@cyaxis/ulvia 0.0.0-stage → 0.0.1-alpha.9

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 matthias-bernouy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,233 @@
-# Temporary Holding Version
+# Ulvia CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Ulvia installation and release CLI.
+
+The workspace package contains private source code. Official releases are
+bundled without workspace dependencies and published publicly as
+`@cyaxis/ulvia`:
+
+```bash
+bun add --global @cyaxis/ulvia@next
+ulvia --help
+```
+
+From the workspace, build and publish one exact release with:
+
+```bash
+bun run cli:build --version 0.0.1-alpha.9
+bun run cli:publish --version 0.0.1-alpha.9
+```
+
+The build creates a checked npm archive and SHA-256 receipt below
+`artifacts/cli`. Publishing accepts only that exact pair, targets the public npm
+registry, and uses the `next` tag for prereleases or `latest` for stable versions.
+It requires npm credentials configured outside the repository.
+
+```bash
+bun run ulvia -- start
+bun run ulvia -- configure network
+bun run ulvia -- services status
+bun run ulvia -- instance create preview --label "Preview site"
+bun run ulvia -- instance list
+bun run ulvia -- instance credentials preview
+bun run ulvia -- instance stop preview
+bun run ulvia -- instance delete preview --yes
+bun run ulvia -- services stop
+bun run ulvia -- upgrade kernel --version 0.0.1-alpha.9
+bun run ulvia -- upgrade provider --version 0.0.1-alpha.9
+bun run ulvia -- upgrade repository --version 0.0.1-alpha.9
+bun run ulvia -- reset --yes
+bun run ulvia -- release packages/official-repository/collections/ulvia-official
+bun run ulvia -- release /path/to/contract-directory
+bun run ulvia -- release /path/to/provider-directory
+bun run ulvia -- push contract ulvia.official/ulvia.cms.installations@1.0.0 --repository https://repository.example
+bun run ulvia -- pull collection ulvia.official/ulvia-official@1.0.0 --repository https://repository.example
+bun run ulvia -- yank collection ulvia.official/ulvia-official@1.0.0 --repository https://repository.example --reason "Superseded"
+bun run ulvia -- restore collection ulvia.official/ulvia-official@1.0.0 --repository https://repository.example
+bun run ulvia -- prune
+```
+
+The lifecycle commands manage the same Docker Compose projects for loopback and
+public installations from any directory. Persistent
+data lives below `$XDG_DATA_HOME/ulvia` or `~/.local/share/ulvia`;
+`ULVIA_DATA_DIR` remains an explicit isolation override for tests and CI. The
+CLI stores authored releases in `<data>/repository`. Shared Provider, Repository,
+MongoDB, proxy, files, secrets and logs live below `<data>/services`; each
+stateless Kernel has independent state and logs below `<data>/instances/<name>`.
+The CLI never starts application servers, supervises their PIDs, or builds
+software images. It pulls only the canonical public images under
+`docker.io/cyaxis`, validates their Ulvia component and stack-API labels, and
+stores the immutable repository digest selected for each component.
+
+The first lifecycle command creates a safe installation configuration bound to
+`127.0.0.1:5100`. Configure public exposure before creating an instance:
+
+```bash
+ulvia configure network \
+  --bind 0.0.0.0 \
+  --http-port 80 \
+  --tls acme \
+  --https-port 443 \
+  --acme-email ops@example.com
+ulvia start
+ulvia instance create website --domain example.com
+```
+
+The configuration is persisted under `<data>/services/installation.json` and
+is not a per-start mode. ACME requires `0.0.0.0` and every instance in an ACME
+installation requires an explicit DNS domain. Network configuration is locked
+after the first instance because its canonical Kernel URL is part of Provider
+provisioning. Repository and Provider management ports remain loopback-only.
+
+`services start` starts only the shared proxy, MongoDB, Repository and Provider.
+`instance create` provisions one isolated Provider tenant and immediately starts
+its dedicated Kernel. `instance start` restarts only an already-provisioned
+instance's Kernel. All Kernels use the shared proxy port: an instance named
+`default` is available at `http://localhost:5100`, while any other instance such
+as `preview` uses `http://preview.localhost:5100`.
+`ULVIA_HTTP_PORT`, `ULVIA_REPOSITORY_PORT`, and `ULVIA_PROVIDER_PORT` provide
+initial isolation defaults for tests and CI. Interactive configuration belongs
