@cyaxis/ulvia 0.0.0-stage → 0.0.2

package/INSTALLATION.md

@@ -0,0 +1,182 @@
+# Install Ulvia
+
+This guide installs the Ulvia CLI and creates a first CMS instance on Ubuntu.
+It is for operators and site owners; workspace contributors should use the
+[development guide](../development/README.md).
+
+> **Prerelease availability:** `@cyaxis/ulvia` is the official release package.
+> Prereleases use the npm `next` tag; stable releases use `latest`.
+
+## 1. Prerequisites On Ubuntu
+
+Ulvia requires a supported Ubuntu host, Docker Engine with the Docker Compose
+plugin, and Bun. Follow the upstream instructions rather than copying an
+unversioned third-party installation script:
+
+- [Install Docker Engine on Ubuntu](https://docs.docker.com/engine/install/ubuntu/)
+- [Install the Docker Compose plugin on Linux](https://docs.docker.com/compose/install/linux/)
+- [Run Docker without `sudo` and configure startup](https://docs.docker.com/engine/install/linux-postinstall/)
+- [Install Bun on Linux](https://bun.com/docs/installation)
+
+Docker's Ubuntu packages include the Compose plugin when
+`docker-compose-plugin` is installed. Verify the complete toolchain:
+
+```bash
+docker version
+docker compose version
+bun --version
+```
+
+The current release toolchain targets Bun 1.4.2 or newer. Docker must be running
+and accessible to the account that executes `ulvia`.
+
+## 2. Install The CLI
+
+Install the current prerelease globally from the public npm registry:
+
+```bash
+bun add --global @cyaxis/ulvia@next
+ulvia --help
+```
+
+If `ulvia` is not found, reopen the terminal and check that `~/.bun/bin` is in
+`PATH`, as described by the Bun installation guide.
+
+## 3. Create A Local Site
+
+Start the shared infrastructure, then create one named instance:
+
+```bash
+ulvia services start
+ulvia instance create my-site --label "My site"
+ulvia instance credentials my-site
+```
+
+The first start uses the exact software version bundled into the installed CLI.
+To bootstrap a different exact prerelease explicitly, use
+`ulvia services start --version 0.0.1-beta`. This option never upgrades an
+existing installation.
+
+The site is available at `http://my-site.localhost:5100`. The credentials
+command prints the initial administrator email and password. It never prints
+the Provider, Repository, encryption, or instance service secrets.
+
+Ulvia deliberately separates shared services from sites:
+
+| Command | Responsibility |
+| --- | --- |
+| `ulvia services start` | Starts the proxy, MongoDB, Official Repository, and Provider. |
+| `ulvia instance create <name>` | Provisions one Provider tenant and starts its Kernel. |
+| `ulvia instance start <name>` | Restarts an existing instance without provisioning it again. |
+| `ulvia start` | Starts shared services and every existing instance; it creates nothing. |
+
+List and inspect the installation at any time:
+
+```bash
+ulvia services status
+ulvia instance list
+ulvia instance status my-site
+```
+
+Persistent data lives below `$XDG_DATA_HOME/ulvia` or
+`~/.local/share/ulvia`. Commands can be run from any working directory.
+
+## 4. Daily Operations
+
+```bash
+ulvia start
+ulvia instance stop my-site
+ulvia instance start my-site
+ulvia services logs all --level warn
+ulvia instance logs my-site kernel
+ulvia services stop
+```
+
+Stopping containers preserves persistent data. `services stop` also makes every
+site unavailable because Kernels depend on the shared Provider and proxy.
+
+## 5. Upgrade Ulvia
+
+Upgrade the host CLI through Bun:
+
+```bash
+bun update --global @cyaxis/ulvia
+```
+
+Upgrade deployable components independently with exact versions:
+
+```bash
+ulvia upgrade kernel --version 0.0.1-beta
+ulvia upgrade provider --version 0.0.1-beta
+ulvia upgrade repository --version 0.0.1-beta
+```
+
+Ulvia resolves each official Docker Hub tag to an immutable digest and reuses
+that digest on subsequent starts. Registry channels such as `next` or `latest`
+may identify releases for humans, but an installation never persists or
+silently follows those mutable tags.
+
+## 6. Public Domain And HTTPS
+
+Configure public networking before creating the first instance because the
+canonical Kernel URLs become part of Provider provisioning:
+
+```bash
+ulvia configure network \
+  --bind 0.0.0.0 \
+  --http-port 80 \
+  --tls acme \
+  --https-port 443 \
+  --acme-email ops@example.com
+
+ulvia services start
+ulvia instance create website --domain example.com
+ulvia instance credentials website
+```
+
+Before starting, point the domain's DNS records to the host and allow inbound
+TCP traffic on ports 80 and 443. Review Docker's documented firewall behavior:
+published container ports can bypass some `ufw` and `firewalld` rules unless
+the host policy uses Docker's supported chains.
+
+Repository and Provider management endpoints remain bound to loopback. Only the
+shared proxy is exposed publicly.
+
+## 7. Backup, Reset, And Removal
+
+Stop the installation before taking a filesystem-level backup of the Ulvia data
