@celilo/cli 0.8.2 → 0.9.0

package/src/cli/commands/proxmox-instance-resize.ts

@@ -0,0 +1,235 @@
+/**
+ * `celilo proxmox vm resize <name> --memory <MB> [--cpu <n>]` (and `ct resize`) —
+ * the canonical resize for a celilo-provisioned instance (ISS-0150 P2). Updates
+ * the SYSTEM's canonical size in module_systems, then reconciles declaratively by
+ * redeploying the owning module (its Terraform now reads the system size).
+ *
+ * Guardrails (proxmox-resize-guards.ts): floor = max(requires.system) across
+ * co-hosted modules (hard); node capacity (overridable with --force). Reboot +
+ * pre-resize backup are confirmed via the event-bus interview (CLAUDE.md: no
+ * direct CLI prompts) — flags win: --allow-reboot / --skip-backup / --yes.
+ */
+
+import { and, eq } from 'drizzle-orm';
+import { ProxmoxClient, type ProxmoxCredentials } from '../../api-clients/proxmox';
+import { getDb } from '../../db/client';
+import { moduleSystems, modules } from '../../db/schema';
+import { type ModuleManifest, getSingularSystemSpec } from '../../manifest/schema';
+import { createModuleBackup } from '../../services/backup-create';
+import { askConfirm, withInterviewSession } from '../../services/bus-interview';
+import { getServiceCredentials, listContainerServices } from '../../services/container-service';
+import { getProvisionedSystems } from '../../services/deployed-systems';
+import { deployModule } from '../../services/module-deploy';
+import { celiloIntro } from '../prompts';
+import type { CommandResult } from '../types';
+import type { InstanceKind } from './proxmox-instance-list';
+import { computeFloor, validateResize } from './proxmox-resize-guards';
+import { resolveProxmoxService } from './proxmox-service';
+
+const PROXMOX_TYPE: Record<InstanceKind, string> = { vm: 'qemu', ct: 'lxc' };
+
+function numFlag(v: string | boolean | undefined): number | undefined {
+  if (typeof v !== 'string') return undefined;
+  const n = Number.parseInt(v, 10);
+  return Number.isNaN(n) ? undefined : n;
+}
+
+export async function handleProxmoxInstanceResize(
+  kind: InstanceKind,
+  args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  celiloIntro(`Resize ${kind === 'vm' ? 'VM' : 'container'}`);
+
+  const name = args[0];
+  if (!name) {
+    const e = `Instance name required: celilo proxmox ${kind} resize <name> --memory <MB> [--cpu <n>]`;
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+
+  if (numFlag(flags.disk) != null) {
+    const e = 'Disk resize is deferred (ISS-0150 D4). Use --memory / --cpu for now.';
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+  const reqCpu = numFlag(flags.cpu);
+  const reqMemory = numFlag(flags.memory);
+  if (reqCpu == null && reqMemory == null) {
+    const e = 'Specify at least one of --memory <MB> or --cpu <n>.';
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+
+  const resolved = resolveProxmoxService(await listContainerServices(), undefined);
+  if ('error' in resolved) {
+    console.log(`✗ ${resolved.error}`);
+    return { success: false, error: resolved.error };
+  }
+  const { service } = resolved;
+  const creds = (await getServiceCredentials(service.id)) as ProxmoxCredentials;
+  const client = new ProxmoxClient(creds);
+
+  const cluster = await client.clusterResources();
+  if (!cluster.success) {
+    console.log(`✗ Could not reach Proxmox: ${cluster.message}`);
+    return { success: false, error: cluster.message };
+  }
+  const wantType = PROXMOX_TYPE[kind];
+  const guestByVmid = new Map<number, (typeof cluster.data)[number]>();
+  for (const r of cluster.data) {
+    if (r.type === wantType && typeof r.vmid === 'number') guestByVmid.set(r.vmid, r);
+  }
+
+  const db = getDb();
+  const systems = getProvisionedSystems(db);
+  const matches = systems.filter(
+    (s) =>
+      s.vmid != null &&
+      guestByVmid.has(s.vmid) &&
+      (s.hostname === name || s.name === name || s.moduleId === name),
+  );
+  if (matches.length === 0) {
+    const e = `No celilo-provisioned ${kind} named '${name}'. Try: celilo proxmox ${kind} list`;
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+  if (matches.length > 1) {
+    const e = `Ambiguous '${name}' — matches ${matches.map((m) => m.moduleId).join(', ')}`;
+    console.log(`✗ ${e}`);
+    return { success: false, error: e };
+  }
+  const target = matches[0];
+  const vmid = target.vmid as number;
+  const guest = guestByVmid.get(vmid);
+  const node = guest?.node;
+
+  // Co-hosted = every module recorded on the same physical instance (vmid).
+  const coHosted = systems.filter((s) => s.vmid === vmid);
+  const mins = coHosted.map((s) => {
+    const mod = db.select().from(modules).where(eq(modules.id, s.moduleId)).get();
+    const spec = mod ? getSingularSystemSpec(mod.manifestData as ModuleManifest) : undefined;
+    return { cpu: spec?.cpu, memory: spec?.memory, disk: spec?.disk };
+  });
+  const floor = computeFloor(mins);
+
+  const nodeCaps = await client.nodeCapacities();
