@celilo/cli 0.5.0-alpha.0 → 0.5.0-alpha.10

package/src/templates/generator.ts

@@ -5,7 +5,9 @@ import { dirname, join, relative } from 'node:path';
 import { and, eq } from 'drizzle-orm';
 import { generateInventory } from '../ansible/inventory';
 import { generateAnsibleSecrets } from '../ansible/secrets';
+import { ProxmoxClient, type ProxmoxCredentials } from '../api-clients/proxmox';
 import { log } from '../cli/prompts';
+import { getModuleStoragePath } from '../config/paths';
 import { type DbClient, getDb } from '../db/client';
 import {
   capabilities,
@@ -18,8 +20,14 @@ import {
 import { getSingularSystemSpec } from '../manifest/schema';
 import type { AnsibleCollection, ModuleManifest } from '../manifest/schema';
 import { validateZoneRequirements } from '../manifest/validate';
+import { getServiceCredentials } from '../services/container-service';
+import { getModuleSystems } from '../services/deployed-systems';
+import {
+  describeCapabilityProblem,
+  findBrokenCapabilityDerivations,
+} from '../services/fleet-checks';
 import { selectInfrastructure } from '../services/infrastructure-selector';
-import { upsertModuleConfig } from '../services/module-config';
+import { deleteModuleConfig, upsertModuleConfig } from '../services/module-config';
 import type { InfrastructureSelection } from '../types/infrastructure';
 import { convertSecretsToJinja } from '../variables/ansible-resolver';
 import { buildResolutionContext } from '../variables/context';
@@ -128,79 +136,177 @@ export function getOutputFilename(templateFilename: string): string {
 }
 
 /**
- * Inject framework-owned DNS-at-birth into every `proxmox_lxc` resource.
+ * Inject framework-owned DNS-at-birth into every Proxmox compute resource —
+ * `proxmox_lxc` and `proxmox_vm_qemu`.
  *
- * An LXC's nameserver is infrastructure celilo owns — like vmid, target_ip, and
+ * A node's nameserver is infrastructure celilo owns — like vmid, target_ip, and
  * inventory — not something a module author hand-writes. Authors declare zero
- * DNS terraform; this stamps it onto each `proxmox_lxc` block at generate time.
- * For every block it emits:
+ * DNS terraform; this stamps it onto each Proxmox resource block at generate
+ * time. For every block it emits:
  *
  *   - `nameserver = "$self:lxc_nameserver"` — only when a nameserver is
- *     computable (`hasNameserver`). The first LXC, deployed before any
- *     `dns_internal` provider exists, has no value: it inherits the Proxmox
- *     node default and the `dns-client-config` aspect repairs resolv.conf
- *     post-deploy.
- *   - `lifecycle { ignore_changes = [nameserver] }` — always. Existing LXCs
- *     were born without a nameserver, so setting one is an in-place UPDATE the
- *     terraform-safety guard (create-only, see terraform-safety.ts) rejects.
- *     `ignore_changes` makes nameserver birth-only: terraform sets it at create
- *     and never diffs it again, so the guard never trips on a redeploy. The
- *     aspect owns the live resolv.conf from then on (terraform = birth DNS,
- *     aspect = ongoing DNS). See v2/LXC_INTERNAL_DNS.md.
+ *     computable (`hasNameserver`). The attribute is `nameserver` for both an
+ *     LXC and a cloud-init VM. The first system, deployed before any
+ *     `dns_internal` provider exists, has no value: it inherits the node default
+ *     and the `dns-client-config` aspect repairs resolv.conf post-deploy.
+ *   - `lifecycle { ignore_changes = [...] }` — always. The list is the
+ *     resource's create-time / ForceNew attributes, so an unchanged redeploy is
+ *     a no-op and a real change an in-place UPDATE — never the destructive
+ *     REPLACE the terraform-safety guard (create-only, see terraform-safety.ts)
+ *     rejects. terraform = birth DNS, the `dns-client-config` aspect = ongoing
+ *     DNS. The per-type lists are in the callback. See v2/LXC_INTERNAL_DNS.md.
  *
  * Anchored on the resource's opening line — it never brace-matches the nested
- * rootfs/network/features blocks, so it's robust to attribute order/formatting.
+ * disk/network/features blocks, so it's robust to attribute order/formatting.
  * Idempotent at file granularity: a `.tf` that already declares
- * `ignore_changes = [nameserver]` (re-run, or an author who opted in) is
- * returned untouched.
+ * `ignore_changes = [nameserver` (re-run, or an author who opted in) is returned
+ * untouched.
  *
  * Policy function (Rule 10.1) - pure string transformation, no I/O.
  *
  * @param content - Raw terraform template content (pre variable-resolution)
  * @param hasNameserver - Whether `$self:lxc_nameserver` resolves to a value
- * @returns Content with DNS injected into each proxmox_lxc resource
+ * @returns Content with DNS injected into each Proxmox compute resource
  */
-export function injectProxmoxLxcDns(content: string, hasNameserver: boolean): string {
+export function injectProxmoxDns(content: string, hasNameserver: boolean): string {
   // Already injected (idempotent) or author opted into the lifecycle — done.
-  // Match the `[nameserver` prefix (no closing bracket) so this stays true
-  // whether the list is the original `[nameserver]` or the ISS-0055-extended
-  // `[nameserver, network[0].hwaddr, …]` — otherwise re-generate double-injects.
+  // Match the `[nameserver` prefix (no closing bracket) so this stays true for
+  // both the LXC and the VM variant — otherwise re-generate double-injects.
   if (content.includes('ignore_changes = [nameserver')) {
     return content;
   }
 
