@celilo/cli 0.5.0-alpha.8 → 0.5.0

package/src/templates/generator.ts

@@ -5,6 +5,7 @@ import { dirname, join, relative } from 'node:path';
 import { and, eq } from 'drizzle-orm';
 import { generateInventory } from '../ansible/inventory';
 import { generateAnsibleSecrets } from '../ansible/secrets';
+import { ProxmoxClient, type ProxmoxCredentials } from '../api-clients/proxmox';
 import { log } from '../cli/prompts';
 import { getModuleStoragePath } from '../config/paths';
 import { type DbClient, getDb } from '../db/client';
@@ -19,12 +20,14 @@ import {
 import { getSingularSystemSpec } from '../manifest/schema';
 import type { AnsibleCollection, ModuleManifest } from '../manifest/schema';
 import { validateZoneRequirements } from '../manifest/validate';
+import { getServiceCredentials } from '../services/container-service';
+import { getModuleSystems } from '../services/deployed-systems';
 import {
   describeCapabilityProblem,
   findBrokenCapabilityDerivations,
 } from '../services/fleet-checks';
 import { selectInfrastructure } from '../services/infrastructure-selector';
-import { upsertModuleConfig } from '../services/module-config';
+import { deleteModuleConfig, upsertModuleConfig } from '../services/module-config';
 import type { InfrastructureSelection } from '../types/infrastructure';
 import { convertSecretsToJinja } from '../variables/ansible-resolver';
 import { buildResolutionContext } from '../variables/context';
@@ -213,10 +216,11 @@ export function injectProxmoxDns(content: string, hasNameserver: boolean): strin
 }
 
 /**
- * Extract the node a proxmox_lxc resource is deployed on from a parsed terraform
- * state object. Pure logic (Rule 10), split from the file read for testability.
- * Prefers the explicit `target_node` attribute; falls back to parsing the
- * resource id (`<node>/lxc/<vmid>`). Returns null when there's no proxmox_lxc
+ * Extract the node a Proxmox guest is deployed on from a parsed terraform state
+ * object — an LXC (proxmox_lxc) or a VM (proxmox_vm_qemu). Pure logic (Rule 10),
+ * split from the file read for testability. Prefers the explicit `target_node`
+ * attribute; falls back to parsing the resource id (`<node>/lxc/<vmid>` for an
+ * LXC, `<node>/qemu/<vmid>` for a VM). Returns null when there's no such
  * resource (e.g. an empty/fresh state).
  */
 export function targetNodeFromTfState(state: {
@@ -225,15 +229,17 @@ export function targetNodeFromTfState(state: {
     instances?: Array<{ attributes?: { target_node?: string; id?: string } }>;
   }>;
 }): string | null {
-  const lxc = state.resources?.find((r) => r.type === 'proxmox_lxc');
-  const attrs = lxc?.instances?.[0]?.attributes;
+  const guest = state.resources?.find(
+    (r) => r.type === 'proxmox_lxc' || r.type === 'proxmox_vm_qemu',
+  );
+  const attrs = guest?.instances?.[0]?.attributes;
   if (!attrs) {
     return null;
   }
   if (attrs.target_node) {
     return attrs.target_node;
   }
-  // id format: "<node>/lxc/<vmid>"
+  // id format: "<node>/lxc/<vmid>" (LXC) or "<node>/qemu/<vmid>" (VM)
   return attrs.id?.split('/')[0] || null;
 }
 
@@ -261,6 +267,49 @@ async function readDeployedTargetNode(moduleId: string): Promise<string | null>
   }
 }
 
+/**
+ * The node a module's container ACTUALLY lives on, from Proxmox (ISS-0090).
+ * Proxmox is the ultimate source of truth for current location — it sees a
+ * hand-migration that celilo's terraform state wouldn't. Returns null when the
+ * module has no deployed vmid yet, the service is unreachable, or the vmid isn't
+ * in the cluster — the caller then falls back to terraform state / the default.
+ * Never throws: a Proxmox outage must not block a deploy.
+ */
+async function readProxmoxNodeForModule(
+  moduleId: string,
+  serviceId: string,
+  db: DbClient,
+): Promise<string | null> {
+  const vmid = getModuleSystems(moduleId, db).find(
+    (s) => s.infrastructure.type === 'container_service' && s.infrastructure.vmid != null,
+  )?.infrastructure.vmid;
+  if (vmid == null) return null;
+  try {
+    const creds = (await getServiceCredentials(serviceId)) as ProxmoxCredentials;
+    const result = await new ProxmoxClient(creds).nodeForVmid(vmid);
+    return result.success ? result.data : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Decide which node to target for a deploy (ISS-0090). Pure (Rule 10):
+ *   Proxmox reality > recorded terraform state > service default.
+ * `default_target_node` governs only a FIRST placement; a changed default must
+ * never relocate a running container. A hand-migration (seen by Proxmox but not
+ * tf-state) is adopted. Deliberate moves are an explicit migrate (ISS-0062).
+ */
+export function decideTargetNode(opts: {
+  proxmoxNode: string | null;
+  stateNode: string | null;
+  defaultNode: string;
+}): { node: string; source: 'proxmox' | 'state' | 'default' } {
+  if (opts.proxmoxNode) return { node: opts.proxmoxNode, source: 'proxmox' };
+  if (opts.stateNode) return { node: opts.stateNode, source: 'state' };
+  return { node: opts.defaultNode, source: 'default' };
+}
+
 /**
  * Discover template files in directory recursively
  *
@@ -684,6 +733,9 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
   // Infrastructure Properties Resolution (Proxmox provider config)
   // For Proxmox services, extract provider config and store as temporary values
   // This happens during generation so templates can access target_node, lxc_template, etc.
+  // Resolved live each generate (ISS-0090) and injected into the context below,
+  // never cached in the DB. undefined for non-Proxmox / machine deploys.
+  let resolvedTargetNode: string | undefined;
   if (isContainerService && isProxmoxService && infrastructureSelection?.serviceId) {
     const service = await db
       .select()
@@ -696,39 +748,49 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
         default_target_node: string;
         lxc_template: string;
         storage: string;
+        // Optional: only set once a cloud-init VM template has been built/selected
+        // for the service (see service reconfigure). Required by `type: vm` modules;
+        // absent for services that only deploy LXCs.
+        vm_template?: string;
       };
 
