@celilo/e2e 0.1.0

package/config/dns/park-your-domain.com.zone

@@ -0,0 +1,10 @@
+$ORIGIN park-your-domain.com.
+$TTL 300
+
+@ IN SOA ns1.park-your-domain.com. admin.park-your-domain.com. (
+    2024010101 300 60 604800 300
+)
+
+@           IN NS   ns1.park-your-domain.com.
+ns1         IN A    100.64.0.55
+dynamicdns  IN A    100.64.0.55

package/config/dns/root.zone

@@ -0,0 +1,14 @@
+$ORIGIN .
+$TTL 86400
+
+@ IN SOA root-dns.lab. admin.lab. (
+    2024010101 1800 900 604800 86400
+)
+
+.           IN NS   root-dns.lab.
+root-dns.lab.   IN A    100.64.0.53
+
+com.        IN NS   tld-dns.lab.
+tld-dns.lab.    IN A    100.64.0.54
+
+org.        IN NS   tld-dns.lab.

package/config/pebble/pebble-ca.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDMTCCAhmgAwIBAgIUaYCN3ZFMCmaVcENgKZ/xOGhglVowDQYJKoZIhvcNAQEL
+BQAwIDEeMBwGA1UEAwwVQ29uZHVjdG9yIEUyRSBSb290IENBMB4XDTI2MDMzMDE5
+NTMwNVoXDTM2MDMyNzE5NTMwNVowIDEeMBwGA1UEAwwVQ29uZHVjdG9yIEUyRSBS
+b290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAupS6A0MRmHf3
+kA6aSkY0He8U+wXZ2OMvHyOecL4UGAO3dmuoOiDVLqtrYkUxmIT8Xqb231ZmUPnV
+YaCtumheP0R8Wk+8cI42yZHoCmTWSmBFFdre3OQeKx8JqW6pt0O3VaRIYZeaDGrU
+3BmJC7UQFBA3gv4HxX4MQxjG7/Uv3QC1rmhBh5P478B5ARc+rpXq/TaYFvvnhSNX
+eS2dOAJmlCD6T4Z3YVb9agNN0I83SQjbowT6Hcnd0hG1qzjcGo6Hh17++tO5Rv48
+a5daf89JXMzt5H5SLAszs0l8YbBENyHGf9ODhTA9rsOPfb16cui/lPWoyK6ZVV1E
+6abbDrau5wIDAQABo2MwYTAdBgNVHQ4EFgQUm0hU9Poa7Jt4/rknHfwM357i5e0w
+HwYDVR0jBBgwFoAUm0hU9Poa7Jt4/rknHfwM357i5e0wDwYDVR0TAQH/BAUwAwEB
+/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBAHNPUe7vyCWii1Oz
+2zQDo14/Hj83eIwUTiFL/ri/KnSgIHDz7yTqlTMONMFB7x22WmJ52akr7B46Fz7F
+LB/c28oaGAP2g6+ACrsicmk3MUPnNWAzkyL6qIJnejkWk3bUJ9QDJ+mUi5OwhFnY
+9s++J5dPDzJzsJxEFwbt2VXh9DA5+FgDl/hULzmr048HT4TStYZth1+cIaZebB9w
+nTYYQAVqXxmkxwtpNTQPjGysAwV4XyYdGFwQBFt2DnsnrdZDSobNSvVqfvnyy6mV
+uXMHYLKgdE9uUgfP5kwIJ6Qo8P+RN4JcGDSWOswLm48YZFThQxH9Yft5+b7CLb+K
+8AA+0IM=
+-----END CERTIFICATE-----

package/config/pebble/pebble-config.json

@@ -0,0 +1,11 @@
+{
+  "pebble": {
+    "listenAddress": "0.0.0.0:443",
+    "managementListenAddress": "0.0.0.0:15000",
+    "certificate": "/config/pebble-tls.crt",
+    "privateKey": "/config/pebble-tls.key",
+    "httpPort": 80,
+    "tlsPort": 443,
+    "ocspResponderURL": ""
+  }
+}

