@celilo/e2e 0.17.1 → 0.18.0

package/bin/e2e-status

@@ -32,4 +32,4 @@ done
 echo ""
 echo "=== DDNS Simulator ==="
 echo -n "  Status: "
-docker compose -p "$PROJECT_NAME" exec -T namecheap-dns curl -s http://localhost:8080/status 2>/dev/null || echo "(not running)"
+docker compose -p "$PROJECT_NAME" exec -T namecheap-dns curl -s --cacert /etc/ssl/namecheap-sim/namecheap-ca.crt https://dynamicdns.park-your-domain.com/status --resolve dynamicdns.park-your-domain.com:443:127.0.0.1 2>/dev/null || echo "(not running)"

package/config/namecheap/ddns-tls.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDfTCCAmWgAwIBAgIUdjRGJDcAnXSrb8e8pgTGItaituQwDQYJKoZIhvcNAQEL
+BQAwJjEkMCIGA1UEAwwbY2VsaWxvIGUyZSBOYW1lY2hlYXAgc2ltIENBMCAXDTI2
+MDgyMTA2NDEyNFoYDzIxMjYwNzI4MDY0MTI0WjAqMSgwJgYDVQQDDB9keW5hbWlj
+ZG5zLnBhcmsteW91ci1kb21haW4uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAqWyqjNCSLxfJLhgwJBT78SzmLb9sRdHCrXYrxeqBF3dHR3aM5/oj
+CuiwT1l8P87cCauTbfHXSpOKRa0HDaQ5ArCQgBOxcK0Q4FzeUKRUtfbA9QR+b7ym
+FQDSV7nYG8oOFnQybr/uKpfRaficzGQQJZDZ3mEXC24J5LLc0PYc6kgASZMy8QY6
+PkCVdzX8viu0J3jGL780W/7AkNuLyzBmBs9SOyWy8vETY4MsRgm0Umv/Rh0MD33P
+n/D5EFYb8bbKAWnEXbpY7p7N7o2Er1IrNq1SD4TCkmR9VLeNm+pdYt6RKBaFoAYd
+Jbhk5YjnefqvlCPYyW2jyHOkh2I6up/P4QIDAQABo4GcMIGZMCoGA1UdEQQjMCGC
+H2R5bmFtaWNkbnMucGFyay15b3VyLWRvbWFpbi5jb20wCQYDVR0TBAIwADALBgNV
+HQ8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFMpDRmoxUAwc
+WJg/0WKwllOse/y7MB8GA1UdIwQYMBaAFNLIv6wf7Q7vOHzctgjyYKGapXkwMA0G
+CSqGSIb3DQEBCwUAA4IBAQAgp2bS+l/5mcoHVTlpt7pKbSx/LNzKAoatbchIQuoI
+uaEy77r6XhLC1BAcqQRIQ38zBDHSQHcR6bI4nSY24HnczZHxM9r6LoJ8MKvXuuH+
+rllrJb3qqvQECO9y4N3bvoK2RT6EjkwqNRsuvn0qtfSOkY2StJrMBdIlFjlAO0FZ
+Bu1+ZBYeqRP+AoTidjzSuU7JgGhGEHLdKJnoBlo4o9FbHgGBw8wgQiUUnWUfcHhw
+Uy+6f2RvK8jrPh2baWnqxpLRBBZdfmN4yu7JKs88uMBpRA9lD29essb/Q9MP8F/H
+2N0zizK46OSkimSMKACbI5U/f2E7JCuQukZV6VotrchC
+-----END CERTIFICATE-----

