@celilo/cli 0.14.2 → 0.15.0

package/src/templates/generator.ts

@@ -248,12 +248,51 @@ export function targetNodeFromTfState(state: {
 }
 
 /**
- * Read the node a module's container is currently deployed on, from its terraform
- * state file. This is celilo's authoritative record of placement (ISS-0090).
- * Returns null when no state exists yet (a first deploy) or it can't be read —
- * the caller then falls back to the service `default_target_node`.
+ * The storage an existing container's root disk actually lives on, from
+ * terraform state. Prefers the LXC `rootfs.storage` attribute, falls back to the
+ * `<storage>:vm-<vmid>-disk-0` volume prefix, then to a VM's data `disk` block.
+ * Returns null when there's no such resource (e.g. an empty/fresh state).
  */
-async function readDeployedTargetNode(moduleId: string): Promise<string | null> {
+export function storageFromTfState(state: {
+  resources?: Array<{
+    type?: string;
+    instances?: Array<{
+      attributes?: {
+        rootfs?:
+          | Array<{ storage?: string; volume?: string }>
+          | { storage?: string; volume?: string };
+        disk?: Array<{ storage?: string; type?: string }>;
+      };
+    }>;
+  }>;
+}): string | null {
+  const guest = state.resources?.find(
+    (r) => r.type === 'proxmox_lxc' || r.type === 'proxmox_vm_qemu',
+  );
+  const attrs = guest?.instances?.[0]?.attributes;
+  if (!attrs) {
+    return null;
+  }
+  // The provider models `rootfs` as a single-element block list; older state
+  // shapes record it as a bare object.
+  const rootfs = Array.isArray(attrs.rootfs) ? attrs.rootfs[0] : attrs.rootfs;
+  if (rootfs?.storage) {
+    return rootfs.storage;
+  }
+  // volume format: "<storage>:vm-<vmid>-disk-0"
+  const volumeStorage = rootfs?.volume?.split(':')[0];
+  if (volumeStorage) {
+    return volumeStorage;
+  }
+  // VMs: the data disk carries the storage that matters (the cloudinit disk
+  // rides on the same storage — see the `disk` block ordering note in the
+  // vm templates).
+  const disks = attrs.disk ?? [];
+  return (disks.find((d) => d.type === 'disk') ?? disks[0])?.storage || null;
+}
+
+/** Parse a module's terraform state, or null when absent/unreadable. */
+async function readTfState(moduleId: string): Promise<Record<string, unknown> | null> {
   const statePath = join(
     getModuleStoragePath(),
     moduleId,
@@ -265,12 +304,33 @@ async function readDeployedTargetNode(moduleId: string): Promise<string | null>
     return null;
   }
   try {
-    return targetNodeFromTfState(JSON.parse(await readFile(statePath, 'utf-8')));
+    return JSON.parse(await readFile(statePath, 'utf-8'));
   } catch {
     return null;
   }
 }
 
+/**
+ * Read the node a module's container is currently deployed on, from its terraform
+ * state file. This is celilo's authoritative record of placement (ISS-0090).
+ * Returns null when no state exists yet (a first deploy) or it can't be read —
+ * the caller then falls back to the service `default_target_node`.
+ */
+async function readDeployedTargetNode(moduleId: string): Promise<string | null> {
+  const state = await readTfState(moduleId);
+  return state ? targetNodeFromTfState(state) : null;
+}
+
+/**
+ * Read the storage a module's container is currently deployed on, from its
+ * terraform state file. Returns null on a first deploy — the caller then falls
+ * back to the service default storage.
+ */
+async function readDeployedStorage(moduleId: string): Promise<string | null> {
+  const state = await readTfState(moduleId);
+  return state ? storageFromTfState(state) : null;
+}
+
 /**
  * The node a module's container ACTUALLY lives on, from Proxmox (ISS-0090).
  * Proxmox is the ultimate source of truth for current location — it sees a
@@ -314,6 +374,27 @@ export function decideTargetNode(opts: {
   return { node: opts.defaultNode, source: 'default' };
 }
 
