cyberia 3.2.22 → 3.2.70

package/src/runtime/engine-cyberia/Dockerfile

@@ -0,0 +1,143 @@
+# syntax=docker/dockerfile:1.7
+#
+# engine-cyberia — PRODUCTION image (underpost/engine-cyberia).
+#
+# ---------------------------------------------------------------------------
+# Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS builder
+ARG UNDERPOST_VERSION=3.2.70
+# Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
+# underpost's dependencies require >=24.15.0, so install the official binary.
+ARG NODE_VERSION=24.15.0
+ENV NODE_ENV=production
+
+RUN set -eux; \
+    # `sudo` is required because underpost's build steps shell out to
+    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # is just a passthrough, but the binary must exist.
+    dnf install -y git openssl tar xz sudo; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
+    dnf clean all; rm -rf /var/cache/dnf; \
+    npm cache clean --force
+
+WORKDIR /home/dd
+
+RUN --mount=type=secret,id=github_username \
+    # --mount=type=secret,id=github_token \
+    set -eu; \
+    export GITHUB_USERNAME="$(cat /run/secrets/github_username)"; \
+    # export GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+    export ENGINE_CYBERIA_REPO="engine-cyberia"; \
+    export INSTANCE_CODE="amethyst-strata-expansion"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/$ENGINE_CYBERIA_REPO"; \
+    mkdir -p /home/dd/engine; \
+    cp -a ./"$ENGINE_CYBERIA_REPO"/. /home/dd/engine/; \
+    rm -rf ./"$ENGINE_CYBERIA_REPO"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/cyberia-instances"; \
+    rm -rf /home/dd/engine/engine-private; \
+    mkdir -p /home/dd/engine/engine-private/conf/dd-cyberia; \
+    cp -a ./cyberia-instances/conf/dd-cyberia/. /home/dd/engine/engine-private/conf/dd-cyberia/.; \
+    cp -a /home/dd/engine/package.json /home/dd/engine/engine-private/conf/dd-cyberia/package.json; \
+    mkdir -p /home/dd/engine/engine-private/cyberia-instances; \
+    cp -a ./cyberia-instances/instances/"$INSTANCE_CODE" /home/dd/engine/engine-private/cyberia-instances/"$INSTANCE_CODE"; \
+    mkdir -p /home/dd/engine/src/client/public/cyberia; \
+    cp -a ./cyberia-instances/public/cyberia/. /home/dd/engine/src/client/public/cyberia/.; \
+    # The engine gRPC server loads its schema at runtime from
+    # cyberia-server/gen/proto/cyberia.proto (src/grpc/cyberia/grpc-server.js);
+    # fetch just that file so the engine can bind :50051 / :4005 without the
+    # full cyberia-server repo.
+    underpost clone "$GITHUB_USERNAME/cyberia-server"; \
+    mkdir -p /home/dd/engine/cyberia-server/gen/proto; \
+    cp -a ./cyberia-server/gen/proto/cyberia.proto /home/dd/engine/cyberia-server/gen/proto/cyberia.proto; \
+    rm -rf ./cyberia-server; \
+    cd /home/dd/engine; \
+    # --- install deps + env, then replay build-safe itc provisioning ----------
+    npm install; \
+    node bin env dd-cyberia production; \
+    ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
+    # --- build the client bundle (assets are now in place) --------------------
+    cd /home/dd/engine; \
+    node bin client dd-cyberia; \
+    # --- CREDENTIAL SCRUB (defense in depth, while secrets are still in scope) -
+    # 1) Redact every real secret value from any file it may have reached.
+    # for _secret in "$GITHUB_TOKEN" "$CLOUDINARY_API_SECRET" "$CLOUDINARY_API_KEY"; do \
+    for _secret in "$GITHUB_USERNAME"; do \
+    # for _secret in "$GITHUB_USERNAME" "$GITHUB_TOKEN"; do \
+      [ -n "$_secret" ] || continue; \
+      grep -rlF --exclude-dir=node_modules --exclude-dir=.git "$_secret" /home/dd/engine 2>/dev/null \
+        | xargs -r sed -i "s#${_secret}#__REDACTED__#g" || true; \
+    done; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET; \
+    unset GITHUB_USERNAME; \
+
+    # 2) Every .git dir — clone URLs embed the token in .git/config, and the
+    #    private history itself must not ship.
