@celilo/e2e 0.5.1 → 0.6.1

package/README.md

@@ -187,7 +187,8 @@ c machine add 192.168.0.254 --ssh-user root --earmark iptables
 c machine add 10.0.10.10 --ssh-user root
 
 # Pre-configure secrets and non-derivable config
-c module secret set namecheap ddns_password test123
+c module config set namecheap domains '["iamtheinternet.org"]'
+c module secret set namecheap ddns_passwords '{"iamtheinternet.org":"test123"}'
 c module config set greenwave router_ip 192.168.0.1
 c module secret set greenwave router_username admin
 c module secret set greenwave router_password admin

package/bin/cele2e

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# cele2e — E2E test CLI for Celilo-deployed applications.
+
+# Resolve symlinks to find the actual package directory
+SOURCE="${BASH_SOURCE[0]}"
+while [ -L "$SOURCE" ]; do
+  DIR="$(cd "$(dirname "$SOURCE")" && pwd)"
+  SOURCE="$(readlink "$SOURCE")"
+  [[ "$SOURCE" != /* ]] && SOURCE="$DIR/$SOURCE"
+done
+SCRIPT_DIR="$(cd "$(dirname "$SOURCE")" && pwd)"
+PKG_DIR="$(dirname "$SCRIPT_DIR")"
+
+exec bun "$PKG_DIR/src/cli/index.ts" "$@"

package/bin/e2e-cache-images

@@ -0,0 +1,57 @@
+#!/bin/bash
+#
+# Save application Docker images to the local cache for e2e acceleration.
+#
+# The cached tarballs are mounted into app-zone target machines and
+# pre-loaded at startup, avoiding slow pulls from ghcr.io / docker.io
+# during every test run.
+#
+# Run once after pulling new image versions. The cache directory is
+# gitignored — each developer maintains their own copy.
+#
+# Usage:
+#   ./e2e/bin/e2e-cache-images
+#
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+E2E_DIR="$(dirname "$SCRIPT_DIR")"
+CACHE_DIR="$E2E_DIR/docker-image-cache"
+
+mkdir -p "$CACHE_DIR"
+
+BOLD='\033[1m'
+GREEN='\033[0;32m'
+DIM='\033[2m'
+NC='\033[0m'
+
+# Images used by deployed modules in the app zone.
+# Update versions here when bumping module image versions.
+declare -A IMAGES=(
+  ["docker.io_library_postgres_15-alpine"]="docker.io/library/postgres:15-alpine"
+  ["docker.io_library_redis_alpine"]="docker.io/library/redis:alpine"
+  ["ghcr.io_goauthentik_server_2024.2.2"]="ghcr.io/goauthentik/server:2024.2.2"
+)
+
+echo -e "${BOLD}Pulling and caching application images...${NC}"
+echo ""
+
+for filename in "${!IMAGES[@]}"; do
+  image="${IMAGES[$filename]}"
+  tarball="$CACHE_DIR/${filename}.tar"
+
+  printf "  %-50s " "$image"
+  START=$(date +%s)
+
+  docker pull "$image" > /dev/null 2>&1
+  docker save "$image" -o "$tarball"
+
+  END=$(date +%s)
+  SIZE=$(du -h "$tarball" | cut -f1)
+  echo -e "${GREEN}✔${NC} ${DIM}$((END - START))s  ${SIZE}${NC}"
+done
+
+echo ""
+echo -e "${GREEN}Images cached to $CACHE_DIR${NC}"
+echo "These will be pre-loaded into app-zone containers on next e2e run."

package/bin/e2e-shell

@@ -2,26 +2,49 @@
 # Connect to a running E2E container.
 #
 # Usage:
-#   ./bin/e2e-shell                # Shell into management machine
+#   ./bin/e2e-shell                # Shell into management (interactive or test project)
 #   ./bin/e2e-shell caddy          # Shell into caddy container
-#   ./bin/e2e-shell fw-main        # Shell into fw-main
-#   ./bin/e2e-shell namecheap-dns  # Shell into namecheap-dns
+#   ./bin/e2e-shell authentik      # Shell into authentik container (test project)
 
 set -e
-PROJECT_NAME="conductor-e2e-interactive"
 CONTAINER="${1:-management}"
 
