@celilo/e2e 0.5.1 → 0.6.1

package/docker/Dockerfile.registry

@@ -0,0 +1,34 @@
+FROM oven/bun:1
+
+WORKDIR /app
+
+# Install the shared @celilo/registry-server package.
+# Both this e2e stand-in and the celilo-registry module run the same code —
+# packages/registry-server is the single source of truth.
+COPY registry-server/package.json ./package.json
+COPY registry-server/tsconfig.json ./tsconfig.json
+COPY registry-server/src ./src
+
+RUN bun install --production
+
+# Bootstrap mode: the shared-infra stand-in serves modules directly from the
+# repo's modules/ directory (volume-mounted read-only). This preserves the
+# pre-unification convenience where tests can `celilo module import
+# public-registry namecheap` without having to publish namecheap first.
+#
+# The production celilo-registry module does NOT set BOOTSTRAP_MODULES_DIR
+# and only serves pre-published packages.
+ENV DATA_DIR=/var/lib/celilo-registry \
+    BOOTSTRAP_MODULES_DIR=/modules \
+    BOOTSTRAP_UPLOADS_DIR=/uploads \
+    BOOTSTRAP_CACHE_DIR=/cache \
+    PATH_PREFIX= \
+    PORT=80
+
+# /uploads is the drop-zone for .netapps that tests push via
+# `docker compose cp`. Create the dir at build time so `docker cp` has
+# somewhere to put files before the server runs.
+RUN mkdir -p /uploads
+
+EXPOSE 80
+CMD ["bun", "run", "src/index.ts"]

package/docker/Dockerfile.target-machine

@@ -57,5 +57,25 @@ RUN (cd /lib/systemd/system/sysinit.target.wants/ && \
 # Re-enable the services we actually need
 RUN systemctl enable ssh target-setup
 
+# --- Caddy pre-installation ---
+# Temporarily disable apt proxy (not available during docker build)
+RUN rm -f /etc/apt/apt.conf.d/00proxy
+
+# Install Caddy (same steps as the Ansible role, but at image build time so
+# the role finds it already installed and skips the slow cloudsmith.io downloads)
+RUN apt-get update && apt-get install -y \
+    debian-keyring \
+    debian-archive-keyring \
+    apt-transport-https \
+    && rm -rf /var/lib/apt/lists/*
+RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | \
+    gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | \
+    tee /etc/apt/sources.list.d/caddy-stable.list
+RUN apt-get update && apt-get install -y caddy && rm -rf /var/lib/apt/lists/*
+
+# Re-enable apt proxy for runtime
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
 STOPSIGNAL SIGRTMIN+3
 ENTRYPOINT ["/sbin/init"]

package/docker/Dockerfile.target-machine-docker

@@ -1,6 +1,6 @@
-# Target machine with Docker pre-installed and authentik images pre-pulled.
-# Used for app-zone machines that will run Docker Compose workloads.
-# This avoids a 10+ minute Docker pull during e2e test deploy time.
+# Target machine with Docker pre-installed.
+# Used for app-zone machines that run Docker Compose workloads (e.g. authentik).
+# Docker itself is baked in; application images are pulled at deploy time by each module.
 
