@celilo/e2e 0.1.0

package/bin/e2e-run

@@ -0,0 +1,354 @@
+#!/bin/bash
+#
+# E2E Test Runner with Live Progress Reporting
+#
+# Runs each test file sequentially with real-time progress display.
+# Shows sub-steps as they happen (building, deploying, configuring).
+# Captures full output per test in e2e/results/<timestamp>/.
+#
+# Shared infrastructure (DNS, Pebble, apt-cache) is started once
+# before the first test and torn down after the last test. Per-test
+# containers connect to the shared networks.
+#
+# Usage:
+#   ./e2e/bin/e2e-run              # run all tests
+#   ./e2e/bin/e2e-run smoke caddy  # run tests matching these patterns
+#
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Package root (where docker/, config/ live)
+PKG_DIR="$(dirname "$SCRIPT_DIR")"
+# Test directory — can be overridden via E2E_TEST_DIR env var.
+# Default: look for tests/ relative to CWD, or fall back to package dir.
+E2E_TEST_DIR="${E2E_TEST_DIR:-$(pwd)}"
+cd "$PKG_DIR"
+
+SHARED_PROJECT="celilo-e2e-shared"
+SHARED_COMPOSE="docker-compose.shared.yml"
+
+# Handle Ctrl+C: kill running test, clean up, and exit immediately.
+INTERRUPTED=false
+cleanup_and_exit() {
+  INTERRUPTED=true
+  echo ""
+  echo -e "${RED}Interrupted. Cleaning up...${NC}"
+  # Kill any running test process
+  [ -n "$TEST_PID" ] && kill $TEST_PID 2>/dev/null
+  # Remove named pipe
+  [ -n "$PIPE" ] && rm -f "$PIPE"
+  # Tear down shared infra
+  echo -e "${DIM}  Stopping shared infrastructure...${NC}"
+  docker compose -f "$SHARED_COMPOSE" -p "$SHARED_PROJECT" down --volumes --remove-orphans > /dev/null 2>&1 || true
+  # Clean up Docker
+  docker network prune -f > /dev/null 2>&1 || true
+  echo -e "${RED}Aborted.${NC}"
+  exit 130
+}
+trap cleanup_and_exit INT TERM
+
+# Colors
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+DIM='\033[2m'
+BOLD='\033[1m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+# Create results directory (in the test project, not the package)
+TIMESTAMP=$(date +%Y%m%d-%H%M%S)
+RESULTS_DIR="$E2E_TEST_DIR/results/$TIMESTAMP"
+mkdir -p "$RESULTS_DIR"
+
+# Discover test files from E2E_TEST_DIR
+TESTS_PATH="$E2E_TEST_DIR/tests"
+if [ ! -d "$TESTS_PATH" ]; then
+  echo -e "${RED}No tests/ directory found at $TESTS_PATH${NC}"
+  echo "Set E2E_TEST_DIR to the directory containing your tests/ folder."
+  exit 1
+fi
+
+if [ $# -gt 0 ]; then
+  TEST_FILES=()
+  for pattern in "$@"; do
+    for f in "$TESTS_PATH"/*${pattern}*.test.ts; do
+      [ -f "$f" ] && TEST_FILES+=("$f")
+    done
+  done
+else
+  TEST_FILES=("$TESTS_PATH"/*.test.ts)
+fi
+
+TOTAL=${#TEST_FILES[@]}
+PASSED=0
+FAILED=0
+RESULTS=()
+
+echo ""
+echo -e "${BOLD}╔══════════════════════════════════════════════════════════════╗${NC}"
+echo -e "${BOLD}║  Celilo E2E Tests                                          ║${NC}"
+printf  "${BOLD}║  %d test(s) queued — %s                              ║${NC}\n" "$TOTAL" "$(date +%H:%M:%S)"
+echo -e "${BOLD}╚══════════════════════════════════════════════════════════════╝${NC}"
+echo ""
+
+SUITE_START=$(date +%s)
+
+# ─── Shared Infrastructure Startup ────────────────────────────────────
+# The first test will call ensureSharedInfra() which starts the shared
+# project. But we also pre-check here so the runner can show progress.