-# Check if network is running
-if ! docker compose -p "$PROJECT_NAME" ps --status running 2>/dev/null | grep -q "$CONTAINER"; then
-  echo "Container '$CONTAINER' is not running."
-  echo "Available containers:"
-  docker compose -p "$PROJECT_NAME" ps --format '  {{.Name}}  ({{.Status}})' 2>/dev/null || echo "  No E2E network running. Start with: ./bin/e2e-up"
+# Resolve project name: prefer interactive project, fall back to any running test project
+resolve_project() {
+  # 1. Interactive project (e2e-up)
+  if docker compose -p celilo-e2e-interactive ps --status running 2>/dev/null | grep -q "$CONTAINER"; then
+    echo "celilo-e2e-interactive"
+    return
+  fi
+
+  # 2. Test run project: find any celilo-e2e-* container matching the name
+  local container_id
+  container_id=$(docker ps --filter "name=${CONTAINER}" --filter "name=celilo-e2e-" --format '{{.Names}}' | head -1)
+  if [ -n "$container_id" ]; then
+    # Extract project from container name: celilo-e2e-<project>-<service>-1
+    # We don't need the compose project name — just exec directly
+    echo "_direct:${container_id}"
+    return
+  fi
+
+  echo ""
+}
+
+PROJECT=$(resolve_project)
+
+if [ -z "$PROJECT" ]; then
+  echo "Container '$CONTAINER' is not running in any celilo-e2e project."
+  echo ""
+  echo "Running celilo-e2e containers:"
+  docker ps --filter "name=celilo-e2e-" --format '  {{.Names}}  ({{.Status}})' 2>/dev/null || echo "  none"
   exit 1
 fi
 
-# Use zsh for management (has conductor aliases + completion), bash for others
-if [ "$CONTAINER" = "management" ]; then
-  docker compose -p "$PROJECT_NAME" exec "$CONTAINER" zsh -li
+SHELL_CMD="bash"
+
+if [[ "$PROJECT" == _direct:* ]]; then
+  FULL_NAME="${PROJECT#_direct:}"
+  exec docker exec -it "$FULL_NAME" $SHELL_CMD
 else
-  docker compose -p "$PROJECT_NAME" exec "$CONTAINER" bash
+  exec docker compose -p "$PROJECT" exec "$CONTAINER" $SHELL_CMD
 fi

package/bin/e2e-status

@@ -1,10 +1,16 @@
 #!/bin/bash
 # Show status of the E2E test network.
 
-PROJECT_NAME="conductor-e2e-interactive"
+PROJECT_NAME="${CELILO_E2E_PROJECT:-celilo-e2e-interactive}"
 
 echo "=== Containers ==="
-docker compose -p "$PROJECT_NAME" ps 2>/dev/null || { echo "No E2E network running."; exit 0; }
+if ! docker compose -p "$PROJECT_NAME" ps 2>/dev/null | grep -q .; then
+  echo "No E2E network running (project: $PROJECT_NAME)."
+  echo ""
+  echo "Start one with: cele2e up  or  cele2e run --keep"
+  exit 0
+fi
+docker compose -p "$PROJECT_NAME" ps
 
 echo ""
 echo "=== DNS Check ==="

package/bin/e2e-up

@@ -15,7 +15,7 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$SCRIPT_DIR"
 
-PROJECT_NAME="conductor-e2e-interactive"
+PROJECT_NAME="celilo-e2e-interactive"
 
 # Parse args
 PRESET="infrastructure"
@@ -148,13 +148,13 @@ echo "  letsencrypt:       100.64.0.100      (Pebble ACME)"
 echo "  apt-cache:         100.64.0.2        (apt proxy → real internet)"
 echo ""
 echo "Commands:"
-echo "  ./bin/e2e-shell                   Reconnect to management"
-echo "  ./bin/e2e-shell <container>       Shell into any container"
-echo "  ./bin/e2e-down                    Tear everything down"
+echo "  cele2e shell                      Reconnect to management"
+echo "  cele2e shell <container>          Shell into any container"
+echo "  cele2e down                       Tear everything down"
 echo "  docker compose -p $PROJECT_NAME ps    List containers"
 echo ""
 echo "Dropping you into the management machine..."
-echo "(use 'conductor <cmd>' or 'c <cmd>' — tab completion works)"
+echo "(use 'celilo <cmd>' — tab completion works)"
 echo ""
 
