@celilo/cli 1.14.0 → 2.1.0

package/src/services/module-build.ts

@@ -1,7 +1,7 @@
 /**
  * Module Build Service
  *
- * Executes module build scripts (Ansible playbooks) in Nix environments
+ * Executes module build scripts (Ansible playbooks)
  * to compile custom software binaries before deployment.
  *
  * Example: Caddy with RFC2136 DNS provider
@@ -40,65 +40,26 @@ export interface BuildStatusRecord {
   buildLog?: string;
 }
 
-/**
- * Detect if module uses Nix environment
- * Policy function - checks for flake.nix existence
- *
- * @param modulePath - Path to module directory
- * @returns True if flake.nix exists
- */
-function detectNixEnvironment(modulePath: string): boolean {
-  const flakePath = `${modulePath}/flake.nix`;
-  return existsSync(flakePath);
-}
-
-/**
- * Check if nix command is available
- * Policy function - validates nix availability
- *
- * @returns True if nix command can be executed
- */
-async function isNixAvailable(): Promise<boolean> {
-  const { spawn } = await import('node:child_process');
-
-  return new Promise((resolve) => {
-    const child = spawn('nix', ['--version'], {
-      stdio: 'ignore',
-    });
-
-    child.on('close', (code) => {
-      resolve(code === 0);
-    });
-
-    child.on('error', () => {
-      resolve(false);
-    });
-  });
-}
-
 /**
  * Execute build playbook with streaming progress
  * Execution function - runs ansible-playbook with fuel-gauge progress indicator
  *
  * @param modulePath - Path to module directory
- * @param playbookPath - Path to build playbook (relative to module)
- * @param useNix - Whether to run inside Nix environment
+ * @param commandStr - Build command to execute
  * @returns Build result with output
  */
 async function executeBuildCommand(
   modulePath: string,
   commandStr: string,
-  useNix: boolean,
 ): Promise<{ success: boolean; output: string; error?: string }> {
   const { executeBuildWithProgress } = await import('./build-stream');
-  const { shellEscape } = await import('../utils/shell');
 
   // build-stream passes through `shell: true`, so spawn re-wraps everything in
   // `/bin/sh -c`. If we sent ['bash', '-c', commandStr] as command+args, sh
   // would re-parse the join — `&&` outside the inner quotes splits the chain
   // and `bun install` runs in modulePath instead of the cd'd subdir. Pass the
   // full command as one string so sh -c gets a single, unsplit shell command.
-  const command = useNix ? `nix develop --command bash -c ${shellEscape(commandStr)}` : commandStr;
+  const command = commandStr;
 
   const result = await executeBuildWithProgress({
     command,
@@ -117,7 +78,6 @@ async function executeBuildCommand(
 async function executeBuildScript(
   modulePath: string,
   scriptPath: string,
-  useNix: boolean,
 ): Promise<{ success: boolean; output: string; error?: string }> {
   const fullScriptPath = `${modulePath}/${scriptPath}`;
 
@@ -132,11 +92,7 @@ async function executeBuildScript(
   let command: string;
   let args: string[];
 
-  if (useNix) {
-    const innerCommand = isShellScript ? 'bash' : 'ansible-playbook';
-    command = 'nix';
-    args = ['develop', '--command', innerCommand, scriptPath];
-  } else if (isShellScript) {
+  if (isShellScript) {
     command = 'bash';
     args = [scriptPath];
   } else {
@@ -207,7 +163,6 @@ function formatBytes(bytes: number): string {
  * @param artifacts - List of artifact paths
  * @param status - Build status
  * @param buildLog - Build output log
- * @param environment - Build environment (nix or system)
  * @param db - Database client
  */
 async function recordBuildMetadata(
@@ -216,7 +171,6 @@ async function recordBuildMetadata(
   artifacts: string[],
   status: BuildStatus,
   buildLog: string,
-  environment: 'nix' | 'system' | null,
   db: DbClient,
 ): Promise<void> {
   await db.insert(moduleBuilds).values({
@@ -225,7 +179,6 @@ async function recordBuildMetadata(
     artifacts,
     status,
     buildLog,
-    environment,
   });
 }
 
@@ -268,38 +221,18 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
     };
   }
 
