@celilo/cli 0.5.0-alpha.9 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "0.5.0-alpha.9",
+  "version": "0.5.0",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {

package/src/api-clients/proxmox.test.ts

@@ -6,7 +6,7 @@ import {
   findNodeForVmid,
   pollTaskUntilDone,
   selectFreeVmid,
-  selectIsoStorage,
+  selectImportStorage,
   summarizeNodeCapacities,
 } from './proxmox';
 
@@ -137,38 +137,48 @@ describe('filterVmTemplates — extract VM templates from a /nodes/{node}/qemu l
   });
 });
 
-describe('selectIsoStorage — pick a storage that accepts iso content', () => {
-  test('returns the first active, enabled storage whose content includes iso', () => {
+describe('selectImportStorage — pick a storage that accepts import content', () => {
+  test('returns the first active, enabled storage whose content includes import', () => {
     const storages = [
       { storage: 'local-lvm', content: 'images,rootdir', active: 1, enabled: 1 },
-      { storage: 'local', content: 'iso,vztmpl,backup', active: 1, enabled: 1 },
+      { storage: 'local', content: 'import,vztmpl,backup', active: 1, enabled: 1 },
     ];
-    expect(selectIsoStorage(storages)).toBe('local');
+    expect(selectImportStorage(storages)).toBe('local');
   });
 
-  test('skips an iso-capable storage that is inactive', () => {
+  test('does NOT pick an iso-only storage (import-from rejects iso content)', () => {
+    // Regression guard: the cloud image must land in the import namespace, not
+    // iso/, or the VM-create `import-from=` fails with `has wrong type 'iso'`.
     const storages = [
-      { storage: 'cold', content: 'iso', active: 0, enabled: 1 },
-      { storage: 'local', content: 'iso', active: 1, enabled: 1 },
+      { storage: 'iso-only', content: 'iso,vztmpl,backup', active: 1, enabled: 1 },
+      { storage: 'data', content: 'import,images', active: 1, enabled: 1 },
     ];
-    expect(selectIsoStorage(storages)).toBe('local');
+    expect(selectImportStorage(storages)).toBe('data');
   });
 
-  test('skips an iso-capable storage that is disabled', () => {
+  test('skips an import-capable storage that is inactive', () => {
     const storages = [
-      { storage: 'off', content: 'iso', active: 1, enabled: 0 },
-      { storage: 'local', content: 'iso', active: 1, enabled: 1 },
+      { storage: 'cold', content: 'import', active: 0, enabled: 1 },
+      { storage: 'local', content: 'import', active: 1, enabled: 1 },
     ];
-    expect(selectIsoStorage(storages)).toBe('local');
+    expect(selectImportStorage(storages)).toBe('local');
   });
 
-  test('returns null when no storage accepts iso content', () => {
+  test('skips an import-capable storage that is disabled', () => {
+    const storages = [
+      { storage: 'off', content: 'import', active: 1, enabled: 0 },
+      { storage: 'local', content: 'import', active: 1, enabled: 1 },
+    ];
+    expect(selectImportStorage(storages)).toBe('local');
+  });
+
+  test('returns null when no storage accepts import content', () => {
     const storages = [{ storage: 'local-lvm', content: 'images,rootdir', active: 1, enabled: 1 }];
-    expect(selectIsoStorage(storages)).toBeNull();
+    expect(selectImportStorage(storages)).toBeNull();
   });
 
   test('returns null for an empty storage list', () => {
-    expect(selectIsoStorage([])).toBeNull();
+    expect(selectImportStorage([])).toBeNull();
   });
 });
 
@@ -200,15 +210,15 @@ describe('selectFreeVmid — first free VMID >= minVmid (template hygiene)', ()
   });
 });
 