+directory. Preserve the complete directory, including MongoDB, files,
+credentials, encryption material, Repository state, and instance definitions.
+Do not restore only selected secret or database files from different snapshots.
+
+`reset` permanently removes Ulvia-owned local state:
+
+```bash
+ulvia reset --yes
+```
+
+Remove the CLI separately after stopping or resetting the installation:
+
+```bash
+bun remove --global @cyaxis/ulvia
+```
+
+Removing the CLI alone does not delete persistent CMS data or Docker resources.
+
+## 8. Troubleshooting
+
+- **Docker permission denied:** complete Docker's Linux post-installation steps,
+  then start a new login session.
+- **`docker compose` is unknown:** install the official Compose plugin rather
+  than the retired standalone `docker-compose` package.
+- **Port 5100, 80, or 443 is occupied:** inspect the owner before changing the
+  persisted network configuration.
+- **An image cannot be pulled:** verify network access and that the requested
+  exact Cyaxis image version has been published.
+- **An instance returns 503:** check `ulvia services status`, then the Provider
+  and instance Kernel logs.
+- **Stored encrypted data cannot be opened:** do not generate replacement keys
+  over an existing data directory; restore the matching complete backup.
+
+For implementation diagnostics and contributor-only environment overrides, see
+the [development and validation guide](../development/README.md).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 matthias-bernouy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,240 @@
-# Temporary Holding Version
+# Ulvia CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Ulvia installation and release CLI.
+
+For the operator journey from a fresh Ubuntu host to a running local or public
+site, follow the [canonical installation guide](INSTALLATION.md).
+
+The workspace package contains private source code. Official releases are
+bundled without workspace dependencies and published publicly as
+`@cyaxis/ulvia`:
+
+```bash
+bun add --global @cyaxis/ulvia@next
+ulvia --help
+```
+
+From the workspace, build and publish one exact release with:
+
+```bash
+bun run cli:build --version 0.0.1-beta
+bun run cli:publish --version 0.0.1-beta
+```
+
+The build creates a checked npm archive and SHA-256 receipt below
+`artifacts/cli`. Publishing accepts only that exact pair, targets the public npm
+registry, and uses the `next` tag for prereleases or `latest` for stable versions.
+It requires npm credentials configured outside the repository.
+
+```bash
+bun run ulvia -- start
+bun run ulvia -- configure network
+bun run ulvia -- services status
+bun run ulvia -- instance create preview --label "Preview site"
+bun run ulvia -- instance list
+bun run ulvia -- instance credentials preview
+bun run ulvia -- instance stop preview
+bun run ulvia -- instance delete preview --yes
+bun run ulvia -- services stop
+bun run ulvia -- upgrade kernel --version 0.0.1-beta
+bun run ulvia -- upgrade provider --version 0.0.1-beta
+bun run ulvia -- upgrade repository --version 0.0.1-beta
+bun run ulvia -- reset --yes
+bun run ulvia -- release packages/official-repository/collections/ulvia-official
+bun run ulvia -- release /path/to/contract-directory
+bun run ulvia -- release /path/to/provider-directory
+bun run ulvia -- push contract ulvia.official/ulvia.cms.installations@1.0.0 --repository https://repository.example
+bun run ulvia -- pull collection ulvia.official/ulvia-official@1.0.0 --repository https://repository.example
+bun run ulvia -- yank collection ulvia.official/ulvia-official@1.0.0 --repository https://repository.example --reason "Superseded"
+bun run ulvia -- restore collection ulvia.official/ulvia-official@1.0.0 --repository https://repository.example
+bun run ulvia -- prune
+```
+
+The lifecycle commands manage the same Docker Compose projects for loopback and
+public installations from any directory. Persistent
+data lives below `$XDG_DATA_HOME/ulvia` or `~/.local/share/ulvia`;
+`ULVIA_DATA_DIR` remains an explicit isolation override for tests and CI. The
+CLI stores authored releases in `<data>/repository`. Shared Provider, Repository,
+MongoDB, proxy, files, secrets and logs live below `<data>/services`; each
+stateless Kernel has independent state and logs below `<data>/instances/<name>`.
+The CLI never starts application servers, supervises their PIDs, or builds
+software images. It pulls only the canonical public images under
+`docker.io/cyaxis`, validates their Ulvia component and stack-API labels, and
+stores the immutable repository digest selected for each component.
+
+The first lifecycle command creates a safe installation configuration bound to
+`127.0.0.1:5100`. Configure public exposure before creating an instance:
+
+```bash
+ulvia configure network \
+  --bind 0.0.0.0 \
+  --http-port 80 \
+  --tls acme \
+  --https-port 443 \
+  --acme-email ops@example.com
+ulvia start
+ulvia instance create website --domain example.com
+```
+
+The configuration is persisted under `<data>/services/installation.json` and