-  // Detect Nix environment and verify availability
-  const nixDetected = detectNixEnvironment(modulePath);
-  const nixAvailable = nixDetected ? await isNixAvailable() : false;
-  const useNix = nixDetected && nixAvailable;
-  const environment: 'nix' | 'system' = useNix ? 'nix' : 'system';
-
-  if (useNix) {
-    log.info('Entering Nix environment (flake.nix detected)...');
-  } else if (nixDetected && !nixAvailable) {
-    log.warn('flake.nix detected but nix command not available - using system Ansible');
-  }
-
   try {
     // Execute build script with streaming progress
     const buildResult = command
-      ? await executeBuildCommand(modulePath, command, useNix)
-      : await executeBuildScript(modulePath, script as string, useNix);
+      ? await executeBuildCommand(modulePath, command)
+      : await executeBuildScript(modulePath, script as string);
 
     // Check if build command failed
     if (!buildResult.success) {
       const errorMsg = buildResult.error || 'Build command failed';
 
       // Record failed build
-      await recordBuildMetadata(
-        moduleId,
-        manifest.version,
-        [],
-        'failed',
-        buildResult.output,
-        environment,
-        db,
-      );
+      await recordBuildMetadata(moduleId, manifest.version, [], 'failed', buildResult.output, db);
 
       return {
         success: false,
@@ -327,7 +260,6 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
           [],
           'failed',
           `${buildLog}\n\n${errorMsg}`,
-          environment,
           db,
         );
 
@@ -346,15 +278,7 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
 
       // Record successful build
       const artifactPaths = verification.map((v) => v.path);
-      await recordBuildMetadata(
-        moduleId,
-        manifest.version,
-        artifactPaths,
-        'success',
-        buildLog,
-        environment,
-        db,
-      );
+      await recordBuildMetadata(moduleId, manifest.version, artifactPaths, 'success', buildLog, db);
 
       return {
         success: true,
@@ -364,7 +288,7 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
     }
 
     // No artifacts defined, just record success
-    await recordBuildMetadata(moduleId, manifest.version, [], 'success', buildLog, environment, db);
+    await recordBuildMetadata(moduleId, manifest.version, [], 'success', buildLog, db);
 
     return {
       success: true,
@@ -376,7 +300,7 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
     const buildLog = `Build failed: ${errorMsg}`;
 
     // Record failed build
-    await recordBuildMetadata(moduleId, manifest.version, [], 'failed', buildLog, environment, db);
+    await recordBuildMetadata(moduleId, manifest.version, [], 'failed', buildLog, db);
 
     return {
       success: false,

package/src/services/module-deploy.ts

@@ -30,11 +30,13 @@ import {
   interviewForMissingSecrets,
 } from './config-interview';
 import { getContainerService } from './container-service';
+import { bootstrapControlPlane } from './control-plane-bootstrap';
 import { executeAnsible } from './deploy-ansible';
 import { planDeployment } from './deploy-planner';
 import { waitForSSH } from './deploy-ssh';
 import { executeTerraform, parseTerraformOutputs } from './deploy-terraform';
 import { validateAndPrepareDeployment } from './deploy-validation';
+import { CONTROL_PLANE_MODULE_ID } from './deployed-systems';
 import { getModuleSystems } from './deployed-systems';
 import { E2E_CONFLICT_MESSAGE, runningE2eContainers } from './e2e-guard';
 import { resolveInfrastructureVariables } from './infrastructure-variable-resolver';
@@ -46,6 +48,7 @@ import {
   runProviderBackfill,
 } from './provider-arrival';
 import { checkProxmoxReachable, formatProxmoxUnreachableError } from './proxmox-preflight';
+import { remoteAccessPolicy } from './remote-access';
 import { LOCAL_MACHINE_IP, deleteTemporarySshKey, writeTemporarySshKey } from './ssh-key-manager';
 import { buildTerraformEnvForService } from './terraform-env';
 
@@ -720,6 +723,7 @@ async function deployModuleImpl(
             capabilities: capabilityFunctions,
             requiredCapabilities: manifest.requires.capabilities.map((c) => c.name),
             systems: getModuleSystems(moduleId, db),
+            remoteAccess: remoteAccessPolicy(moduleId, db),
           },
         );
 
