || true',
+    ].join('\n');
+}
+/**
+ * Fix PowerDNS crash-loop: bind only public IPv4 instead of 0.0.0.0:53
+ * (conflicts with systemd-resolved on 127.0.0.53/54).
+ */
+export async function healPowerDnsListener(input) {
+    const notes = [];
+    const commandResults = [];
+    const execute = input.host.executeEnabled() && input.host.isRoot();
+    if (!execute) {
+        return {
+            ok: false,
+            notes: [tl('notes.auto.n1163'), tl('notes.dns.healNeedRoot')],
+            commandResults,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot(),
+        };
+    }
+    const envPrefix = input.localAddress?.trim()
+        ? `export YSK_PDNS_LOCAL_ADDRESS=${JSON.stringify(input.localAddress.trim())}; `
+        : '';
+    const script = configurePdnsLocalAddressShell();
+    const r = await input.host.runCommand(['bash', '-c', `${envPrefix}${script}`], { timeoutMs: 60_000 });
+    commandResults.push({
+        argv: ['bash', '-c', 'heal-pdns-local-address'],
+        exitCode: r.exitCode,
+        stderr: r.stderr,
+    });
+    const out = `${r.stdout || ''}\n${r.stderr || ''}`;
+    notes.push(...out.split('\n').map((l) => l.trim()).filter(Boolean).slice(0, 20));
+    const addrMatch = out.match(/YSK_PDNS_LOCAL_ADDRESS=([0-9.]+)/);
+    const localAddress = addrMatch?.[1];
+    if (r.exitCode !== 0) {
+        if (out.includes('YSK_PDNS_NO_PUBLIC_IP')) {
+            notes.unshift('Could not detect public IPv4 for local-address');
+        }
+        return {
+            ok: false,
+            localAddress,
+            notes,
+            commandResults,
+            requiresExecute: false,
+            requiresRoot: false,
+        };
+    }
+    // Probe listen
+    const ss = await input.host.runCommand(['bash', '-c', 'ss -ulnp 2>/dev/null | grep -E ":53\\s" || true'], { timeoutMs: 5_000 });
+    const active = await input.host.runCommand(['systemctl', 'is-active', 'pdns'], {
+        timeoutMs: 5_000,
+    });
+    const unitActive = (active.stdout || '').trim() === 'active';
+    const listenUdp53 = /:53\b/.test(ss.stdout || '');
+    notes.push(unitActive ? tl('notes.dns.pdnsUnitActive') : tl('notes.dns.pdnsUnitInactive'), listenUdp53 ? tl('notes.dns.udp53Listening') : tl('notes.dns.udp53NotListening'));
+    // After bind-address heal, re-register managed zones so dig is not REFUSED (0 domains)
+    const wantResync = Boolean(input.dataDir) &&
+        input.resyncZones !== false &&
+        unitActive &&
+        listenUdp53;
+    if (wantResync && input.dataDir) {
+        const sync = await syncPowerDnsBindZones({
+            dataDir: input.dataDir,
+            host: input.host,
+            apply: true,
+        });
+        commandResults.push(...sync.commandResults);
+        notes.push(...sync.notes
+            .filter((n) => /YSK_PDNS_|registered|named-zones|list-zones|zone "/i.test(n) || n.startsWith('  -'))
+            .slice(0, 12));
+        if (sync.ok) {
+            notes.push(tl('notes.dns.healResyncOk'));
+        }
+        else {
+            notes.push(tl('notes.dns.healResyncPartial'));
+        }
+    }
+    return {
+        ok: unitActive && listenUdp53,
+        localAddress,
+        notes,
+        commandResults,
+        requiresExecute: false,
+        requiresRoot: false,
+        unitActive,
+        listenUdp53,
+    };
+}
+/**
+ * Write PowerDNS install helper under dataDir; optional apt install when root+EXECUTE.
+ * After install, configures local-address to public IP (systemd-resolved safe).
+ * Never fakes success when install was requested but skipped/failed.
+ */
+export async function installPowerDnsPackages(input) {
+    const dir = join(input.dataDir, 'dns', 'powerdns');
+    mkdirSync(dir, { recursive: true });
+    const scriptPath = join(dir, 'install-pdns.sh');
+    const packages = ['pdns-server', 'pdns-backend-bind', 'pdns-tools'];
+    const healBody = configurePdnsLocalAddressShell();
+    writeFileSync(scriptPath, [
+        '#!/usr/bin/env bash',
+        '# YSK Server — install PowerDNS (BIND backend) for managed zone files',
+        'set -euo pipefail',
+        'export DEBIAN_FRONTEND=noninteractive',
+        'apt-get update',
+        `apt-get install -y ${packages.join(' ')}`,
+        '# Bind public IP only — 0.0.0.0:53 conflicts with systemd-resolved 127.0.0.53:53',
+        input.localAddress?.trim()
+            ? `export YSK_PDNS_LOCAL_ADDRESS=${JSON.stringify(input.localAddress.trim())}`
+            : 'true',
+        healBody,
+        'echo "PowerDNS installed — use ysk-server hosting powerdns-load --load"',
+        '',
+    ].join('\n'), 'utf8');
+    const notes = [
+        `Install helper: ${scriptPath}`,
+        `Packages: ${packages.join(', ')}`,
+        'Configures local-address to public IPv4 (avoids systemd-resolved :53 conflict)',
+        tl('notes.dns.installAfterLoad'),
+        tl('notes.dns.bindFileNotEnough'),
+    ];
+    const written = [scriptPath];
+    const commandResults = [];
+    const commands = [];
+    const want = Boolean(input.install);
+    if (want) {
+        commands.push(['apt-get', 'update']);
+        commands.push([
+            'bash',
+            '-c',
+            `DEBIAN_FRONTEND=noninteractive apt-get install -y ${packages.join(' ')}`,
+        ]);
+        // heal replaces bare enable --now
+        commands.push([
+            'bash',
+            '-c',
+            input.localAddress?.trim()
+                ? `export YSK_PDNS_LOCAL_ADDRESS=${JSON.stringify(input.localAddress.trim())}; ${configurePdnsLocalAddressShell()}`
+                : configurePdnsLocalAddressShell(),
+        ]);
+    }
+    const execute = Boolean(want && input.host.executeEnabled() && input.host.isRoot());
+    if (want && !execute) {
+        notes.push(tl('notes.auto.n1163'));
+    }
+    if (execute) {
+        for (const argv of commands) {
+            const r = await input.host.runCommand(argv, { timeoutMs: 300_000 });
+            commandResults.push({ argv, exitCode: r.exitCode, stderr: r.stderr });
+        }
+    }
+    const ranOk = commandResults.every((c) => c.exitCode === 0);
+    const probe = await probePowerDns(input.host);
+    notes.push(...probe.notes);
+    return {
+        ok: want ? execute && ranOk : true,
+        notes,
+        written,
+        commands: commands.map((c) => c.join(' ')),
+        commandResults,
+        requiresExecute: !input.host.executeEnabled(),
+        requiresRoot: !input.host.isRoot(),
+        probe,
+    };
+}
+//# sourceMappingURL=powerdns-apply.js.map