-describe('buildCloudImageVolid — volid for a cloud image on iso storage', () => {
-  test('places the filename under the storage iso/ namespace', () => {
+describe('buildCloudImageVolid — volid for a cloud image on import storage', () => {
+  test('places the filename under the storage import/ namespace', () => {
     expect(buildCloudImageVolid('local', 'noble-server-cloudimg-amd64.img')).toBe(
-      'local:iso/noble-server-cloudimg-amd64.img',
+      'local:import/noble-server-cloudimg-amd64.img',
     );
   });
 
   test('works with an arbitrary storage name', () => {
-    expect(buildCloudImageVolid('nas-iso', 'jammy.img')).toBe('nas-iso:iso/jammy.img');
+    expect(buildCloudImageVolid('nas', 'jammy.img')).toBe('nas:import/jammy.img');
   });
 });
 

package/src/api-clients/proxmox.ts

@@ -890,30 +890,38 @@ export async function listVmTemplates(
   return { success: true, data: filterVmTemplates(result.data) };
 }
 
-/** Storage row shape (subset) used when picking ISO-capable storage. */
+/** Storage row shape (subset) used when picking import-capable storage. */
 type ProxmoxStorageRow = { storage: string; content: string; active: number; enabled: number };
 
 /**
- * Pick the first active, enabled storage that accepts `iso` content. Pure
+ * Pick the first active, enabled storage that accepts `import` content. Pure
  * selection logic, split from the network call for testability (Rule 10).
  * Returns the storage name, or null when none qualifies.
+ *
+ * Must be `import`, NOT `iso`: the cloud image is consumed via the VM-create
+ * `import-from=` parameter, which Proxmox only accepts from a source on a
+ * storage whose content type is `images` or `import`. A `.img` downloaded to
+ * the `iso/` namespace is rejected with `has wrong type 'iso'`. The
+ * `download-url` endpoint accepts `content=import` on PVE 8.2+, so we download
+ * straight into the import namespace. (PVE 8.2+; node fleet is 9.x.)
  */
-export function selectIsoStorage(storages: ProxmoxStorageRow[]): string | null {
-  const iso = storages.find((s) => s.active && s.enabled && s.content.includes('iso'));
-  return iso?.storage ?? null;
+export function selectImportStorage(storages: ProxmoxStorageRow[]): string | null {
+  const match = storages.find((s) => s.active && s.enabled && s.content.includes('import'));
+  return match?.storage ?? null;
 }
 
 /**
- * Find a storage on the node that accepts `iso` content (for downloading cloud
- * images). Returns the storage name, or null if none found.
+ * Find a storage on the node that accepts `import` content (for downloading
+ * cloud images that will be imported as a VM disk). Returns the storage name,
+ * or null if none found.
  */
-export async function findIsoStorage(
+export async function findImportStorage(
   credentials: ProxmoxCredentials,
   nodeName: string,
 ): Promise<ProxmoxResult<string | null>> {
   const result = await listNodeStorage(credentials, nodeName);
   if (!result.success) return result;
-  return { success: true, data: selectIsoStorage(result.data) };
+  return { success: true, data: selectImportStorage(result.data) };
 }
 
 /**
@@ -953,20 +961,22 @@ export async function findFreeTemplateVmid(
 }
 
 /**
- * Download a cloud image URL to ISO storage on the node. Returns a UPID for
- * status polling. Requires PVE 7.2+ (`download-url` endpoint).
+ * Download a cloud image URL to `import` storage on the node. Returns a UPID
+ * for status polling. Requires PVE 8.2+ (`download-url` with `content=import`).
+ * The image MUST land in the import namespace (not iso) so the VM-create
+ * `import-from=` accepts it — see selectImportStorage.
  */
 export async function downloadCloudImage(
   credentials: ProxmoxCredentials,
   nodeName: string,
-  isoStorage: string,
+  importStorage: string,
   url: string,
   filename: string,
 ): Promise<ProxmoxResult<string>> {
   return makeProxmoxPost<string>(
     credentials,
-    `/nodes/${nodeName}/storage/${isoStorage}/download-url`,
-    { url, filename, content: 'iso' },
+    `/nodes/${nodeName}/storage/${importStorage}/download-url`,
+    { url, filename, content: 'import' },
   );
 }
 
