@underpostnet/cyberia 3.3.0 → 3.3.76

package/scripts/k3s-node-setup.sh

@@ -50,23 +50,36 @@ fi
 
 # ---------------------------------------------------------------------------
 # System-wide Node.js is required by service units under SELinux.
+#
+# RHEL/Rocky only. An underpost node is an SELinux-Enforcing RHEL host: the storage labeling,
+# the systemd units and the CRI bring-up below are all written against that policy, so a
+# package manager that is merely present is not evidence the rest of this script applies.
+# Commissioning a Debian/Ubuntu machine that is not an underpost node is `underpost baremetal`.
 # ---------------------------------------------------------------------------
-if command -v dnf >/dev/null 2>&1; then
-    sudo dnf install -y policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
+if ! command -v dnf >/dev/null 2>&1; then
+    echo "ERROR: underpost nodes are RHEL/Rocky only; dnf was not found" >&2
+    exit 1
 fi
 
-if ! command -v node >/dev/null 2>&1 || ! node --version 2>/dev/null | grep -q '^v24'; then
+sudo dnf install -y policycoreutils policycoreutils-python-utils selinux-policy-targeted audit rsync
+
+# `command -v node` is not the question this step asks: an nvm runtime under $HOME answers it and
+# is exactly what a unit cannot execute. Only a Node 24 at a system path counts.
+system_node_path() {
+    local candidate
+    for candidate in /usr/bin/node /usr/local/bin/node /bin/node; do
+        if [ -x "$candidate" ] && "$candidate" --version 2>/dev/null | grep -q '^v24'; then
+            printf '%s' "$candidate"
+            return 0
+        fi
+    done
+    return 1
+}
+
+if ! system_node_path >/dev/null; then
     echo "Installing system-wide Node.js 24..."
-    if command -v dnf >/dev/null 2>&1; then
-        curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
-        sudo dnf install -y nodejs
-    elif command -v apt-get >/dev/null 2>&1; then
-        curl -fsSL https://deb.nodesource.com/setup_24.x | sudo bash -
-        sudo apt-get install -y nodejs
-    else
-        echo "ERROR: a supported system package manager is required for Node.js 24" >&2
-        exit 1
-    fi
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+    sudo dnf install -y nodejs
 fi
 
 echo "
@@ -84,7 +97,7 @@ cd "$ENGINE_ROOT"
 
 # Install JS deps and generate secrets using the local engine entrypoint only.
 npm install
-node bin run secret
+# Cluster Secret administration is a control-plane capability, not part of node bring-up.
 
 if [ "$ROLE" = "control" ]; then
     echo "Installing underpost CLI..."

package/scripts/kubeadm-node-setup.sh

@@ -148,16 +148,37 @@ fi
 # ---------------------------------------------------------------------------
 # 0. Base prerequisites.
 # ---------------------------------------------------------------------------
+# RHEL/Rocky only. An underpost node is an SELinux-Enforcing RHEL host: the storage labeling, the
+# systemd units and the CRI bring-up below are all written against that policy. Commissioning a
+# Debian/Ubuntu machine that is not an underpost node is `underpost baremetal`.
+if ! command -v dnf >/dev/null 2>&1; then
+    echo "ERROR: underpost nodes are RHEL/Rocky only; dnf was not found" >&2
+    exit 1
+fi
+
 log "Installing base prerequisites..."
-sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit 2>/dev/null \
-|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
+sudo dnf install -y tar xz gzip bzip2 git curl rsync ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit 2>/dev/null \
+|| dnf install -y tar xz gzip bzip2 git curl rsync ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
 