+    find /home/dd/engine -type d -name .git -prune -exec rm -rf {} + 2>/dev/null || true; \
+    # 3) User-level credential stores possibly written during the build.
+    rm -rf /root/.gitconfig /root/.git-credentials /root/.config/git \
+           /root/.netrc /root/.ssh /root/.npm /root/.cache /root/.node-gyp; \
+    # 4) The underpost global env store may hold GITHUB_TOKEN.
+    rm -f "$(underpost root)/underpost/.env" 2>/dev/null || true; \
+    # 5) Build caches, temp, and build-only toolchains. hardhat is contract
+    #    build/CLI tooling (used only to build the coverage docs above); the
+    #    runtime server never imports it, so its dev node_modules is pure bloat.
+    npm cache clean --force 2>/dev/null || true; \
+    rm -rf /home/dd/cyberia-instances \
+           /home/dd/engine/src/client/public/itemledger \
+           /home/dd/engine/src/client/public/cryptokoyn \
+           /home/dd/engine/src/client/components/cryptokoyn \
+           /home/dd/engine/src/client/components/itemledger \
+           /home/dd/engine/src/client/Itemledger.index.js \
+           /home/dd/engine/src/client/Cryptokoyn.index.js \
+           /home/dd/engine/hardhat/node_modules \
+           /home/dd/engine/.npm /tmp/* /var/tmp/* /var/cache/dnf
+
+# ---------------------------------------------------------------------------
+# Stage 2 — runtime: clean base + pinned Node toolchain + scrubbed app tree.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS runtime
+ENV NODE_ENV=production
+
+# Node + npm + the underpost CLI (exact pinned version) from the builder — no
+# re-download, no git/build toolchain. libstdc++ is the only runtime lib the
+# prebuilt Node binary needs beyond the base image.
+COPY --from=builder /usr/local/ /usr/local/
+RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
+    useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
+    # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
+    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
+    # underpost persists its global env at $(npm root -g)/underpost/.env; the
+    # non-root runtime user must be able to write it (fixes EACCES on start).
+    chown -R dd:dd /usr/local/lib/node_modules/underpost
+
+# Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
+COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine
+
+RUN chmod +x /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh && \
+    /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh
+
+# Explicit re-chown: PVC-backed mounts under src/client/public land here at
+# pod start and may override the COPY --chown above with root ownership.
+RUN chown -R dd:dd /home/dd/engine/src/client/public
+
+USER dd
+WORKDIR /home/dd/engine
+
+EXPOSE 3005
+EXPOSE 50051
+
+CMD ["/bin/sh", "-c", "underpost start --run dd-cyberia production"]

package/src/runtime/engine-cyberia/Dockerfile.dev

@@ -0,0 +1,143 @@
+# syntax=docker/dockerfile:1.7
+#
+# engine-cyberia — DEVELOPMENT image (underpost/engine-cyberia-dev).
+#
+# ---------------------------------------------------------------------------
+# Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS builder
+ARG UNDERPOST_VERSION=3.2.70
+# Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
+# underpost's dependencies require >=24.15.0, so install the official binary.
+ARG NODE_VERSION=24.15.0
+ENV NODE_ENV=development
+
+RUN set -eux; \
+    # `sudo` is required because underpost's build steps shell out to
+    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # is just a passthrough, but the binary must exist.
