@celilo/e2e 0.19.0 → 0.19.2

package/src/container-manager.ts

@@ -1,5 +1,5 @@
 import { type ExecSyncOptions, execSync, spawn } from 'node:child_process';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
 import { parse as parseYaml } from 'yaml';
@@ -10,6 +10,7 @@ import {
   firewallZoneLegs,
   generateTestComposeYaml,
   getAllMachines,
+  registryUploadsHostDir,
 } from './docker-compose-generator';
 import { explainBuildFailure } from './doctor';
 import { type ModuleHost, parseModuleHost } from './module-host';
@@ -613,20 +614,26 @@ function buildNetworkHandle(
       );
       // Give the box its fleet key BEFORE deploying, using the harness keypair.
       //
-      // `ensureFleetKey` (modules/celilo-mgmt/scripts/discovery.ts) mints a new
-      // `celilo-fleet` key under the state dir when none exists, and the deploy
-      // then sets `ssh.public_key` to it. In a real fleet that is right. In the
-      // rig it is not survivable: every target container trusts the HARNESS key,
-      // baked into authorized_keys at boot, and a freshly minted key is trusted
-      // by nothing. celilo would hold a key no machine accepts, and the next
-      // `machine add` fails with "no matching private key was found in ~/.ssh/"
-      // — which reads as a missing fixture and is actually a rotated key.
+      // `ensureFleetKey` (apps/celilo/src/services/fleet-key.ts, reached by the
+      // deploy through `celilo system ensure-fleet-key`) mints a new
+      // `celilo-fleet` key when none exists and records `ssh.public_key`. In a
+      // real fleet that is right. In the rig it is not survivable: every target
+      // container trusts the HARNESS key, baked into authorized_keys at boot,
+      // and a freshly minted key is trusted by nothing. celilo would hold a key
+      // no machine accepts, and the next `machine add` fails with "no matching
+      // private key was found in ~/.ssh/" — which reads as a missing fixture and
+      // is actually a rotated key.
       //
       // `ensureFleetKey` is idempotent and REUSES an existing key, so seeding it
       // with the harness pair means the deploy runs its real code path and
       // arrives at the key the fleet already trusts. This models an operator
       // whose management box already has its fleet key, which is the ordinary
       // case after the first deploy.
+      //
+      // The directory below must match `getFleetSshDir()`, which is
+      // `dirname(getDbPath())/.ssh`. The `db_path` set just above is what makes
+      // the two agree — the framework reads it from the env `on_install`
+      // exports before shelling out.
       const stateSshDir = '/root/.local/share/celilo/.ssh';
       dockerExec(
         projectName,
@@ -1005,12 +1012,19 @@ function buildNetworkHandle(
       }
 
       try {
-        // Copy directly into the registry container's /uploads dir.
-        // The registry rebuilds its index on every request, so no HTTP handshake needed.
-        run(
-          `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} cp ${JSON.stringify(netappPath)} registry:/uploads/${moduleId}.netapp`,
-          { cwd: composeDir, timeout: 120_000 },
-        );
+        // Write HOST-side into the dir bound at the registry's /uploads. The
+        // registry rescans that dir on every request, so it needs no HTTP
+        // handshake and no restart.
+        //
+        // Deliberately not a `docker compose cp` into the container: /uploads
+        // is a READ-ONLY bind in a consumer install, so the container write
+        // failed for every npm-installed consumer while passing forever in the
+        // monorepo, where the same path is not a mount at all (celilo#1142).
+        // registryUploadsHostDir() is the same function the compose generator
+        // builds the mount from, so the two cannot drift apart again.
+        const uploadsDir = registryUploadsHostDir();
+        mkdirSync(uploadsDir, { recursive: true });
+        copyFileSync(netappPath, join(uploadsDir, `${moduleId}.netapp`));
       } finally {
         if (cleanup)
           try {

package/src/docker-compose-generator.ts

@@ -1,5 +1,5 @@
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
+import { basename, join } from 'node:path';
 import { stringify } from 'yaml';
 import { normalizeObservers, observerEnv, observerPlacement } from './observer';
 import { PROXMOX_SIM_IP, SIMULATOR_IPS } from './simulator-ips';
@@ -13,32 +13,76 @@ import {
   zoneIp,
 } from './types';
 
