@celilo/e2e 0.1.0

package/config/routing/target-setup.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# E2E target machine boot setup: routing, DNS, SSH keys.
+# Runs as a systemd oneshot service at boot.
+# GATEWAY is set via environment variable from docker-compose.
+set -e
+
+GATEWAY="${GATEWAY:?GATEWAY not set}"
+
+# Wait for SSH keys (management container generates them)
+echo "Waiting for SSH keys..."
+for i in $(seq 1 30); do
+  if [ -f /ssh-keys/authorized_keys ]; then
+    break
+  fi
+  sleep 1
+done
+
+if [ ! -f /ssh-keys/authorized_keys ]; then
+  echo "ERROR: SSH keys not found after 30s"
+  exit 1
+fi
+
+# SSH keys
+mkdir -p /root/.ssh
+cp /ssh-keys/authorized_keys /root/.ssh/authorized_keys
+chmod 700 /root/.ssh
+chmod 600 /root/.ssh/authorized_keys
+
+# Routing
+ip route del default 2>/dev/null || true
+ip route add default via "$GATEWAY"
+
+# DNS
+echo "nameserver 100.100.0.1" > /etc/resolv.conf
+
+echo "Target machine ready: $(hostname)"

package/config/ssh/generate-keys.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Generate SSH keypair for the test harness.
+# Called during container startup if keys don't exist yet.
+set -e
+
+KEY_DIR="${1:-/ssh-keys}"
+mkdir -p "$KEY_DIR"
+
+if [ ! -f "$KEY_DIR/id_ed25519" ]; then
+  ssh-keygen -t ed25519 -f "$KEY_DIR/id_ed25519" -N "" -q
+  cat "$KEY_DIR/id_ed25519.pub" > "$KEY_DIR/authorized_keys"
+  chmod 600 "$KEY_DIR/id_ed25519"
+  chmod 644 "$KEY_DIR/id_ed25519.pub" "$KEY_DIR/authorized_keys"
+  echo "SSH keys generated in $KEY_DIR"
+else
+  echo "SSH keys already exist in $KEY_DIR"
+fi

package/docker/Dockerfile.apt-cache

@@ -0,0 +1,16 @@
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y \
+    apt-cacher-ng \
+    iproute2 \
+    iputils-ping \
+    && rm -rf /var/lib/apt/lists/*
+
+# apt-cacher-ng config: allow HTTPS passthrough
+RUN echo "PassThroughPattern: .*" >> /etc/apt-cacher-ng/acng.conf
+
+COPY config/routing/apt-cache-routes.sh /startup.sh
+RUN chmod +x /startup.sh
+
+EXPOSE 3142
+CMD ["/startup.sh"]

package/docker/Dockerfile.authoritative-dns

@@ -0,0 +1,15 @@
+FROM cznic/knot
+
+RUN apt-get update && apt-get install -y \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY config/routing/dns-routes.sh /startup.sh
+RUN chmod +x /startup.sh
+
+# Zone files and knot config are volume-mounted per instance
+CMD ["/startup.sh"]

package/docker/Dockerfile.dhcp-client

@@ -0,0 +1,16 @@
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    isc-dhcp-client \
+    iproute2 \
+    iputils-ping \
+    dnsutils \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY config/routing/dhcp-client-setup.sh /startup.sh
+RUN chmod +x /startup.sh
+
+CMD ["/startup.sh"]

package/docker/Dockerfile.firewall

@@ -0,0 +1,28 @@
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y \
+    openssh-server \
+    iptables \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /run/sshd && \
+    sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config && \
+    sed -i 's/#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+
+# Trust the E2E forward proxy CA (for transparent HTTPS interception)
+COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
+RUN update-ca-certificates
+
+# Point apt at the simulated apt cache proxy
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
+COPY config/routing/fw-main-routes.sh /startup.sh
+RUN chmod +x /startup.sh
+
+CMD ["/startup.sh"]

