v1.0.1 — Enterprise BIND 9 Authoritative DNS Manager

PHP-BindManager v1.0.1 — Enterprise BIND 9 Authoritative DNS Manager

PHP-BindManager v1.0.1 is a major feature completion, production hardening, and quality assurance release. This release brings full Roadmap v1.2.0 capabilities—including pure RFC 6238 Two-Factor Authentication (2FA TOTP), Zone Templates, Zone History & Diff Rollback, Bulk DNS Record Operations, Webhook Event Notifications, Split-Horizon DNS Views, DNSSEC Key Management, complete linter eradication, and hardened cross-device mobile viewports.

---

🌟 Key Highlights & Architecture

• Two-Factor Authentication (2FA TOTP RFC 6238): Pure, zero-dependency RFC 6238 implementation with Base32 decoding, HMAC-SHA1 verification, constant-time validation, and mobile authenticator provisioning URIs (/profile/totp). Compatible with Google Authenticator, Authy, Microsoft Authenticator, and 1Password.
• Zone Templates Library: Preconfigured DNS profiles for standard web applications, corporate mail clusters, and CDN infrastructure with 1-click full-zone provisioning (/templates).
• Zone Revision History & Visual Diff Rollback: Automated snapshots and manual revision checkpoints (/zones/{id}/history) with side-by-side record diffing and 1-click instantaneous rollback.
• Bulk DNS Record Operations: Mass record deletion and unified TTL batch updates (/records/bulk) across multiple DNS records simultaneously.
• Webhook Dispatch System: Real-time HTTP POST notifications on zone and record lifecycle events (/system/webhooks) with HMAC-SHA256 signature verification and delivery tracking.
• Split-Horizon DNS Views & Named ACLs: Multi-view query routing powered by BIND9 match-clients rules (/views) and reusable CIDR access control lists (/acls).
• DNSSEC Key Management Lifecycle: Cryptographic key pair generation (/dnssec) supporting KSK, ZSK, and CSK roles, modern algorithms (ECDSA P-256, Ed25519, RSA-SHA256), automated key tag calculation, and retirement workflows.
• System Backups & Live Snapshots: Dedicated web UI and CLI utility (bin/backup.php, /system/backups) for creating, verifying (SHA-256 integrity check), and restoring atomic SQLite WAL database backups.
• Activity Log & Audit Trail Viewer: Granular system audit logging (/system/activity) and compliance-grade diff tracking (/system/audit-logs) with expandable before/after JSON state inspection.
• Granular Scoped API Tokens: Bearer token generator (/system/tokens) supporting custom expiration dates, granular permission scopes, SHA-256 hashing, one-time reveal, and instant revocation.
• HyperOS & MIUI Mobile Viewport Hardening: Engineered for compact viewports and dynamic mobile browser chrome (Xiaomi Redmi, POCO, iPhone dynamic island) using 100svh/100dvh, safe-area-inset padding, and min-width: 0 flex/grid constraints to prevent clipping and horizontal scrolling.
• 100% Quality & Static Analysis Compliance: Zero errors across PHPStan (Level 8), Psalm (Level 4), PHP_CodeSniffer (PSR-12), PHP-CS-Fixer, GitHub Code Scanning, SonarLint, and Trunk linter suites. All 38 PHPUnit tests passing with 112 assertions.

---

🚀 What's Included in v1.0.1

• Enterprise DNS & Operations:
  • Split-Horizon DNS Views (/views) with client matching rules.
  • Named Access Control Lists (/acls) for network restriction.
  • DNSSEC cryptographic key generation & zone signing workflows (/dnssec).
  • Zone Templates system with 1-click zone generation (/templates).
  • Zone snapshot history, visual diff comparison, and rollback engine (/zones/{id}/history).
  • Bulk record operations for batch TTL updates and mass deletions (/records/bulk).
• Security & Identity:
  • Two-Factor Authentication (TOTP RFC 6238) with recovery workflows.
  • LDAP SSO service integration abstraction (LdapAuthService).
  • Webhook dispatch engine with HMAC-SHA256 payload signing (/system/webhooks).
  • Scoped API tokens with expiration and instant revocation (/system/tokens).
  • Zero-vulnerability status across GitHub Code Scanning and SonarLint security checks.
• Reliability & System Administration:
  • Live SQLite WAL backup and restoration system (/system/backups & bin/backup.php).
  • Activity log viewer with category filters (auth, zone, record, system, api, backup).
  • Detailed audit logs with side-by-side JSON diffs.
  • Cross-OS support normalized across Debian/Ubuntu, RHEL, CentOS, AlmaLinux, and Rocky Linux.
• Codebase & Architecture Refinements:
  • Modular service registration in App\Application (registerCoreServices, registerAuthServices, registerDnsServices, registerSystemServices).
  • Clean PSR-17 response handling across all middleware and routes.
  • Upgraded GitHub Actions CI/CD workflows to latest verified runner releases and commit SHAs.