+is not a per-start mode. ACME requires `0.0.0.0` and every instance in an ACME
+installation requires an explicit DNS domain. Network configuration is locked
+after the first instance because its canonical Kernel URL is part of Provider
+provisioning. Repository and Provider management ports remain loopback-only.
+
+`services start` starts only the shared proxy, MongoDB, Repository and Provider.
+On first initialization it uses the exact version embedded by `cli:build`, or
+an explicit `services start --version <version>` override. Later starts reuse
+the persisted digests and reject a conflicting `--version`; component changes
+must go through `upgrade`.
+`instance create` provisions one isolated Provider tenant and immediately starts
+its dedicated Kernel. `instance start` restarts only an already-provisioned
+instance's Kernel. All Kernels use the shared proxy port: an instance named
+`default` is available at `http://localhost:5100`, while any other instance such
+as `preview` uses `http://preview.localhost:5100`.
+`ULVIA_HTTP_PORT`, `ULVIA_REPOSITORY_PORT`, and `ULVIA_PROVIDER_PORT` provide
+initial isolation defaults for tests and CI. Interactive configuration belongs
+to `ulvia configure network`. The Provider still listens on its canonical port
+5103 inside the private Docker network; only its operator port on the host
+changes.
+`start` is the idempotent convenience command for shared services plus every
+previously created local instance; it never creates an implicit instance.
+
+The lifecycle boundary is deliberate:
+
+| Command | Provider tenant | Kernel container |
+| --- | --- | --- |
+| `services start` | Does not create one | Does not start one |
+| `instance create <name>` | Provisions one durable tenant | Creates and starts its Kernel |
+| `instance start <name>` | Reuses the existing tenant | Starts only that Kernel |
+| `start` | Never provisions | Starts every existing Kernel after shared services |
+
+`instance credentials <name>` prints only that administrator's email and
+password. Repository, Provider operator and instance bearer tokens remain in
+private runtime files. Shared services and every instance have independent
+`stop`, `status`, and `logs` boundaries. Software upgrades are explicit and
+component-scoped through `upgrade <component> --version <exact-version>`.
+Normal starts always reuse the installed digest and never follow a newer tag.
+`reset --yes`
+removes every Compose project, instance, shared state and repository
+release. It does not inspect or modify the current working directory.
+`release <resource-directory>` reads `definition.json` and routes by `kind`:
+`collection`, `contract`, or `provider-manifest`. It validates and stores one
+immutable release. A provider manifest must reference exact contract releases
+already in the local repository. Release does not connect to or test a provider.
+Contract fixture assets declared in `definition.json` are read from
+`fixtures/<asset-id>` and verified by digest. Releasing the same coordinate with
+different content fails. The local Repository serves stored resources
+at `/v1/collections`, `/v1/contracts`, and `/v1/providers` on loopback port
+5102, with declared contract fixtures at
+`/v1/contracts/<publisher>/<contract>/<version>/fixtures/<asset-id>`, and sees
+new releases without restarting. The CMS consumes the collection and provider
+repository endpoints. The Provider administration Page imports an exact
+manifest, approves an account connection and replaces the site's exact contract
+selections for Gateway calls. `prune` empties all local repository content
+without deleting service or instance data.
+
+Contract authors may keep only release metadata in `definition.json` and split
+capabilities recursively below `capabilities/`. Each capability is one JSON
+object. Optional `mocks/**/*.json` fragments contain one mock plus its explicit
+`capabilityId`; mocks embedded in capability fragments reject. The compiler
+sorts capabilities and mocks by their declared IDs, so paths never affect the
+immutable digest. `definition.json` cannot contain an inline `capabilities`
+array: the recursive source tree is the only authored contract format.
+
+An optional conformance companion uses `conformance/definition.json`, recursive
+`conformance/scenarios/**/*.json` scenario objects and recursive
+`conformance/exemptions/**/*.json` coverage-exemption objects. Optional suite
+fixture bytes live below `conformance/fixtures/<asset-id>`. The release command
+assembles and admits a present suite, including exact locally released
+dependencies, before storing the contract. Conformance publication and live
+execution are separate Gateway/repository APIs; the CLI does not yet orchestrate
+a disposable provider environment.
+
+`push` publishes one exact local coordinate, and `pull` downloads and re-admits
+one exact remote coordinate before storing it locally. Both support
+`collection`, `contract`, and `provider`; dependencies must be transferred
