cyberia 3.2.22 → 3.2.70

package/Dockerfile

@@ -1,45 +1,143 @@
-FROM rockylinux:9
-
-# Update and install required packages
-RUN dnf -y update && \
-    dnf -y install epel-release && \
-    dnf -y install --allowerasing \
-    bzip2 \
-    sudo \
-    curl \
-    net-tools \
-    openssh-server \
-    nano \
-    vim-enhanced \
-    less \
-    openssl-devel \
-    wget \
-    git \
-    gnupg2 \
-    libnsl \
-    perl && \
-    dnf clean all
-
-
-# Install Node.js
-RUN curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
-RUN dnf install nodejs -y
-RUN dnf clean all
-
-# Verify Node.js and npm versions
-RUN node --version
-RUN npm --version
-
-# Install underpost ci/cd cli
-RUN npm install -g underpost
-RUN underpost --version
-
-# Create working directory
+# syntax=docker/dockerfile:1.7
+#
+# engine-cyberia — PRODUCTION image (underpost/engine-cyberia).
+#
+# ---------------------------------------------------------------------------
+# Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS builder
+ARG UNDERPOST_VERSION=3.2.70
+# Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
+# underpost's dependencies require >=24.15.0, so install the official binary.
+ARG NODE_VERSION=24.15.0
+ENV NODE_ENV=production
+
+RUN set -eux; \
+    # `sudo` is required because underpost's build steps shell out to
+    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # is just a passthrough, but the binary must exist.
+    dnf install -y git openssl tar xz sudo; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
+    dnf clean all; rm -rf /var/cache/dnf; \
+    npm cache clean --force
+
 WORKDIR /home/dd
 
