@celilo/e2e 0.17.1 → 0.19.0

package/bin/e2e-status

@@ -32,4 +32,4 @@ done
 echo ""
 echo "=== DDNS Simulator ==="
 echo -n "  Status: "
-docker compose -p "$PROJECT_NAME" exec -T namecheap-dns curl -s http://localhost:8080/status 2>/dev/null || echo "(not running)"
+docker compose -p "$PROJECT_NAME" exec -T namecheap-dns curl -s --cacert /etc/ssl/namecheap-sim/namecheap-ca.crt https://dynamicdns.park-your-domain.com/status --resolve dynamicdns.park-your-domain.com:443:127.0.0.1 2>/dev/null || echo "(not running)"

package/config/namecheap/ddns-tls.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDfTCCAmWgAwIBAgIUdjRGJDcAnXSrb8e8pgTGItaituQwDQYJKoZIhvcNAQEL
+BQAwJjEkMCIGA1UEAwwbY2VsaWxvIGUyZSBOYW1lY2hlYXAgc2ltIENBMCAXDTI2
+MDgyMTA2NDEyNFoYDzIxMjYwNzI4MDY0MTI0WjAqMSgwJgYDVQQDDB9keW5hbWlj
+ZG5zLnBhcmsteW91ci1kb21haW4uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAqWyqjNCSLxfJLhgwJBT78SzmLb9sRdHCrXYrxeqBF3dHR3aM5/oj
+CuiwT1l8P87cCauTbfHXSpOKRa0HDaQ5ArCQgBOxcK0Q4FzeUKRUtfbA9QR+b7ym
+FQDSV7nYG8oOFnQybr/uKpfRaficzGQQJZDZ3mEXC24J5LLc0PYc6kgASZMy8QY6
+PkCVdzX8viu0J3jGL780W/7AkNuLyzBmBs9SOyWy8vETY4MsRgm0Umv/Rh0MD33P
+n/D5EFYb8bbKAWnEXbpY7p7N7o2Er1IrNq1SD4TCkmR9VLeNm+pdYt6RKBaFoAYd
+Jbhk5YjnefqvlCPYyW2jyHOkh2I6up/P4QIDAQABo4GcMIGZMCoGA1UdEQQjMCGC
+H2R5bmFtaWNkbnMucGFyay15b3VyLWRvbWFpbi5jb20wCQYDVR0TBAIwADALBgNV
+HQ8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFMpDRmoxUAwc
+WJg/0WKwllOse/y7MB8GA1UdIwQYMBaAFNLIv6wf7Q7vOHzctgjyYKGapXkwMA0G
+CSqGSIb3DQEBCwUAA4IBAQAgp2bS+l/5mcoHVTlpt7pKbSx/LNzKAoatbchIQuoI
+uaEy77r6XhLC1BAcqQRIQ38zBDHSQHcR6bI4nSY24HnczZHxM9r6LoJ8MKvXuuH+
+rllrJb3qqvQECO9y4N3bvoK2RT6EjkwqNRsuvn0qtfSOkY2StJrMBdIlFjlAO0FZ
+Bu1+ZBYeqRP+AoTidjzSuU7JgGhGEHLdKJnoBlo4o9FbHgGBw8wgQiUUnWUfcHhw
+Uy+6f2RvK8jrPh2baWnqxpLRBBZdfmN4yu7JKs88uMBpRA9lD29essb/Q9MP8F/H
+2N0zizK46OSkimSMKACbI5U/f2E7JCuQukZV6VotrchC
+-----END CERTIFICATE-----