+to `ulvia configure network`. The Provider still listens on its canonical port
+5103 inside the private Docker network; only its operator port on the host
+changes.
+`start` is the idempotent convenience command for shared services plus every
+previously created local instance; it never creates an implicit instance.
+
+The lifecycle boundary is deliberate:
+
+| Command | Provider tenant | Kernel container |
+| --- | --- | --- |
+| `services start` | Does not create one | Does not start one |
+| `instance create <name>` | Provisions one durable tenant | Creates and starts its Kernel |
+| `instance start <name>` | Reuses the existing tenant | Starts only that Kernel |
+| `start` | Never provisions | Starts every existing Kernel after shared services |
+
+`instance credentials <name>` prints only that administrator's email and
+password. Repository, Provider operator and instance bearer tokens remain in
+private runtime files. Shared services and every instance have independent
+`stop`, `status`, and `logs` boundaries. Software upgrades are explicit and
+component-scoped through `upgrade <component> --version <exact-version>`.
+Normal starts always reuse the installed digest and never follow a newer tag.
+`reset --yes`
+removes every Compose project, instance, shared state and repository
+release. It does not inspect or modify the current working directory.
+`release <resource-directory>` reads `definition.json` and routes by `kind`:
+`collection`, `contract`, or `provider-manifest`. It validates and stores one
+immutable release. A provider manifest must reference exact contract releases
+already in the local repository. Release does not connect to or test a provider.
+Contract fixture assets declared in `definition.json` are read from
+`fixtures/<asset-id>` and verified by digest. Releasing the same coordinate with
+different content fails. The local Repository serves stored resources
+at `/v1/collections`, `/v1/contracts`, and `/v1/providers` on loopback port
+5102, with declared contract fixtures at
+`/v1/contracts/<publisher>/<contract>/<version>/fixtures/<asset-id>`, and sees
+new releases without restarting. The CMS consumes the collection and provider
+repository endpoints. The Provider administration Page imports an exact
+manifest, approves an account connection and replaces the site's exact contract
+selections for Gateway calls. `prune` empties all local repository content
+without deleting service or instance data.
+
+Contract authors may keep only release metadata in `definition.json` and split
+capabilities recursively below `capabilities/`. Each capability is one JSON
+object. Optional `mocks/**/*.json` fragments contain one mock plus its explicit
+`capabilityId`; mocks embedded in capability fragments reject. The compiler
+sorts capabilities and mocks by their declared IDs, so paths never affect the
+immutable digest. `definition.json` cannot contain an inline `capabilities`
+array: the recursive source tree is the only authored contract format.
+
+An optional conformance companion uses `conformance/definition.json`, recursive
+`conformance/scenarios/**/*.json` scenario objects and recursive
+`conformance/exemptions/**/*.json` coverage-exemption objects. Optional suite
+fixture bytes live below `conformance/fixtures/<asset-id>`. The release command
+assembles and admits a present suite, including exact locally released
+dependencies, before storing the contract. Conformance publication and live
+execution are separate Gateway/repository APIs; the CLI does not yet orchestrate
+a disposable provider environment.
+
+`push` publishes one exact local coordinate, and `pull` downloads and re-admits
+one exact remote coordinate before storing it locally. Both support
+`collection`, `contract`, and `provider`; dependencies must be transferred
+first. `ULVIA_REPOSITORY_URL` can replace `--repository`.
+Repository writes require `ULVIA_REPOSITORY_TOKEN`; the token is never accepted
+as a command-line argument. Every mutation carries a timestamp, one-time nonce,
+body digest, and HMAC-SHA-256 signature. The server rejects stale or replayed
+requests, serializes writes across processes, re-runs admission and evolution
+rules, and stages every declared asset as a separately signed raw stream. A final
+idempotent commit makes the immutable artifact visible only after all byte lengths
+and SHA-256 digests pass. Interrupted and rejected sessions never expose a partial
