@underpostnet/cyberia 3.3.0 → 3.3.76

package/src/runtime/engine-cyberia/Dockerfile

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.3.0
+ARG UNDERPOST_VERSION=3.3.76
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0
@@ -14,7 +14,7 @@ ENV NODE_ENV=production
 
 RUN set -eux; \
     # `sudo` is required because underpost's build steps shell out to
-    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # `sudo cp`/`sudo rm` (src/server/runtime/start.js); the build runs as root so sudo
     # is just a passthrough, but the binary must exist.
     dnf install -y git openssl tar xz sudo; \
     arch="$(uname -m)"; \
@@ -26,10 +26,22 @@ RUN set -eux; \
     curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
       | tar -xJ -C /usr/local --strip-components=1; \
     node --version; npm --version; \
-    npm install -g underpost@${UNDERPOST_VERSION}; \
     dnf clean all; rm -rf /var/cache/dnf; \
     npm cache clean --force
 
+
+# The builder's own `underpost clone` calls below run on this same CLI, and the runtime stage
+# inherits it through `COPY --from=builder /usr/local/`.
+COPY underpost-cli.tgz /tmp/underpost-cli.tgz
+RUN set -eux; \
+    npm install -g /tmp/underpost-cli.tgz --omit=dev; \
+    rm -f /tmp/underpost-cli.tgz; \
+    npm cache clean --force; \
+    underpost --version; \
+    # The staged package must be the pinned release: a drift here would ship a CLI the
+    # deployment manifests were not built against.
+    underpost --version | grep -Fq "${UNDERPOST_VERSION}"
+
 WORKDIR /home/dd
 
 # Comma-separated instance codes to provision (backup dir + optional saga).
@@ -38,7 +50,7 @@ WORKDIR /home/dd
 # `--build-arg INSTANCE_CODES=...`. Declared as an ARG (not a marker-wrapped
 # shell string) so the value is clean — a `/** … */` literal in the shell would
 # glob-expand in the `for` loop below.
-ARG INSTANCE_CODES="amethyst-strata-expansion,FOREST"
+ARG INSTANCE_CODES="amethyst-strata-expansion,FOREST,TEST"
 
 RUN --mount=type=secret,id=github_username \
     # --mount=type=secret,id=github_token \
@@ -83,7 +95,7 @@ RUN --mount=type=secret,id=github_username \
     cd /home/dd/engine; \
     # --- install deps + env, then replay build-safe itc provisioning ----------
     npm install; \
-    node bin env dd-cyberia production; \
+    node bin app load --env production --args deploy-id=dd-cyberia; \
     ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
     # --- build the client bundle (assets are now in place) --------------------
     cd /home/dd/engine; \
@@ -136,11 +148,15 @@ COPY --from=builder /usr/local/ /usr/local/
 RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
     useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
     # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
-    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    # (src/server/runtime/start.js). Grant passwordless sudo so those succeed without a TTY/password.
     printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
-    # underpost persists its global env at $(npm root -g)/underpost/.env; the
-    # non-root runtime user must be able to write it (fixes EACCES on start).
-    chown -R dd:dd /usr/local/lib/node_modules/underpost
+    # underpost persists its global env and container state under
+    # `$(npm root -g)/underpost` (getUnderpostRootPath). That path is a STORE directory, not
+    # the CLI package tree: the staged package installs under its own package name, and
+    # `underpost start --build` re-links the bin at the pulled checkout without moving the
+    # store (src/server/runtime/start.js#linkRuntimeCli). Create it here — the non-root
+    # runtime user cannot mkdir inside /usr/local itself (EACCES on the first state write).
+    mkdir -p "$(npm root -g)/underpost" && chown -R dd:dd "$(npm root -g)/underpost"
 
 # Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
 COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine

package/src/runtime/engine-cyberia/Dockerfile.dev

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.3.0
+ARG UNDERPOST_VERSION=3.3.76
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0
@@ -14,7 +14,7 @@ ENV NODE_ENV=development
 
 RUN set -eux; \
     # `sudo` is required because underpost's build steps shell out to
-    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # `sudo cp`/`sudo rm` (src/server/runtime/start.js); the build runs as root so sudo
     # is just a passthrough, but the binary must exist.
     dnf install -y git openssl tar xz sudo; \
     arch="$(uname -m)"; \
@@ -26,10 +26,22 @@ RUN set -eux; \
     curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
       | tar -xJ -C /usr/local --strip-components=1; \
     node --version; npm --version; \
-    npm install -g underpost@${UNDERPOST_VERSION}; \
     dnf clean all; rm -rf /var/cache/dnf; \
     npm cache clean --force
 
+
+# The builder's own `underpost clone` calls below run on this same CLI, and the runtime stage
+# inherits it through `COPY --from=builder /usr/local/`.
+COPY underpost-cli.tgz /tmp/underpost-cli.tgz
+RUN set -eux; \
+    npm install -g /tmp/underpost-cli.tgz --omit=dev; \
+    rm -f /tmp/underpost-cli.tgz; \
+    npm cache clean --force; \
+    underpost --version; \
+    # The staged package must be the pinned release: a drift here would ship a CLI the
+    # deployment manifests were not built against.
+    underpost --version | grep -Fq "${UNDERPOST_VERSION}"
+
 WORKDIR /home/dd
 
 # Comma-separated instance codes to provision (backup dir + optional saga).
@@ -38,7 +50,7 @@ WORKDIR /home/dd
 # `--build-arg INSTANCE_CODES=...`. Declared as an ARG (not a marker-wrapped
 # shell string) so the value is clean — a `/** … */` literal in the shell would
 # glob-expand in the `for` loop below.
-ARG INSTANCE_CODES="amethyst-strata-expansion,FOREST"
+ARG INSTANCE_CODES="amethyst-strata-expansion,FOREST,TEST"
 
 RUN --mount=type=secret,id=github_username \
     # --mount=type=secret,id=github_token \
@@ -83,7 +95,7 @@ RUN --mount=type=secret,id=github_username \
     cd /home/dd/engine; \
     # --- install deps + env, then replay build-safe itc provisioning ----------
     npm install; \
-    node bin env dd-cyberia development; \
+    node bin app load --env development --args deploy-id=dd-cyberia; \
     ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
     # --- build the client bundle (assets are now in place) --------------------
     cd /home/dd/engine; \
@@ -136,11 +148,15 @@ COPY --from=builder /usr/local/ /usr/local/
 RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
     useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
     # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
-    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    # (src/server/runtime/start.js). Grant passwordless sudo so those succeed without a TTY/password.
     printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
-    # underpost persists its global env at $(npm root -g)/underpost/.env; the
-    # non-root runtime user must be able to write it (fixes EACCES on start).
-    chown -R dd:dd /usr/local/lib/node_modules/underpost
+    # underpost persists its global env and container state under
+    # `$(npm root -g)/underpost` (getUnderpostRootPath). That path is a STORE directory, not
+    # the CLI package tree: the staged package installs under its own package name, and
+    # `underpost start --build` re-links the bin at the pulled checkout without moving the
+    # store (src/server/runtime/start.js#linkRuntimeCli). Create it here — the non-root
+    # runtime user cannot mkdir inside /usr/local itself (EACCES on the first state write).
+    mkdir -p "$(npm root -g)/underpost" && chown -R dd:dd "$(npm root -g)/underpost"
 
 # Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
 COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine

package/src/runtime/engine-cyberia/Dockerfile.test

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.3.0
+ARG UNDERPOST_VERSION=3.3.76
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0
@@ -14,7 +14,7 @@ ENV NODE_ENV=development
 
 RUN set -eux; \
     # `sudo` is required because underpost's build steps shell out to
-    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # `sudo cp`/`sudo rm` (src/server/runtime/start.js); the build runs as root so sudo
     # is just a passthrough, but the binary must exist.
     dnf install -y git openssl tar xz sudo; \
     arch="$(uname -m)"; \
@@ -71,8 +71,8 @@ RUN --mount=type=secret,id=github_token \
     \
     # --- install deps + env, then replay build-safe itc provisioning ----------
     npm install; \
-    node bin env dd-cyberia development; \
-    node bin fs --pull --recursive --deploy-id dd-cyberia --storage-file-path './engine-private/conf/dd-cyberia/storage.engine-cyberia.json'; \
+    node bin app load --env development --args deploy-id=dd-cyberia; \
+    node bin fs --pull --tracked --deploy-id dd-cyberia --storage-id engine-cyberia; \
     ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
     ( cd /home/dd/engine && underpost clone underpostnet/cyberia-server ); \
     \
@@ -140,7 +140,7 @@ COPY --from=builder /usr/local/ /usr/local/
 RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
     useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
     # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
-    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    # (src/server/runtime/start.js). Grant passwordless sudo so those succeed without a TTY/password.
     printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
     # underpost persists its global env at $(npm root -g)/underpost/.env; the
     # non-root runtime user must be able to write it (fixes EACCES on start).

package/src/runtime/engine-cyberia/compose.env

@@ -43,25 +43,37 @@ VALKEY_PORT=6379
 # cyberia-server-* -> stable engine gateway for HTTP and the raw engine runtime
 # for gRPC. The public engine-cyberia name belongs to nginx, avoiding ambiguous
 # Docker DNS while keeping one stable HTTP endpoint for every module.
-ENGINE_API_BASE_URL=http://engine-cyberia
-ENGINE_GRPC_ADDRESS=engine-cyberia-runtime:50051
+CYBERIA_DATA_SERVER_URL=http://engine-cyberia
+CYBERIA_DATA_SERVER_GRPC=engine-cyberia-runtime:50051
 
 # Client-visible Content Authority origin, forwarded to browser/Raylib clients
 # for every engine-cyberia content/asset/metadata request. Host-reachable
 # (Docker publishes the raw engine runtime on host :4005). Unlike the internal
-# ENGINE_API_BASE_URL, this value is consumed outside the Compose network:
+# CYBERIA_DATA_SERVER_URL, this value is consumed outside the Compose network:
 # the two responsibilities must never overwrite each other.
 ENGINE_PUBLIC_URL=http://localhost:4005
 ENGINE_GRPC_RELOAD_INTERVAL_SEC=300
 
-# --- Browser-facing client runtime config (injected by docker-driver.py) -----
+# Shared secret between the engine and every game server. It guards the server
+# registry report (server -> engine) and the hot-reload trigger (engine ->
+# server). Unset disables both: a server then stays out of the public list.
+CYBERIA_SERVER_API_KEY=change_me_dev_server_api_key
+
+# Public origin of the server gateway. Each server reports this origin plus its
+# own sub-path, which is the URL a client dials.
+CYBERIA_SERVER_PUBLIC_ORIGIN=http://localhost:8081
+
+# --- Browser-facing client runtime config (injected by wasm-driver.py) -----
 # The single WASM bundle resolves its instance from the URL sub-path and builds
 # its endpoints from these origins. HTTP client/API traffic uses nginx on :80;
 # WebSocket traffic uses the dedicated multi-path server gateway on :8081.
 #   http://localhost/          -> default, ws://localhost:8081/ws
 #   http://localhost/FOREST    -> FOREST,  ws://localhost:8081/FOREST/ws
 CYBERIA_WS_ORIGIN=ws://localhost:8081
-CYBERIA_ENGINE_API_ORIGIN=http://localhost
+# The browser's own route to the Data Server, through nginx on :80. Distinct from the internal
+# CYBERIA_DATA_SERVER_URL above: both name a Data Server origin, but from opposite sides of the
+# Compose network, and one file cannot hold two values under one name.
+CYBERIA_CLIENT_DATA_SERVER_URL=http://localhost
 CYBERIA_DEFAULT_INSTANCE=amethyst-strata-expansion
 
 # cyberia-server logging. This is the dev stack, so default to DEBUG. Set

package/src/runtime/engine-cyberia/docker-compose.yml

@@ -135,7 +135,7 @@ services:
   # server starts but rejects connections until seeded). Serves REST/WS on 4005
   # and the engine gRPC data service on 50051.
   engine-cyberia-runtime:
-    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.3.0}
+    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.3.76}
     container_name: dd-cyberia-engine
     command:
       - /bin/sh
@@ -190,14 +190,16 @@ services:
   # gateway on host port 8081, so one port can route every instance path.
 
   cyberia-server-runtime:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.0}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.76}
     container_name: dd-cyberia-server
     environment:
       INSTANCE_CODE: amethyst-strata-expansion
       CYBERIA_BASE_PATH: /
-      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia}
+      CYBERIA_PUBLIC_URL: ${CYBERIA_SERVER_PUBLIC_ORIGIN:-http://localhost:8081}
+      CYBERIA_SERVER_API_KEY: ${CYBERIA_SERVER_API_KEY:-}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_DATA_SERVER_URL:-http://engine-cyberia}
       ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
-      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia-runtime:50051}
+      CYBERIA_DATA_SERVER_GRPC: ${CYBERIA_DATA_SERVER_GRPC:-engine-cyberia-runtime:50051}
       ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
@@ -226,14 +228,16 @@ services:
     restart: unless-stopped
 
   cyberia-server-forest:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.0}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.76}
     container_name: dd-cyberia-server-forest
     environment:
       INSTANCE_CODE: FOREST
       CYBERIA_BASE_PATH: /FOREST
-      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia}
+      CYBERIA_PUBLIC_URL: ${CYBERIA_SERVER_PUBLIC_ORIGIN:-http://localhost:8081}/FOREST
+      CYBERIA_SERVER_API_KEY: ${CYBERIA_SERVER_API_KEY:-}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_DATA_SERVER_URL:-http://engine-cyberia}
       ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
-      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia-runtime:50051}
+      CYBERIA_DATA_SERVER_GRPC: ${CYBERIA_DATA_SERVER_GRPC:-engine-cyberia-runtime:50051}
       ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
@@ -262,14 +266,16 @@ services:
     restart: unless-stopped
 
   cyberia-server-test:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.0}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.76}
     container_name: dd-cyberia-server-test
     environment:
       INSTANCE_CODE: TEST
       CYBERIA_BASE_PATH: /TEST
-      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia}
+      CYBERIA_PUBLIC_URL: ${CYBERIA_SERVER_PUBLIC_ORIGIN:-http://localhost:8081}/TEST
+      CYBERIA_SERVER_API_KEY: ${CYBERIA_SERVER_API_KEY:-}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_DATA_SERVER_URL:-http://engine-cyberia}
       ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
-      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia-runtime:50051}
+      CYBERIA_DATA_SERVER_GRPC: ${CYBERIA_DATA_SERVER_GRPC:-engine-cyberia-runtime:50051}
       ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
@@ -299,7 +305,7 @@ services:
 
   # === Tier 4: presentation, one per variant ===============================
   # One WASM bundle serves every variant; the instance is resolved from the URL
-  # sub-path (docker-driver injects CYBERIA_BASE_PATH / _WS_ORIGIN /
+  # sub-path (wasm-driver injects CYBERIA_BASE_PATH / _WS_ORIGIN /
   # _ENGINE_API_ORIGIN / _DEFAULT_INSTANCE). Each client waits ONLY for its own
   # server, so the three
   # server->client pipelines advance independently (in parallel) once the shared
@@ -309,7 +315,7 @@ services:
   #   cyberia-server-test   -> cyberia-client-test
 
   cyberia-client-runtime:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.0}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.76}
     container_name: dd-cyberia-client
     environment:
       CYBERIA_PORT: '8081'
@@ -317,7 +323,7 @@ services:
       CYBERIA_BASE_PATH: /
       CYBERIA_DEFAULT_INSTANCE: ${CYBERIA_DEFAULT_INSTANCE:-amethyst-strata-expansion}
       CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://localhost:8081}
-      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://localhost}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_CLIENT_DATA_SERVER_URL:-http://localhost}
     networks:
       - dd-cyberia-internal
     expose:
@@ -334,7 +340,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-forest:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.0}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.76}
     container_name: dd-cyberia-client-forest
     environment:
       CYBERIA_PORT: '8081'
@@ -342,7 +348,7 @@ services:
       CYBERIA_BASE_PATH: /FOREST
       CYBERIA_DEFAULT_INSTANCE: ${CYBERIA_DEFAULT_INSTANCE:-amethyst-strata-expansion}
       CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://localhost:8081}
-      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://localhost}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_CLIENT_DATA_SERVER_URL:-http://localhost}
     networks:
       - dd-cyberia-internal
     expose:
@@ -359,7 +365,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-test:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.0}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.76}
     container_name: dd-cyberia-client-test
     environment:
       CYBERIA_PORT: '8081'
@@ -367,7 +373,7 @@ services:
       CYBERIA_BASE_PATH: /TEST
       CYBERIA_DEFAULT_INSTANCE: ${CYBERIA_DEFAULT_INSTANCE:-amethyst-strata-expansion}
       CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://localhost:8081}
-      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://localhost}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_CLIENT_DATA_SERVER_URL:-http://localhost}
     networks:
       - dd-cyberia-internal
     expose:

package/src/runtime/express/Express.js

@@ -12,18 +12,19 @@ import swaggerUi from 'swagger-ui-express';
 import compression from 'compression';
 import { createServer } from 'http';
 
-import { loggerFactory, loggerMiddleware } from '../../server/logger.js';
+import { loggerFactory, loggerMiddleware } from '../../server/ops/logger.js';
 import { getCapVariableName, newInstance } from '../../client/components/core/CommonJs.js';
 import { MailerProvider } from '../../mailer/MailerProvider.js';
 import { DataBaseProviderService } from '../../db/DataBaseProvider.js';
-import { createPeerServer } from '../../server/peer.js';
-import { createValkeyConnection } from '../../server/valkey.js';
-import { applySecurity, authMiddlewareFactory } from '../../server/auth.js';
+import { createPeerServer } from '../../server/network/peer.js';
+import { createValkeyConnection } from '../../db/valkey/Valkey.js';
+import { applySecurity, authMiddlewareFactory } from '../../server/security/auth.js';
 import { ssrMiddlewareFactory } from '../../client-builder/ssr.js';
 import { buildSwaggerUiOptions } from '../../client-builder/client-build-docs.js';
 
-import { shellExec } from '../../server/process.js';
-import { devProxyHostFactory, isDevProxyContext, isTlsDevProxy } from '../../server/conf.js';
+import { shellExec } from '../../server/runtime/process.js';
+import { devProxyHostFactory, isDevProxyContext, isTlsDevProxy } from '../../server/runtime/conf.js';
+import { metricsPathFactory } from '../../server/ops/monitoring.js';
 
 import Underpost from '../../index.js';
 
@@ -113,8 +114,9 @@ class ExpressService {
       return next();
     });
 
-    // Metrics endpoint
-    app.get(`${path === '/' ? '' : path}/metrics`, async (req, res) => {
+    // Metrics endpoint. The route is shared with the Prometheus scrape config
+    // so a target can never point at a path this server does not serve.
+    app.get(metricsPathFactory(path), async (req, res) => {
       res.set('Content-Type', promRegister.contentType);
       return res.end(await promRegister.metrics());
     });
@@ -163,19 +165,22 @@ class ExpressService {
     // Create HTTP server for regular instances (required for WebSockets)
     const server = createServer({}, app);
 
-    if (!apiBaseHost) {
-      // Swagger path definition
-      const swaggerJsonPath = `./public/${host}${path === '/' ? path : `${path}/`}swagger-output.json`;
-      const swaggerPath = `${path === '/' ? `/api-docs` : `${path}/api-docs`}`;
-
-      // Flag swagger requests before security middleware
-      if (fs.existsSync(swaggerJsonPath)) {
-        app.use(swaggerPath, (req, res, next) => {
-          res.locals.isSwagger = true;
-          next();
-        });
-      }
+    // Swagger path definition. The UI is served by every instance that renders the
+    // client, so a split client/API deployment keeps `api-docs` same-origin with the
+    // page that frames it.
+    const swaggerJsonPath = `./public/${host}${path === '/' ? path : `${path}/`}swagger-output.json`;
+    const swaggerPath = `${path === '/' ? `/api-docs` : `${path}/api-docs`}`;
+    const swaggerEnabled = fs.existsSync(swaggerJsonPath);
+
+    // Flag swagger requests before security middleware
+    if (swaggerEnabled) {
+      app.use(swaggerPath, (req, res, next) => {
+        res.locals.isSwagger = true;
+        next();
+      });
+    }
 
+    if (!apiBaseHost) {
       // Security and CORS — must run before swagger-ui so CSP headers are included in swagger responses
       if (process.env.NODE_ENV === 'development' && useLocalSsl)
         origins = origins.map((origin) => origin.replace('http', 'https'));
@@ -184,13 +189,6 @@ class ExpressService {
         origin: origins,
       });
 
-      // Swagger UI setup (after security middleware so responses carry correct CSP headers)
-      if (fs.existsSync(swaggerJsonPath)) {
-        const swaggerDoc = JSON.parse(fs.readFileSync(swaggerJsonPath, 'utf8'));
-        const swaggerUiOptions = await buildSwaggerUiOptions();
-        app.use(swaggerPath, swaggerUi.serve, swaggerUi.setup(swaggerDoc, swaggerUiOptions));
-      }
-
       // Database and Valkey connections
       if (db && apis) await DataBaseProviderService.load({ apis, host, path, db });
 
@@ -261,6 +259,13 @@ class ExpressService {
       }
     }
 
+    // Swagger UI setup (after security middleware so responses carry correct CSP headers)
+    if (swaggerEnabled) {
+      const swaggerDoc = JSON.parse(fs.readFileSync(swaggerJsonPath, 'utf8'));
+      const swaggerUiOptions = await buildSwaggerUiOptions();
+      app.use(swaggerPath, swaggerUi.serve, swaggerUi.setup(swaggerDoc, swaggerUiOptions));
+    }
+
     // SSR middleware loading
     const ssr = await ssrMiddlewareFactory({ app, directory, rootHostPath, path });
     for (const [_, ssrMiddleware] of Object.entries(ssr)) app.use(ssrMiddleware);

package/src/runtime/lampp/Lampp.js

@@ -6,8 +6,9 @@
  */
 
 import fs from 'fs-extra';
-import { getRootDirectory, shellCd, shellExec } from '../../server/process.js';
-import { loggerFactory } from '../../server/logger.js';
+import { getRootDirectory, shellCd, shellExec } from '../../server/runtime/process.js';
+import { loggerFactory } from '../../server/ops/logger.js';
+import Underpost from '../../index.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -71,12 +72,8 @@ class LamppService {
    * @memberof LamppService
    */
   async initService(options = { daemon: false }) {
-    let cmd;
-
-    // 1. Write the current virtual host router configuration
     fs.writeFileSync(`/opt/lampp/etc/extra/httpd-vhosts.conf`, this.router || '', 'utf8');
 
-    // 2. Ensure the vhosts file is included in the main httpd.conf
     const httpdConfPath = `/opt/lampp/etc/httpd.conf`;
     fs.writeFileSync(
       httpdConfPath,
@@ -86,12 +83,9 @@ class LamppService {
       'utf8',
     );
 
-    // 3. Stop the service before making port changes
-    cmd = `sudo /opt/lampp/lampp stop`;
-    shellExec(cmd);
+    shellExec(`sudo /opt/lampp/lampp stop`);
 
-    // 4. Comment out default port Listen directives (80 and 443) to prevent conflicts
-    // Modify httpd.conf (port 80)
+    // Every vhost declares its own Listen, so the stock 80/443 directives would double-bind.
     if (!fs.readFileSync(httpdConfPath, 'utf8').match(/# Listen 80/))
       fs.writeFileSync(
         httpdConfPath,
@@ -99,7 +93,6 @@ class LamppService {
         'utf8',
       );
 
-    // Modify httpd-ssl.conf (port 443)
     const httpdSslConfPath = `/opt/lampp/etc/extra/httpd-ssl.conf`;
     if (fs.existsSync(httpdSslConfPath) && !fs.readFileSync(httpdSslConfPath, 'utf8').match(/# Listen 443/))
       fs.writeFileSync(
@@ -108,7 +101,8 @@ class LamppService {
         'utf8',
       );
 
-    // 5. Modify the lampp startup script to bypass port checking for 80 and 443
+    // The startup script aborts when 80/443 are already held by the ingress proxy; short-circuit
+    // its probes so the service still comes up behind one.
     const lamppScriptPath = `/opt/lampp/lampp`;
     if (!fs.readFileSync(lamppScriptPath, 'utf8').match(/testport 443 && false/))
       fs.writeFileSync(
@@ -123,9 +117,7 @@ class LamppService {
         'utf8',
       );
 
-    // 6. Start the service
-    cmd = `sudo /opt/lampp/lampp start`;
-    shellExec(cmd);
+    shellExec(`sudo /opt/lampp/lampp start`);
   }
 
   /**
@@ -217,13 +209,15 @@ class LamppService {
    * @param {string} options.path - The base path for error documents (e.g., '/app').
    * @param {string} [options.directory] - Optional absolute path to the document root.
    * @param {string} [options.rootHostPath] - Relative path from the root directory to the document root, used if `directory` is not provided.
+   * @param {string} [options.repository] - Repository backing the document root. Each conf route
+   *   declares its own, so one host serves as many repositories as it has routes.
    * @param {boolean} [options.redirect] - If true, enables RewriteEngine for redirection.
    * @param {string} [options.redirectTarget] - The target URL for redirection.
    * @param {boolean} [options.resetRouter] - If true, clears the existing router configuration before appending the new one.
    * @returns {{disabled: boolean}} An object indicating if the service is disabled.
    * @memberof LamppService
    */
-  createApp({ port, host, path, directory, rootHostPath, redirect, redirectTarget, resetRouter }) {
+  createApp({ port, host, path, directory, rootHostPath, repository, redirect, redirectTarget, resetRouter }) {
     if (!this.enabled()) return { disabled: true };
 
     if (!this.ports.includes(port)) this.ports.push(port);
@@ -231,7 +225,17 @@ class LamppService {
 
     const documentRoot = directory ? directory : `${getRootDirectory()}${rootHostPath}`;
 
-    // Append the new VirtualHost configuration
+    if (repository) {
+      const { accessible } = Underpost.repo.provisionSiteRoot({ host, siteRoot: documentRoot, repository });
+      // The checkout keeps its `.git` so the backup pipeline can commit and push it back; the
+      // vhost below denies it over HTTP.
+      if (accessible) Underpost.repo.initLocalRepo({ path: documentRoot, origin: repository });
+      // The vhost is still emitted, so the host answers rather than vanishing from the router —
+      // but Apache cannot stat a DocumentRoot that was never created and turns every request into
+      // a blanket 403. Named here, because that 403 carries nothing pointing back at this step.
+      else logger.error(`${host}: ${documentRoot} not provisioned — this vhost will answer 403 until it is`);
+    }
+
     this.appendRouter(`
 Listen ${port}
 
@@ -305,55 +309,3 @@ Listen ${port}
 const Lampp = new LamppService();
 
 export { Lampp };
-
-// -- helper info --
-
-// ERR too many redirects:
-// Check: SELECT * FROM database.wp_options where option_name = 'siteurl' or option_name = 'home';
-// Check: wp-config.php
-// if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
-//   $_SERVER['HTTPS'] = 'on';
-// }
-// For plugins:
-// define( 'FS_METHOD', 'direct' );
-
-// ErrorDocument 404 /custom_404.html
-// ErrorDocument 500 /custom_50x.html
-// ErrorDocument 502 /custom_50x.html
-// ErrorDocument 503 /custom_50x.html
-// ErrorDocument 504 /custom_50x.html
-
-// Respond When Error Pages are Directly Requested
-
-// <Files "custom_404.html">
-//     <If "-z %{ENV:REDIRECT_STATUS}">
-//         RedirectMatch 404 ^/custom_404.html$
-//     </If>
-// </Files>
-
-// <Files "custom_50x.html">
-//     <If "-z %{ENV:REDIRECT_STATUS}">
-//         RedirectMatch 404 ^/custom_50x.html$
-//     </If>
-// </Files>
-
-// Add www or https with htaccess rewrite
-
-// Options +FollowSymLinks
-// RewriteEngine On
-// RewriteCond %{HTTP_HOST} ^example.com [NC]
-// RewriteRule ^(.*)$ http://example.com/$1 [R=301,L]
-
-// Redirect http to https with htaccess rewrite
-
-// RewriteEngine On
-// RewriteCond %{SERVER_PORT} 80
-// RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
-
-// Redirect to HTTPS with www subdomain
-
-// RewriteEngine On
-// RewriteCond %{HTTPS} off [OR]
-// RewriteCond %{HTTP_HOST} ^www\. [NC]
-// RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
-// RewriteRule ^ https://%1%{REQUEST_URI} [L,NE,R=301]

package/src/runtime/nginx/Nginx.js

@@ -9,7 +9,7 @@
 
 import fs from 'fs-extra';
 import path from 'path';
-import { loggerFactory } from '../../server/logger.js';
+import { loggerFactory } from '../../server/ops/logger.js';
 
 const logger = loggerFactory(import.meta);