cyberia 3.2.5 → 3.2.12

package/CLI-HELP.md

@@ -1,4 +1,4 @@
-## underpost ci/cd cli v3.2.5
+## underpost ci/cd cli v3.2.12
 
 ### Usage: `underpost [options] [command]`
   ```
@@ -32,7 +32,7 @@ Commands:
   monitor [options] <deploy-id> [env]                        Manages health server monitoring for specified deployments.
   ssh [options]                                              Manages SSH credentials and sessions for remote access to cluster nodes or services.
   run [options] <runner-id> [path]                           Runs specified scripts using various runners.
-  lxd [options]                                              Manages LXD virtual machines as K3s nodes (control plane or workers).
+  lxd [options] [vm-id]                                      Manages LXD virtual machines as K3s nodes (control plane or workers).
   baremetal [options] [workflow-id]                          Manages baremetal server operations, including installation, database setup, commissioning, and user management.
   release [options] [version]                                Release orchestrator for building new versions and deploying releases of the Underpost CLI.
   help [command]                                             display help for command
@@ -85,18 +85,29 @@ Options:
 Builds client assets, single replicas, and/or syncs environment ports.
 
 Arguments:
-  deploy-id         The deployment ID to build. (default: "dd-default")
-  sub-conf          The sub-configuration for the build. (default: "")
-  host              Comma-separated hosts to filter the build. (default: "")
-  path              Comma-separated paths to filter the build. (default: "")
+  deploy-id                   The deployment ID to build. (default:
+                              "dd-default")
+  sub-conf                    The sub-configuration for the build. (default: "")
+  host                        Comma-separated hosts to filter the build.
+                              (default: "")
+  path                        Comma-separated paths to filter the build.
+                              (default: "")
 
 Options:
-  --sync-env-port   Sync environment port assignments across all deploy IDs
-  --single-replica  Build single replica folders instead of full client
-  --build-zip       Create zip files of the builds
-  --lite-build      Skip full build (default is full build)
-  --icons-build     Build icons
-  -h, --help        display help for command
+  --sync-env-port             Sync environment port assignments across all
+                              deploy IDs
+  --single-replica            Build single replica folders instead of full
+                              client
+  --build-zip                 Create zip files of the builds
+  --split <mb>                Split generated zip files into parts of the
+                              specified size in MB
+  --unzip <build-prefix>      Extract a built client zip or split zip parts
+                              using the given build prefix
+  --merge-zip <build-prefix>  Merge split ZIP parts back into a single ZIP file
+                              for the given build prefix
+  --lite-build                Skip full build (default is full build)
+  --icons-build               Build icons
+  -h, --help                  display help for command
  
 ```
   
@@ -124,6 +135,12 @@ Options:
                                installation.
   --skip-pull-base             Skips cloning repositories, uses current
                                workspace code directly.
+  --skip-full-build            Skips the full client bundle build during
+                               deployment.
+  --pull-bundle                Downloads the pre-built client bundle from
+                               Cloudinary via pull-bundle before starting. Use
+                               together with --skip-full-build to skip the local
+                               build entirely.
   -h, --help                   display help for command
  
