kampodine 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.4.0 — 2026-10-07
+
+**Breaking: project-generic naming.** Every origin-coupled default name is
+gone; the package now speaks only for itself.
+
+- `KAMPODINE_HOST` replaces `ESPELLAR_HOST` everywhere (deploy, env); the
+  key-resolution ladder is `--ssh-key` | `KAMPODINE_SSH_KEY` | ssh-agent /
+  ssh-config — the old `ESPELLAR_SSH_KEY` / `ESSELLAR_SSH_KEY` aliases are
+  no longer mentioned anywhere
+- Guest paths renamed: `/etc/esellar/*` → `/etc/kampodine/*` (env file,
+  deployed-sha, anchor.conf); the anchor watcher is `kampodine-anchor`
+- Service/container/image names: `esellar-api` → `kampodine-api`,
+  `esellar-blue`/`esellar-green` → `kampodine-blue`/`kampodine-green`,
+  golden image `esellar-alpine*` → `kampodine-alpine*`
+- `OCI_COMPARTMENT` is now REQUIRED (no default — compartments are
+  account-specific); `OCI_PROFILE` defaults to `default` (the OCI CLI's
+  own default profile) instead of a named profile
+- Existing guests keep booting, but flips against guests provisioned by
+  older releases need their watcher/paths updated (or re-run
+  `vm-prepare` on a fresh host) since the anchor protocol path changed
+
 ## 0.3.0 — 2026-10-07
 
 Full-lifecycle orchestration with first-class help — the "mini vercel CLI"

package/README.md

@@ -48,12 +48,12 @@ kampodine deploy:
 - **`kampodine deploy`** — stream deploy; `--version <sha>` restreams an
   existing build; `--rollback [sha]` is an instant image-tag rollback (the
   previous image stays on the VM for exactly this)
-- **`kampodine env`** — manage the remote app env file (`/etc/esellar/env`,
+- **`kampodine env`** — manage the remote app env file (`/etc/kampodine/env`,
   0600 root) without ever printing a secret: `list` shows KEY + fingerprints
   only (value length + first 2 chars), `push --file <env>` uploads over ssh
   stdin into a 0600 temp + atomic `mv`, `pull` streams the raw payload to
   stdout or `--out` (written 0600). Host/key resolution is identical to
-  deploy: `--host root@<ip>` | `ESPELLAR_HOST`, `--ssh-key <path>` |
+  deploy: `--host root@<ip>` | `KAMPODINE_HOST`, `--ssh-key <path>` |
   `KAMPODINE_SSH_KEY` | ssh-agent. `env fingerprint` previews the masking
   for any local file — values never leave stdin
 - **`kampodine dns`** — OCI DNS records for the post-sslip.io era:

package/cli.js

@@ -39,7 +39,7 @@ DNS
   dns            OCI DNS records (oci config-file / instance-principal auth ONLY): records | add | rm
 
 ENV
-  env            remote app env file (/etc/esellar/env, 0600): list | push | pull — values NEVER printed, fingerprints only
+  env            remote app env file (/etc/kampodine/env, 0600): list | push | pull — values NEVER printed, fingerprints only
 
 Every command supports --help with usage + examples. All further args pass through to the underlying script.
 `;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kampodine",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Kamal-style deploys for Alpine + Podman hosts, built on kamal-proxy",
   "license": "AGPL-3.0",
   "type": "module",

package/scripts/bluegreen.sh

@@ -8,7 +8,7 @@
 # API call, rollback is the same call reversed.
 #
 # Colors are instance display names: <app>-blue / <app>-green (defaults:
-# esellar-blue / esellar-green).
+# kampodine-blue / kampodine-green).
 # The reserved IP is derived from live OCI state — no local state file.
 #
 # Usage:
@@ -20,7 +20,7 @@
 #
 # FLIP = ACME-FIRST:
 #   1. health gate on the target's own IP
-#   2. anchor.conf written on the TARGET guest over ssh — the esellar-anchor
+#   2. anchor.conf written on the TARGET guest over ssh — the kampodine-anchor
 #      watcher service (shipped by vm-prepare) configures the anchor private
 #      address within one interval; flip waits for `ip addr` to show it
 #   3. OCI assigns the reserved IP to the target's anchor (secondary private
@@ -49,7 +49,7 @@
 # instead — it runs the same ACME-first sequence there.
 #
 # provision has TWO routes:
-#   1. NATIVE  — a UEFI_64 esellar-alpine* custom image exists in the
+#   1. NATIVE  — a UEFI_64 kampodine-alpine* custom image exists in the
 #      compartment: launch it directly (the golden image boots as-is).
 #   2. INJECT (provision-via-migrate) — OCI pins imported custom images to
 #      firmware=BIOS and A1/Ampere is UEFI-only, but the template instance
@@ -63,7 +63,7 @@
 #      'gunzip | sudo dd', reboot, verify /etc/alpine-release). The instance
 #      record keeps the platform image metadata — exactly like the template.
 #
-# Env: OCI_PROFILE (default esellar-api), OCI_COMPARTMENT (default esellar).
+# Env: OCI_PROFILE (default: "default"), OCI_COMPARTMENT (required).
 # Injection extras: ALPINE_QCOW2 (golden disk path), OPS_SSH_PUBKEY (ops
 # public key for the platform-image launch), PLATFORM_SSH_USER (default
 # ubuntu), INJECT_PROBE_SLEEP / INJECT_PROBE_TRIES (ssh wait tuning).
@@ -71,8 +71,8 @@
 # loopback; the reserved IP is checked over :80 with the prod Host header).
 set -euo pipefail
 
-PROFILE="${OCI_PROFILE:-esellar-api}"
-COMPARTMENT_NAME="${OCI_COMPARTMENT:-esellar}"
+PROFILE="${OCI_PROFILE:-default}"
+COMPARTMENT_NAME="${OCI_COMPARTMENT:-kampodine}"
 APP_HOST_HEADER="${APP_HOST_HEADER:-app.example.com}"
 REPO_ROOT="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)}"
 SSH_OPTS=(-o ConnectTimeout=6 -o BatchMode=yes -o StrictHostKeyChecking=accept-new)
@@ -86,7 +86,7 @@ usage() {
   cat <<'EOF'
 
 Each sub-step has its own --help: status | init | provision | flip | rollback.
-Env: OCI_PROFILE (default esellar-api), OCI_COMPARTMENT (default esellar).
+Env: OCI_PROFILE (default: "default"), OCI_COMPARTMENT (required).
 
 Examples:
   kampodine bluegreen status
@@ -181,7 +181,7 @@ compartment_ocid() {
 instance_by_color() {
   local comp="$1" color="$2" row
   row="$(oci compute instance list -c "$comp" --profile "$PROFILE" \
-    --display-name "esellar-$color" --lifecycle-state RUNNING \
+    --display-name "kampodine-$color" --lifecycle-state RUNNING \
     --query 'sort_by(data, &"time-created")[-1] | ["id", "availability-domain"] | join('\'' '\'', @)' \
     --raw-output 2>/dev/null || true)"
   [[ -n "$row" ]] || return 0
@@ -240,7 +240,7 @@ reserved_anchor_ip() {
     return 0
   fi
   oci network private-ip create --profile "$PROFILE" --vnic-id "$vnic" \
-    --display-name "esellar-reserved-anchor" \
+    --display-name "kampodine-reserved-anchor" \
     --query 'data.id' --raw-output 2>/dev/null
 }
 
@@ -249,9 +249,9 @@ FLIP_POLL_SLEEP="${FLIP_POLL_SLEEP:-5}"
 FLIP_ADDR_TRIES="${FLIP_ADDR_TRIES:-12}"   # guest watcher pickup: 12 x 5s = 60s
 FLIP_ACME_TRIES="${FLIP_ACME_TRIES:-24}"   # LE HTTP-01: 24 x 5s = 120s
 
-# Guest anchor protocol (the esellar-anchor watcher half lives in
-# infra/alpine-host/ansible/roles/container-service/files/esellar-anchor.sh —
-# both halves of the conf path must stay in sync: /etc/esellar/anchor.conf).
+# Guest anchor protocol (the kampodine-anchor watcher half lives in
+# infra/alpine-host/ansible/roles/container-service/files/kampodine-anchor.sh —
+# both halves of the conf path must stay in sync: /etc/kampodine/anchor.conf).
 # Remote commands are composed client-side BY DESIGN (vm-prepare convention);
 # the interpolated values are OCI-API derived and regex-gated at the call
 # sites, never user input.
@@ -260,7 +260,7 @@ FLIP_ACME_TRIES="${FLIP_ACME_TRIES:-24}"   # LE HTTP-01: 24 x 5s = 120s
 write_anchor_conf() {
   local ip="$1" addr="$2"
   ssh "${SSH_OPTS[@]}" "root@$ip" \
-    "umask 077; mkdir -p /etc/esellar; printf 'ANCHOR_ADDR=%s\nANCHOR_IFACE=\n' '$addr' > /etc/esellar/anchor.conf && echo ANCHOR_CONF_WRITTEN"
+    "umask 077; mkdir -p /etc/kampodine; printf 'ANCHOR_ADDR=%s\nANCHOR_IFACE=\n' '$addr' > /etc/kampodine/anchor.conf && echo ANCHOR_CONF_WRITTEN"
 }
 