@@ -1003,13 +1013,14 @@ export async function pollTaskUntilDone(
 }
 
 /**
- * Build the volid for a cloud image downloaded to ISO storage. Pure path
+ * Build the volid for a cloud image downloaded to `import` storage. Pure path
  * construction, split out for testability (Rule 10) — mirrors buildTemplatePath.
- * Proxmox's `download-url` with `content=iso` stores the `.img` under the
- * storage's `iso/` namespace, so the volid is `<storage>:iso/<filename>`.
+ * Proxmox's `download-url` with `content=import` stores the `.img` under the
+ * storage's `import/` namespace, so the volid is `<storage>:import/<filename>`.
+ * This is the namespace the VM-create `import-from=` accepts (iso/ is rejected).
  */
-export function buildCloudImageVolid(isoStorage: string, filename: string): string {
-  return `${isoStorage}:iso/${filename}`;
+export function buildCloudImageVolid(importStorage: string, filename: string): string {
+  return `${importStorage}:import/${filename}`;
 }
 
 export interface CreateVmFromCloudImageParams {
@@ -1017,8 +1028,8 @@ export interface CreateVmFromCloudImageParams {
   nodeName: string;
   vmid: number;
   name: string;
-  /** Volume ID of the downloaded cloud image, e.g. `local:iso/noble-server-cloudimg-amd64.img` */
-  isoVolid: string;
+  /** Volume ID of the downloaded cloud image, e.g. `local:import/noble-server-cloudimg-amd64.img` */
+  imageVolid: string;
   /** Storage for the imported VM disk and the cloud-init drive */
   diskStorage: string;
 }
@@ -1038,7 +1049,7 @@ export interface CreateVmFromCloudImageParams {
 export async function createVmFromCloudImage(
   params: CreateVmFromCloudImageParams,
 ): Promise<ProxmoxResult<string>> {
-  const { credentials, nodeName, vmid, name, isoVolid, diskStorage } = params;
+  const { credentials, nodeName, vmid, name, imageVolid, diskStorage } = params;
   return makeProxmoxPost<string>(credentials, `/nodes/${nodeName}/qemu`, {
     vmid: String(vmid),
     name,
@@ -1050,7 +1061,7 @@ export async function createVmFromCloudImage(
     serial0: 'socket',
     vga: 'serial0',
     boot: 'order=scsi0',
-    scsi0: `${diskStorage}:0,import-from=${isoVolid}`,
+    scsi0: `${diskStorage}:0,import-from=${imageVolid}`,
     ide2: `${diskStorage}:cloudinit`,
   });
 }

package/src/cli/commands/proxmox-vm-template-build.ts

@@ -25,7 +25,7 @@ import {
   deleteVm,
   downloadCloudImage,
   findFreeTemplateVmid,
-  findIsoStorage,
+  findImportStorage,
   listVmTemplates,
   pollTaskUntilDone,
 } from '../../api-clients/proxmox';
@@ -33,7 +33,12 @@ import { FuelGauge } from '../fuel-gauge';
 
 const UBUNTU_2404_AMD64_URL =
   'https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img';
-const UBUNTU_2404_AMD64_FILENAME = 'noble-server-cloudimg-amd64.img';
+// Stored under the storage's import/ namespace, so the filename must end in an
+// extension PVE accepts for `import` content (UPLOAD_IMPORT_EXT_RE_1 =
+// ova|qcow2|raw|vmdk) — a `.img` is rejected with "invalid filename or wrong
+// extension". Ubuntu's cloud image is qcow2 format despite the upstream `.img`
+// URL, so we download it under a `.qcow2` name. The URL above is unchanged.
+const UBUNTU_2404_AMD64_FILENAME = 'noble-server-cloudimg-amd64.qcow2';
 const DEFAULT_TEMPLATE_NAME = 'ubuntu-2404-cloudinit';
 