package/config/namecheap/ddns-tls.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCpbKqM0JIvF8ku
+GDAkFPvxLOYtv2xF0cKtdivF6oEXd0dHdozn+iMK6LBPWXw/ztwJq5Nt8ddKk4pF
+rQcNpDkCsJCAE7FwrRDgXN5QpFS19sD1BH5vvKYVANJXudgbyg4WdDJuv+4ql9Fp
++JzMZBAlkNneYRcLbgnkstzQ9hzqSABJkzLxBjo+QJV3Nfy+K7QneMYvvzRb/sCQ
+24vLMGYGz1I7JbLy8RNjgyxGCbRSa/9GHQwPfc+f8PkQVhvxtsoBacRduljuns3u
+jYSvUis2rVIPhMKSZH1Ut42b6l1i3pEoFoWgBh0luGTliOd5+q+UI9jJbaPIc6SH
+Yjq6n8/hAgMBAAECggEAMUj3qgPoaoOgVeTaaDykd6mIgglb3UmiOKSWIjpP+DwO
+A6dkYP0eYYeD9mlBICy0TKnZNtPxvXOC9zbYxOqfXP1w45kW9oCZ1rKdR1cuf0p7
+Iit+/lEh/R0ikztwNtFF3NlLbHUvurs0Q3/7WOfI3Kyw/CRBOGV3wkwXuT/G9I2p
+PzPc5eB0XThMXw5TfpcQfRedCOTjGelVk/fDF7cqRuK/g9f77XTfZ76ftLFBREvv
+/7v8rJMoljL08fpU30r1xAFRNQHLfkUVLQxB1l3g9BJ91VieSUHgWljdS4hGDvf/
+djfSIzq4bpkkoYVt8jGOA9+7peahVhWzCEdjVFTlKwKBgQDSi4v+1SCllgqoLSRe
+FvFlWEwMeJWGN2qqxrXfWURgK8ODMgDxYjvwtFr5kO+JfWFrsT5DLYduWOyUkU/O
+b8Qw3Sd2MAgU2cO/ejf/xDIgyIVao+Mg+x2pAADm6NFknUiBHOvZ0MbLZHUpa7uD
+Z0fFXDqhKyIAGC0DvKqD8qp26wKBgQDOAHSZ1kfic074FmUU136I82pwdViVrEHA
+OMNmNaqnrU9HkKqrwIqHrOTdEMNQnkB+OMmJNK6H4N54PILze+TR+EYu6d1BiTWK
+3TAyhaA/eNGa3NuVyg8/wLFPxHj7QLUpv7JsqBKg45/GlPyXU5HtDX0Bsi3COlfX
+YlQi70y5YwKBgHFnwMxON/t4ydy0E/aqHPQdjzjYapGUn9vElIntJys152VvNZrO
+8sJAIxBxxNQluKetHIBKsbv6IdQUQQxMnzxCotLCJFg2w30Lc8ZMA0QtPccIp3pI
+SD2TRukZVk//d+IzlcYI8krznTfmU2X/52SivOG6veGXJAfzQ1U3DCJpAoGAde4Q
+0li3gk3csW2wpEPRbnlbP9INynF4mqBkTEkAz0kKD8Aj1Hs/UviJdHy6M5bE+P1t
+cpy0JZl4AoExvk346rMlCopbXb885ahGhUW2PV/fLratBo1MOYUIfM/PKpcanzHc
+5RM6xtxIhZiZGdB/w6NrIuNsCrr3upfR7sXruF0CgYEAskixy85n2KZzr8kEz3Vb
+ji7zwB9Nl5qSYThc73dmaDCeLGeStfvpjg6TZNHtB9IXzpCo11D1jN04uHigMhAt
+N5hvFmI5eLGLL6EEpMusms9EVPkclybMnS/ykjOX4YNxwTn5fi28ITN36VSulFN/
+OWZYLOMmP6gMqfNJ7ktAA5o=
+-----END PRIVATE KEY-----

package/config/namecheap/namecheap-ca.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDLzCCAhegAwIBAgIUeuo47ZC6Ka3Zfq7a36MZPnASRQwwDQYJKoZIhvcNAQEL
+BQAwJjEkMCIGA1UEAwwbY2VsaWxvIGUyZSBOYW1lY2hlYXAgc2ltIENBMCAXDTI2
+MDgyMTA2NDEyNFoYDzIxMjYwNzI4MDY0MTI0WjAmMSQwIgYDVQQDDBtjZWxpbG8g
+ZTJlIE5hbWVjaGVhcCBzaW0gQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQC2W2bH5m1J6SAkRTT7vspz22V9mWlv1TzWOqVuuRBFQ4IrBlSKrCrgOdi6
+/IAu9rkY2DJsgt3ts4L4IhJnA3VRGU+UltdAwPuo5eOHGq9aLPwaa/Rb7q4Act+a
+53wVp3eLDAEvY4fk+dHUay87Ar2sXC+8WgwVZwUGoOpRE7/IWab9Q98a3hDYMQ1h
+B71z2Ecz1g1z1w/zBqjiR4IMwgVV2VZ9yCmXBSad2mVCPf/51rWuY9ooZw73MbRc
+PByejx0Fa8jigfFszG/oE2i7alO3ISmJzODgX8AuqqO3yVokKGTUY1DsJxas1U27
+vhlHtYfVEhnUXgWyZphWvr38DslLAgMBAAGjUzBRMB0GA1UdDgQWBBTSyL+sH+0O
+7zh83LYI8mChmqV5MDAfBgNVHSMEGDAWgBTSyL+sH+0O7zh83LYI8mChmqV5MDAP
+BgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQA4BF303aKFEXpTHrPY
+L3zopaL6EYTL6fzU8dhB5ZwCXfCJUa5Rx860kIFSjSaUd3rCfJ/70MTe9SQUGKVF
+dt659/PA8olQtZQJsNOSjduQxAgwGe3T8V3G/qDogGDTAJKWGMQCWYSEwBjr30pQ
+keyX1ahBzWwSg3FmdEOt35SfhvFQ4S/TAoEM33QARq+jJfMBupPNSIETgcr+Rimn
+YWbshg1zfXuQnju9qV3R1bEST7ZSH+CjXhPu6CCbu/jTT3lPRIB04w2Yw5IAi1Kh
+SzCF3TlQEUXpkPhlYpglhW0q3wgfp7QmnquNLHo6E8I+PyBjkSkg+Xq2cw14bE0i
+MWHp
+-----END CERTIFICATE-----