+release. An exact republish is idempotent; different bytes at an existing coordinate
+reject.
+
+The protocol, exact-coordinate client and mutation endpoint live in
+`@bernouy/cms-repository/repository/publication`; the CLI only composes them with
+the reference filesystem adapter and its loopback listener. The filesystem
+composition persists upload sessions and replay claims below the repository root.
+A production repository can replace those ports without depending on this
+executable package.
+
+`yank` is reversible catalogue metadata: it hides a release from new catalogue
+resolution without deleting its exact historical bytes. `restore` exposes it
+again. Contract yanks block new dependent publications while previously
+published provider manifests remain readable. The loopback Repository uses the
+same write protocol and keeps its generated repository token in the private
+runtime directory. The removed integration repository/Supabase bridge is not
+run.
+
+A collection keeps immutable administration copy in recursive locale
+directories such as `translations/en/collection.json` and
+`translations/en/theme/colors.json`. Every JSON object below
+`translations/<locale>/` contributes to that locale's flat catalogue.
+Collection, Bloc, setting, text, theme and Page metadata stores
+reusable keys from those catalogues rather than inline labels. A key may occur
+in only one fragment per locale. The collection locale must define every
+referenced key; additional locale directories may be partial and fall back to
+it.
+
+A collection theme is authored as an ordered set of files. Its
+`theme/definition.json` contains the theme label key and the ordered list of
+category IDs. Category files may be organized recursively below `theme/`; the
+scanner finds them by their internal `id`, while the manifest remains the only
+source of display order. A category filename must match its ID, duplicate IDs
+and orphan files reject, and category/token metadata uses the shared translation
+keys. Categories use an `entries` array containing ordinary tokens and optional
+typed `font-face` entries backed by local WOFF2 assets.
+
+Collection assets are discovered recursively below `assets/`; their lowercase
+relative paths are their stable IDs. They are not declared in the collection
+`definition.json`. An optional root `assets/definition.json` accepts only a
+`generations` object keyed by those paths. The compiler derives media type,
+size and digest. Safe presentation-only SVG files receive the `inline-svg`
+profile automatically; other SVGs remain downloadable assets but cannot be
+expanded into authored Page DOM.
+
+Collection texts use recursive `texts/definitions/**/*.json` arrays for stable
+IDs and administration metadata, plus recursive
+`texts/locales/<locale>/**/*.json` objects for content values. The release
+command joins them into ordinary collection text records. Paths never prefix a
+text ID; duplicate definitions, duplicate per-locale values and unknown value
+IDs reject.
+
+Bloc roots are discovered recursively below `blocs/`. A folder becomes a Bloc
+when it contains `definition.json`, its basename must match the declared Bloc
+ID, and discovery stops there so `settings/definition.json` is never mistaken
+for a nested Bloc. Intermediate grouping directories contain only directories
+and do not affect release identity.
+
+The Official Repository image contains the admitted CMS contracts, provider
+manifest, and administration collection. It installs that snapshot only into
+empty persistent storage. To publish the same resources manually, release the
+CMS contracts before the manifest:
+
+```bash
+bun run ulvia -- release packages/official-repository/contracts/ulvia.cms.access
+bun run ulvia -- release packages/official-repository/contracts/ulvia.cms.installations
+bun run ulvia -- release packages/official-repository/contracts/ulvia.cms.content
+bun run ulvia -- release packages/official-repository/contracts/ulvia.cms.files
+bun run ulvia -- release packages/official-repository/contracts/ulvia.provider.cms-instances
+bun run ulvia -- release packages/official-repository/providers/ulvia.official
+bun run ulvia -- start
+```
+
+`instance create` provisions the named instance through the Provider operator
+API, then starts its Kernel. Connection review validates the runtime report and
+exact manifest claims; it does not yet execute a live conformance suite.

