cyberia 3.2.22 → 3.2.70

package/scripts/disk-clean.sh

@@ -7,20 +7,20 @@ set -euo pipefail
 
 VACUUM_SIZE="200M"          # journalctl vacuum target
 LARGE_LOG_SIZE="+100M"      # threshold for truncation (find syntax)
-TMP_AGE_DAYS=3              # remove files older than this from /tmp and /var/tmp
-CACHE_AGE_DAYS=30           # remove caches older than this from /var/cache
+TMP_AGE_DAYS=1              # remove files older than this from /tmp and /var/tmp
+CACHE_AGE_DAYS=5           # remove caches older than this from /var/cache
 KEEP_KERNELS=2              # keep this many latest kernels
 REMOVE_OPT=0                # ALWAYS allow removing /opt entries (user requested)
 
 timestamp() { date +"%F %T"; }
 log() {
-  echo "$(timestamp) $*"
+    echo "$(timestamp) $*"
 }
 
 # must be root
 if [ "$EUID" -ne 0 ]; then
-  echo "This script must be run as root. Exiting."
-  exit 1
+    echo "This script must be run as root. Exiting."
+    exit 1
 fi
 
 log "=== Starting Rocky Linux 9 automated cleanup (batch mode) ==="
@@ -46,8 +46,8 @@ journalctl --vacuum-size="$VACUUM_SIZE"
 # 3) Truncate very large logs in /var/log (safer than delete)
 log "Truncating logs in /var/log larger than ${LARGE_LOG_SIZE} (keeps zero-sized file so services don't break)..."
 find /var/log -type f -size "$LARGE_LOG_SIZE" -print0 2>/dev/null | while IFS= read -r -d '' f; do
-  echo "Truncating $f"
-  : > "$f" || echo "Failed to truncate $f"
+    echo "Truncating $f"
+    : > "$f" || echo "Failed to truncate $f"
 done
 
 # 4) Clean /tmp and /var/tmp older than TMP_AGE_DAYS
@@ -62,87 +62,110 @@ find /var/cache -mindepth 1 -mtime +"$CACHE_AGE_DAYS" -print0 2>/dev/null | xarg
 # 6) Clean user caches (~/.cache) and Downloads older than CACHE_AGE_DAYS
 log "Cleaning user caches and old downloads (home dirs)..."
 for homedir in /home/* /root; do
-  [ -d "$homedir" ] || continue
-  usercache="$homedir/.cache"
-  userdownloads="$homedir/Downloads"
-  usertrash="$homedir/.local/share/Trash"
-
-  if [ -d "$usercache" ]; then
-    log "Removing contents of $usercache"
-    rm -rf "${usercache:?}/"* 2>/dev/null
-  fi
-  if [ -d "$userdownloads" ]; then
-    log "Removing files older than ${CACHE_AGE_DAYS} days from $userdownloads"
-    find "$userdownloads" -type f -mtime +"$CACHE_AGE_DAYS" -print0 2>/dev/null | xargs -0r rm -f -- 2>/dev/null
-  fi
-  if [ -d "$usertrash" ]; then
-    log "Emptying trash in $usertrash"
-    rm -rf "${usertrash:?}/"* 2>/dev/null
-  fi
+    [ -d "$homedir" ] || continue
+    usercache="$homedir/.cache"
+    userdownloads="$homedir/Downloads"
+    usertrash="$homedir/.local/share/Trash"
+    
+    if [ -d "$usercache" ]; then
+        log "Removing contents of $usercache"
+        rm -rf "${usercache:?}/"* 2>/dev/null
+    fi
+    if [ -d "$userdownloads" ]; then
+        log "Removing files older than ${CACHE_AGE_DAYS} days from $userdownloads"
+        find "$userdownloads" -type f -mtime +"$CACHE_AGE_DAYS" -print0 2>/dev/null | xargs -0r rm -f -- 2>/dev/null
+    fi
+    if [ -d "$usertrash" ]; then
+        log "Emptying trash in $usertrash"
+        rm -rf "${usertrash:?}/"* 2>/dev/null
+    fi
 done
 