+first. `ULVIA_REPOSITORY_URL` can replace `--repository`.
+Repository writes require `ULVIA_REPOSITORY_TOKEN`; the token is never accepted
+as a command-line argument. Every mutation carries a timestamp, one-time nonce,
+body digest, and HMAC-SHA-256 signature. The server rejects stale or replayed
+requests, serializes writes across processes, re-runs admission and evolution
+rules, and stages every declared asset as a separately signed raw stream. A final
+idempotent commit makes the immutable artifact visible only after all byte lengths
+and SHA-256 digests pass. Interrupted and rejected sessions never expose a partial
+release. An exact republish is idempotent; different bytes at an existing coordinate
+reject.
+
+The protocol, exact-coordinate client and mutation endpoint live in
+`@bernouy/cms-repository/repository/publication`; the CLI only composes them with
+the reference filesystem adapter and its loopback listener. The filesystem
+composition persists upload sessions and replay claims below the repository root.
+A production repository can replace those ports without depending on this
+executable package.
+
+`yank` is reversible catalogue metadata: it hides a release from new catalogue
+resolution without deleting its exact historical bytes. `restore` exposes it
+again. Contract yanks block new dependent publications while previously
+published provider manifests remain readable. The loopback Repository uses the
+same write protocol and keeps its generated repository token in the private
+runtime directory. The removed integration repository/Supabase bridge is not
+run.
+
+A collection keeps immutable administration copy in recursive locale
+directories such as `translations/en/collection.json` and
+`translations/en/theme/colors.json`. Every JSON object below
+`translations/<locale>/` contributes to that locale's flat catalogue.
+Collection, Bloc, setting, text, theme and Page metadata stores
+reusable keys from those catalogues rather than inline labels. A key may occur
+in only one fragment per locale. The collection locale must define every
+referenced key; additional locale directories may be partial and fall back to
+it.
+
+A collection theme is authored as an ordered set of files. Its
+`theme/definition.json` contains the theme label key and the ordered list of
+category IDs. Category files may be organized recursively below `theme/`; the
+scanner finds them by their internal `id`, while the manifest remains the only
+source of display order. A category filename must match its ID, duplicate IDs
+and orphan files reject, and category/token metadata uses the shared translation
+keys. Categories use an `entries` array containing ordinary tokens and optional
+typed `font-face` entries backed by local WOFF2 assets.
+
+Collection assets are discovered recursively below `assets/`; their lowercase
+relative paths are their stable IDs. They are not declared in the collection
+`definition.json`. An optional root `assets/definition.json` accepts only a
+`generations` object keyed by those paths. The compiler derives media type,
+size and digest. Safe presentation-only SVG files receive the `inline-svg`
+profile automatically; other SVGs remain downloadable assets but cannot be
+expanded into authored Page DOM.
+
+Collection texts use recursive `texts/definitions/**/*.json` arrays for stable
+IDs and administration metadata, plus recursive
+`texts/locales/<locale>/**/*.json` objects for content values. The release
+command joins them into ordinary collection text records. Paths never prefix a
+text ID; duplicate definitions, duplicate per-locale values and unknown value
+IDs reject.
+
+Bloc roots are discovered recursively below `blocs/`. A folder becomes a Bloc
+when it contains `definition.json`, its basename must match the declared Bloc
+ID, and discovery stops there so `settings/definition.json` is never mistaken
+for a nested Bloc. Intermediate grouping directories contain only directories
+and do not affect release identity.
+
+The Official Repository image contains the admitted CMS contracts, provider
+manifest, and administration collection. It installs that snapshot only into
+empty persistent storage. To publish the same resources manually, release the
+CMS contracts before the manifest:
+
+```bash
+bun run ulvia -- release packages/official-repository/contracts/ulvia.cms.access
+bun run ulvia -- release packages/official-repository/contracts/ulvia.cms.installations
+bun run ulvia -- release packages/official-repository/contracts/ulvia.cms.content
+bun run ulvia -- release packages/official-repository/contracts/ulvia.cms.files
+bun run ulvia -- release packages/official-repository/contracts/ulvia.provider.cms-instances
+bun run ulvia -- release packages/official-repository/providers/ulvia.official
+bun run ulvia -- start
+```
+
+`instance create` provisions the named instance through the Provider operator
+API, then starts its Kernel. Connection review validates the runtime report and
+exact manifest claims; it does not yet execute a live conformance suite.