package/config/pebble/pebble-tls.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIUbphe84IVhcS25gLcekwSZYM6zcAwDQYJKoZIhvcNAQEL
+BQAwIDEeMBwGA1UEAwwVQ29uZHVjdG9yIEUyRSBSb290IENBMB4XDTI2MDMzMDE5
+NTMyMloXDTM2MDMyNzE5NTMyMlowETEPMA0GA1UEAwwGcGViYmxlMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtX72hIsegPpLkhUa02GTOSowtl8N6jJ9
+f9IH98WDH5yDwKbZPic7pRIhSespmbFdLMt+Hs/fEr/hBQiOSR4hkezb3F8bkv0T
+S0VvSK/Ao9hSbm5H7pFZRucJno5s/g0KIwe/rqI90c/bpIVP8izwXFyGr+D1Aw4R
+RPle4viILZ1MRnshOF5uX2MkZlyMaW/uxFRzHDiN4cAE7nl1nBRGzwI//tA7Ag2h
+XKRZaBJ9180pTcZobWaqxNgw3pAzXqsZbmW+eDOqMdgS/9srX+AHY2kiX+Qg3ozX
+4WgTwebqLf0qw2zsMY10lfn/kiwYC42ukol/r2rp4Ub7EzIgrWA8AwIDAQABo4Gl
+MIGiMGAGA1UdEQRZMFeCCWxvY2FsaG9zdIIGcGViYmxlghxhY21lLXYwMi5hcGku
+bGV0c2VuY3J5cHQub3JngiRhY21lLXN0YWdpbmctdjAyLmFwaS5sZXRzZW5jcnlw
+dC5vcmcwHQYDVR0OBBYEFDGYCywDhGO3KTo1PwCyojJIEGC/MB8GA1UdIwQYMBaA
+FJtIVPT6GuybeP65Jx38DN+e4uXtMA0GCSqGSIb3DQEBCwUAA4IBAQB/ftFFJTww
+7vUcinY7oeeKHDMUUGKIijAshr9F8p8nwIvMpBurrdTCoYSTrXNOxWg7m6eHpjo/
+GYH459Uk9UDF5tp6+WfElTCBEvL0xaOprBFURuy9cbFC1byPtwdht/5o2BijTjEU
+WLmMkth5SkRrXJe1whruT/cxJEf7h/pgzMOiKjil7km933x7bNjMOdjZmUrPT6jd
+8+EJugopzHqkFHZ+uFQmhtQ2F3liyS+FB+9i28dy2vrVylUlPsOZicSzi9RcPwKx
+1Jc+t4gENUInePA5floWZHwvRp9zgWWLNS4XdD2vawUnb7KiIXMLzCg4ETiPHfG0
+Dhqj9k8SflJx
+-----END CERTIFICATE-----

package/config/pebble/pebble-tls.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEugIBADANBgkqhkiG9w0BAQEFAASCBKQwggSgAgEAAoIBAQC1fvaEix6A+kuS
+FRrTYZM5KjC2Xw3qMn1/0gf3xYMfnIPAptk+JzulEiFJ6ymZsV0sy34ez98Sv+EF
+CI5JHiGR7NvcXxuS/RNLRW9Ir8Cj2FJubkfukVlG5wmejmz+DQojB7+uoj3Rz9uk
+hU/yLPBcXIav4PUDDhFE+V7i+IgtnUxGeyE4Xm5fYyRmXIxpb+7EVHMcOI3hwATu
+eXWcFEbPAj/+0DsCDaFcpFloEn3XzSlNxmhtZqrE2DDekDNeqxluZb54M6ox2BL/
+2ytf4AdjaSJf5CDejNfhaBPB5uot/SrDbOwxjXSV+f+SLBgLja6SiX+vaunhRvsT
+MiCtYDwDAgMBAAECgf5791pOB+uEzhpc9Dg97oW5A0YKhvc8xfDAPrXJG2KtTUer
+vLMmIYLfab/46DEl2ENoQIMtEXE/ZfkvngtJH1xu0rQjvpqT24vtgqzB68D8X4zP
++Pp1klyTNbN6aDoLFC0QGYHBMt7qfM9NwDbs5qK+hO+Joqc6QvLbaVIuPg2pY/Vu
+7l5nslOr3WDnX4u9TfGVGR6uIq9Hi+K/4S9pf26PSE1+c4I7qCDAqAlfVLcGJ5HJ
+T65hjwA+XR5rPG8x04LYGjCFFflcZoEvC3FBTOXbRJXvjBjoqVFqFU78YY8WbIy9
+bUX+BuNvB72Ff5lzcV+c5QICuRAMe0LYVfs8NQKBgQD1c9gNR9OmyU3pF71q2mW5
+9+DWIf/qn12PVmaLoiMCAKjcVKTY7JOmHHZNKeWJMHJIXw33TXerv7MYxa7lJALG
+Si1qaeQ6ci1u7Buzd3KHjmQtgwbYmXRPNc8sVaOy2boC+j+OFBf7hSN7U6s7J3f5
+DueEyCTYx1XvyhByPtdXnQKBgQC9S4zgVTF399CseQ/iC+2n+ThIngOFYZJZGnmE
+mHF1v9GPxiidtZji7bDxpX/oEwBP9WTNGPXXAMFPYLkhYvH82SFwH2cZqxXWo2Je
+nMhKnvaHwn/umRDJbXGlqsBcXHQiC1dzwHo7g195O3I6UHKI9UNCWK6FPlKMlaon
+Eu0gHwKBgBlx+vHVgmGF+OezKFXNckJHKi3ItIkUIFTdth+/nTV18At3UueSDvRn
+evQg5cTFGvPZts7uXvuVEfH9fFYQ16DKy85+T8SnVYJsQ6rlNSBMaKI3NRx7PA2C
+HIoSDrhZzejFHJWUC7BtavI8CEJHoy5Ulzeyr+8xKv2CyxWs4hIZAoGATl9/Xkon
+hyIlVaNx/gcuSIOY2AgEMS8qppWdhlaPc08N9tb2bgWH3TzIK+R3xqBHWtOg/oG9
+F12Kq9DCFZ6fzi4f+AooZ6o8Cnfu/HkxPCQAskjHKwRYvO0BRrQhnJvywT2s4ZHp
+icZkuw7vxlEUerwBMvEAoM4i42372t2tK8UCgYEAhahQmoHy83JeXKIh7U6Dkllz
+0cmIu0/mH3lzWm1I19We197hBTBX8c+LDV1dGb9O6Kd7K9GHUMR2/5T09ZKcxa7o
+opR4Mj9gQ7s7ySIAYItmtIRljzKDsh+z65PVdMQfvHaqqtTNALeFLsaAQJBNq06z
+1mKt/BA6j/jpJej7SLM=
+-----END PRIVATE KEY-----

