cyberia 3.2.5 → 3.2.12

package/src/runtime/cyberia-client/Dockerfile

@@ -0,0 +1,101 @@
+# BUILD_MODE: RELEASE | DEBUG
+ARG BUILD_MODE=RELEASE
+
+# --- Build Image
+FROM rockylinux/rockylinux:9 AS builder
+# Re-declare ARG after FROM so it is in scope for RUN
+ARG BUILD_MODE=RELEASE
+
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing \
+    git \
+    curl \
+    wget \
+    openssl-devel \
+    libnsl \
+    perl \
+    gnupg2 \
+    bzip2 && \
+    dnf clean all
+
+# System packages (raylib gfx + build dependencies)
+RUN dnf groupinstall -y "Development Tools" && \
+    dnf install -y \
+        cmake \
+        unzip \
+        python3 \
+        python3.11 \
+        alsa-lib-devel \
+        mesa-libGL-devel \
+        mesa-libGLU-devel \
+        libX11-devel \
+        libXrandr-devel \
+        libXi-devel \
+        libXcursor-devel \
+        libXinerama-devel \
+        libXfixes-devel \
+        freeglut-devel \
+        glfw-devel \
+        libatomic.x86_64 && \
+    dnf clean all && \
+    alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 2 && \
+    alternatives --set python3 /usr/bin/python3.11
+ENV EMSDK=/opt/emsdk
+ENV PATH="${EMSDK}:${EMSDK}/upstream/emscripten:${PATH}"
+
+# Pin emsdk version for reproducible builds
+ARG EMSDK_VERSION=5.0.6
+WORKDIR /opt
+RUN git clone https://github.com/emscripten-core/emsdk.git ${EMSDK}
+WORKDIR ${EMSDK}
+RUN ./emsdk install ${EMSDK_VERSION} && \
+    ./emsdk activate ${EMSDK_VERSION}
+
+WORKDIR /cyberia-client
+# Build context is the cyberia-client project repo root (the workflow
+# in .github/workflows/docker-image.cyberia-client.ci.yml sets
+# context: . from the cyberia-client checkout). The legacy
+# engine-context layout (COPY cyberia-client/ .) is no longer used.
+COPY . .
+
+# `make clean` first so stale bin/ or build/ artefacts copied in from a
+# developer's local checkout (or a previous Docker layer cache hit)
+# can't shadow a fresh BUILD_MODE rebuild — e.g. mixing a DEBUG-mode
+# index.wasm with a RELEASE-mode index.js once produced the
+# "corrupted heap memory area" panic that masked the real Closure bug.
+RUN make -f Web.mk clean && make -f Web.mk all BUILD_MODE=${BUILD_MODE} OUTPUT_DIR=bin/
+
+# --- Runtime Image
+FROM rockylinux/rockylinux:9 AS runtime
+
+# Runtime needs:
+#   - python3 (serves the built /bin/ static files via server.py)
+#   - nodejs + the underpost CLI globally, for the container-status
+#     lifecycle hooks invoked from conf.instances.json before / after
+#     launching server.py. Installing it at build time avoids the slow
+#     `npm install -g` startup the K8S cmd would otherwise repeat.
+ARG UNDERPOST_VERSION=3.2.9
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing curl git python3 && \
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | bash - && \
+    dnf install -y nodejs && \
+    npm install -g underpost@${UNDERPOST_VERSION} && \
+    dnf clean all && \
+    npm cache clean --force
+
+WORKDIR /home/dd/engine/cyberia-client
+
+COPY --from=builder /cyberia-client/server.py ./server.py
+COPY --from=builder /cyberia-client/bin       ./bin/
+
+ENV CYBERIA_PORT=8081
+ENV CYBERIA_MODE=production
+
+EXPOSE 8081 8082
+
+# Default CMD when the image is run directly (not via K8S cmd).
+# In K8S deploys conf.instances.json supplies its own cmd that wraps
+# container-status hooks + this same server.py invocation.
+CMD ["sh", "-c", "exec python3 server.py ${CYBERIA_PORT} bin ${CYBERIA_MODE}"]