package/dist/definitions/kernel-tls.yml

@@ -0,0 +1,5 @@
+services:
+    kernel:
+        environment:
+            ACME_HOST: ${ULVIA_INSTANCE_HOSTNAME}
+            LETSENCRYPT_HOST: ${ULVIA_INSTANCE_HOSTNAME}

package/dist/definitions/kernel.yml

@@ -0,0 +1,40 @@
+services:
+    kernel:
+        image: ${KERNEL_IMAGE}
+        restart: unless-stopped
+        init: true
+        user: "${ULVIA_UID}:${ULVIA_GID}"
+        environment:
+            MODE: PROD
+            NODE_ENV: production
+            KERNEL_HOST: 0.0.0.0
+            KERNEL_PORT: "3000"
+            KERNEL_PUBLIC_URL: ${ULVIA_INSTANCE_URL}
+            CMS_INSTALLATIONS_PROVIDER_URL: http://ulvia-provider:5103
+            CMS_INSTALLATIONS_PROVIDER_TOKEN: ${CMS_INSTALLATIONS_PROVIDER_TOKEN}
+            ULVIA_LOG_FILE: /var/log/ulvia/kernel.ndjson
+            VIRTUAL_HOST: ${ULVIA_INSTANCE_HOSTNAME}
+            VIRTUAL_PORT: "3000"
+        volumes:
+            - type: bind
+              source: ${ULVIA_LOGS_DIR}
+              target: /var/log/ulvia
+        networks:
+            - instances
+        read_only: true
+        tmpfs:
+            - /tmp:rw,nosuid,nodev,noexec,size=256m
+        cap_drop: [ALL]
+        security_opt: [no-new-privileges:true]
+        healthcheck:
+            test: ["CMD", "bun", "-e", "const r=await fetch('http://127.0.0.1:3000/readyz'); if(!r.ok) process.exit(1); await r.body?.cancel()"]
+            interval: 30s
+            timeout: 5s
+            retries: 3
+            start_period: 10s
+        stop_grace_period: 30s
+
+networks:
+    instances:
+        external: true
+        name: ${ULVIA_INSTANCE_NETWORK}