+  const nodeCap = nodeCaps.success ? nodeCaps.data.find((n) => n.node === node) : undefined;
+
+  const decision = validateResize(
+    { cpu: reqCpu, memory: reqMemory },
+    {
+      current: { cpu: target.cpu, memory: target.memory, disk: target.disk },
+      floor,
+      nodeFreeMemMb: nodeCap?.memFreeMb ?? Number.POSITIVE_INFINITY,
+      nodeTotalCores: nodeCap?.cpuCores ?? Number.POSITIVE_INFINITY,
+    },
+    { force: flags.force === true },
+  );
+
+  if (decision.errors.length > 0) {
+    console.log('✗ Resize rejected:');
+    for (const err of decision.errors) console.log(`   - ${err}`);
+    if (decision.capacityOnly) console.log('   (pass --force to override the capacity check)');
+    return { success: false, error: decision.errors.join('; ') };
+  }
+
+  const yes = flags.yes === true;
+  const coHostedIds = coHosted.map((s) => s.moduleId);
+
+  // Pre-resize backup — ON by default; --skip-backup opts out; otherwise the
+  // skip decision is an event-bus interview question (never a direct CLI prompt).
+  let doBackup: boolean;
+  if (flags['skip-backup'] === true) doBackup = false;
+  else if (yes) doBackup = true;
+  else
+    doBackup = await withInterviewSession(() =>
+      askConfirm({
+        scope: 'proxmox-resize',
+        key: 'backup',
+        message: `Take a pre-resize backup of ${coHostedIds.join(', ')} first?`,
+        defaultValue: true,
+      }),
+    );
+
+  if (doBackup) {
+    for (const s of coHosted) {
+      const mod = db.select().from(modules).where(eq(modules.id, s.moduleId)).get();
+      const manifest = mod?.manifestData as ModuleManifest | undefined;
+      if (!manifest?.hooks?.on_backup) {
+        console.log(`  ⚠ ${s.moduleId} has no on_backup hook — skipping its backup`);
+        continue;
+      }
+      const backup = await createModuleBackup(s.moduleId);
+      if (!backup.success) {
+        const e = `Pre-resize backup failed for ${s.moduleId}: ${backup.error}`;
+        console.log(`✗ ${e}`);
+        return { success: false, error: e };
+      }
+      console.log(`  ✓ Backed up ${s.moduleId}`);
+    }
+  }
+
+  // Reboot confirmation — a cpu/memory change needs a Proxmox stop/start.
+  if (decision.needsReboot) {
+    let allowReboot: boolean;
+    if (flags['allow-reboot'] === true || yes) allowReboot = true;
+    else
+      allowReboot = await withInterviewSession(() =>
+        askConfirm({
+          scope: 'proxmox-resize',
+          key: 'reboot',
+          message: `Resizing ${name} (vmid ${vmid}) requires a stop/start — brief downtime. Proceed?`,
+          defaultValue: false,
+        }),
+      );
+    if (!allowReboot) {
+      const e = 'Resize aborted — reboot not approved (re-run with --allow-reboot).';
+      console.log(`✗ ${e}`);
+      return { success: false, error: e };
+    }
+  }
+
+  // Update the canonical size on every module_systems row for this instance.
+  for (const s of coHosted) {
+    const set: { cpu?: number; memory?: number; updatedAt: Date } = { updatedAt: new Date() };
+    if (reqCpu != null) set.cpu = reqCpu;
+    if (reqMemory != null) set.memory = reqMemory;
+    db.update(moduleSystems)
+      .set(set)
+      .where(and(eq(moduleSystems.moduleId, s.moduleId), eq(moduleSystems.name, s.name)))
+      .run();
+  }
+  const effCpu = reqCpu ?? target.cpu;
+  const effMem = reqMemory ?? target.memory;
+  console.log(`✓ Canonical size updated: ${name} → ${effCpu ?? '?'}c / ${effMem ?? '?'}MB`);
+
+  // Reconcile declaratively: redeploy the owning module — its Terraform now reads
+  // the updated system size and writes it to the Proxmox VM config. The proxmox
+  // provider itself stop/starts the VM to apply a cpu/memory change (the reboot
+  // the operator approved above), so no explicit power-cycle is needed here.
+  console.log(`▸ Reconciling ${target.moduleId} (Terraform apply + VM restart)…`);
+  const deployed = await deployModule(target.moduleId, db, {});
+  if (!deployed.success) {
+    // The provider's restart-on-resize can surface a non-fatal "VM already
+    // running" and exit non-zero even though the deploy reached VERIFIED (the
+    // same deploy-over-SSH pattern noted in CLAUDE.md). Trust the module STATE
+    // over the exit code: VERIFIED means the resize landed.
+    const state = db
+      .select({ state: modules.state })
+      .from(modules)
+      .where(eq(modules.id, target.moduleId))
+      .get()?.state;
+    if (state !== 'VERIFIED') {
+      const e = `Size updated but reconcile failed: ${deployed.error}. Re-run: celilo module deploy ${target.moduleId}`;
+      console.log(`✗ ${e}`);
+      return { success: false, error: e };
+    }
+    console.log(
+      `  ⚠ reconcile exited non-zero but ${target.moduleId} is VERIFIED — treating as success`,
+    );
+  }
+
+  console.log(`✓ Resized ${name} and reconciled ${target.moduleId} (new size live).`);
+  return { success: true, message: `resized ${name}` };
+}

