@underpostnet/cyberia 3.2.80 → 3.3.0

package/compose.env

@@ -40,29 +40,27 @@ VALKEY_HOST=valkey-service
 VALKEY_PORT=6379
 
 # --- Cyberia instance wiring (compose service DNS) ---------------------------
-# cyberia-server-* -> engine-cyberia authority endpoints. INTERNAL only: these
-# use the docker service DNS (engine-cyberia) and must never leak to browser
-# clients. Per-instance INSTANCE_CODE is set on each generated server service
-# from conf.instances.json (multiInstance) — not here.
-ENGINE_API_BASE_URL=http://engine-cyberia:4005
-ENGINE_GRPC_ADDRESS=engine-cyberia:50051
+# cyberia-server-* -> stable engine gateway for HTTP and the raw engine runtime
+# for gRPC. The public engine-cyberia name belongs to nginx, avoiding ambiguous
+# Docker DNS while keeping one stable HTTP endpoint for every module.
+ENGINE_API_BASE_URL=http://engine-cyberia
+ENGINE_GRPC_ADDRESS=engine-cyberia-runtime:50051
 
 # Client-visible Content Authority origin, forwarded to browser/Raylib clients
 # for every engine-cyberia content/asset/metadata request. Host-reachable
-# (docker publishes engine-cyberia :4005). Distinct from ENGINE_API_BASE_URL:
+# (Docker publishes the raw engine runtime on host :4005). Unlike the internal
+# ENGINE_API_BASE_URL, this value is consumed outside the Compose network:
 # the two responsibilities must never overwrite each other.
 ENGINE_PUBLIC_URL=http://localhost:4005
 ENGINE_GRPC_RELOAD_INTERVAL_SEC=300
 
 # --- Browser-facing client runtime config (injected by docker-driver.py) -----
 # The single WASM bundle resolves its instance from the URL sub-path and builds
-# its endpoints from these origins. They point at the nginx proxy on localhost:80
-# (the single gateway that path-routes WS -> server, /api + /assets -> engine),
-# NOT at the raw client/engine container ports — a WS to the client port (8082)
-# has no server behind it. So this must be the proxy origin, not :8082 / :4005.
-#   http://localhost/          -> default instance,  ws -> ws://localhost/ws
-#   http://localhost/FOREST    -> FOREST instance,    ws -> ws://localhost/FOREST/ws
-CYBERIA_WS_ORIGIN=ws://localhost
+# its endpoints from these origins. HTTP client/API traffic uses nginx on :80;
+# WebSocket traffic uses the dedicated multi-path server gateway on :8081.
+#   http://localhost/          -> default, ws://localhost:8081/ws
+#   http://localhost/FOREST    -> FOREST,  ws://localhost:8081/FOREST/ws
+CYBERIA_WS_ORIGIN=ws://localhost:8081
 CYBERIA_ENGINE_API_ORIGIN=http://localhost
 CYBERIA_DEFAULT_INSTANCE=amethyst-strata-expansion
 
@@ -72,6 +70,22 @@ CYBERIA_DEFAULT_INSTANCE=amethyst-strata-expansion
 CYBERIA_SERVER_APP_ENV=development
 CYBERIA_SERVER_LOG_LEVEL=
 
+# --- cyberia-server WebSocket admission and rate limits ----------------------
+# Unset keeps the built-in default. An explicit 0 turns that one limit off.
+# The startup log prints the effective profile ("ws limits: ...").
+#
+# Set CYBERIA_DISABLE_CONNECTION_LIMITS=1 to turn every limit off. The load test
+# (test/cyberia-load.test.js) drives every simulated client from one address, so
+# it needs this. NEVER enable it on a public deploy.
+CYBERIA_DISABLE_CONNECTION_LIMITS=
+CYBERIA_MAX_CONNECTIONS=
+CYBERIA_MAX_CONNECTIONS_PER_IP=
+CYBERIA_CONNECT_RATE_PER_IP=
+CYBERIA_CONNECT_BURST_PER_IP=
+CYBERIA_MESSAGE_RATE=
+CYBERIA_MESSAGE_BURST=
+CYBERIA_MAX_STRIKES=
+
 # --- engine-cyberia runtime env (loaded into the container via env_file) -----
 # The dd-cyberia engine (engine-private/conf/dd-cyberia/conf.server.json) needs
 # these to boot: DB auth + per-site DB names, the base PORT (the cyberia host is
@@ -82,6 +96,7 @@ NODE_OPTIONS=--max-old-space-size=8192
 BASE_API=api
 DEFAULT_DEPLOY_ID=dd-cyberia
 DEPLOY_ID=dd-cyberia
+# Configuration/DB selector from conf.server.json; this is not a Docker DNS alias.
 DEFAULT_DEPLOY_HOST=www.cyberiaonline.com
 DEFAULT_DEPLOY_PATH=/
 DISABLE_API_RATE_LIMIT=true
@@ -131,7 +146,25 @@ IPFS_CLUSTER_API_URL=http://ipfs-cluster:9094
 # in docker-compose.yml). Override for a real/shared cluster.
 # CLUSTER_SECRET=
 