package/config/proxy/generate-ca.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# Generate a Squid CA certificate for SSL bumping.
+# Called during Docker image build to create a deterministic CA.
+set -e
+
+CERT_DIR=/etc/squid/ssl
+mkdir -p "$CERT_DIR"
+
+openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
+    -subj "/C=US/ST=Test/L=E2E/O=Celilo E2E/CN=E2E Forward Proxy CA" \
+    -keyout "$CERT_DIR/squid-ca.pem" \
+    -out "$CERT_DIR/squid-ca.pem" 2>/dev/null
+
+# Export just the certificate (no private key) for distribution to clients
+openssl x509 -in "$CERT_DIR/squid-ca.pem" -out "$CERT_DIR/squid-ca.crt"
+
+# Initialize Squid SSL certificate database
+/usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB 2>/dev/null || true
+
+echo "Squid CA generated at $CERT_DIR/squid-ca.pem"

package/config/proxy/squid-ca.crt

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDozCCAougAwIBAgIUNd9blKIHJAKDmqm52oe1zQEf9PowDQYJKoZIhvcNAQEL
+BQAwYTELMAkGA1UEBhMCVVMxDTALBgNVBAgMBFRlc3QxDDAKBgNVBAcMA0UyRTEW
+MBQGA1UECgwNQ29uZHVjdG9yIEUyRTEdMBsGA1UEAwwURTJFIEZvcndhcmQgUHJv
+eHkgQ0EwHhcNMjYwMzMwMDI0OTAxWhcNMzYwMzI3MDI0OTAxWjBhMQswCQYDVQQG
+EwJVUzENMAsGA1UECAwEVGVzdDEMMAoGA1UEBwwDRTJFMRYwFAYDVQQKDA1Db25k
+dWN0b3IgRTJFMR0wGwYDVQQDDBRFMkUgRm9yd2FyZCBQcm94eSBDQTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAPXyuY1L9PAJxj4sTLp1qbIFHgKh+oRX
+sZqyhSLJl8dcn8ulf6Xi9ESyOacN99K6z0WQHRSCPOcrDjqqfuTpysK7noZgRu7w
+85xxGGviERbaS7/cCLczVVbVWJznz0z5aTV6gNG0fZjhCNeubq8jWBlRHwruWXDR
+PxsJMwq7HBfhvraM9soh43L5ZFW+6Rg2mf8Ka0i+j+wJsqimmHUpfLuU3Uv12sb+
+7px6EK9jaa7NL6DFZgEtnmpHYLcCJmfrmWLsx58xlUQC2mr3nrR7xLnuyd5iWt5s
+q8ggnerAbw3xqFXrvaVbwNrzgRwszsu/2Sg46Jd2Ymks5XGHpY2tz/UCAwEAAaNT
+MFEwHQYDVR0OBBYEFNPJkgXvVsG2f4o4KfYIhGM42bRKMB8GA1UdIwQYMBaAFNPJ
+kgXvVsG2f4o4KfYIhGM42bRKMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBABoZdGSVrwMScAebd+zHsvq8uexmKqhU2T6XKjuIHy+OzEZfalPzv+Gm
+U7aZfulpLfwqfsiAq2aSTv3+CFRBgTzQJUaY4URt8S7WoQ1fSPF9ZHYFyOV+eEvK
+biTixKSyH++dW3Z4Xn4vELf1mzZQM1mUaUs34hf0lxVjRs+zXzzG8W5MeIFMXKle
+yamqnud5L8oS0l9l45n0R2yBHenWkRZ1yF6EtPxBSGXitLRN0Ge3AMKyRzTbqcnD
+BbSXk41Offknn9StmLkDUnX3/xbv99sDcbUyj7FDC0VNEqgZfd/6jSsAdyBdaiIa
+AHTY/mSRaUZ9otjpKFpxjrHfdZNPWQM=
+-----END CERTIFICATE-----