package/dist/definitions/kernel-tls.yml

@@ -0,0 +1,5 @@
+services:
+    kernel:
+        environment:
+            ACME_HOST: ${ULVIA_INSTANCE_HOSTNAME}
+            LETSENCRYPT_HOST: ${ULVIA_INSTANCE_HOSTNAME}

package/dist/definitions/kernel.yml

@@ -0,0 +1,40 @@
+services:
+    kernel:
+        image: ${KERNEL_IMAGE}
+        restart: unless-stopped
+        init: true
+        user: "${ULVIA_UID}:${ULVIA_GID}"
+        environment:
+            MODE: PROD
+            NODE_ENV: production
+            KERNEL_HOST: 0.0.0.0
+            KERNEL_PORT: "3000"
+            KERNEL_PUBLIC_URL: ${ULVIA_INSTANCE_URL}
+            CMS_INSTALLATIONS_PROVIDER_URL: http://ulvia-provider:5103
+            CMS_INSTALLATIONS_PROVIDER_TOKEN: ${CMS_INSTALLATIONS_PROVIDER_TOKEN}
+            ULVIA_LOG_FILE: /var/log/ulvia/kernel.ndjson
+            VIRTUAL_HOST: ${ULVIA_INSTANCE_HOSTNAME}
+            VIRTUAL_PORT: "3000"
+        volumes:
+            - type: bind
+              source: ${ULVIA_LOGS_DIR}
+              target: /var/log/ulvia
+        networks:
+            - instances
+        read_only: true
+        tmpfs:
+            - /tmp:rw,nosuid,nodev,noexec,size=256m
+        cap_drop: [ALL]
+        security_opt: [no-new-privileges:true]
+        healthcheck:
+            test: ["CMD", "bun", "-e", "const r=await fetch('http://127.0.0.1:3000/readyz'); if(!r.ok) process.exit(1); await r.body?.cancel()"]
+            interval: 30s
+            timeout: 5s
+            retries: 3
+            start_period: 10s
+        stop_grace_period: 30s
+
+networks:
+    instances:
+        external: true
+        name: ${ULVIA_INSTANCE_NETWORK}

package/dist/definitions/mongo/provision-provider.js

@@ -0,0 +1,21 @@
+const environment = { ...process.env };
+
+function required(name) {
+    const value = String(environment[name] ?? "").trim();
+    if (!value) {
+        throw new Error(`Missing ${name}`);
+    }
+    return value;
+}
+
+const username = required("MONGO_PROVIDER_USERNAME");
+const password = required("MONGO_PROVIDER_PASSWORD");
+const admin = db.getSiblingDB("admin");
+const existing = admin.getUser(username);
+const roles = [{ role: "readWriteAnyDatabase", db: "admin" }];
+
+if (existing) {
+    admin.updateUser(username, { pwd: password, roles });
+} else {
+    admin.createUser({ user: username, pwd: password, roles });
+}

package/dist/definitions/nginx/capability_cache.conf

@@ -0,0 +1,13 @@
+# Cache only generic capability routes. Provider Cache-Control headers remain
+# authoritative, so private and no-store responses are never retained.
+proxy_cache_path /var/cache/nginx/cms levels=1:2 keys_zone=cms_capabilities:16m max_size=1g inactive=1h use_temp_path=off;
+
+map $uri $cms_skip_capability_cache {
+    default 1;
+    ~^/(?:[^/]+/)*\.cms/call/ 0;
+}
+
+map $request_method $cms_cache_method {
+    default $request_method;
+    HEAD GET;
+}

package/dist/definitions/nginx/client_max_body.conf

@@ -0,0 +1,2 @@
+# The application accepts 100 MiB files plus at most 1 MiB of multipart framing.
+client_max_body_size 101m;

package/dist/definitions/nginx/default_location

@@ -0,0 +1,8 @@
+# Included inside every generated proxy location by nginx-proxy.
+proxy_cache cms_capabilities;
+proxy_cache_methods GET HEAD;
+proxy_cache_key "$scheme|$cms_cache_method|$host|$uri|$is_args$args";
+proxy_cache_bypass $cms_skip_capability_cache $http_authorization;
+proxy_no_cache $cms_skip_capability_cache $http_authorization;
+proxy_cache_valid 200 206 1h;
+add_header X-Cache-Status $upstream_cache_status always;

package/dist/definitions/nginx/query_safe_access_log.conf

@@ -0,0 +1,4 @@
+# Never record query strings. Signed file access tokens are carried in queries.
+log_format cms_query_safe '$remote_addr - $remote_user [$time_local] "$request_method $uri $server_protocol" '
+                          '$status $body_bytes_sent "$http_referer" "$http_user_agent"';
+access_log /var/log/nginx/access.log cms_query_safe;

package/dist/definitions/services-tls.yml

@@ -0,0 +1,20 @@
+services:
+    proxy:
+        ports:
+            - "${ULVIA_BIND_ADDRESS}:${ULVIA_HTTPS_PORT}:443"
+
+    acme:
+        image: nginxproxy/acme-companion:2.8.1@sha256:ccfceb9798b9f6586d47eeeadbb8e185c8897b34e011a2739a9b82d5e92a8b6c
+        restart: unless-stopped
+        depends_on:
+            proxy:
+                condition: service_healthy
+        volumes_from:
+            - proxy
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+            - ${ULVIA_PROXY_ACME_DIR}:/etc/acme.sh
+        environment:
+            DEFAULT_EMAIL: ${ULVIA_ACME_EMAIL}
+        networks:
+            - instances