package/config/namecheap/ddns-tls.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCpbKqM0JIvF8ku
+GDAkFPvxLOYtv2xF0cKtdivF6oEXd0dHdozn+iMK6LBPWXw/ztwJq5Nt8ddKk4pF
+rQcNpDkCsJCAE7FwrRDgXN5QpFS19sD1BH5vvKYVANJXudgbyg4WdDJuv+4ql9Fp
++JzMZBAlkNneYRcLbgnkstzQ9hzqSABJkzLxBjo+QJV3Nfy+K7QneMYvvzRb/sCQ
+24vLMGYGz1I7JbLy8RNjgyxGCbRSa/9GHQwPfc+f8PkQVhvxtsoBacRduljuns3u
+jYSvUis2rVIPhMKSZH1Ut42b6l1i3pEoFoWgBh0luGTliOd5+q+UI9jJbaPIc6SH
+Yjq6n8/hAgMBAAECggEAMUj3qgPoaoOgVeTaaDykd6mIgglb3UmiOKSWIjpP+DwO
+A6dkYP0eYYeD9mlBICy0TKnZNtPxvXOC9zbYxOqfXP1w45kW9oCZ1rKdR1cuf0p7
+Iit+/lEh/R0ikztwNtFF3NlLbHUvurs0Q3/7WOfI3Kyw/CRBOGV3wkwXuT/G9I2p
+PzPc5eB0XThMXw5TfpcQfRedCOTjGelVk/fDF7cqRuK/g9f77XTfZ76ftLFBREvv
+/7v8rJMoljL08fpU30r1xAFRNQHLfkUVLQxB1l3g9BJ91VieSUHgWljdS4hGDvf/
+djfSIzq4bpkkoYVt8jGOA9+7peahVhWzCEdjVFTlKwKBgQDSi4v+1SCllgqoLSRe
+FvFlWEwMeJWGN2qqxrXfWURgK8ODMgDxYjvwtFr5kO+JfWFrsT5DLYduWOyUkU/O
+b8Qw3Sd2MAgU2cO/ejf/xDIgyIVao+Mg+x2pAADm6NFknUiBHOvZ0MbLZHUpa7uD
+Z0fFXDqhKyIAGC0DvKqD8qp26wKBgQDOAHSZ1kfic074FmUU136I82pwdViVrEHA
+OMNmNaqnrU9HkKqrwIqHrOTdEMNQnkB+OMmJNK6H4N54PILze+TR+EYu6d1BiTWK
+3TAyhaA/eNGa3NuVyg8/wLFPxHj7QLUpv7JsqBKg45/GlPyXU5HtDX0Bsi3COlfX
+YlQi70y5YwKBgHFnwMxON/t4ydy0E/aqHPQdjzjYapGUn9vElIntJys152VvNZrO
+8sJAIxBxxNQluKetHIBKsbv6IdQUQQxMnzxCotLCJFg2w30Lc8ZMA0QtPccIp3pI
+SD2TRukZVk//d+IzlcYI8krznTfmU2X/52SivOG6veGXJAfzQ1U3DCJpAoGAde4Q
+0li3gk3csW2wpEPRbnlbP9INynF4mqBkTEkAz0kKD8Aj1Hs/UviJdHy6M5bE+P1t
+cpy0JZl4AoExvk346rMlCopbXb885ahGhUW2PV/fLratBo1MOYUIfM/PKpcanzHc
+5RM6xtxIhZiZGdB/w6NrIuNsCrr3upfR7sXruF0CgYEAskixy85n2KZzr8kEz3Vb
+ji7zwB9Nl5qSYThc73dmaDCeLGeStfvpjg6TZNHtB9IXzpCo11D1jN04uHigMhAt
+N5hvFmI5eLGLL6EEpMusms9EVPkclybMnS/ykjOX4YNxwTn5fi28ITN36VSulFN/
+OWZYLOMmP6gMqfNJ7ktAA5o=
+-----END PRIVATE KEY-----

package/config/namecheap/namecheap-ca.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDLzCCAhegAwIBAgIUeuo47ZC6Ka3Zfq7a36MZPnASRQwwDQYJKoZIhvcNAQEL
+BQAwJjEkMCIGA1UEAwwbY2VsaWxvIGUyZSBOYW1lY2hlYXAgc2ltIENBMCAXDTI2
+MDgyMTA2NDEyNFoYDzIxMjYwNzI4MDY0MTI0WjAmMSQwIgYDVQQDDBtjZWxpbG8g
+ZTJlIE5hbWVjaGVhcCBzaW0gQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQC2W2bH5m1J6SAkRTT7vspz22V9mWlv1TzWOqVuuRBFQ4IrBlSKrCrgOdi6
+/IAu9rkY2DJsgt3ts4L4IhJnA3VRGU+UltdAwPuo5eOHGq9aLPwaa/Rb7q4Act+a
+53wVp3eLDAEvY4fk+dHUay87Ar2sXC+8WgwVZwUGoOpRE7/IWab9Q98a3hDYMQ1h
+B71z2Ecz1g1z1w/zBqjiR4IMwgVV2VZ9yCmXBSad2mVCPf/51rWuY9ooZw73MbRc
+PByejx0Fa8jigfFszG/oE2i7alO3ISmJzODgX8AuqqO3yVokKGTUY1DsJxas1U27
+vhlHtYfVEhnUXgWyZphWvr38DslLAgMBAAGjUzBRMB0GA1UdDgQWBBTSyL+sH+0O
+7zh83LYI8mChmqV5MDAfBgNVHSMEGDAWgBTSyL+sH+0O7zh83LYI8mChmqV5MDAP
+BgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQA4BF303aKFEXpTHrPY
+L3zopaL6EYTL6fzU8dhB5ZwCXfCJUa5Rx860kIFSjSaUd3rCfJ/70MTe9SQUGKVF
+dt659/PA8olQtZQJsNOSjduQxAgwGe3T8V3G/qDogGDTAJKWGMQCWYSEwBjr30pQ
+keyX1ahBzWwSg3FmdEOt35SfhvFQ4S/TAoEM33QARq+jJfMBupPNSIETgcr+Rimn
+YWbshg1zfXuQnju9qV3R1bEST7ZSH+CjXhPu6CCbu/jTT3lPRIB04w2Yw5IAi1Kh
+SzCF3TlQEUXpkPhlYpglhW0q3wgfp7QmnquNLHo6E8I+PyBjkSkg+Xq2cw14bE0i
+MWHp
+-----END CERTIFICATE-----