package/src/runtime/cyberia-client/Dockerfile.dev

@@ -0,0 +1,82 @@
+# cyberia-client DEV runtime image.
+#
+# Differences vs the production Dockerfile in this same directory:
+#   - Builds the C/WASM bundle with BUILD_MODE=DEBUG (raylib + emcc keep
+#     symbols, asserts, and DWARF info; the bundle is larger but
+#     debuggable in the browser devtools).
+#   - Default CYBERIA_MODE is `development` instead of `production`.
+#   - Default CYBERIA_PORT is `8082` (debug port) instead of `8081`.
+#   - Keeps `vim-minimal`, `lsof`, `strace`, `procps-ng` in the runtime
+#     image so the operator can attach and inspect a misbehaving pod.
+#   - Does NOT clean the npm cache.
+#
+# Selected automatically by `node bin run instance-build-manifest`
+# whenever the `--dev` flag is set; the production Dockerfile in the
+# same directory is used otherwise.
+
+ARG BUILD_MODE=DEBUG
+
+# --- Build Image
+FROM rockylinux/rockylinux:9 AS builder
+ARG BUILD_MODE=DEBUG
+
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing \
+    git curl wget openssl-devel libnsl perl gnupg2 bzip2 && \
+    dnf clean all
+
+RUN dnf groupinstall -y "Development Tools" && \
+    dnf install -y \
+        cmake unzip python3 python3.11 \
+        alsa-lib-devel mesa-libGL-devel mesa-libGLU-devel \
+        libX11-devel libXrandr-devel libXi-devel libXcursor-devel \
+        libXinerama-devel libXfixes-devel \
+        freeglut-devel glfw-devel libatomic.x86_64 && \
+    dnf clean all && \
+    alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 2 && \
+    alternatives --set python3 /usr/bin/python3.11
+
+ENV EMSDK=/opt/emsdk
+ENV PATH="${EMSDK}:${EMSDK}/upstream/emscripten:${PATH}"
+
+ARG EMSDK_VERSION=5.0.6
+WORKDIR /opt
+RUN git clone https://github.com/emscripten-core/emsdk.git ${EMSDK}
+WORKDIR ${EMSDK}
+RUN ./emsdk install ${EMSDK_VERSION} && \
+    ./emsdk activate ${EMSDK_VERSION}
+
+WORKDIR /cyberia-client
+# Build context is the cyberia-client project repo root (see the
+# production Dockerfile in this directory for the rationale).
+COPY . .
+
+# Dev build: BUILD_MODE=DEBUG keeps symbols, asserts, source maps.
+RUN make -f Web.mk all BUILD_MODE=${BUILD_MODE} OUTPUT_DIR=bin/
+
+# --- Runtime Image
+FROM rockylinux/rockylinux:9 AS runtime
+
+ARG UNDERPOST_VERSION=3.2.9
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing \
+        curl git python3 \
+        procps-ng strace lsof vim-minimal && \
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | bash - && \
+    dnf install -y nodejs && \
+    npm install -g underpost@${UNDERPOST_VERSION} && \
+    dnf clean all
+
+WORKDIR /home/dd/engine/cyberia-client
+
+COPY --from=builder /cyberia-client/server.py ./server.py
+COPY --from=builder /cyberia-client/bin       ./bin/
+
+ENV CYBERIA_PORT=8082
+ENV CYBERIA_MODE=development
+
+EXPOSE 8081 8082
+
+CMD ["sh", "-c", "exec python3 server.py ${CYBERIA_PORT} bin ${CYBERIA_MODE}"]