-# 7) Docker / Podman cleanup (if present)
+# 7) Docker / Podman cleanup (if present) — this is what actually reclaims the
+#    overlay storage behind those duplicated `overlay` df lines.
 if command -v docker >/dev/null 2>&1; then
-  log "Docker detected: pruning images/containers/volumes (aggressive)..."
-  docker system df
-  docker system prune -a --volumes -f
+    log "Docker detected: pruning images/containers/volumes/build cache (aggressive)..."
+    docker system df || true
+    docker system prune -a --volumes -f || true
+    docker builder prune -a -f || true
 fi
 
 if command -v podman >/dev/null 2>&1; then
-  log "Podman detected: pruning images/containers (aggressive)..."
-  podman system df
-  podman system prune -a -f
+    log "Podman detected: pruning images/containers/volumes (aggressive)..."
+    podman system df || true
+    podman system prune -a --volumes -f || true
 fi
 
+if command -v buildah >/dev/null 2>&1; then
+    log "Buildah detected: removing leftover working containers..."
+    buildah rm --all || true
+fi
+
+# 7b) Unmount leaked container overlay 'merged' mounts. Pruning frees the data
+#     but leaves these mountpoints attached, so they keep flooding `df -h` with
+#     identical `overlay ... /merged` rows. Only unmount overlays not backing a
+#     still-existing container, so running workloads are never disturbed.
+log "Unmounting orphaned container overlay mounts..."
+if command -v podman >/dev/null 2>&1; then
+    podman umount --all >/dev/null 2>&1 || true
+fi
+active_merged="$(podman ps -aq 2>/dev/null | xargs -r -I{} podman inspect --format '{{.GraphDriver.Data.MergedDir}}' {} 2>/dev/null || true)"
+findmnt -rn -o TARGET 2>/dev/null | grep -E '/var/lib/(containers/storage|docker)/overlay.*/merged' | sort -r | while IFS= read -r m; do
+    if ! printf '%s\n' "$active_merged" | grep -qxF "$m"; then
+        echo "Unmounting orphaned overlay: $m"
+        umount -l "$m" 2>/dev/null || true
+    fi
+done
+
 # 8) Flatpak unused runtimes/apps (if present)
 if command -v flatpak >/dev/null 2>&1; then
-  log "Flatpak detected: trying to uninstall unused runtimes/apps..."
-  flatpak uninstall --unused -y || flatpak uninstall --unused
-  flatpak repair
+    log "Flatpak detected: trying to uninstall unused runtimes/apps..."
+    flatpak uninstall --unused -y || flatpak uninstall --unused
+    flatpak repair
 fi
 
 # 9) Python Pip cleanup
 if command -v pip3 >/dev/null 2>&1 || command -v pip >/dev/null 2>&1; then
-  log "Python Pip detected: cleaning cache..."
-  if command -v pip3 >/dev/null 2>&1; then
-    pip3 cache purge
-  elif command -v pip >/dev/null 2>&1; then
-    pip cache purge
-  fi
+    log "Python Pip detected: cleaning cache..."
+    if command -v pip3 >/dev/null 2>&1; then
+        pip3 cache purge
+        elif command -v pip >/dev/null 2>&1; then
+        pip cache purge
+    fi
 fi
 
 # 10) Conda cleanup
 if command -v conda >/dev/null 2>&1; then
-  log "Conda detected: cleaning all..."
-  conda clean --all -y
+    log "Conda detected: cleaning all..."
+    conda clean --all -y
 fi
 
 # 11) Remove old kernels but keep the last KEEP_KERNELS (safe)
 log "Removing old kernels, keeping the last $KEEP_KERNELS kernels..."
 OLD_KERNELS=$(dnf repoquery --installonly --latest-limit=-$KEEP_KERNELS -q 2>/dev/null)
 if [ -n "$OLD_KERNELS" ]; then
-  log "Old kernels to remove: $OLD_KERNELS"
-  dnf -y remove $OLD_KERNELS
+    log "Old kernels to remove: $OLD_KERNELS"
+    dnf -y remove $OLD_KERNELS
 else
-  log "No old kernels found by DNF repoquery. Only $KEEP_KERNELS or fewer are currently installed."
+    log "No old kernels found by DNF repoquery. Only $KEEP_KERNELS or fewer are currently installed."
 fi
 