package/dist/definitions/mongo/provision-provider.js

@@ -0,0 +1,21 @@
+const environment = { ...process.env };
+
+function required(name) {
+    const value = String(environment[name] ?? "").trim();
+    if (!value) {
+        throw new Error(`Missing ${name}`);
+    }
+    return value;
+}
+
+const username = required("MONGO_PROVIDER_USERNAME");
+const password = required("MONGO_PROVIDER_PASSWORD");
+const admin = db.getSiblingDB("admin");
+const existing = admin.getUser(username);
+const roles = [{ role: "readWriteAnyDatabase", db: "admin" }];
+
+if (existing) {
+    admin.updateUser(username, { pwd: password, roles });
+} else {
+    admin.createUser({ user: username, pwd: password, roles });
+}

package/dist/definitions/nginx/capability_cache.conf

@@ -0,0 +1,13 @@
+# Cache only generic capability routes. Provider Cache-Control headers remain
+# authoritative, so private and no-store responses are never retained.
+proxy_cache_path /var/cache/nginx/cms levels=1:2 keys_zone=cms_capabilities:16m max_size=1g inactive=1h use_temp_path=off;
+
+map $uri $cms_skip_capability_cache {
+    default 1;
+    ~^/(?:[^/]+/)*\.cms/call/ 0;
+}
+
+map $request_method $cms_cache_method {
+    default $request_method;
+    HEAD GET;
+}

package/dist/definitions/nginx/client_max_body.conf

@@ -0,0 +1,2 @@
+# The application accepts 100 MiB files plus at most 1 MiB of multipart framing.
+client_max_body_size 101m;

package/dist/definitions/nginx/default_location

@@ -0,0 +1,8 @@
+# Included inside every generated proxy location by nginx-proxy.
+proxy_cache cms_capabilities;
+proxy_cache_methods GET HEAD;
+proxy_cache_key "$scheme|$cms_cache_method|$host|$uri|$is_args$args";
+proxy_cache_bypass $cms_skip_capability_cache $http_authorization;
+proxy_no_cache $cms_skip_capability_cache $http_authorization;
+proxy_cache_valid 200 206 1h;
+add_header X-Cache-Status $upstream_cache_status always;

package/dist/definitions/nginx/query_safe_access_log.conf

@@ -0,0 +1,4 @@
+# Never record query strings. Signed file access tokens are carried in queries.
+log_format cms_query_safe '$remote_addr - $remote_user [$time_local] "$request_method $uri $server_protocol" '
+                          '$status $body_bytes_sent "$http_referer" "$http_user_agent"';
+access_log /var/log/nginx/access.log cms_query_safe;

package/dist/definitions/services-tls.yml

@@ -0,0 +1,20 @@
+services:
+    proxy:
+        ports:
+            - "${ULVIA_BIND_ADDRESS}:${ULVIA_HTTPS_PORT}:443"
+
+    acme:
+        image: nginxproxy/acme-companion:2.8.1@sha256:ccfceb9798b9f6586d47eeeadbb8e185c8897b34e011a2739a9b82d5e92a8b6c
+        restart: unless-stopped
+        depends_on:
+            proxy:
+                condition: service_healthy
+        volumes_from:
+            - proxy
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+            - ${ULVIA_PROXY_ACME_DIR}:/etc/acme.sh
+        environment:
+            DEFAULT_EMAIL: ${ULVIA_ACME_EMAIL}
+        networks:
+            - instances