-# Expose necessary ports
-EXPOSE 22
-EXPOSE 80
-EXPOSE 443
-EXPOSE 3000-3100
-EXPOSE 4000-4100
+RUN --mount=type=secret,id=github_username \
+    # --mount=type=secret,id=github_token \
+    set -eu; \
+    export GITHUB_USERNAME="$(cat /run/secrets/github_username)"; \
+    # export GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+    export ENGINE_CYBERIA_REPO="engine-cyberia"; \
+    export INSTANCE_CODE="amethyst-strata-expansion"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/$ENGINE_CYBERIA_REPO"; \
+    mkdir -p /home/dd/engine; \
+    cp -a ./"$ENGINE_CYBERIA_REPO"/. /home/dd/engine/; \
+    rm -rf ./"$ENGINE_CYBERIA_REPO"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/cyberia-instances"; \
+    rm -rf /home/dd/engine/engine-private; \
+    mkdir -p /home/dd/engine/engine-private/conf/dd-cyberia; \
+    cp -a ./cyberia-instances/conf/dd-cyberia/. /home/dd/engine/engine-private/conf/dd-cyberia/.; \
+    cp -a /home/dd/engine/package.json /home/dd/engine/engine-private/conf/dd-cyberia/package.json; \
+    mkdir -p /home/dd/engine/engine-private/cyberia-instances; \
+    cp -a ./cyberia-instances/instances/"$INSTANCE_CODE" /home/dd/engine/engine-private/cyberia-instances/"$INSTANCE_CODE"; \
+    mkdir -p /home/dd/engine/src/client/public/cyberia; \
+    cp -a ./cyberia-instances/public/cyberia/. /home/dd/engine/src/client/public/cyberia/.; \
+    # The engine gRPC server loads its schema at runtime from
+    # cyberia-server/gen/proto/cyberia.proto (src/grpc/cyberia/grpc-server.js);
+    # fetch just that file so the engine can bind :50051 / :4005 without the
+    # full cyberia-server repo.
+    underpost clone "$GITHUB_USERNAME/cyberia-server"; \
+    mkdir -p /home/dd/engine/cyberia-server/gen/proto; \
+    cp -a ./cyberia-server/gen/proto/cyberia.proto /home/dd/engine/cyberia-server/gen/proto/cyberia.proto; \
+    rm -rf ./cyberia-server; \
+    cd /home/dd/engine; \
+    # --- install deps + env, then replay build-safe itc provisioning ----------
+    npm install; \
+    node bin env dd-cyberia production; \
+    ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
+    # --- build the client bundle (assets are now in place) --------------------
+    cd /home/dd/engine; \
+    node bin client dd-cyberia; \
+    # --- CREDENTIAL SCRUB (defense in depth, while secrets are still in scope) -
+    # 1) Redact every real secret value from any file it may have reached.
+    # for _secret in "$GITHUB_TOKEN" "$CLOUDINARY_API_SECRET" "$CLOUDINARY_API_KEY"; do \
+    for _secret in "$GITHUB_USERNAME"; do \
+    # for _secret in "$GITHUB_USERNAME" "$GITHUB_TOKEN"; do \
+      [ -n "$_secret" ] || continue; \
+      grep -rlF --exclude-dir=node_modules --exclude-dir=.git "$_secret" /home/dd/engine 2>/dev/null \
+        | xargs -r sed -i "s#${_secret}#__REDACTED__#g" || true; \
+    done; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET; \
+    unset GITHUB_USERNAME; \
+
+    # 2) Every .git dir — clone URLs embed the token in .git/config, and the
+    #    private history itself must not ship.
+    find /home/dd/engine -type d -name .git -prune -exec rm -rf {} + 2>/dev/null || true; \
+    # 3) User-level credential stores possibly written during the build.
+    rm -rf /root/.gitconfig /root/.git-credentials /root/.config/git \
+           /root/.netrc /root/.ssh /root/.npm /root/.cache /root/.node-gyp; \
+    # 4) The underpost global env store may hold GITHUB_TOKEN.
+    rm -f "$(underpost root)/underpost/.env" 2>/dev/null || true; \
+    # 5) Build caches, temp, and build-only toolchains. hardhat is contract
+    #    build/CLI tooling (used only to build the coverage docs above); the
+    #    runtime server never imports it, so its dev node_modules is pure bloat.
+    npm cache clean --force 2>/dev/null || true; \
+    rm -rf /home/dd/cyberia-instances \
+           /home/dd/engine/src/client/public/itemledger \
+           /home/dd/engine/src/client/public/cryptokoyn \
+           /home/dd/engine/src/client/components/cryptokoyn \
+           /home/dd/engine/src/client/components/itemledger \
+           /home/dd/engine/src/client/Itemledger.index.js \
+           /home/dd/engine/src/client/Cryptokoyn.index.js \
+           /home/dd/engine/hardhat/node_modules \
+           /home/dd/engine/.npm /tmp/* /var/tmp/* /var/cache/dnf
+
+# ---------------------------------------------------------------------------
+# Stage 2 — runtime: clean base + pinned Node toolchain + scrubbed app tree.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS runtime
+ENV NODE_ENV=production
+
+# Node + npm + the underpost CLI (exact pinned version) from the builder — no
+# re-download, no git/build toolchain. libstdc++ is the only runtime lib the
+# prebuilt Node binary needs beyond the base image.
+COPY --from=builder /usr/local/ /usr/local/
+RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
+    useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
+    # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
+    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
+    # underpost persists its global env at $(npm root -g)/underpost/.env; the
+    # non-root runtime user must be able to write it (fixes EACCES on start).
+    chown -R dd:dd /usr/local/lib/node_modules/underpost
+
+# Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
+COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine
+
+RUN chmod +x /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh && \
+    /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh
+
+# Explicit re-chown: PVC-backed mounts under src/client/public land here at
+# pod start and may override the COPY --chown above with root ownership.
+RUN chown -R dd:dd /home/dd/engine/src/client/public
+
+USER dd
+WORKDIR /home/dd/engine
+
+EXPOSE 3005
+EXPOSE 50051
+
+CMD ["/bin/sh", "-c", "underpost start --run dd-cyberia production"]