package/src/runtime/cyberia-server/Dockerfile

@@ -0,0 +1,62 @@
+# --- Build Image
+FROM rockylinux/rockylinux:9 AS builder
+
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing \
+    git \
+    make \
+    golang && \
+    dnf clean all
+
+WORKDIR /build
+
+# Build context is the cyberia-server project repo root (the workflow
+# in .github/workflows/docker-image.cyberia-server.ci.yml sets
+# context: . from the cyberia-server checkout). The legacy
+# engine-context layout (COPY cyberia-server/ .) is no longer used.
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . ./
+RUN chmod +x build.sh && ./build.sh
+
+# --- Runtime Image
+FROM rockylinux/rockylinux:9 AS runtime
+
+# Runtime needs:
+#   - the compiled Go binary (cyberia-server itself)
+#   - nodejs + the underpost CLI globally, for the container-status
+#     lifecycle hooks (`underpost config set container-status ...`) that
+#     the conf.instances.json cmd invokes before / after launching the
+#     server binary. Installing it at build time avoids the slow
+#     `npm install -g` startup the K8S cmd would otherwise have to do
+#     on every pod boot.
+ARG UNDERPOST_VERSION=3.2.9
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing curl git && \
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | bash - && \
+    dnf install -y nodejs && \
+    npm install -g underpost@${UNDERPOST_VERSION} && \
+    dnf clean all && \
+    npm cache clean --force
+
+WORKDIR /home/dd/engine/cyberia-server
+
+COPY --from=builder /build/server ./server
+
+# Static SSR dashboard rendered by `node bin/cyberia run-workflow
+# build-server-dashboard --output-path <project-root>/public/index.html`
+# from inside the engine repo checkout. The Go server's findPublicDir()
+# hard-requires public/index.html at boot and log.Fatalf's without it.
+# CI writes the dashboard into ./public/ at the cyberia-server repo root
+# before docker build picks it up here.
+COPY public/ ./public/
+
+EXPOSE 8081
+
+# Default entrypoint when the image is run directly (not via K8S cmd).
+# In K8S deploys conf.instances.json supplies its own cmd that wraps env
+# sourcing + container-status hooks + this same binary.
+ENTRYPOINT ["/home/dd/engine/cyberia-server/server"]

package/src/runtime/cyberia-server/Dockerfile.dev

@@ -0,0 +1,71 @@
+# cyberia-server DEV runtime image.
+#
+# Differences vs the production Dockerfile in this same directory:
+#   - Builds the Go binary WITHOUT `-trimpath -ldflags="-s -w"` so symbols
+#     and source paths survive into the binary for stack traces and pprof.
+#   - Keeps -race (CGO-free race detector is not available; we still pass
+#     `-gcflags="all=-N -l"` to disable inlining + optimisations so the
+#     dlv debugger and live profilers can attach predictably).
+#   - Keeps `git`, `procps-ng`, `strace`, `lsof`, `vim`, `curl` in the
+#     runtime image so the operator can attach and inspect a misbehaving
+#     pod without re-baking the image. Production keeps the runtime
+#     layer minimal.
+#   - Does NOT strip the npm cache after `npm install -g underpost@…` so
+#     `npm upgrade -g underpost` works in a running container.
+#
+# Selected automatically by `node bin run instance-build-manifest`
+# whenever the `--dev` flag is set; the production Dockerfile in the
+# same directory is used otherwise.
+
+# --- Build Image
+FROM rockylinux/rockylinux:9 AS builder
+
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing \
+    git \
+    make \
+    golang && \
+    dnf clean all
+
+WORKDIR /build
+
+# Build context is the cyberia-server project repo root (see the
+# production Dockerfile in this directory for the rationale).
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . ./
+# Dev build: keep source paths, disable inlining + optimisations.
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+      go build -gcflags="all=-N -l" -o server ./cmd/cyberia-server/ && \
+    echo "DEV build complete: $(pwd)/server"
+
+# --- Runtime Image
+FROM rockylinux/rockylinux:9 AS runtime
+
+ARG UNDERPOST_VERSION=3.2.9
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing \
+        curl git \
+        procps-ng strace lsof vim-minimal && \
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | bash - && \
+    dnf install -y nodejs && \
+    npm install -g underpost@${UNDERPOST_VERSION} && \
+    dnf clean all
+
+WORKDIR /home/dd/engine/cyberia-server
+
+COPY --from=builder /build/server ./server
+
+# Static SSR dashboard — required by the Go server's findPublicDir() at boot.
+# See the production Dockerfile in this directory for the full rationale.
+# The same `node bin/cyberia run-workflow build-server-dashboard --dev
+# --output-path <project-root>/public/index.html` command is executed by
+# the CI workflow before docker build.
+COPY public/ ./public/
+
+EXPOSE 8081
+
+ENTRYPOINT ["/home/dd/engine/cyberia-server/server"]