   // A template that still carries a `nameserver = …` attribute — a stale copied
-  // module from before the per-template lines were reverted, or an author who
-  // set it by hand — already supplies the value. Injecting a second `nameserver`
-  // is a terraform "Attribute redefined" error. So skip the value line when one
-  // exists and just add the lifecycle guard (the load-bearing part). Both cases
-  // converge on exactly one nameserver + ignore_changes.
+  // module, or an author who set it by hand — already supplies the value.
+  // Injecting a second `nameserver` is a terraform "Attribute redefined" error.
+  // So skip the value line when one exists and just add the lifecycle guard.
   const alreadyHasNameserver = /^[ \t]*nameserver[ \t]*=/m.test(content);
 
-  const openLineRe = /^([ \t]*)resource\s+"proxmox_lxc"\s+"[^"]+"\s*\{[ \t]*$/gm;
-  return content.replace(openLineRe, (openLine, indent: string) => {
+  const openLineRe = /^([ \t]*)resource\s+"(proxmox_lxc|proxmox_vm_qemu)"\s+"[^"]+"\s*\{[ \t]*$/gm;
+  return content.replace(openLineRe, (openLine, indent: string, resourceType: string) => {
     const inner = `${indent}  `;
     const injected = [openLine];
     if (hasNameserver && !alreadyHasNameserver) {
       injected.push(`${inner}nameserver = "$self:lxc_nameserver"`);
     }
     injected.push(`${inner}lifecycle {`);
-    // ISS-0055: ignore the ForceNew attributes Proxmox assigns at create time —
-    // the MAC (network hwaddr) and the rootfs volume path. telmate marks these
-    // ForceNew, so leaving them out of the config makes every re-deploy plan a
-    // destructive REPLACE. Ignoring just these two makes an unchanged re-deploy a
-    // no-op (the computed network id/type stay stable once the block is no longer
-    // being replaced) and a real change (e.g. a memory bump) an in-place UPDATE.
-    // We deliberately do NOT list network[0].id / network[0].type — they aren't
-    // schema attributes in telmate ~>2.9 and `terraform validate` rejects them.
-    // `nameserver` stays for the original DNS reason; `rootfs.size` is NOT ignored
-    // so a disk grow still applies in place.
-    injected.push(`${inner}  ignore_changes = [nameserver, network[0].hwaddr, rootfs[0].volume]`);
+    // The create-time / ForceNew attributes Proxmox assigns, per resource type.
+    // Listing them makes an unchanged redeploy a no-op and a real change an
+    // in-place UPDATE, never a destructive REPLACE. A non-existent attribute
+    // here fails `terraform validate`, so each list is exactly the schema
+    // attributes the resource actually has.
+    //   LXC (ISS-0055/0089): the create-time MAC + rootfs volume, plus
+    //   `ssh_public_keys` (ForceNew — a fleet-key rotation must not REPLACE the
+    //   container). `rootfs.size` is NOT ignored, so a disk grow still applies.
+    //   We do NOT ignore `target_node` — a node change is real (migration,
+    //   ISS-0090), never silently dropped.
+    //   VM (telmate 3.x proxmox_vm_qemu): `clone` (ForceNew clone source),
+    //   `sshkeys` + `nameserver` (ForceNew cloud-init), and the NIC `macaddr`.
+    //   Initial set from the provider schema — extend if a first real VM deploy
+    //   surfaces another spurious-REPLACE attribute, exactly as ISS-0055 did for
+    //   the LXC list.
+    const ignore =
+      resourceType === 'proxmox_vm_qemu'
+        ? 'nameserver, network[0].macaddr, sshkeys, clone'
+        : 'nameserver, network[0].hwaddr, rootfs[0].volume, ssh_public_keys';
+    injected.push(`${inner}  ignore_changes = [${ignore}]`);
     injected.push(`${inner}}`);
     return injected.join('\n');
   });
 }
 
