@celilo/cli 1.2.0 → 1.4.0

package/src/services/module-deploy.ts

@@ -932,19 +932,17 @@ async function deployModuleImpl(
     // provider type (machine / proxmox IPAM / DO outputs). This populates
     // ctx.systems for on_install and is the source of truth for system.created
     // and DNS (openspec/specs/module-systems-addressing/spec.md). API-only modules record none.
-    {
-      const { recordDeployedSystemForModule } = await import('./deployed-systems');
-      const recorded = await recordDeployedSystemForModule(
-        moduleId,
-        manifest,
-        plan.infrastructure,
-        db,
+    const { recordDeployedSystemForModule } = await import('./deployed-systems');
+    const recordedSystems = await recordDeployedSystemForModule(
+      moduleId,
+      manifest,
+      plan.infrastructure,
+      db,
+    );
+    if (recordedSystems.length > 0) {
+      log.success(
+        `Recorded ${recordedSystems.length} deployed system(s): ${recordedSystems.map((s) => `${s.hostname} (${s.ipv4_address})`).join(', ')}`,
       );
-      if (recorded.length > 0) {
-        log.success(
-          `Recorded ${recorded.length} deployed system(s): ${recorded.map((s) => `${s.hostname} (${s.ipv4_address})`).join(', ')}`,
-        );
-      }
     }
 
     if (Object.keys(resolution.resolved).length > 0) {
@@ -1152,6 +1150,62 @@ async function deployModuleImpl(
       phases.sshWait = true;
     }
 
+    // Apply the fleet's aspects to the systems THIS deploy just created, before
+    // the module's own playbook runs against them (celilo#902, design D3).
+    //
+    // A base-module aspect fans out to the systems that exist when its PROVIDER
+    // deploys and to nothing afterwards, so a host provisioned here would keep
+    // its boot-time /etc/resolv.conf and be unable to resolve any fleet-internal
+    // name — silently, with a green deploy on top. This is the inbound half.
+    //
+    // Placed here on purpose: after `waitForSSH`, so the host is proven
+    // reachable and the aspect's Ansible does not fail UNREACHABLE on a
+    // still-booting LXC; before `executeAnsible`, so the module's playbook and
+    // its `on_install` hook see a correctly configured host rather than
+    // configuring themselves on top of a broken one.
+    //
+    // FAILURE IS FATAL HERE, and that is DELIBERATELY the opposite of the
+    // outbound direction below, where a failed fan-out never fails the
+    // provider's own deploy (D4). The asymmetry is the point and is not an
+    // oversight to be tidied up: an inbound aspect is a PREREQUISITE of the host
+    // being configured right now, so continuing would configure a host celilo
+    // knows is misconfigured — exactly the outcome celilo#902 produced. Nothing
+    // is rolled back: the rows, the guest and the IPAM allocation all persist,
+    // and re-running this deploy after fixing the cause converges on the same
+    // system.
+    if (recordedSystems.length > 0) {
+      const { reconcileAspectsForSystems } = await import('./aspect-runner');
+      const reconcile = await reconcileAspectsForSystems({
+        systems: recordedSystems.map((sys) => ({ hostname: sys.hostname, zone: sys.zone })),
+        db,
+        // This module's own aspect is fanned out by `on_install` below, across
+        // the whole fleet rather than only these hosts.
+        excludeModuleIds: [moduleId],
+      });
+      if (reconcile.failures.length > 0) {
+        // Name the PROVIDING module, not the one being deployed — otherwise
+        // this reads as a defect in `moduleId` and the operator debugs the
+        // wrong thing.
+        const detail = reconcile.failures
+          .map(
+            (f) =>
+              `  ✗ '${f.providerModuleId}' aspect '${f.role}' on ${f.hostnames.join(', ')}: ${f.error ?? 'unknown error'}`,
+          )
+          .join('\n');
+        return {
+          success: false,
+          phases,
+          error: `Fleet aspects could not be applied to the system(s) this deploy created:\n${detail}\nThese are prerequisites, so '${moduleId}' was not configured on top of them. Fix the cause and re-run \`celilo module deploy ${moduleId}\` — the system is kept and will be reused.`,
+        };
+      }
+      const applied = reconcile.outcomes.filter((o) => o.ran);
+      if (applied.length > 0) {
+        log.success(
+          `Applied ${applied.length} fleet aspect(s) to the new system(s): ${applied.map((o) => `${o.providerModuleId}/${o.role}`).join(', ')}`,
+        );
+      }
+    }
+
     let machineId: string | undefined;
     if (plan.infrastructure?.type === 'machine' && plan.infrastructure.machineId) {
       // The management box deploys to ITSELF (registered in the machine pool as

package/src/templates/ingress-ip.test.ts

@@ -10,6 +10,7 @@
 
 import { beforeEach, describe, expect, test } from 'bun:test';
 import type { DbClient } from '../db/client';
+import { deallocateForModule } from '../ipam/auto-allocator';
 import type { ModuleManifest } from '../manifest/schema';
 import { getModuleConfigValue } from '../services/module-config';
 import { setupTestDatabase } from '../test-utils/database';
@@ -41,6 +42,22 @@ const storedIp = (moduleId: string, variable = 'dns_ingress_ip'): string | undef
   return typeof value === 'string' ? value : undefined;
 };
 