package/config/proxy/squid-ca.pem

@@ -0,0 +1,50 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQD18rmNS/TwCcY+
+LEy6damyBR4CofqEV7GasoUiyZfHXJ/LpX+l4vREsjmnDffSus9FkB0UgjznKw46
+qn7k6crCu56GYEbu8POccRhr4hEW2ku/3Ai3M1VW1Vic589M+Wk1eoDRtH2Y4QjX
+rm6vI1gZUR8K7llw0T8bCTMKuxwX4b62jPbKIeNy+WRVvukYNpn/CmtIvo/sCbKo
+pph1KXy7lN1L9drG/u6cehCvY2muzS+gxWYBLZ5qR2C3AiZn65li7MefMZVEAtpq
+9560e8S57sneYlrebKvIIJ3qwG8N8ahV672lW8Da84EcLM7Lv9koOOiXdmJpLOVx
+h6WNrc/1AgMBAAECggEAH1E18Vj/qmUEOjx31LJQ1lsydBFeDeYAtnsO2twimH8h
+1dOQCnZ4thqfnrb3nHyvEeOE4GypBqKD4FJ/b/SZHey4BdJSlfBWhNAd1PbnSCqp
+xJdnALTno/PsoaYezmVf0TB1IL7D02isMJKEg4aTnD2pH0I0X1o1l+K2/iHPNPcI
+4xDYlINdqmdGNkmaDpgAjrrSSDQCWHa2FcskNKu8+K+Fif7AHKM4rSFwCxzdDN9D
+iAkG4cRdMBTjxMZRS/w82ggBFtKiAz0qYp1i4PxmSTuNQjjfdFm3qv2JrVxjLVNe
+7re/gTHCwbMx57aDGX5cGrOKG5+By0Xcri+AEYwfDQKBgQD9Knus/7GHeZF50BLX
+bakDwFHlxCHGSJKP+R3I0BuxGpFa6dh3TFbvKqYAOpNuV281S1svDgfQp3W6ea6V
+5WRzKhpaYOLrFrgKb4Pxt6Ymzhs4/A7vMzQ9xA6hufK7/9ld4E/+tpLl1NgTQ9Y7
+zrOZSwVzJ3hy/P7I72/8cLqrvwKBgQD4s46dZ8h9LIQHMB6bRwjvRy0QNU2nmmn1
+TIB/ZjqgJYYAqjJuBSclA2MytKd7q+dGpiPIXYc0bGY5EfojgUjRi4gfizFH+83/
+wM3pmBUcKyYaUv+mxtMSfAq5kC0uO3MOa/R1ALj3YtCO+qcrJX8tlCOinqneCRK3
+2vVTPx5BSwKBgQCFCjZEC3q3vuL8KKQ+IZqYJhDjtdYp5SlgD4Hfbb2frF6GcC0Z
+RDzLIpZpuF6RtdDzKM6aQ71HoTj07c0ZaJsJCi8fH5sf/6hnk4K7G89sxRL5NzyB
+516ktssZoiY1NZZ9BswDBt7beKa0OQn0FAO9ovcSNMPPabRa07j96B+w8QKBgB9g
+J8Hb8gM4tn9hprrYP1xQknLVBrL6XBvCRwPLleHWWg2Da1FN/R5CSyV+fRKxIUBc
+fW8tvXzzoAHbLr+D8/fbrpSsLs9yCQ8W9+NceG1RVEFF71LPCpnuZDv84HZQsbdE
+D1cjfDJZmQ4wuR5MYLsTUVuWwL9uTZo8WW7jK6H5AoGBALxPBXNtLjvGHOMooA0I
+5LwdyzJxSLlA6cLU8P5NSfUWEZAEH9fnD3q+tiYeGzf62ptxXOOrzEe/q91HVtwW
+ugvVmbdJ8IMrtz+uVt5f5XrlHEa4sTfS+Kk+pZJMwTkGpGSav91u6ND0+/r+IgR2
+I0OZRbgFU0YofZgI88DIH35e
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDozCCAougAwIBAgIUNd9blKIHJAKDmqm52oe1zQEf9PowDQYJKoZIhvcNAQEL
+BQAwYTELMAkGA1UEBhMCVVMxDTALBgNVBAgMBFRlc3QxDDAKBgNVBAcMA0UyRTEW
+MBQGA1UECgwNQ29uZHVjdG9yIEUyRTEdMBsGA1UEAwwURTJFIEZvcndhcmQgUHJv
+eHkgQ0EwHhcNMjYwMzMwMDI0OTAxWhcNMzYwMzI3MDI0OTAxWjBhMQswCQYDVQQG
+EwJVUzENMAsGA1UECAwEVGVzdDEMMAoGA1UEBwwDRTJFMRYwFAYDVQQKDA1Db25k
+dWN0b3IgRTJFMR0wGwYDVQQDDBRFMkUgRm9yd2FyZCBQcm94eSBDQTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAPXyuY1L9PAJxj4sTLp1qbIFHgKh+oRX
+sZqyhSLJl8dcn8ulf6Xi9ESyOacN99K6z0WQHRSCPOcrDjqqfuTpysK7noZgRu7w
+85xxGGviERbaS7/cCLczVVbVWJznz0z5aTV6gNG0fZjhCNeubq8jWBlRHwruWXDR
+PxsJMwq7HBfhvraM9soh43L5ZFW+6Rg2mf8Ka0i+j+wJsqimmHUpfLuU3Uv12sb+
+7px6EK9jaa7NL6DFZgEtnmpHYLcCJmfrmWLsx58xlUQC2mr3nrR7xLnuyd5iWt5s
+q8ggnerAbw3xqFXrvaVbwNrzgRwszsu/2Sg46Jd2Ymks5XGHpY2tz/UCAwEAAaNT
+MFEwHQYDVR0OBBYEFNPJkgXvVsG2f4o4KfYIhGM42bRKMB8GA1UdIwQYMBaAFNPJ
+kgXvVsG2f4o4KfYIhGM42bRKMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBABoZdGSVrwMScAebd+zHsvq8uexmKqhU2T6XKjuIHy+OzEZfalPzv+Gm
+U7aZfulpLfwqfsiAq2aSTv3+CFRBgTzQJUaY4URt8S7WoQ1fSPF9ZHYFyOV+eEvK
+biTixKSyH++dW3Z4Xn4vELf1mzZQM1mUaUs34hf0lxVjRs+zXzzG8W5MeIFMXKle
+yamqnud5L8oS0l9l45n0R2yBHenWkRZ1yF6EtPxBSGXitLRN0Ge3AMKyRzTbqcnD
+BbSXk41Offknn9StmLkDUnX3/xbv99sDcbUyj7FDC0VNEqgZfd/6jSsAdyBdaiIa
+AHTY/mSRaUZ9otjpKFpxjrHfdZNPWQM=
+-----END CERTIFICATE-----