 ```
@@ -376,6 +393,7 @@ Options:
                         lists.
   --ban-both-remove     Removes IP addresses from both banned ingress and egress
                         lists.
+  --mac                 Prints the MAC address of the main network interface.
   -h, --help            display help for command
  
 ```
@@ -394,13 +412,18 @@ Arguments:
 Options:
   --reset                              Deletes all clusters and prunes all
                                        related data and caches.
+  --reset-mongodb                      Performs a hard cleanup of only
+                                       MongoDB-related resources (StatefulSet,
+                                       PVCs/PVs, Secrets, ConfigMaps, caches)
+                                       without restarting the whole node.
   --mariadb                            Initializes the cluster with a MariaDB
                                        statefulset.
   --mysql                              Initializes the cluster with a MySQL
                                        statefulset.
   --mongodb                            Initializes the cluster with a MongoDB
                                        statefulset.
-  --mongo-db-host <host>               Set custom mongo db host
+  --service-host <host>                Set custom host/IP for exposed MongoDB
+                                       and Valkey clients.
   --postgresql                         Initializes the cluster with a PostgreSQL
                                        statefulset.
   --mongodb4                           Initializes the cluster with a MongoDB
@@ -411,6 +434,14 @@ Options:
                                        ipfs-cluster statefulset.
   --contour                            Initializes the cluster with Project
                                        Contour base HTTPProxy and Envoy.
+  --node-port                          Exposes enabled ready services (e.g.
+                                       MongoDB 4.4, Valkey) to the host/public
+                                       network via their NodePort Service
+                                       manifest.
+  --node-selector <k8s-node-name>      Pins the just-deployed StatefulSet
+                                       (MongoDB 4.4 / Valkey) to the given
+                                       Kubernetes node once it is ready (via a
+                                       kubernetes.io/hostname nodeSelector).
   --cert-manager                       Initializes the cluster with a Let's
                                        Encrypt production ClusterIssuer.
   --dedicated-gpu                      Initializes the cluster with dedicated
@@ -453,6 +484,10 @@ Options:
                                        hostnames or IP addresses.
   --remove-volume-host-paths           Removes specified volume host paths after
                                        execution.
+  --reset-mode <mode>                  Reset mode for --reset --k3s: "drain"
+                                       (stop services, keep K3s installed) or
+                                       "full" (uninstall + cleanup). Default:
+                                       "full".
   --namespace <namespace>              Kubernetes namespace for cluster
                                        operations (defaults to "default").
   --replicas <replicas>                Sets a custom number of replicas for
@@ -524,9 +559,6 @@ Options:
                                       operations.
   --git-clean                         Runs git clean on volume mount paths
                                       before copying.
-  --etc-hosts                         Enables the etc-hosts context for
-                                      deployment operations.
-  --restore-hosts                     Restores default `/etc/hosts` entries.
   --disable-update-underpost-config   Disables updates to Underpost
                                       configuration during deployment.
   --namespace <namespace>             Kubernetes namespace for deployment
@@ -540,6 +572,18 @@ Options:
                                       auto-detected service port).
   --cmd <cmd>                         Custom initialization command for
                                       deployment (comma-separated commands).
+  --skip-full-build                   Skip client bundle rebuild; container will
+                                      pull pre-built bundle via pull-bundle
+                                      instead.
+  --pull-bundle                       Explicitly pull the pre-built client
+                                      bundle from Cloudinary inside the
+                                      container. Use together with
+                                      --skip-full-build.
+  --image-pull-policy <policy>        Override container imagePullPolicy in the
+                                      generated deployment manifest (Always,
+                                      IfNotPresent, Never). Defaults to Never
+                                      for localhost/ images and IfNotPresent
+                                      otherwise.
   -h, --help                          display help for command
  