package/config/routing/fw-isp-routes.sh

@@ -24,9 +24,19 @@ iptables -P FORWARD ACCEPT
 # DNS
 echo "nameserver 203.0.113.1" > /etc/resolv.conf
 
-# Start dnsmasq DHCP server on internal network
-dnsmasq --conf-dir=/etc/dnsmasq.d --keep-in-foreground --log-facility=- &
-echo "dnsmasq DHCP server started"
+# Start dnsmasq DHCP server on internal network.
+#
+# Skippable, because celilo can serve DHCP itself (`modules/dnsmasq-dhcp`) and
+# two DHCP servers on one broadcast domain race: whichever answers a DISCOVER
+# first wins, and a test asserting which one served a lease would be asserting
+# a coin toss. An operator moving DHCP to celilo turns the router's off, so a
+# suite that tests celilo's DHCP models that by setting ROUTER_DHCP=off.
+if [ "${ROUTER_DHCP:-on}" = "off" ]; then
+  echo "dnsmasq DHCP server NOT started (ROUTER_DHCP=off; celilo serves DHCP here)"
+else
+  dnsmasq --conf-dir=/etc/dnsmasq.d --keep-in-foreground --log-facility=- &
+  echo "dnsmasq DHCP server started"
+fi
 
 # Start greenwave simulator
 if [ -f /simulator/server.ts ]; then

package/config/routing/management-routes.sh

@@ -2,8 +2,6 @@
 set -e
 
 # System-wide environment for all processes (hooks, ansible, etc.)
-echo 'DDNS_ENDPOINT=http://100.64.0.55:8080/update' >> /etc/environment
-export DDNS_ENDPOINT="http://100.64.0.55:8080/update"
 
 # Generate SSH keys if needed
 /config/ssh/generate-keys.sh /ssh-keys
@@ -105,7 +103,6 @@ cat > /root/.zshrc << ZSHRC
 export PATH="/root/.bun/bin:/usr/local/bin:\$PATH"
 
 # Simulated network overrides
-export DDNS_ENDPOINT="http://100.64.0.55:8080/update"
 
 # History
 HISTFILE=/root/.zsh_history

package/docker/Dockerfile.management

@@ -35,6 +35,12 @@ RUN apt-get update && apt-get install -y \
     procps \
     zsh \
     gnupg \
+    # The hook jail (openspec/changes/hook-process-boundary, stage 2) runs every
+    # hook under bubblewrap. Without it the management box runs hooks unjailed,
+    # which is a valid mode but not the one the e2e suite is there to exercise.
+    # The container needs security_opt relaxations to let it build a namespace —
+    # see the measured ladder in docker-compose-generator.ts.
+    bubblewrap \
     && rm -rf /var/lib/apt/lists/*
 
 # --- Terraform, plus an OFFLINE provider mirror -------------------------------
@@ -96,6 +102,12 @@ COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
 # external_web's authoritative post-publish check HTTPS-GETs the route from
 # here, which is why mgmt in particular must trust it.
 COPY config/cpanel-host/cpanel-host-ca.crt /usr/local/share/ca-certificates/cpanel-host-ca.crt
+# Trust the Namecheap DDNS sim's CA. Its cert is likewise PRE-INSTALLED rather
+# than Pebble-issued: celilo does not own a third-party API's TLS. This is what
+# lets namecheap's hooks call the REAL endpoint URL over real TLS, instead of
+# being redirected at an http://ip:port by an environment variable that an
+# allow-listed hook environment no longer carries.
+COPY config/namecheap/namecheap-ca.crt /usr/local/share/ca-certificates/namecheap-ca.crt
 RUN update-ca-certificates
 