package/config/proxy/squid.conf

@@ -0,0 +1,38 @@
+# Squid transparent MITM proxy for E2E test network
+# Intercepts HTTP/HTTPS from simulated machines and proxies to real internet
+
+# Regular forward proxy port (required by Squid even in intercept mode)
+http_port 3127
+
+# Transparent interception ports
+http_port 3128 intercept
+https_port 3129 intercept ssl-bump \
+    cert=/etc/squid/ssl/squid-ca.pem \
+    generate-host-certificates=on \
+    dynamic_cert_mem_cache_size=4MB
+
+# SSL bump: peek at SNI, then bump (MITM) all connections
+acl step1 at_step SslBump1
+ssl_bump peek step1
+ssl_bump bump all
+
+# Allow all traffic (the E2E network is fully trusted)
+http_access allow all
+
+# Cache settings (speeds up repeated package downloads)
+cache_dir ufs /var/spool/squid 200 16 256
+maximum_object_size 512 MB
+
+# SSL certificate database
+sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 4MB
+
+# Logging
+access_log stdio:/var/log/squid/access.log
+cache_log /var/log/squid/cache.log
+
+# Resolve via real public DNS (reachable from real-internet bridge)
+dns_nameservers 8.8.8.8 1.1.1.1
+
+# Timeouts
+connect_timeout 30 seconds
+read_timeout 60 seconds

package/config/proxy/startup.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+
+# Route outbound traffic via real-internet bridge
+ip route del default 2>/dev/null || true
+ip route add default via 172.30.0.1
+
+rm -f /run/squid.pid
+
+echo "forward-proxy ready on ports 3128 (HTTP) / 3129 (HTTPS)"
+exec squid -N -f /etc/squid/squid.conf

package/config/resolver/root.hints

@@ -0,0 +1,2 @@
+.                   3600000  NS  root-dns.lab.
+root-dns.lab.       3600000  A   100.64.0.53

