@underpostnet/cyberia 3.2.80 → 3.2.90

package/src/runtime/engine-cyberia/docker-compose.yml

@@ -8,20 +8,20 @@
 #   engine-private/conf/dd-cyberia/docker-compose/cyberia/
 #     ├── docker-compose.yml     (this file — the ENTIRE stack, single source)
 #     ├── compose.env            (working env-file, used as-is — not generated)
-#     ├── nginx.conf             (GENERATED: per-variant sub-path routing)
-#     └── mongodb/entrypoint.sh  (GENERATED infra: replica-set bootstrap)
+#     ├── nginx.conf             (custom per-variant sub-path routing)
+#     └── mongodb/entrypoint.sh  (replica-set bootstrap)
 # All bind mounts below are relative to this directory: the CLI runs compose with
 # `--project-directory` pinned here (see src/cli/docker-compose.js).
 #
 # Multi-instance: one engine-cyberia (content + asset authority) feeds three
 # cyberia-server + three cyberia-client tiers, one per conf.instances.json
 # multiInstance variant (amethyst-strata-expansion "/", FOREST "/FOREST",
-# TEST "/TEST"). nginx.conf routes each host sub-path to its tier and is
-# generated from that same topology; keep the services below in sync with it.
+# TEST "/TEST"). This custom workflow owns nginx.conf and the services below;
+# keep both in sync when its instance topology changes.
 #
-# Startup is a strict health-gated chain — each tier waits for the previous to
-# be healthy:
-#   mongodb + valkey  ->  engine-cyberia  ->  3x cyberia-server  ->  3x cyberia-client  ->  proxy
+# Startup is a strict health-gated chain: the stable gateway starts after the
+# engine, then each server/client pipeline advances independently:
+#   mongodb + valkey -> engine runtime -> proxy -> 3x server -> 3x client
 #
 # Architecture boundaries (see CLAUDE.md "Cyberia architecture boundaries"):
 #   engine-cyberia  — content, validation, persistence, gRPC(:50051)+REST(:4005)
@@ -42,8 +42,8 @@ services:
 
   # --- MongoDB -------------------------------------------------------------
   # replSet rs0, keyFile cluster auth, replica-set + root-user init over the
-  # loopback localhost exception. Uses ./mongodb/entrypoint.sh, generated into
-  # this dir by `underpost docker-compose --generate --docker-compose-id cyberia`.
+  # loopback localhost exception. This custom workflow owns the mounted
+  # ./mongodb/entrypoint.sh bootstrap script.
   mongodb:
     image: ${MONGO_IMAGE:-mongo:latest}
     container_name: dd-cyberia-mongodb
@@ -164,8 +164,8 @@ services:
   # variant that has local content (amethyst + FOREST; TEST has none yet, so its
   # server starts but rejects connections until seeded). Serves REST/WS on 4005
   # and the engine gRPC data service on 50051.
-  engine-cyberia:
-    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.2.80}
+  engine-cyberia-runtime:
+    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.2.90}
     container_name: dd-cyberia-engine
     command:
       - /bin/sh
@@ -213,19 +213,21 @@ services:
     restart: unless-stopped
 
   # === Tier 3: authoritative simulation, one per variant ===================
-  # All three share engine-cyberia (content + gRPC) and differ only by
-  # INSTANCE_CODE — the world each loads. Each waits for engine-cyberia healthy.
-  # The default variant publishes host port 8081; the rest are internal-only
-  # (reached through nginx sub-path routing).
+  # All three share engine-cyberia (content + gRPC) and differ by INSTANCE_CODE
+  # and CYBERIA_BASE_PATH. Each server owns its public path and waits for the
+  # stable gateway, which itself waits for the engine runtime to be healthy.
+  # All variants are internal-only. The proxy publishes a dedicated server
+  # gateway on host port 8081, so one port can route every instance path.
 