 export interface VmTemplateBuildParams {
@@ -69,21 +74,23 @@ export async function buildCloudInitTemplate(params: VmTemplateBuildParams): Pro
   let vmid: number | null = null;
 
   try {
-    // Step 1: find ISO storage
-    gauge.addOutput('Finding ISO-capable storage on the node…');
-    const isoStorageResult = await findIsoStorage(credentials, nodeName);
-    if (!isoStorageResult.success) {
-      throw new Error(`Could not list node storage: ${isoStorageResult.message}`);
+    // Step 1: find import-capable storage. The cloud image is consumed via the
+    // VM-create `import-from=`, which requires an `import`/`images` source — a
+    // `.img` in the `iso/` namespace is rejected (`has wrong type 'iso'`).
+    gauge.addOutput('Finding import-capable storage on the node…');
+    const importStorageResult = await findImportStorage(credentials, nodeName);
+    if (!importStorageResult.success) {
+      throw new Error(`Could not list node storage: ${importStorageResult.message}`);
     }
-    const isoStorage = isoStorageResult.data;
-    if (!isoStorage) {
+    const importStorage = importStorageResult.data;
+    if (!importStorage) {
       throw new Error(
-        'No ISO-capable storage found on the node. ' +
-          "Enable 'iso' content on a storage (typically 'local') in the Proxmox UI: " +
+        'No import-capable storage found on the node. ' +
+          "Enable 'import' content on a storage (typically 'local') in the Proxmox UI: " +
           'Datacenter → Storage → Edit → Content.',
       );
     }
-    gauge.addOutput(`ISO storage: ${isoStorage}`);
+    gauge.addOutput(`Import storage: ${importStorage}`);
 
     // Step 2: find a free template VMID
     gauge.addOutput('Finding a free template VMID (>= 9000)…');
@@ -92,21 +99,21 @@ export async function buildCloudInitTemplate(params: VmTemplateBuildParams): Pro
     vmid = vmidResult.data;
     gauge.addOutput(`Using VMID ${vmid}`);
 
-    // Step 3: download cloud image to ISO storage
+    // Step 3: download cloud image to import storage
     gauge.addOutput(
-      `Downloading Ubuntu 24.04 cloud image to '${isoStorage}' (~600 MB, may take several minutes)…`,
+      `Downloading Ubuntu 24.04 cloud image to '${importStorage}' (~600 MB, may take several minutes)…`,
     );
     const downloadResult = await downloadCloudImage(
       credentials,
       nodeName,
-      isoStorage,
+      importStorage,
       UBUNTU_2404_AMD64_URL,
       UBUNTU_2404_AMD64_FILENAME,
     );
     if (!downloadResult.success) {
       if (downloadResult.message.includes('403') || downloadResult.message.includes('not found')) {
         throw new Error(
-          `Proxmox storage download-url endpoint rejected the request. This endpoint requires Proxmox VE 7.2+. Error: ${downloadResult.message}`,
+          `Proxmox storage download-url endpoint rejected the request. Downloading to 'import' content requires Proxmox VE 8.2+. Error: ${downloadResult.message}`,
         );
       }
       throw new Error(`Cloud image download failed: ${downloadResult.message}`);
@@ -116,14 +123,14 @@ export async function buildCloudInitTemplate(params: VmTemplateBuildParams): Pro
     gauge.addOutput('Cloud image downloaded');
 
     // Step 4: create VM from cloud image
-    const isoVolid = buildCloudImageVolid(isoStorage, UBUNTU_2404_AMD64_FILENAME);
+    const imageVolid = buildCloudImageVolid(importStorage, UBUNTU_2404_AMD64_FILENAME);
     gauge.addOutput(`Creating VM ${vmid} '${DEFAULT_TEMPLATE_NAME}' (importing disk)…`);
     const createResult = await createVmFromCloudImage({
       credentials,
       nodeName,
       vmid,
       name: DEFAULT_TEMPLATE_NAME,
-      isoVolid,
+      imageVolid,
       diskStorage,
     });
     if (!createResult.success) {

package/src/services/proxmox-state-recovery.ts

@@ -23,14 +23,29 @@ interface TerraformState {
     instances?: Array<{
       attributes?: {
         vmid?: number;
+        // proxmox_lxc carries the IP here ("10.0.10.12/24" or "dhcp").
         network?: Array<{
           ip?: string;
         }>;
+        // proxmox_vm_qemu carries the cloud-init IP here ("ip=10.0.10.12/24,gw=…").
+        ipconfig0?: string;
       };
     }>;
   }>;
 }
 
