@celilo/e2e 0.5.0 → 0.6.0

package/bin/cele2e

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# cele2e — E2E test CLI for Celilo-deployed applications.
+
+# Resolve symlinks to find the actual package directory
+SOURCE="${BASH_SOURCE[0]}"
+while [ -L "$SOURCE" ]; do
+  DIR="$(cd "$(dirname "$SOURCE")" && pwd)"
+  SOURCE="$(readlink "$SOURCE")"
+  [[ "$SOURCE" != /* ]] && SOURCE="$DIR/$SOURCE"
+done
+SCRIPT_DIR="$(cd "$(dirname "$SOURCE")" && pwd)"
+PKG_DIR="$(dirname "$SCRIPT_DIR")"
+
+exec bun "$PKG_DIR/src/cli/index.ts" "$@"

package/bin/e2e-cache-images

@@ -0,0 +1,57 @@
+#!/bin/bash
+#
+# Save application Docker images to the local cache for e2e acceleration.
+#
+# The cached tarballs are mounted into app-zone target machines and
+# pre-loaded at startup, avoiding slow pulls from ghcr.io / docker.io
+# during every test run.
+#
+# Run once after pulling new image versions. The cache directory is
+# gitignored — each developer maintains their own copy.
+#
+# Usage:
+#   ./e2e/bin/e2e-cache-images
+#
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+E2E_DIR="$(dirname "$SCRIPT_DIR")"
+CACHE_DIR="$E2E_DIR/docker-image-cache"
+
+mkdir -p "$CACHE_DIR"
+
+BOLD='\033[1m'
+GREEN='\033[0;32m'
+DIM='\033[2m'
+NC='\033[0m'
+
+# Images used by deployed modules in the app zone.
+# Update versions here when bumping module image versions.
+declare -A IMAGES=(
+  ["docker.io_library_postgres_15-alpine"]="docker.io/library/postgres:15-alpine"
+  ["docker.io_library_redis_alpine"]="docker.io/library/redis:alpine"
+  ["ghcr.io_goauthentik_server_2024.2.2"]="ghcr.io/goauthentik/server:2024.2.2"
+)
+
+echo -e "${BOLD}Pulling and caching application images...${NC}"
+echo ""
+
+for filename in "${!IMAGES[@]}"; do
+  image="${IMAGES[$filename]}"
+  tarball="$CACHE_DIR/${filename}.tar"
+
+  printf "  %-50s " "$image"
+  START=$(date +%s)
+
+  docker pull "$image" > /dev/null 2>&1
+  docker save "$image" -o "$tarball"
+
+  END=$(date +%s)
+  SIZE=$(du -h "$tarball" | cut -f1)
+  echo -e "${GREEN}✔${NC} ${DIM}$((END - START))s  ${SIZE}${NC}"
+done
+
+echo ""
+echo -e "${GREEN}Images cached to $CACHE_DIR${NC}"
+echo "These will be pre-loaded into app-zone containers on next e2e run."

package/bin/e2e-shell

@@ -2,26 +2,49 @@
 # Connect to a running E2E container.
 #
 # Usage:
-#   ./bin/e2e-shell                # Shell into management machine
+#   ./bin/e2e-shell                # Shell into management (interactive or test project)
 #   ./bin/e2e-shell caddy          # Shell into caddy container
-#   ./bin/e2e-shell fw-main        # Shell into fw-main
-#   ./bin/e2e-shell namecheap-dns  # Shell into namecheap-dns
+#   ./bin/e2e-shell authentik      # Shell into authentik container (test project)
 
 set -e
-PROJECT_NAME="conductor-e2e-interactive"
 CONTAINER="${1:-management}"
 