+    dnf install -y git openssl tar xz sudo; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
+    dnf clean all; rm -rf /var/cache/dnf; \
+    npm cache clean --force
+
+WORKDIR /home/dd
+
+RUN --mount=type=secret,id=github_username \
+    # --mount=type=secret,id=github_token \
+    set -eu; \
+    export GITHUB_USERNAME="$(cat /run/secrets/github_username)"; \
+    # export GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+    export ENGINE_CYBERIA_REPO="engine-cyberia"; \
+    export INSTANCE_CODE="amethyst-strata-expansion"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/$ENGINE_CYBERIA_REPO"; \
+    mkdir -p /home/dd/engine; \
+    cp -a ./"$ENGINE_CYBERIA_REPO"/. /home/dd/engine/; \
+    rm -rf ./"$ENGINE_CYBERIA_REPO"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/cyberia-instances"; \
+    rm -rf /home/dd/engine/engine-private; \
+    mkdir -p /home/dd/engine/engine-private/conf/dd-cyberia; \
+    cp -a ./cyberia-instances/conf/dd-cyberia/. /home/dd/engine/engine-private/conf/dd-cyberia/.; \
+    cp -a /home/dd/engine/package.json /home/dd/engine/engine-private/conf/dd-cyberia/package.json; \
+    mkdir -p /home/dd/engine/engine-private/cyberia-instances; \
+    cp -a ./cyberia-instances/instances/"$INSTANCE_CODE" /home/dd/engine/engine-private/cyberia-instances/"$INSTANCE_CODE"; \
+    mkdir -p /home/dd/engine/src/client/public/cyberia; \
+    cp -a ./cyberia-instances/public/cyberia/. /home/dd/engine/src/client/public/cyberia/.; \
+    # The engine gRPC server loads its schema at runtime from
+    # cyberia-server/gen/proto/cyberia.proto (src/grpc/cyberia/grpc-server.js);
+    # fetch just that file so the engine can bind :50051 / :4005 without the
+    # full cyberia-server repo.
+    underpost clone "$GITHUB_USERNAME/cyberia-server"; \
+    mkdir -p /home/dd/engine/cyberia-server/gen/proto; \
+    cp -a ./cyberia-server/gen/proto/cyberia.proto /home/dd/engine/cyberia-server/gen/proto/cyberia.proto; \
+    rm -rf ./cyberia-server; \
+    cd /home/dd/engine; \
+    # --- install deps + env, then replay build-safe itc provisioning ----------
+    npm install; \
+    node bin env dd-cyberia development; \
+    ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
+    # --- build the client bundle (assets are now in place) --------------------
+    cd /home/dd/engine; \
+    node bin client dd-cyberia; \
+    # --- CREDENTIAL SCRUB (defense in depth, while secrets are still in scope) -
+    # 1) Redact every real secret value from any file it may have reached.
+    # for _secret in "$GITHUB_TOKEN" "$CLOUDINARY_API_SECRET" "$CLOUDINARY_API_KEY"; do \
+    for _secret in "$GITHUB_USERNAME"; do \
+    # for _secret in "$GITHUB_USERNAME" "$GITHUB_TOKEN"; do \
+      [ -n "$_secret" ] || continue; \
+      grep -rlF --exclude-dir=node_modules --exclude-dir=.git "$_secret" /home/dd/engine 2>/dev/null \
+        | xargs -r sed -i "s#${_secret}#__REDACTED__#g" || true; \
+    done; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET; \
+    unset GITHUB_USERNAME; \
+
+    # 2) Every .git dir — clone URLs embed the token in .git/config, and the
+    #    private history itself must not ship.
+    find /home/dd/engine -type d -name .git -prune -exec rm -rf {} + 2>/dev/null || true; \
+    # 3) User-level credential stores possibly written during the build.
+    rm -rf /root/.gitconfig /root/.git-credentials /root/.config/git \
+           /root/.netrc /root/.ssh /root/.npm /root/.cache /root/.node-gyp; \
+    # 4) The underpost global env store may hold GITHUB_TOKEN.
+    rm -f "$(underpost root)/underpost/.env" 2>/dev/null || true; \
+    # 5) Build caches, temp, and build-only toolchains. hardhat is contract
+    #    build/CLI tooling (used only to build the coverage docs above); the
+    #    runtime server never imports it, so its dev node_modules is pure bloat.
+    npm cache clean --force 2>/dev/null || true; \
+    rm -rf /home/dd/cyberia-instances \
+           /home/dd/engine/src/client/public/itemledger \
+           /home/dd/engine/src/client/public/cryptokoyn \
+           /home/dd/engine/src/client/components/cryptokoyn \
+           /home/dd/engine/src/client/components/itemledger \
+           /home/dd/engine/src/client/Itemledger.index.js \
+           /home/dd/engine/src/client/Cryptokoyn.index.js \
+           /home/dd/engine/hardhat/node_modules \
+           /home/dd/engine/.npm /tmp/* /var/tmp/* /var/cache/dnf
+
+# ---------------------------------------------------------------------------
+# Stage 2 — runtime: clean base + pinned Node toolchain + scrubbed app tree.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS runtime
+ENV NODE_ENV=development
+
+# Node + npm + the underpost CLI (exact pinned version) from the builder — no
+# re-download, no git/build toolchain. libstdc++ is the only runtime lib the
+# prebuilt Node binary needs beyond the base image.