 # shellcheck disable=SC2029
@@ -274,7 +274,7 @@ anchor_addr_ready() {
 read_anchor_conf_addr() {
   local ip="$1" line addr
   line="$(ssh "${SSH_OPTS[@]}" "root@$ip" \
-    'grep -h "^ANCHOR_ADDR=" /etc/esellar/anchor.conf 2>/dev/null | head -n 1' 2>/dev/null || true)"
+    'grep -h "^ANCHOR_ADDR=" /etc/kampodine/anchor.conf 2>/dev/null | head -n 1' 2>/dev/null || true)"
   addr="${line#ANCHOR_ADDR=}"
   addr="${addr//\"/}"
   addr="${addr//\'/}"
@@ -297,7 +297,7 @@ delete_guest_addr() {
 # re-added the address once; retry the delete across one watcher interval.
 cleanup_target_anchor() {
   local ip="$1" addr="$2" i
-  ssh "${SSH_OPTS[@]}" "root@$ip" "rm -f /etc/esellar/anchor.conf" >/dev/null 2>&1 || true
+  ssh "${SSH_OPTS[@]}" "root@$ip" "rm -f /etc/kampodine/anchor.conf" >/dev/null 2>&1 || true
   for ((i = 1; i <= 3; i++)); do
     delete_guest_addr "$ip" "$addr"
     anchor_addr_ready "$ip" "$addr" >/dev/null 2>&1 || return 0
@@ -323,7 +323,7 @@ flip_failure_rollback() {
     if [[ "$bpip" == ocid1.privateip* ]]; then
       if oci network public-ip update --public-ip-id "$rocid" --profile "$PROFILE" \
         --private-ip-id "$bpip" --force >/dev/null 2>&1; then
-        say "rolled back to esellar-$ob (existing anchor $bpip)" >&2
+        say "rolled back to kampodine-$ob (existing anchor $bpip)" >&2
         recovered=1
       fi
     fi
@@ -331,14 +331,14 @@ flip_failure_rollback() {
   if (( ! recovered )); then
     if oci network public-ip update --public-ip-id "$rocid" --profile "$PROFILE" \
       --private-ip-id "" --force --wait-for-state AVAILABLE >/dev/null 2>&1; then
-      say "reserved ip UNASSIGNED (dormant) — no existing anchor on esellar-$ob" >&2
+      say "reserved ip UNASSIGNED (dormant) — no existing anchor on kampodine-$ob" >&2
     else
       cleanup_target_anchor "$tpub" "$taddr"
       die "AUTO-ROLLBACK FAILED — reserved ip state unknown; flip manually via console: $rocid"
     fi
   fi
   cleanup_target_anchor "$tpub" "$taddr"
-  say "esellar-$to cleaned (anchor.conf removed, anchor address deleted) — investigate before retrying" >&2
+  say "kampodine-$to cleaned (anchor.conf removed, anchor address deleted) — investigate before retrying" >&2
 }
 
 # instance_healthy <ephemeral_ip> -> ssh + loopback app check.
@@ -349,7 +349,7 @@ instance_healthy() {
   local ip="$1"
   [[ -n "$ip" ]] || return 1
   ssh "${SSH_OPTS[@]}" "root@$ip" \
-    "rc-service esellar-api status >/dev/null 2>&1 && busybox wget -q -O /dev/null http://127.0.0.1:8080/up" 2>/dev/null
+    "rc-service kampodine-api status >/dev/null 2>&1 && busybox wget -q -O /dev/null http://127.0.0.1:8080/up" 2>/dev/null
 }
 
 # instance_wait_running <iid> — poll lifecycle-state to RUNNING. The OCI CLI's
@@ -365,7 +365,7 @@ instance_wait_running() {
       --query 'data."lifecycle-state"' --raw-output 2>/dev/null || true)"
     case "$state" in
       RUNNING) return 0 ;;
-      FAILED | TERMINATED | TERMINATING) die "esellar instance reached $state — nothing to inject, check the console" ;;
+      FAILED | TERMINATED | TERMINATING) die "kampodine instance reached $state — nothing to inject, check the console" ;;
     esac
     sleep "$sleep_s"
   done
@@ -390,7 +390,7 @@ inject_alpine() {
   # the Alpine verify forever. The scrub below
   # clears the phase file between the two boots; the user's file is never
   # touched.
-  kh="$(mktemp "${TMPDIR:-/tmp}/esellar-inject-kh.XXXXXX")"
+  kh="$(mktemp "${TMPDIR:-/tmp}/kampodine-inject-kh.XXXXXX")"
   iss() { ssh -o UserKnownHostsFile="$kh" "${SSH_OPTS[@]}" "$@"; }
   say "inject: waiting for ssh (${ruser}@${ip}, platform-image first boot)…"
   ssh_wait_probe() { iss "${ruser}@${ip}" true; }
@@ -400,7 +400,7 @@ inject_alpine() {
     [[ "$i" == "$probe_tries" ]] && die "ssh never came up on ${ip} (${ruser}) — check the instance console connection"
     sleep "$probe_sleep"
   done
-  raw="$(mktemp "${TMPDIR:-/tmp}/esellar-inject-raw.XXXXXX")"
+  raw="$(mktemp "${TMPDIR:-/tmp}/kampodine-inject-raw.XXXXXX")"
   say "inject: converting ${qcow2} -> raw…"
   qemu-img convert -O raw "$qcow2" "$raw"
   say "inject: streaming golden disk -> ${ip} boot volume (gunzip | dd, conv=fsync)…"
@@ -440,7 +440,7 @@ inject_alpine() {
   done
   rm -f "$kh"
   [[ -n "$rel" ]] || die "injection streamed but no ALPINE 3.x ssh on ${ip} after reboot (got: '${rel:-nothing}') — check the serial console; terminate, do NOT flip to ${color}"
-  say "INJECTED esellar-$color: Alpine ${rel} boots on ${ip} (instance image metadata stays the platform image — like green)"
+  say "INJECTED kampodine-$color: Alpine ${rel} boots on ${ip} (instance image metadata stays the platform image — like green)"
   say "next: kampodine vm-prepare --host root@${ip} -> kampodine deploy --host root@${ip}"
   say "then 'bluegreen.sh flip --to ${color}' (health-gated) once its app checks green."
 }
@@ -458,11 +458,12 @@ for help_arg in "$@"; do
       ;;
   esac
 done
+[[ -n "${OCI_COMPARTMENT:-}" ]] || die "set OCI_COMPARTMENT=<compartment name or ocid> — no default: compartments are account-specific"
 case "$cmd" in
   status)
     comp="$(compartment_ocid)"
     rp="$(reserved_ip "$comp")"
-    say "== esellar blue/green pair (compartment $COMPARTMENT_NAME) =="
+    say "== kampodine blue/green pair (compartment $COMPARTMENT_NAME) =="
     if [[ -n "$rp" ]]; then
       read -r rocid raddr rholder <<<"$rp"
       say "reserved IP : $raddr ($rocid)"
@@ -475,9 +476,9 @@ case "$cmd" in
       if [[ -n "$row" ]]; then
         read -r iid pub ad <<<"$row"
         if instance_healthy "$pub"; then verdict=HEALTHY; else verdict=UNHEALTHY/unreachable; fi
-        say "esellar-$color : $iid  ip=${pub:-none}  ad=${ad:-?}  app=$verdict"
+        say "kampodine-$color : $iid  ip=${pub:-none}  ad=${ad:-?}  app=$verdict"
       else
-        say "esellar-$color : not provisioned"
+        say "kampodine-$color : not provisioned"
       fi
     done
     ;;
@@ -491,7 +492,7 @@ case "$cmd" in
       exit 0
     fi
     addr="$(oci network public-ip create -c "$comp" --profile "$PROFILE" \
-      --lifetime RESERVED --display-name esellar-active \
+      --lifetime RESERVED --display-name kampodine-active \
       --query 'data."ip-address"' --raw-output)"
     say "created DORMANT reserved IP: $addr (unassigned — no instance attached)"
     say "Point DNS/SSLIP at this address when the pair goes active."
@@ -502,25 +503,25 @@ case "$cmd" in
     color="${1:-}"
     [[ "$color" == blue || "$color" == green ]] || die "usage: kampodine bluegreen provision <blue|green>"
     comp="$(compartment_ocid)"
-    instance_by_color "$comp" "$color" | grep -q . && die "esellar-$color already RUNNING"
+    instance_by_color "$comp" "$color" | grep -q . && die "kampodine-$color already RUNNING"
     # base: the OTHER color's AD + subnet (same fault domain layout), golden image
     other=green; [[ "$color" == green ]] && other=blue
     orow="$(instance_by_color "$comp" "$other")"
-    [[ -n "$orow" ]] || die "esellar-$other not RUNNING — need its AD/subnet as the pair template"
+    [[ -n "$orow" ]] || die "kampodine-$other not RUNNING — need its AD/subnet as the pair template"
     # instance_by_color rows are "<ocid> <ephemeral_public_ip> <ad>" — field 2
     # is the IP, the AD is field 3 (launching with the IP as AD fails).
     read -r oiid _ oad <<<"$orow"
     subnet="$(oci compute vnic-attachment list -c "$comp" --profile "$PROFILE" \
       --instance-id "$oiid" --query 'data[0]."subnet-id"' --raw-output)"
 
-    # Route selection. NATIVE only with a UEFI_64 esellar-alpine* custom image:
+    # Route selection. NATIVE only with a UEFI_64 kampodine-alpine* custom image:
     # OCI pins IMPORTED images to firmware=BIOS and A1 is UEFI-only, so a BIOS
     # verdict means the import would die at launch (Shape ... is not valid for
     # image) — skip it. Otherwise take the template's LIVE image-id from its
     # instance record and inject the golden disk (provision-via-migrate).
     mode="" image=""
     custom="$(oci compute image list -c "$comp" --profile "$PROFILE" --all --sort-by TIMECREATED \
-      --query "data[?\"display-name\" != null && starts_with(\"display-name\", 'esellar-alpine')] | [0].id" \
+      --query "data[?\"display-name\" != null && starts_with(\"display-name\", 'kampodine-alpine')] | [0].id" \
       --raw-output 2>/dev/null || true)"
     if [[ "$custom" == ocid1.image* ]]; then
       fw="$(oci compute image get --image-id "$custom" --profile "$PROFILE" \
@@ -528,7 +529,7 @@ case "$cmd" in
       if [[ "$fw" == "UEFI_64" ]]; then
         image="$custom" mode="native"
       else
-        say "note: newest esellar-alpine* custom image is firmware=${fw:-unknown} — A1 rejects BIOS-pinned imports, skipping to the platform-image + injection route"
+        say "note: newest kampodine-alpine* custom image is firmware=${fw:-unknown} — A1 rejects BIOS-pinned imports, skipping to the platform-image + injection route"
       fi
     fi
     if [[ -z "$image" ]]; then
@@ -536,7 +537,7 @@ case "$cmd" in
         --query 'data."image-id"' --raw-output 2>/dev/null || true)"
       [[ "$image" == ocid1.image* ]] || die "template instance has no resolvable image-id — cannot launch or inject"
       mode="inject"
-      qcow2="${ALPINE_QCOW2:-${REPO_ROOT}/infra/alpine-host/build/esellar-alpine-3.22.6-aarch64.qcow2}"
+      qcow2="${ALPINE_QCOW2:-${REPO_ROOT}/infra/alpine-host/build/kampodine-alpine-3.22.6-aarch64.qcow2}"
       [[ -f "$qcow2" ]] || die "golden qcow2 not found: $qcow2 (build via packer, or set ALPINE_QCOW2)"
       command -v qemu-img >/dev/null 2>&1 || die "qemu-img not found in PATH (brew install qemu) — required for the qcow2 -> raw conversion"
       # ops ssh public key for the platform-image first boot. OPS_SSH_PUBKEY
@@ -549,22 +550,22 @@ case "$cmd" in
         keyfile="$OPS_SSH_PUBKEY"
       else
         agent_keys="$(ssh-add -L 2>/dev/null | grep -v '\.pub$' || true)"
-        [[ -n "$agent_keys" ]] || die "no ssh key available: OPS_SSH_PUBKEY unset and ssh-add lists no keys (ssh-add ~/.ssh/id_ed25519-esellar, or set OPS_SSH_PUBKEY)"
-        keyfile="$(mktemp "${TMPDIR:-/tmp}/esellar-ops-pubkey.XXXXXX")"
+        [[ -n "$agent_keys" ]] || die "no ssh key available: OPS_SSH_PUBKEY unset and ssh-add lists no keys (ssh-add ~/.ssh/id_ed25519-kampodine, or set OPS_SSH_PUBKEY)"
+        keyfile="$(mktemp "${TMPDIR:-/tmp}/kampodine-ops-pubkey.XXXXXX")"
         printf '%s\n' "$agent_keys" > "$keyfile"
         chmod 600 "$keyfile"
       fi
     fi
 