package/config/routing/management-routes.sh

@@ -2,8 +2,6 @@
 set -e
 
 # System-wide environment for all processes (hooks, ansible, etc.)
-echo 'DDNS_ENDPOINT=http://100.64.0.55:8080/update' >> /etc/environment
-export DDNS_ENDPOINT="http://100.64.0.55:8080/update"
 
 # Generate SSH keys if needed
 /config/ssh/generate-keys.sh /ssh-keys
@@ -105,7 +103,6 @@ cat > /root/.zshrc << ZSHRC
 export PATH="/root/.bun/bin:/usr/local/bin:\$PATH"
 
 # Simulated network overrides
-export DDNS_ENDPOINT="http://100.64.0.55:8080/update"
 
 # History
 HISTFILE=/root/.zsh_history

package/docker/Dockerfile.management

@@ -96,6 +96,12 @@ COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
 # external_web's authoritative post-publish check HTTPS-GETs the route from
 # here, which is why mgmt in particular must trust it.
 COPY config/cpanel-host/cpanel-host-ca.crt /usr/local/share/ca-certificates/cpanel-host-ca.crt
+# Trust the Namecheap DDNS sim's CA. Its cert is likewise PRE-INSTALLED rather
+# than Pebble-issued: celilo does not own a third-party API's TLS. This is what
+# lets namecheap's hooks call the REAL endpoint URL over real TLS, instead of
+# being redirected at an http://ip:port by an environment variable that an
+# allow-listed hook environment no longer carries.
+COPY config/namecheap/namecheap-ca.crt /usr/local/share/ca-certificates/namecheap-ca.crt
 RUN update-ca-certificates
 
 # Tell bun (and Node-compat code) to merge the system CA bundle with

package/docker/Dockerfile.namecheap-dns

@@ -14,6 +14,12 @@ RUN apt-get update && apt-get install -y \
 RUN curl -fsSL https://bun.sh/install | bash
 ENV PATH="/root/.bun/bin:$PATH"
 
+# The endpoint's own certificate, PRE-INSTALLED the way a real third-party
+# service's is (same pattern as the cPanel host sim). The CA rides along so the
+# container can probe its own HTTPS endpoint without disabling verification.
+COPY config/namecheap/ddns-tls.crt config/namecheap/ddns-tls.key config/namecheap/namecheap-ca.crt /etc/ssl/namecheap-sim/
+RUN chmod 600 /etc/ssl/namecheap-sim/ddns-tls.key
+
 COPY simulators/namecheap-ddns/ /simulator/
 COPY config/routing/dns-routes.sh /dns-routes.sh
 RUN chmod +x /dns-routes.sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,7 +37,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/capabilities": "^2.4.0",
+    "@celilo/capabilities": "^3.0.0",
     "@celilo/cli-display": "^0.2.0",
     "@celilo/event-bus": "^0.6.0",
     "@celilo/terraform-fake": "^0.3.1",

package/simulators/namecheap-ddns/server.ts

@@ -46,7 +46,24 @@ const PASSWORD_MAP: Record<string, string> = (() => {
   return {};
 })();
 const FALLBACK_PASSWORD = process.env.DDNS_PASSWORD || 'test123';
-const PORT = Number(process.env.DDNS_PORT) || 8080;
+/**
+ * The real Namecheap DDNS endpoint is `https://dynamicdns.park-your-domain.com`,
+ * so that is what this serves: port 443, with a certificate for that name.
+ *
+ * It used to listen on plain HTTP at 8080 and the rig pointed the module at
+ * `http://100.64.0.55:8080/update` through a `DDNS_ENDPOINT` environment
+ * variable. That bypassed both the DNS chain the rig had already built (the
+ * `park-your-domain.com` zone has always been there) and TLS, and it stopped
+ * working when hooks became subprocesses with an allow-listed environment
+ * (openspec/changes/hook-process-boundary, design D5).
+ *
+ * The certificate is PRE-INSTALLED rather than issued by Pebble, the same way
+ * the cPanel host simulator's is, and for the same reason: celilo does not own
+ * this service's TLS. A real third-party API has a certificate from a real CA
+ * long before celilo talks to it, and there is no ACME exchange to model.
+ */
+const PORT = Number(process.env.DDNS_PORT) || 443;
+const TLS_DIR = process.env.DDNS_TLS_DIR || '/etc/ssl/namecheap-sim';
 