 docker compose -p "$PROJECT_NAME" exec management zsh -li

package/completions/install-zsh-completion.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+#
+# cele2e - Zsh Completion Installer
+
+set -e
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+COMPLETION_FILE="_cele2e"
+COMPLETION_DIR="$HOME/.zsh/completions"
+ZSHRC="$HOME/.zshrc"
+
+echo -e "${BLUE}🧪  cele2e - Zsh Completion Installer${NC}\n"
+
+if ! command -v zsh &> /dev/null; then
+    echo -e "${RED}✗ zsh not found${NC}"; exit 1
+fi
+echo -e "${GREEN}✓${NC} zsh detected"
+
+if ! command -v cele2e &> /dev/null; then
+    echo -e "${RED}✗ cele2e not found in PATH${NC}"
+    echo -e "  Run: bun install -g ~/hobby/infra/packages/e2e"; exit 1
+fi
+echo -e "${GREEN}✓${NC} Found cele2e CLI"
+
+echo -e "${YELLOW}→${NC} Generating completion script..."
+GENERATED=$(cele2e completion zsh 2>/dev/null)
+if [[ -z "$GENERATED" ]]; then
+    echo -e "${RED}✗ Failed to generate completion script${NC}"; exit 1
+fi
+echo -e "${GREEN}✓${NC} Completion script generated"
+
+mkdir -p "$COMPLETION_DIR"
+echo -e "${YELLOW}→${NC} Installing completion script..."
+echo "$GENERATED" > "$COMPLETION_DIR/$COMPLETION_FILE"
+chmod 644 "$COMPLETION_DIR/$COMPLETION_FILE"
+echo -e "${GREEN}✓${NC} Installed to $COMPLETION_DIR/$COMPLETION_FILE"
+
+[[ -f "$ZSHRC" ]] || touch "$ZSHRC"
+
+if grep -q "fpath=.*\.zsh/completions" "$ZSHRC"; then
+    echo -e "${GREEN}✓${NC} Completion directory already in fpath"
+else
+    echo -e "${YELLOW}→${NC} Adding completion directory to .zshrc..."
+    if grep -qn "autoload.*compinit" "$ZSHRC"; then
+        COMPINIT_LINE=$(grep -n "autoload.*compinit" "$ZSHRC" | head -1 | cut -d: -f1)
+        sed -i '' "${COMPINIT_LINE}i\\
+# cele2e completions\\
+fpath=(~/.zsh/completions \$fpath)\\
+
+" "$ZSHRC"
+    else
+        echo -e "\n# cele2e completions\nfpath=(~/.zsh/completions \$fpath)\nautoload -Uz compinit && compinit" >> "$ZSHRC"
+    fi
+    echo -e "${GREEN}✓${NC} fpath configured"
+fi
+
+if ! grep -q "autoload.*compinit" "$ZSHRC"; then
+    echo "autoload -Uz compinit && compinit" >> "$ZSHRC"
+fi
+
+echo -e "${YELLOW}→${NC} Clearing completion cache..."
+rm -rf "$HOME"/.zcompdump*
+echo -e "${GREEN}✓${NC} Cache cleared"
+
+echo ""
+echo -e "${GREEN}✅ Installation complete!${NC}"
+echo ""
+echo "To activate:"
+echo -e "  ${BLUE}exec zsh${NC}"
+echo ""
+echo "Try it out:"
+echo -e "  ${BLUE}cele2e <TAB>${NC}"
+echo -e "  ${BLUE}cele2e run <TAB>${NC}"

package/config/dns/celilo.computer.zone

@@ -0,0 +1,16 @@
+$ORIGIN celilo.computer.
+$TTL 300
+
+@ IN SOA ns1.celilo.computer. admin.celilo.computer. (
+    2024020117 300 60 604800 300
+)
+
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
+@       IN NS   ns1.celilo.computer.
+ns1     IN A    100.64.0.55
+@    IN A    100.100.0.100
+www     IN A    100.100.0.100

package/config/dns/iamtheinternet.org.zone

@@ -2,14 +2,15 @@ $ORIGIN iamtheinternet.org.
 $TTL 300
 
 @ IN SOA ns1.iamtheinternet.org. admin.iamtheinternet.org. (
-    2024010778 300 60 604800 300
+    2024020248 300 60 604800 300
 )
 