+const PACKAGE_DIR = join(import.meta.dir, '..');
+
+/**
+ * Is this @celilo/e2e running from the monorepo, or from an npm install?
+ *
+ * `<pkgDir>/../../modules` is `<repo>/modules` in the monorepo and
+ * `<consumer>/node_modules/modules` (nonexistent) in a consumer install.
+ */
+function isMonorepoInstall(): boolean {
+  return existsSync(join(PACKAGE_DIR, '..', '..', 'modules'));
+}
+
 /**
- * Volumes for the registry container. Picks between source-bootstrap and
- * uploads-bootstrap based on where the @celilo/e2e package lives:
+ * The host dir bound read-only at the registry's `/uploads` — and therefore
+ * the dir `publishModule` writes a `.netapp` into. The registry rescans it on
+ * every request, so a host-side write is picked up with no container write and
+ * no HTTP handshake.
+ *
+ * Both install shapes bind one. They differ only in WHICH, because they differ
+ * in where standard modules come from:
+ *
+ * - **Monorepo dev** — modules are served live from `/modules`
+ *   (`../../modules`, BOOTSTRAP_MODULES_DIR mode), so edits to a module's
+ *   source flow through without a manual repack. `/uploads` is therefore a
+ *   dedicated drop-zone, emptied on every shared-infra start (see
+ *   `prepareRegistryDropZone`) — a leftover `.netapp` would shadow live source.
  *
- * - **Monorepo dev** — `../../modules` from the compose file (which lives
- *   in `packages/e2e/`) resolves to `<repo>/modules`. The registry runs
- *   in BOOTSTRAP_MODULES_DIR mode and packs source modules on the fly,
- *   so edits to a module's source flow through without manual repack.
+ * - **npm-installed consumer** (lunacycle and friends) — `../../modules` does
+ *   not exist, so there is no source to serve. `/uploads` IS the netapp cache
+ *   `cele2e build-infra` fills from the public registry (see
+ *   stageNetappsFromRegistry in cli/build.ts), and a published module lands
+ *   beside the standard ones. Consumers vendor nothing.
  *
- * - **npm-installed consumer** (lunacycle and friends) — `../../modules`
- *   would resolve to `<consumer>/node_modules/modules`, which doesn't
- *   exist. Docker fails the mount with "permission denied" trying to
- *   create that path. Instead we bind the local `./netapps/` dir to
- *   `/uploads`, and the registry's scanUploadsDir picks up the .netapp
- *   files. That dir is populated at `cele2e build-infra` time by fetching
- *   the standard-module netapps from the public registry (see
- *   stageNetappsFromRegistry in cli/build.ts) — consumers vendor nothing.
+ * Read this through `registryUploadsHostDir()` rather than re-deriving it.
+ * publishModule used to `docker cp` into the container's `/uploads` instead,
+ * which works only where that path is NOT a mount — so it passed forever in
+ * the monorepo and failed for every consumer against the read-only bind
+ * (celilo#1142). One function now decides the mount and the write target
+ * together, so they cannot disagree again.
+ */
+export function registryUploadsHostDir(): string {
+  return join(PACKAGE_DIR, isMonorepoInstall() ? 'uploads' : 'netapps');
+}
+
+/**
+ * Make the drop-zone ready for a shared-infra bring-up.
  *
- * Detection: check whether the would-be monorepo modules dir is real.
- * `import.meta.dir` is `<pkgDir>/src/`, so `../../../modules` from there
- * is `<repo>/modules` in the monorepo and `<consumer>/node_modules/modules`
- * (nonexistent) in a consumer install.
+ * Creates it: Docker silently creates a MISSING bind source as an empty
+ * root-owned directory, which the host then cannot write into.
+ *
+ * Empties it, but only in the monorepo, where `/uploads` is dedicated — a
+ * `.netapp` left by a previous run would shadow the live module source it was
+ * packed from. In a consumer install the same dir IS the build-infra netapp
+ * cache, so clearing it would delete every standard module. (Before
+ * celilo#1142 published netapps lived in the registry's container layer and
+ * died with the container, so starting empty is the behaviour being kept, not
+ * a new one.)
  */
+export function prepareRegistryDropZone(): void {
+  const dir = registryUploadsHostDir();
+  mkdirSync(dir, { recursive: true });
+  if (!isMonorepoInstall()) return;
+  for (const file of readdirSync(dir)) {
+    if (file.endsWith('.netapp')) rmSync(join(dir, file), { force: true });
+  }
+}
+
 function getRegistryVolumes(): string[] {
-  const monorepoModules = join(import.meta.dir, '..', '..', '..', 'modules');
-  return existsSync(monorepoModules) ? ['../../modules:/modules:ro'] : ['./netapps:/uploads:ro'];
+  const uploads = `./${basename(registryUploadsHostDir())}:/uploads:ro`;
+  return isMonorepoInstall() ? ['../../modules:/modules:ro', uploads] : [uploads];
 }
 
 const NETWORK_DRIVER_OPTS = {

package/src/shared-infra.ts

@@ -17,6 +17,7 @@ import {
   SHARED_NETWORKS,
   SHARED_PROJECT_NAME,
   generateSharedInfraYaml,
+  prepareRegistryDropZone,
 } from './docker-compose-generator';
 import { ensureRegistryServerBundle, ensureTerraformFakeBundle } from './registry-bundle';
 
@@ -161,6 +162,11 @@ export async function ensureSharedInfra(): Promise<void> {
   const yaml = generateSharedInfraYaml();
   writeFileSync(join(e2eDir, SHARED_COMPOSE_FILE), yaml);
 
+  // The registry's /uploads bind source must exist before `up` (a missing
+  // bind source becomes an empty root-owned dir), and in the monorepo it
+  // starts empty so no stale .netapp shadows live module source.
+  prepareRegistryDropZone();
+
   // Seed the live DNS zone files from their templates BEFORE the compose
   // mounts them. config/dns/{iamtheinternet.org,example.net}.zone are
   // gitignored runtime state (scrubDnsZones rewrites them per-test); on a