+COPY --from=builder /usr/local/ /usr/local/
+RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
+    useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
+    # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
+    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
+    # underpost persists its global env at $(npm root -g)/underpost/.env; the
+    # non-root runtime user must be able to write it (fixes EACCES on start).
+    chown -R dd:dd /usr/local/lib/node_modules/underpost
+
+# Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
+COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine
+
+RUN chmod +x /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh && \
+    /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh
+
+# Explicit re-chown: PVC-backed mounts under src/client/public land here at
+# pod start and may override the COPY --chown above with root ownership.
+RUN chown -R dd:dd /home/dd/engine/src/client/public
+
+USER dd
+WORKDIR /home/dd/engine
+
+EXPOSE 4005
+EXPOSE 50051
+
+CMD ["/bin/sh", "-c", "underpost start --run dd-cyberia development"]

package/src/runtime/engine-cyberia/Dockerfile.test

@@ -0,0 +1,165 @@
+# syntax=docker/dockerfile:1.7
+#
+# engine-cyberia — DEVELOPMENT image (underpost/engine-cyberia-dev).
+#
+# ---------------------------------------------------------------------------
+# Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS builder
+ARG UNDERPOST_VERSION=3.2.70
+# Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
+# underpost's dependencies require >=24.15.0, so install the official binary.
+ARG NODE_VERSION=24.15.0
+ENV NODE_ENV=development
+
+RUN set -eux; \
+    # `sudo` is required because underpost's build steps shell out to
+    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # is just a passthrough, but the binary must exist.
+    dnf install -y git openssl tar xz sudo; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
+    dnf clean all; rm -rf /var/cache/dnf; \
+    npm cache clean --force
+
+WORKDIR /home/dd
+
+# Single hermetic RUN: GitHub credentials are mounted as secrets (readable only
+# here, never persisted), used to clone + build the private dd-cyberia deploy,
+# then every credential/secret/VCS trace is removed BEFORE this layer commits.
+RUN --mount=type=secret,id=github_token \
+    --mount=type=secret,id=github_username \
+    --mount=type=secret,id=cloudinary_cloud_name \
+    --mount=type=secret,id=cloudinary_api_key \
+    --mount=type=secret,id=cloudinary_api_secret \
+    set -eu; \
+    export GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+    export GITHUB_USERNAME="$(cat /run/secrets/github_username)"; \
+    # Cloudinary creds power the `node bin fs --pull` asset downloads below; they
+    # are optional (empty when not provided) so builds that don't need assets
+    # still work.
+    export CLOUDINARY_CLOUD_NAME="$(cat /run/secrets/cloudinary_cloud_name 2>/dev/null || true)"; \
+    export CLOUDINARY_API_KEY="$(cat /run/secrets/cloudinary_api_key 2>/dev/null || true)"; \
+    export CLOUDINARY_API_SECRET="$(cat /run/secrets/cloudinary_api_secret 2>/dev/null || true)"; \
+    \
+    # --- fetch sources under our control, then build WITHOUT itc-scripts -----
+    # itc-scripts are DEPLOY-time provisioning; the DB-seeding parts (`cyberia
+    # ol --drop`, `instance --import`) and the in-cluster .env rewrite cannot run
+    # in a hermetic build, so we strip the scripts and replay ONLY the build-safe
+    # provisioning steps inline (asset pulls, ffmpeg, hardhat deps, cyberia-server
+    # clone). Pre-clone so privateEngineRepoFactory no-ops and --skip-pull-base
+    # reuses the tree.