+echo -e "${BOLD}Shared Infrastructure${NC}"
+
+# Check if shared infra is already running
+SHARED_RUNNING=false
+SHARED_CONTAINERS=$(docker compose -f "$SHARED_COMPOSE" -p "$SHARED_PROJECT" ps -q 2>/dev/null || true)
+if [ -n "$SHARED_CONTAINERS" ]; then
+  # Verify DNS is healthy
+  DNS_CHECK=$(docker compose -f "$SHARED_COMPOSE" -p "$SHARED_PROJECT" exec -T comcast-resolver dig @127.0.0.1 iamtheinternet.org NS +short +timeout=2 2>/dev/null || true)
+  if [ -n "$DNS_CHECK" ]; then
+    SHARED_RUNNING=true
+    echo -e "  ${GREEN}✔ already running (DNS healthy)${NC}"
+  else
+    echo -e "  ${DIM}DNS unhealthy, restarting...${NC}"
+    docker compose -f "$SHARED_COMPOSE" -p "$SHARED_PROJECT" down --volumes --remove-orphans > /dev/null 2>&1 || true
+  fi
+fi
+
+if [ "$SHARED_RUNNING" = false ]; then
+  echo -e "  ${DIM}Starting DNS hierarchy, Pebble ACME, apt-cache...${NC}"
+  # The actual startup happens inside the first test's ensureSharedInfra()
+  # call. We just report it here for visibility.
+fi
+
+SHARED_END=$(date +%s)
+echo ""
+
+# Track step count per test for percentage
+STEP_COUNT=0
+ESTIMATED_STEPS=15
+
+# Parse a line of test output and display as a progress step.
+show_progress() {
+  local line="$1"
+  local test_start="$2"
+  local step=""
+
+  # Shared infra progress (from ensureSharedInfra)
+  if [[ "$line" == *"[e2e] Shared infrastructure ready"* ]]; then
+    step="✔ shared infrastructure ready"
+  elif [[ "$line" == *"[e2e] Building shared"* ]]; then
+    step="building shared infrastructure images"
+  elif [[ "$line" == *"[e2e] Starting shared"* ]]; then
+    step="starting shared infrastructure"
+  elif [[ "$line" == *"[e2e] Cleaning up stale shared"* ]]; then
+    step="cleaning up stale shared infra"
+
+  # Per-test container manager progress
+  elif [[ "$line" == *"[e2e] Building images"* ]]; then
+    step="building test images"
+  elif [[ "$line" == *"[e2e] Starting containers"* ]]; then
+    step="starting test containers"
+  elif [[ "$line" == *"[e2e] Cleaning up"* ]]; then
+    step="cleaning up stale test resources"
+  elif [[ "$line" == *"[e2e] Waiting for DNS"* ]]; then
+    step="waiting for DNS convergence"
+  elif [[ "$line" == *"[e2e] Verifying routing"* ]]; then
+    step="verifying routing"
+  elif [[ "$line" == *"[e2e] Waiting for target"* ]]; then
+    step="waiting for target machines"
+  elif [[ "$line" == *"[e2e] Waiting for DHCP"* ]]; then
+    step="waiting for DHCP"
+  elif [[ "$line" == *"[e2e] Initializing celilo"* ]]; then
+    step="initializing celilo"
+  elif [[ "$line" == *"[e2e] Network ready"* ]]; then
+    step="network ready"
+  elif [[ "$line" == *"[e2e] Stopping network"* ]]; then
+    step="stopping network"
+
+  # Test-level progress (console.log from tests)
+  elif [[ "$line" == *"Adding machines"* ]]; then
+    step="adding machines"
+  elif [[ "$line" == *"Importing modules"* ]]; then
+    step="importing modules"
+  elif [[ "$line" == *"Configuring modules"* ]]; then
+    step="configuring modules"
+  elif [[ "$line" == *"Prerequisites ready"* ]]; then
+    step="prerequisites ready"
+
+  # Celilo CLI: "Deploying module: namecheap"
+  elif [[ "$line" == *"Deploying module:"* ]]; then
+    local module=$(echo "$line" | sed -n 's/.*Deploying module: \([^ ]*\).*/\1/p')
