@underpostnet/cyberia 3.2.90 → 3.3.73

package/manifests/grafana/service.yaml

@@ -11,4 +11,9 @@ spec:
   selector:
     app: grafana
   sessionAffinity: None
-  type: LoadBalancer
+  # ClusterIP: this Service is what Prometheus' provisioned datasource and the
+  # edge route resolve. Browser access is a separate decision, published by
+  # `monitor --grafana-host` (edge route) or `--node-port` (LAN), so a cluster
+  # with no LoadBalancer controller does not sit on a Service that never gets an
+  # address.
+  type: ClusterIP

package/manifests/mariadb/pv.yaml

@@ -10,3 +10,4 @@ spec:
     - ReadWriteOnce
   hostPath:
     path: /data/mariadb
+    type: DirectoryOrCreate

package/manifests/mongodb/statefulset.yaml

@@ -55,6 +55,12 @@ spec:
             - '--keyFile'
             - '/opt/mongodb/mongodb-keyfile'
             - '--bind_ip_all'
+            # Pinned, not inferred. mongod sizes its cache from the cgroup limit and lands on
+            # the 256MB floor, which leaves no headroom for a `mongodump` running in this same
+            # container — the dump gets OOM-killed (exit 137), the container restarts, and the
+            # replica set re-elects mid-backup.
+            - '--wiredTigerCacheSizeGB'
+            - '0.25'
 
           ports:
             - containerPort: 27017
@@ -91,10 +97,11 @@ spec:
           resources:
             requests:
               cpu: '100m'
-              memory: '256Mi'
+              memory: '512Mi'
             limits:
               cpu: '500m'
-              memory: '512Mi'
+              # 256MB WiredTiger cache + connections + an in-container mongodump/mongorestore.
+              memory: '1536Mi'
       volumes:
         - name: raw-secret-keyfile-volume
           secret:

package/manifests/mysql/pv-pvc.yaml

@@ -1,4 +1,9 @@
 # pv-pvc.yaml
+# The host path lives under /data, the node storage root this platform owns and labels
+# `container_file_t`; a path outside it (the previous '/mnt/data') carries the policy default and
+# is unreadable to the unprivileged container. `claimRef` pins the volume to exactly one claim —
+# without it this PV and postgres-pv-volume were interchangeable `manual`-class volumes over the
+# same directory, so either database could bind either one and both could land on one data tree.
 apiVersion: v1
 kind: PersistentVolume
 metadata:
@@ -7,12 +12,19 @@ metadata:
     type: local
 spec:
   storageClassName: manual
+  persistentVolumeReclaimPolicy: Retain
   capacity:
     storage: 20Gi
   accessModes:
     - ReadWriteOnce
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    namespace: default
+    name: mysql-pv-claim
   hostPath:
-    path: '/mnt/data'
+    path: '/data/mysql'
+    type: DirectoryOrCreate
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -20,6 +32,7 @@ metadata:
   name: mysql-pv-claim
 spec:
   storageClassName: manual
+  volumeName: mysql-pv
   accessModes:
     - ReadWriteOnce
   resources:

package/manifests/postgresql/pv.yaml

@@ -1,3 +1,7 @@
+# The host path lives under /data, the node storage root this platform owns and labels
+# `container_file_t`. `claimRef` pins the volume to exactly one claim: this PV and mysql-pv were
+# previously interchangeable `manual`-class volumes over the same '/mnt/data' directory, so either
+# database could bind either one and both could end up writing one data tree.
 kind: PersistentVolume
 apiVersion: v1
 metadata:
@@ -7,9 +11,16 @@ metadata:
     app: postgres
 spec:
   storageClassName: manual
+  persistentVolumeReclaimPolicy: Retain
   capacity:
     storage: 5Gi
   accessModes:
     - ReadWriteMany
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    namespace: default
+    name: postgres-pv-claim
   hostPath:
-    path: '/mnt/data'
+    path: '/data/postgresql'
+    type: DirectoryOrCreate