package/Dockerfile.dev

@@ -0,0 +1,143 @@
+# syntax=docker/dockerfile:1.7
+#
+# engine-cyberia — DEVELOPMENT image (underpost/engine-cyberia-dev).
+#
+# ---------------------------------------------------------------------------
+# Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS builder
+ARG UNDERPOST_VERSION=3.2.70
+# Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
+# underpost's dependencies require >=24.15.0, so install the official binary.
+ARG NODE_VERSION=24.15.0
+ENV NODE_ENV=development
+
+RUN set -eux; \
+    # `sudo` is required because underpost's build steps shell out to
+    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # is just a passthrough, but the binary must exist.
+    dnf install -y git openssl tar xz sudo; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
+    dnf clean all; rm -rf /var/cache/dnf; \
+    npm cache clean --force
+
+WORKDIR /home/dd
+
+RUN --mount=type=secret,id=github_username \
+    # --mount=type=secret,id=github_token \
+    set -eu; \
+    export GITHUB_USERNAME="$(cat /run/secrets/github_username)"; \
+    # export GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+    export ENGINE_CYBERIA_REPO="engine-cyberia"; \
+    export INSTANCE_CODE="amethyst-strata-expansion"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/$ENGINE_CYBERIA_REPO"; \
+    mkdir -p /home/dd/engine; \
+    cp -a ./"$ENGINE_CYBERIA_REPO"/. /home/dd/engine/; \
+    rm -rf ./"$ENGINE_CYBERIA_REPO"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/cyberia-instances"; \
+    rm -rf /home/dd/engine/engine-private; \
+    mkdir -p /home/dd/engine/engine-private/conf/dd-cyberia; \
+    cp -a ./cyberia-instances/conf/dd-cyberia/. /home/dd/engine/engine-private/conf/dd-cyberia/.; \
+    cp -a /home/dd/engine/package.json /home/dd/engine/engine-private/conf/dd-cyberia/package.json; \
+    mkdir -p /home/dd/engine/engine-private/cyberia-instances; \
+    cp -a ./cyberia-instances/instances/"$INSTANCE_CODE" /home/dd/engine/engine-private/cyberia-instances/"$INSTANCE_CODE"; \
+    mkdir -p /home/dd/engine/src/client/public/cyberia; \
+    cp -a ./cyberia-instances/public/cyberia/. /home/dd/engine/src/client/public/cyberia/.; \
+    # The engine gRPC server loads its schema at runtime from
+    # cyberia-server/gen/proto/cyberia.proto (src/grpc/cyberia/grpc-server.js);
+    # fetch just that file so the engine can bind :50051 / :4005 without the
+    # full cyberia-server repo.
+    underpost clone "$GITHUB_USERNAME/cyberia-server"; \
+    mkdir -p /home/dd/engine/cyberia-server/gen/proto; \
+    cp -a ./cyberia-server/gen/proto/cyberia.proto /home/dd/engine/cyberia-server/gen/proto/cyberia.proto; \
+    rm -rf ./cyberia-server; \
+    cd /home/dd/engine; \
+    # --- install deps + env, then replay build-safe itc provisioning ----------
+    npm install; \
+    node bin env dd-cyberia development; \
+    ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
+    # --- build the client bundle (assets are now in place) --------------------
+    cd /home/dd/engine; \
+    node bin client dd-cyberia; \
+    # --- CREDENTIAL SCRUB (defense in depth, while secrets are still in scope) -
+    # 1) Redact every real secret value from any file it may have reached.
+    # for _secret in "$GITHUB_TOKEN" "$CLOUDINARY_API_SECRET" "$CLOUDINARY_API_KEY"; do \
+    for _secret in "$GITHUB_USERNAME"; do \
+    # for _secret in "$GITHUB_USERNAME" "$GITHUB_TOKEN"; do \
+      [ -n "$_secret" ] || continue; \
+      grep -rlF --exclude-dir=node_modules --exclude-dir=.git "$_secret" /home/dd/engine 2>/dev/null \
+        | xargs -r sed -i "s#${_secret}#__REDACTED__#g" || true; \
+    done; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET; \
+    unset GITHUB_USERNAME; \
+
+    # 2) Every .git dir — clone URLs embed the token in .git/config, and the
+    #    private history itself must not ship.
+    find /home/dd/engine -type d -name .git -prune -exec rm -rf {} + 2>/dev/null || true; \
+    # 3) User-level credential stores possibly written during the build.
+    rm -rf /root/.gitconfig /root/.git-credentials /root/.config/git \
+           /root/.netrc /root/.ssh /root/.npm /root/.cache /root/.node-gyp; \
+    # 4) The underpost global env store may hold GITHUB_TOKEN.
+    rm -f "$(underpost root)/underpost/.env" 2>/dev/null || true; \
+    # 5) Build caches, temp, and build-only toolchains. hardhat is contract
+    #    build/CLI tooling (used only to build the coverage docs above); the
+    #    runtime server never imports it, so its dev node_modules is pure bloat.
+    npm cache clean --force 2>/dev/null || true; \
+    rm -rf /home/dd/cyberia-instances \
+           /home/dd/engine/src/client/public/itemledger \
+           /home/dd/engine/src/client/public/cryptokoyn \
+           /home/dd/engine/src/client/components/cryptokoyn \
+           /home/dd/engine/src/client/components/itemledger \
+           /home/dd/engine/src/client/Itemledger.index.js \
+           /home/dd/engine/src/client/Cryptokoyn.index.js \
+           /home/dd/engine/hardhat/node_modules \
+           /home/dd/engine/.npm /tmp/* /var/tmp/* /var/cache/dnf
+
+# ---------------------------------------------------------------------------
+# Stage 2 — runtime: clean base + pinned Node toolchain + scrubbed app tree.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS runtime
+ENV NODE_ENV=development
+
+# Node + npm + the underpost CLI (exact pinned version) from the builder — no
+# re-download, no git/build toolchain. libstdc++ is the only runtime lib the
+# prebuilt Node binary needs beyond the base image.
+COPY --from=builder /usr/local/ /usr/local/
+RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
+    useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
+    # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
+    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
+    # underpost persists its global env at $(npm root -g)/underpost/.env; the
+    # non-root runtime user must be able to write it (fixes EACCES on start).
+    chown -R dd:dd /usr/local/lib/node_modules/underpost
+
+# Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
+COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine
+
+RUN chmod +x /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh && \
+    /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh
+
+# Explicit re-chown: PVC-backed mounts under src/client/public land here at
+# pod start and may override the COPY --chown above with root ownership.
+RUN chown -R dd:dd /home/dd/engine/src/client/public
+
+USER dd
+WORKDIR /home/dd/engine
+
+EXPOSE 4005
+EXPOSE 50051
+
+CMD ["/bin/sh", "-c", "underpost start --run dd-cyberia development"]