+/**
+ * Extract the CIDR from a qemu cloud-init `ipconfig0` string
+ * ("ip=10.0.10.12/24,gw=10.0.10.1" → "10.0.10.12/24"). Returns undefined for a
+ * DHCP config or anything without an explicit `ip=`.
+ */
+function extractIpFromIpconfig(ipconfig0: string | undefined): string | undefined {
+  if (!ipconfig0) return undefined;
+  const match = ipconfig0.match(/(?:^|,)ip=([^,]+)/);
+  const value = match?.[1];
+  return value && value !== 'dhcp' ? value : undefined;
+}
+
 /**
  * Ensure module_configs has vmid and target_ip from Terraform state
  * This recovers from state drift scenarios where container was deleted/recreated
@@ -82,19 +97,23 @@ export async function ensureProxmoxConfigFromState(
     );
   }
 
-  // Find proxmox_lxc resource
-  const lxcResource = state.resources?.find((r) => r.type === 'proxmox_lxc');
-  if (!lxcResource || !lxcResource.instances || lxcResource.instances.length === 0) {
-    throw new Error('No proxmox_lxc resource found in Terraform state');
+  // Find the provisioned guest: an LXC (proxmox_lxc) or a VM (proxmox_vm_qemu).
+  const guest = state.resources?.find(
+    (r) => r.type === 'proxmox_lxc' || r.type === 'proxmox_vm_qemu',
+  );
+  if (!guest || !guest.instances || guest.instances.length === 0) {
+    throw new Error('No proxmox_lxc or proxmox_vm_qemu resource found in Terraform state');
   }
 
-  const attributes = lxcResource.instances[0].attributes;
+  const attributes = guest.instances[0].attributes;
   if (!attributes) {
-    throw new Error('No attributes found in proxmox_lxc resource');
+    throw new Error(`No attributes found in ${guest.type} resource`);
   }
 
   const vmid = attributes.vmid;
-  const containerIp = attributes.network?.[0]?.ip;
+  // LXC exposes the IP at network[0].ip; a qemu VM exposes it via the cloud-init
+  // ipconfig0 ("ip=<cidr>,gw=<gw>"). Use whichever the guest type provides.
+  const containerIp = attributes.network?.[0]?.ip ?? extractIpFromIpconfig(attributes.ipconfig0);
 
   if (!vmid) {
     throw new Error('vmid not found in Terraform state');

package/src/templates/generator.test.ts

@@ -790,7 +790,28 @@ describe("targetNodeFromTfState (ISS-0090 — terraform state is celilo's placem
     expect(targetNodeFromTfState(state)).toBe('node3');
   });
 
-  test('returns null when there is no proxmox_lxc resource (fresh/empty state)', () => {
+  test('reads the node from a proxmox_vm_qemu target_node attribute (type:vm)', () => {
+    const state = {
+      resources: [
+        {
+          type: 'proxmox_vm_qemu',
+          instances: [{ attributes: { target_node: 'node3', id: 'node3/qemu/208' } }],
+        },
+      ],
+    };
+    expect(targetNodeFromTfState(state)).toBe('node3');
+  });
+
+  test('parses the qemu resource id when target_node is absent (type:vm)', () => {
+    const state = {
+      resources: [
+        { type: 'proxmox_vm_qemu', instances: [{ attributes: { id: 'node3/qemu/208' } }] },
+      ],
+    };
+    expect(targetNodeFromTfState(state)).toBe('node3');
+  });
+
+  test('returns null when there is no proxmox_lxc/proxmox_vm_qemu resource (fresh/empty state)', () => {
     expect(targetNodeFromTfState({ resources: [] })).toBeNull();
     expect(targetNodeFromTfState({})).toBeNull();
   });

package/src/templates/generator.ts

@@ -216,10 +216,11 @@ export function injectProxmoxDns(content: string, hasNameserver: boolean): strin
 }
 