package/config/resolver/unbound.conf

@@ -0,0 +1,28 @@
+server:
+    interface: 0.0.0.0
+    access-control: 0.0.0.0/0 allow
+    cache-min-ttl: 0
+    cache-max-ttl: 60
+    verbosity: 1
+    do-daemonize: no
+    do-not-query-localhost: no
+
+    # Simulated DNS overrides (served directly by unbound)
+    # Let's Encrypt ACME endpoints → Pebble
+    local-data: "acme-v02.api.letsencrypt.org. IN A 100.64.0.100"
+    local-data: "acme-staging-v02.api.letsencrypt.org. IN A 100.64.0.100"
+
+# Simulated domains → namecheap-dns (authoritative)
+stub-zone:
+    name: "iamtheinternet.org."
+    stub-addr: 100.64.0.55
+
+stub-zone:
+    name: "park-your-domain.com."
+    stub-addr: 100.64.0.55
+
+# Everything else → real public DNS (reachable via real-internet bridge)
+forward-zone:
+    name: "."
+    forward-addr: 8.8.8.8
+    forward-addr: 1.1.1.1

package/config/routing/apt-cache-routes.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -e
+
+# The apt-cache container has two interfaces:
+# - internet-external (100.64.0.x): reachable by simulated machines
+# - real-internet: has masquerade enabled for actual internet access
+#
+# Default route must go via the real-internet bridge (for package downloads).
+# Simulated machines reach us on 100.64.0.2:3142.
+
+# Fix default route: use real-internet bridge for outbound traffic
+# Docker defaults to the first network's gateway, but we need the
+# real-internet network which has masquerade enabled.
+ip route del default 2>/dev/null || true
+ip route add default via 172.30.0.1
+
+# Start apt-cacher-ng
+/usr/sbin/apt-cacher-ng -c /etc/apt-cacher-ng
+
+echo "apt-cache ready on port 3142"
+sleep infinity

package/config/routing/dhcp-client-setup.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# DHCP client container startup
+# Gets network config (DNS server, search domain) from DHCP
+set -e
+
+echo "DHCP client starting..."
+
+# Run dhclient - it will get a lease from dnsmasq on the greenwave sim
+# The lease file at /var/lib/dhcp/dhclient.leases records what was offered
+mkdir -p /var/lib/dhcp
+dhclient -v eth0 2>&1 || true
+
+echo "DHCP client ready: $(hostname)"
+echo "Lease info:"
+cat /var/lib/dhcp/dhclient.leases 2>/dev/null | head -20
+
+sleep infinity

package/config/routing/dns-routes.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -e
+
+# Routing — all DNS servers are on internet-external
+ip route del default 2>/dev/null || true
+ip route add default via 100.64.0.1    # Everything via fw-ext
+
+# Start knot DNS
+/usr/sbin/knotd --config /config/knot.conf --daemonize
+
+echo "DNS server ready: $(hostname)"
+sleep infinity

package/config/routing/fw-ext-routes.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+set -e
+
+# Routing
+ip route del default 2>/dev/null || true
+# Default route via real-internet bridge (for Squid outbound to real internet)
+ip route add default via 172.30.0.1
+# Internal subnets via fw-isp
+ip route add 192.168.0.0/24 via 100.100.0.100     # Internal via fw-isp
+ip route add 10.0.10.0/24 via 100.100.0.100       # dmz via fw-isp
+ip route add 10.0.20.0/24 via 100.100.0.100       # app via fw-isp
+ip route add 10.0.30.0/24 via 100.100.0.100       # secure via fw-isp
+
+# IP forwarding is set via sysctls in docker-compose
+
+# NAT/forward between isp-external and internet-external
+iptables -t nat -A POSTROUTING -j MASQUERADE
+iptables -P FORWARD ACCEPT
+
+# Start Squid transparent proxy (runs on fw-ext itself)
+rm -f /run/squid.pid
+squid -N -f /etc/squid/squid.conf &
+
+# Transparent proxy: REDIRECT HTTP/HTTPS from isp-external to local Squid
+# Exception: traffic to simulated services (100.64.0.0/24) passes through directly
+ISP_IFACE=$(ip -o addr show | grep '100.100.0.101' | awk '{print $2}')
+iptables -t nat -A PREROUTING -i "$ISP_IFACE" -p tcp --dport 80 ! -d 100.64.0.0/24 -j REDIRECT --to-port 3128
+iptables -t nat -A PREROUTING -i "$ISP_IFACE" -p tcp --dport 443 ! -d 100.64.0.0/24 -j REDIRECT --to-port 3129
+
+# DNS
+echo "nameserver 100.100.0.1" > /etc/resolv.conf
+
+# Fetch Pebble's runtime ACME root CA (Pebble generates a fresh root at each startup)
+# Retry until Pebble is up and responding
+echo "Waiting for Pebble ACME root CA..."
+(
+  for i in $(seq 1 60); do
+    if curl -sk https://100.64.0.100:15000/roots/0 -o /usr/local/share/ca-certificates/pebble-acme-root.crt 2>/dev/null; then
+      if [ -s /usr/local/share/ca-certificates/pebble-acme-root.crt ]; then
+        update-ca-certificates 2>/dev/null
+        echo "Pebble ACME root CA installed"
+        break
+      fi
+    fi
+    sleep 2
+  done
+) &
+
+echo "fw-ext ready (with transparent HTTPS proxy)"
+sleep infinity