package/manifests/postgresql/pvc.yaml

@@ -6,6 +6,7 @@ metadata:
     app: postgres
 spec:
   storageClassName: manual
+  volumeName: postgres-pv-volume
   accessModes:
     - ReadWriteMany
   resources:

package/manifests/prometheus/deployment.yaml

@@ -1,25 +1,3 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: prometheus-config
-  labels:
-    app: prometheus
-data:
-  prometheus.yml: |
-    global:
-      scrape_interval: 30s
-      evaluation_interval: 30s
-
-    scrape_configs:
-      - job_name: 'scraper'
-        metrics_path: /metrics
-        scheme: https
-        static_configs:
-          - targets: []
-        # tls_config:
-        #   insecure_skip_verify: true
-
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -37,6 +15,7 @@ spec:
       labels:
         app: prometheus
     spec:
+      serviceAccountName: prometheus
       containers:
         - name: prometheus
           image: prom/prometheus:latest
@@ -51,8 +30,22 @@ spec:
           volumeMounts:
             - name: prometheus-config
               mountPath: /etc/prometheus/
+            - name: prometheus-rules
+              mountPath: /etc/prometheus/rules/
             - name: prometheus-data
               mountPath: /prometheus
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 9090
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /-/healthy
+              port: 9090
+            initialDelaySeconds: 30
+            periodSeconds: 20
           resources:
             requests:
               memory: '200Mi'
@@ -61,6 +54,9 @@ spec:
         - name: prometheus-config
           configMap:
             name: prometheus-config
+        - name: prometheus-rules
+          configMap:
+            name: prometheus-rules
         - name: prometheus-data
           emptyDir: {}
 