+/**
+ * Decide which storage to target for a deploy. Pure (Rule 10). The sibling of
+ * `decideTargetNode`: the service's `storage` governs only a FIRST placement.
+ * A container already living on `local-lvm` must keep living there when the
+ * service default later changes to `datacenter` — emitting the new default
+ * makes terraform plan a destroy-and-recreate ("forces replacement") of a
+ * running container and lose its volume. Relocating storage is a deliberate
+ * migration, never a side effect of a default drifting.
+ *
+ * ponytail: terraform state only, no Proxmox-reality tier like decideTargetNode
+ * has. A hand `pct move-volume` is invisible until the next apply refreshes
+ * state; add a Proxmox read if that ever bites.
+ */
+export function decideStorage(opts: {
+  stateStorage: string | null;
+  defaultStorage: string;
+}): { storage: string; source: 'state' | 'default' } {
+  if (opts.stateStorage) return { storage: opts.stateStorage, source: 'state' };
+  return { storage: opts.defaultStorage, source: 'default' };
+}
+
 /**
  * Discover template files in directory recursively
  *
@@ -784,6 +865,7 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
   // Resolved live each generate (ISS-0090) and injected into the context below,
   // never cached in the DB. undefined for non-Proxmox / machine deploys.
   let resolvedTargetNode: string | undefined;
+  let resolvedStorage: string | undefined;
   if (isContainerService && isProxmoxService && infrastructureSelection?.serviceId) {
     const service = await db
       .select()
@@ -824,11 +906,24 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
         );
       }
 
-      // Persist only the non-drift provider values. target_node is reality — it's
-      // injected into the resolution context below, never cached (ISS-0090); drop
-      // any stale __infra_target_node a prior generate left behind.
+      // Storage is sticky for the same reason placement is: the service default
+      // governs only a FIRST create. Emitting a changed default at an existing
+      // container makes terraform plan a destroy-and-recreate.
+      const storageDecision = decideStorage({
+        stateStorage: await readDeployedStorage(moduleId),
+        defaultStorage: providerConfig.storage,
+      });
+      resolvedStorage = storageDecision.storage;
+      if (storageDecision.source === 'state' && resolvedStorage !== providerConfig.storage) {
+        log.info(
+          `${moduleId} → storage '${resolvedStorage}' (from terraform state; service default is '${providerConfig.storage}'). Moving storage requires a deliberate migration.`,
+        );
+      }
+
+      // Persist only the non-drift provider values. target_node and storage are
+      // reality — they're injected into the resolution context below, never
+      // cached (ISS-0090); drop any stale __infra_* rows a prior generate left.
       upsertModuleConfig(db, moduleId, '__infra_lxc_template', providerConfig.lxc_template);
-      upsertModuleConfig(db, moduleId, '__infra_storage', providerConfig.storage);
       // vm_template is only present once a VM template exists for the service.
       // Persist it when set so `type: vm` modules can resolve $self:vm_template;
       // a `type: vm` deploy against a service without one then fails loudly at
@@ -837,8 +932,12 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
         upsertModuleConfig(db, moduleId, '__infra_vm_template', providerConfig.vm_template);
       }
       deleteModuleConfig(db, moduleId, '__infra_target_node');
+      deleteModuleConfig(db, moduleId, '__infra_storage');
 
-      log.success(`Infrastructure resolved: target_node=${decision.node} (${decision.source})`);
+      log.success(
+        `Infrastructure resolved: target_node=${decision.node} (${decision.source}), ` +
+          `storage=${storageDecision.storage} (${storageDecision.source})`,
+      );
     }
   }
 
@@ -870,15 +969,19 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
       context.selfConfig.target_ip = ipConfig.value!;
     }
 
-    // target_node is the live-resolved reality (ISS-0090) — inject it directly,
-    // never from a cached __infra_target_node row (which drifts).
+    // target_node and storage are the live-resolved reality of an existing
+    // container (ISS-0090) — inject them directly, never from a cached
+    // __infra_* row (which drifts against the service default).
     if (resolvedTargetNode) {
       context.selfConfig.target_node = resolvedTargetNode;
     }
+    if (resolvedStorage) {
+      context.selfConfig.storage = resolvedStorage;
+    }
 
-    // lxc_template / storage are provider config (intent, not drift-prone) — read
-    // them back from the __infra_* rows persisted above.
-    const infraKeys = ['lxc_template', 'storage', 'vm_template'];
+    // lxc_template / vm_template are provider config (intent, not drift-prone) —
+    // read them back from the __infra_* rows persisted above.
+    const infraKeys = ['lxc_template', 'vm_template'];
     for (const key of infraKeys) {
       const infraConfig = db
         .select()