 FROM ubuntu:22.04
 
@@ -87,22 +87,14 @@ RUN mkdir -p /etc/docker && \
 
 RUN systemctl enable docker
 
-# Pre-cached image loading service:
-# At first boot, if /docker-image-cache/*.tar exists, load them into Docker.
-# This avoids multi-minute pulls during e2e test deploy.
-RUN echo '#!/bin/bash\n\
-set -e\n\
-if ls /docker-image-cache/*.tar 1>/dev/null 2>&1; then\n\
-  for img in /docker-image-cache/*.tar; do\n\
-    echo "Loading cached Docker image: $img"\n\
-    docker load < "$img"\n\
-  done\n\
-fi\n' > /usr/local/bin/load-cached-images.sh && \
-    chmod +x /usr/local/bin/load-cached-images.sh
-
-RUN printf '[Unit]\nDescription=Load pre-cached Docker images\nAfter=docker.service\nRequires=docker.service\n\n[Service]\nType=oneshot\nExecStart=/usr/local/bin/load-cached-images.sh\nRemainAfterExit=yes\n\n[Install]\nWantedBy=multi-user.target\n' \
-    > /etc/systemd/system/load-docker-cache.service && \
-    systemctl enable load-docker-cache
+# Pre-load cached Docker images on startup (e2e acceleration)
+# /docker-image-cache is bind-mounted from the host by the compose generator.
+# The service is a no-op if the directory is absent or empty.
+COPY config/routing/docker-image-preload.sh /usr/local/bin/docker-image-preload.sh
+RUN chmod +x /usr/local/bin/docker-image-preload.sh
+COPY config/routing/docker-image-preload.service /etc/systemd/system/docker-image-preload.service
+RUN systemctl enable docker-image-preload
+
 
 STOPSIGNAL SIGRTMIN+3
 ENTRYPOINT ["/sbin/init"]

package/docker/Dockerfile.target-technitium

@@ -0,0 +1,97 @@
+# Target machine with Technitium DNS Server pre-installed.
+# Based on target-machine; Technitium is installed at image build time so the
+# Ansible role finds it already present and skips the download step.
+
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    systemd \
+    systemd-sysv \
+    openssh-server \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    python3 \
+    python3-apt \
+    sqlite3 \
+    jq \
+    sudo \
+    curl \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Trust the E2E forward proxy CA (for transparent HTTPS interception)
+COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
+# Trust Pebble's test CA (so Caddy/ACME clients trust the simulated Let's Encrypt)
+COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
+RUN update-ca-certificates
+
+RUN mkdir -p /run/sshd && \
+    sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config && \
+    sed -i 's/#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+
+# Enable SSH service
+RUN systemctl enable ssh
+
+# Point apt at the simulated apt cache proxy
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
+# E2E network setup service (runs at boot to configure routing, DNS, SSH keys)
+COPY config/routing/target-setup.sh /usr/local/bin/target-setup.sh
+RUN chmod +x /usr/local/bin/target-setup.sh
+
+COPY config/routing/target-setup.service /etc/systemd/system/target-setup.service
+RUN systemctl enable target-setup
+
+# Clean up unnecessary systemd services that slow down boot
+RUN (cd /lib/systemd/system/sysinit.target.wants/ && \
+    ls | grep -v systemd-tmpfiles-setup | xargs rm -f 2>/dev/null); \
+    rm -f /lib/systemd/system/multi-user.target.wants/*; \
+    rm -f /etc/systemd/system/*.wants/*; \
+    rm -f /lib/systemd/system/local-fs.target.wants/*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
+    rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
+    rm -f /lib/systemd/system/basic.target.wants/*; \
+    true
+
+# Re-enable the services we actually need
+RUN systemctl enable ssh target-setup
+
+# --- Technitium pre-installation (manual — installer requires running systemd) ---
+# The official install.sh checks for systemd at runtime and fails during docker build.
+# Instead: install ASP.NET Core runtime, download binaries, write the service file.
+# Ansible tasks check for /opt/technitium/dns/DnsServerApp.dll and skip the download.
+
+# Temporarily lift the apt proxy (not available at build time)
+RUN rm -f /etc/apt/apt.conf.d/00proxy
+
+# ASP.NET Core 8.0 runtime via Microsoft package feed
+RUN curl -sSL https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb \
+    -o /tmp/ms-prod.deb && \
+    dpkg -i /tmp/ms-prod.deb && \
+    rm /tmp/ms-prod.deb && \
+    apt-get update && \
+    apt-get install -y aspnetcore-runtime-8.0 && \
+    rm -rf /var/lib/apt/lists/*
+
+# Download and extract Technitium portable package
+RUN mkdir -p /opt/technitium/dns && \
+    curl -sSL https://download.technitium.com/dns/DnsServerPortable.tar.gz \
+    -o /tmp/technitium.tar.gz && \
+    tar -xzf /tmp/technitium.tar.gz -C /opt/technitium/dns && \
+    rm -f /tmp/technitium.tar.gz
+
+# Register systemd service (same unit the installer creates)
+RUN printf '[Unit]\nDescription=Technitium DNS Server\nAfter=network.target\n\n[Service]\nExecStart=/usr/bin/dotnet /opt/technitium/dns/DnsServerApp.dll\nRestart=on-failure\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target\n' \
+    > /etc/systemd/system/dns.service && \
+    systemctl enable dns
+
+# Re-enable apt proxy for runtime
+RUN echo 'Acquire::http::Proxy "http://100.64.0.2:3142";' > /etc/apt/apt.conf.d/00proxy
+
+STOPSIGNAL SIGRTMIN+3
+ENTRYPOINT ["/sbin/init"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -10,21 +10,28 @@
     "./fixtures": "./src/fixtures.ts"
   },
   "bin": {
+    "cele2e": "./bin/cele2e",
     "celilo-e2e-run": "./bin/e2e-run",
     "celilo-e2e-build": "./bin/e2e-build",
     "celilo-e2e-load": "./bin/e2e-load",
     "celilo-e2e-infra": "./bin/e2e-infra"
   },
+  "scripts": {
+    "test": "bun test tests/",
+    "test:completion": "bun test tests/completion"
+  },
   "files": [
     "src/",
     "docker/",
     "config/",
+    "completions/",
     "simulators/",
     "bin/",
     "netapps/",
     "README.md"
   ],
   "dependencies": {
+    "@celilo/cli-display": "0.1.0",
     "yaml": "^2.8.0"
   },
   "devDependencies": {