package/package.json

@@ -2,13 +2,13 @@
     "type": "module",
     "main": "src/index.js",
     "name": "@underpostnet/cyberia",
-    "version": "3.2.90",
+    "version": "3.3.73",
     "description": "Cyberia CLI — toolchain for the Cyberia MMO data layer, content pipeline, persistence, gRPC services, and ERC-1155 lifecycle on Hyperledger Besu.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
         "build": "node bin client",
-        "test": "NODE_ENV=test c8 mocha",
-        "test:monitor": "NODE_ENV=test c8 mocha test/deploy-monitor.test.js",
+        "test": "node bin test",
+        "test:coverage": "COVERAGE_ENFORCE=1 node bin test unit,infra,app,cyberia",
         "dev": "NODE_ENV=development nodemon src/server",
         "dev:container": "NODE_ENV=development node src/server",
         "prod:container": "NODE_ENV=production node src/server",
@@ -17,7 +17,7 @@
         "dev:proxy": "NODE_ENV=development node src/proxy proxy",
         "docs": "typedoc --options typedoc.json",
         "install:global": "npm install -g prettier",
-        "install:test": "npm install -g mocha && npm install -g c8 && npm install -g coveralls-next",
+        "install:test": "npm install -g coveralls-next",
         "install": "npm run install:global && npm run install:test",
         "prettier": "prettier --write .",
         "fix": "npm audit fix --force && npm audit",
@@ -26,7 +26,6 @@
         "security:secrets:ci": "gitleaks detect --source . --config .gitleaks.toml --redact=1",
         "security:deps": "npm audit",
         "security": "npm run security:secrets:ci && npm run security:deps",
-        "clean": "node bin env clean && node bin run clean",
         "docker:generate": "node bin docker-compose --generate --deploy-id dd-cyberia --docker-compose-id cyberia",
         "docker:up": "node bin docker-compose --up --deploy-id dd-cyberia --docker-compose-id cyberia",
         "docker:up:build": "node bin docker-compose --up --build --deploy-id dd-cyberia --docker-compose-id cyberia",
@@ -41,7 +40,8 @@
         "docker:reset": "node bin docker-compose --reset --deploy-id dd-cyberia --docker-compose-id cyberia"
     },
     "bin": {
-        "cyberia": "bin/index.js"
+        "cyberia": "bin/index.js",
+        "underpost": "bin/index.js"
     },
     "repository": {
         "type": "git",
@@ -72,12 +72,12 @@
     },
     "homepage": "https://github.com/underpostnet/engine-cyberia#readme",
     "dependencies": {
-        "underpost": "^3.2.90",
+        "underpost": "^3.3.73",
         "adm-zip": "^0.6.0",
         "maxrects-packer": "^2.7.3",
         "pngjs": "^7.0.0",
         "jimp": "^1.6.0",
-        "sharp": "^0.34.5",
+        "sharp": "^0.35.3",
         "ethers": "~6.16.0"
     },
     "publishConfig": {
@@ -90,12 +90,85 @@
         "minimatch": "^10.2.2",
         "glob": "^11.0.0",
         "diff": ">=8.0.3",
-        "js-yaml": ">=3.14.2",
+        "js-yaml": "$js-yaml",
         "debug": ">=4.3.6",
         "serialize-javascript": ">=7.0.5",
         "router": {
             "path-to-regexp": ">=8.4.0"
         },
         "ws": "^8.20.2"
+    },
+    "devDependencies": {
+        "@fortawesome/fontawesome-free": "^7.3.1",
+        "@fullcalendar/rrule": "^7.0.2",
+        "@grpc/grpc-js": "^1.14.4",
+        "@grpc/proto-loader": "^0.8.1",
+        "@neodrag/vanilla": "^2.3.1",
+        "@vitest/coverage-v8": "4.1.11",
+        "ag-grid-community": "^36.1.0",
+        "allure-vitest": "3.11.0",
+        "axios": "^1.20.0",
+        "bumpp": "^12.2.2",
+        "chai": "^6.2.2",
+        "clipboardy": "^5.3.2",
+        "cloudinary": "^2.11.0",
+        "colors": "^1.4.0",
+        "commander": "^15.0.0",
+        "compression": "^1.7.4",
+        "cookie-parser": "^1.4.7",
+        "cors": "^2.8.6",
+        "d3": "^7.9.0",
+        "dexie": "^4.4.5",
+        "dotenv": "^17.4.2",
+        "easymde": "^2.21.0",
+        "esbuild": "^0.28.2",
+        "escape-string-regexp": "^5.0.0",
+        "express": "^5.2.1",
+        "express-fileupload": "^1.4.3",
+        "express-rate-limit": "^8.6.2",
+        "express-slow-down": "^3.1.1",
+        "fast-json-stable-stringify": "^2.1.0",
+        "favicons": "^7.3.1",
+        "fs-extra": "^11.4.0",
+        "fullcalendar": "^7.0.2",
+        "helmet": "^8.3.0",
+        "html-minifier-terser": "^7.2.0",
+        "http-proxy-middleware": "^4.2.0",
+        "ignore-walk": "^9.0.0",
+        "iovalkey": "^0.4.0",
+        "json-colorizer": "^3.0.1",
+        "js-yaml": "^5.4.1",
+        "jsonwebtoken": "^9.0.3",
+        "mariadb": "^3.5.3",
+        "mongoose": "^9.9.4",
+        "morgan": "^1.12.0",
+        "marked": "^18.0.11",
+        "nodemailer": "^9.0.6",
+        "nodemon": "^3.0.1",
+        "peer": "^1.0.2",
+        "peerjs": "^1.5.5",
+        "prom-client": "^15.1.2",
+        "read": "^6.0.0",
+        "rrule": "^2.8.1",
+        "shelljs": "^0.10.0",
+        "sitemap": "^9.0.1",
+        "socket.io": "^4.8.3",
+        "sortablejs": "^1.15.0",
+        "split-file": "^2.3.0",
+        "swagger-autogen": "^2.23.7",
+        "swagger-ui-express": "^5.0.0",
+        "typedoc": "^0.28.20",
+        "typescript": "6.0.3",
+        "validator": "^13.15.35",
+        "vanilla-jsoneditor": "^3.13.0",
+        "vitest": "4.1.11",
+        "winston": "^3.19.0",
+        "workbox-background-sync": "^7.4.1",
+        "workbox-cacheable-response": "^7.4.1",
+        "workbox-core": "^7.4.1",
+        "workbox-expiration": "^7.4.1",
+        "workbox-precaching": "^7.4.1",
+        "workbox-routing": "^7.4.1",
+        "workbox-strategies": "^7.4.1"
     }
-}
+}