-    say "launching esellar-$color: image=${image:0:60}… ad=$oad subnet=${subnet:0:60}… mode=$mode"
+    say "launching kampodine-$color: image=${image:0:60}… ad=$oad subnet=${subnet:0:60}… mode=$mode"
     # NOTE: --profile stays ON the launch line (script-gates static scan reads
     # the invocation line, not array contents).
     launch_args=(-c "$comp" --availability-domain "$oad" --subnet-id "$subnet"
       --image-id "$image" --shape VM.Standard.A1.Flex --shape-config '{"ocpus":2,"memoryInGBs":12}'
-      --assign-public-ip true --display-name "esellar-$color")
+      --assign-public-ip true --display-name "kampodine-$color")
     [[ "$mode" == "inject" ]] && launch_args+=(--ssh-authorized-keys-file "$keyfile")
     iid="$(oci compute instance launch "${launch_args[@]}" --profile "$PROFILE" --query 'data.id' --raw-output)"
-    say "LAUNCHED esellar-$color: $iid"
+    say "LAUNCHED kampodine-$color: $iid"
     if [[ "$mode" == "native" ]]; then
       say "next: wait RUNNING -> ssh in -> kampodine vm-prepare -> kampodine deploy --host root@<ephemeral-ip>"
       say "then 'bluegreen.sh flip --to $color' (health-gated) once its app checks green."
@@ -594,16 +595,16 @@ case "$cmd" in
     read -r rocid raddr _ <<<"$rp"
     rhost="${raddr//./-}.sslip.io"
     trow="$(instance_by_color "$comp" "$to")"
-    [[ -n "$trow" ]] || die "esellar-$to is not RUNNING — nothing to flip to"
+    [[ -n "$trow" ]] || die "kampodine-$to is not RUNNING — nothing to flip to"
     read -r tiid tpub _ <<<"$trow"
     tvnic="$(primary_vnic_of "$tiid")"
-    [[ -n "$tvnic" ]] || die "no primary VNIC on esellar-$to"
+    [[ -n "$tvnic" ]] || die "no primary VNIC on kampodine-$to"
     tpip="$(reserved_anchor_ip "$tvnic")"
-    [[ "$tpip" == ocid1.privateip* ]] || die "could not resolve/create the reserved-anchor secondary private ip on esellar-$to"
+    [[ "$tpip" == ocid1.privateip* ]] || die "could not resolve/create the reserved-anchor secondary private ip on kampodine-$to"
     if instance_healthy "$tpub"; then
-      say "target health: esellar-$to app HEALTHY on its own IP"
+      say "target health: kampodine-$to app HEALTHY on its own IP"
     else
-      (( force )) || die "esellar-$to app UNHEALTHY — refusing flip (override: --force)"
+      (( force )) || die "kampodine-$to app UNHEALTHY — refusing flip (override: --force)"
       say "target health: UNHEALTHY — flipping anyway (--force)"
     fi
 
@@ -611,19 +612,19 @@ case "$cmd" in
     # once the hostname resolves to the reserved ip AND routes to the target,
     # so the guest anchor address goes FIRST, then the assign, then the cert.
     ob=green; [[ "$to" == green ]] && ob=blue
-    say "flip[1/4]: anchor conf -> esellar-$to guest ($tpub), watcher configures the address"
+    say "flip[1/4]: anchor conf -> kampodine-$to guest ($tpub), watcher configures the address"
     tsubnet="$(oci compute vnic-attachment list -c "$comp" --profile "$PROFILE" \
       --instance-id "$tiid" --query 'data[0]."subnet-id"' --raw-output 2>/dev/null || true)"
-    [[ "$tsubnet" == ocid1.subnet* ]] || die "could not resolve esellar-$to's subnet id"
+    [[ "$tsubnet" == ocid1.subnet* ]] || die "could not resolve kampodine-$to's subnet id"
     tcidr="$(oci network subnet get --subnet-id "$tsubnet" --profile "$PROFILE" \
       --query 'data."cidr-block"' --raw-output 2>/dev/null || true)"
-    [[ "$tcidr" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/[0-9]+$ ]] || die "could not resolve esellar-$to's subnet cidr (got: ${tcidr:-none})"
+    [[ "$tcidr" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/[0-9]+$ ]] || die "could not resolve kampodine-$to's subnet cidr (got: ${tcidr:-none})"
     tanchor_addr="$(oci network private-ip get --private-ip-id "$tpip" --profile "$PROFILE" \
       --query 'data."ip-address"' --raw-output 2>/dev/null || true)"
-    [[ "$tanchor_addr" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || die "could not resolve the anchor private address on esellar-$to"
+    [[ "$tanchor_addr" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || die "could not resolve the anchor private address on kampodine-$to"
     taddr_cidr="${tanchor_addr}/${tcidr##*/}"
     if ! write_anchor_conf "$tpub" "$taddr_cidr" >/dev/null 2>&1; then
-      die "anchor.conf write failed on esellar-$to ($tpub) — nothing mutated, flip aborted"
+      die "anchor.conf write failed on kampodine-$to ($tpub) — nothing mutated, flip aborted"
     fi
     addr_ok=0
     for ((i = 1; i <= FLIP_ADDR_TRIES; i++)); do
@@ -632,15 +633,15 @@ case "$cmd" in
     done
     if (( ! addr_ok )); then
       cleanup_target_anchor "$tpub" "$taddr_cidr"
-      die "guest watcher never configured $taddr_cidr on esellar-$to — is rc-service esellar-anchor running? (conf removed, NOTHING mutated)"
+      die "guest watcher never configured $taddr_cidr on kampodine-$to — is rc-service kampodine-anchor running? (conf removed, NOTHING mutated)"
     fi
-    say "flip[2/4]: guest answers on $taddr_cidr — reserved $raddr -> esellar-$to (anchor $tpip)"
+    say "flip[2/4]: guest answers on $taddr_cidr — reserved $raddr -> kampodine-$to (anchor $tpip)"
     oci network public-ip update --public-ip-id "$rocid" --profile "$PROFILE" \
       --private-ip-id "$tpip" --force --wait-for-state ASSIGNED >/dev/null \
       || { cleanup_target_anchor "$tpub" "$taddr_cidr"; die "OCI flip call failed — guest conf removed; run 'kampodine bluegreen status'"; }
-    say "flip[3/4]: reserved IP ASSIGNED — registering $rhost on esellar-$to's kamal-proxy (ACME HTTP-01 through the reserved ip)…"
+    say "flip[3/4]: reserved IP ASSIGNED — registering $rhost on kampodine-$to's kamal-proxy (ACME HTTP-01 through the reserved ip)…"
     if ! ssh "${SSH_OPTS[@]}" "root@$tpub" \
-      "podman exec kamal-proxy kamal-proxy deploy esellar-api --host=$rhost --target=esellar-api:8080 --tls --health-check-path=/api/auth/ok"; then
+      "podman exec kamal-proxy kamal-proxy deploy kampodine-api --host=$rhost --target=kampodine-api:8080 --tls --health-check-path=/api/auth/ok"; then
       flip_failure_rollback "$to" "$ob" "$comp" "$rocid" "$tpub" "$taddr_cidr"
       exit 1
     fi
@@ -656,14 +657,14 @@ case "$cmd" in
     fi
     served="$(curl -s -m 8 --resolve "$rhost:443:$raddr" "https://$rhost/api/auth/ok" || true)"
     say "flip[4/4]: cert for $rhost VALID + serving through $raddr"
-    say "FLIPPED: https://$raddr/ (https://$rhost/) now serves from esellar-$to"
+    say "FLIPPED: https://$raddr/ (https://$rhost/) now serves from kampodine-$to"
     say "served /api/auth/ok: ${served:-<no body>}"
     ;;
 
   rollback)
     # DORMANT rollback: holder guest cleanup
     # (anchor.conf removal + anchor address delete — the flip tool's explicit
-    # job; the esellar-anchor watcher is add-only) then the OCI unassign
+    # job; the kampodine-anchor watcher is add-only) then the OCI unassign
     # (documented CLI semantics: an empty --private-ip-id unassigns). For a
     # real pair where traffic must land on the other color, use
     # 'flip --to <other>' — it runs the full ACME-first sequence there.
@@ -692,10 +693,10 @@ case "$cmd" in
     if [[ -z "$holder_color" ]]; then
       say "warning: reserved $raddr held by an anchor of neither RUNNING color (terminated instance?) — unassigning without guest cleanup"
     else
-      say "current holder: esellar-$holder_color ($holder_ip) — cleaning the guest anchor, then unassigning"
+      say "current holder: kampodine-$holder_color ($holder_ip) — cleaning the guest anchor, then unassigning"
       conf_addr="$(read_anchor_conf_addr "$holder_ip")"
       cleanup_target_anchor "$holder_ip" "$conf_addr"
-      say "esellar-$holder_color guest cleaned (anchor.conf removed${conf_addr:+, address $conf_addr deleted})"
+      say "kampodine-$holder_color guest cleaned (anchor.conf removed${conf_addr:+, address $conf_addr deleted})"
     fi
     say "unassigning reserved $raddr (-> dormant)…"
     oci network public-ip update --public-ip-id "$rocid" --profile "$PROFILE" \

package/scripts/deploy.sh

@@ -3,7 +3,7 @@
 #
 #   Mac:  podman build (VITE_BUILD_ID=<sha>) -> podman save (docker-archive)
 #         streamed over SSH -> podman load on the VM
-#   VM:   retag to 127.0.0.1:5000/esellar-api:latest -> rc-service esellar-api
+#   VM:   retag to 127.0.0.1:5000/kampodine-api:latest -> rc-service kampodine-api
 #         restart (the OpenRC supervise-daemon service re-runs the whole
 #         `podman run` against :latest — no pull in the run, so restarts are
 #         offline-safe) -> exec-fetch health probe with served-sha verify ->
@@ -26,12 +26,12 @@
 set -euo pipefail
 