-# --- Host-published ports ----------------------------------------------------
+# --- Local access ------------------------------------------------------------
+# Client gateway:  http://localhost/{,FOREST,TEST}
+# Client port alias: http://localhost:8082/{,FOREST,TEST}
+# Server gateway:  http://localhost:8081/{,FOREST,TEST}
+# Engine authority: http://localhost:4005
+# Docker-network gateways:
+#   http://cyberia-client/{,FOREST,TEST}
+#   http://cyberia-server/{,FOREST,TEST}
+#   http://engine-cyberia/
+#
+# The *.localhost aliases normally resolve to loopback without configuration:
+#   http://client.cyberia.localhost/{,FOREST,TEST}
+#   http://server.cyberia.localhost/{,FOREST,TEST}
+#   http://engine.cyberia.localhost/
+# `node bin/cyberia run-workflow docker:up` maintains this host entry (the
+# aliases already work between containers):
+#   127.0.0.1 cyberia-client cyberia-server engine-cyberia
+#
+# Host-published ports:
 PROXY_HTTP_PORT=80
 IPFS_API_PORT=5001
 IPFS_GATEWAY_PORT=8080
@@ -140,5 +173,7 @@ MONGO_HOST_PORT=27017
 VALKEY_NODEPORT=32079
 ENGINE_CYBERIA_REST_PORT=4005
 ENGINE_CYBERIA_GRPC_PORT=50051
+# Multi-path nginx server gateway, not a single server container publication.
 CYBERIA_SERVER_PORT=8081
+# Multi-path nginx client gateway; raw client containers remain internal.
 CYBERIA_CLIENT_PORT=8082

package/conf.js

@@ -179,6 +179,7 @@ const DefaultConf = /**/ {
           'InstanceEngineCyberia',
           'ActionEngineCyberia',
           'EntityEngineCyberia',
+          'FallbackWorldEngineCyberia',
           'InstanceSelectionView',
         ],
         core: [
@@ -264,6 +265,7 @@ const DefaultConf = /**/ {
         { path: '/docs', client: 'CyberiaPortal', ssr: 'CyberiaPortal' },
         { path: '/cyberia-action-engine', client: 'CyberiaPortal', ssr: 'CyberiaPortal' },
         { path: '/cyberia-entity-engine', client: 'CyberiaPortal', ssr: 'CyberiaPortal' },
+        { path: '/fallback-world-engine', client: 'CyberiaPortal', ssr: 'CyberiaPortal' },
         { path: '/instance-selection', title: 'Select World', client: 'CyberiaPortal', ssr: 'CyberiaPortal' },
       ],
       dists: [

package/deploy/dd-cyberia/deploy.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/logging.sh"
+
+ENGINE_ROOT=/home/dd/engine
+INGRESS_NODE=localhost.localdomain
+
+main() {
+    echo "Starting remote deploy"
+
+    run_quiet \
+        "Pull repository" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run pull"
+
+    run_quiet \
+        "Install dependencies" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install"
+
+    run_quiet \
+        "Sync secrets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run secret"
+
+    run_quiet \
+        "Deploy dd-cyberia" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run deploy dd-cyberia --gateway-api --ingress-node ${INGRESS_NODE}"
+}
+
+main "$@"

