Poweradmin Files

Know what happened, and decide who can do what. 4.5.0 records the before and after of every record change, lets API keys be narrower than their owners, and adds eleven permissions for rights that used to need superuser. API v1 is removed.

⚠️ Before upgrading: back up your database, run the 4.5.0 migration for your database type, move integrations from /api/v1 to /api/v2, and read Upgrading below.

✨ What's new

• Record change log - every record and zone change is stored with a before and after snapshot. Bulk edits are grouped with an optional reason (logging.require_change_comment makes it mandatory).
• Granular API keys - read-only, limited to some operations, or scoped to specific zones. Existing keys stay unrestricted.
• Eleven new permissions - DNSSEC keys for owned zones, the activity logs, metadata and owner views, delegation NS records below the apex, and the server status page.
• Serial policy - SOA-EDIT and SOA-EDIT-API per zone, and [UNIXTIME], [COUNTER], [SERIAL] in zone templates.
• Secondary zone import over AXFR, with conversion to a primary zone.
• LDAP - user info synced on login (ldap.sync_user_info), users created on first login (ldap.auto_provision), and groups mapped to permission templates.
• Default TTL per record type.
• API v2 - DNSSEC endpoints, a dynamic DNS endpoint, and templates and groups on user objects.
• Health and ping endpoints for monitoring, off by default, with an optional token and result cache.
• Headless mode - interface.web_enabled = false serves the API only.
• IDN zones - one IDN entry in the letter filter and the punycode name shown next to the Unicode one (#1735).
• Interface - full-width layout, hideable zone list columns, page sizes from 5 to 500, record types HHIT, BRID, RESINFO and WALLET, and 15 new locales.

🐳 Docker

• The container waits for the database before it sets up the schema (DB_WAIT_TIMEOUT, default 30 seconds).
• The health probe can require a token (PA_HEALTH_TOKEN, sent as the X-Health-Token header) and cache its result (PA_HEALTH_CACHE_SECONDS, default 0). With a token, use a shell-form healthcheck, see DOCKER.md (github.com).

🐛 Fixes

Includes every fix from 4.4.1 and 4.4.2, plus:

• Sign-in - MFA is no longer asked again right after setup (#1737), and the login page no longer loops between / and /login.
• Sessions follow interface.session_timeout and no longer end early.
• User preferences equal to the site default are no longer stored, so settings.php keeps applying (#1739).
• Zone search paging no longer repeats zones, and filters and sorting are kept.
• API backend mode - the zone list reports the canonical zone id (#1559), and parallel zone creation no longer fails (#1710).
• Logging - an unknown logging.level falls back to info instead of silencing almost everything.
• New users can't be given a permission template with rights their creator doesn't have.
• Record comments are copied to the matching A or PTR record only in zones the user can edit.
• Dynamic DNS returns a normal error instead of a server error when the IP is sent in an unexpected format.
• Username rename compares names as plain text when checking for duplicates.
• Zone type labels stay Primary/Secondary after the cached PowerDNS version expires.

📦 Upgrading

• Migration - sql/poweradmin-{mysql,pgsql,sqlite}-update-to-4.5.0.sql. Keep your config/settings.php.
• API v1 is removed. /api/v1/* answers 410 Gone. Stay on 4.4.x if you still need it.
• DNSSEC keys and zone logs need the new permissions, which the upgrade does not grant. The upgrade guide has SQL to restore the old access.
• OIDC and SAML need interface.application_url, set to the public URL registered with your identity provider.
• Identity providers no longer grant administrator rights unless allow_superuser_provisioning is true for that provider.
• Lua metadata can only be set by administrators.
• Password reset links issued before the upgrade stop working.
• Session key - if security.session_key came from the web installer, replace it with openssl rand -hex 32. Docker installs need no action.
• Account lockout, when enabled, also counts the DDNS endpoint and Basic auth on the API.
• API backend mode - zone ids migrated from SQL mode change once to the canonical id, so update stored ids (for example Terraform state).
• PHP 8.2+. On PowerDNS 5.1.x with the API backend, see the README known issue about backslash escaping (PowerDNS issue 18159).

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.4.0...v4.5.0