 # Tell bun (and Node-compat code) to merge the system CA bundle with

package/docker/Dockerfile.namecheap-dns

@@ -14,6 +14,12 @@ RUN apt-get update && apt-get install -y \
 RUN curl -fsSL https://bun.sh/install | bash
 ENV PATH="/root/.bun/bin:$PATH"
 
+# The endpoint's own certificate, PRE-INSTALLED the way a real third-party
+# service's is (same pattern as the cPanel host sim). The CA rides along so the
+# container can probe its own HTTPS endpoint without disabling verification.
+COPY config/namecheap/ddns-tls.crt config/namecheap/ddns-tls.key config/namecheap/namecheap-ca.crt /etc/ssl/namecheap-sim/
+RUN chmod 600 /etc/ssl/namecheap-sim/ddns-tls.key
+
 COPY simulators/namecheap-ddns/ /simulator/
 COPY config/routing/dns-routes.sh /dns-routes.sh
 RUN chmod +x /dns-routes.sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.17.1",
+  "version": "0.19.0",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,7 +37,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/capabilities": "^2.4.0",
+    "@celilo/capabilities": "^3.1.0",
     "@celilo/cli-display": "^0.2.0",
     "@celilo/event-bus": "^0.6.0",
     "@celilo/terraform-fake": "^0.3.1",

package/simulators/namecheap-ddns/server.ts

@@ -46,7 +46,24 @@ const PASSWORD_MAP: Record<string, string> = (() => {
   return {};
 })();
 const FALLBACK_PASSWORD = process.env.DDNS_PASSWORD || 'test123';
-const PORT = Number(process.env.DDNS_PORT) || 8080;
+/**
+ * The real Namecheap DDNS endpoint is `https://dynamicdns.park-your-domain.com`,
+ * so that is what this serves: port 443, with a certificate for that name.
+ *
+ * It used to listen on plain HTTP at 8080 and the rig pointed the module at
+ * `http://100.64.0.55:8080/update` through a `DDNS_ENDPOINT` environment
+ * variable. That bypassed both the DNS chain the rig had already built (the
+ * `park-your-domain.com` zone has always been there) and TLS, and it stopped
+ * working when hooks became subprocesses with an allow-listed environment
+ * (openspec/changes/hook-process-boundary, design D5).
+ *
+ * The certificate is PRE-INSTALLED rather than issued by Pebble, the same way
+ * the cPanel host simulator's is, and for the same reason: celilo does not own
+ * this service's TLS. A real third-party API has a certificate from a real CA
+ * long before celilo talks to it, and there is no ACME exchange to model.
+ */
+const PORT = Number(process.env.DDNS_PORT) || 443;
+const TLS_DIR = process.env.DDNS_TLS_DIR || '/etc/ssl/namecheap-sim';
 
 function expectedPasswordFor(domain: string): string {
   return PASSWORD_MAP[domain] ?? FALLBACK_PASSWORD;
@@ -107,6 +124,10 @@ function normalizeIp(address: string): string {
 
 const server = Bun.serve({
   port: PORT,
+  tls: {
+    cert: Bun.file(`${TLS_DIR}/ddns-tls.crt`),
+    key: Bun.file(`${TLS_DIR}/ddns-tls.key`),
+  },
   fetch(req, server) {
     const url = new URL(req.url);
 

package/src/container-manager.ts

@@ -813,6 +813,11 @@ function buildNetworkHandle(
       await handle.celilo(`module config set iptables firewall_ip ${firewallIp}`);
       await handle.celilo(`module config set iptables nat_ip ${natIp}`);
       await handle.celilo(`module config set iptables zones '${JSON.stringify(declaredZones)}'`);
+      // Caller-supplied settings last, so a suite can turn on an opt-in policy
+      // the way an operator would rather than assert against the default.
+      for (const [key, value] of Object.entries(opts.config ?? {})) {
+        await handle.celilo(`module config set iptables ${key} ${value}`);
+      }
       // `check: false` returns the failed deploy instead of throwing, so a test
       // can assert on WHAT the refusal said. Interface classification refuses
       // by design (D12 onboarding), and a refusal is only useful if it names
@@ -1259,8 +1264,14 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
     );
   }
 