@@ -858,6 +862,7 @@ async function deployModuleImpl(
                 capabilities: capFns,
                 requiredCapabilities: (manifest.requires?.capabilities ?? []).map((c) => c.name),
                 systems: getModuleSystems(moduleId, db),
+                remoteAccess: remoteAccessPolicy(moduleId, db),
               },
             };
           },
@@ -1159,6 +1164,7 @@ async function deployModuleImpl(
             capabilities: capFunctions,
             requiredCapabilities: providerManifest.requires.capabilities.map((c) => c.name),
             systems: getModuleSystems(capRecord.moduleId, db),
+            remoteAccess: remoteAccessPolicy(capRecord.moduleId, db),
           },
         );
 
@@ -1308,6 +1314,21 @@ async function deployModuleImpl(
       }
     }
 
+    // The provider's own deploy runs the static-content converge alongside
+    // everything else (design D10, task 4.5): the release set is written into
+    // the generated inventory, the playbook's static_content-tagged tasks
+    // converge /srv/www, and a rebuilt host recovers with no consumer
+    // involvement. Same plan + writer the publish-time converge uses — one
+    // code path, two callers.
+    if (manifest.provides?.capabilities?.some((cap) => cap.name === 'public_web')) {
+      const { writeStaticContentVars } = await import('./static-content-converge');
+      const staticVars = await writeStaticContentVars(db, moduleId, generatedPath);
+      if (!staticVars.success) {
+        return { success: false, error: staticVars.error, phases };
+      }
+      log.success('Static-content release set written to the inventory');
+    }
+
     try {
       const ansibleResult = await executeAnsible(generatedPath, {
         noInteractive: !process.stdout.isTTY,
@@ -1332,6 +1353,55 @@ async function deployModuleImpl(
         // container ID/IP got assigned per module in the DB.
       }
 
+      // celilo initialises its own box, in its own process.
+      //
+      // This was `celilo-mgmt`'s `on_install` hook until celilo#1225. The hook
+      // reached every one of these operations by spawning the `celilo` CLI,
+      // which a jailed hook cannot do — the mount set binds no `/usr/bin`, no
+      // `/usr/local/bin` and no shell — so the deploy ran Ansible to completion
+      // and then died in its own install hook on any host with a jail backend.
+      //
+      // It runs at the point the hook used to, for the reason the hook ran
+      // there: the Ansible role has just installed celilo and started the
+      // dispatcher, and none of this can be read before that.
+      if (moduleId === CONTROL_PLANE_MODULE_ID) {
+        log.success('Initializing celilo management state');
+        try {
+          const bootstrap = await bootstrapControlPlane({ db });
+
+          log.info(`  DNS: primary ${bootstrap.dns.primary}, fallback ${bootstrap.dns.fallback}`);
+          for (const applied of bootstrap.network.applied) {
+            log.info(`  Network: ${applied}`);
+          }
+          if (bootstrap.network.skipped) {
+            log.warn(`  Network not recorded: ${bootstrap.network.skipped}`);
+          }
+          // The operator authorises this key on every machine celilo manages,
+          // so it is printed rather than merely stored. It was the loudest line
+          // the hook produced and it stays the loudest line here.
+          log.success(
+            `celilo fleet SSH key — add this public key to machines celilo will manage:\n${bootstrap.fleetKey.publicKey}`,
+          );
+
+          if (bootstrap.dispatcher.status === 'fail') {
+            // A management plane with no dispatcher is broken: event-driven
+            // reconciles never deliver. Fail the install, do not whisper.
+            log.error(`Dispatcher check failed: ${bootstrap.dispatcher.summary}`);
+            return {
+              success: false,
+              phases,
+              error:
+                `celilo-mgmt: ${bootstrap.dispatcher.summary}. ${bootstrap.dispatcher.remediation ?? ''}`.trim(),
+            };
+          }
+          log.success(`Event dispatcher is live (${bootstrap.dispatcher.summary})`);
+        } catch (err) {
+          const detail = err instanceof Error ? err.message : String(err);
+          log.error(`Initializing celilo management state failed: ${detail}`);
+          return { success: false, phases, error: detail };
+        }
+      }
+
       // Run on_install hook (post-deploy actions like port forwarding, DNS registration)
       if (manifest.hooks?.on_install) {
         const onInstallDef = manifest.hooks.on_install;
@@ -1412,6 +1482,7 @@ async function deployModuleImpl(
                 capabilities: capFns,
                 requiredCapabilities: manifest.requires.capabilities.map((c) => c.name),
                 systems: getModuleSystems(moduleId, db),
+                remoteAccess: remoteAccessPolicy(moduleId, db),
               },
             };
           },