-# Check if network is running
-if ! docker compose -p "$PROJECT_NAME" ps --status running 2>/dev/null | grep -q "$CONTAINER"; then
-  echo "Container '$CONTAINER' is not running."
-  echo "Available containers:"
-  docker compose -p "$PROJECT_NAME" ps --format '  {{.Name}}  ({{.Status}})' 2>/dev/null || echo "  No E2E network running. Start with: ./bin/e2e-up"
+# Resolve project name: prefer interactive project, fall back to any running test project
+resolve_project() {
+  # 1. Interactive project (e2e-up)
+  if docker compose -p celilo-e2e-interactive ps --status running 2>/dev/null | grep -q "$CONTAINER"; then
+    echo "celilo-e2e-interactive"
+    return
+  fi
+
+  # 2. Test run project: find any celilo-e2e-* container matching the name
+  local container_id
+  container_id=$(docker ps --filter "name=${CONTAINER}" --filter "name=celilo-e2e-" --format '{{.Names}}' | head -1)
+  if [ -n "$container_id" ]; then
+    # Extract project from container name: celilo-e2e-<project>-<service>-1
+    # We don't need the compose project name — just exec directly
+    echo "_direct:${container_id}"
+    return
+  fi
+
+  echo ""
+}
+
+PROJECT=$(resolve_project)
+
+if [ -z "$PROJECT" ]; then
+  echo "Container '$CONTAINER' is not running in any celilo-e2e project."
+  echo ""
+  echo "Running celilo-e2e containers:"
+  docker ps --filter "name=celilo-e2e-" --format '  {{.Names}}  ({{.Status}})' 2>/dev/null || echo "  none"
   exit 1
 fi
 
-# Use zsh for management (has conductor aliases + completion), bash for others
-if [ "$CONTAINER" = "management" ]; then
-  docker compose -p "$PROJECT_NAME" exec "$CONTAINER" zsh -li
+SHELL_CMD="bash"
+
+if [[ "$PROJECT" == _direct:* ]]; then
+  FULL_NAME="${PROJECT#_direct:}"
+  exec docker exec -it "$FULL_NAME" $SHELL_CMD
 else
-  docker compose -p "$PROJECT_NAME" exec "$CONTAINER" bash
+  exec docker compose -p "$PROJECT" exec "$CONTAINER" $SHELL_CMD
 fi

package/bin/e2e-status

@@ -1,10 +1,16 @@
 #!/bin/bash
 # Show status of the E2E test network.
 
-PROJECT_NAME="conductor-e2e-interactive"
+PROJECT_NAME="${CELILO_E2E_PROJECT:-celilo-e2e-interactive}"
 
 echo "=== Containers ==="
-docker compose -p "$PROJECT_NAME" ps 2>/dev/null || { echo "No E2E network running."; exit 0; }
+if ! docker compose -p "$PROJECT_NAME" ps 2>/dev/null | grep -q .; then
+  echo "No E2E network running (project: $PROJECT_NAME)."
+  echo ""
+  echo "Start one with: cele2e up  or  cele2e run --keep"
+  exit 0
+fi
+docker compose -p "$PROJECT_NAME" ps
 
 echo ""
 echo "=== DNS Check ==="

package/bin/e2e-up

@@ -15,7 +15,7 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$SCRIPT_DIR"
 
-PROJECT_NAME="conductor-e2e-interactive"
+PROJECT_NAME="celilo-e2e-interactive"
 
 # Parse args
 PRESET="infrastructure"
@@ -148,13 +148,13 @@ echo "  letsencrypt:       100.64.0.100      (Pebble ACME)"
 echo "  apt-cache:         100.64.0.2        (apt proxy → real internet)"
 echo ""
 echo "Commands:"
-echo "  ./bin/e2e-shell                   Reconnect to management"
-echo "  ./bin/e2e-shell <container>       Shell into any container"
-echo "  ./bin/e2e-down                    Tear everything down"
+echo "  cele2e shell                      Reconnect to management"
+echo "  cele2e shell <container>          Shell into any container"
+echo "  cele2e down                       Tear everything down"
 echo "  docker compose -p $PROJECT_NAME ps    List containers"
 echo ""
 echo "Dropping you into the management machine..."
-echo "(use 'conductor <cmd>' or 'c <cmd>' — tab completion works)"
+echo "(use 'celilo <cmd>' — tab completion works)"
 echo ""
 