 /**
- * Extract the node a proxmox_lxc resource is deployed on from a parsed terraform
- * state object. Pure logic (Rule 10), split from the file read for testability.
- * Prefers the explicit `target_node` attribute; falls back to parsing the
- * resource id (`<node>/lxc/<vmid>`). Returns null when there's no proxmox_lxc
+ * Extract the node a Proxmox guest is deployed on from a parsed terraform state
+ * object — an LXC (proxmox_lxc) or a VM (proxmox_vm_qemu). Pure logic (Rule 10),
+ * split from the file read for testability. Prefers the explicit `target_node`
+ * attribute; falls back to parsing the resource id (`<node>/lxc/<vmid>` for an
+ * LXC, `<node>/qemu/<vmid>` for a VM). Returns null when there's no such
  * resource (e.g. an empty/fresh state).
  */
 export function targetNodeFromTfState(state: {
@@ -228,15 +229,17 @@ export function targetNodeFromTfState(state: {
     instances?: Array<{ attributes?: { target_node?: string; id?: string } }>;
   }>;
 }): string | null {
-  const lxc = state.resources?.find((r) => r.type === 'proxmox_lxc');
-  const attrs = lxc?.instances?.[0]?.attributes;
+  const guest = state.resources?.find(
+    (r) => r.type === 'proxmox_lxc' || r.type === 'proxmox_vm_qemu',
+  );
+  const attrs = guest?.instances?.[0]?.attributes;
   if (!attrs) {
     return null;
   }
   if (attrs.target_node) {
     return attrs.target_node;
   }
-  // id format: "<node>/lxc/<vmid>"
+  // id format: "<node>/lxc/<vmid>" (LXC) or "<node>/qemu/<vmid>" (VM)
   return attrs.id?.split('/')[0] || null;
 }
 
@@ -745,6 +748,10 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
         default_target_node: string;
         lxc_template: string;
         storage: string;
+        // Optional: only set once a cloud-init VM template has been built/selected
+        // for the service (see service reconfigure). Required by `type: vm` modules;
+        // absent for services that only deploy LXCs.
+        vm_template?: string;
       };
 
       // ISS-0090: deploy follows REALITY. Resolve the node from Proxmox (it sees
@@ -774,6 +781,13 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
       // any stale __infra_target_node a prior generate left behind.
       upsertModuleConfig(db, moduleId, '__infra_lxc_template', providerConfig.lxc_template);
       upsertModuleConfig(db, moduleId, '__infra_storage', providerConfig.storage);
+      // vm_template is only present once a VM template exists for the service.
+      // Persist it when set so `type: vm` modules can resolve $self:vm_template;
+      // a `type: vm` deploy against a service without one then fails loudly at
+      // variable resolution (the intended "no VM template configured" error).
+      if (providerConfig.vm_template) {
+        upsertModuleConfig(db, moduleId, '__infra_vm_template', providerConfig.vm_template);
+      }
       deleteModuleConfig(db, moduleId, '__infra_target_node');
 
       log.success(`Infrastructure resolved: target_node=${decision.node} (${decision.source})`);
@@ -816,7 +830,7 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
 
     // lxc_template / storage are provider config (intent, not drift-prone) — read
     // them back from the __infra_* rows persisted above.
-    const infraKeys = ['lxc_template', 'storage'];
+    const infraKeys = ['lxc_template', 'storage', 'vm_template'];
     for (const key of infraKeys) {
       const infraConfig = db
         .select()