package/scripts/audit-selinux.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SINCE="recent"
+FAIL_ON_AVC="1"
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --since)
+            [ "$#" -ge 2 ] || { echo "--since requires an ausearch time value" >&2; exit 2; }
+            SINCE="$2"
+            shift 2
+            ;;
+        --no-fail)
+            FAIL_ON_AVC="0"
+            shift
+            ;;
+        -h|--help)
+            echo "Usage: $0 [--since recent|today|boot|TIME] [--no-fail]"
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            exit 2
+            ;;
+    esac
+done
+
+command -v getenforce >/dev/null 2>&1 || {
+    echo "SELinux userspace is unavailable. Install policycoreutils." >&2
+    exit 2
+}
+command -v ausearch >/dev/null 2>&1 || {
+    echo "ausearch is unavailable. Install audit and start auditd." >&2
+    exit 2
+}
+
+MODE="$(getenforce)"
+echo "SELinux mode: $MODE"
+[ "$MODE" = "Enforcing" ] || echo "WARNING: expected Enforcing mode" >&2
+command -v sestatus >/dev/null 2>&1 && sestatus
+
+AUDIT=(ausearch)
+[ "$(id -u)" -eq 0 ] || AUDIT=(sudo ausearch)
+RAW_FILE="$(mktemp /tmp/underpost-selinux-avc.XXXXXX)"
+trap 'rm -f "$RAW_FILE"' EXIT
+
+"${AUDIT[@]}" -m AVC,USER_AVC,SELINUX_ERR -ts "$SINCE" --raw > "$RAW_FILE" 2>/dev/null || true
+if ! grep -q '^type=' "$RAW_FILE"; then
+    echo "No SELinux AVC denials found since: $SINCE"
+    [ "$MODE" = "Enforcing" ]
+    exit
+fi
+
+echo "SELinux AVC denials found since: $SINCE" >&2
+"${AUDIT[@]}" -m AVC,USER_AVC,SELINUX_ERR -ts "$SINCE" -i || true
+if command -v sealert >/dev/null 2>&1; then
+    echo "sealert analysis:"
+    sealert -a "$RAW_FILE" || true
+else
+    echo "Install setroubleshoot-server for sealert analysis." >&2
+fi
+
+[ "$FAIL_ON_AVC" = "0" ] || exit 1