 REPO_ROOT="$(git rev-parse --show-toplevel)"
-ESPELLAR_HOST="${ESPELLAR_HOST:-}"
+KAMPODINE_HOST="${KAMPODINE_HOST:-}"
 PROXY_HOST="${PROXY_HOST:-app.example.com}"
-ENV_FILE_REMOTE="/etc/esellar/env"
-DEPLOYED_SHA_FILE="/etc/esellar/deployed-sha"
+ENV_FILE_REMOTE="/etc/kampodine/env"
+DEPLOYED_SHA_FILE="/etc/kampodine/deployed-sha"
 ENV_CLEAR_KEYS='^(NODE_ENV|PORT|LIBSQL_TENANT_DIR|LIBSQL_API_MOUNT|STATIC_SPA_MOUNT)='
-IMAGE="127.0.0.1:5000/esellar-api"
+IMAGE="127.0.0.1:5000/kampodine-api"
 
 MODE="deploy"
 VERSION=""
@@ -40,8 +40,7 @@ REFRESH_CONFIG=0
 # SSH key resolution — GENERIC, no hardcoded personal paths:
 #   1. --ssh-key flag           (explicit, per-invocation)
 #   2. KAMPODINE_SSH_KEY env    (project-level: direnv / .envrc / export)
-#   3. ESSELLAR_SSH_KEY env     (legacy alias, kept for existing setups)
-#   4. empty → ssh-agent and/or the operator's ~/.ssh/config Host block
+#   3. empty → ssh-agent and/or the operator's ~/.ssh/config Host block
 #      (the POSIX way: per-host IdentityFile belongs in ssh config, not here)
 if [ -n "${KAMPODINE_SSH_KEY:-}" ]; then
     SSH_KEY="$KAMPODINE_SSH_KEY"
@@ -66,15 +65,15 @@ EOF
   grep '^#   kampodine deploy' "$0" | sed 's/^#   //'
   cat <<'EOF'
 
-Host/key resolution: --host | ESPELLAR_HOST; --ssh-key | KAMPODINE_SSH_KEY |
-ESPELLAR_SSH_KEY | ssh-agent / ~/.ssh/config.
+Host/key resolution: --host | KAMPODINE_HOST; --ssh-key | KAMPODINE_SSH_KEY |
+KAMPODINE_SSH_KEY | ssh-agent / ~/.ssh/config.
 EOF
   exit 0
 }
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --host) ESPELLAR_HOST="$2"; shift 2 ;;
+    --host) KAMPODINE_HOST="$2"; shift 2 ;;
     --ssh-key) SSH_KEY="$2"; shift 2 ;;
     --version) VERSION="$2"; MODE="version"; shift 2 ;;
     --rollback)
@@ -89,13 +88,13 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 [[ "$VERSION" != *..* && "$VERSION" =~ ^[0-9a-f]{4,40}$|^$ ]] || die "--version must be a git sha fragment"
-[ -n "$ESPELLAR_HOST" ] || die "set ESPELLAR_HOST=root@<vm-ip> (or a ~/.ssh/config Host alias via --host)"
+[ -n "$KAMPODINE_HOST" ] || die "set KAMPODINE_HOST=root@<vm-ip> (or a ~/.ssh/config Host alias via --host)"
 
 SSH_ARGS=(-o ConnectTimeout=10 -o BatchMode=yes)
 [[ -n "$SSH_KEY" ]] && SSH_ARGS+=(-i "$SSH_KEY")
 # $1 is a composed remote command — client-side expansion is the design.
 # shellcheck disable=SC2029
-vm() { ssh "${SSH_ARGS[@]}" "$ESPELLAR_HOST" "$1"; }
+vm() { ssh "${SSH_ARGS[@]}" "$KAMPODINE_HOST" "$1"; }
 
 # --- macOS ssh-agent quirk (first deploy from a fresh machine) ---------------
 if [[ "$(uname -s)" == "Darwin" ]]; then
@@ -141,7 +140,7 @@ vm "podman tag $IMAGE:$VER $IMAGE:latest" || die "stream retag failed"
 
 # --- env file from varlock (schema-only from HEAD; secrets from pass) ----------
 say "generating $ENV_FILE_REMOTE from varlock (schema-only from HEAD; secrets resolve from pass — no plaintext secret files)…"
-ENV_TMP="$(mktemp /tmp/esellar-env.XXXXXX)"
+ENV_TMP="$(mktemp /tmp/kampodine-env.XXXXXX)"
 trap 'rm -f "$ENV_TMP"' EXIT
 # Schema-only resolution: extract the COMMITTED schema into a scratch dir
 # inside the repo (plugin resolution needs node_modules; local
@@ -158,20 +157,20 @@ git -C "$REPO_ROOT" archive HEAD apps/api/.env.schema | tar -x -C "$ENV_SCHEMA_D
   | sed -E 's/^([A-Za-z_][A-Za-z0-9_]*)="(.*)"$/\1=\2/' > "$ENV_TMP" \
   || die "varlock env generation failed (pass store unlocked? schema committed?)"
 printf 'API_GIT_SHA=%s\n' "$VER" >> "$ENV_TMP"
-scp -q "${SSH_ARGS[@]}" "$ENV_TMP" "$ESPELLAR_HOST:/etc/esellar/env.tmp"
-vm "mv /etc/esellar/env.tmp $ENV_FILE_REMOTE && chmod 600 $ENV_FILE_REMOTE"
+scp -q "${SSH_ARGS[@]}" "$ENV_TMP" "$KAMPODINE_HOST:/etc/kampodine/env.tmp"
+vm "mv /etc/kampodine/env.tmp $ENV_FILE_REMOTE && chmod 600 $ENV_FILE_REMOTE"
 rm -f "$ENV_TMP"
 rm -rf "$ENV_SCHEMA_DIR"
 
 if [[ $REFRESH_CONFIG -eq 1 ]]; then
   say "ansible container-service refresh (--tags container-service — rc script/config drift repair)…"
   (cd "$REPO_ROOT/infra/alpine-host/ansible" \
-    && ansible-playbook -i "esellar-vm ansible_host=${ESPELLAR_HOST#*@},ansible_user=${ESPELLAR_HOST%%@*}," playbook.yml --tags container-service --private-key "${SSH_KEY:-~/.ssh/id_ed25519}") \
+    && ansible-playbook -i "kampodine-vm ansible_host=${KAMPODINE_HOST#*@},ansible_user=${KAMPODINE_HOST%%@*}," playbook.yml --tags container-service --private-key "${SSH_KEY:-~/.ssh/id_ed25519}") \
     || die "ansible playbook failed"
 fi
 
-say "rc-service esellar-api restart (supervise-daemon: stop-old/start-new podman run on the retagged :latest)…"
-vm "rc-service esellar-api restart" || die "esellar-api restart failed (rc-service esellar-api status)"
+say "rc-service kampodine-api restart (supervise-daemon: stop-old/start-new podman run on the retagged :latest)…"
+vm "rc-service kampodine-api restart" || die "kampodine-api restart failed (rc-service kampodine-api status)"
 
 say "health probe (host-side wget /api/auth/ok + served-sha — works for node AND scratch images)…"
 HEALTH_OK=0
@@ -188,17 +187,17 @@ for _ in $(seq 1 30); do
   sleep 3
 done
 if [[ $HEALTH_OK -ne 1 ]]; then
-  vm "podman logs --tail 30 esellar-api 2>&1" || true
-  vm "rc-service esellar-api status 2>&1" || true
+  vm "podman logs --tail 30 kampodine-api 2>&1" || true
+  vm "rc-service kampodine-api status 2>&1" || true
   PREV_HINT="$(vm "test -f $DEPLOYED_SHA_FILE && cat $DEPLOYED_SHA_FILE" 2>/dev/null || true)"
   die "container never became healthy — rollback: kampodine deploy --rollback${PREV_HINT:+ $PREV_HINT}"
 fi
-CANARY="$(vm "podman logs esellar-api 2>&1 | grep -c ENV_IMPORT_SUSPECT || true")"
+CANARY="$(vm "podman logs kampodine-api 2>&1 | grep -c ENV_IMPORT_SUSPECT || true")"
 say "container healthy, env-canary hits: $CANARY"
 
 say "kamal-proxy re-point (podman exec — same invocation kamal used)…"
 if vm "podman ps --format '{{.Names}}' | grep -qx kamal-proxy"; then
-  vm "podman exec kamal-proxy kamal-proxy deploy esellar-api --host=$PROXY_HOST --target=esellar-api:8080 --tls --health-check-path=/api/auth/ok" \
+  vm "podman exec kamal-proxy kamal-proxy deploy kampodine-api --host=$PROXY_HOST --target=kampodine-api:8080 --tls --health-check-path=/api/auth/ok" \
     || die "proxy re-point failed (podman logs kamal-proxy)"
 else
   say "  kamal-proxy not running — skipping re-point"

package/scripts/dns.sh

@@ -12,8 +12,8 @@
 # Types are pinned to A | AAAA | CNAME. `add` merges into the existing RRSet
 # (round-robin records survive); `rm` filters it; both are idempotence-aware.
 #
-# Zone/compartment: OCI_PROFILE (default esellar-api), OCI_COMPARTMENT
-# (default esellar). Zone defaults to the compartment's ONLY zone; pass
+# Zone/compartment: OCI_PROFILE (default: "default"), OCI_COMPARTMENT (required)
+# (required). Zone defaults to the compartment's ONLY zone; pass
 # --zone <id-or-name> when several exist.
 #
 # Usage:
@@ -23,8 +23,8 @@
 #   (all: optional --zone <id-or-name>; --instance-principal for instance auth)
 set -euo pipefail
 