-  cyberia-server:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.80}
+  cyberia-server-runtime:
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.90}
     container_name: dd-cyberia-server
     environment:
       INSTANCE_CODE: amethyst-strata-expansion
-      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia:4005}
+      CYBERIA_BASE_PATH: /
+      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia}
       ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
-      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia:50051}
+      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia-runtime:50051}
       ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
@@ -234,27 +236,26 @@ services:
       - dd-cyberia-internal
     expose:
       - '8081'
-    ports:
-      - '${CYBERIA_SERVER_PORT:-8081}:8081'
     healthcheck:
-      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/8081' || exit 1"]
+      test: ['CMD-SHELL', 'curl -fsS http://127.0.0.1:8081/api/v1/health/ready >/dev/null || exit 1']
       interval: 15s
       timeout: 5s
       retries: 5
       start_period: 30s
     depends_on:
-      engine-cyberia:
+      proxy:
         condition: service_healthy
     restart: unless-stopped
 
   cyberia-server-forest:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.80}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.90}
     container_name: dd-cyberia-server-forest
     environment:
       INSTANCE_CODE: FOREST
-      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia:4005}
+      CYBERIA_BASE_PATH: /FOREST
+      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia}
       ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
-      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia:50051}
+      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia-runtime:50051}
       ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
@@ -264,24 +265,25 @@ services:
     expose:
       - '8081'
     healthcheck:
-      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/8081' || exit 1"]
+      test: ['CMD-SHELL', 'curl -fsS http://127.0.0.1:8081/FOREST/api/v1/health/ready >/dev/null || exit 1']
       interval: 15s
       timeout: 5s
       retries: 5
       start_period: 30s
     depends_on:
-      engine-cyberia:
+      proxy:
         condition: service_healthy
     restart: unless-stopped
 
   cyberia-server-test:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.80}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.90}
     container_name: dd-cyberia-server-test
     environment:
       INSTANCE_CODE: TEST
-      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia:4005}
+      CYBERIA_BASE_PATH: /TEST
+      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia}
       ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
-      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia:50051}
+      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia-runtime:50051}
       ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
@@ -291,69 +293,68 @@ services:
     expose:
       - '8081'
     healthcheck:
-      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/8081' || exit 1"]
+      test: ['CMD-SHELL', 'curl -fsS http://127.0.0.1:8081/TEST/api/v1/health/ready >/dev/null || exit 1']
       interval: 15s
       timeout: 5s
       retries: 5
       start_period: 30s
     depends_on:
-      engine-cyberia:
+      proxy:
         condition: service_healthy
     restart: unless-stopped
 
   # === Tier 4: presentation, one per variant ===============================
   # One WASM bundle serves every variant; the instance is resolved from the URL
-  # sub-path (docker-driver injects CYBERIA_WS_ORIGIN / _ENGINE_API_ORIGIN /
-  # _DEFAULT_INSTANCE). Each client waits ONLY for its own server, so the three
+  # sub-path (docker-driver injects CYBERIA_BASE_PATH / _WS_ORIGIN /
+  # _ENGINE_API_ORIGIN / _DEFAULT_INSTANCE). Each client waits ONLY for its own
+  # server, so the three
   # server->client pipelines advance independently (in parallel) once the shared
   # engine-cyberia is healthy:
   #   cyberia-server        -> cyberia-client
   #   cyberia-server-forest -> cyberia-client-forest
   #   cyberia-server-test   -> cyberia-client-test
 
-  cyberia-client:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.80}
+  cyberia-client-runtime:
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.90}
     container_name: dd-cyberia-client
     environment:
       CYBERIA_PORT: '8081'
       CYBERIA_INSTANCE_CODE: amethyst-strata-expansion
       CYBERIA_BASE_PATH: /
       CYBERIA_DEFAULT_INSTANCE: ${CYBERIA_DEFAULT_INSTANCE:-amethyst-strata-expansion}
-      CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://server.cyberiaonline.com}
-      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://www.cyberiaonline.com}
+      CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://localhost:8081}
+      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://localhost}
     networks:
       - dd-cyberia-internal
     expose:
       - '8081'
-    ports:
-      - '${CYBERIA_CLIENT_PORT:-8082}:8081'
     healthcheck:
-      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/8081' || exit 1"]
+      test: ['CMD-SHELL', 'curl -fsS http://127.0.0.1:8081/ >/dev/null || exit 1']
       interval: 15s
       timeout: 5s
       retries: 5
       start_period: 20s
     depends_on:
-      cyberia-server:
+      cyberia-server-runtime:
         condition: service_healthy
     restart: unless-stopped
 