package/scripts/event-monitor.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NAMESPACE="${NAMESPACE:-default}"
+TARGET_URL="${TARGET_URL:-https://underpost.net/}"
+ENVOY_NAMESPACE="${ENVOY_NAMESPACE:-envoy-gateway-system}"
+
+COLOR_CYAN='\033[0;36m'
+COLOR_GREEN='\033[0;32m'
+COLOR_YELLOW='\033[1;33m'
+COLOR_RED='\033[0;31m'
+COLOR_NC='\033[0m'
+
+echo -e "${COLOR_CYAN}=== 1. Active Probes Status (Prometheus Instant Query) ===${COLOR_NC}"
+kubectl exec -n "$NAMESPACE" deployment/prometheus -c prometheus -- \
+promtool query instant http://localhost:9090 'probe_success' || true
+
+echo -e "\n${COLOR_CYAN}=== 2. Currently Firing Alerts ===${COLOR_NC}"
+kubectl exec -n "$NAMESPACE" deployment/prometheus -c prometheus -- \
+promtool query instant http://localhost:9090 'ALERTS{alertstate="firing"}' || true
+
+echo -e "\n${COLOR_CYAN}=== 3. Blackbox Exporter Live Test (${TARGET_URL}) ===${COLOR_NC}"
+ENCODED_URL=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$TARGET_URL', safe=''))" 2>/dev/null || echo "https%3A%2F%2Funderpost.net%2F")
+kubectl get --raw "/api/v1/namespaces/$NAMESPACE/services/blackbox-exporter:9115/proxy/probe?module=http_2xx&target=${ENCODED_URL}" | grep -E "probe_success|probe_http_status_code" || true
+
+echo -e "\n${COLOR_CYAN}=== 4. Prometheus Logs (Rule Evaluation & Scraping) ===${COLOR_NC}"
+kubectl logs -n "$NAMESPACE" -l app=prometheus --tail=50 --all-containers=true
+
+echo -e "\n${COLOR_CYAN}=== 5. Alertmanager Logs (Notifications & Dispatch) ===${COLOR_NC}"
+kubectl logs -n "$NAMESPACE" -l app=alertmanager --tail=50 --all-containers=true
+
+echo -e "\n${COLOR_CYAN}=== 6. Blackbox Exporter Logs (ICMP/HTTP Probes Execution) ===${COLOR_NC}"
+kubectl logs -n "$NAMESPACE" -l app=blackbox-exporter --tail=50 --all-containers=true
+
+echo -e "\n${COLOR_CYAN}=== 7. WireGuard Interface Status ===${COLOR_NC}"
+if command -v wg &> /dev/null; then
+    echo -e "${COLOR_YELLOW}[Host WireGuard Status]${COLOR_NC}"
+    wg show || true
+    
+    echo -e "\n${COLOR_YELLOW}[WireGuard Systemd Services]${COLOR_NC}"
+    systemctl list-units --type=service 'wg-quick*' --no-pager || true
+else
+    echo -e "${COLOR_YELLOW}'wg' CLI tool is not installed on the host.${COLOR_NC}"
+fi
+
+echo -e "\n${COLOR_CYAN}=== 8. Ingress & Gateway Diagnostics ===${COLOR_NC}"
+if kubectl get ns "$ENVOY_NAMESPACE" &>/dev/null; then
+    echo -e "${COLOR_YELLOW}[Targeting namespace: ${ENVOY_NAMESPACE}]${COLOR_NC}"
+    kubectl get pods -n "$ENVOY_NAMESPACE" || true
+else
+    echo -e "${COLOR_YELLOW}[Namespace '${ENVOY_NAMESPACE}' not found. Searching cluster-wide for Ingress/Envoy resources...]${COLOR_NC}"
+    kubectl get pods -A -l "app.kubernetes.io/name in (envoy-gateway, envoy, ingress-nginx, ingress)" 2>/dev/null || \
+    kubectl get pods -A | grep -E "envoy|ingress|gateway" || true
+fi
+
+echo -e "\n${COLOR_GREEN}Done checking cluster monitoring state.${COLOR_NC}"

package/scripts/k3s-node-setup.sh

@@ -49,22 +49,38 @@ if [ -z "$(ls -A "$ENGINE_ROOT")" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# NVM and Node.js — required for `node bin ...` entrypoints
+# System-wide Node.js is required by service units under SELinux.
+#
+# RHEL/Rocky only. An underpost node is an SELinux-Enforcing RHEL host: the storage labeling,
+# the systemd units and the CRI bring-up below are all written against that policy, so a
+# package manager that is merely present is not evidence the rest of this script applies.
+# Commissioning a Debian/Ubuntu machine that is not an underpost node is `underpost baremetal`.
 # ---------------------------------------------------------------------------
-echo "Installing NVM and Node.js v24.15.0..."
+if ! command -v dnf >/dev/null 2>&1; then
+    echo "ERROR: underpost nodes are RHEL/Rocky only; dnf was not found" >&2
+    exit 1
+fi
 
-curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
+sudo dnf install -y policycoreutils policycoreutils-python-utils selinux-policy-targeted audit rsync
 
