Deploy: read cluster objects, drop the zones and RPZ ConfigMaps

DO NOT SYNC THIS BEFORE MIGRATING. Removing fancy-dns-zones and fancy-dns-rpz
from the kustomization lets a pruning GitOps tool delete them, and they hold the
only copy of the zones and address redirects until the objects exist. Follow
deploy/MIGRATION.md: install the definitions, run `fancy-dns-console migrate`
against the live cluster, then roll this out.

The StatefulSet starts the resolver with -kube and no longer mounts the two
ConfigMaps; its service account loses the ConfigMap role and keeps only the
read-only Role on the fancy-dns objects (crds/rbac.yaml). The kustomization now
installs the definitions and that Role. The shipped config no longer lists the
migrated sources.

Config validation no longer refuses an enabled blocklist with no sources in the
file, because BlockList, DomainRule and AddressOverride objects can supply every
rule and the file cannot know. The existing "no source" warning says so. That
removed the only validation message the settings tests used as a fixture; they
now use an invalid acl.default_policy, and an empty settings document is refused
by the handler instead of by that check.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/api/handlers.go

@@ -578,6 +578,9 @@ func (s *Server) Commit(next *config.Config) error { return s.commit(next) }
 // parseConfigYAML decodes a config document on top of the defaults, which is
 // what makes a partial document from the UI editor work.
 func parseConfigYAML(text string) (*config.Config, error) {
+	if strings.TrimSpace(text) == "" {
+		return nil, errors.New("the document is empty")
+	}
 	next := config.Default()
 	if err := yaml.Unmarshal([]byte(text), next); err != nil {
 		return nil, err
@@ -640,7 +643,7 @@ func configWarnings(cfg *config.Config) []string {
 		add("blocklist.enabled: blocklists are off, so this instance is an open resolver for everything")
 	} else if len(cfg.Block.Lists) == 0 && len(cfg.Block.LocalZones) == 0 &&
 		len(cfg.Block.BlockEntries) == 0 {
-		add("blocklist: enabled but no source is configured")
+		add("blocklist: enabled but this config names no source (fine if BlockList or DomainRule objects supply it)")
 	}
 	for _, l := range cfg.Block.Lists {
 		if strings.HasPrefix(l.URL, "http://") {

internal/api/settings_test.go

@@ -146,7 +146,7 @@ func TestSettingsPutRejects(t *testing.T) {
 		{"broken yaml", `{"config_yaml": "api: [\n"}`, "cannot parse config"},
 		{
 			"invalid config",
-			`{"config_yaml": "blocklist:\n  enabled: true\n  lists: []\n"}`,
+			`{"config_yaml": "acl:\n  default_policy: maybe\n"}`,
 			"invalid config",
 		},
 	}
@@ -261,11 +261,9 @@ func TestSettingsValidate(t *testing.T) {
 	})
 
 	t.Run("empty document is not valid", func(t *testing.T) {
-		// Not the obvious answer, and worth pinning: an empty document
-		// decodes onto config.Default, and the shipped defaults enable the
-		// blocklist without a single source, so Validate rejects them. The
-		// UI therefore cannot be used to "reset to nothing"; a reset to
-		// defaults has to send a real default document.
+		// An empty document would decode onto the defaults and be valid, so the
+		// editor could be used to wipe the config by accident. It is refused
+		// outright; a reset to defaults has to send a real default document.
 		res := h.do(http.MethodPost, "/api/settings/validate", `{"config_yaml": ""}`, "X-API-Key: rw-key")
 		if res.status != http.StatusOK {
 			t.Fatalf("validate = %d, want 200: %s", res.status, res.body)
@@ -297,7 +295,7 @@ func TestSettingsValidate(t *testing.T) {
 
 	t.Run("invalid config", func(t *testing.T) {
 		res := h.do(http.MethodPost, "/api/settings/validate",
-			`{"config_yaml": "blocklist:\n  enabled: true\n  lists: []\n"}`, "X-API-Key: rw-key")
+			`{"config_yaml": "acl:\n  default_policy: maybe\n"}`, "X-API-Key: rw-key")
 		if res.status != http.StatusOK {
 			t.Fatalf("validate = %d, want 200: %s", res.status, res.body)
 		}
@@ -316,8 +314,8 @@ func TestSettingsValidate(t *testing.T) {
 			msg, _ := m["message"].(string)
 			joined += msg + "\n"
 		}
-		if !strings.Contains(joined, "blocklist is enabled but no lists") {
-			t.Errorf("errors = %q, want the blocklist complaint", joined)
+		if !strings.Contains(joined, "acl.default_policy must be") {
+			t.Errorf("errors = %q, want the default_policy complaint", joined)
 		}
 		// fieldOf falls back to "config" for a message with no dotted path,
 		// which is what this one is. Pinned so the editor's field highlighting

internal/config/config.go

@@ -1152,12 +1152,10 @@ func (c *Config) Validate() error {
 			add("blocklist.lists[%d] %q: refresh must not be negative", i, l.Name)
 		}
 	}
-	if c.Block.Enabled {
-		if len(c.Block.Lists) == 0 && len(c.Block.LocalZones) == 0 &&
-			len(c.Block.BlockEntries) == 0 && len(c.Block.AllowEntries) == 0 {
-			add("blocklist is enabled but no lists, local_zones or inline entries are configured")
-		}
-	}
+	// An enabled blocklist with nothing configured is not an error: BlockList,
+	// DomainRule and AddressOverride objects can supply every rule, and the
+	// config file cannot know about them. configWarnings says so for a
+	// standalone config.
 
 	switch c.ACL.DefaultPolicy {
 	case "allow", "deny", "block_only":