package/deploy/dd-cyberia/init.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/logging.sh"
+
+ENGINE_ROOT=/home/dd/engine
+INGRESS_NODE=localhost.localdomain
+
+main() {
+    echo "Starting init deploy"
+
+    run_quiet \
+        "Pull repository" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run pull"
+
+    run_quiet \
+        "Install dependencies" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install"
+
+    run_quiet \
+        "Sync secrets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run secret"
+
+    run_quiet \
+        "Build dd-cyberia configuration" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin/build dd-cyberia --conf"
+
+    run_quiet \
+        "Deploy dd-cyberia production" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin deploy dd-cyberia production --kubeadm --gateway-api --ingress-node ${INGRESS_NODE} --sync --build-manifest --timeout-response 300000ms --versions green --replicas 1"
+
+    run_quiet \
+        "Clean dd-cyberia working tree" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin deploy dd-cyberia production --kubeadm --gateway-api --ingress-node ${INGRESS_NODE} --disable-update-proxy --git-clean"
+
+    run_quiet \
+        "Promote dd-cyberia deployment" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin monitor dd-cyberia production --ready-deployment --promote --timeout-response 300000ms --versions green --replicas 1"
+}
+
+main "$@"

package/deploy/dd-cyberia/sync-deploy.sh

@@ -0,0 +1,194 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/logging.sh"
+
+ENGINE_ROOT=/home/dd/engine
+TARGET_NODE=localhost.localdomain
+INGRESS_NODE=localhost.localdomain
+
+# Asset repositories are committed only when they actually changed, so the
+# status query stays outside run_quiet: its stdout is the value we branch on.
+has_changes() {
+    local path="$1"
+
+    sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin cmt $path --has-changes" | tr -d '\n'
+}
+
+main() {
+    echo "Starting remote sync and deploy"
+
+    run_quiet \
+        "Pull repository" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run pull"
+
+    run_quiet \
+        "Install dependencies" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install"
+
+    run_quiet \
+        "Sync secrets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run secret"
+
+    run_quiet \
+        "Run tests" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm run test"
+
+    run_quiet \
+        "Clean cyberia public assets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run clean src/client/public/cyberia"
+
+    run_quiet \
+        "Clean underpost public assets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run clean src/client/public/underpost"
+
+    run_quiet \
+        "Initialize cyberia assets repository" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin cmt src/client/public/cyberia --init-repo"
+
+    run_quiet \
+        "Initialize underpost assets repository" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin cmt src/client/public/underpost --init-repo"
+
+    run_quiet \
+        "Pull cyberia public assets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin fs src/client/public/cyberia --pull --recursive --deploy-id dd-cyberia"
+
+    run_quiet \
+        "Pull underpost public assets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin fs src/client/public/underpost --pull --recursive --deploy-id dd-cyberia --storage-file-path './engine-private/conf/dd-cyberia/storage.underpost.json'"
+
+    if [ "$(has_changes src/client/public/cyberia)" = "1" ]; then
+        run_quiet \
+            "Commit cyberia public assets" \
+            "Target pod:" \
+            14 \
+            sudo -n -- /bin/bash -lc \
+            "cd $ENGINE_ROOT && node bin cmt src/client/public/cyberia feat 'Update cyberia public assets'"
+    fi
+
+    if [ "$(has_changes src/client/public/underpost)" = "1" ]; then
+        run_quiet \
+            "Commit underpost public assets" \
+            "Target pod:" \
+            14 \
+            sudo -n -- /bin/bash -lc \
+            "cd $ENGINE_ROOT && node bin cmt src/client/public/underpost feat 'Update underpost public assets'"
+    fi
+
+    run_quiet \
+        "Apply format fixes" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm run fix"
+
+    run_quiet \
+        "Reinstall dependencies" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install"
+
+    run_quiet \
+        "Build cyberia deployment bundle" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin/deploy cyberia"
+
+    run_quiet \
+        "Clean build artifacts" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && underpost run clean"
+
+    run_quiet \
+        "Load dd-cyberia production environment" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin env dd-cyberia production"
+
+    run_quiet \
+        "Build cyberia manifests" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin/cyberia run-workflow build-manifest"
+
+    run_quiet \
+        "Sync dd-cyberia cluster" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run sync 'dd-cyberia,1,,underpost/engine-cyberia:latest' \
+          --kubeadm \
+          --deploy-id-cron-jobs none \
+          --timeout-response 300000ms \
+          --node-name ${TARGET_NODE} \
+          --gateway-api \
+          --ingress-node ${INGRESS_NODE} \
+          --ssh-key-path /home/dd/tmp/897as9dxhaskd9 \
+          --image-pull-policy Always \
+          --cmd 'cd /home/dd/engine, \
+            underpost clone underpostnet/engine-cyberia, \
+            mkdir -p /home/dd/engine/src/client/public/itemledger \
+              /home/dd/engine/src/client/public/cryptokoyn \
+              /home/dd/engine/src/client/components/cryptokoyn \
+              /home/dd/engine/src/client/components/itemledger \
+              /home/dd/engine/hardhat, \
+            cp -a ./engine-cyberia/src/client/public/itemledger/. /home/dd/engine/src/client/public/itemledger/, \
+            cp -a ./engine-cyberia/src/client/public/cryptokoyn/. /home/dd/engine/src/client/public/cryptokoyn/, \
+            cp -a ./engine-cyberia/src/client/components/cryptokoyn/. /home/dd/engine/src/client/components/cryptokoyn/, \
+            cp -a ./engine-cyberia/src/client/components/itemledger/. /home/dd/engine/src/client/components/itemledger/, \
+            cp -a ./engine-cyberia/src/client/Itemledger.index.js /home/dd/engine/src/client/Itemledger.index.js, \
+            cp -a ./engine-cyberia/src/client/Cryptokoyn.index.js /home/dd/engine/src/client/Cryptokoyn.index.js, \
+            rm -rf ./engine-cyberia, \
+            sudo rm -rf ./engine-private/, \
+            node bin clone underpostnet/engine-cyberia-private, \
+            sudo mv ./engine-cyberia-private ./engine-private, \
+            node bin env dd-cyberia production, \
+            node ./engine-private/itc-scripts/dd-cyberia-0.js, \
+            sudo chown -R dd:dd /home/dd/engine/src/client/public/cyberia, \
+            node bin/cyberia run-workflow import-default-items --clean, \
+            node bin/cyberia run-workflow import-default-items, \
+            node bin env dd-cyberia production, \
+            node bin client dd-cyberia, \
+            node bin start dd-cyberia production --run'"
+}
+
+main "$@"

