Classes
Class AppInitializer
Class AppManager
Controller for managing API keys
Class DocsController
Class JsonController
Answers every miss on a headless install, where there is no web interface to render a 404 page with.
Unauthenticated readiness probe reporting whether Poweradmin can reach its own dependencies. Disabled by default.
Answers every /api/v1 path with 410 Gone and a pointer to v2.
Streams a DNSSEC private key as a PEM file download. Requires PowerDNS
4.7+ which exposes the privatekey field on per-key GETs of /cryptokeys.
Imports a PEM-encoded DNSSEC private key into a zone via the PowerDNS API.
Handles reading and replacing raw PowerDNS domain metadata for a single zone.
Lists network -> view mappings (PowerDNS 5.0+) and exposes inline add/edit/remove actions. Admin-only; hidden behind the supportsViews() capability gate, which covers the version, the backend and views=yes.
Lists PowerDNS views (5.0+) and the zones they contain. Also exposes inline add/remove actions. The whole feature is admin-only and hidden when the connected server cannot serve views, whether through its version, its backend or its views setting (capability gate).
Controller for displaying PowerDNS server status
Unauthenticated liveness probe. Answers if the process can serve a request and checks nothing else, so it still reports ok while the database is down.
Admin UI for managing per-record-type default TTLs. The repository drives ReverseTtlResolver::resolveTtlForType(), so values entered here take effect for every record-creation path (UI + API).
Serves static assets like CSS, JS, images and fonts.
Manage which zones a producer zone publishes in its catalog.
Shapes an unhandled throwable into an HTTP response for the front controller.
Static helpers classifying the current request from server globals: API route detection and JSON response negotiation.
Prepares the zone-list owner and group cells: the first entries stay visible, the rest collapse into a "+N more" tooltip label.
Removes the web interface from the route collection when interface.web_enabled is false, leaving an API-only (headless) surface.
Class SymfonyRouter
Tracks the most recent PowerDNS API error so the UI can surface it.
Writes the "client_ip:.. user:.. operation:.." audit lines. Every line starts with the same actor context; one method per event keeps the field names in one place.
Builds the repositories and domain services controllers ask for, and memoizes the per-request shared instances (backend provider, permission cache). Owns the wiring so BaseController only exposes thin accessors.
The totals on the admin dashboard. Zone and record counts are null when they cannot be read, so the page still renders.
Factory for creating DNS backend provider instances.
Orchestration service for DNS data reads.
Builds a DynamicDnsRequest from the HTTP request the dyndns2 endpoint received.
Service for managing group memberships
Service for managing user groups
Resolves the interface language for the current request.
Detects and caches the connected PowerDNS server version so admins can see it in the UI and so error reports include it without a manual lookup.
The single guarded entry point for permission template writes.
Words a successful RecordAddResult for the add-record page and the zone editor.
Outcome of adding one record from a form, with the companion PTR or A record the operator asked for alongside it.
The add-record flow shared by the add-record page and the inline form on the zone editor: name and content are normalised the same way, the TTL default is resolved the same way, and the companion PTR or A record follows the same rules.
Service for managing DNS record comments.
Puts a zone-editor submission that was refused as stale back into the freshly read record listing, so the warning does not also cost the operator their edits.
Centralized factory for creating repository instances.
Validates controller request data against Symfony constraints.
In-memory sorting, filtering, and pagination for datasets.
Service for building absolute URLs
Class UserAuthenticationService
Words a refused UserManagementService write for the user forms. The service's own message is the API wording; password policy, field length and external-auth password messages are the same on both sides and pass through.
User provisioning service for external authentication providers Supports both OIDC and SAML user provisioning and linking
Service for sending zone access change notifications
Words a refused ZoneManagementService::createZone() for the add-zone forms.
Service for managing zone-group ownership
Words a refused ZoneMetadataService write for the metadata editor.
Reads the owner and group fields of the add-zone forms and applies the shared ownership rules. The forms drop what the ownership mode disallows instead of rejecting it, and word the refusals in the user's language.
Words a ZoneEditService save for the zone editor's flash message.
Words a ZoneSigningService outcome for the web pages that sign or unsign an existing zone.
Synchronizes zone metadata between the PowerDNS API and the local zones table.
Abstract class BaseController
Thrown when a referenced user group does not exist.
Class ApiKey
Immutable description of what an API key is allowed to do.
Application-wide constants
Built-in PowerDNS domain metadata kind definitions.
Class Permission
Value object representing a DNS record prepared for display Encapsulates both the raw record data and display-specific transformations
Class containing constants for DNS record types.
Class for validating and working with Top Level Domains
UserGroup domain entity
UserGroupMember domain entity
ZoneGroup domain entity
Template functions
ZoneType class represents the different types of zones in a DNS system.
Persistence for API keys: lookup by key value or owner, creation, expiry and usage tracking.
Persistence boundary for generic admin-managed settings layered above config/settings.php. Keys use dotted notation (e.g. "interface.theme") so they map cleanly onto ConfigurationManager groups during fallback.