package/simulators/greenwave/state.ts

@@ -161,28 +161,23 @@ function applyIptablesRule(mapping: PortMapping): void {
   const intIp = mapping.internalClient;
   const intPort = mapping.internalPort;
 
-  try {
+  function addRules(p: string) {
     // DNAT incoming traffic on external interface destined for our public IP
     execSync(
-      `iptables -t nat -A PREROUTING -i ${EXTERNAL_INTERFACE} -d ${PUBLIC_IP} -p ${proto} --dport ${extPort} -j DNAT --to-destination ${intIp}:${intPort}`,
+      `iptables -t nat -A PREROUTING -i ${EXTERNAL_INTERFACE} -d ${PUBLIC_IP} -p ${p} --dport ${extPort} -j DNAT --to-destination ${intIp}:${intPort}`,
       { timeout: 5000 },
     );
     // Allow forwarded traffic
     execSync(
-      `iptables -A FORWARD -p ${proto} -d ${intIp} --dport ${intPort} -j ACCEPT`,
+      `iptables -A FORWARD -p ${p} -d ${intIp} --dport ${intPort} -j ACCEPT`,
       { timeout: 5000 },
     );
+  }
 
-    // If protocol is TCP/UDP, also add UDP rules
+  try {
+    addRules(proto);
     if (mapping.protocol === 'TCP/UDP') {
-      execSync(
-        `iptables -t nat -A PREROUTING -i ${EXTERNAL_INTERFACE} -d ${PUBLIC_IP} -p udp --dport ${extPort} -j DNAT --to-destination ${intIp}:${intPort}`,
-        { timeout: 5000 },
-      );
-      execSync(
-        `iptables -A FORWARD -p udp -d ${intIp} --dport ${intPort} -j ACCEPT`,
-        { timeout: 5000 },
-      );
+      addRules('udp');
     }
   } catch (err) {
     console.error(`[greenwave] Failed to apply iptables rule:`, err);