package/Dockerfile.test

@@ -0,0 +1,165 @@
+# syntax=docker/dockerfile:1.7
+#
+# engine-cyberia — DEVELOPMENT image (underpost/engine-cyberia-dev).
+#
+# ---------------------------------------------------------------------------
+# Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS builder
+ARG UNDERPOST_VERSION=3.2.70
+# Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
+# underpost's dependencies require >=24.15.0, so install the official binary.
+ARG NODE_VERSION=24.15.0
+ENV NODE_ENV=development
+
+RUN set -eux; \
+    # `sudo` is required because underpost's build steps shell out to
+    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # is just a passthrough, but the binary must exist.
+    dnf install -y git openssl tar xz sudo; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
+    dnf clean all; rm -rf /var/cache/dnf; \
+    npm cache clean --force
+
+WORKDIR /home/dd
+
+# Single hermetic RUN: GitHub credentials are mounted as secrets (readable only
+# here, never persisted), used to clone + build the private dd-cyberia deploy,
+# then every credential/secret/VCS trace is removed BEFORE this layer commits.
+RUN --mount=type=secret,id=github_token \
+    --mount=type=secret,id=github_username \
+    --mount=type=secret,id=cloudinary_cloud_name \
+    --mount=type=secret,id=cloudinary_api_key \
+    --mount=type=secret,id=cloudinary_api_secret \
+    set -eu; \
+    export GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+    export GITHUB_USERNAME="$(cat /run/secrets/github_username)"; \
+    # Cloudinary creds power the `node bin fs --pull` asset downloads below; they
+    # are optional (empty when not provided) so builds that don't need assets
+    # still work.
+    export CLOUDINARY_CLOUD_NAME="$(cat /run/secrets/cloudinary_cloud_name 2>/dev/null || true)"; \
+    export CLOUDINARY_API_KEY="$(cat /run/secrets/cloudinary_api_key 2>/dev/null || true)"; \
+    export CLOUDINARY_API_SECRET="$(cat /run/secrets/cloudinary_api_secret 2>/dev/null || true)"; \
+    \
+    # --- fetch sources under our control, then build WITHOUT itc-scripts -----
+    # itc-scripts are DEPLOY-time provisioning; the DB-seeding parts (`cyberia
+    # ol --drop`, `instance --import`) and the in-cluster .env rewrite cannot run
+    # in a hermetic build, so we strip the scripts and replay ONLY the build-safe
+    # provisioning steps inline (asset pulls, ffmpeg, hardhat deps, cyberia-server
+    # clone). Pre-clone so privateEngineRepoFactory no-ops and --skip-pull-base
+    # reuses the tree.
+    export ENGINE_CYBERIA_REPO="engine-cyberia"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/$ENGINE_CYBERIA_REPO"; \
+    mkdir -p /home/dd/engine; \
+    cp -a ./"$ENGINE_CYBERIA_REPO"/. /home/dd/engine/; \
+    rm -rf ./"$ENGINE_CYBERIA_REPO"; \
+    cd /home/dd/engine; \
+    rm -rf ./engine-private; \
+    underpost clone "$GITHUB_USERNAME/engine-cyberia-private"; \
+    mv ./engine-cyberia-private ./engine-private; \
+    rm -rf ./engine-private/itc-scripts; \
+    \
+    # --- install deps + env, then replay build-safe itc provisioning ----------
+    npm install; \
+    node bin env dd-cyberia development; \
+    node bin fs --pull --recursive --deploy-id dd-cyberia --storage-file-path './engine-private/conf/dd-cyberia/storage.engine-cyberia.json'; \
+    ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
+    ( cd /home/dd/engine && underpost clone underpostnet/cyberia-server ); \
+    \
+    # --- build the client bundle (assets are now in place) --------------------
+    node bin client dd-cyberia; \
+    \
+    # --- bake NON-secret env (placeholders; real creds come from runtime env) -
+    CONF=/home/dd/engine/engine-private/conf/dd-cyberia; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" "$CONF/.env.development"; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" "$CONF/.env.production"; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" "$CONF/.env.test"; \
+    cp -a "$CONF/conf.server.dev.dev.json" "$CONF/conf.server.json"; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" /home/dd/engine/.env; \