+    export ENGINE_CYBERIA_REPO="engine-cyberia"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/$ENGINE_CYBERIA_REPO"; \
+    mkdir -p /home/dd/engine; \
+    cp -a ./"$ENGINE_CYBERIA_REPO"/. /home/dd/engine/; \
+    rm -rf ./"$ENGINE_CYBERIA_REPO"; \
+    cd /home/dd/engine; \
+    rm -rf ./engine-private; \
+    underpost clone "$GITHUB_USERNAME/engine-cyberia-private"; \
+    mv ./engine-cyberia-private ./engine-private; \
+    rm -rf ./engine-private/itc-scripts; \
+    \
+    # --- install deps + env, then replay build-safe itc provisioning ----------
+    npm install; \
+    node bin env dd-cyberia development; \
+    node bin fs --pull --recursive --deploy-id dd-cyberia --storage-file-path './engine-private/conf/dd-cyberia/storage.engine-cyberia.json'; \
+    ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
+    ( cd /home/dd/engine && underpost clone underpostnet/cyberia-server ); \
+    \
+    # --- build the client bundle (assets are now in place) --------------------
+    node bin client dd-cyberia; \
+    \
+    # --- bake NON-secret env (placeholders; real creds come from runtime env) -
+    CONF=/home/dd/engine/engine-private/conf/dd-cyberia; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" "$CONF/.env.development"; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" "$CONF/.env.production"; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" "$CONF/.env.test"; \
+    cp -a "$CONF/conf.server.dev.dev.json" "$CONF/conf.server.json"; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" /home/dd/engine/.env; \
+    \
+    # --- drop build-only / non-runtime private material ----------------------
+    rm -rf /home/dd/engine/engine-private/itc-scripts; \
+    rm -rf /home/dd/engine/engine-private/cyberia-instances/FOREST; \
+    rm -rf /home/dd/engine/engine-private/logs; \
+    rm -rf "$CONF/build" "$CONF/instances"; \
+    rm -rf "$CONF/conf.instances.json"; \
+    rm -rf "$CONF/conf.server.dev.underpost.json"; \
+    rm -rf "$CONF/storage.bundle.json"; \
+    rm -rf "$CONF/storage.json"; \
+    rm -rf "$CONF/storage.underpost.json"; \
+    \
+    # --- CREDENTIAL SCRUB (defense in depth, while secrets are still in scope) -
+    # 1) Redact every real secret value from any file it may have reached.
+    for _secret in "$GITHUB_TOKEN" "$CLOUDINARY_API_SECRET" "$CLOUDINARY_API_KEY"; do \
+      [ -n "$_secret" ] || continue; \
+      grep -rlF --exclude-dir=node_modules --exclude-dir=.git "$_secret" /home/dd/engine 2>/dev/null \
+        | xargs -r sed -i "s#${_secret}#__REDACTED__#g" || true; \
+    done; \
+    unset GITHUB_TOKEN GITHUB_USERNAME CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET; \
+    # 2) Every .git dir — clone URLs embed the token in .git/config, and the
+    #    private history itself must not ship.
+    find /home/dd/engine -type d -name .git -prune -exec rm -rf {} + 2>/dev/null || true; \
+    # 3) User-level credential stores possibly written during the build.
+    rm -rf /root/.gitconfig /root/.git-credentials /root/.config/git \
+           /root/.netrc /root/.ssh /root/.npm /root/.cache /root/.node-gyp; \
+    # 4) The underpost global env store may hold GITHUB_TOKEN.
+    rm -f "$(underpost root)/underpost/.env" 2>/dev/null || true; \
+    # 5) Build caches, temp, and build-only toolchains. hardhat is contract
+    #    build/CLI tooling (used only to build the coverage docs above); the
+    #    runtime server never imports it, so its dev node_modules is pure bloat.
+    npm cache clean --force 2>/dev/null || true; \
+    rm -rf /home/dd/engine/src/client/public/itemledger \
+    rm -rf /home/dd/engine/src/client/public/cryptokoyn \
+    rm -rf /home/dd/engine/src/client/components/cryptokoyn \
+    rm -rf /home/dd/engine/src/client/components/itemledger \
+    rm -rf /home/dd/engine/src/client/Itemledger.index.js \
+    rm -rf /home/dd/engine/src/client/Cryptokoyn.index.js \
+    rm -rf /home/dd/engine/hardhat/node_modules \
+           /home/dd/engine/.npm /tmp/* /var/tmp/* /var/cache/dnf
+
+# ---------------------------------------------------------------------------
+# Stage 2 — runtime: clean base + pinned Node toolchain + scrubbed app tree.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS runtime
+ENV NODE_ENV=development
+
+# Node + npm + the underpost CLI (exact pinned version) from the builder — no
+# re-download, no git/build toolchain. libstdc++ is the only runtime lib the
+# prebuilt Node binary needs beyond the base image.