package/dist/definitions/services.yml

@@ -0,0 +1,177 @@
+services:
+    proxy:
+        image: nginxproxy/nginx-proxy:1.11.5@sha256:e06db5fb9586234e9c2bdef707c8b8d784caa4fb49fbe7285eb3730a501c3eaa
+        restart: unless-stopped
+        ports:
+            - "${ULVIA_BIND_ADDRESS}:${ULVIA_HTTP_PORT}:80"
+        volumes:
+            - /var/run/docker.sock:/tmp/docker.sock:ro
+            - ./nginx/client_max_body.conf:/etc/nginx/conf.d/zzz_client_max_body.conf:ro
+            - ./nginx/capability_cache.conf:/etc/nginx/conf.d/zzz_capability_cache.conf:ro
+            - ./nginx/query_safe_access_log.conf:/etc/nginx/conf.d/zzz_query_safe_access_log.conf:ro
+            - ./nginx/default_location:/etc/nginx/vhost.d/default_location:ro
+            - ${ULVIA_PROXY_CERTIFICATES_DIR}:/etc/nginx/certs
+            - ${ULVIA_PROXY_VHOST_DIR}:/etc/nginx/vhost.d
+            - ${ULVIA_PROXY_CHALLENGE_DIR}:/usr/share/nginx/html
+            - ${ULVIA_PROXY_ACME_DIR}:/etc/acme.sh
+            - proxy-cache:/var/cache/nginx
+        networks:
+            - instances
+        healthcheck:
+            test: ["CMD", "nginx", "-t"]
+            interval: 30s
+            timeout: 5s
+            retries: 3
+            start_period: 5s
+
+    mongo:
+        image: mongo:7.0.37@sha256:d5b3ca8c3f3cdce78d44870dc0871b76d5235e9b2ad4ea6bea5d1fbff8027703
+        restart: unless-stopped
+        user: "${ULVIA_UID}:${ULVIA_GID}"
+        environment:
+            MONGO_INITDB_ROOT_USERNAME: ${ULVIA_MONGO_USERNAME}
+            MONGO_INITDB_ROOT_PASSWORD: ${ULVIA_MONGO_PASSWORD}
+        volumes:
+            - type: bind
+              source: ${ULVIA_MONGO_DIR}
+              target: /data/db
+        networks:
+            - private
+        healthcheck:
+            test:
+                [
+                    "CMD-SHELL",
+                    "mongosh --quiet --username \"$$MONGO_INITDB_ROOT_USERNAME\" --password \"$$MONGO_INITDB_ROOT_PASSWORD\" --authenticationDatabase admin --eval 'quit(db.adminCommand({ ping: 1 }).ok ? 0 : 1)'",
+                ]
+            interval: 30s
+            timeout: 5s
+            retries: 3
+            start_period: 10s
+        stop_grace_period: 30s
+
+    repository:
+        image: ${OFFICIAL_REPOSITORY_IMAGE}
+        restart: unless-stopped
+        init: true
+        user: "${ULVIA_UID}:${ULVIA_GID}"
+        environment:
+            MODE: PROD
+            NODE_ENV: production
+            REPOSITORY_HOST: 0.0.0.0
+            REPOSITORY_PORT: "3000"
+            ULVIA_LOG_FILE: /var/log/ulvia/repository.ndjson
+            ULVIA_REPOSITORY_DIR: /var/lib/ulvia-repository
+            ULVIA_REPOSITORY_SEED_DIR: /opt/ulvia-repository-seed
+            ULVIA_REPOSITORY_TOKEN: ${ULVIA_REPOSITORY_TOKEN}
+        volumes:
+            - type: bind
+              source: ${ULVIA_REPOSITORY_DIR}
+              target: /var/lib/ulvia-repository
+            - type: bind
+              source: ${ULVIA_LOGS_DIR}
+              target: /var/log/ulvia
+        ports:
+            - "127.0.0.1:${ULVIA_REPOSITORY_PORT}:3000"
+        networks:
+            - private
+        read_only: true
+        tmpfs:
+            - /tmp:rw,nosuid,nodev,noexec,size=64m
+        cap_drop: [ALL]
+        security_opt: [no-new-privileges:true]
+        healthcheck:
+            test: ["CMD", "bun", "-e", "const r=await fetch('http://127.0.0.1:3000/readyz'); if(!r.ok) process.exit(1); await r.body?.cancel()"]
+            interval: 30s
+            timeout: 5s
+            retries: 3