 docker compose -p "$PROJECT_NAME" exec management zsh -li

package/completions/install-zsh-completion.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+#
+# cele2e - Zsh Completion Installer
+
+set -e
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+COMPLETION_FILE="_cele2e"
+COMPLETION_DIR="$HOME/.zsh/completions"
+ZSHRC="$HOME/.zshrc"
+
+echo -e "${BLUE}🧪  cele2e - Zsh Completion Installer${NC}\n"
+
+if ! command -v zsh &> /dev/null; then
+    echo -e "${RED}✗ zsh not found${NC}"; exit 1
+fi
+echo -e "${GREEN}✓${NC} zsh detected"
+
+if ! command -v cele2e &> /dev/null; then
+    echo -e "${RED}✗ cele2e not found in PATH${NC}"
+    echo -e "  Run: bun install -g ~/hobby/infra/packages/e2e"; exit 1
+fi
+echo -e "${GREEN}✓${NC} Found cele2e CLI"
+
+echo -e "${YELLOW}→${NC} Generating completion script..."
+GENERATED=$(cele2e completion zsh 2>/dev/null)
+if [[ -z "$GENERATED" ]]; then
+    echo -e "${RED}✗ Failed to generate completion script${NC}"; exit 1
+fi
+echo -e "${GREEN}✓${NC} Completion script generated"
+
+mkdir -p "$COMPLETION_DIR"
+echo -e "${YELLOW}→${NC} Installing completion script..."
+echo "$GENERATED" > "$COMPLETION_DIR/$COMPLETION_FILE"
+chmod 644 "$COMPLETION_DIR/$COMPLETION_FILE"
+echo -e "${GREEN}✓${NC} Installed to $COMPLETION_DIR/$COMPLETION_FILE"
+
+[[ -f "$ZSHRC" ]] || touch "$ZSHRC"
+
+if grep -q "fpath=.*\.zsh/completions" "$ZSHRC"; then
+    echo -e "${GREEN}✓${NC} Completion directory already in fpath"
+else
+    echo -e "${YELLOW}→${NC} Adding completion directory to .zshrc..."
+    if grep -qn "autoload.*compinit" "$ZSHRC"; then
+        COMPINIT_LINE=$(grep -n "autoload.*compinit" "$ZSHRC" | head -1 | cut -d: -f1)
+        sed -i '' "${COMPINIT_LINE}i\\
+# cele2e completions\\
+fpath=(~/.zsh/completions \$fpath)\\
+
+" "$ZSHRC"
+    else
+        echo -e "\n# cele2e completions\nfpath=(~/.zsh/completions \$fpath)\nautoload -Uz compinit && compinit" >> "$ZSHRC"
+    fi
+    echo -e "${GREEN}✓${NC} fpath configured"
+fi
+
+if ! grep -q "autoload.*compinit" "$ZSHRC"; then
+    echo "autoload -Uz compinit && compinit" >> "$ZSHRC"
+fi
+
+echo -e "${YELLOW}→${NC} Clearing completion cache..."
+rm -rf "$HOME"/.zcompdump*
+echo -e "${GREEN}✓${NC} Cache cleared"
+
+echo ""
+echo -e "${GREEN}✅ Installation complete!${NC}"
+echo ""
+echo "To activate:"
+echo -e "  ${BLUE}exec zsh${NC}"
+echo ""
+echo "Try it out:"
+echo -e "  ${BLUE}cele2e <TAB>${NC}"
+echo -e "  ${BLUE}cele2e run <TAB>${NC}"

package/config/dns/iamtheinternet.org.zone

@@ -2,7 +2,7 @@ $ORIGIN iamtheinternet.org.
 $TTL 300
 
 @ IN SOA ns1.iamtheinternet.org. admin.iamtheinternet.org. (
-    2024010778 300 60 604800 300
+    2024010821 300 60 604800 300
 )
 
 @       IN NS   ns1.iamtheinternet.org.

package/config/routing/docker-image-preload.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Pre-load cached Docker images for e2e acceleration
+After=docker.service
+Requires=docker.service
+ConditionPathIsDirectory=/docker-image-cache
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/docker-image-preload.sh
+RemainAfterExit=yes
+StandardOutput=journal
+
+[Install]
+WantedBy=multi-user.target

package/config/routing/docker-image-preload.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Load pre-cached Docker images for e2e acceleration.
+# Runs at container startup via docker-image-preload.service.
+# Gracefully skips if /docker-image-cache is empty or not mounted.
+
+# Wait for the Docker daemon to accept connections (up to 30s)
+for i in $(seq 1 30); do
+    if docker info > /dev/null 2>&1; then
+        break
+    fi
+    sleep 1
+done
+
+if ! docker info > /dev/null 2>&1; then
+    echo "docker-image-preload: Docker not ready after 30s, skipping"
+    exit 0
+fi
+
+shopt -s nullglob
+for tar in /docker-image-cache/*.tar; do
+    echo "docker-image-preload: loading $(basename "$tar")"
+    docker load -i "$tar"
+done
+echo "docker-image-preload: done"

package/config/routing/management-routes.sh

@@ -28,26 +28,43 @@ ip route add 10.0.10.0/24 via 192.168.0.254    # dmz via fw-main
 ip route add 10.0.20.0/24 via 192.168.0.254    # app via fw-main
 ip route add 10.0.30.0/24 via 192.168.0.254    # secure via fw-main
 