+COPY --from=builder /usr/local/ /usr/local/
+RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
+    useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
+    # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
+    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
+    # underpost persists its global env at $(npm root -g)/underpost/.env; the
+    # non-root runtime user must be able to write it (fixes EACCES on start).
+    chown -R dd:dd /usr/local/lib/node_modules/underpost
+
+# Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
+COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine
+
+RUN chmod +x /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh && \
+    /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh
+
+# Explicit re-chown: PVC-backed mounts under src/client/public land here at
+# pod start and may override the COPY --chown above with root ownership.
+RUN chown -R dd:dd /home/dd/engine/src/client/public
+
+USER dd
+WORKDIR /home/dd/engine
+
+EXPOSE 4005
+EXPOSE 50051
+
+CMD ["/bin/sh", "-c", "underpost start --run dd-cyberia development"]

package/src/runtime/engine-cyberia/compose.env

@@ -0,0 +1,131 @@
+# Working env-file for the Cyberia ecosystem compose stack (custom workflow).
+# Used as-is by the CLI (not generated). Set real credentials here, then run:
+#   underpost docker-compose --up --deploy-id dd-cyberia --docker-compose-id cyberia
+#
+# Loaded explicitly via --env-file so container service-discovery values (the
+# Docker network hostnames below) are not overridden by any host-local .env.
+
+# --- Ecosystem images (dev variants, published by docker-image.*.dev.ci.yml) --
+# This stack is development-only, so it uses the `-dev` images built from the
+# Dockerfile.dev variants (debug builds + live-inspection tooling).
+MONGO_IMAGE=mongo:latest
+VALKEY_IMAGE=valkey/valkey:latest
+ENGINE_CYBERIA_IMAGE=underpost/engine-cyberia-dev
+ENGINE_CYBERIA_TAG=v3.2.70
+CYBERIA_SERVER_IMAGE=underpost/cyberia-server-dev
+CYBERIA_SERVER_TAG=v3.2.70
+CYBERIA_CLIENT_IMAGE=underpost/cyberia-client-dev
+CYBERIA_CLIENT_TAG=v3.2.70
+PROXY_IMAGE=nginx:stable-alpine
+IPFS_IMAGE=ipfs/kubo:latest
+IPFS_CLUSTER_IMAGE=ipfs/ipfs-cluster:latest
+
+# --- Private-repo bootstrap (engine-cyberia clones the private dd-cyberia conf) -
+# The engine-cyberia image ships only the underpost CLI; at start it runs the
+# `underpost start --build` bootstrap, which clones ${GITHUB_USERNAME}/engine-cyberia.
+GITHUB_USERNAME=underpostnet
+GITHUB_TOKEN=change_me_private_repo_token
+
+# --- MongoDB (translation of Secret mongodb-secret) --------------------------
+MONGO_INITDB_ROOT_USERNAME=admin
+MONGO_INITDB_ROOT_PASSWORD=change_me_dev_password
+
+# --- Application DB / cache connection (Docker service discovery, not localhost)
+NODE_ENV=development
+DB_PROVIDER=mongoose
+DB_HOST=mongodb://mongodb:27017
+DB_REPLICA_SET=rs0
+DB_AUTH_SOURCE=admin
+VALKEY_HOST=valkey-service
+VALKEY_PORT=6379
+
+# --- Cyberia instance wiring (compose service DNS) ---------------------------
+# cyberia-server -> engine-cyberia authority endpoints. INTERNAL only: these use
+# the docker service DNS (engine-cyberia) and must never leak to browser clients.
+INSTANCE_CODE=amethyst-strata-expansion
+ENGINE_API_BASE_URL=http://engine-cyberia:4005
+ENGINE_GRPC_ADDRESS=engine-cyberia:50051
+
+# Client-visible Content Authority origin, forwarded to browser/Raylib clients
+# for every engine-cyberia content/asset/metadata request. Host-reachable
+# (docker publishes engine-cyberia :4005). Distinct from ENGINE_API_BASE_URL:
+# the two responsibilities must never overwrite each other.