+/**
+ * Extract the node a proxmox_lxc resource is deployed on from a parsed terraform
+ * state object. Pure logic (Rule 10), split from the file read for testability.
+ * Prefers the explicit `target_node` attribute; falls back to parsing the
+ * resource id (`<node>/lxc/<vmid>`). Returns null when there's no proxmox_lxc
+ * resource (e.g. an empty/fresh state).
+ */
+export function targetNodeFromTfState(state: {
+  resources?: Array<{
+    type?: string;
+    instances?: Array<{ attributes?: { target_node?: string; id?: string } }>;
+  }>;
+}): string | null {
+  const lxc = state.resources?.find((r) => r.type === 'proxmox_lxc');
+  const attrs = lxc?.instances?.[0]?.attributes;
+  if (!attrs) {
+    return null;
+  }
+  if (attrs.target_node) {
+    return attrs.target_node;
+  }
+  // id format: "<node>/lxc/<vmid>"
+  return attrs.id?.split('/')[0] || null;
+}
+
+/**
+ * Read the node a module's container is currently deployed on, from its terraform
+ * state file. This is celilo's authoritative record of placement (ISS-0090).
+ * Returns null when no state exists yet (a first deploy) or it can't be read —
+ * the caller then falls back to the service `default_target_node`.
+ */
+async function readDeployedTargetNode(moduleId: string): Promise<string | null> {
+  const statePath = join(
+    getModuleStoragePath(),
+    moduleId,
+    'generated',
+    'terraform',
+    'terraform.tfstate',
+  );
+  if (!existsSync(statePath)) {
+    return null;
+  }
+  try {
+    return targetNodeFromTfState(JSON.parse(await readFile(statePath, 'utf-8')));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The node a module's container ACTUALLY lives on, from Proxmox (ISS-0090).
+ * Proxmox is the ultimate source of truth for current location — it sees a
+ * hand-migration that celilo's terraform state wouldn't. Returns null when the
+ * module has no deployed vmid yet, the service is unreachable, or the vmid isn't
+ * in the cluster — the caller then falls back to terraform state / the default.
+ * Never throws: a Proxmox outage must not block a deploy.
+ */
+async function readProxmoxNodeForModule(
+  moduleId: string,
+  serviceId: string,
+  db: DbClient,
+): Promise<string | null> {
+  const vmid = getModuleSystems(moduleId, db).find(
+    (s) => s.infrastructure.type === 'container_service' && s.infrastructure.vmid != null,
+  )?.infrastructure.vmid;
+  if (vmid == null) return null;
+  try {
+    const creds = (await getServiceCredentials(serviceId)) as ProxmoxCredentials;
+    const result = await new ProxmoxClient(creds).nodeForVmid(vmid);
+    return result.success ? result.data : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Decide which node to target for a deploy (ISS-0090). Pure (Rule 10):
+ *   Proxmox reality > recorded terraform state > service default.
+ * `default_target_node` governs only a FIRST placement; a changed default must
+ * never relocate a running container. A hand-migration (seen by Proxmox but not
+ * tf-state) is adopted. Deliberate moves are an explicit migrate (ISS-0062).
+ */
+export function decideTargetNode(opts: {
+  proxmoxNode: string | null;
+  stateNode: string | null;
+  defaultNode: string;
+}): { node: string; source: 'proxmox' | 'state' | 'default' } {
+  if (opts.proxmoxNode) return { node: opts.proxmoxNode, source: 'proxmox' };
+  if (opts.stateNode) return { node: opts.stateNode, source: 'state' };
+  return { node: opts.defaultNode, source: 'default' };
+}
+
 /**
  * Discover template files in directory recursively
  *
@@ -624,6 +730,9 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
   // Infrastructure Properties Resolution (Proxmox provider config)
   // For Proxmox services, extract provider config and store as temporary values
   // This happens during generation so templates can access target_node, lxc_template, etc.
+  // Resolved live each generate (ISS-0090) and injected into the context below,
+  // never cached in the DB. undefined for non-Proxmox / machine deploys.
+  let resolvedTargetNode: string | undefined;
   if (isContainerService && isProxmoxService && infrastructureSelection?.serviceId) {
     const service = await db
       .select()
@@ -638,20 +747,36 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
         storage: string;
       };
 