-PROFILE="${OCI_PROFILE:-esellar-api}"
-COMPARTMENT_NAME="${OCI_COMPARTMENT:-esellar}"
+PROFILE="${OCI_PROFILE:-default}"
+COMPARTMENT_NAME="${OCI_COMPARTMENT:-kampodine}"
 AUTH_ARGS=()
 
 say() { printf '\033[1;34m[dns]\033[0m %s\n' "$*"; }
@@ -37,13 +37,13 @@ usage() {
 
 Auth is the oci CLI's own — its config file (--profile) or instance
 principal. kampodine never accepts, stores, or logs credential material.
-Zone/compartment: OCI_PROFILE (default esellar-api), OCI_COMPARTMENT (default
-esellar). Types are pinned to A | AAAA | CNAME; ttl range 60..172800.
+Zone/compartment: OCI_PROFILE (default: "default"), OCI_COMPARTMENT (default
+kampodine). Types are pinned to A | AAAA | CNAME; ttl range 60..172800.
 
 Examples:
   kampodine dns records
-  kampodine dns records --zone esellar.example.com
-  kampodine dns add --name app --type A --value 203.0.113.10 --zone esellar.example.com
+  kampodine dns records --zone kampodine.example.com
+  kampodine dns add --name app --type A --value 203.0.113.10 --zone kampodine.example.com
   kampodine dns add --name www --type CNAME --value app.example.com --ttl 3600
   kampodine dns rm --name app --type A --value 203.0.113.10
 EOF
@@ -111,6 +111,8 @@ need_provider() {
     || die "oci CLI not found — brew install oci-cli (https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm), then: oci setup config"
   command -v jq >/dev/null 2>&1 \
     || die "jq not found — brew install jq (dns.sh uses it for RRSet surgery)"
+  [[ -n "${OCI_COMPARTMENT:-}" ]] \
+    || die "set OCI_COMPARTMENT=<compartment name or ocid> — no default: compartments are account-specific"
 }
 
 compartment_ocid() {

package/scripts/env.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# env.sh — manage the remote app env file (/etc/esellar/env, 0600 root).
+# env.sh — manage the remote app env file (/etc/kampodine/env, 0600 root).
 #
 # SECRETS NEVER PRINT. `env list`, `env push`, and the `env pull` summaries
 # surface FINGERPRINTS ONLY: KEY + value length + first 2 characters. Raw
@@ -8,8 +8,8 @@
 # secret ever lands in terminal output, logs, or process args.
 #
 # Host/key resolution is IDENTICAL to deploy.sh:
-#   --host root@<ip> | ESPELLAR_HOST | ~/.ssh/config Host alias
-#   --ssh-key <path> | KAMPODINE_SSH_KEY | ESPELLAR_SSH_KEY (legacy) |
+#   --host root@<ip> | KAMPODINE_HOST | ~/.ssh/config Host alias
+#   --ssh-key <path> | KAMPODINE_SSH_KEY |
 #   ssh-agent (the POSIX default; per-host IdentityFile belongs in ssh config)
 #
 # Usage:
@@ -23,14 +23,14 @@
 # file you push unless you mean to own them here.
 set -euo pipefail
 
-ENV_FILE_REMOTE="${KAMPODINE_ENV_REMOTE:-/etc/esellar/env}"
+ENV_FILE_REMOTE="${KAMPODINE_ENV_REMOTE:-/etc/kampodine/env}"
 ENV_TMP_BASE="$(dirname "$ENV_FILE_REMOTE")"
 
-ESPELLAR_HOST="${ESPELLAR_HOST:-}"
+KAMPODINE_HOST="${KAMPODINE_HOST:-}"
 # SSH key resolution — same ladder as deploy.sh:
 #   1. --ssh-key flag           (explicit, per-invocation)
 #   2. KAMPODINE_SSH_KEY env    (project-level: direnv / .envrc / export)
-#   3. ESPELLAR_SSH_KEY env     (legacy alias, kept for existing setups)
+#   3. KAMPODINE_SSH_KEY env     (legacy alias, kept for existing setups)
 #   4. empty → ssh-agent and/or the operator's ~/.ssh/config Host block
 if [ -n "${KAMPODINE_SSH_KEY:-}" ]; then
     SSH_KEY="$KAMPODINE_SSH_KEY"
@@ -47,8 +47,8 @@ usage() {
 
 Fingerprints NEVER leak values: every line is KEY + value length + first 2 chars.
 Raw values move only in push's upload stream and pull's stdout/--out payload.
-Host/key resolution matches deploy.sh: --host | ESPELLAR_HOST; --ssh-key |
-KAMPODINE_SSH_KEY | ESPELLAR_SSH_KEY | ssh-agent / ~/.ssh/config.
+Host/key resolution matches deploy.sh: --host | KAMPODINE_HOST; --ssh-key |
+KAMPODINE_SSH_KEY | ssh-agent / ~/.ssh/config.
 
 Examples:
   kampodine env list --host root@203.0.113.10
@@ -72,7 +72,7 @@ FILE=""
 OUT=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --host) ESPELLAR_HOST="$2"; shift 2 ;;
+    --host) KAMPODINE_HOST="$2"; shift 2 ;;
     --ssh-key) SSH_KEY="$2"; shift 2 ;;
     --file) FILE="$2"; shift 2 ;;
     --out) OUT="$2"; shift 2 ;;
@@ -85,7 +85,7 @@ SSH_ARGS=(-o ConnectTimeout=10 -o BatchMode=yes)
 [[ -n "$SSH_KEY" ]] && SSH_ARGS+=(-i "$SSH_KEY")
 # $1 is a composed remote command — client-side expansion is the design.
 # shellcheck disable=SC2029
-vm() { ssh "${SSH_ARGS[@]}" "$ESPELLAR_HOST" "$1"; }
+vm() { ssh "${SSH_ARGS[@]}" "$KAMPODINE_HOST" "$1"; }
 
 # --- macOS ssh-agent quirk (first run from a fresh machine) -------------------
 if [[ "$(uname -s)" == "Darwin" ]]; then
@@ -94,7 +94,7 @@ if [[ "$(uname -s)" == "Darwin" ]]; then
 fi
 
 require_host() {
-  [[ -n "$ESPELLAR_HOST" ]] || die "target required: --host root@<ip> or ESPELLAR_HOST=root@<ip> (resolution matches deploy.sh)"
+  [[ -n "$KAMPODINE_HOST" ]] || die "target required: --host root@<ip> or KAMPODINE_HOST=root@<ip> (resolution matches deploy.sh)"
 }
 
 # env_fp_lines — env content on stdin -> fingerprint table on stdout.
@@ -126,7 +126,7 @@ env_fp_lines() {
 }
 
 fetch_remote_env() {
-  vm "cat $ENV_FILE_REMOTE" || die "cannot read $ENV_FILE_REMOTE on $ESPELLAR_HOST (no env file yet? run: kampodine env push --file <env>, or kampodine deploy)"
+  vm "cat $ENV_FILE_REMOTE" || die "cannot read $ENV_FILE_REMOTE on $KAMPODINE_HOST (no env file yet? run: kampodine env push --file <env>, or kampodine deploy)"
 }
 
 case "$SUB" in
@@ -142,7 +142,7 @@ case "$SUB" in
     require_host
     count="$(grep -cE '^[A-Za-z_][A-Za-z0-9_]*=' "$FILE" || true)"
     [[ "${count:-0}" -gt 0 ]] || die "no KEY=VALUE lines in $FILE — nothing to push"
-    say "pushing $FILE -> $ESPELLAR_HOST:$ENV_FILE_REMOTE (fingerprint summary below; values are NEVER printed)"
+    say "pushing $FILE -> $KAMPODINE_HOST:$ENV_FILE_REMOTE (fingerprint summary below; values are NEVER printed)"
     env_fp_lines < "$FILE"
     tmp_remote="$ENV_TMP_BASE/env.tmp.$$"
     # 0600 FROM CREATION: umask 077 + ssh stdin pipe — the temp is never
@@ -151,8 +151,8 @@ case "$SUB" in
     vm "umask 077; cat > $tmp_remote" < "$FILE" || die "upload failed"
     vm "chmod 600 $tmp_remote && mv -f $tmp_remote $ENV_FILE_REMOTE" \
       || die "atomic install failed (remote temp left at: $tmp_remote)"
-    say "installed $ENV_FILE_REMOTE (0600) on $ESPELLAR_HOST"
-    say "restart to apply: ssh $ESPELLAR_HOST 'rc-service esellar-api restart'   # or: kampodine deploy"
+    say "installed $ENV_FILE_REMOTE (0600) on $KAMPODINE_HOST"
+    say "restart to apply: ssh $KAMPODINE_HOST 'rc-service kampodine-api restart'   # or: kampodine deploy"
     ;;
 
   pull)
@@ -167,7 +167,7 @@ case "$SUB" in
       # stdout IS the payload (pipe into whatever needs the values);
       # the human-readable summary goes to stderr, masked.
       printf '%s\n' "$raw"
-      say "fingerprint summary for $ENV_FILE_REMOTE on $ESPELLAR_HOST (payload above on stdout):" >&2
+      say "fingerprint summary for $ENV_FILE_REMOTE on $KAMPODINE_HOST (payload above on stdout):" >&2
       env_fp_lines <<<"$raw" >&2
     fi
     ;;

package/scripts/image-import.sh

@@ -14,26 +14,26 @@
 # Auth: ~/.oci/config (brew install oci-cli; oci setup config) by default, or
 # --from-pass to source API credentials from the local pass store — the key
 # NEVER enters this repo, the image, or any log (values only go into env vars).
-# Every oci call pins --profile $PROFILE (OCI_PROFILE, default esellar-api) —
-# the CLI's DEFAULT profile is NOT the esellar tenancy.
+# Every oci call pins --profile $PROFILE (OCI_PROFILE, default "default") —
+# the CLI's DEFAULT profile is NOT the kampodine tenancy.
 # Placeholder pass paths (create yours to match):
-#   esellar/oci/user         user OCID
-#   esellar/oci/tenancy      tenancy OCID
-#   esellar/oci/fingerprint  API key fingerprint
-#   esellar/oci/api-key      PEM private key
+#   kampodine/oci/user         user OCID
+#   kampodine/oci/tenancy      tenancy OCID
+#   kampodine/oci/fingerprint  API key fingerprint
+#   kampodine/oci/api-key      PEM private key
 #
 # Usage:
 #   kampodine image-import                       # defaults below
 #   kampodine image-import --from-pass
-#   kampodine image-import --image build/esellar-alpine-3.22.6-aarch64.qcow2
+#   kampodine image-import --image build/kampodine-alpine-3.22.6-aarch64.qcow2
 set -euo pipefail
 