 function expectedPasswordFor(domain: string): string {
   return PASSWORD_MAP[domain] ?? FALLBACK_PASSWORD;
@@ -107,6 +124,10 @@ function normalizeIp(address: string): string {
 
 const server = Bun.serve({
   port: PORT,
+  tls: {
+    cert: Bun.file(`${TLS_DIR}/ddns-tls.crt`),
+    key: Bun.file(`${TLS_DIR}/ddns-tls.key`),
+  },
   fetch(req, server) {
     const url = new URL(req.url);
 

package/src/container-manager.ts

@@ -813,6 +813,11 @@ function buildNetworkHandle(
       await handle.celilo(`module config set iptables firewall_ip ${firewallIp}`);
       await handle.celilo(`module config set iptables nat_ip ${natIp}`);
       await handle.celilo(`module config set iptables zones '${JSON.stringify(declaredZones)}'`);
+      // Caller-supplied settings last, so a suite can turn on an opt-in policy
+      // the way an operator would rather than assert against the default.
+      for (const [key, value] of Object.entries(opts.config ?? {})) {
+        await handle.celilo(`module config set iptables ${key} ${value}`);
+      }
       // `check: false` returns the failed deploy instead of throwing, so a test
       // can assert on WHAT the refusal said. Interface classification refuses
       // by design (D12 onboarding), and a refusal is only useful if it names

package/src/docker-compose-generator.ts

@@ -595,7 +595,6 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
         ...(config.managementVolumes ?? []),
       ],
       environment: {
-        DDNS_ENDPOINT: `http://${SIMULATOR_IPS.NAMECHEAP_DNS}:8080/update`,
         // On its own control-plane network the only router in reach is fw-main's
         // leg there — both for the default route and for the segmented zones.
         DEFAULT_GATEWAY: zone === 'secure-mgmt' ? SECURE_MGMT_GATEWAY : managementDefaultGw,
@@ -821,7 +820,6 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
       ...(config.managementVolumes ?? []),
     ],
     environment: {
-      DDNS_ENDPOINT: `http://${SIMULATOR_IPS.NAMECHEAP_DNS}:8080/update`,
       DEFAULT_GATEWAY: managementDefaultGw,
       CELILO_REGISTRY_URL: 'http://e2e-registry.lab',
     },

package/src/simulator-ips.ts

@@ -23,7 +23,7 @@ export const SIMULATOR_IPS = {
   ROOT_DNS: '100.64.0.53',
   /** Authoritative TLD DNS for `com.`, `org.`, `net.`. */
   TLD_DNS: '100.64.0.54',
-  /** Authoritative DNS for the customer domains; also serves the DDNS update endpoint at port 8080. */
+  /** Authoritative DNS for the customer domains; also serves the DDNS update endpoint at https://dynamicdns.park-your-domain.com. */
   NAMECHEAP_DNS: '100.64.0.55',
   /** Internal e2e module registry (replaces production celilo.computer in tests). */
   REGISTRY: '100.64.0.56',

package/src/types.ts

@@ -449,7 +449,19 @@ export interface NetworkHandle {
    *
    * @param opts.natIp - NAT IP for port-forwarded traffic (default 10.226.1.253)
    */
-  deployFirewall(opts?: { natIp?: string; check?: boolean }): Promise<ExecResult>;
+  /**
+   * @param opts.config - Extra `module config set iptables <key> <value>` pairs,
+   *   applied after the topology-derived ones and before the deploy. For
+   *   settings whose whole point is that they are OPT-IN: the harness deploys a
+   *   DEFAULT firewall, so a suite testing an opt-in policy has to turn it on
+   *   the way an operator would, and asserting on a default deploy would only
+   *   ever measure the default.
+   */
+  deployFirewall(opts?: {
+    natIp?: string;
+    check?: boolean;
+    config?: Record<string, string>;
+  }): Promise<ExecResult>;
 
   /**
    * Deploy the `greenwave` module against the ISP router (`fw-isp`) — the box