Read-only lookups on the domains table: name and id resolution, zone type, primary server and the best-matching zone for a record name. Implemented for direct SQL and for the API backend mode.
Persistence for the dynamic DNS update endpoint: resolves the calling user, the zones they may update, and reads or replaces the A and AAAA records for one hostname.
Persistence for record comments in the Poweradmin-native comments table, including the record-to-comment links and the migration of legacy PowerDNS comments.
Reads over the records table by zone, name, id or RRset, plus the existence checks record validation relies on. Implemented for direct SQL and for the API backend mode.
Persistence boundary for admin-configured default TTLs keyed by record type.
Persistence for user group membership (user_group_members).
Persistence for user groups: lookup by id, name or member, and the member and zone counts the group list displays.
Persistence for per-user multi-factor authentication settings (user_mfa).
Persistence for per-user interface preferences stored as key-value pairs.
Persistence for user accounts, their permission template and the zones they own.
Persistence for group-based zone ownership (zones_groups), the second ownership path beside the direct owner on the zones table.
Zone reads and ownership writes over the zones and domains tables. Implemented once for direct SQL and once for the API backend mode, which reads zone state via PowerDNS.
Service for managing API keys
Permission gate for the public API. A facade over PermissionService so the API and the web UI share one oracle; only the group and visible-zone lookups query here.
Layered reader for admin-managed settings.
Catalog zone membership.
Database credential mapping service
Interface for DNS data backend operations.
Service for IDN (Internationalized Domain Name) handling
DNS Record Validation Service
Interface for DNS Record Validation Service
Validator for AAAA DNS records
AFSDB record validator
Validator for ALIAS DNS records
Validator for APL (Address Prefix List) DNS records
Validator for A DNS records
BRID (Broadcast Remote ID) record validator
Validator for opaque RDATA stored as base64 in zone-file form (PowerDNS xfrBlob).
CAA record validator
CDNSKEY record validator
CDS (Child DS) record validator
CERT record validator
Validator for CNAME DNS records
Validator for CSYNC DNS records
Parser for DNS
DHCID (Dynamic Host Configuration Identifier) record validator
Validator for DLV (DNSSEC Lookaside Validation) DNS records
DMARC record validator
DNAME record validator
DNSKEY record validator
DNS Violation Validator
Validator for DS (Delegation Signer) DNS records
Default DNS record validator for record types that don't have specific validation
Common DNS validation functions shared across record types
Interface for DNS record validators
Registry for DNS record validators
EUI48 record validator
EUI64 record validator
HHIT (HIP Hash Identity Tag) record validator
HINFO record validator
HTTPS record validator
Hostname validation service
IP address validation service
IPSECKEY record validator
KEY record validator
KX Record Validator
L32 record validator
L64 record validator
LOC record validator
LP record validator
LUA record validator
MINFO Record Validator
MR (Mail Rename) record validator
MX Record Validator
NAPTR (Naming Authority Pointer) Record Validator
NID (Node Identifier) Record Validator
NSEC3PARAM record validator
NSEC3 record validator
NSEC record validator
NS Record Validator
OPENPGPKEY record validator
Validator for PTR (Pointer) DNS records
RESINFO (Resolver Information) record validator
RKEY (Resource KEY) record validator
RP (Responsible Person) record validator
RRSIG (Resource Record Signature) record validator for DNSSEC
SMIMEA (S/MIME Certificate Association) record validator
SOA record validator
SPF record validator
SRV record validator
SSHFP (SSH Fingerprint) record validator
SVCB record validator
String validation for DNS records
TKEY (Transaction KEY) record validator
TLSA (TLS Authentication) record validator
TSIG (Transaction SIGnature) record validator
DNS TTL validation service
TXT record validator
URI (Uniform Resource Identifier) Record Validator
WALLET record validator
ZONEMD (Message Digest for DNS Zones) Record Validator
Service class for managing domains/zones
Interface for domain/zone management operations
Service class for managing DNS records
Interface for DNS record management operations
Outcome of a record write. Replaces the bool return plus MessageService side channel: callers read the reason, the HTTP status and the offending form field from here instead of the session.
Service class for managing SOA records
Interface for SOA record management operations
Service class for managing PowerDNS supermasters
Outcome of a zone write (create, delete, metadata, owner or template change).
DNSSEC operations for one zone, implemented over the PowerDNS API and as a no-op provider for installations without DNSSEC.
Service for parsing domain names into components
Helper functions for dynamic DNS updates
Turns a submitted list of group references into distinct group entities
Maps a PowerDNS Authoritative Server version string to feature capability flags used by the UI to show, hide, or default behaviour appropriately.
Service for managing user permissions
Gates perm_templ assignment on user create/update API paths.
Gates what a permission template may contain.
Service responsible for transforming DNS records for display purposes Implements the Single Responsibility Principle by focusing only on display transformations
Resolves the default TTL for new records.
