Celilo stops guessing your network. A management server comes up knowing only the one network it’s actually plugged into, and it grows its reach as you deploy the modules that provide new networks. There are no hardcoded subnet defaults for zones that may not exist on your network — a zone becomes real only when something actually provides it.
Why stop guessing
The old model made the management server declare all four zones’ subnets as its own configuration, seeded with hardcoded defaults. That’s the wrong owner — subnets and gateways are a network concern, and the management box became the dumping ground only because it happened to be deployed first. Worse, those invented defaults described a network that might not match yours at all. Better to know one true thing than to assume four.
What’s known at install
Right after the management server installs, exactly one zone exists: internal —
the LAN the box is sitting on, discovered from the box itself. Celilo reads the
primary interface’s address and the default gateway, and reads the current DNS
resolver from the machine, then records what it found — loudly, so you can see
exactly what was discovered and written. From that point you can deploy modules
destined for internal, like homebridge.
Zones appear as firewalls reveal them
The dmz, app, and secure zones simply don’t exist yet. They come into being
when a firewall-capable module is deployed and you designate the additional
networks that firewall provides, supplying their addressing. Until then, a deploy
targeting one of those zones fails cleanly with “zone not configured” — not a
silent misconfiguration, but an honest signal that the network isn’t there yet.
Deploy the firewall, name its networks, and Celilo can allocate in them. Your
topology reveals itself one module at a time, and Celilo never pretends to know
more than it does.