package/src/cli/commands/proxmox-node-list.ts

@@ -11,6 +11,7 @@ import { ProxmoxClient, type ProxmoxCredentials } from '../../api-clients/proxmo
 import { getServiceCredentials, listContainerServices } from '../../services/container-service';
 import { celiloIntro } from '../prompts';
 import type { CommandResult } from '../types';
+import { resolveProxmoxService } from './proxmox-service';
 
 function formatUptime(sec: number): string {
   if (sec <= 0) return '—';
@@ -19,40 +20,6 @@ function formatUptime(sec: number): string {
   return days > 0 ? `${days}d${hours}h` : `${hours}h`;
 }
 
-/**
- * Resolve which Proxmox service to introspect: an explicit service-id arg, else
- * the sole Proxmox service. Returns an error message when the choice is
- * ambiguous or the named service doesn't exist.
- */
-function resolveProxmoxService(
-  services: Awaited<ReturnType<typeof listContainerServices>>,
-  requested: string | undefined,
-): { service: (typeof services)[number] } | { error: string } {
-  const proxmox = services.filter((s) => s.providerName === 'proxmox');
-  if (proxmox.length === 0) {
-    return {
-      error: 'No Proxmox container service configured. Add one: celilo service add proxmox',
-    };
-  }
-  if (requested) {
-    const match = proxmox.find((s) => s.serviceId === requested);
-    if (!match) {
-      return {
-        error: `No Proxmox service '${requested}'. Known: ${proxmox.map((s) => s.serviceId).join(', ')}`,
-      };
-    }
-    return { service: match };
-  }
-  if (proxmox.length > 1) {
-    return {
-      error: `Multiple Proxmox services — specify one: celilo proxmox node list <service-id>\n  ${proxmox
-        .map((s) => s.serviceId)
-        .join('\n  ')}`,
-    };
-  }
-  return { service: proxmox[0] };
-}
-
 export async function handleProxmoxNodeList(
   args: string[],
   _flags: Record<string, boolean | string> = {},