 # 12) /opt review and removal (ON by default now)
 if [ -d /opt ]; then
-  log "/opt usage (top entries):"
-  du -sh /opt/* 2>/dev/null | sort -h | head -n 20
-
-  if [ "$REMOVE_OPT" = "1" ]; then
-    OPT_TARGETS=(/opt/local-path-provisioner)
-    for t in "${OPT_TARGETS[@]}"; do
-      if [ -d "$t" ]; then
-        log "Removing $t as REMOVE_OPT=1"
-        rm -rf "$t"
-      fi
-    done
-  else
-    log "Automatic /opt removals disabled (set REMOVE_OPT=1 to enable)."
-  fi
+    log "/opt usage (top entries):"
+    du -sh /opt/* 2>/dev/null | sort -h | head -n 20
+    
+    if [ "$REMOVE_OPT" = "1" ]; then
+        OPT_TARGETS=(/opt/local-path-provisioner)
+        for t in "${OPT_TARGETS[@]}"; do
+            if [ -d "$t" ]; then
+                log "Removing $t as REMOVE_OPT=1"
+                rm -rf "$t"
+            fi
+        done
+    else
+        log "Automatic /opt removals disabled (set REMOVE_OPT=1 to enable)."
+    fi
 fi
 
 # 13) Find large files > 100MB (report only)
@@ -150,8 +173,10 @@ log "Listing files larger than 100MB (report only):"
 find / -xdev -type f -size +100M -printf '%s\t%p\n' 2>/dev/null | sort -nr | head -n 50 | awk '{printf "%.1fMB\t%s\n",$1/1024/1024,$2}'
 
 # Final disk usage
-log "Disk usage after cleanup:"
+log "Disk usage cleanup:"
 df -h
+log "Top-level usage ( / ):"
+du -xh --max-depth=1 / | sort -rh | head -n 20
 