package/src/services/remote-access.test.ts

@@ -0,0 +1,223 @@
+/**
+ * D12's reachability policy (hook-process-boundary stage 3, tasks 5.1b/5.2).
+ *
+ * The rules under test, in the order they short-circuit:
+ *   1. a request on the module's OWN credential is allowed — the credential is
+ *      the scope;
+ *   2. an explicit non-root user is allowed — the fleet key's authority is
+ *      root on fleet systems, and a non-root account trusts it only where an
+ *      operator installed it (the cPanel bootstrap);
+ *   3. the target is a system the module or one of its instances provisioned;
+ *   4. or it is a machine in celilo's pool that this module's own config names
+ *      — the case a config-only manager module needs, since it provisions
+ *      nothing and so can never satisfy rule 3 (celilo#1225);
+ *
+ *   and otherwise a refusal names the module, the target, and the capability
+ *   route.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { existsSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { type DbClient, createDbClient } from '../db/client';
+import {
+  capabilities,
+  machines,
+  moduleConfigs,
+  moduleInstances,
+  moduleSystems,
+  modules,
+} from '../db/schema';
+import { remoteAccessPolicy } from './remote-access';
+
+const TEST_DB_PATH = './test-remote-access.db';
+
+function seedModule(db: DbClient, id: string): void {
+  db.insert(modules)
+    .values({
+      id,
+      name: id,
+      version: '1.0.0',
+      manifestData: {},
+      sourcePath: `/tmp/${id}`,
+      state: 'VERIFIED',
+    })
+    .run();
+}
+
+function seedSystem(db: DbClient, moduleId: string, ipv4Address: string, hostname: string): void {
+  db.insert(moduleSystems)
+    .values({
+      moduleId,
+      name: 'main',
+      hostname,
+      ipv4Address,
+      zone: 'dmz',
+      infraType: 'machine',
+      updatedAt: new Date(),
+    })
+    .run();
+}
+
+/** A box the operator admitted to celilo's pool. */
+function seedPoolMachine(db: DbClient, ipAddress: string, hostname: string): void {
+  db.insert(machines)
+    .values({
+      id: `machine-${hostname}`,
+      hostname,
+      zone: 'internal',
+      ipAddress,
+      sshUser: 'root',
+      sshKeyEncrypted: 'x',
+      hardware: { cpu_cores: 1, memory_mb: 512, disk_gb: 8 },
+    })
+    .run();
+}
+
+/** A config value the operator set on a module. */
+function seedConfig(db: DbClient, moduleId: string, key: string, value: string): void {
+  db.insert(moduleConfigs).values({ moduleId, key, value }).run();
+}
+
+describe('remoteAccessPolicy', () => {
+  let db: DbClient;
+
+  beforeEach(() => {
+    db = createDbClient({ path: TEST_DB_PATH });
+    seedModule(db, 'caddy');
+    seedSystem(db, 'caddy', '10.0.10.10', 'www');
+    seedModule(db, 'homebridge');
+    seedSystem(db, 'homebridge', '10.0.30.7', 'homebridge');
+    db.insert(capabilities)
+      .values({ moduleId: 'caddy', capabilityName: 'public_web', version: '1.0.0', data: {} })
+      .run();
+  });
+
+  afterEach(async () => {
+    db.$client.close();
+    for (const suffix of ['', '-shm', '-wal']) {
+      const p = `${TEST_DB_PATH}${suffix}`;
+      if (existsSync(p)) await rm(p);
+    }
+  });
+
+  test("allows the module's own system", () => {
+    const policy = remoteAccessPolicy('caddy', db);
+    expect(policy.checkTarget({ ipv4_address: '10.0.10.10' }, false)).toEqual({ allowed: true });
+  });
+
+  test("allows an instance's system, one level deep", () => {
+    seedModule(db, 'forgejo-runner-abc123def456');
+    db.insert(moduleInstances)
+      .values({
+        moduleId: 'forgejo-runner-abc123def456',
+        parentId: 'homebridge',
+        submodule: 'runner',
+        instanceKey: 'lab',
+        state: 'ready',
+      })
+      .run();
+    seedSystem(db, 'forgejo-runner-abc123def456', '10.0.30.9', 'runner-lab');
+
+    const policy = remoteAccessPolicy('homebridge', db);
+    expect(policy.checkTarget({ ipv4_address: '10.0.30.9' }, false)).toEqual({ allowed: true });