package/src/cli/commands/proxmox-resize-guards.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from 'bun:test';
+import { type ResizeContext, computeFloor, validateResize } from './proxmox-resize-guards';
+
+const ctx = (over: Partial<ResizeContext> = {}): ResizeContext => ({
+  current: { cpu: 4, memory: 8192, disk: 80 },
+  floor: { cpu: 4, memory: 8192, disk: 80 },
+  nodeFreeMemMb: 20000,
+  nodeTotalCores: 6,
+  ...over,
+});
+
+describe('validateResize (ISS-0150)', () => {
+  test('a valid memory bump within headroom passes and needs a reboot', () => {
+    const d = validateResize({ memory: 16384 }, ctx());
+    expect(d.errors).toEqual([]);
+    expect(d.needsReboot).toBe(true);
+    expect(d.effective).toEqual({ cpu: 4, memory: 16384, disk: 80 });
+  });
+
+  test('below the floor is rejected (hard, not overridable)', () => {
+    const d = validateResize({ memory: 4096 }, ctx(), { force: true });
+    expect(d.errors.length).toBe(1);
+    expect(d.errors[0]).toContain('below the module minimum');
+  });
+
+  test('memory growth beyond node free RAM is a capacity error, overridable with --force', () => {
+    const tight = ctx({ nodeFreeMemMb: 1000 }); // only 1 GB free; +8 GB requested
+    const blocked = validateResize({ memory: 16384 }, tight, { force: false });
+    expect(blocked.errors.length).toBe(1);
+    expect(blocked.capacityOnly).toBe(true);
+    const forced = validateResize({ memory: 16384 }, tight, { force: true });
+    expect(forced.errors).toEqual([]);
+  });
+
+  test('cpu above physical cores is a capacity error', () => {
+    const d = validateResize({ cpu: 8 }, ctx(), { force: false });
+    expect(d.errors[0]).toContain('exceeds node physical cores');
+    expect(validateResize({ cpu: 8 }, ctx(), { force: true }).errors).toEqual([]);
+  });
+});
+
+describe('computeFloor', () => {
+  test('takes the max of each field across co-hosted modules', () => {
+    expect(
+      computeFloor([
+        { cpu: 2, memory: 4096, disk: 40 },
+        { cpu: 4, memory: 2048, disk: 80 },
+      ]),
+    ).toEqual({ cpu: 4, memory: 4096, disk: 80 });
+  });
+
+  test('treats missing minimums as 0', () => {
+    expect(computeFloor([{ memory: 8192 }, {}])).toEqual({ cpu: 0, memory: 8192, disk: 0 });
+  });
+});