 REPO_ROOT="$(git rev-parse --show-toplevel)"
 IMAGE=""
-BUCKET="${OCI_IMPORT_BUCKET:-esellar-image-import}"
-NAME_PREFIX="${OCI_IMPORT_NAME:-esellar-alpine}"
-COMPARTMENT_NAME="${OCI_COMPARTMENT:-esellar}"
-PROFILE="${OCI_PROFILE:-esellar-api}"
+BUCKET="${OCI_IMPORT_BUCKET:-kampodine-image-import}"
+NAME_PREFIX="${OCI_IMPORT_NAME:-kampodine-alpine}"
+COMPARTMENT_NAME="${OCI_COMPARTMENT:-kampodine}"
+PROFILE="${OCI_PROFILE:-default}"
 FROM_PASS=0
 KEEP_OBJECT=0
 
@@ -65,18 +65,19 @@ while [[ $# -gt 0 ]]; do
 done
 
 command -v oci >/dev/null 2>&1 || die "oci CLI not found — brew install oci-cli, then: oci setup config (infra/oci/README.md § CLI setup)"
+[[ -n "${OCI_COMPARTMENT:-}" ]] || die "set OCI_COMPARTMENT=<compartment name or ocid> — no default: compartments are account-specific"
 command -v pass >/dev/null 2>&1 || true
 
 if [[ $FROM_PASS -eq 1 ]]; then
   command -v pass >/dev/null 2>&1 || die "pass not installed (brew install pass)"
   say "sourcing OCI API credentials from pass (values never printed/logged)…"
   for entry in user tenancy fingerprint api-key; do
-    pass show "esellar/oci/$entry" >/dev/null 2>&1 || die "missing pass entry esellar/oci/$entry"
+    pass show "kampodine/oci/$entry" >/dev/null 2>&1 || die "missing pass entry kampodine/oci/$entry"
   done
-  OCI_CLI_USER="$(pass show esellar/oci/user)"
-  OCI_CLI_TENANCY="$(pass show esellar/oci/tenancy)"
-  OCI_CLI_FINGERPRINT="$(pass show esellar/oci/fingerprint)"
-  OCI_CLI_KEY_CONTENT="$(pass show esellar/oci/api-key)"
+  OCI_CLI_USER="$(pass show kampodine/oci/user)"
+  OCI_CLI_TENANCY="$(pass show kampodine/oci/tenancy)"
+  OCI_CLI_FINGERPRINT="$(pass show kampodine/oci/fingerprint)"
+  OCI_CLI_KEY_CONTENT="$(pass show kampodine/oci/api-key)"
   export OCI_CLI_USER OCI_CLI_TENANCY OCI_CLI_FINGERPRINT OCI_CLI_KEY_CONTENT
 fi
 
@@ -84,7 +85,7 @@ fi
 if [[ -z "$IMAGE" ]]; then
   # Constrained glob (our own build output names) — ls is fine here.
   # shellcheck disable=SC2012
-  IMAGE="$(ls -t "$REPO_ROOT/infra/alpine-host/build"/esellar-alpine-*.qcow2 2>/dev/null | head -1 || true)"
+  IMAGE="$(ls -t "$REPO_ROOT/infra/alpine-host/build"/kampodine-alpine-*.qcow2 2>/dev/null | head -1 || true)"
   [[ -n "$IMAGE" ]] || die "no qcow2 under infra/alpine-host/build/ — run: (cd infra/alpine-host && packer build .)"
 fi
 [[ -f "$IMAGE" ]] || die "image not found: $IMAGE"
@@ -96,7 +97,7 @@ NAMESPACE="$(oci os ns get --profile "$PROFILE" --query data --raw-output)"
 
 STAMP="$(date +%Y%m%d-%H%M%S)"
 OBJECT_NAME="${NAME_PREFIX}-${STAMP}.qcow2"
-IMAGE_NAME="${NAME_PREFIX}-$(basename "$IMAGE" .qcow2 | sed 's/^esellar-alpine-//')-${STAMP}"
+IMAGE_NAME="${NAME_PREFIX}-$(basename "$IMAGE" .qcow2 | sed 's/^kampodine-alpine-//')-${STAMP}"
 
 say "uploading $(basename "$IMAGE") -> os://$BUCKET/$OBJECT_NAME"
 oci os object put -bn "$BUCKET" --profile "$PROFILE" --file "$IMAGE" --name "$OBJECT_NAME" --force \
@@ -162,7 +163,7 @@ say "  display   : $IMAGE_NAME"
 say "  firmware  : $IMPORT_FIRMWARE"
 say "next:"
 if [[ "$IMPORT_FIRMWARE" == "UEFI_64" ]]; then
-  say "  A1-ready. kampodine bluegreen provision <blue|green> picks this image (newest esellar-alpine*)."
+  say "  A1-ready. kampodine bluegreen provision <blue|green> picks this image (newest kampodine-alpine*)."
 else
   say "  A1 launch will REJECT this image (firmware $IMPORT_FIRMWARE) — see the WARN above."
 fi

package/scripts/migrate.sh

@@ -15,7 +15,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="${REPO_ROOT:-$(cd "${SCRIPT_DIR}/../../.." && pwd)}"
 TENANT_DIR="${TENANT_DIR:-/data/tenants}"
-SERVICE="${SERVICE:-esellar-api}"
+SERVICE="${SERVICE:-kampodine-api}"
 
 log() { printf '[migrate-all] %s\n' "$*"; }
 fail() { printf '[migrate-all][FAIL] %s\n' "$*" >&2; exit 1; }
@@ -25,7 +25,7 @@ Usage:
   kampodine migrate [--allow-running]
 
 Examples:
-  kampodine migrate                    # stop the API first (rc-service esellar-api stop)
+  kampodine migrate                    # stop the API first (rc-service kampodine-api stop)
   kampodine migrate --allow-running    # deliberate: migrate while the API serves (SQLITE_BUSY risk)
 
 Runs drizzle migrations over the libSQL dbs under TENANT_DIR (default
@@ -51,11 +51,11 @@ command -v pnpm >/dev/null 2>&1 || fail "pnpm not found in PATH"
 [[ -d "$TENANT_DIR" ]] || fail "tenant dir ${TENANT_DIR} does not exist"
 
 # Writing schema while the API serves traffic risks SQLITE_BUSY on a single-writer
-# engine — the service must be stopped first (rc-service esellar-api stop). Override exists
+# engine — the service must be stopped first (rc-service kampodine-api stop). Override exists
 # for deliberate local use.
 if systemctl is-active --quiet "$SERVICE" 2>/dev/null; then
   if [[ $ALLOW_RUNNING -ne 1 ]]; then
-    fail "${SERVICE} is running — stop it first (rc-service esellar-api stop) or pass --allow-running"
+    fail "${SERVICE} is running — stop it first (rc-service kampodine-api stop) or pass --allow-running"
   fi
   log "WARNING: migrating while ${SERVICE} is running (--allow-running)"
 fi

package/scripts/vm-prepare.sh

@@ -12,21 +12,21 @@
 #   2. apk repositories: ensure the v3.22 community repo (podman lives there)
 #   3. podman stack: podman podman-docker crun catatonit netavark
 #      aardvark-dns fuse-overlayfs
-#   4. /etc/esellar/ (kampodine deploy writes /etc/esellar/env here, 0600 root)
+#   4. /etc/kampodine/ (kampodine deploy writes /etc/kampodine/env here, 0600 root)
 #   5. /etc/containers/registries.conf (insecure 127.0.0.1:5000; search docker.io)
 #   6. sysctl net.ipv4.ip_unprivileged_port_start=80 (persisted + applied live)
-#   7. OpenRC services /etc/init.d/esellar-api + /etc/init.d/kamal-proxy
+#   7. OpenRC services /etc/init.d/kampodine-api + /etc/init.d/kamal-proxy
 #      (supervise-daemon around plain `podman run`), rc-update'd into the
 #      default runlevel — that IS boot survival (no quadlets, no systemctl)
-#   8. esellar-anchor: the blue-green reserved-ip flip's GUEST half — a
-#      busybox watcher (no container) that polls /etc/esellar/anchor.conf and
+#   8. kampodine-anchor: the blue-green reserved-ip flip's GUEST half — a
+#      busybox watcher (no container) that polls /etc/kampodine/anchor.conf and
 #      `ip addr add`s the anchor address at flip time. Started+enabled on every
 #      VM, inert without the conf (flip tooling writes it over ssh).
 #   9. kamal-proxy image pulled + service UP — the first deploy execs into it
 #      to issue the fresh ACME certificate
 #
-# The esellar-api container is NOT started here: neither its image (pulled by
-# the first deploy over the registry tunnel) nor /etc/esellar/env (written by
+# The kampodine-api container is NOT started here: neither its image (pulled by
+# the first deploy over the registry tunnel) nor /etc/kampodine/env (written by
 # kampodine deploy) exists yet on a fresh VM.
 #
 # Idempotent: safe to re-run. apk add is a no-op when satisfied; managed files
@@ -36,12 +36,12 @@
 #
 #   kampodine vm-prepare --host root@<new-ip>
 #   ... --pull-images     # + pre-pull the app image over the registry tunnel
-#   ... --ssh-key <path>  # ssh identity (default: agent / ESPELLAR_SSH_KEY)
+#   ... --ssh-key <path>  # ssh identity (default: agent / KAMPODINE_SSH_KEY)
 set -euo pipefail
 