+    if [ -n "$module" ]; then
+      step="deploying $module"
+    else
+      step="deploying module"
+    fi
+  # Celilo CLI: "Deploying software..."
+  elif [[ "$line" == *"Deploying software"* ]]; then
+    step="running Ansible"
+
+  # Test console.log: "[45s] Deploying namecheap..."
+  elif [[ "$line" =~ Deploying\ ([a-z_-]+) ]]; then
+    step="deploying ${BASH_REMATCH[1]}"
+
+  # Celilo CLI: "✓ Module 'namecheap' deployed successfully"
+  elif [[ "$line" == *"deployed successfully"* ]]; then
+    local module=$(echo "$line" | sed -n "s/.*Module '\([^']*\)' deployed.*/\1/p")
+    step="✔ ${module:-module} deployed"
+
+  # Celilo CLI: "Successfully imported module: namecheap"
+  elif [[ "$line" == *"Successfully imported module:"* ]]; then
+    local module=$(echo "$line" | sed -n 's/.*imported module: \([^ ]*\).*/\1/p')
+    step="✔ ${module:-module} imported"
+
+  # Celilo CLI: "Infrastructure selected: machine"
+  elif [[ "$line" == *"Infrastructure selected"* ]]; then
+    step="infrastructure selected"
+  # Celilo CLI: "Terraform"
+  elif [[ "$line" == *"Terraform skipped"* ]]; then
+    step="terraform skipped (existing machine)"
+  elif [[ "$line" == *"terraform init"* ]] || [[ "$line" == *"Terraform init"* ]]; then
+    step="terraform init"
+  elif [[ "$line" == *"terraform apply"* ]] || [[ "$line" == *"Terraform apply"* ]]; then
+    step="terraform apply"
+
+  # Ansible health retries
+  elif [[ "$line" == *"RETRYING"* ]] && [[ "$line" == *"healthy"* ]]; then
+    local retries=$(echo "$line" | sed -n 's/.*(\([0-9]*\) retries left).*/\1/p')
+    step="waiting for health check ($retries retries left)"
+
+  # Skip noise
+  elif [[ "$line" == *"Set config for"* ]]; then return
+  elif [[ "$line" == *"Set secret for"* ]]; then return
+  elif [[ "$line" == *"Auto-generated"* ]]; then return
+  elif [[ "$line" == *"Warning: Permanently added"* ]]; then return
+
+  # Error detection
+  elif [[ "$line" == *"Error:"* ]] && [[ "$line" != *"vitest"* ]] && [[ "$line" != *"bun test"* ]] && [[ "$line" != *"ipv4: Address already"* ]]; then
+    local err=$(echo "$line" | sed 's/.*Error: //' | cut -c1-70)
+    step="✗ $err"
+  fi
+
+  if [ -n "$step" ]; then
+    STEP_COUNT=$((STEP_COUNT + 1))
+    # Update estimate upward if we're exceeding it
+    if [ $STEP_COUNT -gt $ESTIMATED_STEPS ]; then
+      ESTIMATED_STEPS=$((STEP_COUNT + 5))
+    fi
+    local pct=$(( (STEP_COUNT * 100) / ESTIMATED_STEPS ))
+    [ $pct -gt 99 ] && pct=99  # Don't show 100% until actually done
+    local now=$(date +%s)
+    local elapsed=$((now - test_start))
+    printf "  ${DIM}%3ds${NC} ${CYAN}%2d%%${NC} %s\n" "$elapsed" "$pct" "$step"
+  fi
+}
+
+for ((i=0; i<TOTAL; i++)); do
+  FILE="${TEST_FILES[$i]}"
+  NAME=$(basename "$FILE" .test.ts)
+  TEST_DIR="$RESULTS_DIR/$NAME"
+  mkdir -p "$TEST_DIR"
+
+  # Percentage complete (based on test count, not time)
+  PCT=$(( (i * 100) / TOTAL ))
+  ELAPSED_TOTAL=$(($(date +%s) - SUITE_START))
+  if [ $i -gt 0 ]; then
+    AVG_PER_TEST=$((ELAPSED_TOTAL / i))
+    REMAINING=$(( (TOTAL - i) * AVG_PER_TEST ))
+    ETA_MIN=$((REMAINING / 60))
+    ETA_SEC=$((REMAINING % 60))
+    ETA_STR=" — ~${ETA_MIN}m ${ETA_SEC}s remaining"
+  else
+    ETA_STR=""
+  fi
+