+  });
+
+  test("refuses another module's system, naming module, target and the capability route", () => {
+    const verdict = remoteAccessPolicy('homebridge', db).checkTarget(
+      { ipv4_address: '10.0.10.10' },
+      false,
+    );
+    expect(verdict.allowed).toBe(false);
+    if (verdict.allowed) throw new Error('unreachable');
+    expect(verdict.message).toContain("Module 'homebridge'");
+    expect(verdict.message).toContain('10.0.10.10');
+    expect(verdict.message).toContain("belongs to module 'caddy'");
+    expect(verdict.message).toContain('public_web');
+  });
+
+  test('refuses an address no deployed system has, with the generic guidance', () => {
+    const verdict = remoteAccessPolicy('homebridge', db).checkTarget(
+      { ipv4_address: '203.0.113.50' },
+      false,
+    );
+    expect(verdict.allowed).toBe(false);
+    if (verdict.allowed) throw new Error('unreachable');
+    expect(verdict.message).toContain("Module 'homebridge'");
+    expect(verdict.message).toContain('203.0.113.50');
+    expect(verdict.message).toContain('capability');
+  });
+
+  test('allows any target when the request carries its own credential', () => {
+    const policy = remoteAccessPolicy('homebridge', db);
+    expect(policy.checkTarget({ ipv4_address: '10.0.10.10' }, true)).toEqual({ allowed: true });
+  });
+
+  test('allows an explicit non-root user (the off-fleet account case)', () => {
+    const policy = remoteAccessPolicy('generic-cpanel-hosting-provider', db);
+    expect(
+      policy.checkTarget({ ipv4_address: '198.51.100.7', user: 'peba-hosting' }, false),
+    ).toEqual({ allowed: true });
+  });
+
+  test("an explicit 'root' user gets no such pass", () => {
+    const verdict = remoteAccessPolicy('homebridge', db).checkTarget(
+      { ipv4_address: '10.0.10.10', user: 'root' },
+      false,
+    );
+    expect(verdict.allowed).toBe(false);
+  });
+
+  describe('a config-only module managing a pool machine (celilo#1225)', () => {
+    // `iptables` is the archetype: it configures a pre-existing firewall and is
+    // deployed onto nothing, so `module_systems` holds no row for it EVER. Rule
+    // 3 is unsatisfiable for it by construction, not by timing.
+    const FIREWALL = '10.226.1.254';
+
+    beforeEach(() => {
+      seedModule(db, 'iptables');
+    });
+
+    test("allows a pool machine this module's config names", () => {
+      seedPoolMachine(db, FIREWALL, 'fw-main');
+      seedConfig(db, 'iptables', 'firewall_ip', FIREWALL);
+
+      expect(
+        remoteAccessPolicy('iptables', db).checkTarget({ ipv4_address: FIREWALL }, false),
+      ).toEqual({ allowed: true });
+    });
+
+    test('pool membership ALONE is not authorization', () => {
+      // Otherwise any module could reach every box celilo knows about, which is
+      // far wider than the rule this policy states.
+      seedPoolMachine(db, FIREWALL, 'fw-main');
+
+      const result = remoteAccessPolicy('iptables', db).checkTarget(
+        { ipv4_address: FIREWALL },
+        false,
+      );
+      expect(result.allowed).toBe(false);
+    });
+
+    test('config ALONE is not authorization', () => {
+      // A module names its own config keys. If naming an address were enough, a
+      // module could point itself at any box in the world.
+      seedConfig(db, 'iptables', 'firewall_ip', FIREWALL);
+
+      const result = remoteAccessPolicy('iptables', db).checkTarget(
+        { ipv4_address: FIREWALL },
+        false,
+      );
+      expect(result.allowed).toBe(false);
+    });
+
+    test("one module's config does not unlock another module's box", () => {
+      seedPoolMachine(db, FIREWALL, 'fw-main');
+      seedConfig(db, 'iptables', 'firewall_ip', FIREWALL);
+
+      // caddy has its own systems and no config naming the firewall.
+      const result = remoteAccessPolicy('caddy', db).checkTarget({ ipv4_address: FIREWALL }, false);
+      expect(result.allowed).toBe(false);
+    });
+  });
+});