+    \
+    # --- drop build-only / non-runtime private material ----------------------
+    rm -rf /home/dd/engine/engine-private/itc-scripts; \
+    rm -rf /home/dd/engine/engine-private/cyberia-instances/FOREST; \
+    rm -rf /home/dd/engine/engine-private/logs; \
+    rm -rf "$CONF/build" "$CONF/instances"; \
+    rm -rf "$CONF/conf.instances.json"; \
+    rm -rf "$CONF/conf.server.dev.underpost.json"; \
+    rm -rf "$CONF/storage.bundle.json"; \
+    rm -rf "$CONF/storage.json"; \
+    rm -rf "$CONF/storage.underpost.json"; \
+    \
+    # --- CREDENTIAL SCRUB (defense in depth, while secrets are still in scope) -
+    # 1) Redact every real secret value from any file it may have reached.
+    for _secret in "$GITHUB_TOKEN" "$CLOUDINARY_API_SECRET" "$CLOUDINARY_API_KEY"; do \
+      [ -n "$_secret" ] || continue; \
+      grep -rlF --exclude-dir=node_modules --exclude-dir=.git "$_secret" /home/dd/engine 2>/dev/null \
+        | xargs -r sed -i "s#${_secret}#__REDACTED__#g" || true; \
+    done; \
+    unset GITHUB_TOKEN GITHUB_USERNAME CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET; \
+    # 2) Every .git dir — clone URLs embed the token in .git/config, and the
+    #    private history itself must not ship.
+    find /home/dd/engine -type d -name .git -prune -exec rm -rf {} + 2>/dev/null || true; \
+    # 3) User-level credential stores possibly written during the build.
+    rm -rf /root/.gitconfig /root/.git-credentials /root/.config/git \
+           /root/.netrc /root/.ssh /root/.npm /root/.cache /root/.node-gyp; \
+    # 4) The underpost global env store may hold GITHUB_TOKEN.
+    rm -f "$(underpost root)/underpost/.env" 2>/dev/null || true; \
+    # 5) Build caches, temp, and build-only toolchains. hardhat is contract
+    #    build/CLI tooling (used only to build the coverage docs above); the
+    #    runtime server never imports it, so its dev node_modules is pure bloat.
+    npm cache clean --force 2>/dev/null || true; \
+    rm -rf /home/dd/engine/src/client/public/itemledger \
+    rm -rf /home/dd/engine/src/client/public/cryptokoyn \
+    rm -rf /home/dd/engine/src/client/components/cryptokoyn \
+    rm -rf /home/dd/engine/src/client/components/itemledger \
+    rm -rf /home/dd/engine/src/client/Itemledger.index.js \
+    rm -rf /home/dd/engine/src/client/Cryptokoyn.index.js \
+    rm -rf /home/dd/engine/hardhat/node_modules \
+           /home/dd/engine/.npm /tmp/* /var/tmp/* /var/cache/dnf
+
+# ---------------------------------------------------------------------------
+# Stage 2 — runtime: clean base + pinned Node toolchain + scrubbed app tree.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS runtime
+ENV NODE_ENV=development
+
+# Node + npm + the underpost CLI (exact pinned version) from the builder — no
+# re-download, no git/build toolchain. libstdc++ is the only runtime lib the
+# prebuilt Node binary needs beyond the base image.
+COPY --from=builder /usr/local/ /usr/local/
+RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
+    useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
+    # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
+    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
+    # underpost persists its global env at $(npm root -g)/underpost/.env; the
+    # non-root runtime user must be able to write it (fixes EACCES on start).
+    chown -R dd:dd /usr/local/lib/node_modules/underpost
+
+# Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
+COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine
+
+RUN chmod +x /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh && \
+    /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh
+
+# Explicit re-chown: PVC-backed mounts under src/client/public land here at
+# pod start and may override the COPY --chown above with root ownership.
+RUN chown -R dd:dd /home/dd/engine/src/client/public
+
+USER dd
+WORKDIR /home/dd/engine
+
+EXPOSE 4005
+EXPOSE 50051
+
+CMD ["/bin/sh", "-c", "underpost start --run dd-cyberia development"]