-  // Wait for DHCP client lease
-  if (config.dhcpClient) {
+  // Wait for DHCP client lease.
+  //
+  // Skipped when the router's DHCP is off, because then NOTHING is serving yet:
+  // celilo's own DHCP server is a module, and modules deploy long after the
+  // network is up. Waiting here would time out at 60s on every such suite and
+  // report it as a network-start failure. Those suites drive the client
+  // themselves once their server is deployed.
+  if (config.dhcpClient && config.routerDhcp !== false) {
     console.log('[progress:start] waiting for DHCP client lease | DHCP lease acquired');
     // Self-diagnosing via waitFor's onTimeout (e2e-confidence #255): a DHCP-lease
     // timeout is an intermittent in-suite flake (passes solo). On timeout, dump

package/src/docker-compose-generator.ts

@@ -94,6 +94,12 @@ function baseService(opts: {
   environment?: Record<string, string>;
   tmpfs?: string[];
   privileged?: boolean;
+  /**
+   * Docker `security_opt` entries, e.g. `seccomp=unconfined`. Needed by the
+   * management box so the hook jail's bubblewrap can build a namespace inside
+   * a container — see the measured ladder at its call site.
+   */
+  security_opt?: string[];
   dns?: string[];
   /** Host devices to expose, e.g. `/dev/net/tun` for a userspace WireGuard tunnel. */
   devices?: string[];
@@ -215,7 +221,13 @@ function defaultTopologyServices(config: NetworkConfig): Record<string, unknown>
       volumes: ['ssh-keys:/ssh-keys:ro'],
       // Which real ISP router this sim stands in for. The protocol is identical
       // across the two; only the TR-181 vendor extension prefix differs.
-      environment: { ROUTER_VENDOR_PREFIX: config.routerVendorPrefix ?? 'X_GWS_' },
+      environment: {
+        ROUTER_VENDOR_PREFIX: config.routerVendorPrefix ?? 'X_GWS_',
+        // The simulated router serves DHCP on `internal` by default, which is
+        // what an operator's router does. A suite testing celilo's OWN DHCP
+        // turns it off, because two servers on one broadcast domain race.
+        ROUTER_DHCP: config.routerDhcp === false ? 'off' : 'on',
+      },
     }),
   };
 }
@@ -568,7 +580,34 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
       image:
         variant === 'vanilla' ? 'celilo-e2e/management:vanilla' : 'celilo-e2e/management:latest',
       networks: { [zone]: { ipv4_address: ip } },
-      cap_add: ['NET_ADMIN'],
+      // SYS_ADMIN is for the hook jail, NET_ADMIN for the routing the box does
+      // anyway. See the security_opt block below for why both are here.
+      cap_add: ['NET_ADMIN', 'SYS_ADMIN'],
+      // The hook jail runs each hook under bubblewrap, which has to build a
+      // user namespace and then mount inside it. Docker denies that four
+      // separate ways, and every one of these is load-bearing — measured on a
+      // colima Ubuntu 24.04.1 VM (kernel 6.8.0-50,
+      // kernel.apparmor_restrict_unprivileged_userns=1), by removing one at a
+      // time from the working set:
+      //
+      //   drop seccomp=unconfined      -> bwrap: pivot_root: Operation not permitted
+      //   drop apparmor=unconfined     -> bwrap: Failed to make / slave: Permission denied
+      //   drop systempaths=unconfined  -> bwrap: Can't mount proc on /newroot/proc
+      //   drop SYS_ADMIN               -> bwrap: setting up uid map: Permission denied
+      //
+      // Deliberately NOT `privileged: true`, which design D8 measured as
+      // working and task 4.1 asked to improve on. It would also grant every
+      // capability and every host device; this set grants four named things.
+      //
+      // `systempaths=unconfined` is the one D8's ladder was missing: it unmasks
+      // the /proc paths Docker hides, which is why "all three" of the earlier
+      // options still failed on the proc mount.
+      //
+      // NOTE this makes the container a WEAK place to test the AppArmor
+      // profile: apparmor=unconfined means the restriction the profile exists
+      // to satisfy is not in force here. That gate is the celilo-builder probe
+      // on a real kernel, never this container.
+      security_opt: ['seccomp=unconfined', 'apparmor=unconfined', 'systempaths=unconfined'],
       // ISS-0157: `module import`'s `bun install` hard-links packages from the
       // bun cache into node_modules, which on overlayfs forces a copy-up + fsync
       // per file. On a slow/contended builder disk that storm blows past the
@@ -595,7 +634,6 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
         ...(config.managementVolumes ?? []),
       ],
       environment: {
-        DDNS_ENDPOINT: `http://${SIMULATOR_IPS.NAMECHEAP_DNS}:8080/update`,
         // On its own control-plane network the only router in reach is fw-main's
         // leg there — both for the default route and for the segmented zones.
         DEFAULT_GATEWAY: zone === 'secure-mgmt' ? SECURE_MGMT_GATEWAY : managementDefaultGw,
@@ -821,7 +859,6 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
       ...(config.managementVolumes ?? []),
     ],
     environment: {
-      DDNS_ENDPOINT: `http://${SIMULATOR_IPS.NAMECHEAP_DNS}:8080/update`,
       DEFAULT_GATEWAY: managementDefaultGw,
       CELILO_REGISTRY_URL: 'http://e2e-registry.lab',
     },