-# DNS — use the simulated resolver
-echo "nameserver 100.100.0.1" > /etc/resolv.conf
+# DNS — Technitium internal resolver (split-horizon) with public fallback.
+# Technitium at 192.168.0.10 is authoritative for iamtheinternet.org internally,
+# resolving www/auth to Caddy's DMZ IP (10.0.10.10) rather than the public WAN IP.
+# Fall back to the simulated public resolver if Technitium is not yet up.
+printf 'nameserver 192.168.0.10\nnameserver 100.100.0.1\n' > /etc/resolv.conf
 
 # Create celilo data directory (Linux default: /var/lib/celilo/)
 mkdir -p /var/lib/celilo/modules
 
-# Dependencies come from the host bind mount (node_modules/)
-# If missing, run 'cd apps/celilo && bun install' on the host first.
-cd /celilo/apps/celilo
-if [ ! -d node_modules/@clack ]; then
-  echo "WARNING: node_modules not found. Run 'cd apps/celilo && bun install' on the host."
+# If the monorepo is mounted at /celilo, use it for shell completions (dev mode).
+# Otherwise use the globally installed CLI from npm.
+if [ -d /celilo/apps/celilo ]; then
+  CELILO_SRC="/celilo/apps/celilo/src/cli/index.ts"
+  CELILO_CMD="bun run $CELILO_SRC"
+
+  # Warn if node_modules are missing (developer forgot to bun install)
+  if [ ! -d /celilo/apps/celilo/node_modules/@clack ]; then
+    echo "WARNING: /celilo/apps/celilo/node_modules not found. Run 'cd apps/celilo && bun install' on the host."
+  fi
+
+  # Generate zsh completions from source
+  mkdir -p /root/.zsh/completions
+  bun run "$CELILO_SRC" completion zsh > /root/.zsh/completions/_celilo 2>/dev/null || true
+
+  START_DIR="/celilo/apps/celilo"
+else
+  CELILO_CMD="celilo"
+  START_DIR="/root"
+
+  # Generate zsh completions from npm-installed CLI
+  mkdir -p /root/.zsh/completions
+  celilo completion zsh > /root/.zsh/completions/_celilo 2>/dev/null || true
 fi
 
-# Generate zsh completion script from celilo
-mkdir -p /root/.zsh/completions
-bun run /celilo/apps/celilo/src/cli/index.ts completion zsh > /root/.zsh/completions/_celilo 2>/dev/null || true
-
-# Shell setup: aliases and completion for zsh
-cat > /root/.zshrc << 'ZSHRC'
-export PATH="/root/.bun/bin:$PATH"
+# Shell setup
+cat > /root/.zshrc << ZSHRC
+export PATH="/root/.bun/bin:/usr/local/bin:\$PATH"
 
 # Simulated network overrides
 export DDNS_ENDPOINT="http://100.64.0.55:8080/update"
@@ -69,27 +86,22 @@ bindkey '^R' history-incremental-search-backward
 # Prompt
 PROMPT='%F{cyan}celilo%f:%F{yellow}%~%f# '
 
-# Commands
-celilo() { bun run /celilo/apps/celilo/src/cli/index.ts "$@"; }
-c() { celilo "$@"; }
+# Commands — celilo shim in /usr/local/bin prefers source when /celilo is mounted
+alias c='celilo'
 alias ll='ls -la'
 
-# Tab completion — use celilo's built-in zsh completion generator
-fpath=(~/.zsh/completions $fpath)
+# Tab completion
+fpath=(~/.zsh/completions \$fpath)
 autoload -Uz compinit && compinit -u
 
-# Also bind `c` to the same completion
-compdef _celilo c
-
-cd /celilo/apps/celilo
+cd $START_DIR
 ZSHRC
 
-# Also set up bash aliases (for non-zsh shells)
-cat > /root/.bashrc << 'BASHRC'
-export PATH="/root/.bun/bin:$PATH"
-alias celilo='bun run /celilo/apps/celilo/src/cli/index.ts'
+# Bash fallback (for non-zsh shells)
+cat > /root/.bashrc << BASHRC
+export PATH="/root/.bun/bin:/usr/local/bin:\$PATH"
 alias c='celilo'
-cd /celilo/apps/celilo
+cd $START_DIR
 BASHRC
 
 echo "Management machine ready"

package/docker/Dockerfile.management

@@ -17,18 +17,20 @@ RUN chsh -s /bin/zsh root
 
 # Trust the E2E forward proxy CA (for transparent HTTPS interception)
 COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
+# Trust Pebble's test CA (so bun fetch() trusts certs issued by the simulated Let's Encrypt)
+COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
 RUN update-ca-certificates
 