   cyberia-client-forest:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.80}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.90}
     container_name: dd-cyberia-client-forest
     environment:
       CYBERIA_PORT: '8081'
       CYBERIA_INSTANCE_CODE: FOREST
       CYBERIA_BASE_PATH: /FOREST
       CYBERIA_DEFAULT_INSTANCE: ${CYBERIA_DEFAULT_INSTANCE:-amethyst-strata-expansion}
-      CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://server.cyberiaonline.com}
-      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://www.cyberiaonline.com}
+      CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://localhost:8081}
+      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://localhost}
     networks:
       - dd-cyberia-internal
     expose:
       - '8081'
     healthcheck:
-      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/8081' || exit 1"]
+      test: ['CMD-SHELL', 'curl -fsS http://127.0.0.1:8081/FOREST/ >/dev/null || exit 1']
       interval: 15s
       timeout: 5s
       retries: 5
@@ -364,21 +365,21 @@ services:
     restart: unless-stopped
 
   cyberia-client-test:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.80}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.90}
     container_name: dd-cyberia-client-test
     environment:
       CYBERIA_PORT: '8081'
       CYBERIA_INSTANCE_CODE: TEST
       CYBERIA_BASE_PATH: /TEST
       CYBERIA_DEFAULT_INSTANCE: ${CYBERIA_DEFAULT_INSTANCE:-amethyst-strata-expansion}
-      CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://server.cyberiaonline.com}
-      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://www.cyberiaonline.com}
+      CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://localhost:8081}
+      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://localhost}
     networks:
       - dd-cyberia-internal
     expose:
       - '8081'
     healthcheck:
-      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/8081' || exit 1"]
+      test: ['CMD-SHELL', 'curl -fsS http://127.0.0.1:8081/TEST/ >/dev/null || exit 1']
       interval: 15s
       timeout: 5s
       retries: 5
@@ -388,31 +389,41 @@ services:
         condition: service_healthy
     restart: unless-stopped
 
-  # === Tier 5: reverse proxy (waits for all clients) =======================
-  # Routes the three cyberiaonline.com hosts to their per-variant upstreams with
-  # websocket upgrade. Config source of truth: ./nginx.conf (generated from the
-  # multiInstance topology). Fronts the stack only once every tier is healthy.
+  # === Stable HTTP gateway =================================================
+  # Routes stable Docker DNS names and localhost paths to their per-variant
+  # upstreams with websocket upgrade. Config source of truth: ./nginx.conf,
+  # maintained by this custom workflow. Ports 80 and 8082 serve the multi-path
+  # client gateway; port 8081 is the multi-path server gateway. It starts as
+  # soon as the engine is healthy so server startup can safely use the stable
+  # engine-cyberia HTTP alias. Client/server upstreams resolve lazily as their
+  # independently health-gated pipelines become available.
   proxy:
     image: ${PROXY_IMAGE:-nginx:stable-alpine}
     container_name: dd-cyberia-proxy
     volumes:
       - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
     networks:
-      - dd-cyberia-internal
+      dd-cyberia-internal:
+        aliases:
+          - cyberia-client
+          - cyberia-server
+          - engine-cyberia
     ports:
       - '${PROXY_HTTP_PORT:-80}:80'
+      - '${CYBERIA_SERVER_PORT:-8081}:8081'
+      - '${CYBERIA_CLIENT_PORT:-8082}:80'
     healthcheck:
-      test: ['CMD', 'wget', '-q', '-O', '-', 'http://127.0.0.1/healthz']
+      test:
+        - CMD-SHELL
+        - >-
+          wget -q -O /dev/null http://127.0.0.1/healthz &&
+          wget -q -O /dev/null http://127.0.0.1:8081/healthz
       interval: 15s
       timeout: 5s
       retries: 5
       start_period: 10s
     depends_on:
-      cyberia-client:
-        condition: service_healthy
-      cyberia-client-forest:
-        condition: service_healthy
-      cyberia-client-test:
+      engine-cyberia-runtime:
         condition: service_healthy
     restart: unless-stopped
 

package/src/runtime/engine-cyberia/nginx.conf

@@ -1,8 +1,9 @@
-# Generated by 'underpost docker-compose --generate --deploy-id dd-cyberia --docker-compose-id cyberia' — do not hand-edit.
-# Source of truth: engine-private/conf/dd-cyberia/conf.instances.json (multiInstance).
-# Single localhost gateway (dev compose). Access http://localhost/ (default),
-# http://localhost/<PATH> per variant. Client origins point back here
-# (compose.env CYBERIA_WS_ORIGIN=ws://localhost, CYBERIA_ENGINE_API_ORIGIN=http://localhost).
+# Canonical routing for the dd-cyberia custom Compose workflow. This file is
+# maintained here and is used as-is by the generic Docker Compose CLI.
+# Docker DNS: http://cyberia-client, http://cyberia-server, http://engine-cyberia.
+# Host access: client on http://localhost[:8082]/<PATH>, server on
+# http://localhost:8081/<PATH>, and engine on http://localhost:4005.
+# Optional *.cyberia.localhost aliases remain available.
 