-      // Store provider config values as temporary config (similar to IPAM allocation)
-      const infraProperties = [
-        { key: 'target_node', value: providerConfig.default_target_node },
-        { key: 'lxc_template', value: providerConfig.lxc_template },
-        { key: 'storage', value: providerConfig.storage },
-      ];
-
-      for (const prop of infraProperties) {
-        upsertModuleConfig(db, moduleId, `__infra_${prop.key}`, prop.value);
+      // ISS-0090: deploy follows REALITY. Resolve the node from Proxmox (it sees
+      // a hand-migration that tf-state wouldn't), else the recorded terraform
+      // state, else the service default (FIRST placement only). A changed default
+      // must never relocate a running container; deliberate moves are an explicit
+      // migrate (ISS-0062).
+      const decision = decideTargetNode({
+        proxmoxNode: await readProxmoxNodeForModule(
+          moduleId,
+          infrastructureSelection.serviceId,
+          db,
+        ),
+        stateNode: await readDeployedTargetNode(moduleId),
+        defaultNode: providerConfig.default_target_node,
+      });
+      resolvedTargetNode = decision.node;
+      if (decision.source !== 'default' && decision.node !== providerConfig.default_target_node) {
+        const from = decision.source === 'proxmox' ? 'Proxmox' : 'terraform state';
+        log.info(
+          `${moduleId} → node '${decision.node}' (from ${from}; service default is '${providerConfig.default_target_node}'). Relocating requires a deliberate migration.`,
+        );
       }
 
-      log.success(
-        `Infrastructure properties resolved from service: target_node=${providerConfig.default_target_node}`,
-      );
+      // Persist only the non-drift provider values. target_node is reality — it's
+      // injected into the resolution context below, never cached (ISS-0090); drop
+      // any stale __infra_target_node a prior generate left behind.
+      upsertModuleConfig(db, moduleId, '__infra_lxc_template', providerConfig.lxc_template);
+      upsertModuleConfig(db, moduleId, '__infra_storage', providerConfig.storage);
+      deleteModuleConfig(db, moduleId, '__infra_target_node');
+
+      log.success(`Infrastructure resolved: target_node=${decision.node} (${decision.source})`);
     }
   }
 
@@ -683,8 +808,15 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
       context.selfConfig.target_ip = ipConfig.value!;
     }
 
-    // Add infrastructure properties to context (target_node, lxc_template, storage)
-    const infraKeys = ['target_node', 'lxc_template', 'storage'];
+    // target_node is the live-resolved reality (ISS-0090) — inject it directly,
+    // never from a cached __infra_target_node row (which drifts).
+    if (resolvedTargetNode) {
+      context.selfConfig.target_node = resolvedTargetNode;
+    }
+
+    // lxc_template / storage are provider config (intent, not drift-prone) — read
+    // them back from the __infra_* rows persisted above.
+    const infraKeys = ['lxc_template', 'storage'];
     for (const key of infraKeys) {
       const infraConfig = db
         .select()
@@ -705,6 +837,23 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
     };
   }
 
