@celilo/cli 0.8.1 → 0.9.0

package/src/services/dns-provider-backfill.ts

@@ -18,7 +18,11 @@ import type { DnsInternalCapability, HookLogger } from '@celilo/capabilities';
 import { and, eq, inArray, or } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { capabilities as capabilitiesTable, modules, webRoutes } from '../db/schema';
-import { loadCapabilityFunctions, resolveFirewallNatIp } from '../hooks/capability-loader';
+import {
+  loadCapabilityFunctions,
+  resolveCaddyZoneIp,
+  resolveFirewallNatIp,
+} from '../hooks/capability-loader';
 import { runNamedHook } from '../hooks/run-named-hook';
 import type { HookName } from '../hooks/types';
 import { getModuleSystems } from './deployed-systems';
@@ -137,13 +141,21 @@ export async function backfillWebRouteDns(
     return;
   }
 
+  // caddy's zone-routable IP — the in-zone split-horizon answer (ISS-0156). When
+  // it differs from the natIp, each fronted hostname carries it as
+  // `zoneRoutableValue`; the provider's reconcileViews (driven from the ledger by
+  // the registration wrapper) materializes the per-zone view overrides.
+  const caddyZoneIp = await resolveCaddyZoneIp(db);
+  const zoneRoutableValue = caddyZoneIp && caddyZoneIp !== natIp ? caddyZoneIp : undefined;
+  const viewNote = zoneRoutableValue ? ` (in-zone view → ${zoneRoutableValue})` : '';
+
   logger.info(
-    `Backfilling ${hostnames.length} web-route hostname(s) into '${moduleId}' at ${natIp}`,
+    `Backfilling ${hostnames.length} web-route hostname(s) into '${moduleId}' at ${natIp}${viewNote}`,
   );
   const failures: string[] = [];
   for (const host of hostnames) {
     try {
-      await dnsInternal.registerRecord({ host, type: 'A', value: natIp });
+      await dnsInternal.registerRecord({ host, type: 'A', value: natIp, zoneRoutableValue });
     } catch (err) {
       failures.push(`${host}: ${err instanceof Error ? err.message : String(err)}`);
     }

package/src/services/fleet-checks.test.ts

@@ -242,7 +242,7 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
         variables: {
           owns: [
             {
-              name: 'idp_dmz_ip',
+              name: 'idp_auth_url',
               type: 'string',
               required: true,
               source: 'capability',
@@ -254,21 +254,21 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
       });
 
     it('fails when the consumed capability has no deployed provider', () => {
-      insertModule('forgejo', consumer('$capability:idp.dmz_ip'));
+      insertModule('forgejo', consumer('$capability:idp.auth_url'));
       const f = checkCapabilityProviders(db);
       expect(f.status).toBe('fail');
       expect(f.detail.join(' ')).toContain("no deployed module provides 'idp'");
     });
 
     it('fails when the provider lacks the referenced field', () => {
-      insertModule('forgejo', consumer('$capability:idp.dmz_ip'));
+      insertModule('forgejo', consumer('$capability:idp.auth_url'));
       insertModule('authentik', baseManifest({ id: 'authentik', name: 'Authentik' }));
       db.insert(capabilitiesTable)
         .values({
           moduleId: 'authentik',
           capabilityName: 'idp',
           version: '1.0.0',
-          data: { auth_url: 'x' },
+          data: { admin_email: 'x' },
         })
         .run();
       const f = checkCapabilityProviders(db);
@@ -277,14 +277,14 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
     });
 
     it('passes when the provider carries a concrete value', () => {
-      insertModule('forgejo', consumer('$capability:idp.dmz_ip'));
+      insertModule('forgejo', consumer('$capability:idp.auth_url'));
       insertModule('authentik', baseManifest({ id: 'authentik', name: 'Authentik' }));
       db.insert(capabilitiesTable)
         .values({
           moduleId: 'authentik',
           capabilityName: 'idp',
           version: '1.0.0',
-          data: { dmz_ip: '10.0.10.10' },
+          data: { auth_url: 'https://auth.celilo.computer' },
         })
         .run();
       const f = checkCapabilityProviders(db);
@@ -292,16 +292,16 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
     });
 
