@celilo/cli 0.13.1 → 0.13.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {

package/schemas/system_config.json

@@ -74,6 +74,22 @@
       "maximum": 4094,
       "description": "VLAN tag for internal zone (not defaulted; internal is untagged)"
     },
+    "network.secure-mgmt.subnet": {
+      "type": "string",
+      "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
+      "description": "Control-plane subnet CIDR — the network celilo-mgr itself occupies when it does not sit on the internal LAN (not defaulted — discovered at celilo-mgmt install, or recorded by firewall onboarding). Derives the firewall's trusted sources and the internal resolver's split-horizon view for celilo's own traffic."
+    },
+    "network.secure-mgmt.gateway": {
+      "type": "string",
+      "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
+      "description": "Control-plane gateway IP address (not defaulted — discovered from the default route)"
+    },
+    "network.secure-mgmt.vlan": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 4094,
+      "description": "VLAN tag for the control-plane zone (not defaulted)"
+    },
     "dns.primary": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",

package/src/ansible/inventory.ts

@@ -6,7 +6,7 @@ import type { DbClient } from '../db/client';
 import { machines, moduleConfigs, systemConfig } from '../db/schema';
 import { getModuleSystems } from '../services/deployed-systems';
 import { parseStoredConfigValue } from '../services/module-config';
-import { getTempKeyPath } from '../services/ssh-key-manager';
+import { LOCAL_MACHINE_IP, getTempKeyPath } from '../services/ssh-key-manager';
 
 /**
  * Inventory generation result
@@ -395,7 +395,7 @@ export async function generateInventory(
 
       // Build host definition from machine. The local box (127.0.0.1)
       // uses Ansible's local connection — no SSH key/host.
-      const isLocal = machine.ipAddress === '127.0.0.1';
+      const isLocal = machine.ipAddress === LOCAL_MACHINE_IP;
       host = {
         hostname: moduleHostname || machine.hostname,
         ansibleHost: machine.ipAddress,

package/src/cli/generate-zsh-completion.ts

@@ -355,6 +355,8 @@ _celilo_system_config_keys() {
     'network.secure.gateway:Secure gateway IP'
     'network.internal.subnet:Internal subnet'
     'network.internal.gateway:Internal gateway IP'
+    'network.secure-mgmt.subnet:Control-plane subnet (celilo-mgr own network)'
+    'network.secure-mgmt.gateway:Control-plane gateway IP'
     'dns.primary:Primary DNS server'
     'dns.fallback:Fallback DNS servers'
     'routing.internal_gateway:Internal gateway IP'

package/src/services/aspect-runner.ts

@@ -51,7 +51,7 @@ import { executeAnsible } from './deploy-ansible';
 import { getContainerSystemsInZones } from './deployed-systems';
 import { getSystemsByZone } from './machine-pool';
 import { executeProxmoxReconcile, planProxmoxReconcile } from './proxmox-reconcile';
-import { writeTemporarySshKey } from './ssh-key-manager';
+import { LOCAL_MACHINE_IP, writeTemporarySshKey } from './ssh-key-manager';
 
 type DbClient = ReturnType<typeof getDb>;
 
@@ -231,7 +231,7 @@ export async function materializeAspectAnsible(args: {
     // (ansible/inventory.ts). Without this the fan-out tried `ssh root@127.0.0.1`
     // with an empty key file and the host failed UNREACHABLE with an opaque
     // "error in libcrypto", so celilo could not configure its own resolv.conf.
-    const isLocal = t.ipAddress === '127.0.0.1';
+    const isLocal = t.ipAddress === LOCAL_MACHINE_IP;
     const keyPath = t.machineId && !isLocal ? await writeTemporarySshKey(t.machineId) : undefined;
     inventoryHosts.push({
       hostname: t.hostname,

package/src/services/module-deploy.ts

@@ -40,7 +40,7 @@ import { resolveInfrastructureVariables } from './infrastructure-variable-resolv
 import { findMachineForModule } from './machine-pool';
 import { checkProxmoxReachable, formatProxmoxUnreachableError } from './proxmox-preflight';
 import { republishStaticWebConsumers } from './public-web-republish';
-import { deleteTemporarySshKey, writeTemporarySshKey } from './ssh-key-manager';
+import { LOCAL_MACHINE_IP, deleteTemporarySshKey, writeTemporarySshKey } from './ssh-key-manager';
 import { buildTerraformEnvForService } from './terraform-env';
 
 export interface DeployResult {
@@ -1129,8 +1129,20 @@ async function deployModuleImpl(
 