+  echo -e "${BOLD}[${i}/${TOTAL}] ${CYAN}${PCT}%${NC}${BOLD} ${NAME}${NC}${DIM}${ETA_STR}${NC}"
+
+  STEP_COUNT=0
+  TEST_START=$(date +%s)
+  PIPE=$(mktemp -u)
+  mkfifo "$PIPE"
+
+  # Background: run bun test, merge stdout+stderr, tee to log + pipe
+  (bun test --timeout 300000 "$FILE" 2>&1 | tee "$TEST_DIR/output.log" > "$PIPE") &
+  TEST_PID=$!
+
+  # Foreground: read pipe line-by-line and show progress
+  while IFS= read -r line; do
+    show_progress "$line" "$TEST_START"
+  done < "$PIPE"
+
+  # Wait for test to finish and get exit code
+  wait $TEST_PID 2>/dev/null
+  EXIT_CODE=$?
+  rm -f "$PIPE"
+
+  TEST_END=$(date +%s)
+  DURATION=$((TEST_END - TEST_START))
+
+  if [ $EXIT_CODE -eq 0 ]; then
+    echo -e "  ${GREEN}✔ passed (${DURATION}s)${NC}"
+    PASSED=$((PASSED + 1))
+    RESULTS+=("✓|$NAME|${DURATION}s")
+    echo '{"status":"pass","duration":'$DURATION'}' > "$TEST_DIR/result.json"
+  else
+    echo -e "  ${RED}✗ failed (${DURATION}s)${NC}"
+    FAILED=$((FAILED + 1))
+    ERROR=$(grep -E "Error:|expected.*to be|Timeout" "$TEST_DIR/output.log" 2>/dev/null | grep -v "vitest\|bun test" | head -1 | sed 's/.*Error: //' | cut -c1-80)
+    RESULTS+=("✗|$NAME|${DURATION}s|$ERROR")
+    echo '{"status":"fail","duration":'$DURATION',"error":"'"${ERROR//\"/\\\"}"'"}' > "$TEST_DIR/result.json"
+    echo -e "  ${RED}  └─ ${ERROR}${NC}"
+  fi
+  echo ""
+
+  # Clean up per-test Docker resources between tests (not shared infra)
+  docker network prune -f > /dev/null 2>&1 || true
+done
+
+# ─── Shared Infrastructure Teardown ───────────────────────────────────
+echo -e "${DIM}Stopping shared infrastructure...${NC}"
+docker compose -f "$SHARED_COMPOSE" -p "$SHARED_PROJECT" down --volumes --remove-orphans > /dev/null 2>&1 || true
+docker network prune -f > /dev/null 2>&1 || true
+
+SUITE_END=$(date +%s)
+SUITE_DURATION=$((SUITE_END - SUITE_START))
+SUITE_MINUTES=$((SUITE_DURATION / 60))
+SUITE_SECONDS=$((SUITE_DURATION % 60))
+
+echo ""
+echo -e "${BOLD}╔══════════════════════════════════════════════════════════════╗${NC}"
+printf  "${BOLD}║  Results: ${GREEN}%d passed${NC}${BOLD}, ${RED}%d failed${NC}${BOLD} — %dm %ds total             ║${NC}\n" "$PASSED" "$FAILED" "$SUITE_MINUTES" "$SUITE_SECONDS"
+echo -e "${BOLD}╠══════════════════════════════════════════════════════════════╣${NC}"
+
+for result in "${RESULTS[@]}"; do
+  IFS='|' read -r icon name duration error <<< "$result"
+  if [ "$icon" = "✓" ]; then
+    printf "${BOLD}║${NC}  ${GREEN}%s${NC} %-28s ${DIM}%6s${NC}\n" "$icon" "$name" "$duration"
+  else
+    printf "${BOLD}║${NC}  ${RED}%s${NC} %-28s ${DIM}%6s${NC}\n" "$icon" "$name" "$duration"
+    if [ -n "$error" ]; then
+      printf "${BOLD}║${NC}    ${RED}└─ %s${NC}\n" "$error"
+    fi
+  fi
+done
+
+echo -e "${BOLD}╚══════════════════════════════════════════════════════════════╝${NC}"
+echo ""
+echo -e "Full logs: ${DIM}$RESULTS_DIR${NC}"
+
+# Write summary
+cat > "$RESULTS_DIR/summary.json" <<EOF
+{
+  "timestamp": "$TIMESTAMP",
+  "total": $TOTAL,
+  "passed": $PASSED,
+  "failed": $FAILED,
+  "duration": $SUITE_DURATION
+}
+EOF
+
+# Add results dir to gitignore if not already there
+grep -q "^results/" "$E2E_TEST_DIR/.gitignore" 2>/dev/null || echo "results/" >> "$E2E_TEST_DIR/.gitignore"
+
+# Exit with failure if any tests failed
+[ $FAILED -eq 0 ]