+ENGINE_PUBLIC_URL=http://localhost:4005
+ENGINE_GRPC_RELOAD_INTERVAL_SEC=300
+
+# cyberia-server logging. This is the dev stack, so default to DEBUG. Set
+# CYBERIA_SERVER_LOG_LEVEL (debug|info|warn|error) to override the APP_ENV
+# fallback without touching APP_ENV.
+CYBERIA_SERVER_APP_ENV=development
+CYBERIA_SERVER_LOG_LEVEL=
+
+# --- engine-cyberia runtime env (loaded into the container via env_file) -----
+# The dd-cyberia engine (engine-private/conf/dd-cyberia/conf.server.json) needs
+# these to boot: DB auth + per-site DB names, the base PORT (the cyberia host is
+# assigned PORT+1 = 4005, which the healthcheck/nginx target), JWT, and mailer.
+# Secrets are DEV PLACEHOLDERS — no real credentials ship in the public image.
+PORT=4004
+NODE_OPTIONS=--max-old-space-size=8192
+BASE_API=api
+DEFAULT_DEPLOY_ID=dd-cyberia
+DEPLOY_ID=dd-cyberia
+DEFAULT_DEPLOY_HOST=www.cyberiaonline.com
+DEFAULT_DEPLOY_PATH=/
+DISABLE_API_RATE_LIMIT=true
+DOTENV_CONFIG_QUIET=true
+ACCESS_EXPIRE_MINUTES=1440
+REFRESH_EXPIRE_MINUTES=5
+DEV_PROXY_PORT_OFFSET=0
+JWT_SECRET=change_me_dev_jwt_secret
+
+# DB auth (must match the MONGO_INITDB_ROOT_* creds above) + per-site DB names.
+DB_USER=admin
+DB_PASSWORD=change_me_dev_password
+
+DB_NAME_CYBERIA=cyberia
+
+# Mailer / SMTP (dev placeholders — mailer stays inert without real creds).
+MAILER_SENDER_NAME=CYBERIA
+MAILER_SENDER_EMAIL=noreply@example.com
+SMTP_HOST=smtp.example.com
+SMTP_PORT=465
+SMTP_AUTH_USER=change_me
+SMTP_AUTH_PASS=change_me
+MAILER_SENDER_NAME_CYBERIA=CYBERIA
+MAILER_SENDER_EMAIL_CYBERIA=noreply@example.com
+SMTP_HOST_CYBERIA=smtp.example.com
+SMTP_PORT_CYBERIA=465
+SMTP_AUTH_USER_CYBERIA=change_me
+SMTP_AUTH_PASS_CYBERIA=change_me
+
+# Third-party integrations (dev placeholders).
+CLOUDINARY_CLOUD_NAME=change_me
+CLOUDINARY_API_KEY=change_me
+CLOUDINARY_API_SECRET=change_me
+GEMINI_API_KEY=change_me
+HUGGINGFACE_API_KEY=change_me
+DEFAULT_ADMIN_EMAIL=admin@example.com
+DEFAULT_ADMIN_PASSWORD=change_me
+
+# --- IPFS endpoints ----------------------------------------------------------
+# Kubo (content plane) is the `ipfs` service; the Cluster REST API (:9094, pin
+# replication) is the `ipfs-cluster` service. Override only to target a
+# different node.
+IPFS_API_URL=http://ipfs:5001
+IPFS_GATEWAY_URL=http://ipfs:8080
+IPFS_CLUSTER_API_URL=http://ipfs-cluster:9094
+# 32-byte hex shared secret for the ipfs-cluster consensus (dev default is set
+# in docker-compose.yml). Override for a real/shared cluster.
+# CLUSTER_SECRET=
+
+# --- Host-published ports ----------------------------------------------------
+PROXY_HTTP_PORT=80
+IPFS_API_PORT=5001
+IPFS_GATEWAY_PORT=8080
+IPFS_CLUSTER_API_PORT=9094
+MONGO_HOST_PORT=27017
+VALKEY_NODEPORT=32079
+ENGINE_CYBERIA_REST_PORT=4005
+ENGINE_CYBERIA_GRPC_PORT=50051
+CYBERIA_SERVER_PORT=8081
+CYBERIA_CLIENT_PORT=8082