Add a stateful Proxmox API console and broad handler coverage beyond the

initial QEMU slice, backed by imported contracts for majors 6–9.
- Implement durable handlers for access/auth, cluster, LXC, storage, HA,
  firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops
- Serve an interactive Web UI with catalog browsing, demo seed controls,
  and OpenAPI/help surfaces
- Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3
- Support in-memory runtime contract Apply (POST /ui/api/contract/apply)
  so /version and /api2 routes follow the selected major until restart
- Expand seed profiles (including demo-cluster), migrations 007–008, TLS
  gateway config, Compose/Makefile tooling, and compatibility evidence
- Tighten .gitignore for macOS, hidden directories (.*/), and local secrets

docker-compose.yml

@@ -1,6 +1,34 @@
+name: proxmox-api-simulator
+
+x-simulator-env: &simulator-env
+  DATABASE_URL: postgresql://proxmox:proxmox@postgres:5432/proxmox_simulator
+  CONTRACT_SNAPSHOT: /app/contracts/pve-9.2.3.json
+  COMPATIBILITY_EVIDENCE: /app/evidence/pve-9.2.3.json
+  LOG_LEVEL: INFO
+  TICKET_SIGNING_KEY: development-only-signing-key-change-me
+
+x-dev-env: &dev-env
+  DATABASE_URL: postgresql://proxmox:proxmox@postgres:5432/proxmox_simulator
+  TEST_DATABASE_URL: postgresql://proxmox:proxmox@postgres:5432/proxmox_simulator
+  CONTRACT_SNAPSHOT: /workspace/contracts/e61a893e996d05d376579226e7dfbedbcfce8b71787adacffbc557e6e35901c1/snapshot.json
+  COMPATIBILITY_EVIDENCE: /workspace/evidence/pve-9.2.3.json
+  PROXMOXER_HOST: tls-gateway
+  PROXMOXER_PORT: "8443"
+  LOG_LEVEL: INFO
+  TICKET_SIGNING_KEY: development-only-signing-key-change-me
+
+networks:
+  simulator:
+    driver: bridge
+
+volumes:
+  postgres-data:
+
 services:
   postgres:
     image: postgres:17.5-bookworm
+    restart: unless-stopped
+    networks: [simulator]
     environment:
       POSTGRES_DB: proxmox_simulator
       POSTGRES_USER: proxmox
@@ -10,49 +38,101 @@ services:
       interval: 5s
       timeout: 3s
       retries: 10
+      start_period: 5s
     volumes:
       - postgres-data:/var/lib/postgresql/data
     ports:
       - "127.0.0.1:5432:5432"
 
-  simulator:
+  migrate:
     build:
       context: .
       target: runtime
+    image: proxmox-api-simulator:0.1.0
+    networks: [simulator]
     env_file:
       - path: .env
         required: false
     environment:
-      DATABASE_URL: postgresql://proxmox:proxmox@postgres:5432/proxmox_simulator
-      CONTRACT_SNAPSHOT: /app/contracts/pve-9.2.3.json
-      COMPATIBILITY_EVIDENCE: /app/evidence/pve-9.2.3-0.1.0.json
+      <<: *simulator-env
     depends_on:
       postgres:
         condition: service_healthy
+    entrypoint: ["python"]
+    command: ["-m", "app.db.migrate_cli"]
+    restart: "no"
+
+  simulator:
+    build:
+      context: .
+      target: dev
+    image: proxmox-api-simulator-dev:0.1.0
+    restart: unless-stopped
+    networks: [simulator]
+    working_dir: /workspace
+    volumes:
+      - .:/workspace
+    env_file:
+      - path: .env
+        required: false
+    environment:
+      <<: *dev-env
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+    entrypoint: []
+    command:
+      [
+        "uvicorn",
+        "app.main:app",
+        "--host",
+        "0.0.0.0",
+        "--port",
+        "8006",
+        "--reload",
+        "--reload-dir",
+        "/workspace/app",
+        "--reload-include",
+        "*.html",
+      ]
     healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8006/health/ready', timeout=2)"]
+      test:
+        [
+          "CMD",
+          "python",
+          "-c",
+          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8006/health/ready', timeout=2)",
+        ]
       interval: 10s
       timeout: 3s
-      retries: 5
+      retries: 8
+      start_period: 20s
     ports:
       - "8006:8006"
-    read_only: true
-    tmpfs:
-      - /tmp
-    security_opt:
-      - no-new-privileges:true
 
   tls-gateway:
     image: nginx:1.28.0-alpine
+    restart: unless-stopped
+    networks: [simulator]
     depends_on:
       simulator:
-        condition: service_started
+        condition: service_healthy
     ports:
       - "8007:8443"
     volumes:
-      - ./docker/tls/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./docker/tls/gateway.conf:/etc/nginx/conf.d/default.conf:ro
       - ./docker/tls/server.crt:/etc/nginx/tls/server.crt:ro
       - ./docker/tls/server.key:/etc/nginx/tls/server.key:ro
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "wget -qO- --no-check-certificate https://127.0.0.1:8443/health/live || exit 1",
+        ]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 5s
     read_only: true
     tmpfs:
       - /var/cache/nginx
@@ -61,5 +141,22 @@ services:
     security_opt:
       - no-new-privileges:true
 
-volumes:
-  postgres-data:
+  dev:
+    profiles: [tools]
+    build:
+      context: .
+      target: dev
+    image: proxmox-api-simulator-dev:0.1.0
+    networks: [simulator]
+    working_dir: /workspace
+    volumes:
+      - .:/workspace
+    env_file:
+      - path: .env
+        required: false
+    environment:
+      <<: *dev-env
+    depends_on:
+      postgres:
+        condition: service_healthy
+    entrypoint: []