     it('passes but flags a derived ref for the chain trace (ISS-0114)', () => {
-      // The workstream-B case: idp.dmz_ip is present but is itself a ref
-      // ($self:caddy_dmz_ip) — we can't verify it resolves without the walker.
-      insertModule('forgejo', consumer('$capability:idp.dmz_ip'));
+      // idp.auth_url is present but is itself a ref ($self:auth_url) — we can't
+      // verify it resolves without the walker.
+      insertModule('forgejo', consumer('$capability:idp.auth_url'));
       insertModule('authentik', baseManifest({ id: 'authentik', name: 'Authentik' }));
       db.insert(capabilitiesTable)
         .values({
           moduleId: 'authentik',
           capabilityName: 'idp',
           version: '1.0.0',
-          data: { dmz_ip: '$self:caddy_dmz_ip' },
+          data: { auth_url: '$self:auth_url' },
         })
         .run();
       const f = checkCapabilityProviders(db);
@@ -442,11 +442,11 @@ describe('findBrokenCapabilityDerivations (shared predicate)', () => {
     variables: {
       owns: [
         {
-          name: 'idp_dmz_ip',
+          name: 'idp_auth_url',
           type: 'string',
           required: true,
           source: 'capability',
-          derive_from: '$capability:idp.dmz_ip',
+          derive_from: '$capability:idp.auth_url',
         },
       ],
       imports: [],
@@ -461,21 +461,23 @@ describe('findBrokenCapabilityDerivations (shared predicate)', () => {
   });
 
   it('flags empty-value when the field is present but empty', () => {
-    const problems = findBrokenCapabilityDerivations('forgejo', consumer, { idp: { dmz_ip: '' } });
+    const problems = findBrokenCapabilityDerivations('forgejo', consumer, {
+      idp: { auth_url: '' },
+    });
     expect(problems[0].reason).toBe('empty-value');
   });
 
   it('flags unresolved-ref when the resolved value is still a template', () => {
     const problems = findBrokenCapabilityDerivations('forgejo', consumer, {
-      idp: { dmz_ip: '$self:caddy_dmz_ip' },
+      idp: { auth_url: '$self:auth_url' },
     });
     expect(problems[0].reason).toBe('unresolved-ref');
-    expect(problems[0].value).toBe('$self:caddy_dmz_ip');
+    expect(problems[0].value).toBe('$self:auth_url');
   });
 
   it('returns nothing when the field resolves to a concrete value', () => {
     const problems = findBrokenCapabilityDerivations('forgejo', consumer, {
-      idp: { dmz_ip: '10.0.10.10' },
+      idp: { auth_url: 'https://auth.celilo.computer' },
     });
     expect(problems).toHaveLength(0);
   });

package/src/services/machine-detector.ts

@@ -27,23 +27,45 @@ export class DetectionError extends Error {
 export type CommandRunner = (command: string) => string;
 