package/simulators/isitup/Caddyfile

@@ -0,0 +1,11 @@
+{
+    email admin@isitup.org
+    # Pebble listens on 443 with a TLS cert whose SAN is
+    # acme-v02.api.letsencrypt.org (not an IP), so we use the hostname and
+    # rely on comcast-resolver's local-data override to reach 100.64.0.100.
+    acme_ca https://acme-v02.api.letsencrypt.org/dir
+}
+
+isitup.org {
+    reverse_proxy localhost:8080
+}

package/simulators/isitup/entrypoint.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# Start the Bun API server in the background, then Caddy in the foreground.
+# Caddy terminates TLS (with a cert issued by Pebble) and reverse-proxies
+# /api.json to Bun on localhost:8080.
+
+set -e
+
+# Route through fw-ext so we can reach comcast-resolver on isp-external
+# (Docker's default bridge gateway has no path across networks). Without
+# this, DNS for acme-v02.api.letsencrypt.org fails, Caddy never gets its
+# cert, and port 443 never opens. Mirrors config/routing/pebble-startup.sh.
+# fw-ext is a per-test container so this route is unreachable when shared
+# infra runs alone — harmless; the test brings fw-ext up before the prober
+# is exercised.
+ip route del default 2>/dev/null || true
+ip route add default via 100.64.0.1
+
+# Fetch Pebble's runtime ACME root CA so the simulator trusts certs presented
+# by the targets it probes (e.g. Caddy on iamtheinternet.org uses a Pebble-
+# issued cert). Pebble regenerates its root on every startup, so the static
+# pebble-ca.crt baked in at build time isn't enough.
+echo "Waiting for Pebble ACME root CA..."
+for i in $(seq 1 60); do
+  if curl -sk https://100.64.0.100:15000/roots/0 -o /usr/local/share/ca-certificates/pebble-acme-root.crt 2>/dev/null; then
+    if [ -s /usr/local/share/ca-certificates/pebble-acme-root.crt ]; then
+      update-ca-certificates 2>/dev/null
+      echo "Pebble ACME root CA installed"
+      break
+    fi
+  fi
+  sleep 2
+done
+
+cd /simulator
+bun run server.ts &
+BUN_PID=$!
+
+# Wait briefly for Bun to come up before Caddy starts proxying
+for i in $(seq 1 10); do
+  if curl -sf http://127.0.0.1:8080/health >/dev/null 2>&1; then
+    break
+  fi
+  sleep 0.3
+done
+
+# Caddy runs in foreground so the container lifecycle follows it
+exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile

package/simulators/isitup/server.ts

@@ -0,0 +1,112 @@
+/**
+ * isitup.org Simulator
+ *
+ * Mimics the isitup.org JSON API:
+ *   GET /api.json?url=<domain>
+ *
+ * status_code values match the real API:
+ *   1 = site is up
+ *   2 = site is down (connection failed / non-2xx/3xx)
+ *   3 = bad URL (malformed)
+ *
+ * The simulator is deployed on internet-external and probes the target
+ * from that network position — so it exercises the same public-facing
+ * path a real external prober would.
+ */
+
+const PORT = Number(process.env.PORT) || 8080;
+
+interface ProbeResponse {
+  domain: string;
+  port: number;
+  status_code: 1 | 2 | 3;
+  response_ip: string;
+  response_code: number;
+  response_time: number;
+}
+
+async function probe(targetUrl: string): Promise<ProbeResponse> {
+  let parsed: URL;
+  const withScheme = targetUrl.includes('://') ? targetUrl : `https://${targetUrl}`;
+  try {
+    parsed = new URL(withScheme);
+  } catch {
+    return {
+      domain: targetUrl,
+      port: 443,
+      status_code: 3,
+      response_ip: '',
+      response_code: 0,
+      response_time: 0,
+    };
+  }
+
+  const port = parsed.port
+    ? Number(parsed.port)
+    : parsed.protocol === 'https:'
+      ? 443
+      : 80;
+
+  const start = Date.now();
+  try {
+    const response = await fetch(withScheme, {
+      signal: AbortSignal.timeout(10_000),
+      redirect: 'follow',
+    });
+    const responseTime = (Date.now() - start) / 1000;
+    // Real isitup treats 2xx/3xx as up. Anything else (or unreachable) is down.
+    const isUp = response.status >= 200 && response.status < 400;
+    console.log(`[isitup] ${withScheme} → HTTP ${response.status} in ${responseTime.toFixed(2)}s`);
+    return {
+      domain: parsed.hostname,
+      port,
+      status_code: isUp ? 1 : 2,
+      response_ip: '',
+      response_code: response.status,
+      response_time: responseTime,
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.log(`[isitup] ${withScheme} → probe error: ${message}`);
+    return {
+      domain: parsed.hostname,
+      port,
+      status_code: 2,
+      response_ip: '',
+      response_code: 0,
+      response_time: (Date.now() - start) / 1000,
+    };
+  }
+}
+
+const server = Bun.serve({
+  port: PORT,
+  async fetch(req) {
+    const url = new URL(req.url);
+
+    if (url.pathname === '/api.json') {
+      const target = url.searchParams.get('url');
+      if (!target) {
+        return Response.json({
+          domain: '',
+          port: 443,
+          status_code: 3,
+          response_ip: '',
+          response_code: 0,
+          response_time: 0,
+        });
+      }
+      const result = await probe(target);
+      console.log(`[isitup] ${target} → ${result.status_code} (${result.response_code})`);
+      return Response.json(result);
+    }
+
+    if (url.pathname === '/' || url.pathname === '/health') {
+      return Response.json({ ok: true, service: 'isitup.org simulator' });
+    }
+
+    return new Response('Not Found', { status: 404 });
+  },
+});
+
+console.log(`[isitup] simulator listening on port ${server.port}`);

package/simulators/namecheap-ddns/server.ts

@@ -11,9 +11,38 @@
 import { updateZone } from './zone-updater';
 import type { DdnsRecord } from './types';
 
-const VALID_PASSWORD = process.env.DDNS_PASSWORD || 'test123';
+// Real Namecheap DDNS uses a separate password per domain. The simulator
+// supports two modes:
+//   1. DDNS_PASSWORDS (JSON object mapping domain→password). Per-domain
+//      lookup; password must match the entry for the requested domain.
+//   2. DDNS_PASSWORD (single string fallback). Accepted for any domain.
+//      Default `test123` keeps single-domain tests working unchanged.
+// Mode 1 wins when set; the cross-domain e2e test exercises it via
+// docker-compose env to verify per-domain password routing.
+const PASSWORD_MAP: Record<string, string> = (() => {
+  const raw = process.env.DDNS_PASSWORDS;
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      const out: Record<string, string> = {};
+      for (const [k, v] of Object.entries(parsed)) {
+        if (typeof v === 'string') out[k] = v;
+      }
+      return out;
+    }
+  } catch {
+    console.warn(`[ddns] Failed to parse DDNS_PASSWORDS env var: ${raw}`);
+  }
+  return {};
+})();
+const FALLBACK_PASSWORD = process.env.DDNS_PASSWORD || 'test123';
 const PORT = Number(process.env.DDNS_PORT) || 8080;
 
+function expectedPasswordFor(domain: string): string {
+  return PASSWORD_MAP[domain] ?? FALLBACK_PASSWORD;
+}
+
 // Track registered records for debugging
 const records: Map<string, DdnsRecord> = new Map();
 
@@ -66,7 +95,7 @@ const server = Bun.serve({
         return xmlResponse(1, '', ['Missing required parameters: host, domain']);
       }
 
-      if (password !== VALID_PASSWORD) {
+      if (password !== expectedPasswordFor(domain)) {
         return xmlResponse(1, ip, ['Passwords do not match']);
       }