package/deploy/lib/logging.sh

@@ -0,0 +1,96 @@
+# Shared logging helpers for deploy/<deploy-id>/*.sh. Sourced, never executed directly.
+#
+# Deploy script contract:
+# - one run_quiet call per remote command, with its own label
+# - the body lives in main(), invoked on the last line: the first remote command
+#   pulls this repository, rewriting the running script while bash reads it
+#
+# run_quiet hides normal output, prints only `patterns` matches plus the next
+# `lines_after` lines, and returns the command's exit status so `set -e` stops
+# the deployment. On failure it keeps two temp files and prints their paths in
+# red instead of their contents: the command's own stderr (native error message
+# and stack trace) and the full unfiltered log up to the error.
+
+RUN_QUIET_RED=$'\033[0;31m'
+RUN_QUIET_RESET=$'\033[0m'
+
+RUN_QUIET_NODE_NAME=$(hostname 2>/dev/null | tr '[:upper:]' '[:lower:]')
+RUN_QUIET_NODE_TAG=${RUN_QUIET_NODE_NAME:+ [$RUN_QUIET_NODE_NAME]}
+
+run_quiet() {
+    local label="$1"
+    local patterns="$2"
+    local lines_after="$3"
+    shift 3
+    
+    local debug_log
+    local error_log
+    local fifo_dir
+    local filter_pid
+    local stderr_pid
+    local status=0
+    
+    echo "$(date -Is) $RUN_QUIET_NODE_TAG ▶ $label"
+    
+    debug_log=$(mktemp --suffix=.debug.log)
+    error_log=$(mktemp --suffix=.error.log)
+    fifo_dir=$(mktemp -d)
+    mkfifo "$fifo_dir/merged" "$fifo_dir/stderr"
+    
+    # The filter reads the live stream rather than the finished log: a deployment
+    # monitor prints its matches for minutes before exiting, so a pass over the
+    # completed file would show nothing until then. fflush defeats awk's block
+    # buffering, which otherwise withholds matches whenever stdout is a pipe.
+    # awk writes the debug log itself rather than piping through tee, so the
+    # reader stays a single process that a kill can always release.
+    awk \
+    -v pattern="$patterns" \
+    -v lines_after="$lines_after" \
+    -v debug_log="$debug_log" '
+        {
+            print > debug_log
+        }
+        $0 ~ pattern {
+            remaining = lines_after + 1
+        }
+        remaining > 0 {
+            print
+            fflush()
+            remaining--
+        }
+    ' <"$fifo_dir/merged" &
+    filter_pid=$!
+    
+    # stderr is duplicated: on its own for the native error and stack trace, and
+    # into the merged stream so both the debug log and the filter see it in
+    # chronological order with stdout.
+    tee -a "$error_log" <"$fifo_dir/stderr" >"$fifo_dir/merged" &
+    stderr_pid=$!
+    
+    "$@" >"$fifo_dir/merged" 2>"$fifo_dir/stderr" || status=$?
+    
+    # Drain both readers before the paths are printed, or the trace can still be
+    # in flight. Bounded: a command that leaks a child holding a stream open must
+    # not hang the deployment, and by then everything read has been written.
+    run_quiet_drain "$stderr_pid"
+    run_quiet_drain "$filter_pid"
+    rm -rf "$fifo_dir"
+    
+    if [ "$status" -ne 0 ]; then
+        printf '%s✖ %s failed (exit %s)\n  error trace: %s\n  debug log:   %s%s\n' \
+        "$RUN_QUIET_RED" "$label" "$status" "$error_log" "$debug_log" "$RUN_QUIET_RESET" >&2
+        return "$status"
+    fi
+    
+    rm -f "$debug_log" "$error_log"
+    
+    return "$status"
+}
+
+run_quiet_drain() {
+    local pid="$1"
+    
+    timeout 10 tail --pid="$pid" -f /dev/null 2>/dev/null || true
+    kill "$pid" 2>/dev/null || true
+    wait "$pid" 2>/dev/null || true
+}