 HOST=""
 DO_PULL=0
-SSH_KEY="${ESPELLAR_SSH_KEY:-}"
+SSH_KEY="${KAMPODINE_SSH_KEY:-}"
 
 say() { printf '\033[1;32m[vm-prepare]\033[0m %s\n' "$*"; }
 die() { printf '\033[1;31m[vm-prepare] FAIL:\033[0m %s\n' "$*" >&2; exit 1; }
@@ -56,7 +56,7 @@ EOF
   cat <<'EOF'
 
 Host/key resolution: --host | (no env default — explicit flag);
---ssh-key | ESPELLAR_SSH_KEY | ssh-agent / ~/.ssh/config.
+--ssh-key | KAMPODINE_SSH_KEY | ssh-agent / ~/.ssh/config.
 EOF
   exit 0
 }
@@ -87,7 +87,7 @@ if [[ "$(uname -s)" == "Darwin" ]]; then
 fi
 
 # --- managed file payloads (built Mac-side, scp'd) ----------------------------
-TMPDIR_LOCAL="$(mktemp -d /tmp/esellar-vm-prepare.XXXXXX)"
+TMPDIR_LOCAL="$(mktemp -d /tmp/kampodine-vm-prepare.XXXXXX)"
 trap 'rm -rf "$TMPDIR_LOCAL"' EXIT
 
 cat > "$TMPDIR_LOCAL/registries.conf" <<'REGISTRIES'
@@ -102,17 +102,17 @@ location = "127.0.0.1:5000"
 insecure = true
 REGISTRIES
 
-cat > "$TMPDIR_LOCAL/60-esellar.conf" <<'SYSCTL'
+cat > "$TMPDIR_LOCAL/60-kampodine.conf" <<'SYSCTL'
 # Managed by packages/kampodine/scripts/vm-prepare.sh — do not hand-edit.
 # OpenRC contract: let unprivileged/container paths bind port 80
 # (kamal-proxy publishes 80+443; belt-and-braces for a future rootless move).
 net.ipv4.ip_unprivileged_port_start=80
 SYSCTL
 
-cat > "$TMPDIR_LOCAL/esellar-api" <<'INITD_API'
+cat > "$TMPDIR_LOCAL/kampodine-api" <<'INITD_API'
 #!/sbin/openrc-run
 # Managed by packages/kampodine/scripts/vm-prepare.sh — do not hand-edit.
-# KEEP IN SYNC with ansible/roles/container-service/templates/esellar-api.initd.j2
+# KEEP IN SYNC with the golden image's container-service init template
 # (rendered with role defaults): vm-prepare bootstraps a fresh VM BEFORE the
 # first ansible converge; ansible owns the file afterwards (drift repair).
 #
@@ -122,7 +122,7 @@ cat > "$TMPDIR_LOCAL/esellar-api" <<'INITD_API'
 # dies, the WHOLE run restarts against the local :latest (no pull inside the
 # run — restarts are offline-safe; the registry tunnel is down between deploys).
 #
-# Env: /etc/esellar/env (0600 root, written by kampodine deploy per deploy) is
+# Env: /etc/kampodine/env (0600 root, written by kampodine deploy per deploy) is
 # the single SECRETS source (podman --env-file reads KEY=VALUE lines directly).
 # The five CLEAR vars (NODE_ENV, PORT, LIBSQL_TENANT_DIR, LIBSQL_API_MOUNT,
 # STATIC_SPA_MOUNT) are owned HERE via -e — deploy filters them out of the env
@@ -130,16 +130,16 @@ cat > "$TMPDIR_LOCAL/esellar-api" <<'INITD_API'
 # (tenant sqlite files) — without the bind mount, tenant data would be
 # container-ephemeral and lost on every restart.
 
-name="esellar-api"
-description="esellar API + SPA container (127.0.0.1:5000/esellar-api:latest on 8080)"
+name="kampodine-api"
+description="kampodine API + SPA container (127.0.0.1:5000/kampodine-api:latest on 8080)"
 
 supervisor=supervise-daemon
 command="/usr/bin/podman"
-command_args="run --rm --name esellar-api --network kamal -p 8080:8080"
+command_args="run --rm --name kampodine-api --network kamal -p 8080:8080"
 command_args="$command_args -v /data/tenants:/data/tenants"
 command_args="$command_args -e NODE_ENV=production -e PORT=8080"
 command_args="$command_args -e LIBSQL_TENANT_DIR=/data/tenants -e LIBSQL_API_MOUNT=1 -e STATIC_SPA_MOUNT=1"
-command_args="$command_args --env-file /etc/esellar/env 127.0.0.1:5000/esellar-api:latest"
+command_args="$command_args --env-file /etc/kampodine/env 127.0.0.1:5000/kampodine-api:latest"
 
 # Respawn forever (blue's restart=always precedent): a crash loop self-heals at
 # the next deploy's restart; the 10s delay bounds log noise.
@@ -147,26 +147,26 @@ respawn_delay=10
 respawn_max=0
 
 # podman run's OWN stderr (missing image, name conflicts, netavark failures);
-# container stdout/stderr go to `podman logs esellar-api`.
-supervise_daemon_args="--stderr /var/log/esellar-api-service.log"
+# container stdout/stderr go to `podman logs kampodine-api`.
+supervise_daemon_args="--stderr /var/log/kampodine-service.log"
 
 depend() {
 	need net
-	after esellar-datamount
+	after kampodine-datamount
 }
 
 start_pre() {
 	# SIGKILLed runs leave the container name holding port 8080 (--rm only
 	# cleans CLEAN exits) — sweep any leftover before the supervised run.
-	podman container exists esellar-api 2>/dev/null && podman rm -f esellar-api >/dev/null 2>&1
+	podman container exists kampodine-api 2>/dev/null && podman rm -f kampodine-api >/dev/null 2>&1
 	return 0
 }
 
 stop_post() {
 	# supervise-daemon killed the podman client; make sure the container goes
 	# down too (TERM -> graceful shutdown, then a tolerant sweep).
-	podman stop --time 10 esellar-api >/dev/null 2>&1 || true
-	podman rm -f --time 0 esellar-api >/dev/null 2>&1 || true
+	podman stop --time 10 kampodine-api >/dev/null 2>&1 || true
+	podman rm -f --time 0 kampodine-api >/dev/null 2>&1 || true
 }
 INITD_API
 
@@ -174,7 +174,7 @@ cat > "$TMPDIR_LOCAL/kamal-proxy" <<'INITD_PROXY'
 #!/sbin/openrc-run
 # Managed by packages/kampodine/scripts/vm-prepare.sh — do not hand-edit.
 # KEEP IN SYNC with ansible/roles/container-service/templates/kamal-proxy.initd.j2
-# (see the esellar-api header for the vm-prepare/ansible split).
+# (see the kampodine-api header for the vm-prepare/ansible split).
 #
 # TLS edge (kamal-proxy, Let's Encrypt HTTP-01 on :80). Publishes 80+443; the
 # LE certs + host->target registrations persist in the kamal-proxy-config named
@@ -182,7 +182,7 @@ cat > "$TMPDIR_LOCAL/kamal-proxy" <<'INITD_PROXY'
 # the first deploy survives container recreation AND reboots. Start-fresh:
 # nothing is carried from the retired blue VM. Target registration happens at
 # deploy time (kampodine deploy: podman exec kamal-proxy kamal-proxy deploy
-# esellar-api --host=$PROXY_HOST --target=esellar-api:8080 --tls
+# kampodine-api --host=$PROXY_HOST --target=kampodine-api:8080 --tls
 # --health-check-path=/api/auth/ok).
 
 name="kamal-proxy"
@@ -212,19 +212,19 @@ stop_post() {
 }
 INITD_PROXY
 
-cat > "$TMPDIR_LOCAL/esellar-anchor.sh" <<'ANCHOR_WATCHER'
+cat > "$TMPDIR_LOCAL/kampodine-anchor.sh" <<'ANCHOR_WATCHER'
 #!/bin/sh
-# KEEP IN SYNC with ansible/roles/container-service/files/esellar-anchor.sh
+# KEEP IN SYNC with ansible/roles/container-service/files/kampodine-anchor.sh
 # (vm-prepare rendered-content convention: vm-prepare bootstraps a fresh VM
 # BEFORE the first ansible converge; ansible owns the file afterwards).
 #
-# esellar-anchor.sh — guest half of the blue-green reserved-ip flip.
+# kampodine-anchor.sh — guest half of the blue-green reserved-ip flip.
 #
 # OCI assigns the reserved PUBLIC ip to a SECONDARY private ip ("the anchor")
 # on the instance VNIC, but this image has NO oracle-cloud-agent: nothing
 # configures that private ip inside the guest, so packets to the reserved ip
 # die until the address exists on the interface. `kampodine bluegreen flip` writes
-# /etc/esellar/anchor.conf over ssh at flip time; this watcher polls it and
+# /etc/kampodine/anchor.conf over ssh at flip time; this watcher polls it and
 # runs `ip addr add` within one interval. The unit is enabled+started on every
 # VM by default and is INERT without the conf — a VM that never flips never
 # touches its addresses.
@@ -236,13 +236,13 @@ cat > "$TMPDIR_LOCAL/esellar-anchor.sh" <<'ANCHOR_WATCHER'
 # ADD-ONLY BY DESIGN: this script NEVER removes or flushes addresses (rollback
 # cleanup is the flip tool's explicit ssh job). Idempotent: a present address
 # is a no-op. Only state TRANSITIONS are logged (bounded log noise), to
-# stdout — supervise-daemon tees it to /var/log/esellar-anchor.log.
+# stdout — supervise-daemon tees it to /var/log/kampodine-anchor.log.
 