package/src/cli/commands/proxmox-resize-guards.ts

@@ -0,0 +1,102 @@
+/**
+ * Pure guardrails for `celilo proxmox … resize` (ISS-0150 D4). Kept separate from
+ * the command so the floor + capacity logic is unit-testable without Proxmox or a
+ * DB. See apps/celilo/designs/PROXMOX_INSTANCE_SIZING.md.
+ */
+
+export interface ResizeRequest {
+  cpu?: number;
+  memory?: number; // MB
+  disk?: number; // GB
+}
+
+export interface ResizeContext {
+  /** Current canonical size of the system (null where unknown). */
+  current: { cpu: number | null; memory: number | null; disk: number | null };
+  /**
+   * Minimum floor — `max(requires.system.<field>)` across every module co-hosted
+   * on this system. A resize may never drop below any tenant's minimum.
+   */
+  floor: { cpu: number; memory: number; disk: number };
+  /** Free RAM on the target node — memory growth must fit (delta check). */
+  nodeFreeMemMb: number;
+  /** Physical cores on the target node — a VM's vCPU can't exceed this (absolute). */
+  nodeTotalCores: number;
+}
+
+export interface ResizeDecision {
+  /** Hard errors that block the resize (unless overridden where noted). */
+  errors: string[];
+  /** The size that would be applied (requested fields merged over current). */
+  effective: { cpu: number | null; memory: number | null; disk: number | null };
+  /** cpu/memory changes need a Proxmox stop/start; disk-only growth does not. */
+  needsReboot: boolean;
+  /** True when the only blocker is capacity (so `--force` can override). */
+  capacityOnly: boolean;
+}
+
+/**
+ * Validate a resize request against the floor and node capacity. Disk shrink is
+ * rejected (qemu can't shrink safely); disk resize is otherwise deferred
+ * (D4) — callers should reject a disk change until that lands, but the floor/grow
+ * checks are here for when it does.
+ */
+export function validateResize(
+  req: ResizeRequest,
+  ctx: ResizeContext,
+  opts: { force: boolean } = { force: false },
+): ResizeDecision {
+  const effective = {
+    cpu: req.cpu ?? ctx.current.cpu,
+    memory: req.memory ?? ctx.current.memory,
+    disk: req.disk ?? ctx.current.disk,
+  };
+
+  const floorErrors: string[] = [];
+  if (req.cpu != null && req.cpu < ctx.floor.cpu) {
+    floorErrors.push(`cpu ${req.cpu} is below the module minimum (${ctx.floor.cpu})`);
+  }
+  if (req.memory != null && req.memory < ctx.floor.memory) {
+    floorErrors.push(`memory ${req.memory}MB is below the module minimum (${ctx.floor.memory}MB)`);
+  }
+  if (req.disk != null && req.disk < ctx.floor.disk) {
+    floorErrors.push(`disk ${req.disk}GB is below the module minimum (${ctx.floor.disk}GB)`);
+  }
+
+  const capErrors: string[] = [];
+  // cpu: a single VM's vCPU can't usefully exceed the node's physical cores.
+  if (req.cpu != null && req.cpu > ctx.nodeTotalCores) {
+    capErrors.push(`cpu ${req.cpu} exceeds node physical cores (${ctx.nodeTotalCores})`);
+  }
+  // memory: only the GROWTH beyond the current size draws on free RAM.
+  if (req.memory != null && ctx.current.memory != null) {
+    const addedMb = req.memory - ctx.current.memory;
+    if (addedMb > ctx.nodeFreeMemMb) {
+      capErrors.push(`+${addedMb}MB exceeds node free RAM (${ctx.nodeFreeMemMb}MB)`);
+    }
+  }
+
+  const capacityOnly = floorErrors.length === 0 && capErrors.length > 0;
+  // Floor is a hard floor (never overridable). Capacity is overridable with --force.
+  const errors = [...floorErrors, ...(opts.force ? [] : capErrors)];
+
+  const needsReboot = req.cpu != null || req.memory != null;
+
+  return { errors, effective, needsReboot, capacityOnly };
+}
+
+/**
+ * Compute the floor for a system from the requires.system minimums of every
+ * module co-hosted on it. Pure over the extracted minimums.
+ */
+export function computeFloor(
+  mins: Array<{ cpu?: number | null; memory?: number | null; disk?: number | null }>,
+): { cpu: number; memory: number; disk: number } {
+  const maxOf = (pick: (m: (typeof mins)[number]) => number | null | undefined): number =>
+    mins.reduce((acc, m) => Math.max(acc, pick(m) ?? 0), 0);
+  return {
+    cpu: maxOf((m) => m.cpu),
+    memory: maxOf((m) => m.memory),
+    disk: maxOf((m) => m.disk),
+  };
+}

package/src/cli/commands/proxmox-service.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared Proxmox-service resolution for the `celilo proxmox …` command tree
+ * (node list, vm/ct list|show|resize). Resolves an explicit service-id arg, else
+ * the sole Proxmox service; errors when ambiguous or unknown.
+ */
+
+import type { listContainerServices } from '../../services/container-service';
+
+type Services = Awaited<ReturnType<typeof listContainerServices>>;
+
+export function resolveProxmoxService(
+  services: Services,
+  requested: string | undefined,
+): { service: Services[number] } | { error: string } {
+  const proxmox = services.filter((s) => s.providerName === 'proxmox');
+  if (proxmox.length === 0) {
+    return {
+      error: 'No Proxmox container service configured. Add one: celilo service add proxmox',
+    };
+  }
+  if (requested) {
+    const match = proxmox.find((s) => s.serviceId === requested);
+    if (!match) {
+      return {
+        error: `No Proxmox service '${requested}'. Known: ${proxmox.map((s) => s.serviceId).join(', ')}`,
+      };
+    }
+    return { service: match };
+  }
+  if (proxmox.length > 1) {
+    return {
+      error: `Multiple Proxmox services — specify one with <service-id>:\n  ${proxmox
+        .map((s) => s.serviceId)
+        .join('\n  ')}`,
+    };
+  }
+  return { service: proxmox[0] };
+}