package/deploy/pwa-microservices-template/deploy.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/logging.sh"
+
+# Runs in the workflow's rockylinux:9 container against the checked-out
+# workspace instead of over SSH, so the repository root is this script's
+# grandparent rather than a fixed remote path.
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+main() {
+    echo "Starting github pages deploy"
+
+    cd "$REPO_ROOT"
+
+    run_quiet \
+        "Install required packages" \
+        "Target pod:" \
+        14 \
+        dnf install -y sudo tar gzip bzip2 git
+
+    run_quiet \
+        "Install curl" \
+        "Target pod:" \
+        14 \
+        dnf install -y curl --allowerasing
+
+    run_quiet \
+        "Add Node.js repository" \
+        "Target pod:" \
+        14 \
+        bash -c "curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -"
+
+    run_quiet \
+        "Install Node.js" \
+        "Target pod:" \
+        14 \
+        dnf install nodejs -y
+
+    run_quiet \
+        "Install dependencies" \
+        "Target pod:" \
+        14 \
+        npm install
+
+    run_quiet \
+        "Build dd-github-pages configuration" \
+        "Target pod:" \
+        14 \
+        node bin new --default-conf --conf-workflow-id dd-github-pages
+
+    run_quiet \
+        "Create dd-github-pages deployment" \
+        "Target pod:" \
+        14 \
+        node bin new --deploy-id dd-github-pages
+
+    run_quiet \
+        "Load dd-github-pages production environment" \
+        "Target pod:" \
+        14 \
+        node bin env dd-github-pages production
+
+    run_quiet \
+        "Build dd-github-pages client" \
+        "Target pod:" \
+        14 \
+        env NODE_ENV=production node bin client dd-github-pages '' underpostnet.github.io /pwa-microservices-template-ghpkg
+}
+
+main "$@"

package/deploy/release/deploy.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/logging.sh"
+
+ENGINE_ROOT=/home/dd/engine
+
+main() {
+    echo "Starting remote release deploy"
+
+    run_quiet \
+        "Pull repository" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run pull"
+
+    run_quiet \
+        "Install dependencies" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install"
+
+    run_quiet \
+        "Sync secrets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run secret"
+
+    run_quiet \
+        "Install underpost CLI" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install -g underpost"
+
+    run_quiet \
+        "Resync secrets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run secret"
+
+    run_quiet \
+        "Configure git" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run --dev git-conf"
+
+    run_quiet \
+        "Build and publish docker images" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run docker-image"
+}
+
+main "$@"