 # Point apt at the simulated apt cache proxy (for runtime apt usage)
 RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
 
-# Install celilo CLI from npm — provides the fallback `celilo` command
-RUN bun add -g @celilo/cli@0.1.4
+# Install celilo CLI from npm. bun installs the bin to /usr/local/bin/celilo
+# on the oven/bun base image. We rename it so our shim can fall back to it.
+RUN bun add -g @celilo/cli@0.1.5 \
+    && mv /usr/local/bin/celilo /usr/local/bin/celilo-npm
 
 # Shim: prefer /celilo source when mounted (dev loop), fall back to npm install.
-# This means `celilo ...` runs the monorepo's source code during e2e tests
-# instead of the pinned npm version — critical for iterating on fixes.
-RUN printf '#!/bin/bash\nif [ -d /celilo/apps/celilo ]; then\n  exec bun run /celilo/apps/celilo/src/cli/index.ts "$@"\nfi\nexec /root/.bun/bin/celilo "$@"\n' > /usr/local/bin/celilo \
+RUN printf '#!/bin/bash\nif [ -d /celilo/apps/celilo ]; then\n  exec bun run /celilo/apps/celilo/src/cli/index.ts "$@"\nfi\nexec /usr/local/bin/celilo-npm "$@"\n' > /usr/local/bin/celilo \
     && chmod +x /usr/local/bin/celilo
 
 # Standard modules pre-packaged as .netapp files — built by e2e-build.

package/docker/Dockerfile.target-machine

@@ -57,5 +57,25 @@ RUN (cd /lib/systemd/system/sysinit.target.wants/ && \
 # Re-enable the services we actually need
 RUN systemctl enable ssh target-setup
 
+# --- Caddy pre-installation ---
+# Temporarily disable apt proxy (not available during docker build)
+RUN rm -f /etc/apt/apt.conf.d/00proxy
+
+# Install Caddy (same steps as the Ansible role, but at image build time so
+# the role finds it already installed and skips the slow cloudsmith.io downloads)
+RUN apt-get update && apt-get install -y \
+    debian-keyring \
+    debian-archive-keyring \
+    apt-transport-https \
+    && rm -rf /var/lib/apt/lists/*
+RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | \
+    gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | \
+    tee /etc/apt/sources.list.d/caddy-stable.list
+RUN apt-get update && apt-get install -y caddy && rm -rf /var/lib/apt/lists/*
+
+# Re-enable apt proxy for runtime
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
 STOPSIGNAL SIGRTMIN+3
 ENTRYPOINT ["/sbin/init"]

package/docker/Dockerfile.target-machine-docker

@@ -1,6 +1,6 @@
-# Target machine with Docker pre-installed and authentik images pre-pulled.
-# Used for app-zone machines that will run Docker Compose workloads.
-# This avoids a 10+ minute Docker pull during e2e test deploy time.
+# Target machine with Docker pre-installed.
+# Used for app-zone machines that run Docker Compose workloads (e.g. authentik).
+# Docker itself is baked in; application images are pulled at deploy time by each module.
 
 FROM ubuntu:22.04
 
@@ -87,22 +87,14 @@ RUN mkdir -p /etc/docker && \
 
 RUN systemctl enable docker
 
-# Pre-cached image loading service:
-# At first boot, if /docker-image-cache/*.tar exists, load them into Docker.
-# This avoids multi-minute pulls during e2e test deploy.
-RUN echo '#!/bin/bash\n\
-set -e\n\
-if ls /docker-image-cache/*.tar 1>/dev/null 2>&1; then\n\
-  for img in /docker-image-cache/*.tar; do\n\
-    echo "Loading cached Docker image: $img"\n\
-    docker load < "$img"\n\
-  done\n\
-fi\n' > /usr/local/bin/load-cached-images.sh && \
-    chmod +x /usr/local/bin/load-cached-images.sh
-
-RUN printf '[Unit]\nDescription=Load pre-cached Docker images\nAfter=docker.service\nRequires=docker.service\n\n[Service]\nType=oneshot\nExecStart=/usr/local/bin/load-cached-images.sh\nRemainAfterExit=yes\n\n[Install]\nWantedBy=multi-user.target\n' \
-    > /etc/systemd/system/load-docker-cache.service && \
-    systemctl enable load-docker-cache
+# Pre-load cached Docker images on startup (e2e acceleration)
+# /docker-image-cache is bind-mounted from the host by the compose generator.
+# The service is a no-op if the directory is absent or empty.
+COPY config/routing/docker-image-preload.sh /usr/local/bin/docker-image-preload.sh
+RUN chmod +x /usr/local/bin/docker-image-preload.sh
+COPY config/routing/docker-image-preload.service /etc/systemd/system/docker-image-preload.service
+RUN systemctl enable docker-image-preload
+
 