 log "=== Cleanup finished ==="
 exit 0

package/scripts/kubeadm-node-setup.sh

@@ -0,0 +1,317 @@
+#!/bin/bash
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Underpost Kubeadm Node Setup (bare-metal physical node)
+#
+# Mirrors scripts/k3s-node-setup.sh but for kubeadm on real hardware: it runs on
+# the freshly deployed OS (disk-installed Rocky) after first boot, installs NVM +
+# Node.js, ensures the engine source is present, and drives the cluster bring-up
+# through the local engine entrypoint `node bin cluster` (src/cli/cluster.js) —
+# reusing its kubeadm + Contour + host-init logic instead of reimplementing it.
+#
+# Modes:
+#   --control                 Initialize a new kubeadm control-plane (default).
+#   --worker                  Join an existing cluster.
+#
+# Worker join (controller supplies this over SSH; no manual token paste):
+#   --join-command="kubeadm join <ip>:6443 --token <t> --discovery-token-ca-cert-hash <h>"
+#   or:  --control-ip=<ip> --token=<t> --discovery-token-ca-cert-hash=<h>
+#
+# Engine source / options:
+#   --engine-root=<path>      Engine source path (default /home/dd/engine).
+#   --engine-repo=<url>       Git repo cloned if the engine source is missing.
+#   --engine-branch=<branch>  Branch to clone (default: repo default).
+#   --no-contour              Control mode: skip the Contour ingress install.
+# ---------------------------------------------------------------------------
+
+ROLE="control"
+JOIN_COMMAND=""
+CONTROL_IP=""
+CONTROL_ENDPOINT_HOST=""
+TOKEN=""
+CA_CERT_HASH=""
+JOIN_ONLY="0"
+INSTALL_CONTOUR="1"
+ENGINE_ROOT="/home/dd/engine"
+ENGINE_REPO="https://github.com/underpostnet/engine.git"
+ENGINE_BRANCH=""
+# Private repo holding secrets (engine-private/conf/.../.env.production) cloned
+# with a GitHub token. GITHUB_TOKEN/GITHUB_USERNAME come from the environment
+# (passed over SSH by the controller) or the --github-* args.
+ENGINE_PRIVATE_REPO="https://github.com/underpostnet/engine-private.git"
+ENGINE_PRIVATE_BRANCH=""
+GITHUB_TOKEN="${GITHUB_TOKEN:-}"
+GITHUB_USERNAME="${GITHUB_USERNAME:-}"
+CRI_SOCKET="unix:///var/run/crio/crio.sock"
+
+for arg in "$@"; do
+    case $arg in
+        --control)                          ROLE="control" ;;
+        --worker)                           ROLE="worker" ;;
+        --join-command=*)                   JOIN_COMMAND="${arg#*=}" ;;
+        --control-ip=*)                     CONTROL_IP="${arg#*=}" ;;
+        --control-endpoint-host=*)          CONTROL_ENDPOINT_HOST="${arg#*=}" ;;
+        --token=*)                          TOKEN="${arg#*=}" ;;
+        --discovery-token-ca-cert-hash=*)   CA_CERT_HASH="${arg#*=}" ;;
+        --join-only)                        JOIN_ONLY="1" ;;
+        --engine-root=*)                    ENGINE_ROOT="${arg#*=}" ;;
+        --engine-repo=*)                    ENGINE_REPO="${arg#*=}" ;;
+        --engine-branch=*)                  ENGINE_BRANCH="${arg#*=}" ;;
+        --engine-private-repo=*)            ENGINE_PRIVATE_REPO="${arg#*=}" ;;
+        --engine-private-branch=*)          ENGINE_PRIVATE_BRANCH="${arg#*=}" ;;
+        --github-token=*)                   GITHUB_TOKEN="${arg#*=}" ;;
+        --github-username=*)                GITHUB_USERNAME="${arg#*=}" ;;
+        --no-contour)                       INSTALL_CONTOUR="0" ;;
+    esac
+done
+
+log() { echo "$(date): [kubeadm-setup] $*"; }
+
+# worker_join: lightweight, idempotent kubeadm join. Centralizes the join logic
+# used by both the full worker flow and the --join-only short-circuit. Returns
+# non-zero on failure so `set -e` aborts the script (no false-positive success).
+worker_join() {
+    if [ -z "$JOIN_COMMAND" ]; then
+        if [ -n "$CONTROL_IP" ] && [ -n "$TOKEN" ] && [ -n "$CA_CERT_HASH" ]; then
+            JOIN_COMMAND="kubeadm join ${CONTROL_IP}:6443 --token ${TOKEN} --discovery-token-ca-cert-hash ${CA_CERT_HASH}"
+        else
+            echo "ERROR: worker mode needs --join-command=... OR --control-ip/--token/--discovery-token-ca-cert-hash" >&2
+            return 1
+        fi
+    fi
+
+    command -v kubeadm >/dev/null 2>&1 || {