 ```
@@ -749,6 +793,7 @@ Options:
   --recursive                              Uploads files recursively from the specified path.
   --deploy-id <deploy-id>                  Specifies the deployment configuration ID for file operations.
   --pull                                   Downloads the specified file.
+  --omit-unzip                             With --pull, keeps the downloaded .zip file and skips extraction.
   --force                                  Forces the action, overriding any warnings or conflicts.
   --storage-file-path <storage-file-path>  Specifies a custom file storage path.
   -h, --help                               display help for command
@@ -877,7 +922,7 @@ Options:
 Runs specified scripts using various runners.
 
 Arguments:
-  runner-id                                       The runner ID to run. Options: dev-cluster,ipfs-expose,metadata,svc-ls,svc-rm,ssh-deploy-info,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,template-deploy-image,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,ssh-deploy-stop,ssh-deploy-db-rollback,ssh-deploy-db,ssh-deploy-db-status,tz,get-proxy,instance-promote,instance,ls-deployments,host-update,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,deploy,disk-clean,disk-devices,disk-usage,dev,service,etc-hosts,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,rmi,kill,generate-pass,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job.
+  runner-id                                       The runner ID to run. Options: dev-cluster,ipfs-expose,metadata,svc-ls,svc-rm,ssh-deploy-info,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,ssh-deploy-stop,ssh-deploy-db-rollback,ssh-deploy-db,ssh-deploy-db-status,tz,get-proxy,instance-promote,instance,instance-build-manifest,ls-deployments,host-update,install-crio,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,deploy,disk-clean,disk-devices,disk-usage,dev,service,etc-hosts,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,pull-rocky-image,rmi,kill,generate-pass,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job,push-bundle,pull-bundle,monitor-ui,shared-dir.
   path                                            The input value, identifier, or path for the operation.
 
 Options:
@@ -925,7 +970,6 @@ Options:
   --k3s                                           Sets the k3s cluster context for the runner execution.
   --kind                                          Sets the kind cluster context for the runner execution.
   --git-clean                                     Runs git clean on volume mount paths before copying.
-  --log-type <log-type>                           Sets the log type for the runner execution.
   --deploy-id <deploy-id>                         Sets deploy id context for the runner execution.
   --user <user>                                   Sets user context for the runner execution.
   --hosts <hosts>                                 Comma-separated list of hosts for the runner execution.
@@ -946,6 +990,9 @@ Options:
   --create-job-now                                After applying cron manifests, immediately create a Job from each CronJob (forwarded to cron runner).
   --host-aliases <host-aliases>                   Adds entries to the Pod /etc/hosts via hostAliases. Format: semicolon-separated entries of "ip=hostname1,hostname2" (e.g., "127.0.0.1=foo.local,bar.local;10.1.2.3=foo.remote,bar.remote").
   --copy                                          Copies the runner output to the clipboard (supported by: generate-pass, template-deploy-local).
+  --skip-full-build                               Skip client bundle rebuild; triggers pull-bundle in container startup (supported by: sync, template-deploy).
+  --pull-bundle                                   Explicitly download the pre-built client bundle from Cloudinary inside the container (supported by: sync, template-deploy). Use together with --skip-full-build.
+  --remove                                        Remove/teardown resources
   -h, --help                                      display help for command
  
 ```
@@ -953,14 +1000,36 @@ Options:
 