+  // Policy: fail loud at the source on a broken capability chain. A
+  // required `source: capability` var whose chain doesn't resolve is
+  // silently dropped during derivation, then surfaces downstream as a
+  // cryptic `$self:<x> not found` in some template. Assert it here against
+  // the resolved capabilities map so generate names the broken link and
+  // the provider to redeploy (ISS-0115; the data-plane sibling of ISS-0088).
+  const capProblems = findBrokenCapabilityDerivations(moduleId, manifest, context.capabilities);
+  if (capProblems.length > 0) {
+    return {
+      success: false,
+      error: `Cannot generate '${moduleId}': ${capProblems.length} capability-derived variable(s) won't resolve:\n${capProblems
+        .map((p) => `  - ${describeCapabilityProblem(p)}`)
+        .join('\n')}`,
+      details: capProblems,
+    };
+  }
+
   // Execution: Store derived variables in module_configs
   // Variables with derive_from are resolved in the context but not stored in module_configs.
   // Store them so hooks and host_vars can access them.
@@ -912,7 +1061,7 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
       // every proxmox_lxc resource before resolution (terraform files only).
       const content =
         !isAnsibleTemplate && template.targetPath.endsWith('.tf')
-          ? injectProxmoxLxcDns(template.content, Boolean(context.selfConfig.lxc_nameserver))
+          ? injectProxmoxDns(template.content, Boolean(context.selfConfig.lxc_nameserver))
           : template.content;
       const result = isAnsibleTemplate
         ? await convertSecretsToJinja(content, context, db)

package/src/test-utils/fixtures.test.ts

@@ -60,7 +60,7 @@ describe('Fixture Test Utilities', () => {
     test('excludes secrets from config', async () => {
       const config = await getModuleTestConfig('dns-external');
       expect(config).toBeDefined();
-      expect(config.vps_ip).toBe('188.166.157.2');
+      expect(config.vps_ip).toBe('192.0.2.20');
       expect(config.secrets).toBeUndefined();
     });
 

package/src/test-utils/integration-guard.ts

@@ -0,0 +1,33 @@
+import { execSync } from 'node:child_process';
+
+/**
+ * Guard for tests that can't run in the `unit` target / on the minimal CI
+ * runner — they shell out to external tools (ansible, wg, terraform, docker…)
+ * or assert platform-specific behavior. Such tests are integration tests by
+ * Rule 7.1 and must NOT gate the unit CI.
+ *
+ * Returns `true` (→ skip) when:
+ *   - CELILO_UNIT_ONLY=1 is set (the `unit` target forces them off), OR
+ *   - a required tool is absent on this host, OR
+ *   - we're on the wrong platform.
+ *
+ * Usage:  describe.skipIf(skipIntegration({ tools: ['ansible'] }))(...)
+ *         test.skipIf(skipIntegration({ platform: 'darwin' }))(...)
+ */
+function hasTool(tool: string): boolean {
+  try {
+    execSync(`command -v ${tool}`, { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function skipIntegration(
+  req: { tools?: string[]; platform?: NodeJS.Platform } = {},
+): boolean {
+  if (process.env.CELILO_UNIT_ONLY === '1') return true;
+  if (req.tools?.some((t) => !hasTool(t))) return true;
+  if (req.platform && process.platform !== req.platform) return true;
+  return false;
+}

package/src/types/infrastructure.ts

@@ -31,6 +31,12 @@ export interface ProxmoxConfig {
   default_target_node: string;
   lxc_template: string;
   storage: string;
+  /**
+   * Cloud-init VM template to clone for `requires.system.type: vm` modules — the
+   * VM analogue of `lxc_template`. Optional: only services hosting VM modules set
+   * it (the operator builds the template once, per VM_INFRA_TYPE.md).
+   */
+  vm_template?: string;
 }
 
 /**

package/src/variables/computed/computed-integration.test.ts

@@ -90,7 +90,7 @@ beforeEach(async () => {
   // Encrypt with the SAME master key the resolver will decrypt with (the one
   // beforeEach wrote into CELILO_DATA_DIR).
   const enc = encryptSecret(
-    JSON.stringify({ 'lunacycle.net': 'pw1', 'celilo.computer': 'pw2' }),
+    JSON.stringify({ 'example.net': 'pw1', 'celilo.computer': 'pw2' }),
     await loadTestMasterKey(),
   );
   db.$client
@@ -133,7 +133,7 @@ describe('computed capability fields — DB integration', () => {
     expect(result.success).toBe(true);
     if (result.success) {
       // Non-scalar computed results serialize to JSON in the string path.
-      expect(JSON.parse(result.value)).toEqual(['lunacycle.net', 'celilo.computer']);
+      expect(JSON.parse(result.value)).toEqual(['example.net', 'celilo.computer']);
     }
   });
 