package/src/runtime/express/Dockerfile

@@ -30,11 +30,11 @@ RUN dnf clean all
 RUN node --version
 RUN npm --version
 
-# Create non-root user for secure container execution (cron jobs, init containers)
-# Deployment containers override to root via securityContext when npm install -g is needed
-RUN useradd -m -u 1000 -s /bin/bash dd
+# Install underpost ci/cd cli
+RUN npm install -g underpost
+RUN underpost --version
 
-# Set working directory
+# Create working directory
 WORKDIR /home/dd
 
 # Expose necessary ports

package/src/runtime/express/Express.js

@@ -15,7 +15,7 @@ import { createServer } from 'http';
 import { loggerFactory, loggerMiddleware } from '../../server/logger.js';
 import { getCapVariableName, newInstance } from '../../client/components/core/CommonJs.js';
 import { MailerProvider } from '../../mailer/MailerProvider.js';
-import { DataBaseProvider } from '../../db/DataBaseProvider.js';
+import { DataBaseProviderService } from '../../db/DataBaseProvider.js';
 import { createPeerServer } from '../../server/peer.js';
 import { createValkeyConnection } from '../../server/valkey.js';
 import { applySecurity, authMiddlewareFactory } from '../../server/auth.js';
@@ -192,7 +192,7 @@ class ExpressService {
       }
 
       // Database and Valkey connections
-      if (db && apis) await DataBaseProvider.load({ apis, host, path, db });
+      if (db && apis) await DataBaseProviderService.load({ apis, host, path, db });
 
       if (valkey) await createValkeyConnection({ host, path }, valkey);
 

package/src/runtime/lampp/Dockerfile

@@ -1,6 +1,6 @@
 FROM rockylinux:9
 
-# Update and install required packages
+# System packages 
 RUN dnf -y update && \
     dnf -y install epel-release && \
     dnf -y install --allowerasing \
@@ -20,13 +20,14 @@ RUN dnf -y update && \
     perl && \
     dnf clean all
 
-# --- Download and install XAMPP (PHP 8.2)
+
+# Download and install XAMPP (PHP 8.2)
 RUN curl -L -o /tmp/xampp-linux-installer.run "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/8.2.12/xampp-linux-x64-8.2.12-0-installer.run" && \
     chmod +x /tmp/xampp-linux-installer.run && \
     bash -c "/tmp/xampp-linux-installer.run --mode unattended" && \
     ln -sf /opt/lampp/lampp /usr/bin/lampp
 
-# --- Create /xampp/htdocs (static root) and set permissions
+# Create /xampp/htdocs (static root) and set permissions
 RUN mkdir -p /opt/lampp/htdocs && \
     chown -R root:root /opt/lampp/htdocs && \
     chmod -R a+rX /opt/lampp/htdocs
@@ -47,11 +48,11 @@ RUN dnf clean all
 RUN node --version
 RUN npm --version
 
-# Create non-root user for secure container execution (cron jobs, init containers)
-# Deployment containers override to root via securityContext when npm install -g is needed
-RUN useradd -m -u 1000 -s /bin/bash dd
+# Install underpost CLI 
+RUN npm install -g underpost
+RUN underpost --version
 
-# Set working directory
+# Runtime root expected by startup/build scripts.
 WORKDIR /home/dd
 