 ### `lxd` :
 ```
- Usage: underpost lxd [options]
+ Usage: underpost lxd [options] [vm-id]
 
 Manages LXD virtual machines as K3s nodes (control plane or workers).
 
+Arguments:
+  vm-id                            VM identifier shared by current-VM flags like
+                                   --vm-create, --vm-delete, --vm-init,
+                                   --vm-info, and --vm-test.
+
 Options:
   --init                           Initializes LXD on the current machine via
                                    preseed.
-  --reset                          Removes the LXD snap and purges all data.
+  --reset                          Host-safe reset: removes proxy devices,
+                                   stops/deletes VMs, drops admin-profile and
+                                   lxdbr0. Does NOT touch the LXD snap or
+                                   storage pools.
+  --purge                          DESTRUCTIVE: gracefully shuts down the LXD
+                                   daemon (60s timeout), then removes the LXD
+                                   snap. Combine with --reset to wipe per-VM
+                                   state first. Safe replacement for the prior
+                                   aggressive teardown.
+  --shutdown                       Pre-host-reboot procedure: gracefully stops
+                                   every VM and the LXD daemon. Run BEFORE any
+                                   reboot/poweroff to keep the host bootable.
+  --restore                        Symmetric to --shutdown: starts the LXD
+                                   daemon, waits for it to be responsive, then
+                                   starts every VM. VMs created via
+                                   admin-profile have boot.autostart=false, so
+                                   this is the explicit "bring the lab back up"
+                                   command.
   --install                        Installs the LXD snap.
   --dev                            Use local paths instead of the global npm
                                    installation.
@@ -972,30 +1041,54 @@ Options:
                                    plane node.
   --worker                         Initialize the target VM as a K3s worker
                                    node.
-  --create-vm <vm-name>            Copy the LXC launch command for a new K3s VM
-                                   to the clipboard.
-  --delete-vm <vm-name>            Stop and delete the specified VM.
-  --init-vm <vm-name>              Run k3s-node-setup.sh on the specified VM
-                                   (use with --control or --worker).
-  --info-vm <vm-name>              Display full configuration and status for the
-                                   specified VM.
-  --test <vm-name>                 Run connectivity and health checks on the
-                                   specified VM.
-  --root-size <gb-size>            Root disk size in GiB for --create-vm
+  --vm-create                      Copy the LXC launch command for the command
+                                   argument [vm-id] to the clipboard.
+  --vm-delete                      SAFELY stop and delete the command argument
+                                   [vm-id] (removes proxy devices first, then
+                                   stops, then deletes). Safe to re-run.
+  --vm-init                        Bring the command argument [vm-id] up as a
+                                   K3s node end-to-end: OS base setup, mirror
+                                   /home/dd/engine into the VM, then K3s role
+                                   install via the local engine (use with
+                                   --control or --worker).
+  --vm-info                        Display full configuration and status for the
+                                   command argument [vm-id].
+  --vm-test                        Run connectivity and health checks on the
+                                   command argument [vm-id].
+  --vm-sync-engine                 Re-copy the host engine source into the
+                                   command argument [vm-id], overriding whatever
+                                   is currently there (equivalent to the
+                                   engine-bootstrap step of --vm-init in
+                                   isolation).
+  --root-size <gb-size>            Root disk size in GiB for --vm-create
                                    (default: 32).
   --join-node <nodes>              Join a K3s worker to a control plane.
                                    Standalone format: "workerName,controlName".
-                                   When used with --init-vm --worker, provide
+                                   When used with --vm-init --worker, provide
                                    just the control node name for auto-join.
   --expose <vm-name:ports>         Proxy host ports to a VM (e.g.,
                                    "k3s-control:80,443").
+  --node-port <port>               Customizes the VM-side (connect) port for
+                                   --expose, so the host listens on the given
+                                   port but proxies to this NodePort inside the
+                                   VM (e.g. expose host 27017 -> VM NodePort
+                                   32017).
   --delete-expose <vm-name:ports>  Remove proxied ports from a VM (e.g.,
                                    "k3s-control:80,443").
-  --workflow-id <workflow-id>      Workflow ID to execute via runWorkflow.
-  --vm-id <vm-name>                Target VM name for workflow execution.
-  --deploy-id <deploy-id>          Deployment ID context for workflow execution.
+  --copy                           For two-phase flows that surface a command
+                                   for the user to execute (e.g.
+                                   --create-admin-profile phase 1), copy the
+                                   command to the clipboard instead of printing
+                                   it to the terminal.
   --namespace <namespace>          Kubernetes namespace context (defaults to
                                    "default").
+  --maas-project <project>         LXD project managed by MAAS (e.g.
+                                   "k3s-cluster"). When set, all lxc commands
+                                   target this project so MAAS enumerates the
+                                   VMs in its machines UI.
+  --move-to-project                Stop the [vm-id] VM in the default project,
+                                   move it to --maas-project, then start it so
+                                   MAAS picks it up. Requires --maas-project.
   -h, --help                       display help for command
  
 ```
@@ -1085,6 +1178,9 @@ Options:
   --pwa-build            Runs the pwa-microservices-template update flow: always
                          re-clones, syncs engine sources, installs, builds, and
                          pushes.
+  --dry-run              For --build: previews version-bump changes (per-file
+                         substitution counts) without writing files or running
+                         downstream commands.
   -h, --help             display help for command
  
 ```

package/Dockerfile

@@ -34,10 +34,6 @@ RUN npm --version
 RUN npm install -g underpost
 RUN underpost --version
 
-# Create non-root user for secure container execution (cron jobs, init containers)
-# Deployment containers override to root via securityContext when npm install -g is needed
-RUN useradd -m -u 1000 -s /bin/bash dd
-
 # Create working directory
 WORKDIR /home/dd