package/config/routing/fw-isp-routes.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+set -e
+
+# SSH setup
+mkdir -p /root/.ssh
+cp /ssh-keys/authorized_keys /root/.ssh/authorized_keys
+chmod 700 /root/.ssh
+chmod 600 /root/.ssh/authorized_keys
+/usr/sbin/sshd
+
+# Routing
+ip route del default 2>/dev/null || true
+ip route add default via 100.100.0.101            # Internet via fw-ext
+ip route add 10.0.10.0/24 via 192.168.0.254       # dmz via fw-main
+ip route add 10.0.20.0/24 via 192.168.0.254       # app via fw-main
+ip route add 10.0.30.0/24 via 192.168.0.254       # secure via fw-main
+
+# IP forwarding is set via sysctls in docker-compose
+
+# NAT all outbound traffic
+iptables -t nat -A POSTROUTING -j MASQUERADE
+iptables -P FORWARD ACCEPT
+
+# DNS
+echo "nameserver 100.100.0.1" > /etc/resolv.conf
+
+# Start dnsmasq DHCP server on internal network
+dnsmasq --conf-dir=/etc/dnsmasq.d --keep-in-foreground --log-facility=- &
+echo "dnsmasq DHCP server started"
+
+# Start greenwave simulator
+if [ -f /simulator/server.ts ]; then
+  cd /simulator && bun run server.ts &
+fi
+
+echo "fw-isp ready"
+sleep infinity

package/config/routing/fw-main-routes.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+set -e
+
+# SSH setup
+mkdir -p /root/.ssh
+cp /ssh-keys/authorized_keys /root/.ssh/authorized_keys
+chmod 700 /root/.ssh
+chmod 600 /root/.ssh/authorized_keys
+/usr/sbin/sshd
+
+# Routing — detect if we have an isp-external interface (direct-internet topology)
+ip route del default 2>/dev/null || true
+if ip -o addr show | grep -q '100.100.0'; then
+  # Direct internet: route via fw-ext on isp-external
+  ip route add default via 100.100.0.101
+else
+  # Default: route via fw-isp on internal
+  ip route add default via 192.168.0.1
+fi
+
+# IP forwarding is set via sysctls in docker-compose
+
+# NAT all outbound traffic from dmz/app/secure
+iptables -t nat -A POSTROUTING -j MASQUERADE
+iptables -P FORWARD ACCEPT
+
+# DNS
+echo "nameserver 100.100.0.1" > /etc/resolv.conf
+
+echo "fw-main ready"
+sleep infinity