 EXPOSE 22

package/src/runtime/wp/Dockerfile

@@ -1,13 +1,12 @@
 FROM rockylinux:9
 
-# Update and install required packages
+# System packages 
 RUN dnf -y update && \
     dnf -y install epel-release && \
     dnf -y install --allowerasing \
     bzip2 \
     sudo \
     curl \
-    unzip \
     net-tools \
     openssh-server \
     nano \
@@ -21,13 +20,13 @@ RUN dnf -y update && \
     perl && \
     dnf clean all
 
-# --- Download and install XAMPP (PHP 8.2)
+# Download and install XAMPP (PHP 8.2)
 RUN curl -L -o /tmp/xampp-linux-installer.run "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/8.2.12/xampp-linux-x64-8.2.12-0-installer.run" && \
     chmod +x /tmp/xampp-linux-installer.run && \
     bash -c "/tmp/xampp-linux-installer.run --mode unattended" && \
     ln -sf /opt/lampp/lampp /usr/bin/lampp
 
-# --- Create /xampp/htdocs (static root) and set permissions
+# Create /xampp/htdocs (static root) and set permissions
 RUN mkdir -p /opt/lampp/htdocs && \
     chown -R root:root /opt/lampp/htdocs && \
     chmod -R a+rX /opt/lampp/htdocs
@@ -39,25 +38,20 @@ RUN echo 'export PATH="/opt/lampp/bin:/usr/local/bin:${PATH}"' > /etc/profile.d/
 # Provide a no-op sendmail so WP plugins don't error on mail calls
 RUN printf '#!/bin/sh\ncat > /dev/null\n' > /usr/sbin/sendmail && chmod +x /usr/sbin/sendmail
 
+# Install Node.js (includes npm)
+RUN curl -fsSL https://rpm.nodesource.com/setup_24.x | bash - && \
+    dnf install -y nodejs && \
+    dnf clean all
+
 # Install WP-CLI
 RUN curl -sL https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar -o /usr/local/bin/wp && \
     chmod +x /usr/local/bin/wp && \
     wp --info --allow-root
 
-# Install Node.js
-RUN curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
-RUN dnf install nodejs -y
-RUN dnf clean all
-
-# Verify Node.js and npm versions
-RUN node --version
-RUN npm --version
-
-# Create non-root user for secure container execution (cron jobs, init containers)
-# Deployment containers override to root via securityContext when npm install -g is needed
-RUN useradd -m -u 1000 -s /bin/bash dd
+# Install underpost CLI 
+RUN npm install -g underpost
 
-# Set working directory
+# Runtime root expected by startup/build scripts.
 WORKDIR /home/dd
 
 EXPOSE 22

package/src/runtime/wp/Wp.js

@@ -56,10 +56,11 @@ class WpService {
    * to `/usr/local/bin/wp` if it is not already present.
    */
   static ensureWpCli() {
-    const existing = shellExec(`PATH="${LAMPP_BIN}:$PATH" which wp 2>/dev/null || true`, {
+    const existing = shellExec(`PATH="${LAMPP_BIN}:$PATH" which wp`, {
       stdout: true,
       silent: true,
       disableLog: true,
+      silentOnError: true,
     });
     if (existing && existing.trim()) return;
     logger.info('WP-CLI not found — installing to /usr/local/bin/wp');
@@ -76,10 +77,11 @@ class WpService {
    */
   static ensureSendmail() {
     const sendmailPath = '/usr/sbin/sendmail';
-    const existing = shellExec(`test -x "${sendmailPath}" && echo ok || true`, {
+    const existing = shellExec(`test -x "${sendmailPath}" && echo ok`, {
       stdout: true,
       silent: true,
       disableLog: true,
+      silentOnError: true,
     });
     if (existing && existing.trim() === 'ok') return;
     logger.info('sendmail stub missing — creating no-op at /usr/sbin/sendmail');
@@ -494,7 +496,7 @@ Thumbs.db
    * `git clone` yields a fully working site without needing a fresh install.
    *
    * Safe to call repeatedly — `git commit` is a no-op when the working tree
-   * is clean (`|| true` prevents non-zero exit).
+   * is clean (`silentOnError: true` swallows the non-zero exit gracefully).
    *
    * @param {object} opts
    * @param {string}      opts.siteRoot   - Absolute path to the WordPress root.
@@ -514,7 +516,8 @@ Thumbs.db
 