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
 @       IN NS   ns1.iamtheinternet.org.
 ns1     IN A    100.64.0.55
 @    IN A    0.0.0.0
-caddy    IN A    100.100.0.100
-www    IN A    100.100.0.100
-deathstar    IN A    100.100.0.100
-test    IN A    0.0.0.0
-auth    IN A    100.100.0.100
+www     IN A    100.100.0.100

package/config/dns/knot-namecheap.conf

@@ -6,6 +6,14 @@ zone:
     file: "/config/iamtheinternet.org.zone"
     storage: "/var/lib/knot"
 
+  - domain: "celilo.computer"
+    file: "/config/celilo.computer.zone"
+    storage: "/var/lib/knot"
+
+  - domain: "lunacycle.net"
+    file: "/config/lunacycle.net.zone"
+    storage: "/var/lib/knot"
+
   - domain: "park-your-domain.com"
     file: "/config/park-your-domain.com.zone"
     storage: "/var/lib/knot"

package/config/dns/knot-tld.conf

@@ -9,3 +9,7 @@ zone:
   - domain: "org"
     file: "/config/org.zone"
     storage: "/var/lib/knot"
+
+  - domain: "net"
+    file: "/config/net.zone"
+    storage: "/var/lib/knot"

package/config/dns/lunacycle.net.zone

@@ -0,0 +1,16 @@
+$ORIGIN lunacycle.net.
+$TTL 300
+
+@ IN SOA ns1.lunacycle.net. admin.lunacycle.net. (
+    2024020108 300 60 604800 300
+)
+
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
+@       IN NS   ns1.lunacycle.net.
+ns1     IN A    100.64.0.55
+@       IN A    100.100.0.100
+www     IN A    100.100.0.100

package/config/dns/net.zone

@@ -0,0 +1,11 @@
+$ORIGIN net.
+$TTL 86400
+
+@ IN SOA tld-dns.lab. admin.lab. (
+    2024010101 1800 900 604800 86400
+)
+
+net.                    IN NS   tld-dns.lab.
+
+lunacycle               IN NS   ns1.lunacycle.net.
+ns1.lunacycle.net.      IN A    100.64.0.55

package/config/dns/org.zone

@@ -10,5 +10,10 @@ org.                    IN NS   tld-dns.lab.
 iamtheinternet          IN NS   ns1.iamtheinternet.org.
 ns1.iamtheinternet.org. IN A    100.64.0.55
 
+; External prober simulator — mimics isitup.org's JSON API.
+; Served directly by tld-dns rather than delegated, since we only need a
+; single A record (no subdomains, no SOA of its own).
+isitup                  IN A    100.64.0.57
+
 ; Note: Let's Encrypt ACME endpoints are handled by unbound local-data
 ; (resolves acme-v02.api.letsencrypt.org → 100.64.0.100 directly)

package/config/dns/root.zone

@@ -12,3 +12,5 @@ com.        IN NS   tld-dns.lab.
 tld-dns.lab.    IN A    100.64.0.54
 
 org.        IN NS   tld-dns.lab.
+
+net.        IN NS   tld-dns.lab.

package/config/dns/templates/iamtheinternet.org.zone

@@ -0,0 +1,16 @@
+$ORIGIN iamtheinternet.org.
+$TTL 300
+
+@ IN SOA ns1.iamtheinternet.org. admin.iamtheinternet.org. (
+    2024020247 300 60 604800 300
+)
+
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
+@       IN NS   ns1.iamtheinternet.org.
+ns1     IN A    100.64.0.55
+@       IN A    0.0.0.0
+www     IN A    100.100.0.100

package/config/dns/templates/lunacycle.net.zone

@@ -0,0 +1,16 @@
+$ORIGIN lunacycle.net.
+$TTL 300
+
+@ IN SOA ns1.lunacycle.net. admin.lunacycle.net. (
+    2024020108 300 60 604800 300
+)
+
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
+@       IN NS   ns1.lunacycle.net.
+ns1     IN A    100.64.0.55
+@       IN A    100.100.0.100
+www     IN A    100.100.0.100

package/config/resolver/unbound.conf

@@ -11,12 +11,22 @@ server:
     # Let's Encrypt ACME endpoints → Pebble
     local-data: "acme-v02.api.letsencrypt.org. IN A 100.64.0.100"
     local-data: "acme-staging-v02.api.letsencrypt.org. IN A 100.64.0.100"
+    # E2E registry container
+    local-data: "e2e-registry.lab. IN A 100.64.0.56"
+    # External website prober simulator — without this override, isitup.org
+    # falls through the "forward-zone: ." below and resolves to the REAL
+    # Namecheap-parked domain on the public internet.
+    local-data: "isitup.org. IN A 100.64.0.57"
 