+        echo "ERROR: kubeadm not found on node. Run a full (non --join-only) setup first." >&2
+        return 1
+    }
+
+    # Make the control-plane endpoint hostname resolve to the control IP. kubeadm
+    # reads the cluster-info / kubeadm-config ConfigMaps whose server URL is the
+    # control-plane endpoint (often 'localhost.localdomain:6443'); without this the
+    # worker dials [::1]:6443 and fails with "connection refused".
+    if [ -n "$CONTROL_ENDPOINT_HOST" ] && [ -n "$CONTROL_IP" ] && [ "$CONTROL_ENDPOINT_HOST" != "$CONTROL_IP" ]; then
+        log "Mapping control-plane endpoint '$CONTROL_ENDPOINT_HOST' -> $CONTROL_IP in /etc/hosts"
+        ESC_HOST="$(printf '%s' "$CONTROL_ENDPOINT_HOST" | sed 's/[.]/\\./g')"
+        # Strip the endpoint host from any existing (loopback) line so it no longer
+        # resolves to 127.0.0.1, then point it at the real control-plane IP.
+        sudo sed -i -E "s/[[:space:]]+${ESC_HOST}([[:space:]]|\$)/\1/g" /etc/hosts || true
+        if ! grep -qE "^${CONTROL_IP}[[:space:]].*${ESC_HOST}([[:space:]]|\$)" /etc/hosts; then
+            echo "${CONTROL_IP} ${CONTROL_ENDPOINT_HOST}" | sudo tee -a /etc/hosts >/dev/null
+        fi
+    fi
+
+    # Kernel/sysctl prereqs the kubeadm preflight needs (no engine/node required).
+    sudo swapoff -a || true
+    sudo sed -i '/swap/d' /etc/fstab || true
+    sudo modprobe br_netfilter || true
+    printf 'net.bridge.bridge-nf-call-iptables = 1\nnet.bridge.bridge-nf-call-ip6tables = 1\nnet.ipv4.ip_forward = 1\n' \
+    | sudo tee /etc/sysctl.d/99-kubernetes.conf >/dev/null
+    sudo sysctl --system >/dev/null 2>&1 || true
+
+    # Replace --discovery-token-ca-cert-hash with --discovery-token-unsafe-skip-ca-verification
+    # so token discovery does not depend on the pinned CA hash.
+    UNSAFE_JOIN="$(echo "${JOIN_COMMAND}" | sed 's/--discovery-token-ca-cert-hash [^ ]*/--discovery-token-unsafe-skip-ca-verification/')"
+
+    _do_join() {
+        # Reset any stale state from a previous failed join so kubeadm does not
+        # reuse cached config that points at an unreachable endpoint.
+        sudo kubeadm reset -f --cri-socket="${CRI_SOCKET}" >/dev/null 2>&1 || true
+        sudo rm -rf /etc/kubernetes/* /var/lib/kubelet/pki 2>/dev/null || true
+        log "Joining cluster: ${UNSAFE_JOIN%% --token*} ..."
+        sudo ${UNSAFE_JOIN} --cri-socket="${CRI_SOCKET}"
+    }
+
+    if _do_join; then
+        log "Worker joined the cluster."
+        return 0
+    fi
+    log "WARNING: kubeadm join attempt failed; resetting and retrying once..."
+    if _do_join; then
+        log "Worker joined the cluster."
+        return 0
+    fi
+    log "FATAL: kubeadm join failed after retry"
+    return 1
+}
+
+# --join-only: skip all prerequisite/engine/host setup and go straight to the
+# join (used by `baremetal --resume-join` on an already-provisioned node).
+if [ "$JOIN_ONLY" = "1" ]; then
+    [ "$ROLE" = "worker" ] || { echo "ERROR: --join-only is only valid with --worker" >&2; exit 1; }
+    log "--join-only: skipping prerequisites/engine setup; joining cluster directly"
+    worker_join
+    log "kubeadm worker (join-only) complete."
+    exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# 0. Base prerequisites — a minimal @core Rocky install lacks tar/xz/git, which
+#    NVM needs to extract Node.js and the engine clone needs. Install them first.
+# ---------------------------------------------------------------------------
+log "Installing base prerequisites (tar, xz, gzip, git, curl)..."
+sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils 2>/dev/null \
+|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils
+
+# ---------------------------------------------------------------------------
+# 1. NVM and Node.js — required for the `node bin ...` entrypoints. Idempotent so
+#    a retried run does not reinstall Node from scratch.
+# ---------------------------------------------------------------------------
+if command -v node >/dev/null 2>&1 && node --version 2>/dev/null | grep -q '^v24'; then