package/bin/e2e-shell

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Connect to a running E2E container.
+#
+# Usage:
+#   ./bin/e2e-shell                # Shell into management machine
+#   ./bin/e2e-shell caddy          # Shell into caddy container
+#   ./bin/e2e-shell fw-main        # Shell into fw-main
+#   ./bin/e2e-shell namecheap-dns  # Shell into namecheap-dns
+
+set -e
+PROJECT_NAME="conductor-e2e-interactive"
+CONTAINER="${1:-management}"
+
+# Check if network is running
+if ! docker compose -p "$PROJECT_NAME" ps --status running 2>/dev/null | grep -q "$CONTAINER"; then
+  echo "Container '$CONTAINER' is not running."
+  echo "Available containers:"
+  docker compose -p "$PROJECT_NAME" ps --format '  {{.Name}}  ({{.Status}})' 2>/dev/null || echo "  No E2E network running. Start with: ./bin/e2e-up"
+  exit 1
+fi
+
+# Use zsh for management (has conductor aliases + completion), bash for others
+if [ "$CONTAINER" = "management" ]; then
+  docker compose -p "$PROJECT_NAME" exec "$CONTAINER" zsh -li
+else
+  docker compose -p "$PROJECT_NAME" exec "$CONTAINER" bash
+fi

package/bin/e2e-status

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Show status of the E2E test network.
+
+PROJECT_NAME="conductor-e2e-interactive"
+
+echo "=== Containers ==="
+docker compose -p "$PROJECT_NAME" ps 2>/dev/null || { echo "No E2E network running."; exit 0; }
+
+echo ""
+echo "=== DNS Check ==="
+echo -n "  iamtheinternet.org NS: "
+docker compose -p "$PROJECT_NAME" exec -T comcast-resolver dig @127.0.0.1 iamtheinternet.org NS +short +timeout=2 2>/dev/null || echo "(failed)"
+
+echo -n "  www.iamtheinternet.org A: "
+docker compose -p "$PROJECT_NAME" exec -T comcast-resolver dig @127.0.0.1 www.iamtheinternet.org A +short +timeout=2 2>/dev/null || echo "(not set)"
+
+echo ""
+echo "=== Connectivity (from management) ==="
+for target in "fw-main:192.168.0.254" "fw-isp:192.168.0.1" "comcast-resolver:100.100.0.1" "root-dns:100.64.0.53" "namecheap-dns:100.64.0.55"; do
+  name="${target%%:*}"
+  ip="${target##*:}"
+  echo -n "  $name ($ip): "
+  docker compose -p "$PROJECT_NAME" exec -T management ping -c1 -W2 "$ip" >/dev/null 2>&1 && echo "OK" || echo "FAIL"
+done
+
+echo ""
+echo "=== DDNS Simulator ==="
+echo -n "  Status: "
+docker compose -p "$PROJECT_NAME" exec -T namecheap-dns curl -s http://localhost:8080/status 2>/dev/null || echo "(not running)"