+/** Reservation reasons currently held, so a test can assert one is GONE. */
+const reservedReasons = (): string[] =>
+  (db.$client.prepare('SELECT reason FROM ip_reservations').all() as Array<{ reason: string }>).map(
+    (r) => r.reason,
+  );
+
+/**
+ * What `module remove` does to a module's IPAM state. Removal also drops the
+ * module row, which cascades the stored config value away — the tests below
+ * clear it by hand so a "reinstall" starts from the same state a real one does.
+ */
+const removeModule = async (moduleId: string): Promise<void> => {
+  await deallocateForModule(moduleId, db);
+  db.$client.prepare('DELETE FROM module_configs WHERE module_id = ?').run(moduleId);
+};
+
 beforeEach(async () => {
   db = await setupTestDatabase();
   db.$client
@@ -137,3 +154,94 @@ describe('ensureIngressIps', () => {
     expect(storedIp('caddy-internal', 'ingress_ip')).toMatch(/^10\.226\.1\.\d+$/);
   });
 });
+
+/**
+ * The release half (celilo#892). `ensureIngressIps` reserved the address and
+ * nothing ever gave it back, so every install/remove cycle permanently burned
+ * one address from the internal static range — silently, and with no way to
+ * tell the dead row from the live one, since both carry the same reason.
+ *
+ * On celilo-mgr this left 192.168.0.153 and .154 both reading
+ * `ingress:caddy-internal:ingress_ip`, only one of them real.
+ */
+describe('releasing ingress IPs on module removal', () => {
+  test('removing a module releases its ingress reservation', async () => {
+    await ensureIngressIps('technitium', wantsIngress, db);
+    expect(reservedReasons()).toContain('ingress:technitium:dns_ingress_ip');
+
+    await removeModule('technitium');
+
+    expect(reservedReasons()).not.toContain('ingress:technitium:dns_ingress_ip');
+  });
+
+  test('a reinstall REUSES the address instead of advancing to the next one', async () => {
+    // The user-visible symptom: without the release, the range walks forward
+    // one address per install/remove cycle until it runs out.
+    await ensureIngressIps('technitium', wantsIngress, db);
+    const first = storedIp('technitium');
+
+    await removeModule('technitium');
+    await ensureIngressIps('technitium', wantsIngress, db);
+
+    expect(storedIp('technitium')).toBe(first);
+  });
+
+  test('the exclusion count returns to its pre-install value', async () => {
+    const before = reservedReasons().length;
+
+    await ensureIngressIps('caddy-internal', wantsWebIngress, db);
+    expect(reservedReasons().length).toBe(before + 1);
+
+    await removeModule('caddy-internal');
+
+    expect(reservedReasons().length).toBe(before);
+  });
+
+  test('releases the LEGACY `dns-ingress:<module>` reason too', async () => {
+    // Written before celilo#879 generalized the reason format. celilo-mgr holds
+    // one of these right now, so a fix matching only the current format leaves
+    // the installed base leaking.
+    db.$client
+      .prepare('INSERT INTO ip_reservations (ip_start, zone, reason) VALUES (?, ?, ?)')
+      .run('10.226.1.42', 'internal', 'dns-ingress:technitium');
+
+    await removeModule('technitium');
+
+    expect(reservedReasons()).not.toContain('dns-ingress:technitium');
+  });
+
+  test('releases a module holding BOTH formats at once', async () => {
+    // An upgraded installation: the legacy row from before celilo#879 plus a
+    // current one written since. Releasing only one still leaks.
+    await ensureIngressIps('technitium', wantsIngress, db);
+    db.$client
+      .prepare('INSERT INTO ip_reservations (ip_start, zone, reason) VALUES (?, ?, ?)')
+      .run('10.226.1.42', 'internal', 'dns-ingress:technitium');
+
+    await removeModule('technitium');
+
+    expect(reservedReasons()).toEqual([]);
+  });
+
+  test("leaves OTHER modules' reservations alone", async () => {
+    await ensureIngressIps('technitium', wantsIngress, db);
+    await ensureIngressIps('knot-unbound-internal', wantsIngress, db);
+
+    await removeModule('technitium');
+
+    expect(reservedReasons()).toEqual(['ingress:knot-unbound-internal:dns_ingress_ip']);
+  });
+
+  test('releases even when the module has no zone-IP allocation', async () => {
+    // `deallocateForModule` returns early when there is no `ip_allocations`
+    // row, which is the normal case for a module deployed onto a machine
+    // rather than a celilo-provisioned container. Releasing after that early
+    // return would skip exactly the modules that leak.
+    await ensureIngressIps('caddy-internal', wantsWebIngress, db);
+
+    const hadAllocation = await deallocateForModule('caddy-internal', db);
+
+    expect(hadAllocation).toBe(false);
+    expect(reservedReasons()).toEqual([]);
+  });
+});