-      // ISS-0090: target the node the container ACTUALLY lives on, not the
-      // service default. `default_target_node` governs only NEW placement; a
-      // changed default must NEVER relocate a running system. celilo's terraform
-      // state is its authoritative record of where it placed this container (kept
-      // in sync by deploy and by `module migrate`), so read the deployed node from
-      // there. Fall back to the default only when there's no state yet — a first
-      // deploy. Deliberate relocation is an explicit `module migrate`, not a
-      // side-effect of the default changing.
-      let targetNode = providerConfig.default_target_node;
-      const deployedNode = await readDeployedTargetNode(moduleId);
-      if (deployedNode) {
-        if (deployedNode !== targetNode) {
-          log.info(
-            `${moduleId} is already deployed on node '${deployedNode}' — targeting it (service default is '${providerConfig.default_target_node}'). Relocating requires a deliberate migration.`,
-          );
-        }
-        targetNode = deployedNode;
+      // ISS-0090: deploy follows REALITY. Resolve the node from Proxmox (it sees
+      // a hand-migration that tf-state wouldn't), else the recorded terraform
+      // state, else the service default (FIRST placement only). A changed default
+      // must never relocate a running container; deliberate moves are an explicit
+      // migrate (ISS-0062).
+      const decision = decideTargetNode({
+        proxmoxNode: await readProxmoxNodeForModule(
+          moduleId,
+          infrastructureSelection.serviceId,
+          db,
+        ),
+        stateNode: await readDeployedTargetNode(moduleId),
+        defaultNode: providerConfig.default_target_node,
+      });
+      resolvedTargetNode = decision.node;
+      if (decision.source !== 'default' && decision.node !== providerConfig.default_target_node) {
+        const from = decision.source === 'proxmox' ? 'Proxmox' : 'terraform state';
+        log.info(
+          `${moduleId} → node '${decision.node}' (from ${from}; service default is '${providerConfig.default_target_node}'). Relocating requires a deliberate migration.`,
+        );
       }
 
-      // Store provider config values as temporary config (similar to IPAM allocation)
-      const infraProperties = [
-        { key: 'target_node', value: targetNode },
-        { key: 'lxc_template', value: providerConfig.lxc_template },
-        { key: 'storage', value: providerConfig.storage },
-      ];
-
-      for (const prop of infraProperties) {
-        upsertModuleConfig(db, moduleId, `__infra_${prop.key}`, prop.value);
+      // Persist only the non-drift provider values. target_node is reality — it's
+      // injected into the resolution context below, never cached (ISS-0090); drop
+      // any stale __infra_target_node a prior generate left behind.
+      upsertModuleConfig(db, moduleId, '__infra_lxc_template', providerConfig.lxc_template);
+      upsertModuleConfig(db, moduleId, '__infra_storage', providerConfig.storage);
+      // vm_template is only present once a VM template exists for the service.
+      // Persist it when set so `type: vm` modules can resolve $self:vm_template;
+      // a `type: vm` deploy against a service without one then fails loudly at
+      // variable resolution (the intended "no VM template configured" error).
+      if (providerConfig.vm_template) {
+        upsertModuleConfig(db, moduleId, '__infra_vm_template', providerConfig.vm_template);
       }
+      deleteModuleConfig(db, moduleId, '__infra_target_node');
 
-      log.success(`Infrastructure properties resolved from service: target_node=${targetNode}`);
+      log.success(`Infrastructure resolved: target_node=${decision.node} (${decision.source})`);
     }
   }
 
@@ -760,8 +822,15 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
       context.selfConfig.target_ip = ipConfig.value!;
     }
 
-    // Add infrastructure properties to context (target_node, lxc_template, storage)
-    const infraKeys = ['target_node', 'lxc_template', 'storage'];
+    // target_node is the live-resolved reality (ISS-0090) — inject it directly,
+    // never from a cached __infra_target_node row (which drifts).
+    if (resolvedTargetNode) {
+      context.selfConfig.target_node = resolvedTargetNode;
+    }
+
+    // lxc_template / storage are provider config (intent, not drift-prone) — read
+    // them back from the __infra_* rows persisted above.
+    const infraKeys = ['lxc_template', 'storage', 'vm_template'];
     for (const key of infraKeys) {
       const infraConfig = db
         .select()