package/config/routing/management-routes.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+set -e
+
+# System-wide environment for all processes (hooks, ansible, etc.)
+echo 'DDNS_ENDPOINT=http://100.64.0.55:8080/update' >> /etc/environment
+export DDNS_ENDPOINT="http://100.64.0.55:8080/update"
+
+# Generate SSH keys if needed
+/config/ssh/generate-keys.sh /ssh-keys
+
+# Set up SSH
+mkdir -p /root/.ssh
+cp /ssh-keys/id_ed25519 /root/.ssh/id_ed25519
+cp /ssh-keys/id_ed25519.pub /root/.ssh/id_ed25519.pub
+chmod 700 /root/.ssh
+chmod 600 /root/.ssh/id_ed25519
+# Accept all host keys automatically
+echo "StrictHostKeyChecking no" > /root/.ssh/config
+echo "UserKnownHostsFile /dev/null" >> /root/.ssh/config
+chmod 600 /root/.ssh/config
+
+# Routing — DEFAULT_GATEWAY comes from docker-compose environment
+# default: 192.168.0.1 (fw-isp), direct-internet: 192.168.0.254 (fw-main)
+GATEWAY="${DEFAULT_GATEWAY:-192.168.0.1}"
+ip route del default 2>/dev/null || true
+ip route add default via "$GATEWAY"
+ip route add 10.0.10.0/24 via 192.168.0.254    # dmz via fw-main
+ip route add 10.0.20.0/24 via 192.168.0.254    # app via fw-main
+ip route add 10.0.30.0/24 via 192.168.0.254    # secure via fw-main
+
+# DNS — use the simulated resolver
+echo "nameserver 100.100.0.1" > /etc/resolv.conf
+
+# Create celilo data directory (Linux default: /var/lib/celilo/)
+mkdir -p /var/lib/celilo/modules
+
+# Dependencies come from the host bind mount (node_modules/)
+# If missing, run 'cd apps/celilo && bun install' on the host first.
+cd /celilo/apps/celilo
+if [ ! -d node_modules/@clack ]; then
+  echo "WARNING: node_modules not found. Run 'cd apps/celilo && bun install' on the host."
+fi
+
+# Generate zsh completion script from celilo
+mkdir -p /root/.zsh/completions
+bun run /celilo/apps/celilo/src/cli/index.ts completion zsh > /root/.zsh/completions/_celilo 2>/dev/null || true
+
+# Shell setup: aliases and completion for zsh
+cat > /root/.zshrc << 'ZSHRC'
+export PATH="/root/.bun/bin:$PATH"
+
+# Simulated network overrides
+export DDNS_ENDPOINT="http://100.64.0.55:8080/update"
+
+# History
+HISTFILE=/root/.zsh_history
+HISTSIZE=10000
+SAVEHIST=10000
+setopt SHARE_HISTORY
+setopt HIST_IGNORE_DUPS
+setopt HIST_IGNORE_SPACE
+
+# Key bindings — emacs mode (ctrl-p/n for history, ctrl-a/e, etc.)
+bindkey -e
+bindkey '^P' up-history
+bindkey '^N' down-history
+bindkey '^R' history-incremental-search-backward
+
+# Prompt
+PROMPT='%F{cyan}celilo%f:%F{yellow}%~%f# '
+
+# Commands
+celilo() { bun run /celilo/apps/celilo/src/cli/index.ts "$@"; }
+c() { celilo "$@"; }
+alias ll='ls -la'
+
+# Tab completion — use celilo's built-in zsh completion generator
+fpath=(~/.zsh/completions $fpath)
+autoload -Uz compinit && compinit -u
+
+# Also bind `c` to the same completion
+compdef _celilo c
+
+cd /celilo/apps/celilo
+ZSHRC
+
+# Also set up bash aliases (for non-zsh shells)
+cat > /root/.bashrc << 'BASHRC'
+export PATH="/root/.bun/bin:$PATH"
+alias celilo='bun run /celilo/apps/celilo/src/cli/index.ts'
+alias c='celilo'
+cd /celilo/apps/celilo
+BASHRC
+
+echo "Management machine ready"
+sleep infinity

package/config/routing/namecheap-startup.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+set -e
+
+# Routing
+ip route del default 2>/dev/null || true
+ip route add default via 100.64.0.1
+
+# Start knot DNS
+/usr/sbin/knotd --config /config/knot.conf --daemonize
+
+# Start DDNS simulator (will be added in Phase 3)
+if [ -f /simulator/server.ts ]; then
+  cd /simulator && bun run server.ts &
+fi
+
+echo "namecheap-dns ready"
+sleep infinity

package/config/routing/pebble-startup.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -e
+
+# Route through fw-ext to reach isp-external (where comcast-resolver lives)
+ip route del default 2>/dev/null || true
+ip route add default via 100.64.0.1
+
+echo "pebble starting"
+exec pebble "$@"

package/config/routing/resolver-routes.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e
+
+# Routing: default via real-internet bridge for DNS forwarding to real upstream
+ip route del default 2>/dev/null || true
+ip route add default via 172.30.0.1
+
+# Keep route to simulated internet services via fw-ext
+ip route add 100.64.0.0/24 via 100.100.0.101
+
+# Start unbound
+/usr/sbin/unbound -d &
+
+echo "comcast-resolver ready"
+sleep infinity

package/config/routing/target-routes.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# Generic startup for target machines (dmz/app/secure).
+# The default gateway is passed as $1 (e.g., 10.0.10.1 for dmz).
+set -e
+
+GATEWAY="${1:?Usage: target-routes.sh <gateway-ip>}"
+
+# SSH setup
+mkdir -p /root/.ssh
+cp /ssh-keys/authorized_keys /root/.ssh/authorized_keys
+chmod 700 /root/.ssh
+chmod 600 /root/.ssh/authorized_keys
+/usr/sbin/sshd
+
+# Routing
+ip route del default 2>/dev/null || true
+ip route add default via "$GATEWAY"
+
+# DNS
+echo "nameserver 100.100.0.1" > /etc/resolv.conf
+
+echo "Target machine ready: $(hostname)"
+sleep infinity

package/config/routing/target-setup.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=E2E target machine network setup
+After=network.target
+Before=ssh.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/target-setup.sh
+RemainAfterExit=yes
+PassEnvironment=GATEWAY
+
+[Install]
+WantedBy=multi-user.target