 map $http_upgrade $connection_upgrade {
     default upgrade;
@@ -17,7 +18,7 @@ proxy_http_version 1.1;
 
 server {
     listen 80 default_server;
-    server_name localhost 127.0.0.1 _;
+    server_name localhost 127.0.0.1 cyberia-client cyberia.localhost client.cyberia.localhost _;
 
         location = /healthz {
             access_log off;
@@ -27,7 +28,7 @@ server {
 
         # Shared content authority: REST API + engine-served assets (fonts, ui-icons).
         location /api/ {
-            set $up_engine engine-cyberia:4005;
+            set $up_engine engine-cyberia-runtime:4005;
             proxy_pass http://$up_engine;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -39,7 +40,7 @@ server {
         }
 
         location /assets/ {
-            set $up_engine engine-cyberia:4005;
+            set $up_engine engine-cyberia-runtime:4005;
             proxy_pass http://$up_engine;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -51,7 +52,7 @@ server {
         }
 
         location = /ws {
-            set $up_server_default cyberia-server:8081;
+            set $up_server_default cyberia-server-runtime:8081;
             proxy_pass http://$up_server_default;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -62,9 +63,8 @@ server {
             proxy_read_timeout 3600s;
         }
 
-        location /FOREST/ws {
+        location = /FOREST/ws {
             set $up_server_forest cyberia-server-forest:8081;
-            rewrite ^/FOREST/(.*)$ /$1 break;
             proxy_pass http://$up_server_forest;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -75,9 +75,8 @@ server {
             proxy_read_timeout 3600s;
         }
 
-        location /TEST/ws {
+        location = /TEST/ws {
             set $up_server_test cyberia-server-test:8081;
-            rewrite ^/TEST/(.*)$ /$1 break;
             proxy_pass http://$up_server_test;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -89,7 +88,7 @@ server {
         }
 
         location / {
-            set $up_client_default cyberia-client:8081;
+            set $up_client_default cyberia-client-runtime:8081;
             proxy_pass http://$up_client_default;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -101,7 +100,7 @@ server {
         }
 
         location = /FOREST { return 301 /FOREST/; }
-        location /FOREST {
+        location ^~ /FOREST/ {
             set $up_client_forest cyberia-client-forest:8081;
             proxy_pass http://$up_client_forest;
             proxy_set_header Host $host;
@@ -114,7 +113,7 @@ server {
         }
 
         location = /TEST { return 301 /TEST/; }
-        location /TEST {
+        location ^~ /TEST/ {
             set $up_client_test cyberia-client-test:8081;
             proxy_pass http://$up_client_test;
             proxy_set_header Host $host;
@@ -126,3 +125,74 @@ server {
             proxy_read_timeout 3600s;
         }
 }
+
+# Dedicated Cyberia server gateway. Port 8081 makes all instance paths available
+# from localhost; the stable Docker DNS alias exposes the same routes on :80.
+server {
+    listen 80;
+    listen 8081 default_server;
+    server_name cyberia-server server.cyberia.localhost;
+
+        location = /healthz {
+            access_log off;
+            return 200 "ok\n";
+            add_header Content-Type text/plain;
+        }
+
+        location = /FOREST { return 301 /FOREST/; }
+        location ^~ /FOREST/ {
+            set $up_http_server_forest cyberia-server-forest:8081;
+            proxy_pass http://$up_http_server_forest;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+
+        location = /TEST { return 301 /TEST/; }
+        location ^~ /TEST/ {
+            set $up_http_server_test cyberia-server-test:8081;
+            proxy_pass http://$up_http_server_test;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+
+        location / {
+            set $up_http_server_default cyberia-server-runtime:8081;
+            proxy_pass http://$up_http_server_default;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+}
+
+# The engine remains a single shared authority. Its direct :4005 publication is
+# canonical for debugging; this alias is convenient for browser parity.
+server {
+    listen 80;
+    server_name engine-cyberia engine.cyberia.localhost;
+
+        location / {
+            set $up_engine_authority engine-cyberia-runtime:4005;
+            proxy_pass http://$up_engine_authority;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+}