@celilo/e2e 0.14.0 → 0.15.0

package/docker/Dockerfile.management

@@ -37,6 +37,52 @@ RUN apt-get update && apt-get install -y \
     gnupg \
     && rm -rf /var/lib/apt/lists/*
 
+# --- Terraform, plus an OFFLINE provider mirror -------------------------------
+#
+# celilo runs `terraform apply` on the management box for any module placed on a
+# container_service. Until the Proxmox simulator existed, no suite could reach
+# that path — every test used the machine pool, where there is no infrastructure
+# to create — so the rig never needed terraform at all, and the deploy failed
+# with a bare `/bin/sh: 1: terraform: not found`.
+#
+# The provider is MIRRORED into the image rather than fetched at deploy time.
+# `terraform init` would otherwise reach registry.terraform.io, and the rig
+# simulates the whole internet: that name does not resolve inside the topology,
+# and making it resolve would mean pointing a public name at a private address —
+# the exact model violation the e2e rules prohibit. A filesystem mirror is how
+# real airgapped installs do this, so the rig is if anything more faithful.
+#
+# Version pinned to what the module templates declare. If a module ever moves off
+# `telmate/proxmox@3.0.2-rc07`, `terraform init` fails in the rig with a clear
+# "provider not available in mirror" rather than silently reaching outward.
+ARG TERRAFORM_VERSION=1.7.1
+ARG PROXMOX_PROVIDER_VERSION=3.0.2-rc07
+RUN set -eux; \
+    arch="$(dpkg --print-architecture)"; \
+    case "$arch" in \
+      amd64) tf_arch=amd64 ;; \
+      arm64) tf_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${tf_arch}.zip" -o /tmp/terraform.zip; \
+    unzip -q /tmp/terraform.zip -d /usr/local/bin; \
+    rm /tmp/terraform.zip; \
+    terraform version
+
+# Populate the mirror for the platform this image runs on.
+RUN set -eux; \
+    mkdir -p /opt/terraform-mirror /tmp/tfmirror; \
+    cd /tmp/tfmirror; \
+    printf 'terraform {\n  required_providers {\n    proxmox = {\n      source  = "telmate/proxmox"\n      version = "%s"\n    }\n  }\n}\n' "${PROXMOX_PROVIDER_VERSION}" > main.tf; \
+    terraform providers mirror /opt/terraform-mirror; \
+    rm -rf /tmp/tfmirror
+
+# `direct` is excluded on purpose: if the mirror is missing a provider we want a
+# loud failure, not a silent reach for the real internet from inside a simulated
+# one.
+RUN printf 'provider_installation {\n  filesystem_mirror {\n    path    = "/opt/terraform-mirror"\n    include = ["registry.terraform.io/*/*"]\n  }\n  direct {\n    exclude = ["registry.terraform.io/*/*"]\n  }\n}\n' > /etc/terraform.rc
+ENV TF_CLI_CONFIG_FILE=/etc/terraform.rc
+
 # Set zsh as default shell
 RUN chsh -s /bin/zsh root
 

package/docker/Dockerfile.proxmox-sim

@@ -4,9 +4,17 @@ WORKDIR /app
 
 # The Docker CLI is the whole point of this image: creating an LXC means
 # starting a real container on the host daemon, via the socket mounted at run
-# time (D2). `docker-cli` alone — no daemon, nothing to run in here.
+# time (D2).
+#
+# `docker-cli`, NOT `docker.io`: the latter Depends on containerd, runc and
+# iptables — a whole daemon this image never runs — while the CLI binary itself
+# arrives only as a RECOMMENDS, so `docker.io --no-install-recommends` installs
+# the daemon's dependencies and not the one program we need. That failed at the
+# worst possible moment: the image built clean, started clean, served the API
+# clean, and only when Terraform actually created a container did the provisioner
+# die with `Executable not found in $PATH: "docker"`.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    docker.io \
+    docker-cli \
     openssl \
     ca-certificates \
     && rm -rf /var/lib/apt/lists/*

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,10 +37,10 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/capabilities": "^1.2.0",
+    "@celilo/capabilities": "^1.3.0",
     "@celilo/cli-display": "^0.2.0",
-    "@celilo/event-bus": "^0.5.0",
-    "@celilo/terraform-fake": "^0.2.0",
+    "@celilo/event-bus": "^0.6.0",
+    "@celilo/terraform-fake": "^0.3.0",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"
   },

package/src/docker-compose-generator.ts

@@ -579,7 +579,16 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
       // Tmpfs the bun *cache* subdir too: the copy-up + fsync storm is the
       // overlay upper layer under /root/.bun/install/cache. RAM-backing it (cold
       // → re-fetch over the fast sim/net) keeps the CLI intact. Ephemeral e2e.
-      tmpfs: ['/root/.local/share/celilo', '/root/.bun/install/cache'],
+      // `:exec` on the celilo data dir, because compose's default tmpfs options
+      // include noexec and terraform EXECUTES the provider plugin it unpacks
+      // into `<module>/generated/terraform/.terraform/providers/...`. Without it
+      // the deploy dies with
+      //   fork/exec .../terraform-provider-proxmox_v3.0.2-rc07: permission denied
+      // on a file that is `-rwxr-xr-x` and owned by the root running it — which
+      // reads as a file-permission bug and is a mount-option one. The tmpfs
+      // itself stays: it is what keeps `module import` inside its timeout
+      // (ISS-0157), and that reason is unaffected by allowing exec.
+      tmpfs: ['/root/.local/share/celilo:exec', '/root/.bun/install/cache'],
       volumes: [
         ...(celiloRoot ? [`${celiloRoot}:/celilo`] : []),
         'ssh-keys:/ssh-keys',