@celilo/cli 2.1.0 → 2.2.0

package/src/services/trusted-sources.ts

@@ -14,6 +14,7 @@ import type {
   TrustedSource,
   TrustedSourceStore,
 } from '@celilo/capabilities';
+import { isCidr } from '@celilo/capabilities';
 import { and, eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { trustedSources } from '../db/schema';
@@ -80,20 +81,56 @@ export interface TrustedSubnetEntry {
 }
 
 /**
- * The operator's explicit trusted sources, as a comma-separated CIDR list in
- * system config. ADDITIVE rather than replacing the derived control-plane
- * subnet: dropping control-plane trust would block the SSH celilo uses to run
- * every hook and converge, so an operator cannot strand celilo's own management
- * by naming a subnet here.
+ * The operator's explicit trusted sources, in system config. Accepts the two
+ * forms a config value takes in this area: a comma-separated CIDR list and a
+ * JSON array of CIDRs (the form every sibling key uses, e.g. ddns_passwords).
+ *
+ * Every token must be a CIDR. The parser is the single choke point between the
+ * operator's value and the ruleset renderer, which emits each subnet verbatim
+ * into rules.v4 — a token that is not a CIDR used to ride through as a literal
+ * subnet name and iptables-restore failed the whole converge with
+ * "Bad argument `]'". Failing here names the token instead.
+ *
+ * ADDITIVE rather than replacing the derived control-plane subnet: dropping
+ * control-plane trust would block the SSH celilo uses to run every hook and
+ * converge, so an operator cannot strand celilo's own management by naming a
+ * subnet here.
  */
 export const TRUSTED_SUBNETS_CONFIG_KEY = 'firewall.trusted_subnets';
 
 export function parseOperatorTrustedSubnets(raw: string | undefined): string[] {
-  if (!raw) return [];
-  return raw
-    .split(',')
-    .map((s) => s.trim())
-    .filter((s) => s.length > 0);
+  if (!raw || raw.trim().length === 0) return [];
+
+  let tokens: string[];
+  const trimmed = raw.trim();
+  if (trimmed.startsWith('[') || trimmed.startsWith('{')) {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      throw new Error(
+        `${TRUSTED_SUBNETS_CONFIG_KEY} looks like JSON but does not parse: ${raw}. Expected a JSON array of CIDRs, e.g. ["10.0.0.0/24"], or a comma-separated CIDR list.`,
+      );
+    }
+    if (!Array.isArray(parsed) || parsed.some((t) => typeof t !== 'string')) {
+      throw new Error(
+        `${TRUSTED_SUBNETS_CONFIG_KEY} must be a JSON array of CIDR strings, e.g. ["10.0.0.0/24"], or a comma-separated CIDR list.`,
+      );
+    }
+    tokens = parsed;
+  } else {
+    tokens = trimmed.split(',');
+  }
+
+  const subnets = tokens.map((s) => s.trim()).filter((s) => s.length > 0);
+  for (const subnet of subnets) {
+    if (!isCidr(subnet)) {
+      throw new Error(
+        `${TRUSTED_SUBNETS_CONFIG_KEY} contains "${subnet}", which is not an IPv4 CIDR. Expected e.g. 10.0.0.0/24 (comma-separated) or ["10.0.0.0/24"] (JSON array).`,
+      );
+    }
+  }
+  return subnets;
 }
 
 /**

package/src/templates/generator.ts

@@ -817,9 +817,16 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
     const configMap = new Map(configs.map((c) => [c.key, c.value || c.valueJson]));
 
     // Check for missing required variables
-    // Skip infrastructure and terraform variables - they're auto-populated during/after generation
+    // Skip infrastructure and terraform variables - they're auto-populated during/after generation.
+    // Skip hook-owned variables too: they are discovered by the module's own
+    // hooks at runtime (hook-owned-state D2), so a hook that has not run yet
+    // is not a configuration error.
     const missingVars = requiredVars.filter(
-      (v) => v.source !== 'infrastructure' && v.source !== 'terraform' && !configMap.has(v.name),
+      (v) =>
+        v.source !== 'infrastructure' &&
+        v.source !== 'terraform' &&
+        v.source !== 'hook' &&
+        !configMap.has(v.name),
     );
 
     if (missingVars.length > 0) {

package/src/variables/context.ts

@@ -577,19 +577,30 @@ async function assembleResolutionContext(
   // LXC boots with a working resolver — before Ansible's apt update, and
   // independent of which Proxmox node it lands on (the nodes' DNS defaults
   // diverge): the internal dns_internal resolver first (it recurses, so it
-  // also answers external names), then the public resolvers as fallback.
+  // also answers external names), then the configured fleet resolvers as
+  // fallback.
   // Bootstrap (no dns_internal provider registered yet — e.g. the DNS module's
   // own LXC) → public only, so apt still works. Injected as
   // $self:lxc_nameserver, mirroring how inventory.* are auto-derived; the
   // proxmox_lxc terraform template drops it straight into `nameserver`.
   {
-    const publicDns: string[] = [];
+    // Named for what the keys hold, not for what a reader hopes they hold:
+    // `dns.primary` / `dns.fallback` mean "the resolvers systems should use",
+    // and an operator pointing the fleet at its own resolver (a deployed
+    // dns_internal provider's address) is established, deliberate practice
+    // (celilo#1239). These entries may therefore be private. The guard against
+    // a resolver celilo installed ending up here lives where the keys are
+    // WRITTEN from host state — discovery refuses a deployed provider's
+    // address (dns-discovery.ts) — not in a privateness check here, which
+    // would break that practice while fixing nothing: in an uncovered zone
+    // dropping the entries takes DNS away rather than tightening anything.
+    const configuredDns: string[] = [];
     for (const key of ['dns.primary', 'dns.fallback']) {
       const raw = systemConfigMap[key];
       if (raw) {
         for (const part of raw.split(',')) {
           const ip = part.trim();
-          if (ip) publicDns.push(ip);
+          if (ip) configuredDns.push(ip);
         }
       }
     }
@@ -663,8 +674,8 @@ async function assembleResolutionContext(
     const nameservers = dropPublicResolvers
       ? [primaryIp, secondaryIp]
       : primaryIp
-        ? [primaryIp, ...publicDns]
-        : publicDns;
+        ? [primaryIp, ...configuredDns]
+        : configuredDns;
     const unique = [...new Set(nameservers)];
     if (unique.length > 0) {
       selfConfig.lxc_nameserver = unique.join(' ');