package/src/cli/completion.ts

@@ -248,13 +248,21 @@ export async function getCompletions(words: string[], current: number): Promise<
   // Service subcommands
   // Proxmox subcommands
   if (command === 'proxmox' && currentIndex === 1) {
-    return filterSuggestions(['node'], args[1] || '');
+    return filterSuggestions(['node', 'vm', 'ct'], args[1] || '');
   }
   if (command === 'proxmox' && args[1] === 'node' && currentIndex === 2) {
     return filterSuggestions(['list'], args[2] || '');
   }
-  // proxmox node list <service-id> — proxmox services only
-  if (command === 'proxmox' && args[1] === 'node' && args[2] === 'list' && currentIndex === 3) {
+  if (command === 'proxmox' && (args[1] === 'vm' || args[1] === 'ct') && currentIndex === 2) {
+    return filterSuggestions(['list', 'resize'], args[2] || '');
+  }
+  // proxmox <node|vm|ct> list <service-id> — proxmox services only
+  if (
+    command === 'proxmox' &&
+    (args[1] === 'node' || args[1] === 'vm' || args[1] === 'ct') &&
+    args[2] === 'list' &&
+    currentIndex === 3
+  ) {
     const services = await listContainerServices();
     const serviceIds = services.filter((s) => s.providerName === 'proxmox').map((s) => s.serviceId);
     return filterSuggestions(serviceIds, args[3] || '');

package/src/cli/index.ts

@@ -69,6 +69,8 @@ import { handleModuleUpgrade } from './commands/module-upgrade';
 import { moduleVerify } from './commands/module-verify';
 import { handleModuleVersion } from './commands/module-version';
 import { handlePackage } from './commands/package';
+import { handleProxmoxInstanceList } from './commands/proxmox-instance-list';
+import { handleProxmoxInstanceResize } from './commands/proxmox-instance-resize';
 import { handleProxmoxNodeList } from './commands/proxmox-node-list';
 import { main as runPublish } from './commands/publish';
 import { handleSecretList } from './commands/secret-list';
@@ -1822,6 +1824,19 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         error: 'Proxmox node action required (list)\n\nRun "celilo proxmox --help" for usage',
       };
     }
+    if (parsed.subcommand === 'vm' || parsed.subcommand === 'ct') {
+      const action = parsed.args[0];
+      if (action === 'list') {
+        return handleProxmoxInstanceList(parsed.subcommand, parsed.args.slice(1));
+      }
+      if (action === 'resize') {
+        return handleProxmoxInstanceResize(parsed.subcommand, parsed.args.slice(1), parsed.flags);
+      }
+      return {
+        success: false,
+        error: `Proxmox ${parsed.subcommand} action required (list, resize)\n\nRun "celilo proxmox --help" for usage`,
+      };
+    }
     return {
       success: false,
       error: `Unknown proxmox subcommand: ${parsed.subcommand}\n\nRun "celilo proxmox --help" for usage`,

package/src/db/schema.ts

@@ -392,6 +392,17 @@ export const moduleSystems = sqliteTable(
     serviceId: text('service_id').references(() => containerServices.id),
     /** Proxmox VMID — set only for proxmox containers. */
     vmid: integer('vmid'),
+    // Canonical deployed SIZE of this system (ISS-0150). For celilo-provisioned
+    // VM/LXC instances only (null for machine-pool systems celilo doesn't size).
+    // Seeded from the module's `requires.system` at first provision, then owned
+    // by `celilo proxmox … resize` — `requires.system` is only the minimum floor,
+    // never the live size. See CLAUDE.md "requires.system is the MINIMUM".
+    /** vCPU cores. */
+    cpu: integer('cpu'),
+    /** RAM in MB. */
+    memory: integer('memory'),
+    /** Root disk in GB. */
+    disk: integer('disk'),
     createdAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
     updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
   },
@@ -492,8 +503,17 @@ export const dnsInternalRecords = sqliteTable(
       .references(() => modules.id, { onDelete: 'cascade' }),
     /** The registered hostname (e.g. "git-ssh.git.celilo.computer"). */
     host: text('host').notNull(),
-    /** The A-record value celilo asked the resolver to serve. */
+    /** The A-record value celilo asked the resolver to serve — the LAN/default
+     *  answer (firewall natIp for a caddy-fronted host). */
     ip: text('ip').notNull(),
+    /**
+     * In-zone split-horizon answer (caddy's zone-routable IP), when this is a
+     * caddy-fronted hostname that needs source-based views (ISS-0156,
+     * v2/INTERNAL_DNS_ZONE_VIEWS.md). NULL for records with no zone override
+     * (per-system identity, plain A records). This column is the durable
+     * desired-state the resolver's view config is reconciled from.
+     */
+    zoneRoutableIp: text('zone_routable_ip'),
     registeredAt: integer('registered_at', { mode: 'timestamp' })
       .notNull()
       .default(sql`(unixepoch())`),

package/src/hooks/capability-loader.ts

@@ -124,6 +124,28 @@ export async function resolveFirewallNatIp(db: DbClient): Promise<string | undef
   return undefined;
 }
 