 # ---------------------------------------------------------------------------
 # 1. System-wide Node.js. Home-directory runtimes cannot be used by hardened
 #    systemd services under SELinux.
 # ---------------------------------------------------------------------------
-if command -v node >/dev/null 2>&1 && node --version 2>/dev/null | grep -q '^v24'; then
-    log "Node.js $(node --version) already installed"
+# `command -v node` is not the question this step asks: an nvm runtime under $HOME answers it and
+# is exactly what a unit cannot execute. Only a Node 24 at a system path counts.
+system_node_path() {
+    local candidate
+    for candidate in /usr/bin/node /usr/local/bin/node /bin/node; do
+        if [ -x "$candidate" ] && "$candidate" --version 2>/dev/null | grep -q '^v24'; then
+            printf '%s' "$candidate"
+            return 0
+        fi
+    done
+    return 1
+}
+
+if node_path="$(system_node_path)"; then
+    log "System-wide Node.js $("$node_path" --version) already installed at $node_path"
 else
     log "Installing system-wide Node.js 24..."
     curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
@@ -178,7 +199,7 @@ Bringing up underpost kubeadm node (role=$ROLE) from $ENGINE_ROOT
 # ---------------------------------------------------------------------------
 # 2. Engine source — required by `node bin cluster` (manifests + CLI).
 #    Normalizes any (custom-named) repo into the canonical paths, mirroring
-#    src/server/start.js: clone into a temp dir then copy the contents into the
+#    src/server/runtime/start.js: clone into a temp dir then copy the contents into the
 #    target, so the working tree is always $ENGINE_ROOT regardless of repo name.
 # ---------------------------------------------------------------------------
 command -v git >/dev/null 2>&1 || sudo dnf install -y git
@@ -248,10 +269,8 @@ fi
 
 cd "$ENGINE_ROOT"
 
-# Clone + normalize the private secrets repo into $ENGINE_ROOT/engine-private
-# (where `node bin run secret` reads engine-private/conf/.../.env.production),
-# regardless of the private repo's name. The token is masked in logs and then
-# stripped from the saved remote URL.
+# Clone + normalize the private secrets repo into $ENGINE_ROOT/engine-private, regardless of the
+# private repo's name. The token is masked in logs and then stripped from the saved remote URL.
 if [ -n "$GITHUB_TOKEN" ]; then
     PRIV_URL="https://${GITHUB_USERNAME:-x-access-token}:${GITHUB_TOKEN}@${ENGINE_PRIVATE_REPO#https://}"
     if clone_or_pull "$PRIV_URL" "$ENGINE_PRIVATE_BRANCH" "$ENGINE_ROOT/engine-private" "origin" "$GITHUB_TOKEN"; then
@@ -264,10 +283,11 @@ else
     log "WARNING: GITHUB_TOKEN not provided; engine-private not cloned — secrets will be unavailable"
 fi
 
-# Install JS deps and generate secrets using the local engine entrypoint.
+# Install JS deps using the local engine entrypoint. Cluster Secret administration is not part of
+# node bring-up: it is a control-plane capability, projected by `cron --setup-start --apply` on the
+# control node. A worker joining the cluster has no business writing cluster-wide Secrets.
 npm install
 npm install -g underpost
-node bin run secret
 
 # ---------------------------------------------------------------------------
 # 3. Host prerequisites (Docker, CRI-O, kubelet/kubeadm/kubectl, ...) via cluster.js

package/scripts/maas-setup.sh

@@ -18,14 +18,14 @@ cd /home/dd/engine
 underpost secret underpost --create-from-file /home/dd/engine/engine-private/conf/dd-cron/.env.production
 
 # Extract configuration values from secrets
-DB_PG_MAAS_USER=$(node bin config get --plain DB_PG_MAAS_USER)
-DB_PG_MAAS_PASS=$(node bin config get --plain DB_PG_MAAS_PASS)
-DB_PG_MAAS_HOST=$(node bin config get --plain DB_PG_MAAS_HOST)
-DB_PG_MAAS_NAME=$(node bin config get --plain DB_PG_MAAS_NAME)
-
-MAAS_ADMIN_USERNAME=$(node bin config get --plain MAAS_ADMIN_USERNAME)
-MAAS_ADMIN_EMAIL=$(node bin config get --plain MAAS_ADMIN_EMAIL)
-MAAS_ADMIN_PASS=$(node bin config get --plain MAAS_ADMIN_PASS)
+DB_PG_MAAS_USER=$(node bin host get --plain DB_PG_MAAS_USER)
+DB_PG_MAAS_PASS=$(node bin host get --plain DB_PG_MAAS_PASS)
+DB_PG_MAAS_HOST=$(node bin host get --plain DB_PG_MAAS_HOST)
+DB_PG_MAAS_NAME=$(node bin host get --plain DB_PG_MAAS_NAME)
+
+MAAS_ADMIN_USERNAME=$(node bin host get --plain MAAS_ADMIN_USERNAME)
+MAAS_ADMIN_EMAIL=$(node bin host get --plain MAAS_ADMIN_EMAIL)
+MAAS_ADMIN_PASS=$(node bin host get --plain MAAS_ADMIN_PASS)
 
 # Initialize MAAS region+rack controller
 maas init region+rack \