---

📦 Quick Start & Installation

# 1. Clone repository
git clone https://github.com/alsyundawy/PHP-BindManager.git
cd PHP-BindManager

# 2. Checkout v1.0.1 release tag
git checkout v1.0.1

# 3. Install dependencies
composer install --no-dev --optimize-autoloader



# 4. Environment configuration
cp .env.example .env

# 5. Database setup & migrations
php bin/migrate.php
php bin/seed.php

# 6. Run Web Server
php -S 0.0.0.0:8000 -t Public

For complete deployment guides with BIND 9, Apache, Nginx, and Caddy, see INSTALL.md and TUTORIAL.md.

Full Changelog: v1.0.0...v1.0.1

v1.0.0 — Enterprise BIND 9 Authoritative DNS Manager

PHP-BindManager v1.0.0 — Enterprise BIND 9 Authoritative DNS Manager

PHP-BindManager is an enterprise-grade, high-performance web operations platform designed specifically for managing BIND 9 Authoritative DNS servers. Built with modern PHP 8.1–8.5, an authoritative-only architecture, zero-CDN local assets, and a modern responsive dashboard.

---

🌟 Key Highlights & Architecture

• Authoritative DNS Focus: Purpose-built for Primary (Master) and Secondary (Slave) BIND 9 nameserver environments. Recursive bloat and RPZ attack surfaces are intentionally excluded to deliver maximum performance, isolation, and security.
• Zero-CDN Architecture: 100% self-contained frontend asset bundle (Bootstrap 3.5.8, jQuery 3.7.1, Font Awesome 6.7.2) located in Public/assets/vendor/. Operates completely air-gapped without external tracking, latency, or supply-chain CDN compromise.
• Visual Subnet Inspired UI / UX: Modern, sleek web interface featuring glassmorphic navigation, real-time KPI metrics, dark/light theme switching (data-theme & data-bs-theme), and responsive data tables.
• Cross-Device & Mobile Viewport Engineering: Fully optimized for diverse screen sizes from compact mobile viewports (Xiaomi Redmi, Poco MIUI viewport quirks, iPhone dynamic island & safe areas) using 100dvh and safe-area insets, up to 2K/4K ultra-wide workstations.
• Hardened Security Framework:
  • Argon2id password hashing with modern entropy parameters.
  • CSRF token validation on all state-changing endpoints.
  • Session hijacking defense with strict cookie parameters (secure, httponly, samesite=lax).
  • Native IP & account rate-limiting to prevent brute-force attacks.
  • Hardened HTTP security headers: Strict Content-Security-Policy (CSP), HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
• High-Performance Storage: SQLite 3 database engine running in Write-Ahead Logging (WAL) mode (PRAGMA journal_mode=WAL;, PRAGMA synchronous=NORMAL;), providing concurrent reads and atomic writes without database lock contention.
• Automated Zone Verification: Native integration with named-checkzone ensures zero-downtime zone updates; faulty zones are prevented from deployment before triggering rndc reload.
• RESTful API v1: Complete programmatic DNS provisioning with Bearer token authentication and OpenAPI 3.1 specifications.
• 100% Quality & Static Analysis Compliance: Zero errors across PHPStan (Level 8), Psalm (Level 4), PHP_CodeSniffer (PSR-12), PHP-CS-Fixer, and full PHPUnit test suite.

---

🚀 What's Included in v1.0.0

• Zone Operations:
  • Full CRUD for Forward and Reverse DNS zones (in-addr.arpa and ip6.arpa).
  • Serial auto-incrementing algorithms (date-based YYYYMMDDnn and incremental integer).
  • Zone file generation matching strict RFC standard syntax.
• Record Management:
  • Comprehensive record type support: A, AAAA, CNAME, MX, NS, TXT, PTR, SRV, CAA, SOA.
• System Monitoring:
  • Real-time BIND 9 daemon status probe (named / rndc / systemd / process table).
  • Storage and WAL database health metrics.
• Zero External Calls:
  • All web fonts, stylesheets, and scripts are served directly from the local web server.

---

📦 Quick Start & Installation

# 1. Clone repository
git clone https://github.com/alsyundawy/PHP-BindManager.git
cd PHP-BindManager

# 2. Install dependencies
composer install --no-dev --optimize-autoloader

# 3. Environment configuration
cp .env.example .env

# 4. Database setup & initial seed
php bin/migrate.php
php bin/seed.php

# 5. Run Web Server
php -S 0.0.0.0:8000 -t Public

For complete deployment guides with BIND 9, Apache, Nginx, and Caddy, see INSTALL.md and TUTORIAL.md.