+            start_period: 5s
+
+    mongo-provision:
+        image: mongo:7.0.37@sha256:d5b3ca8c3f3cdce78d44870dc0871b76d5235e9b2ad4ea6bea5d1fbff8027703
+        restart: "no"
+        environment:
+            MONGO_INITDB_ROOT_USERNAME: ${ULVIA_MONGO_USERNAME}
+            MONGO_INITDB_ROOT_PASSWORD: ${ULVIA_MONGO_PASSWORD}
+            MONGO_PROVIDER_USERNAME: ${ULVIA_MONGO_PROVIDER_USERNAME}
+            MONGO_PROVIDER_PASSWORD: ${ULVIA_MONGO_PROVIDER_PASSWORD}
+        entrypoint: ["/bin/sh", "-c"]
+        command:
+            - >-
+                exec mongosh --quiet --host mongo
+                --username "$$MONGO_INITDB_ROOT_USERNAME"
+                --password "$$MONGO_INITDB_ROOT_PASSWORD"
+                --authenticationDatabase admin
+                /opt/ulvia-mongo/provision-provider.js
+        volumes:
+            - ./mongo/provision-provider.js:/opt/ulvia-mongo/provision-provider.js:ro
+        networks:
+            - private
+        depends_on:
+            mongo:
+                condition: service_healthy
+        read_only: true
+        tmpfs:
+            - /tmp:rw,nosuid,nodev,noexec,size=32m
+        cap_drop: [ALL]
+        security_opt: [no-new-privileges:true]
+
+    provider:
+        image: ${PROVIDER_IMAGE}
+        restart: unless-stopped
+        init: true
+        user: "${ULVIA_UID}:${ULVIA_GID}"
+        environment:
+            MODE: PROD
+            NODE_ENV: production
+            CMS_FILES_DIR: /var/lib/cms/files
+            CMS_REPOSITORY_URL: http://repository:3000
+            CMS_REPOSITORY_ALLOW_INSECURE_HTTP: "true"
+            CMS_SESSION_SECRET: ${ULVIA_PROVIDER_SESSION_SECRET}
+            CMS_KEK_HEX: ${ULVIA_PROVIDER_KEK_HEX}
+            MONGO_URL: mongodb://${ULVIA_MONGO_PROVIDER_USERNAME}:${ULVIA_MONGO_PROVIDER_PASSWORD}@mongo:27017/ulvia_provider_control?authSource=admin&retryWrites=false
+            ULVIA_LOG_FILE: /var/log/ulvia/provider.ndjson
+            ULVIA_PROVIDER_HOST: 0.0.0.0
+            ULVIA_PROVIDER_PORT: "5103"
+            ULVIA_PROVIDER_PUBLIC_URL: http://ulvia-provider:5103
+            ULVIA_PROVIDER_OPERATOR_TOKEN: ${ULVIA_PROVIDER_OPERATOR_TOKEN}
+        volumes:
+            - type: bind
+              source: ${ULVIA_FILES_DIR}
+              target: /var/lib/cms/files
+            - type: bind
+              source: ${ULVIA_LOGS_DIR}
+              target: /var/log/ulvia
+        ports:
+            - "127.0.0.1:${ULVIA_PROVIDER_PORT}:5103"
+        networks:
+            private: {}
+            instances:
+                aliases:
+                    - ulvia-provider
+        depends_on:
+            mongo-provision:
+                condition: service_completed_successfully
+            repository:
+                condition: service_healthy
+        read_only: true
+        tmpfs:
+            - /tmp:rw,nosuid,nodev,noexec,size=256m
+        cap_drop: [ALL]
+        security_opt: [no-new-privileges:true]
+        healthcheck:
+            test: ["CMD", "bun", "-e", "const r=await fetch('http://127.0.0.1:5103/ulvia/operator/instances',{headers:{authorization:'Bearer '+process.env.ULVIA_PROVIDER_OPERATOR_TOKEN}}); if(!r.ok) process.exit(1); await r.body?.cancel()"]
+            interval: 30s
+            timeout: 5s
+            retries: 3
+            start_period: 10s
+        stop_grace_period: 30s
+
+networks:
+    private:
+        name: ${ULVIA_PRIVATE_NETWORK}
+        internal: true
+    instances:
+        name: ${ULVIA_INSTANCE_NETWORK}
+
+volumes:
+    proxy-cache: