cyberia 3.2.12 → 3.2.70

package/src/runtime/engine-cyberia/compose.env

@@ -0,0 +1,131 @@
+# Working env-file for the Cyberia ecosystem compose stack (custom workflow).
+# Used as-is by the CLI (not generated). Set real credentials here, then run:
+#   underpost docker-compose --up --deploy-id dd-cyberia --docker-compose-id cyberia
+#
+# Loaded explicitly via --env-file so container service-discovery values (the
+# Docker network hostnames below) are not overridden by any host-local .env.
+
+# --- Ecosystem images (dev variants, published by docker-image.*.dev.ci.yml) --
+# This stack is development-only, so it uses the `-dev` images built from the
+# Dockerfile.dev variants (debug builds + live-inspection tooling).
+MONGO_IMAGE=mongo:latest
+VALKEY_IMAGE=valkey/valkey:latest
+ENGINE_CYBERIA_IMAGE=underpost/engine-cyberia-dev
+ENGINE_CYBERIA_TAG=v3.2.70
+CYBERIA_SERVER_IMAGE=underpost/cyberia-server-dev
+CYBERIA_SERVER_TAG=v3.2.70
+CYBERIA_CLIENT_IMAGE=underpost/cyberia-client-dev
+CYBERIA_CLIENT_TAG=v3.2.70
+PROXY_IMAGE=nginx:stable-alpine
+IPFS_IMAGE=ipfs/kubo:latest
+IPFS_CLUSTER_IMAGE=ipfs/ipfs-cluster:latest
+
+# --- Private-repo bootstrap (engine-cyberia clones the private dd-cyberia conf) -
+# The engine-cyberia image ships only the underpost CLI; at start it runs the
+# `underpost start --build` bootstrap, which clones ${GITHUB_USERNAME}/engine-cyberia.
+GITHUB_USERNAME=underpostnet
+GITHUB_TOKEN=change_me_private_repo_token
+
+# --- MongoDB (translation of Secret mongodb-secret) --------------------------
+MONGO_INITDB_ROOT_USERNAME=admin
+MONGO_INITDB_ROOT_PASSWORD=change_me_dev_password
+
+# --- Application DB / cache connection (Docker service discovery, not localhost)
+NODE_ENV=development
+DB_PROVIDER=mongoose
+DB_HOST=mongodb://mongodb:27017
+DB_REPLICA_SET=rs0
+DB_AUTH_SOURCE=admin
+VALKEY_HOST=valkey-service
+VALKEY_PORT=6379
+
+# --- Cyberia instance wiring (compose service DNS) ---------------------------
+# cyberia-server -> engine-cyberia authority endpoints. INTERNAL only: these use
+# the docker service DNS (engine-cyberia) and must never leak to browser clients.
+INSTANCE_CODE=amethyst-strata-expansion
+ENGINE_API_BASE_URL=http://engine-cyberia:4005
+ENGINE_GRPC_ADDRESS=engine-cyberia:50051
+
+# Client-visible Content Authority origin, forwarded to browser/Raylib clients
+# for every engine-cyberia content/asset/metadata request. Host-reachable
+# (docker publishes engine-cyberia :4005). Distinct from ENGINE_API_BASE_URL:
+# the two responsibilities must never overwrite each other.
+ENGINE_PUBLIC_URL=http://localhost:4005
+ENGINE_GRPC_RELOAD_INTERVAL_SEC=300
+
+# cyberia-server logging. This is the dev stack, so default to DEBUG. Set
+# CYBERIA_SERVER_LOG_LEVEL (debug|info|warn|error) to override the APP_ENV
+# fallback without touching APP_ENV.
+CYBERIA_SERVER_APP_ENV=development
+CYBERIA_SERVER_LOG_LEVEL=
+
+# --- engine-cyberia runtime env (loaded into the container via env_file) -----
+# The dd-cyberia engine (engine-private/conf/dd-cyberia/conf.server.json) needs
+# these to boot: DB auth + per-site DB names, the base PORT (the cyberia host is
+# assigned PORT+1 = 4005, which the healthcheck/nginx target), JWT, and mailer.
+# Secrets are DEV PLACEHOLDERS — no real credentials ship in the public image.
+PORT=4004
+NODE_OPTIONS=--max-old-space-size=8192
+BASE_API=api
+DEFAULT_DEPLOY_ID=dd-cyberia
+DEPLOY_ID=dd-cyberia
+DEFAULT_DEPLOY_HOST=www.cyberiaonline.com
+DEFAULT_DEPLOY_PATH=/
+DISABLE_API_RATE_LIMIT=true
+DOTENV_CONFIG_QUIET=true
+ACCESS_EXPIRE_MINUTES=1440
+REFRESH_EXPIRE_MINUTES=5
+DEV_PROXY_PORT_OFFSET=0
+JWT_SECRET=change_me_dev_jwt_secret
+
+# DB auth (must match the MONGO_INITDB_ROOT_* creds above) + per-site DB names.
+DB_USER=admin
+DB_PASSWORD=change_me_dev_password
+
+DB_NAME_CYBERIA=cyberia
+
+# Mailer / SMTP (dev placeholders — mailer stays inert without real creds).
+MAILER_SENDER_NAME=CYBERIA
+MAILER_SENDER_EMAIL=noreply@example.com
+SMTP_HOST=smtp.example.com
+SMTP_PORT=465
+SMTP_AUTH_USER=change_me
+SMTP_AUTH_PASS=change_me
+MAILER_SENDER_NAME_CYBERIA=CYBERIA
+MAILER_SENDER_EMAIL_CYBERIA=noreply@example.com
+SMTP_HOST_CYBERIA=smtp.example.com
+SMTP_PORT_CYBERIA=465
+SMTP_AUTH_USER_CYBERIA=change_me
+SMTP_AUTH_PASS_CYBERIA=change_me
+
+# Third-party integrations (dev placeholders).
+CLOUDINARY_CLOUD_NAME=change_me
+CLOUDINARY_API_KEY=change_me
+CLOUDINARY_API_SECRET=change_me
+GEMINI_API_KEY=change_me
+HUGGINGFACE_API_KEY=change_me
+DEFAULT_ADMIN_EMAIL=admin@example.com
+DEFAULT_ADMIN_PASSWORD=change_me
+
+# --- IPFS endpoints ----------------------------------------------------------
+# Kubo (content plane) is the `ipfs` service; the Cluster REST API (:9094, pin
+# replication) is the `ipfs-cluster` service. Override only to target a
+# different node.
+IPFS_API_URL=http://ipfs:5001
+IPFS_GATEWAY_URL=http://ipfs:8080
+IPFS_CLUSTER_API_URL=http://ipfs-cluster:9094
+# 32-byte hex shared secret for the ipfs-cluster consensus (dev default is set
+# in docker-compose.yml). Override for a real/shared cluster.
+# CLUSTER_SECRET=
+
+# --- Host-published ports ----------------------------------------------------
+PROXY_HTTP_PORT=80
+IPFS_API_PORT=5001
+IPFS_GATEWAY_PORT=8080
+IPFS_CLUSTER_API_PORT=9094
+MONGO_HOST_PORT=27017
+VALKEY_NODEPORT=32079
+ENGINE_CYBERIA_REST_PORT=4005
+ENGINE_CYBERIA_GRPC_PORT=50051
+CYBERIA_SERVER_PORT=8081
+CYBERIA_CLIENT_PORT=8082

package/src/runtime/engine-cyberia/docker-compose.yml

@@ -0,0 +1,316 @@
+# Cyberia ecosystem Docker Compose stack — canonical custom workflow.
+#
+# Orchestrates the entire Cyberia MMORPG on the underpost platform base
+# (MongoDB + Valkey), then replaces the default engine template with the Cyberia
+# content-authority engine and its two custom instances, fronted by an nginx
+# reverse proxy — the same topology as the root docker-compose.yml, specialized
+# for the dd-cyberia deploy.
+#
+# Canonical location (custom docker-compose workflow):
+#   engine-private/conf/dd-cyberia/docker-compose/cyberia/
+#     ├── docker-compose.yml   (this file)
+#     ├── compose.env          (working env-file, used as-is — not generated)
+#     ├── nginx.conf           (reverse-proxy config, used as-is — not generated)
+#     └── mongodb/entrypoint.sh (only generated infra: replica-set bootstrap)
+# All bind mounts below are relative to this directory: the CLI runs compose
+# with `--project-directory` pinned here (see src/cli/docker-compose.js).
+#
+# Architecture boundaries (see CLAUDE.md "Cyberia architecture boundaries"):
+#   engine-cyberia  — content, validation, persistence, gRPC(:50051)+REST(:4005)
+#                     data services, asset metadata. The authority layer.
+#   cyberia-server  — authoritative real-time simulation / tick processing (Go).
+#   cyberia-client  — rendering, input, prediction, presentation (WASM bundle).
+#
+# Usage:
+#   underpost docker-compose --up --deploy-id dd-cyberia --docker-compose-id cyberia
+#   (or the docker:cyberia:* npm scripts). The engine-cyberia image bakes the
+#   dd-cyberia build at image-build time, so no private-repo credentials are
+#   required at container start.
+
+name: dd-cyberia
+
+services:
+  # --- MongoDB -------------------------------------------------------------
+  # Identical bootstrap to the root docker-compose.yml: replSet rs0, keyFile
+  # cluster auth, replica-set + root-user init over the loopback localhost
+  # exception. Uses ./mongodb/entrypoint.sh, generated into this canonical dir
+  # by `underpost docker-compose --generate --docker-compose-id cyberia ...`.
+  mongodb:
+    image: ${MONGO_IMAGE:-mongo:latest}
+    container_name: dd-cyberia-mongodb
+    entrypoint: ['bash', '/docker-init/entrypoint.sh']
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: ${MONGO_INITDB_ROOT_USERNAME:?set MONGO_INITDB_ROOT_USERNAME in compose.env}
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD:?set MONGO_INITDB_ROOT_PASSWORD in compose.env}
+      DB_REPLICA_SET: ${DB_REPLICA_SET:-rs0}
+    volumes:
+      - ./mongodb:/docker-init:ro
+      - mongodb-keyfile:/opt/keyfile
+      - mongodb-data:/data/db
+    networks:
+      - dd-cyberia-internal
+    expose:
+      - '27017'
+    ports:
+      - '${MONGO_HOST_PORT:-27017}:27017'
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >
+          mongosh --quiet -u "$$MONGO_INITDB_ROOT_USERNAME" -p "$$MONGO_INITDB_ROOT_PASSWORD"
+          --authenticationDatabase admin --eval "db.hello().isWritablePrimary" | grep -q true
+      interval: 10s
+      timeout: 5s
+      retries: 20
+      start_period: 60s
+    restart: unless-stopped
+
+  # --- Valkey --------------------------------------------------------------
+  valkey-service:
+    image: ${VALKEY_IMAGE:-valkey/valkey:latest}
+    container_name: dd-cyberia-valkey
+    command: ['valkey-server', '--port', '6379', '--bind', '0.0.0.0', '--protected-mode', 'no']
+    volumes:
+      - valkey-data:/data
+    networks:
+      - dd-cyberia-internal
+    expose:
+      - '6379'
+    ports:
+      - '${VALKEY_NODEPORT:-32079}:6379'
+    healthcheck:
+      test: ['CMD', 'valkey-cli', '-p', '6379', 'ping']
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+    restart: unless-stopped
+
+  # --- IPFS (Kubo daemon) --------------------------------------------------
+  # Content plane: add / pin / cat / files (MFS). The engine reaches it at
+  # http://ipfs:5001 (RPC) and http://ipfs:8080 (gateway) via the
+  # IPFS_API_URL / IPFS_GATEWAY_URL overrides in compose.env. The init hook
+  # binds the API/gateway to 0.0.0.0 (default is loopback-only) so both the
+  # engine and the ipfs-cluster service can reach the daemon.
+  ipfs:
+    image: ${IPFS_IMAGE:-ipfs/kubo:latest}
+    container_name: dd-cyberia-ipfs
+    volumes:
+      - ./ipfs/configure-ipfs.sh:/container-init.d/001-configure-ipfs.sh:ro
+      - ipfs-data:/data/ipfs
+    networks:
+      - dd-cyberia-internal
+    expose:
+      - '5001'
+      - '8080'
+      - '4001'
+    ports:
+      - '${IPFS_API_PORT:-5001}:5001'
+      - '${IPFS_GATEWAY_PORT:-8080}:8080'
+    healthcheck:
+      test: ['CMD-SHELL', 'ipfs --api=/ip4/127.0.0.1/tcp/5001 id >/dev/null 2>&1 || exit 1']
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 40s
+    restart: unless-stopped
+
+  # --- IPFS Cluster (pin orchestration) ------------------------------------
+  # Single-node dev equivalent of manifests/ipfs (StatefulSet ipfs-cluster).
+  # Serves the Cluster REST API on :9094 (ipfs-client.js IPFS_CLUSTER_API_URL);
+  # the engine POSTs /pins/<cid> here to replicate pins. It drives the shared
+  # Kubo daemon above via CLUSTER_IPFSHTTP_NODEMULTIADDRESS and starts only once
+  # Kubo is healthy, so the engine (which waits for this service to be healthy)
+  # never races an unreachable cluster.
+  ipfs-cluster:
+    image: ${IPFS_CLUSTER_IMAGE:-ipfs/ipfs-cluster:latest}
+    container_name: dd-cyberia-ipfs-cluster
+    depends_on:
+      ipfs:
+        condition: service_healthy
+    environment:
+      CLUSTER_PEERNAME: dd-cyberia-cluster
+      # 32-byte hex shared secret. Fixed dev default keeps the cluster identity
+      # stable across restarts; override in compose.env for anything shared.
+      CLUSTER_SECRET: ${CLUSTER_SECRET:-0e1d2c3b4a59687778695a4b3c2d1e0f0e1d2c3b4a59687778695a4b3c2d1e0f}
+      CLUSTER_IPFSHTTP_NODEMULTIADDRESS: /dns4/ipfs/tcp/5001
+      CLUSTER_RESTAPI_HTTPLISTENMULTIADDRESS: /ip4/0.0.0.0/tcp/9094
+      CLUSTER_CRDT_TRUSTEDPEERS: '*'
+    volumes:
+      - ipfs-cluster-data:/data/ipfs-cluster
+    networks:
+      - dd-cyberia-internal
+    expose:
+      - '9094'
+      - '9096'
+    ports:
+      - '${IPFS_CLUSTER_API_PORT:-9094}:9094'
+    healthcheck:
+      test: ['CMD-SHELL', 'ipfs-cluster-ctl --host /ip4/127.0.0.1/tcp/9094 id >/dev/null 2>&1 || exit 1']
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 40s
+    restart: unless-stopped
+
+  # --- engine-cyberia (content authority) ----------------------------------
+  # The underpost Node engine for deploy dd-cyberia. The image bakes the
+  # dd-cyberia build at image-build time (see src/runtime/engine-cyberia/
+  # Dockerfile), so the container start only runs `underpost start --run`.
+  # Serves the portal/REST/WS on 4005 and the engine gRPC data service on
+  # 50051 (conf.server.json www.cyberiaonline.com.grpc).
+  engine-cyberia:
+    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.2.70}
+    container_name: dd-cyberia-engine
+    command:
+      - /bin/sh
+      - -c
+      - >
+        node bin/cyberia ol --drop &&
+        node bin/cyberia run-workflow drop-db &&
+        node bin/cyberia instance amethyst-strata-expansion --import &&
+        underpost start --run dd-cyberia development
+    env_file:
+      - ./compose.env
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      DB_PROVIDER: ${DB_PROVIDER:-mongoose}
+      DB_HOST: ${DB_HOST:-mongodb://mongodb:27017}
+      DB_REPLICA_SET: ${DB_REPLICA_SET:-rs0}
+      DB_AUTH_SOURCE: ${DB_AUTH_SOURCE:-admin}
+      DB_USER: ${MONGO_INITDB_ROOT_USERNAME:?}
+      DB_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD:?}
+      VALKEY_HOST: ${VALKEY_HOST:-valkey-service}
+      VALKEY_PORT: ${VALKEY_PORT:-6379}
+    networks:
+      - dd-cyberia-internal
+    expose:
+      - '4005'
+      - '50051'
+    ports:
+      - '${ENGINE_CYBERIA_REST_PORT:-4005}:4005'
+      - '${ENGINE_CYBERIA_GRPC_PORT:-50051}:50051'
+    healthcheck:
+      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/4005' || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      # The dd-cyberia build is baked into the image; start just runs the
+      # engine, so a moderate start_period covers DB connect + listen.
+      start_period: 120s
+    depends_on:
+      mongodb:
+        condition: service_healthy
+      valkey-service:
+        condition: service_healthy
+      ipfs:
+        condition: service_healthy
+      ipfs-cluster:
+        condition: service_healthy
+    restart: unless-stopped
+
+  # --- cyberia-server (authoritative simulation) ---------------------------
+  # Go MMO runtime. Reads the engine authority endpoints from the environment
+  # (compose service DNS) instead of the K8s {{grpc-service-dns}} template used
+  # in conf.instances.json. Uses the published image's default ENTRYPOINT.
+  cyberia-server:
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.70}
+    container_name: dd-cyberia-server
+    environment:
+      INSTANCE_CODE: ${INSTANCE_CODE:-FOREST}
+      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia:4005}
+      ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
+      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia:50051}
+      ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
+      STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
+      APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
+      LOG_LEVEL: ${CYBERIA_SERVER_LOG_LEVEL:-}
+    networks:
+      - dd-cyberia-internal
+    expose:
+      - '8081'
+    ports:
+      - '${CYBERIA_SERVER_PORT:-8081}:8081'
+    healthcheck:
+      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/8081' || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    depends_on:
+      engine-cyberia:
+        condition: service_healthy
+    restart: unless-stopped
+
+  # --- cyberia-client (presentation) ---------------------------------------
+  # Python static-file server for the pre-built WASM bundle. The -dev image's
+  # docker-driver.py defaults to CYBERIA_PORT=8082; override to 8081 so the whole
+  # ecosystem (nginx upstream, healthcheck) stays on a single internal port.
+  cyberia-client:
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.70}
+    container_name: dd-cyberia-client
+    environment:
+      CYBERIA_PORT: '8081'
+    networks:
+      - dd-cyberia-internal
+    expose:
+      - '8081'
+    ports:
+      - '${CYBERIA_CLIENT_PORT:-8082}:8081'
+    healthcheck:
+      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/8081' || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    # Last stage of the sequential chain: only start once cyberia-server is
+    # healthy (which itself gates on engine-cyberia -> mongodb/valkey).
+    depends_on:
+      cyberia-server:
+        condition: service_healthy
+    restart: unless-stopped
+
+  # --- Reverse proxy -------------------------------------------------------
+  # Routes the three cyberiaonline.com hosts to their upstreams with websocket
+  # upgrade support. Config source of truth: ./nginx.conf (this dir).
+  proxy:
+    image: ${PROXY_IMAGE:-nginx:stable-alpine}
+    container_name: dd-cyberia-proxy
+    volumes:
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    networks:
+      - dd-cyberia-internal
+    ports:
+      - '${PROXY_HTTP_PORT:-80}:80'
+    healthcheck:
+      test: ['CMD', 'wget', '-q', '-O', '-', 'http://127.0.0.1/healthz']
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    # Fronts the stack only after every tier reports healthy.
+    depends_on:
+      engine-cyberia:
+        condition: service_healthy
+      cyberia-server:
+        condition: service_healthy
+      cyberia-client:
+        condition: service_healthy
+    restart: unless-stopped
+
+networks:
+  dd-cyberia-internal:
+    name: dd-cyberia-internal
+    driver: bridge
+
+volumes:
+  mongodb-data:
+    name: dd-cyberia-mongodb-data
+  mongodb-keyfile:
+    name: dd-cyberia-mongodb-keyfile
+  valkey-data:
+    name: dd-cyberia-valkey-data
+  ipfs-data:
+    name: dd-cyberia-ipfs-data
+  ipfs-cluster-data:
+    name: dd-cyberia-ipfs-cluster-data

package/src/runtime/engine-cyberia/ipfs/configure-ipfs.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# Kubo /container-init.d hook — runs after `ipfs init`, before the daemon starts.
+# Compose equivalent of the Addresses/Datastore config in manifests/ipfs
+# configmap.yaml (configure-ipfs.sh). Binds the RPC API (5001) and gateway
+# (8080) to all interfaces so the engine and ipfs-cluster containers can reach
+# the daemon at http://ipfs:5001 (ipfs-client.js IPFS_API_URL).
+set -e
+
+ipfs config Addresses.API /ip4/0.0.0.0/tcp/5001
+ipfs config Addresses.Gateway /ip4/0.0.0.0/tcp/8080
+ipfs config --json Swarm.ConnMgr.HighWater 2000
+ipfs config --json Datastore.BloomFilterSize 1048576
+ipfs config Datastore.StorageMax 100GB

package/src/runtime/engine-cyberia/mongodb/entrypoint.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Generated by 'underpost docker-compose --generate' — do not hand-edit.
+set -e
+
+KEYFILE=/opt/keyfile/mongodb-keyfile
+RS="${DB_REPLICA_SET:-rs0}"
+MEMBER_HOST="mongodb:27017"
+
+if [ ! -s "$KEYFILE" ]; then
+  openssl rand -base64 756 > "$KEYFILE"
+fi
+chmod 400 "$KEYFILE"
+chown 999:999 "$KEYFILE"
+mkdir -p /data/db
+chown -R 999:999 /data/db
+
+# One-time replica-set + root-user bootstrap via the localhost exception,
+# performed in the background once mongod accepts loopback connections.
+(
+  for i in $(seq 1 60); do
+    if mongosh --quiet --host 127.0.0.1 --eval 'db.adminCommand({ ping: 1 })' >/dev/null 2>&1; then
+      break
+    fi
+    sleep 1
+  done
+
+  cat > /tmp/mongo-bootstrap.js <<JS
+var RS = "$RS";
+var HOST = "$MEMBER_HOST";
+var U = "$MONGO_INITDB_ROOT_USERNAME";
+var P = "$MONGO_INITDB_ROOT_PASSWORD";
+function waitPrimary() {
+  for (var i = 0; i < 60; i++) {
+    var h = db.hello();
+    if (h.isWritablePrimary) return true;
+    sleep(1000);
+  }
+  return false;
+}
+var initialized = false;
+try {
+  var s = rs.status();
+  if (s && s.ok === 1) initialized = true;
+} catch (e) {
+  var m = String(e);
+  if (m.indexOf("requires authentication") >= 0 || m.indexOf("not authorized") >= 0 || m.indexOf("Unauthorized") >= 0) {
+    initialized = true;
+  } else if (m.indexOf("NotYetInitialized") < 0 && m.indexOf("no replset config") < 0) {
+    throw e;
+  }
+}
+if (!initialized) {
+  rs.initiate({ _id: RS, members: [{ _id: 0, host: HOST }] });
+  waitPrimary();
+  var admin = db.getSiblingDB("admin");
+  try {
+    admin.createUser({ user: U, pwd: P, roles: [{ role: "root", db: "admin" }] });
+    print("BOOTSTRAP_USER_CREATED");
+  } catch (e) {
+    var s2 = String(e);
+    if (s2.indexOf("already exists") < 0 && s2.indexOf("not authorized") < 0 && s2.indexOf("requires authentication") < 0) {
+      throw e;
+    }
+    print("BOOTSTRAP_USER_SKIP");
+  }
+  print("BOOTSTRAP_DONE");
+} else {
+  print("BOOTSTRAP_ALREADY_INITIALIZED");
+}
+JS
+
+  mongosh --quiet --host 127.0.0.1 /tmp/mongo-bootstrap.js > /tmp/mongo-bootstrap.log 2>&1 || true
+) &
+
+exec gosu mongodb mongod \
+  --replSet "$RS" --auth --clusterAuthMode keyFile --keyFile "$KEYFILE" --bind_ip_all

package/src/runtime/engine-cyberia/nginx.conf

@@ -0,0 +1,87 @@
+# Reverse proxy for the Cyberia ecosystem compose stack (custom workflow:
+# --deploy-id dd-cyberia --docker-compose-id cyberia). Hand-authored source of
+# truth for this stack — used as-is (not generated). Mirrors the render format
+# of src/runtime/nginx/Nginx.js (websocket upgrade map, named upstreams,
+# proxy_http_version 1.1, per-host servers).
+#
+# Host -> upstream mapping (matches engine-private/conf/dd-cyberia hosts):
+#   www.cyberiaonline.com    -> engine-cyberia:4005  (portal + REST + WS authority)
+#   server.cyberiaonline.com -> cyberia-server:8081  (Go MMO simulation / websocket)
+#   client.cyberiaonline.com -> cyberia-client:8081  (WASM presentation bundle)
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+upstream up_engine_cyberia { server engine-cyberia:4005; }
+upstream up_cyberia_server { server cyberia-server:8081; }
+upstream up_cyberia_client { server cyberia-client:8081; }
+
+proxy_http_version 1.1;
+
+server {
+    listen 80 default_server;
+    server_name _ cyberiaonline.com www.cyberiaonline.com;
+
+    location = /healthz {
+        access_log off;
+        return 200 "ok\n";
+        add_header Content-Type text/plain;
+    }
+
+    location / {
+        proxy_pass http://up_engine_cyberia;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_read_timeout 3600s;
+    }
+}
+
+server {
+    listen 80;
+    server_name server.cyberiaonline.com;
+
+    location = /healthz {
+        access_log off;
+        return 200 "ok\n";
+        add_header Content-Type text/plain;
+    }
+
+    location / {
+        proxy_pass http://up_cyberia_server;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_read_timeout 3600s;
+    }
+}
+
+server {
+    listen 80;
+    server_name client.cyberiaonline.com;
+
+    location = /healthz {
+        access_log off;
+        return 200 "ok\n";
+        add_header Content-Type text/plain;
+    }
+
+    location / {
+        proxy_pass http://up_cyberia_client;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_read_timeout 3600s;
+    }
+}

package/src/runtime/express/Express.js

@@ -19,8 +19,8 @@ import { DataBaseProviderService } from '../../db/DataBaseProvider.js';
 import { createPeerServer } from '../../server/peer.js';
 import { createValkeyConnection } from '../../server/valkey.js';
 import { applySecurity, authMiddlewareFactory } from '../../server/auth.js';
-import { ssrMiddlewareFactory } from '../../server/ssr.js';
-import { buildSwaggerUiOptions } from '../../server/client-build-docs.js';
+import { ssrMiddlewareFactory } from '../../client-builder/ssr.js';
+import { buildSwaggerUiOptions } from '../../client-builder/client-build-docs.js';
 
 import { shellExec } from '../../server/process.js';
 import { devProxyHostFactory, isDevProxyContext, isTlsDevProxy } from '../../server/conf.js';