package/src/network-builder.ts

@@ -140,6 +140,23 @@ export class NetworkBuilder {
     return this;
   }
 
+  /**
+   * Stop the simulated ISP router serving DHCP on `internal`.
+   *
+   * For suites where CELILO serves DHCP (`modules/dnsmasq-dhcp`). Two servers
+   * on one broadcast domain race, so without this a lease assertion is a coin
+   * toss. It is also what an operator does when moving DHCP to celilo, so the
+   * suite models the migration rather than dodging a conflict.
+   *
+   * NOTE: `withDhcpClient()`'s start-up lease wait expects SOMETHING to answer.
+   * Pair this with a suite that deploys celilo's DHCP server, or the client
+   * gets no lease and the network never comes up.
+   */
+  withoutRouterDhcp(): this {
+    this.config.routerDhcp = false;
+    return this;
+  }
+
   /**
    * Add the Proxmox API simulator on `secure-mgmt`.
    *

package/src/simulator-ips.ts

@@ -23,7 +23,7 @@ export const SIMULATOR_IPS = {
   ROOT_DNS: '100.64.0.53',
   /** Authoritative TLD DNS for `com.`, `org.`, `net.`. */
   TLD_DNS: '100.64.0.54',
-  /** Authoritative DNS for the customer domains; also serves the DDNS update endpoint at port 8080. */
+  /** Authoritative DNS for the customer domains; also serves the DDNS update endpoint at https://dynamicdns.park-your-domain.com. */
   NAMECHEAP_DNS: '100.64.0.55',
   /** Internal e2e module registry (replaces production celilo.computer in tests). */
   REGISTRY: '100.64.0.56',

package/src/types.ts

@@ -66,6 +66,19 @@ export interface NetworkConfig {
    * serves both rather than a near-duplicate second one.
    */
   routerVendorPrefix?: string;
+  /**
+   * Whether the simulated ISP router serves DHCP on `internal`. Defaults to
+   * true, which is what an operator's router does and what every existing suite
+   * relies on.
+   *
+   * Set false when celilo serves DHCP instead (`modules/dnsmasq-dhcp`). Two
+   * DHCP servers on one broadcast domain race — whichever answers a DISCOVER
+   * first wins — so a suite asserting WHICH server issued a lease would be
+   * asserting a coin toss. Turning the router's off is also what a real
+   * operator does when moving DHCP to celilo, so this models the migration
+   * rather than papering over a conflict.
+   */
+  routerDhcp?: boolean;
   /** Extra volume mounts for the management container (host:container format) */
   managementVolumes: string[];
   /** Include a DHCP client container on the internal network */
@@ -449,7 +462,19 @@ export interface NetworkHandle {
    *
    * @param opts.natIp - NAT IP for port-forwarded traffic (default 10.226.1.253)
    */
-  deployFirewall(opts?: { natIp?: string; check?: boolean }): Promise<ExecResult>;
+  /**
+   * @param opts.config - Extra `module config set iptables <key> <value>` pairs,
+   *   applied after the topology-derived ones and before the deploy. For
+   *   settings whose whole point is that they are OPT-IN: the harness deploys a
+   *   DEFAULT firewall, so a suite testing an opt-in policy has to turn it on
+   *   the way an operator would, and asserting on a default deploy would only
+   *   ever measure the default.
+   */
+  deployFirewall(opts?: {
+    natIp?: string;
+    check?: boolean;
+    config?: Record<string, string>;
+  }): Promise<ExecResult>;
 
   /**
    * Deploy the `greenwave` module against the ISP router (`fw-isp`) — the box