package/README.md

@@ -224,7 +224,7 @@ cyberia chain register / mint / transfer / burn / pause / unpause
 
 # Named workflows
 cyberia run-workflow import-default-items
-cyberia run-workflow seed-skill-config --instance-code default
+cyberia run-workflow seed-skills
 cyberia run-workflow seed-dialogues
 cyberia run-workflow build-manifest
 cyberia run-workflow build-server-dashboard

package/baremetal/commission-workflows.json

@@ -174,6 +174,7 @@
     "type": "iso-ram",
     "osIdLike": "rhel centos fedora",
     "architecture": "amd64",
+    "infraSetup": "underpost-kubeadm-contour",
     "isoUrl": "https://download.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9-latest-x86_64-boot.iso",
     "tftpPrefix": "envy-rocky9",
     "bootstrapHttpServerPort": 8888,

package/bin/build.js

@@ -140,6 +140,7 @@ const buildDeployTemplate = async (confName) => {
       break;
     }
     default:
+      for (const path of catalog.templatePaths) fs.copySync(`.${path}`, `${basePath}${path}`);
       break;
   }
 
@@ -153,6 +154,16 @@ const buildDeployTemplate = async (confName) => {
   if (!fs.existsSync(`${basePath}/images`)) fs.mkdirSync(`${basePath}/images`);
 
   fs.copyFileSync(`./.github/workflows/${repoName}.ci.yml`, `${basePath}/.github/workflows/${repoName}.ci.yml`);
+  if (fs.existsSync(`./.github/workflows/docker-image.${repoName}.ci.yml`))
+    fs.copyFileSync(
+      `./.github/workflows/docker-image.${repoName}.ci.yml`,
+      `${basePath}/.github/workflows/docker-image.${repoName}.ci.yml`,
+    );
+  if (fs.existsSync(`./.github/workflows/docker-image.${repoName}.dev.ci.yml`))
+    fs.copyFileSync(
+      `./.github/workflows/docker-image.${repoName}.dev.ci.yml`,
+      `${basePath}/.github/workflows/docker-image.${repoName}.dev.ci.yml`,
+    );
   fs.copyFileSync(`./.github/workflows/${repoName}.cd.yml`, `${basePath}/.github/workflows/${repoName}.cd.yml`);
 
   if (fs.existsSync(`./typedoc.${confName}.json`)) {
@@ -178,6 +189,26 @@ const buildDeployTemplate = async (confName) => {
     `${basePath}/.gitignore`,
     fs.readFileSync(`.gitignore`, 'utf8').split('# Ignore ERP / CRM custom prototypes src')[0],
   );
+
+  // Process catalog copies — each [src, dest] pair is copied from engine root to the template target.
+  if (catalog.copies && catalog.copies.length) {
+    for (const [src, dest] of catalog.copies) {
+      if (fs.existsSync(src)) {
+        logger.info(`Build copy`, `${src} -> ${dest}`);
+        fs.copySync(src, `${basePath}/${dest.replace(/^\.\//, '')}`);
+      }
+    }
+  }
+
+  // Process catalog moves — each [src, dest] pair is moved from engine src to template dest.
+  if (catalog.moves && catalog.moves.length) {
+    for (const [src, dest] of catalog.moves) {
+      if (fs.existsSync(src)) {
+        logger.info(`Build move`, `${src} -> ${dest}`);
+        fs.moveSync(src, `${basePath}/${dest.replace(/^\.\//, '')}`, { overwrite: true });
+      }
+    }
+  }
 };
 
 const program = new Command();