 # Simulated domains → namecheap-dns (authoritative)
 stub-zone:
     name: "iamtheinternet.org."
     stub-addr: 100.64.0.55
 
+stub-zone:
+    name: "lunacycle.net."
+    stub-addr: 100.64.0.55
+
 stub-zone:
     name: "park-your-domain.com."
     stub-addr: 100.64.0.55

package/config/routing/docker-image-preload.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Pre-load cached Docker images for e2e acceleration
+After=docker.service
+Requires=docker.service
+ConditionPathIsDirectory=/docker-image-cache
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/docker-image-preload.sh
+RemainAfterExit=yes
+StandardOutput=journal
+
+[Install]
+WantedBy=multi-user.target

package/config/routing/docker-image-preload.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Load pre-cached Docker images for e2e acceleration.
+# Runs at container startup via docker-image-preload.service.
+# Gracefully skips if /docker-image-cache is empty or not mounted.
+
+# Wait for the Docker daemon to accept connections (up to 30s)
+for i in $(seq 1 30); do
+    if docker info > /dev/null 2>&1; then
+        break
+    fi
+    sleep 1
+done
+
+if ! docker info > /dev/null 2>&1; then
+    echo "docker-image-preload: Docker not ready after 30s, skipping"
+    exit 0
+fi
+
+shopt -s nullglob
+for tar in /docker-image-cache/*.tar; do
+    echo "docker-image-preload: loading $(basename "$tar")"
+    docker load -i "$tar"
+done
+echo "docker-image-preload: done"

package/config/routing/management-routes.sh

@@ -28,8 +28,30 @@ ip route add 10.0.10.0/24 via 192.168.0.254    # dmz via fw-main
 ip route add 10.0.20.0/24 via 192.168.0.254    # app via fw-main
 ip route add 10.0.30.0/24 via 192.168.0.254    # secure via fw-main
 
-# DNS — use the simulated resolver
-echo "nameserver 100.100.0.1" > /etc/resolv.conf
+# DNS — Technitium internal resolver (split-horizon) with public fallback.
+# Technitium at 192.168.0.10 is authoritative for iamtheinternet.org internally,
+# resolving www/auth to Caddy's DMZ IP (10.0.10.10) rather than the public WAN IP.
+# Fall back to the simulated public resolver if Technitium is not yet up.
+printf 'nameserver 192.168.0.10\nnameserver 100.100.0.1\n' > /etc/resolv.conf
+
+# Fetch Pebble's runtime ACME root CA (Pebble generates a fresh root at each
+# startup, unlike the static /config/pebble/pebble-ca.crt baked in at build
+# time which only signs Pebble's own API endpoint). Without this, management
+# can't verify certs that Caddy obtained from Pebble (iamtheinternet.org,
+# isitup.org, etc.). Mirrors the equivalent block in fw-ext-routes.sh.
+echo "Waiting for Pebble ACME root CA..."
+(
+  for i in $(seq 1 60); do
+    if curl -sk https://100.64.0.100:15000/roots/0 -o /usr/local/share/ca-certificates/pebble-acme-root.crt 2>/dev/null; then
+      if [ -s /usr/local/share/ca-certificates/pebble-acme-root.crt ]; then
+        update-ca-certificates 2>/dev/null
+        echo "Pebble ACME root CA installed"
+        break
+      fi
+    fi
+    sleep 2
+  done
+) &
 