+/**
+ * Caddy's zone-routable IP — its own DMZ ingress address (`target_ip`, the same
+ * value public_web exposes as `dmz_ip`). This is the in-zone split-horizon
+ * answer (ISS-0156): clients INSIDE the segmented zones reach caddy here, since
+ * they can't route to the firewall natIp. Returns undefined when no public_web
+ * provider advertises a `target_ip`. Shared by the live public_web registration
+ * and the deploy-time backfill so both write the same `zoneRoutableValue`.
+ */
+export async function resolveCaddyZoneIp(db: DbClient): Promise<string | undefined> {
+  const webProviders = db
+    .select()
+    .from(capabilities)
+    .where(eq(capabilities.capabilityName, 'public_web'))
+    .all();
+  for (const wp of webProviders) {
+    const cfg = await loadModuleConfig(wp.moduleId, db);
+    const ip = String(cfg.target_ip ?? '').split('/')[0];
+    if (ip) return ip;
+  }
+  return undefined;
+}
+
 export async function loadCapabilityFunctions(
   consumingModuleId: string,
   db: DbClient,

package/src/manifest/template-validator.test.ts

@@ -1,6 +1,13 @@
 import { describe, expect, test } from 'bun:test';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import type { ModuleManifest } from './schema';
-import { type TemplateValidationError, formatTemplateValidationErrors } from './template-validator';
+import {
+  type TemplateValidationError,
+  formatTemplateValidationErrors,
+  validateModuleTemplates,
+} from './template-validator';
 
 /**
  * Create a minimal valid manifest for testing
@@ -66,6 +73,29 @@ describe('template-validator', () => {
       expect(system?.storage).toBe('local-lvm');
     });
 
+    test('accepts $self:{cores,memory,disk,storage} as auto-allocated sizing (ISS-0150)', async () => {
+      // ISS-0150 repointed instance Terraform to read $self:cores/memory/disk/
+      // storage, which are injected at generate time from module_systems (see
+      // variables/context.ts) — not declared in the manifest. They must validate
+      // at `module import` time like vmid/target_ip, or every VM/CT module fails
+      // to import. Regression guard: this previously errored "Self variable
+      // 'cores' not found in module configuration".
+      const manifest = createTestManifest();
+      const dir = await mkdtemp(join(tmpdir(), 'celilo-tpl-'));
+      try {
+        await mkdir(join(dir, 'terraform'), { recursive: true });
+        await writeFile(
+          join(dir, 'terraform/main.tf.tpl'),
+          'cores  = $self:cores\nmemory = $self:memory\ndisk   = $self:disk\nstorage = "$self:storage"\n',
+        );
+        const result = await validateModuleTemplates(dir, manifest);
+        expect(result.errors).toEqual([]);
+        expect(result.success).toBe(true);
+      } finally {
+        await rm(dir, { recursive: true, force: true });
+      }
+    });
+
     test('validates capability references', async () => {
       const manifest = createTestManifest({
         requires: {

package/src/manifest/template-validator.ts

@@ -73,6 +73,15 @@ const AUTO_ALLOCATED_VARIABLES = new Set([
   'gateway', // Auto-derived from zone configuration
   'target_node', // Can be auto-derived from system config
   'lxc_nameserver', // Composed at generate time from dns_internal + dns.primary (v2/LXC_INTERNAL_DNS.md)
+  // Instance sizing (ISS-0150): the instance Terraform reads $self:{cores,memory,
+  // disk,storage}, which are injected during resolution from the module_systems
+  // table (falling back to requires.system.*) — see variables/context.ts. Like
+  // vmid/target_ip they are populated at generate time, not declared in the
+  // manifest, so they are auto-allocated rather than import-time validation errors.
+  'cores', // requires.system.cpu / module_systems.cpu
+  'memory', // requires.system.memory / module_systems.memory
+  'disk', // requires.system.disk / module_systems.disk
+  'storage', // storage pool name (requires.system.storage)
 ]);
 
 /**