+    log "Node.js $(node --version) already installed; skipping NVM setup"
+else
+    log "Installing NVM and Node.js v24.15.0..."
+    curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
+    
+    export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
+    # shellcheck disable=SC1090
+    [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+    
+    nvm install 24.15.0
+    nvm use 24.15.0
+    nvm alias default 24.15.0
+    ln -sf "$(command -v node)" /usr/local/bin/node
+    ln -sf "$(command -v npm)" /usr/local/bin/npm
+    ln -sf "$(command -v npx)" /usr/local/bin/npx
+fi
+
+echo "
+██╗░░░██╗███╗░░██╗██████╗░███████╗██████╗░██████╗░░█████╗░░██████╗████████╗
+██║░░░██║████╗░██║██╔══██╗██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔════╝╚══██╔══╝
+██║░░░██║██╔██╗██║██║░░██║█████╗░░██████╔╝██████╔╝██║░░██║╚█████╗░░░░██║░░░
+██║░░░██║██║╚████║██║░░██║██╔══╝░░██╔══██╗██╔═══╝░██║░░██║░╚═══██╗░░░██║░░░
+╚██████╔╝██║░╚███║██████╔╝███████╗██║░░██║██║░░░░░╚█████╔╝██████╔╝░░░██║░░░
+░╚═════╝░╚═╝░░╚══╝╚═════╝░╚══════╝╚═╝░░╚═╝╚═╝░░░░░░╚════╝░╚═════╝░░░░╚═╝░░░
+
+Bringing up underpost kubeadm node (role=$ROLE) from $ENGINE_ROOT
+"
+
+# ---------------------------------------------------------------------------
+# 2. Engine source — required by `node bin cluster` (manifests + CLI).
+#    Normalizes any (custom-named) repo into the canonical paths, mirroring
+#    src/server/start.js: clone into a temp dir then copy the contents into the
+#    target, so the working tree is always $ENGINE_ROOT regardless of repo name.
+# ---------------------------------------------------------------------------
+command -v git >/dev/null 2>&1 || sudo dnf install -y git
+
+# clone_or_pull <repo-url> <branch> <target-dir> <remote-name> [mask-secret]
+# If <target-dir> exists with a git repo, does a git pull (fetch+reset) to
+# update it. Otherwise clones <repo-url> into a temp dir and copies contents
+# to <target-dir> so a custom repo (e.g. engine-test-test) always lands at
+# the canonical path. [mask-secret] is redacted from any logged output.
+clone_or_pull() {
+    local url="${1:-}" branch="${2:-}" target="${3:-}" remote="${4:-origin}" mask="${5:-}"
+    if [ -d "$target" ] && git -C "$target" rev-parse --git-dir >/dev/null 2>&1; then
+        log "$target already present; pulling latest ..."
+        if git -C "$target" remote get-url "$remote" >/dev/null 2>&1; then
+            # Temporarily set the authenticated URL so the fetch succeeds.
+            # The caller strips the token from the remote URL after this returns.
+            local saved_url; saved_url="$(git -C "$target" remote get-url "$remote" 2>/dev/null || true)"
+            git -C "$target" remote set-url "$remote" "$url" 2>/dev/null || true
+            if [ -n "$mask" ]; then
+                git -C "$target" fetch --depth 1 "$remote" 2>&1 | sed "s/${mask}/***/g" || true
+            else
+                git -C "$target" fetch --depth 1 "$remote" 2>&1 || true
+            fi
+            # Restore the saved (clean) URL immediately so the token is never persisted.
+            if [ -n "$saved_url" ]; then
+                git -C "$target" remote set-url "$remote" "$saved_url" 2>/dev/null || true
+            fi
+            if [ -n "$branch" ]; then
+                git -C "$target" reset --hard "$remote/$branch" 2>/dev/null || true
+            else
+                # No branch specified: pull whichever branch is HEAD on remote
+                git -C "$target" reset --hard "$remote/$(git -C "$target" rev-parse --abbrev-ref HEAD 2>/dev/null)" 2>/dev/null || true
+            fi
+            # Clean untracked files so stale artifacts don't accumulate
+            git -C "$target" clean -fd 2>/dev/null || true
+            log "$target updated via pull"
+            return 0
+        fi
+    fi
+    # Full clone + normalize path
+    log "Cloning + normalizing $url -> $target ..."
+    local tmp; tmp="$(mktemp -d)"
+    local ok=0
+    if [ -n "$branch" ]; then