 # Create celilo data directory (Linux default: /var/lib/celilo/)
 mkdir -p /var/lib/celilo/modules

package/config/routing/resolver-internal-routes.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+set -e
+
+# CADDY_IP: IP of the caddy container in the DMZ (default 10.0.10.10).
+# All test-domain queries resolve to this IP so management can reach
+# caddy directly without hairpin NAT through the external interface.
+CADDY_IP="${CADDY_IP:-10.0.10.10}"
+
+# DOMAINS: comma-separated list of e2e test domains that should be
+# split-horizon redirected to caddy. Default covers the canonical
+# (iamtheinternet.org) plus the cross-domain test's second domain
+# (lunacycle.net). Tests can override via DEFAULT_GATEWAY/DOMAINS env
+# vars in docker-compose.
+DOMAINS="${DOMAINS:-iamtheinternet.org,lunacycle.net}"
+
+# Routing — reach comcast-resolver (100.100.0.1) via fw-main or fw-isp.
+# DEFAULT_GATEWAY is set by docker-compose from the topology config.
+GATEWAY="${DEFAULT_GATEWAY:-192.168.0.254}"
+ip route del default 2>/dev/null || true
+ip route add default via "$GATEWAY"
+
+# Build per-domain split-horizon blocks.
+# local-zone "redirect" returns the single A record for ALL names under
+# the zone (including subdomains), so every hostname in the test domain
+# reaches caddy which then reverse-proxies to the correct backend.
+SPLIT_HORIZON_BLOCK=""
+IFS=',' read -ra DOMAIN_LIST <<< "${DOMAINS}"
+for d in "${DOMAIN_LIST[@]}"; do
+    SPLIT_HORIZON_BLOCK="${SPLIT_HORIZON_BLOCK}    local-zone: \"${d}.\" redirect\n    local-data: \"${d}. IN A ${CADDY_IP}\"\n"
+done
+
+# Generate unbound config with split-horizon for each test domain plus
+# the standard simulator overrides (Pebble, registry).
+cat > /etc/unbound/unbound.conf << EOF
+server:
+    interface: 0.0.0.0
+    access-control: 0.0.0.0/0 allow
+    cache-min-ttl: 0
+    cache-max-ttl: 60
+    verbosity: 1
+    do-daemonize: no
+    do-not-query-localhost: no
+
+$(printf "${SPLIT_HORIZON_BLOCK}")
+    # Mirror the public resolver's simulated endpoint overrides so that
+    # management uses Pebble for ACME and the e2e registry for modules.
+    local-data: "acme-v02.api.letsencrypt.org. IN A 100.64.0.100"
+    local-data: "acme-staging-v02.api.letsencrypt.org. IN A 100.64.0.100"
+    local-data: "e2e-registry.lab. IN A 100.64.0.56"
+
+forward-zone:
+    name: "."
+    forward-addr: 100.100.0.1
+EOF
+
+/usr/sbin/unbound -d &
+
+echo "internal resolver ready (split-horizon: ${DOMAINS} -> ${CADDY_IP})"
+sleep infinity

package/docker/Dockerfile.internal-resolver

@@ -0,0 +1,16 @@
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y \
+    unbound \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY config/routing/resolver-internal-routes.sh /startup.sh
+RUN chmod +x /startup.sh
+
+EXPOSE 53/tcp 53/udp
+CMD ["/startup.sh"]

package/docker/Dockerfile.isitup

@@ -0,0 +1,37 @@
+FROM oven/bun:latest
+
+# Caddy (for ACME/TLS termination) + tools needed by entrypoint.sh.
+# iproute2 provides `ip` so the entrypoint can rewrite the default route
+# through fw-ext (same pattern as Dockerfile.pebble); without it DNS for
+# simulated public hostnames fails.
+RUN apt-get update && apt-get install -y \
+    ca-certificates \
+    curl \
+    iproute2 \
+    debian-keyring \
+    debian-archive-keyring \
+    apt-transport-https \
+    gnupg \
+    && curl -fsSL 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
+       | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg \
+    && curl -fsSL 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
+       > /etc/apt/sources.list.d/caddy-stable.list \
+    && apt-get update && apt-get install -y caddy \
+    && rm -rf /var/lib/apt/lists/*
+
+# Trust Pebble CA so Caddy's ACME client accepts the directory endpoint
+COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
+RUN update-ca-certificates
+
+# Simulator app
+COPY simulators/isitup/server.ts /simulator/server.ts
+
+# Caddy config
+COPY simulators/isitup/Caddyfile /etc/caddy/Caddyfile
+
+# Entrypoint
+COPY simulators/isitup/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 80 443
+CMD ["/entrypoint.sh"]

package/docker/Dockerfile.management

@@ -17,6 +17,8 @@ RUN chsh -s /bin/zsh root
 
 # Trust the E2E forward proxy CA (for transparent HTTPS interception)
 COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
+# Trust Pebble's test CA (so bun fetch() trusts certs issued by the simulated Let's Encrypt)
+COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
 RUN update-ca-certificates
 
 # Point apt at the simulated apt cache proxy (for runtime apt usage)