package/docker/Dockerfile.forward-proxy

@@ -0,0 +1,28 @@
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y \
+    squid-openssl \
+    openssl \
+    iproute2 \
+    iputils-ping \
+    && rm -rf /var/lib/apt/lists/*
+
+# Pre-generated CA certificate for SSL bumping
+COPY config/proxy/squid-ca.pem /etc/squid/ssl/squid-ca.pem
+RUN chmod 600 /etc/squid/ssl/squid-ca.pem
+
+# Initialize SSL certificate database
+RUN /usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB
+
+# Squid config
+COPY config/proxy/squid.conf /etc/squid/squid.conf
+
+# Create log and cache directories, initialize swap
+RUN mkdir -p /var/log/squid && chown proxy:proxy /var/log/squid
+RUN squid -z -f /etc/squid/squid.conf 2>/dev/null; sleep 1; kill "$(cat /run/squid.pid 2>/dev/null)" 2>/dev/null; rm -f /run/squid.pid; true
+
+COPY config/proxy/startup.sh /startup.sh
+RUN chmod +x /startup.sh
+
+EXPOSE 3128 3129
+CMD ["/startup.sh"]

package/docker/Dockerfile.greenwave-sim

@@ -0,0 +1,29 @@
+FROM oven/bun:latest
+
+RUN apt-get update && apt-get install -y \
+    openssh-server \
+    iptables \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    curl \
+    python3 \
+    dnsmasq \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /run/sshd && \
+    sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config && \
+    sed -i 's/#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+
+# Trust the E2E forward proxy CA (for transparent HTTPS interception)
+COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
+RUN update-ca-certificates
+
+COPY simulators/greenwave/ /simulator/
+COPY config/dhcp/dnsmasq.conf /etc/dnsmasq.d/e2e.conf
+COPY config/routing/fw-isp-routes.sh /startup.sh
+RUN chmod +x /startup.sh
+
+CMD ["/startup.sh"]

package/docker/Dockerfile.management

@@ -0,0 +1,30 @@
+FROM oven/bun:latest
+
+RUN apt-get update && apt-get install -y \
+    openssh-client \
+    ansible \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    curl \
+    procps \
+    zsh \
+    && rm -rf /var/lib/apt/lists/*
+
+# Set zsh as default shell
+RUN chsh -s /bin/zsh root
+
+# Trust the E2E forward proxy CA (for transparent HTTPS interception)
+COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
+RUN update-ca-certificates
+
+# Point apt at the simulated apt cache proxy (for runtime apt usage)
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
+COPY config/ssh/generate-keys.sh /config/ssh/generate-keys.sh
+COPY config/routing/management-routes.sh /startup.sh
+RUN chmod +x /startup.sh /config/ssh/generate-keys.sh
+
+WORKDIR /celilo/apps/celilo
+CMD ["/startup.sh"]

package/docker/Dockerfile.namecheap-dns

@@ -0,0 +1,25 @@
+FROM cznic/knot
+
+RUN apt-get update && apt-get install -y \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    curl \
+    unzip \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install bun for the DDNS API simulator
+RUN curl -fsSL https://bun.sh/install | bash
+ENV PATH="/root/.bun/bin:$PATH"
+
+COPY simulators/namecheap-ddns/ /simulator/
+COPY config/routing/dns-routes.sh /dns-routes.sh
+RUN chmod +x /dns-routes.sh
+
+# Custom startup: knot DNS + DDNS simulator
+COPY config/routing/namecheap-startup.sh /startup.sh
+RUN chmod +x /startup.sh
+
+CMD ["/startup.sh"]

package/docker/Dockerfile.pebble

@@ -0,0 +1,18 @@
+FROM ghcr.io/letsencrypt/pebble:latest AS pebble
+
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y \
+    iproute2 \
+    iputils-ping \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy Pebble binary and test certs from official image
+COPY --from=pebble /app /usr/local/bin/pebble
+COPY --from=pebble /test /test
+
+COPY config/routing/pebble-startup.sh /startup.sh
+RUN chmod +x /startup.sh
+
+ENTRYPOINT ["/startup.sh"]