 /**
- * Execute SSH command and return output
+ * Per-command SSH timeout. Detection opens a fresh SSH connection per
+ * attribute (hostname, cpu, memory, ...); under load (e.g. the e2e builder
+ * running many containers) a single handshake + command can exceed a tight
+ * budget, surfacing as `spawnSync ... ETIMEDOUT` and failing an
+ * otherwise-healthy `machine add`. 30s gives headroom without masking a
+ * genuinely-unreachable host (which fails fast on connection refusal).
+ */
+const SSH_TIMEOUT_MS = 30_000;
+/** Retry attempts for a detection SSH command. Detection is read-only
+ * (hostname / nproc / free / ...), so retrying a transient timeout is safe. */
+const SSH_ATTEMPTS = 3;
+
+/** Synchronous sleep — detection runs synchronously (execSync), so there's no
+ * async context to await in. */
+function sleepSync(ms: number): void {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/**
+ * Execute SSH command and return output. Retries transient failures
+ * (connection timeouts under load) with linear backoff — safe because every
+ * detection command is read-only.
  */
 function sshExec(ip: string, user: string, keyPath: string, command: string): string {
-  try {
-    const output = execSync(
-      `ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -i "${keyPath}" ${user}@${ip} "${command}"`,
-      {
+  const sshCmd = `ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ConnectTimeout=10 -i "${keyPath}" ${user}@${ip} "${command}"`;
+  let lastMessage = 'Unknown error';
+  for (let attempt = 1; attempt <= SSH_ATTEMPTS; attempt++) {
+    try {
+      return execSync(sshCmd, {
         encoding: 'utf8',
         stdio: ['pipe', 'pipe', 'pipe'],
-        timeout: 10000, // 10 second timeout
-      },
-    );
-    return output.trim();
-  } catch (error) {
-    const message = error instanceof Error ? error.message : 'Unknown error';
-    throw new DetectionError(`SSH command failed: ${message}`);
+        timeout: SSH_TIMEOUT_MS,
+      }).trim();
+    } catch (error) {
+      lastMessage = error instanceof Error ? error.message : 'Unknown error';
+      if (attempt < SSH_ATTEMPTS) sleepSync(1000 * attempt);
+    }
   }
+  throw new DetectionError(`SSH command failed after ${SSH_ATTEMPTS} attempts: ${lastMessage}`);
 }
 
 /** CommandRunner that SSHes to a remote machine. */

package/src/templates/generator.ts

@@ -27,7 +27,11 @@ import {
   findBrokenCapabilityDerivations,
 } from '../services/fleet-checks';
 import { selectInfrastructure } from '../services/infrastructure-selector';
-import { deleteModuleConfig, upsertModuleConfig } from '../services/module-config';
+import {
+  deleteModuleConfig,
+  getModuleConfigValue,
+  upsertModuleConfig,
+} from '../services/module-config';
 import type { InfrastructureSelection } from '../types/infrastructure';
 import { convertSecretsToJinja } from '../variables/ansible-resolver';
 import { buildResolutionContext } from '../variables/context';
@@ -730,6 +734,50 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
     }
   }
 
+  // Dedicated DNS-ingress IP (ISS-0156). A dns_internal provider now deploys into
+  // a PROTECTED zone (dmz) so it can see protected-zone query sources for
+  // split-horizon views (v2/INTERNAL_DNS_ZONE_VIEWS.md). `internal` devices have
+  // no route into the 10-net, so they reach the resolver through a firewall DNAT
+  // on a dedicated `internal`-subnet address. A module opts in by declaring a
+  // `dns_ingress_ip` infrastructure variable; we allocate a free IP from the
+  // `internal` subnet via IPAM and RESERVE it (so it's never re-handed-out),
+  // idempotently (reuse the stored value on re-generate). The resolver's
+  // on_install passes it to firewall.exposeService({ ingressIp }).
+  const wantsDnsIngress = manifest.variables?.owns?.some(
+    (v) => v.name === 'dns_ingress_ip' && v.source === 'infrastructure',
+  );
+  if (wantsDnsIngress) {
+    const existing = getModuleConfigValue(moduleId, 'dns_ingress_ip', db)?.value;
+    if (typeof existing === 'string' && existing.length > 0) {
+      log.success(`Using existing DNS-ingress IP ${existing} for ${moduleId}`);
+    } else {
+      const subnetRow = db.$client
+        .prepare('SELECT value FROM system_config WHERE key = ?')
+        .get('network.internal.subnet') as { value: string } | undefined;
+      if (!subnetRow?.value) {
+        return {
+          success: false,
+          error:
+            'network.internal.subnet is not configured — required to allocate the ' +
+            'dns_internal DNS-ingress IP (ISS-0156). Ensure the internal network is set up first.',
+        };
+      }
+      const { allocateIPFromSubnet, reserveIP } = await import('../ipam/allocator');
+      const { stripCIDR } = await import('../ipam/subnet-parser');
+      try {
+        const ip = stripCIDR(await allocateIPFromSubnet(subnetRow.value, 'internal', db));
+        await reserveIP(ip, 'internal', `dns-ingress:${moduleId}`, null, db);
+        upsertModuleConfig(db, moduleId, 'dns_ingress_ip', ip);
+        log.success(`Allocated DNS-ingress IP ${ip} (internal subnet) for ${moduleId}`);
+      } catch (error) {
+        return {
+          success: false,
+          error: `DNS-ingress IP allocation failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+      }
+    }
+  }
+
   // Infrastructure Properties Resolution (Proxmox provider config)
   // For Proxmox services, extract provider config and store as temporary values
   // This happens during generation so templates can access target_node, lxc_template, etc.