package/bin/e2e-up

@@ -0,0 +1,160 @@
+#!/bin/bash
+# Start the E2E test network interactively.
+#
+# Usage:
+#   ./bin/e2e-up                          # Infrastructure only
+#   ./bin/e2e-up --caddy                  # + caddy machine in dmz
+#   ./bin/e2e-up --full-stack             # + caddy, idp, db
+#   ./bin/e2e-up --custom '{"dmz":{"caddy":"10.0.10.10","web":"10.0.10.20"}}'
+#
+# After startup, drops you into a shell on the management machine.
+# Use `exit` to leave the shell (network stays running).
+# Use `./bin/e2e-down` to tear everything down.
+
+set -e
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$SCRIPT_DIR"
+
+PROJECT_NAME="conductor-e2e-interactive"
+
+# Parse args
+PRESET="infrastructure"
+CUSTOM_JSON=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --caddy) PRESET="caddy"; shift ;;
+    --full-stack) PRESET="full-stack"; shift ;;
+    --custom) shift; CUSTOM_JSON="$1"; shift ;;
+    --help|-h)
+      echo "Usage: e2e-up [--caddy|--full-stack|--custom '<json>']"
+      echo ""
+      echo "Presets:"
+      echo "  (default)      Infrastructure only (management, firewalls, DNS, Pebble)"
+      echo "  --caddy        + caddy machine at 10.0.10.10 in dmz"
+      echo "  --full-stack   + caddy (dmz), idp (app), db (secure)"
+      echo "  --custom JSON  Custom machine spec, e.g. '{\"dmz\":{\"caddy\":\"10.0.10.10\"}}'"
+      echo ""
+      echo "After startup, you'll be dropped into the management machine shell."
+      echo "Use ./bin/e2e-down to tear down, or ./bin/e2e-shell to reconnect."
+      exit 0
+      ;;
+    *) shift ;;
+  esac
+done
+
+# Generate docker-compose.yml
+export PRESET CUSTOM_JSON
+echo "Generating docker-compose.yml (preset: $PRESET)..."
+bun -e "
+import { generateComposeYaml } from './src/docker-compose-generator';
+
+const presets = {
+  'infrastructure': {
+    topology: 'default',
+    dmzMachines: [],
+    appMachines: [],
+    secureMachines: [],
+    domain: 'iamtheinternet.org',
+    ddnsPassword: 'test123',
+    verifyRouting: false,
+  },
+  'caddy': {
+    topology: 'default',
+    dmzMachines: [{ name: 'caddy', ip: '10.0.10.10', zone: 'dmz' }],
+    appMachines: [],
+    secureMachines: [],
+    domain: 'iamtheinternet.org',
+    ddnsPassword: 'test123',
+    verifyRouting: false,
+  },
+  'full-stack': {
+    topology: 'default',
+    dmzMachines: [{ name: 'caddy', ip: '10.0.10.10', zone: 'dmz' }],
+    appMachines: [{ name: 'idp', ip: '10.0.20.100', zone: 'app' }],
+    secureMachines: [{ name: 'db', ip: '10.0.30.50', zone: 'secure' }],
+    domain: 'iamtheinternet.org',
+    ddnsPassword: 'test123',
+    verifyRouting: false,
+  },
+};
+
+const customJson = process.env.CUSTOM_JSON;
+let config;
+if (customJson) {
+  const spec = JSON.parse(customJson);
+  config = { ...presets['infrastructure'] };
+  for (const [zone, machines] of Object.entries(spec)) {
+    const key = zone + 'Machines';
+    if (key in config) {
+      config[key] = Object.entries(machines).map(([name, ip]) => ({ name, ip, zone }));
+    }
+  }
+} else {
+  config = presets[process.env.PRESET || 'infrastructure'];
+}
+
+console.log(generateComposeYaml(config));
+" > docker-compose.yml
+
+# Build and start
+echo "Building images (this may take a while on first run)..."
+docker compose -p "$PROJECT_NAME" build
+
+echo "Starting containers..."
+docker compose -p "$PROJECT_NAME" up -d
+
+echo ""
+echo "Waiting for management machine to initialize..."
+for i in $(seq 1 15); do
+  if docker compose -p "$PROJECT_NAME" exec -T management test -f /root/.zshrc 2>/dev/null; then
+    break
+  fi
+  sleep 1
+done
+
+echo "Waiting for DNS convergence..."
+for i in $(seq 1 30); do
+  if docker compose -p "$PROJECT_NAME" exec -T comcast-resolver dig @127.0.0.1 iamtheinternet.org NS +short +timeout=2 2>/dev/null | grep -q '.'; then
+    echo "DNS is ready!"
+    break
+  fi
+  if [ "$i" = "30" ]; then
+    echo "WARNING: DNS did not converge after 60s. Continuing anyway."
+  fi
+  sleep 2
+done
+
+echo ""
+echo "================================================"
+echo "  E2E Network is running!"
+echo "  Project: $PROJECT_NAME"
+echo "================================================"
+echo ""
+echo "Networks:"
+echo "  internal:          192.168.0.0/24"
+echo "  dmz:               10.0.10.0/24"
+echo "  app:               10.0.20.0/24"
+echo "  secure:            10.0.30.0/24"
+echo "  isp-external:      100.100.0.0/24"
+echo "  internet-external: 100.64.0.0/24"
+echo ""
+echo "Key machines:"
+echo "  management:        192.168.0.100  (conductor CLI)"
+echo "  fw-main:           192.168.0.254  (iptables firewall)"
+echo "  fw-isp:            192.168.0.1    (greenwave router sim)"
+echo "  comcast-resolver:  100.100.0.1        (DNS resolver)"
+echo "  namecheap-dns:     100.64.0.55       (DDNS simulator)"
+echo "  letsencrypt:       100.64.0.100      (Pebble ACME)"
+echo "  apt-cache:         100.64.0.2        (apt proxy → real internet)"
+echo ""
+echo "Commands:"
+echo "  ./bin/e2e-shell                   Reconnect to management"
+echo "  ./bin/e2e-shell <container>       Shell into any container"
+echo "  ./bin/e2e-down                    Tear everything down"
+echo "  docker compose -p $PROJECT_NAME ps    List containers"
+echo ""
+echo "Dropping you into the management machine..."
+echo "(use 'conductor <cmd>' or 'c <cmd>' — tab completion works)"
+echo ""
+
+docker compose -p "$PROJECT_NAME" exec management zsh -li