 STOPSIGNAL SIGRTMIN+3
 ENTRYPOINT ["/sbin/init"]

package/docker/Dockerfile.target-technitium

@@ -0,0 +1,97 @@
+# Target machine with Technitium DNS Server pre-installed.
+# Based on target-machine; Technitium is installed at image build time so the
+# Ansible role finds it already present and skips the download step.
+
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    systemd \
+    systemd-sysv \
+    openssh-server \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    python3 \
+    python3-apt \
+    sqlite3 \
+    jq \
+    sudo \
+    curl \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Trust the E2E forward proxy CA (for transparent HTTPS interception)
+COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
+# Trust Pebble's test CA (so Caddy/ACME clients trust the simulated Let's Encrypt)
+COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
+RUN update-ca-certificates
+
+RUN mkdir -p /run/sshd && \
+    sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config && \
+    sed -i 's/#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+
+# Enable SSH service
+RUN systemctl enable ssh
+
+# Point apt at the simulated apt cache proxy
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
+# E2E network setup service (runs at boot to configure routing, DNS, SSH keys)
+COPY config/routing/target-setup.sh /usr/local/bin/target-setup.sh
+RUN chmod +x /usr/local/bin/target-setup.sh
+
+COPY config/routing/target-setup.service /etc/systemd/system/target-setup.service
+RUN systemctl enable target-setup
+
+# Clean up unnecessary systemd services that slow down boot
+RUN (cd /lib/systemd/system/sysinit.target.wants/ && \
+    ls | grep -v systemd-tmpfiles-setup | xargs rm -f 2>/dev/null); \
+    rm -f /lib/systemd/system/multi-user.target.wants/*; \
+    rm -f /etc/systemd/system/*.wants/*; \
+    rm -f /lib/systemd/system/local-fs.target.wants/*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
+    rm -f /lib/systemd/system/basic.target.wants/*; \
+    true
+
+# Re-enable the services we actually need
+RUN systemctl enable ssh target-setup
+
+# --- Technitium pre-installation (manual — installer requires running systemd) ---
+# The official install.sh checks for systemd at runtime and fails during docker build.
+# Instead: install ASP.NET Core runtime, download binaries, write the service file.
+# Ansible tasks check for /opt/technitium/dns/DnsServerApp.dll and skip the download.
+
+# Temporarily lift the apt proxy (not available at build time)
+RUN rm -f /etc/apt/apt.conf.d/00proxy
+
+# ASP.NET Core 8.0 runtime via Microsoft package feed
+RUN curl -sSL https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb \
+    -o /tmp/ms-prod.deb && \
+    dpkg -i /tmp/ms-prod.deb && \
+    rm /tmp/ms-prod.deb && \
+    apt-get update && \
+    apt-get install -y aspnetcore-runtime-8.0 && \
+    rm -rf /var/lib/apt/lists/*
+
+# Download and extract Technitium portable package
+RUN mkdir -p /opt/technitium/dns && \
+    curl -sSL https://download.technitium.com/dns/DnsServerPortable.tar.gz \
+    -o /tmp/technitium.tar.gz && \
+    tar -xzf /tmp/technitium.tar.gz -C /opt/technitium/dns && \
+    rm -f /tmp/technitium.tar.gz
+
+# Register systemd service (same unit the installer creates)
+RUN printf '[Unit]\nDescription=Technitium DNS Server\nAfter=network.target\n\n[Service]\nExecStart=/usr/bin/dotnet /opt/technitium/dns/DnsServerApp.dll\nRestart=on-failure\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target\n' \
+    > /etc/systemd/system/dns.service && \
+    systemctl enable dns
+
+# Re-enable apt proxy for runtime
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
+STOPSIGNAL SIGRTMIN+3
+ENTRYPOINT ["/sbin/init"]