@@ -170,7 +170,7 @@ describe('computed capability fields — DB integration', () => {
     const reg = ctx.capabilities.dns_registrar as Record<string, unknown>;
 
     // The real array, not the raw marker object.
-    expect(reg.domain_list).toEqual(['lunacycle.net', 'celilo.computer']);
+    expect(reg.domain_list).toEqual(['example.net', 'celilo.computer']);
     expect(reg.provider).toBe('namecheap');
   });
 

package/src/variables/computed/computed.test.ts

@@ -23,7 +23,7 @@ function makeLookup(data: Record<string, unknown>): LookupFn {
 
 const FIXTURE = {
   secret: {
-    ddns_passwords: { 'lunacycle.net': 'pw1', 'celilo.computer': 'pw2' },
+    ddns_passwords: { 'example.net': 'pw1', 'celilo.computer': 'pw2' },
   },
   self: {
     zone_names: { dmz: 'DMZ', app: 'App' },
@@ -34,7 +34,7 @@ const FIXTURE = {
     zones_with_dupes: ['x', 'y', 'x', 'z', 'y'],
   },
   system: {
-    primary_domain: 'lunacycle.net',
+    primary_domain: 'example.net',
   },
 };
 
@@ -44,7 +44,7 @@ function evalOk(expr: string): unknown {
 
 describe('computed DSL — keys', () => {
   test('keys of the ddns_passwords secret map (the domain_list case)', () => {
-    expect(evalOk('keys(secret.ddns_passwords)')).toEqual(['lunacycle.net', 'celilo.computer']);
+    expect(evalOk('keys(secret.ddns_passwords)')).toEqual(['example.net', 'celilo.computer']);
   });
 
   test('keys of a non-secret object', () => {
@@ -63,7 +63,7 @@ describe('computed DSL — values', () => {
   });
 
   test('keys of a secret map is allowed (key names are non-sensitive)', () => {
-    expect(evalOk('keys(secret.ddns_passwords)')).toEqual(['lunacycle.net', 'celilo.computer']);
+    expect(evalOk('keys(secret.ddns_passwords)')).toEqual(['example.net', 'celilo.computer']);
   });
 });
 
@@ -107,7 +107,7 @@ describe('computed DSL — concat + unique (nesting/chaining)', () => {
 describe('computed DSL — format', () => {
   test('interpolates named parts', () => {
     expect(evalOk("format('{host}.{zone}', host=self.hostname, zone=system.primary_domain)")).toBe(
-      'dns-int.lunacycle.net',
+      'dns-int.example.net',
     );
   });
 

package/src/variables/declarative-derivation.test.ts

@@ -164,14 +164,14 @@ describe('resolveDeclarativeDerivation', () => {
         capabilities: {
           dns_external: {
             server: {
-              ip: '188.166.157.2',
+              ip: '192.0.2.20',
             },
           },
         },
       };
 
       const result = resolveDeclarativeDerivation(variable, context);
-      expect(result).toBe('188.166.157.2');
+      expect(result).toBe('192.0.2.20');
     });
 
     test('resolves nested capability path', () => {
@@ -193,7 +193,7 @@ describe('resolveDeclarativeDerivation', () => {
           dns_external: {
             server: {
               ip: {
-                primary: '188.166.157.2',
+                primary: '192.0.2.20',
                 secondary: '188.166.157.3',
               },
             },
@@ -202,7 +202,7 @@ describe('resolveDeclarativeDerivation', () => {
       };
 
       const result = resolveDeclarativeDerivation(variable, context);
-      expect(result).toBe('188.166.157.2');
+      expect(result).toBe('192.0.2.20');
     });
 
     test('throws on missing capability', () => {
@@ -350,13 +350,13 @@ describe('resolveDeclarativeDerivation', () => {
         secrets: {},
         capabilities: {
           dns_external: {
-            server: { ip: '188.166.157.2' },
+            server: { ip: '192.0.2.20' },
           },
         },
       };
 
       const result = resolveDeclarativeDerivation(variable, context);
-      expect(result).toBe('caddy.example.com@188.166.157.2');
+      expect(result).toBe('caddy.example.com@192.0.2.20');
     });
   });