milestone 20: declarative configuration for iac

CHANGELOG.md

@@ -10,6 +10,46 @@ subject rarely does.
 
 ## [Unreleased]
 
+### Added
+
+- **Declarative configuration for IaC.** `nxdns run --config=<file>` makes the
+  file the sole source of configuration: every boot converges the database to
+  it in one transaction, preserving blocklist downloads, compiled lists and
+  client history, so an unchanged file costs zero downloads and zero writes.
+  Bare `nxdns run` keeps the database (and the web UI) in charge, exactly as
+  before. In file mode the web UI is read-only for configuration and says so;
+  runtime actions (pause, blocklist refresh, certificate reload) stay live.
+  `GET /api/settings` reports which authority governs the process.
+- `nxdns import` now refuses a file whose application would delete
+  configuration rows, names the tables and counts, and applies it only with
+  the new `--allow-delete` flag. Additive and edit-in-place imports need no
+  flag.
+
+### Changed
+
+- **Breaking: `nxdns run --config <file>` changed meaning.** It used to seed
+  the database once and then ignore the file; it now makes the file the
+  authority on every boot, which deletes any configuration the file does not
+  declare — including edits made through the web UI since the seed. Before
+  upgrading a unit that carries `--config`: either drop the flag to keep the
+  database in charge, or adopt file mode with the sequence in the upgrade
+  guide. Order matters there: export the file with the NEW binary (stopped).
+- **Breaking: 0.0.1 exports are refused by this version.** A 0.0.1
+  `nxdns export` writes both `.password = ""` and the stored
+  `.password_hash`, and this version refuses a file that carries both. This
+  bites any old export — an adoption file or a configuration backup fed to
+  `nxdns import` alike. Fix an existing export by deleting its
+  `.password = ""` line (keep the `.password_hash` line). Take fresh backups
+  with the new binary.
+- **Breaking: the offline password-change recipe changed.** Setting
+  `.password = "new"` together with `.password_hash = ""` is now refused
+  (empty `password_hash` is an explicit "disable authentication", and the two
+  fields cannot both be present). To change the password in the file: set
+  `.password` and delete the `.password_hash` line entirely.
+- `nxdns import --force` is renamed `--allow-delete`.
+- A fresh install no longer seeds from `/etc/nxdns/config.zon` by presence.
+  Use `nxdns import` once, or run in file mode with `--config`.
+
 ## [0.0.1] - 2026-08-09
 
 First release. Everything below is new.