-export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-# shellcheck disable=SC1090
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+# `command -v node` is not the question this step asks: an nvm runtime under $HOME answers it and
+# is exactly what a unit cannot execute. Only a Node 24 at a system path counts.
+system_node_path() {
+    local candidate
+    for candidate in /usr/bin/node /usr/local/bin/node /bin/node; do
+        if [ -x "$candidate" ] && "$candidate" --version 2>/dev/null | grep -q '^v24'; then
+            printf '%s' "$candidate"
+            return 0
+        fi
+    done
+    return 1
+}
 
-nvm install 24.15.0
-nvm use 24.15.0
-nvm alias default 24.15.0
-ln -sf "$(command -v node)" /usr/local/bin/node
-ln -sf "$(command -v npm)" /usr/local/bin/npm
-ln -sf "$(command -v npx)" /usr/local/bin/npx
+if ! system_node_path >/dev/null; then
+    echo "Installing system-wide Node.js 24..."
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+    sudo dnf install -y nodejs
+fi
 
 echo "
 ██╗░░░██╗███╗░░██╗██████╗░███████╗██████╗░██████╗░░█████╗░░██████╗████████╗
@@ -81,7 +97,7 @@ cd "$ENGINE_ROOT"
 
 # Install JS deps and generate secrets using the local engine entrypoint only.
 npm install
-node bin run secret
+# Cluster Secret administration is a control-plane capability, not part of node bring-up.
 
 if [ "$ROLE" = "control" ]; then
     echo "Installing underpost CLI..."
@@ -116,7 +132,7 @@ if [ "$ROLE" = "control" ]; then
     curl -sfL https://get.k3s.io | \
     K3S_URL="https://${CONTROL_IP}:6443" \
     K3S_TOKEN="${K3S_TOKEN}" \
-    sh -s - agent
+    sh -s - agent $(if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then printf '%s' '--selinux'; fi)
     
     echo ""
     echo "K3s worker joined https://${CONTROL_IP}:6443 successfully."

package/scripts/kubeadm-node-setup.sh

@@ -5,8 +5,8 @@ set -euo pipefail
 # Underpost Kubeadm Node Setup (bare-metal physical node)
 #
 # Mirrors scripts/k3s-node-setup.sh but for kubeadm on real hardware: it runs on
-# the freshly deployed OS (disk-installed Rocky) after first boot, installs NVM +
-# Node.js, ensures the engine source is present, and drives the cluster bring-up
+# the freshly deployed OS (disk-installed Rocky) after first boot, installs
+# system-wide Node.js, ensures the engine source is present, and drives the cluster bring-up
 # through the local engine entrypoint `node bin cluster` (src/cli/cluster.js) —
 # reusing its kubeadm + Contour + host-init logic instead of reimplementing it.
 #
@@ -146,33 +146,43 @@ if [ "$JOIN_ONLY" = "1" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 0. Base prerequisites — a minimal @core Rocky install lacks tar/xz/git, which
-#    NVM needs to extract Node.js and the engine clone needs. Install them first.
+# 0. Base prerequisites.
 # ---------------------------------------------------------------------------
-log "Installing base prerequisites (tar, xz, gzip, git, curl)..."
-sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils 2>/dev/null \
-|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils
+# RHEL/Rocky only. An underpost node is an SELinux-Enforcing RHEL host: the storage labeling, the
+# systemd units and the CRI bring-up below are all written against that policy. Commissioning a
+# Debian/Ubuntu machine that is not an underpost node is `underpost baremetal`.
+if ! command -v dnf >/dev/null 2>&1; then
+    echo "ERROR: underpost nodes are RHEL/Rocky only; dnf was not found" >&2
+    exit 1
+fi
+
+log "Installing base prerequisites..."
+sudo dnf install -y tar xz gzip bzip2 git curl rsync ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit 2>/dev/null \
+|| dnf install -y tar xz gzip bzip2 git curl rsync ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
 