package/src/variables/context.ts

@@ -8,6 +8,7 @@ import {
   machines,
   moduleConfigs,
   moduleInfrastructure,
+  moduleSystems,
   modules,
   secrets,
   systemConfig,
@@ -264,20 +265,48 @@ export async function buildResolutionContext(
     const systemResources = getSingularSystemSpec(manifest);
 
     if (systemResources) {
-      // Map manifest fields to module variable names and apply defaults
+      // The DEPLOYED size is the SYSTEM's canonical state (ISS-0150), seeded from
+      // requires.system at first provision and thereafter owned by
+      // `celilo proxmox … resize`. So sizing flows: module_systems → these config
+      // vars → `$self:{cores,memory,disk}` in the instance Terraform.
+      //
+      // Precedence: the recorded system size WINS and overwrites the cached
+      // config (a resize must propagate on the next generate); only when this
+      // module has no recorded system size yet (the very first provision, before
+      // recordDeployedSystemForModule runs below) do we fall back to
+      // requires.system — and seed-when-unset, matching the prior behavior so the
+      // first-deploy / golden output is unchanged. `requires.system` stays the
+      // minimum floor, never the canonical size. (CLAUDE.md / ISS-0150.)
+      const sizedRow = db
+        .select({
+          cpu: moduleSystems.cpu,
+          memory: moduleSystems.memory,
+          disk: moduleSystems.disk,
+        })
+        .from(moduleSystems)
+        .where(eq(moduleSystems.moduleId, moduleId))
+        .all()
+        .find((r) => r.cpu != null || r.memory != null || r.disk != null);
+
       const resourceMappings: Array<{
         manifestKey: keyof typeof systemResources;
         configKey: string;
+        systemValue: number | null | undefined;
       }> = [
-        { manifestKey: 'cpu', configKey: 'cores' }, // manifest.requires.system.cpu → cores variable
-        { manifestKey: 'memory', configKey: 'memory' },
-        { manifestKey: 'disk', configKey: 'disk' },
-        { manifestKey: 'storage', configKey: 'storage' },
+        { manifestKey: 'cpu', configKey: 'cores', systemValue: sizedRow?.cpu }, // requires.system.cpu → cores
+        { manifestKey: 'memory', configKey: 'memory', systemValue: sizedRow?.memory },
+        { manifestKey: 'disk', configKey: 'disk', systemValue: sizedRow?.disk },
+        { manifestKey: 'storage', configKey: 'storage', systemValue: undefined }, // pool name, not sizing
       ];
 
-      for (const { manifestKey, configKey } of resourceMappings) {
+      for (const { manifestKey, configKey, systemValue } of resourceMappings) {
+        if (systemValue != null) {
+          // Canonical system size — always wins so a resize propagates.
+          upsertModuleConfig(db, moduleId, configKey, systemValue);
+          selfConfig[configKey] = String(systemValue);
+          continue;
+        }
         const value = systemResources[manifestKey];
-
         // Manifest fields are typed (cpu: number, storage: string, etc.).
         // Pass them through unstringified so valueJson preserves the
         // shape — see comment in the variable-defaults block above.