package/docker/Dockerfile.resolver

@@ -0,0 +1,20 @@
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y \
+    unbound \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN chown -R root:unbound /etc/unbound
+
+COPY config/resolver/unbound.conf /etc/unbound/unbound.conf
+COPY config/resolver/root.hints /etc/unbound/root.hints
+COPY config/routing/resolver-routes.sh /startup.sh
+RUN chmod +x /startup.sh
+
+EXPOSE 53/tcp 53/udp
+CMD ["/startup.sh"]

package/docker/Dockerfile.router

@@ -0,0 +1,33 @@
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y \
+    iproute2 \
+    iptables \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    curl \
+    ca-certificates \
+    squid-openssl \
+    openssl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Trust Pebble's test CA (so curl from fw-ext trusts Caddy's ACME cert)
+COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
+RUN update-ca-certificates
+
+# Squid CA certificate for SSL bumping
+COPY config/proxy/squid-ca.pem /etc/squid/ssl/squid-ca.pem
+RUN chmod 600 /etc/squid/ssl/squid-ca.pem
+
+# Initialize Squid SSL cert db and cache dirs
+RUN /usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB
+COPY config/proxy/squid.conf /etc/squid/squid.conf
+RUN mkdir -p /var/log/squid && chown proxy:proxy /var/log/squid
+RUN squid -z -f /etc/squid/squid.conf 2>/dev/null; sleep 1; kill "$(cat /run/squid.pid 2>/dev/null)" 2>/dev/null; rm -f /run/squid.pid; true
+
+COPY config/routing/fw-ext-routes.sh /startup.sh
+RUN chmod +x /startup.sh
+
+CMD ["/startup.sh"]

package/docker/Dockerfile.target-machine

@@ -0,0 +1,58 @@
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    systemd \
+    systemd-sysv \
+    openssh-server \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    python3 \
+    sudo \
+    curl \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Trust the E2E forward proxy CA (for transparent HTTPS interception)
+COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
+# Trust Pebble's test CA (so Caddy/ACME clients trust the simulated Let's Encrypt)
+COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
+RUN update-ca-certificates
+
+RUN mkdir -p /run/sshd && \
+    sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config && \
+    sed -i 's/#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+
+# Enable SSH service
+RUN systemctl enable ssh
+
+# Point apt at the simulated apt cache proxy
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
+# E2E network setup service (runs at boot to configure routing, DNS, SSH keys)
+COPY config/routing/target-setup.sh /usr/local/bin/target-setup.sh
+RUN chmod +x /usr/local/bin/target-setup.sh
+
+COPY config/routing/target-setup.service /etc/systemd/system/target-setup.service
+RUN systemctl enable target-setup
+
+# Clean up unnecessary systemd services that slow down boot
+RUN (cd /lib/systemd/system/sysinit.target.wants/ && \
+    ls | grep -v systemd-tmpfiles-setup | xargs rm -f 2>/dev/null); \
+    rm -f /lib/systemd/system/multi-user.target.wants/*; \
+    rm -f /etc/systemd/system/*.wants/*; \
+    rm -f /lib/systemd/system/local-fs.target.wants/*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
+    rm -f /lib/systemd/system/basic.target.wants/*; \
+    true
+
+# Re-enable the services we actually need
+RUN systemctl enable ssh target-setup
+
+STOPSIGNAL SIGRTMIN+3
+ENTRYPOINT ["/sbin/init"]