+        if [ -n "$mask" ]; then git clone --depth 1 --branch "$branch" "$url" "$tmp/repo" 2>&1 | sed "s/${mask}/***/g"; ok=${PIPESTATUS[0]}; else git clone --depth 1 --branch "$branch" "$url" "$tmp/repo"; ok=$?; fi
+    else
+        if [ -n "$mask" ]; then git clone --depth 1 "$url" "$tmp/repo" 2>&1 | sed "s/${mask}/***/g"; ok=${PIPESTATUS[0]}; else git clone --depth 1 "$url" "$tmp/repo"; ok=$?; fi
+    fi
+    if [ "$ok" -ne 0 ] || [ ! -d "$tmp/repo" ]; then
+        rm -rf "$tmp"
+        return 1
+    fi
+    mkdir -p "$target"
+    cp -a "$tmp/repo/." "$target/"
+    rm -rf "$tmp"
+}
+
+if [ -n "$GITHUB_TOKEN" ]; then
+    ENGINE_REPO_URL="https://${GITHUB_USERNAME:-x-access-token}:${GITHUB_TOKEN}@${ENGINE_REPO#https://}"
+    # Mask the token in log output by routing through clone_or_pull with mask arg
+    clone_or_pull "$ENGINE_REPO_URL" "$ENGINE_BRANCH" "$ENGINE_ROOT" "origin" "$GITHUB_TOKEN" || { log "FATAL: engine clone failed"; exit 1; }
+    # Drop the token from the remote URL so it is not persisted on disk.
+    git -C "$ENGINE_ROOT" remote set-url origin "$ENGINE_REPO" 2>/dev/null || true
+else
+    clone_or_pull "$ENGINE_REPO" "$ENGINE_BRANCH" "$ENGINE_ROOT" "origin" "" || { log "FATAL: engine clone failed"; exit 1; }
+fi
+
+cd "$ENGINE_ROOT"
+
+# Clone + normalize the private secrets repo into $ENGINE_ROOT/engine-private
+# (where `node bin run secret` reads engine-private/conf/.../.env.production),
+# regardless of the private repo's name. The token is masked in logs and then
+# stripped from the saved remote URL.
+if [ -n "$GITHUB_TOKEN" ]; then
+    PRIV_URL="https://${GITHUB_USERNAME:-x-access-token}:${GITHUB_TOKEN}@${ENGINE_PRIVATE_REPO#https://}"
+    if clone_or_pull "$PRIV_URL" "$ENGINE_PRIVATE_BRANCH" "$ENGINE_ROOT/engine-private" "origin" "$GITHUB_TOKEN"; then
+        # Drop the token from the remote URL so it is not persisted on disk.
+        git -C "$ENGINE_ROOT/engine-private" remote set-url origin "$ENGINE_PRIVATE_REPO" 2>/dev/null || true
+    else
+        log "WARNING: engine-private clone failed — secrets will be unavailable"
+    fi
+else
+    log "WARNING: GITHUB_TOKEN not provided; engine-private not cloned — secrets will be unavailable"
+fi
+
+# Install JS deps and generate secrets using the local engine entrypoint.
+npm install
+npm install -g underpost
+node bin run secret
+
+# ---------------------------------------------------------------------------
+# 3. Host prerequisites (Docker, CRI-O, kubelet/kubeadm/kubectl, ...) via cluster.js
+# ---------------------------------------------------------------------------
+log "Installing Kubernetes host prerequisites (underpost cluster --init-host)..."
+# CRI-O is already installed by this point (idempotent dnf). The install-crio
+# runner also tries to install cri-tools (crictl) which is not in Rocky 9 repos.
+# That failure is non-fatal; CRI-O itself works fine without crictl.
+node bin cluster --dev --init-host || log "WARNING: init-host had minor errors (CRI-O is already installed)"
+
+# ---------------------------------------------------------------------------
+# 4. Role-specific bring-up, fully delegated to src/cli/cluster.js
+# ---------------------------------------------------------------------------
+if [ "$ROLE" = "control" ]; then
+    if [ "$INSTALL_CONTOUR" = "1" ]; then
+        log "Initializing kubeadm control-plane + Contour (underpost cluster --kubeadm --contour)..."
+        node bin cluster --dev --kubeadm --contour
+    else
+        log "Initializing kubeadm control-plane (underpost cluster --kubeadm)..."
+        node bin cluster --dev --kubeadm
+    fi
+    
+    echo ""
+    log "Control-plane ready. Join command for workers:"
+    sudo kubeadm token create --print-join-command
+    
+    elif [ "$ROLE" = "worker" ]; then
+    # Apply the same host configuration cluster.js uses (SELinux, swap, sysctl)
+    # before joining; worker_join then handles endpoint mapping + the join itself
+    # and fails the script (set -e) if the join does not succeed.
+    log "Applying host configuration (underpost cluster --config)..."
+    node bin cluster --dev --config
+    worker_join
+fi
+
+log "kubeadm ${ROLE} setup complete."