     logger.info(`${host}: persisting site to repository`);
     shellExec(
-      `cd "${siteRoot}" && git add -A && git commit -m "wp provision ${host} $(date -u +%Y-%m-%dT%H:%M:%SZ)" || true`,
+      `cd "${siteRoot}" && git add -A && git commit -m "wp provision ${host} $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,
+      { silentOnError: true },
     );
     shellExec(`cd "${siteRoot}" && underpost push . ${githubOrg}/${repoName} -f`);
     logger.info(`${host}: initial commit pushed to ${githubOrg}/${repoName}`);
@@ -627,7 +630,7 @@ if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROT
 
     // MariaDB export is handled by the shared db.js backup flow — no duplicate dump here.
     if (fs.existsSync(path.join(siteRoot, '.git'))) {
-      shellExec(`cd "${siteRoot}" && git add -A && git commit -m "wp backup $(date -u +%Y-%m-%dT%H:%M:%SZ)" || true`);
+      shellExec(`cd "${siteRoot}" && git add -A && git commit -m "wp backup $(date -u +%Y-%m-%dT%H:%M:%SZ)"`, { silentOnError: true });
       shellExec(`cd "${siteRoot}" && underpost push . ${githubOrg}/${repository.split('/').pop().split('.')[0]}`);
       logger.info(`backup: git push done for ${siteRoot}`);
     } else {

package/src/server/atlas-sprite-sheet-generator.js

@@ -133,6 +133,7 @@ export class AtlasSpriteSheetGenerator {
    */
   static async generateAtlas(objectLayerRenderFrames, itemKey, cellPixelDim = 20, maxAtlasDim = null) {
     const { frames, colors } = objectLayerRenderFrames;
+    const frameDuration = Number(objectLayerRenderFrames?.frame_duration);
 
     // Direction order for consistent packing
     const directionOrder = [
@@ -255,13 +256,13 @@ export class AtlasSpriteSheetGenerator {
         frameMetadata[direction] = [];
       }
 
-      frameMetadata[direction].push({
+      frameMetadata[direction][frameIndex] = {
         x,
         y,
         width: image.bitmap.width,
         height: image.bitmap.height,
         frameIndex,
-      });
+      };
     }
 
     // Convert to PNG buffer
@@ -272,6 +273,7 @@ export class AtlasSpriteSheetGenerator {
       atlasWidth,
       atlasHeight,
       cellPixelDim,
+      frame_duration: Number.isFinite(frameDuration) ? frameDuration : 100,
       frames: frameMetadata,
     };
 

package/src/server/auth.js

@@ -20,7 +20,7 @@ import rateLimit from 'express-rate-limit';
 import slowDown from 'express-slow-down';
 import cors from 'cors';
 import cookieParser from 'cookie-parser';
-import { DataBaseProvider } from '../db/DataBaseProvider.js';
+import { DataBaseProviderService } from '../db/DataBaseProvider.js';
 import { isDevProxyContext } from './conf.js';
 
 const logger = loggerFactory(import.meta);
@@ -229,7 +229,7 @@ const authMiddlewareFactory = (options = { host: '', path: '' }) => {
 
       // Non-guest verify session exists
       if (payload.jwtid && payload.role !== 'guest') {
-        const User = DataBaseProvider.instance[`${payload.host}${payload.path}`].mongoose.models.User;
+        const User = DataBaseProviderService.getModel('user', { host: payload.host, path: payload.path });
         const user = await User.findOne({ _id: payload._id, 'activeSessions._id': payload.jwtid }).lean();
 
         if (!user) {