     let machineId: string | undefined;
     if (plan.infrastructure?.type === 'machine' && plan.infrastructure.machineId) {
-      machineId = plan.infrastructure.machineId;
-      await writeTemporarySshKey(machineId);
+      // The management box deploys to ITSELF (registered in the machine pool as
+      // 127.0.0.1) over Ansible's local connection — it has no stored SSH key,
+      // and pinning one here throws before Ansible ever runs. `inventory.ts` and
+      // `aspect-runner.ts` both already skip the key for the local box; this call
+      // site did not, so celilo-mgmt could not complete a self-deploy.
+      const machine = db
+        .select()
+        .from(machines)
+        .where(eq(machines.id, plan.infrastructure.machineId))
+        .get();
+      if (machine?.ipAddress !== LOCAL_MACHINE_IP) {
+        machineId = plan.infrastructure.machineId;
+        await writeTemporarySshKey(machineId);
+      }
     }
 
     try {

package/src/services/ssh-key-manager.test.ts

@@ -10,6 +10,7 @@ import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { addMachine } from './machine-pool';
 import {
+  LOCAL_MACHINE_IP,
   ManagedSshKey,
   cleanupTemporarySshKeys,
   deleteTemporarySshKey,
@@ -326,3 +327,16 @@ describe('ssh-key-manager', () => {
     });
   });
 });
+
+// The management box is reached over Ansible's local connection, never by
+// `ssh root@127.0.0.1`, so callers must skip key materialization for it. Three
+// call sites decide this — inventory.ts, aspect-runner.ts and module-deploy.ts —
+// and module-deploy.ts did NOT, so `celilo module deploy celilo-mgmt` threw
+// "has no SSH key stored" before Ansible ever ran and the control plane could
+// not self-deploy. The literal now lives in one place so a fourth caller finds
+// it instead of retyping it.
+describe('LOCAL_MACHINE_IP', () => {
+  it('is the loopback address the management box registers itself under', () => {
+    expect(LOCAL_MACHINE_IP).toBe('127.0.0.1');
+  });
+});

package/src/services/ssh-key-manager.ts

@@ -17,6 +17,18 @@ function getTempKeysDir(): string {
   return join(tmpdir(), 'celilo-ansible-keys');
 }
 
+/**
+ * The address the management box registers itself under in its own machine pool.
+ *
+ * celilo-mgr deploys to ITSELF, so it appears in the pool as a machine — but it
+ * has no stored SSH key and must be reached over Ansible's local connection
+ * rather than `ssh root@127.0.0.1`. Three call sites need to know this
+ * (`inventory.ts`, `aspect-runner.ts`, `module-deploy.ts`); one of them silently
+ * didn't, and celilo-mgmt could not complete a self-deploy as a result. Exported
+ * so the next caller finds it instead of retyping the literal.
+ */
+export const LOCAL_MACHINE_IP = '127.0.0.1';
+
 /**
  * Ensure the temp keys directory exists
  */

package/src/services/system-config-validator.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, it } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import type { SystemConfigProperty, SystemConfigSchema } from './system-config-schema-types';
 import { validateKey, validateValue } from './system-config-validator';
 
@@ -158,3 +160,26 @@ describe('validateKey', () => {
     expect(result.error).toContain('network.bridge');
   });
 });
+
+// The shipped schema is what `celilo system config set` validates against, and it
+// is a hand-maintained enumeration of zones. `secure-mgmt` was added to
+// NETWORK_ZONES, IPAM, zone detection and the manifest schema but NOT here, so the
+// zone existed everywhere except the one place its subnet could be RECORDED — and
+// recording it is what derives firewall trust and the resolver's split-horizon
+// view. It failed only on the live box, at `system config set`.
+describe('shipped system_config.json covers every placement zone', () => {
+  const shipped = JSON.parse(
+    readFileSync(join(import.meta.dir, '../../schemas/system_config.json'), 'utf-8'),
+  ) as SystemConfigSchema;
+
+  // `external` is deliberately absent: cloud/VPS systems carry their own
+  // addressing and celilo allocates nothing for them.
+  const ADDRESSABLE_ZONES = ['internal', 'dmz', 'app', 'secure', 'secure-mgmt'] as const;
+
+  for (const zone of ADDRESSABLE_ZONES) {
+    it(`accepts network.${zone}.subnet and .gateway`, () => {
+      expect(validateKey(`network.${zone}.subnet`, shipped).valid).toBe(true);
+      expect(validateKey(`network.${zone}.gateway`, shipped).valid).toBe(true);
+    });
+  }
+});