package/config/dhcp/dnsmasq.conf

@@ -0,0 +1,27 @@
+# dnsmasq DHCP server for e2e internal network
+# Runs on the greenwave simulator (fw-isp) container
+
+# Only DHCP, no DNS (technitium handles DNS)
+port=0
+
+# Listen on internal interface only
+interface=eth0
+bind-interfaces
+
+# DHCP range: .200-.220 (small range for test clients)
+dhcp-range=192.168.0.200,192.168.0.220,255.255.255.0,1h
+
+# Default gateway (the greenwave router itself)
+dhcp-option=option:router,192.168.0.1
+
+# DNS server (initially the router, updated by greenwave API)
+dhcp-option=option:dns-server,192.168.0.1
+
+# Domain name / search domain
+# dhcp-option=option:domain-name,iamtheinternet.org
+
+# Short lease time for testing
+dhcp-lease-max=20
+
+# Log DHCP transactions
+log-dhcp

package/config/dns/com.zone

@@ -0,0 +1,11 @@
+$ORIGIN com.
+$TTL 86400
+
+@ IN SOA tld-dns.lab. admin.lab. (
+    2024010101 1800 900 604800 86400
+)
+
+com.                    IN NS   tld-dns.lab.
+
+park-your-domain        IN NS   ns1.park-your-domain.com.
+ns1.park-your-domain.com. IN A  100.64.0.55

package/config/dns/iamtheinternet.org.zone

@@ -0,0 +1,15 @@
+$ORIGIN iamtheinternet.org.
+$TTL 300
+
+@ IN SOA ns1.iamtheinternet.org. admin.iamtheinternet.org. (
+    2024010686 300 60 604800 300
+)
+
+@       IN NS   ns1.iamtheinternet.org.
+ns1     IN A    100.64.0.55
+@    IN A    0.0.0.0
+caddy    IN A    100.100.0.100
+www    IN A    100.100.0.100
+deathstar    IN A    100.100.0.100
+test    IN A    0.0.0.0
+auth    IN A    100.100.0.100

package/config/dns/knot-namecheap.conf

@@ -0,0 +1,11 @@
+server:
+    listen: 0.0.0.0@53
+
+zone:
+  - domain: "iamtheinternet.org"
+    file: "/config/iamtheinternet.org.zone"
+    storage: "/var/lib/knot"
+
+  - domain: "park-your-domain.com"
+    file: "/config/park-your-domain.com.zone"
+    storage: "/var/lib/knot"

package/config/dns/knot-root.conf

@@ -0,0 +1,7 @@
+server:
+    listen: 0.0.0.0@53
+
+zone:
+  - domain: "."
+    file: "/config/root.zone"
+    storage: "/var/lib/knot"

package/config/dns/knot-tld.conf

@@ -0,0 +1,11 @@
+server:
+    listen: 0.0.0.0@53
+
+zone:
+  - domain: "com"
+    file: "/config/com.zone"
+    storage: "/var/lib/knot"
+
+  - domain: "org"
+    file: "/config/org.zone"
+    storage: "/var/lib/knot"

package/config/dns/org.zone

@@ -0,0 +1,14 @@
+$ORIGIN org.
+$TTL 86400
+
+@ IN SOA tld-dns.lab. admin.lab. (
+    2024010101 1800 900 604800 86400
+)
+
+org.                    IN NS   tld-dns.lab.
+
+iamtheinternet          IN NS   ns1.iamtheinternet.org.
+ns1.iamtheinternet.org. IN A    100.64.0.55
+
+; Note: Let's Encrypt ACME endpoints are handled by unbound local-data
+; (resolves acme-v02.api.letsencrypt.org → 100.64.0.100 directly)