@celilo/cli 0.13.1 → 0.13.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {

package/schemas/system_config.json

@@ -74,6 +74,22 @@
       "maximum": 4094,
       "description": "VLAN tag for internal zone (not defaulted; internal is untagged)"
     },
+    "network.secure-mgmt.subnet": {
+      "type": "string",
+      "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
+      "description": "Control-plane subnet CIDR — the network celilo-mgr itself occupies when it does not sit on the internal LAN (not defaulted — discovered at celilo-mgmt install, or recorded by firewall onboarding). Derives the firewall's trusted sources and the internal resolver's split-horizon view for celilo's own traffic."
+    },
+    "network.secure-mgmt.gateway": {
+      "type": "string",
+      "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
+      "description": "Control-plane gateway IP address (not defaulted — discovered from the default route)"
+    },
+    "network.secure-mgmt.vlan": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 4094,
+      "description": "VLAN tag for the control-plane zone (not defaulted)"
+    },
     "dns.primary": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",

package/src/cli/generate-zsh-completion.ts

@@ -355,6 +355,8 @@ _celilo_system_config_keys() {
     'network.secure.gateway:Secure gateway IP'
     'network.internal.subnet:Internal subnet'
     'network.internal.gateway:Internal gateway IP'
+    'network.secure-mgmt.subnet:Control-plane subnet (celilo-mgr own network)'
+    'network.secure-mgmt.gateway:Control-plane gateway IP'
     'dns.primary:Primary DNS server'
     'dns.fallback:Fallback DNS servers'
     'routing.internal_gateway:Internal gateway IP'

package/src/services/system-config-validator.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, it } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import type { SystemConfigProperty, SystemConfigSchema } from './system-config-schema-types';
 import { validateKey, validateValue } from './system-config-validator';
 
@@ -158,3 +160,26 @@ describe('validateKey', () => {
     expect(result.error).toContain('network.bridge');
   });
 });
+
+// The shipped schema is what `celilo system config set` validates against, and it
+// is a hand-maintained enumeration of zones. `secure-mgmt` was added to
+// NETWORK_ZONES, IPAM, zone detection and the manifest schema but NOT here, so the
+// zone existed everywhere except the one place its subnet could be RECORDED — and
+// recording it is what derives firewall trust and the resolver's split-horizon
+// view. It failed only on the live box, at `system config set`.
+describe('shipped system_config.json covers every placement zone', () => {
+  const shipped = JSON.parse(
+    readFileSync(join(import.meta.dir, '../../schemas/system_config.json'), 'utf-8'),
+  ) as SystemConfigSchema;
+
+  // `external` is deliberately absent: cloud/VPS systems carry their own
+  // addressing and celilo allocates nothing for them.
+  const ADDRESSABLE_ZONES = ['internal', 'dmz', 'app', 'secure', 'secure-mgmt'] as const;
+
+  for (const zone of ADDRESSABLE_ZONES) {
+    it(`accepts network.${zone}.subnet and .gateway`, () => {
+      expect(validateKey(`network.${zone}.subnet`, shipped).valid).toBe(true);
+      expect(validateKey(`network.${zone}.gateway`, shipped).valid).toBe(true);
+    });
+  }
+});