package/docker/Dockerfile.target-machine-docker

@@ -0,0 +1,105 @@
+# Target machine with Docker pre-installed and authentik images pre-pulled.
+# Used for app-zone machines that will run Docker Compose workloads.
+# This avoids a 10+ minute Docker pull during e2e test deploy time.
+
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    systemd \
+    systemd-sysv \
+    openssh-server \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    python3 \
+    sudo \
+    curl \
+    ca-certificates \
+    gnupg \
+    lsb-release \
+    && rm -rf /var/lib/apt/lists/*
+
+# Trust the E2E forward proxy CA (for transparent HTTPS interception)
+COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
+# Trust Pebble's test CA (so Caddy/ACME clients trust the simulated Let's Encrypt)
+COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
+RUN update-ca-certificates
+
+RUN mkdir -p /run/sshd && \
+    sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config && \
+    sed -i 's/#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+
+# Enable SSH service
+RUN systemctl enable ssh
+
+# Point apt at the simulated apt cache proxy
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
+# E2E network setup service
+COPY config/routing/target-setup.sh /usr/local/bin/target-setup.sh
+RUN chmod +x /usr/local/bin/target-setup.sh
+
+COPY config/routing/target-setup.service /etc/systemd/system/target-setup.service
+RUN systemctl enable target-setup
+
+# Clean up unnecessary systemd services
+RUN (cd /lib/systemd/system/sysinit.target.wants/ && \
+    ls | grep -v systemd-tmpfiles-setup | xargs rm -f 2>/dev/null); \
+    rm -f /lib/systemd/system/multi-user.target.wants/*; \
+    rm -f /etc/systemd/system/*.wants/*; \
+    rm -f /lib/systemd/system/local-fs.target.wants/*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
+    rm -f /lib/systemd/system/basic.target.wants/*; \
+    true
+
+# Re-enable the services we actually need
+RUN systemctl enable ssh target-setup
+
+# --- Docker pre-installation ---
+# Temporarily disable apt proxy (the e2e proxy isn't available during docker build)
+RUN rm -f /etc/apt/apt.conf.d/00proxy
+
+# Install Docker (same steps as the Ansible role, but at image build time)
+RUN install -m 0755 -d /etc/apt/keyrings && \
+    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \
+    chmod a+r /etc/apt/keyrings/docker.asc && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list && \
+    apt-get update && \
+    apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin && \
+    rm -rf /var/lib/apt/lists/*
+
+# Re-enable apt proxy for runtime
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
+# Configure Docker for nested operation (vfs storage driver)
+# Must match Ansible's exact content to avoid a Docker restart that wipes cached images
+# Ansible copy module writes: '{"storage-driver": "vfs"}\n'
+RUN mkdir -p /etc/docker && \
+    echo '{"storage-driver": "vfs"}' > /etc/docker/daemon.json
+
+RUN systemctl enable docker
+
+# Pre-cached image loading service:
+# At first boot, if /docker-image-cache/*.tar exists, load them into Docker.
+# This avoids multi-minute pulls during e2e test deploy.
+RUN echo '#!/bin/bash\n\
+set -e\n\
+if ls /docker-image-cache/*.tar 1>/dev/null 2>&1; then\n\
+  for img in /docker-image-cache/*.tar; do\n\
+    echo "Loading cached Docker image: $img"\n\
+    docker load < "$img"\n\
+  done\n\
+fi\n' > /usr/local/bin/load-cached-images.sh && \
+    chmod +x /usr/local/bin/load-cached-images.sh
+
+RUN printf '[Unit]\nDescription=Load pre-cached Docker images\nAfter=docker.service\nRequires=docker.service\n\n[Service]\nType=oneshot\nExecStart=/usr/local/bin/load-cached-images.sh\nRemainAfterExit=yes\n\n[Install]\nWantedBy=multi-user.target\n' \
+    > /etc/systemd/system/load-docker-cache.service && \
+    systemctl enable load-docker-cache
+
+STOPSIGNAL SIGRTMIN+3
+ENTRYPOINT ["/sbin/init"]

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@celilo/e2e",
+  "version": "0.1.0",
+  "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
+  "type": "module",
+  "main": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./types": "./src/types.ts",
+    "./fixtures": "./src/fixtures.ts"
+  },
+  "bin": {
+    "celilo-e2e-run": "./bin/e2e-run",
+    "celilo-e2e-build": "./bin/e2e-build",
+    "celilo-e2e-load": "./bin/e2e-load",
+    "celilo-e2e-infra": "./bin/e2e-infra"
+  },
+  "files": [
+    "src/",
+    "docker/",
+    "config/",
+    "simulators/",
+    "bin/",
+    "README.md"
+  ],
+  "dependencies": {
+    "yaml": "^2.8.0"
+  },
+  "devDependencies": {
+    "@types/bun": "latest"
+  },
+  "keywords": [
+    "celilo",
+    "e2e",
+    "testing",
+    "docker",
+    "infrastructure"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/psbanka/infra",
+    "directory": "packages/e2e"
+  }
+}