 # ---------------------------------------------------------------------------
-# 1. NVM and Node.js — required for the `node bin ...` entrypoints. Idempotent so
-#    a retried run does not reinstall Node from scratch.
+# 1. System-wide Node.js. Home-directory runtimes cannot be used by hardened
+#    systemd services under SELinux.
 # ---------------------------------------------------------------------------
-if command -v node >/dev/null 2>&1 && node --version 2>/dev/null | grep -q '^v24'; then
-    log "Node.js $(node --version) already installed; skipping NVM setup"
+# `command -v node` is not the question this step asks: an nvm runtime under $HOME answers it and
+# is exactly what a unit cannot execute. Only a Node 24 at a system path counts.
+system_node_path() {
+    local candidate
+    for candidate in /usr/bin/node /usr/local/bin/node /bin/node; do
+        if [ -x "$candidate" ] && "$candidate" --version 2>/dev/null | grep -q '^v24'; then
+            printf '%s' "$candidate"
+            return 0
+        fi
+    done
+    return 1
+}
+
+if node_path="$(system_node_path)"; then
+    log "System-wide Node.js $("$node_path" --version) already installed at $node_path"
 else
-    log "Installing NVM and Node.js v24.15.0..."
-    curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
-    
-    export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-    # shellcheck disable=SC1090
-    [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
-    
-    nvm install 24.15.0
-    nvm use 24.15.0
-    nvm alias default 24.15.0
-    ln -sf "$(command -v node)" /usr/local/bin/node
-    ln -sf "$(command -v npm)" /usr/local/bin/npm
-    ln -sf "$(command -v npx)" /usr/local/bin/npx
+    log "Installing system-wide Node.js 24..."
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+    sudo dnf install -y nodejs
 fi
 
 echo "
@@ -189,7 +199,7 @@ Bringing up underpost kubeadm node (role=$ROLE) from $ENGINE_ROOT
 # ---------------------------------------------------------------------------
 # 2. Engine source — required by `node bin cluster` (manifests + CLI).
 #    Normalizes any (custom-named) repo into the canonical paths, mirroring
-#    src/server/start.js: clone into a temp dir then copy the contents into the
+#    src/server/runtime/start.js: clone into a temp dir then copy the contents into the
 #    target, so the working tree is always $ENGINE_ROOT regardless of repo name.
 # ---------------------------------------------------------------------------
 command -v git >/dev/null 2>&1 || sudo dnf install -y git
@@ -259,10 +269,8 @@ fi
 
 cd "$ENGINE_ROOT"
 
-# Clone + normalize the private secrets repo into $ENGINE_ROOT/engine-private
-# (where `node bin run secret` reads engine-private/conf/.../.env.production),
-# regardless of the private repo's name. The token is masked in logs and then
-# stripped from the saved remote URL.
+# Clone + normalize the private secrets repo into $ENGINE_ROOT/engine-private, regardless of the
+# private repo's name. The token is masked in logs and then stripped from the saved remote URL.
 if [ -n "$GITHUB_TOKEN" ]; then
     PRIV_URL="https://${GITHUB_USERNAME:-x-access-token}:${GITHUB_TOKEN}@${ENGINE_PRIVATE_REPO#https://}"
     if clone_or_pull "$PRIV_URL" "$ENGINE_PRIVATE_BRANCH" "$ENGINE_ROOT/engine-private" "origin" "$GITHUB_TOKEN"; then
@@ -275,10 +283,11 @@ else
     log "WARNING: GITHUB_TOKEN not provided; engine-private not cloned — secrets will be unavailable"
 fi
 
-# Install JS deps and generate secrets using the local engine entrypoint.
+# Install JS deps using the local engine entrypoint. Cluster Secret administration is not part of
+# node bring-up: it is a control-plane capability, projected by `cron --setup-start --apply` on the
+# control node. A worker joining the cluster has no business writing cluster-wide Secrets.
 npm install
 npm install -g underpost
-node bin run secret
 
 # ---------------------------------------------------------------------------
 # 3. Host prerequisites (Docker, CRI-O, kubelet/kubeadm/kubectl, ...) via cluster.js