Gates auth-critical fields on user self-edit API paths (#1327).
Central catalogue of $_SESSION keys.
Domain service for user management operations
Shapes raw user rows into the read format the API exposes
Simple validation result class following the Result pattern
Pure rules for what a user may change on the zone edit screens.
Service for mirroring zone ownership into the PowerDNS account field
Zone counting service
Resolves the user-owner and group-owner assignment for a new zone, applying the active zone_ownership_mode and permission rules. The API hands in its JSON body; the web forms hand in the owner and groups they already parsed.
Saves the zone editor's record table: the edit gate, the stale-form check, the per-row diff and write, the record and zone comments, and the SOA serial bump that closes a save.
One submission of the zone editor's record table, as posted.
Builds the ownership index the zone lists and the search page use to decide per-row edit/delete controls and owner-column visibility.
Service for managing DNS zones. Failures come back as
message is the API wording, the code lets the web forms word it themselves.
The zone metadata rules the editor and the API share: what a kind accepts, who may change it, what the active backend can store, and how a change is persisted and logged. Callers parse their input and word the refusals.
Blocks creating a zone that overlaps an existing zone owned by another user.
Who owns which of a page of zones, resolved once so per-row controls do not query per zone. Ownership is direct (zones.owner) or through any group the user belongs to.
Resolves the dns.zone_ownership_mode setting into ownership-side flags.
Outcome of {ZoneCreateOwnershipResolver}: either a resolved owner/group assignment for the new zone, or an error with HTTP status. The error carries a code so the web forms can word it themselves; the message is the API text.
How a zone editor save ended, with what the page needs to report it and, for a refused stale form, the rows to put back in front of the operator.
Signs and unsigns zones the one way every entry point agrees on: refuse presigned zones and invalid zones, bump the SOA serial so secondaries notice, verify what PowerDNS reports afterwards, rectify, and audit.
Validates zone template records before they are stored.
Service for managing zone template synchronization tracking
Zone Validation Service
Utility class for domain operations
Value object representing user information read from an LDAP entry
Value object representing OIDC user information
Encoded composite record identifier for API-mode records.
Value object representing SAML user information
Interface for user information from external authentication providers Supports both OIDC and SAML authentication
Read access to settings by group and key. ConfigurationManager is the production implementation; FakeConfiguration backs unit tests.
Class ConfigurationManager
Resolves the configured theme base path for on-disk checks.
Resolves which zones row a Poweradmin zone ID refers to.
DbCompat class provides compatibility methods for different database types.
PDO subclass that records executed queries for debug display.
Reusable SQL fragments that derive zone-health flags (Disabled / No SOA) from the PowerDNS records table. Used by SQL-mode repositories to render status badges in the zone list without an extra round-trip.
Minimal message-only logger used by the DNSSEC API provider. New code should take a PSR-3 LoggerInterface instead.
Sink for the PSR-3 Logger: formats a log context into a line and writes it, or drops it when logging is disabled.
PSR-3 logger that writes every message to PHP's error_log().
Resolves HTTP(S)_PROXY / NO_PROXY environment variables into stream-context options usable by PHP's HTTP wrapper. PHP's stream wrapper does not pick up these variables on its own, so each call site needs to opt in explicitly.
API-backend domain repository.
API-backend dynamic DNS repository.
API-backend record comment repository.
API-backend record repository.
Class DbApiKeyRepository
SQL-backend domain repository.
SQL-backend dynamic DNS repository.
SQL-backend record repository.
PowerDNS REST API-based DNS backend provider.
API Key Authentication Middleware
HTTP Basic Authentication Middleware
Factory for DNS services
Null Object implementation of DnssecProvider Used when PowerDNS API is not configured or DNSSEC is disabled
SQL-based DNS backend provider.
Service class for managing form state across requests
DependencyCheck class verifies the availability of required PHP extensions.
LanguageCode class is used for retrieving language names based on their codes.
Detects the HTTP protocol (http/https) from server environment.
Class ReverseDomainHierarchySorting
Class ReverseDomainNaturalSorting
Class ReverseZoneSorting
Service for safely handling and sanitizing User-Agent strings
Renders the shared page chrome (header, footer, Twig globals) around controller-rendered templates.
Class LocaleManager Manages locale settings for the application.
DNS Wizard Internal API Controller
DNS Wizard Form Controller
DNS Wizard Selection Controller
Abstract base class for DNS Record Wizards
CAA Wizard
DKIM Wizard
DMARC Wizard
SPF Wizard
SRV Wizard
TLSA Wizard
DNS Wizard Registry
Interface for Poweradmin modules.
Module Registry
Imports a zone from a live primary by creating a secondary, triggering an AXFR pull, and offering a one-click conversion to a primary zone once the records have transferred. API-backend only (see the module class).
Imports a zone from a live primary server by creating a secondary zone, pulling it over AXFR, and converting it to a primary once the data lands.
Generates standard BIND zone files from DNS records.
BIND zone file parser.
Class Pages
Class Version