-CONF="/etc/esellar/anchor.conf"
-INTERVAL="${ESPELLAR_ANCHOR_INTERVAL:-5}"
+CONF="/etc/kampodine/anchor.conf"
+INTERVAL="${KAMPODINE_ANCHOR_INTERVAL:-5}"
 STATE="boot" # last logged transition (boot | idle | added | error)
 
-log() { printf '%s esellar-anchor: %s\n' "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$*"; }
+log() { printf '%s kampodine-anchor: %s\n' "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$*"; }
 
 # supervise-daemon SIGTERMs on stop — die cleanly with the current tick.
 trap 'exit 0' TERM INT
@@ -283,33 +283,33 @@ while :; do
 done
 ANCHOR_WATCHER
 
-cat > "$TMPDIR_LOCAL/esellar-anchor" <<'INITD_ANCHOR'
+cat > "$TMPDIR_LOCAL/kampodine-anchor" <<'INITD_ANCHOR'
 #!/sbin/openrc-run
 # Managed by packages/kampodine/scripts/vm-prepare.sh — do not hand-edit.
-# KEEP IN SYNC with ansible/roles/container-service/templates/esellar-anchor.initd.j2
-# (rendered with role defaults — see the esellar-api header for the
+# KEEP IN SYNC with ansible/roles/container-service/templates/kampodine-anchor.initd.j2
+# (rendered with role defaults — see the kampodine-api header for the
 # vm-prepare/ansible split).
 #
 # Guest half of the blue-green reserved-ip flip: supervise-daemon runs the
-# esellar-anchor.sh watcher, which polls /etc/esellar/anchor.conf (written by
+# kampodine-anchor.sh watcher, which polls /etc/kampodine/anchor.conf (written by
 # `kampodine bluegreen flip` over ssh at flip time) and `ip addr add`s the
 # anchor address when it appears. Started+enabled on EVERY vm by default and
 # INERT without the conf: a VM that never flips never touches its addresses —
-# unlike the container units, there is no esellar_start_containers gate.
-# Transitions land in /var/log/esellar-anchor.log.
+# unlike the container units, there is no kampodine_start_containers gate.
+# Transitions land in /var/log/kampodine-anchor.log.
 
-name="esellar-anchor"
+name="kampodine-anchor"
 description="Blue-green reserved-ip anchor address watcher (guest half of the flip)"
 
 supervisor=supervise-daemon
-command="/usr/local/sbin/esellar-anchor.sh"
+command="/usr/local/sbin/kampodine-anchor.sh"
 
 # Respawn forever: the watcher itself never exits (trap TERM/INT -> exit 0 on
 # stop), so a respawn means the script died abnormally — retry gently.
 respawn_delay=5
 respawn_max=0
 
-supervise_daemon_args="--stdout /var/log/esellar-anchor.log --stderr /var/log/esellar-anchor.log"
+supervise_daemon_args="--stdout /var/log/kampodine-anchor.log --stderr /var/log/kampodine-anchor.log"
 
 depend() {
 	need net
@@ -366,7 +366,7 @@ say "sshd hardening: ensure drop-in + Include + restart (golden image predates t
 vm 'grep -q "^Include /etc/ssh/sshd_config.d/\*.conf" /etc/ssh/sshd_config || sed -i "1i Include /etc/ssh/sshd_config.d/*.conf" /etc/ssh/sshd_config' \
   || die "could not ensure the sshd_config Include line"
 vm 'mkdir -p /etc/ssh/sshd_config.d && chmod 700 /etc/ssh/sshd_config.d'
-scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/sshd-hardening.conf" "$HOST:/etc/ssh/sshd_config.d/99-esellar-hardening.conf"
+scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/sshd-hardening.conf" "$HOST:/etc/ssh/sshd_config.d/99-kampodine-hardening.conf"
 vm 'rc-service sshd restart' || die "sshd restart failed after hardening ensure"
 
 say "gate: sshd hardening effective"
@@ -404,50 +404,50 @@ PODSTACK_GATE
 vm 'rc-update show boot | grep -q cgroups || rc-update add cgroups boot' || die "rc-update cgroups failed"
 vm 'rc-service cgroups status >/dev/null 2>&1 || rc-service cgroups start' || die "cgroups start failed"
 
-# --- 3. /etc/esellar + managed config files ------------------------------------
-say "creating /etc/esellar (env file lands here via kampodine deploy, 0600 root)…"
-vm 'mkdir -p /etc/esellar && chmod 700 /etc/esellar'
+# --- 3. /etc/kampodine + managed config files ------------------------------------
+say "creating /etc/kampodine (env file lands here via kampodine deploy, 0600 root)…"
+vm 'mkdir -p /etc/kampodine && chmod 700 /etc/kampodine'
 
 say "writing /etc/containers/registries.conf (insecure 127.0.0.1:5000; search docker.io)…"
 vm 'mkdir -p /etc/containers'
 scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/registries.conf" "$HOST:/etc/containers/registries.conf"
 
-say "writing /etc/sysctl.d/60-esellar.conf + applying live…"
-scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/60-esellar.conf" "$HOST:/etc/sysctl.d/60-esellar.conf"
+say "writing /etc/sysctl.d/60-kampodine.conf + applying live…"
+scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/60-kampodine.conf" "$HOST:/etc/sysctl.d/60-kampodine.conf"
 vm_sh <<'SYSCTL_APPLY' || die "sysctl ensure/apply failed"
 rc-update show boot | grep -Eq '^[[:space:]]*sysctl[[:space:]]*\|' || rc-update add sysctl boot
 sysctl -w net.ipv4.ip_unprivileged_port_start=80 > /dev/null
 SYSCTL_APPLY
 
 # --- 4. OpenRC services (canonical: ansible container-service templates) --------
-say "ensuring the 'kamal' podman network (deploy's proxy re-point resolves esellar-api:8080 by network DNS)…"
+say "ensuring the 'kamal' podman network (deploy's proxy re-point resolves kampodine-api:8080 by network DNS)…"
 # shellcheck disable=SC2016
 vm 'podman network exists kamal 2>/dev/null || podman network create kamal' \
   || die "podman network create kamal failed"
-say "installing OpenRC services esellar-api + kamal-proxy (supervise-daemon around podman run)…"
-scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/esellar-api" "$HOST:/etc/init.d/esellar-api"
+say "installing OpenRC services kampodine-api + kamal-proxy (supervise-daemon around podman run)…"
+scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/kampodine-api" "$HOST:/etc/init.d/kampodine-api"
 scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/kamal-proxy" "$HOST:/etc/init.d/kamal-proxy"
-vm 'chmod 755 /etc/init.d/esellar-api /etc/init.d/kamal-proxy'
+vm 'chmod 755 /etc/init.d/kampodine-api /etc/init.d/kamal-proxy'
 
-# --- 4b. esellar-anchor (blue-green flip guest half — watcher, no container) ----
+# --- 4b. kampodine-anchor (blue-green flip guest half — watcher, no container) ----
 # Ships on EVERY vm: started + enabled now, INERT until a flip writes
-# /etc/esellar/anchor.conf over ssh (ansible container-service owns both files
+# /etc/kampodine/anchor.conf over ssh (ansible container-service owns both files
 # afterwards — drift repair keeps them in sync).
-say "installing the esellar-anchor watcher service (blue-green flip guest half)…"
+say "installing the kampodine-anchor watcher service (blue-green flip guest half)…"
 # /usr/local/sbin does NOT exist on the golden image (fresh Alpine ships no
 # /usr/local hierarchy; the alpine-base role creates it — vm-prepare runs
 # BEFORE any ansible)
 vm 'mkdir -p /usr/local/sbin' || die "mkdir /usr/local/sbin failed"
-scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/esellar-anchor.sh" "$HOST:/usr/local/sbin/esellar-anchor.sh"
-scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/esellar-anchor" "$HOST:/etc/init.d/esellar-anchor"
-vm 'chmod 755 /usr/local/sbin/esellar-anchor.sh /etc/init.d/esellar-anchor' || die "chmod esellar-anchor files failed"
-vm 'sh -n /usr/local/sbin/esellar-anchor.sh' || die "esellar-anchor.sh does not parse (busybox sh)"
-vm 'sh -n /etc/init.d/esellar-anchor' || die "/etc/init.d/esellar-anchor does not parse"
-vm 'rc-update show default | grep -qE "^[[:space:]]*esellar-anchor[[:space:]]*\\|" || rc-update add esellar-anchor default' \
-  || die "rc-update add esellar-anchor default failed"
-vm 'rc-service esellar-anchor start' || die "rc-service esellar-anchor start failed"
-
-for SVC in esellar-api kamal-proxy; do
+scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/kampodine-anchor.sh" "$HOST:/usr/local/sbin/kampodine-anchor.sh"
+scp -q "${SSH_ARGS[@]}" "$TMPDIR_LOCAL/kampodine-anchor" "$HOST:/etc/init.d/kampodine-anchor"
+vm 'chmod 755 /usr/local/sbin/kampodine-anchor.sh /etc/init.d/kampodine-anchor' || die "chmod kampodine-anchor files failed"
+vm 'sh -n /usr/local/sbin/kampodine-anchor.sh' || die "kampodine-anchor.sh does not parse (busybox sh)"
+vm 'sh -n /etc/init.d/kampodine-anchor' || die "/etc/init.d/kampodine-anchor does not parse"
+vm 'rc-update show default | grep -qE "^[[:space:]]*kampodine-anchor[[:space:]]*\\|" || rc-update add kampodine-anchor default' \
+  || die "rc-update add kampodine-anchor default failed"
+vm 'rc-service kampodine-anchor start' || die "rc-service kampodine-anchor start failed"
+
+for SVC in kampodine-api kamal-proxy; do
   vm "rc-update show default | grep -qE '^[[:space:]]*${SVC}[[:space:]]*\\|' || rc-update add ${SVC} default" \
     || die "rc-update add $SVC default failed"
 done
@@ -456,7 +456,7 @@ done
 # re-runs after a deploy must not bounce production.
 # shellcheck disable=SC2016
 vm_sh <<'UNIT_DRIFT' || true
-for SVC in esellar-api kamal-proxy esellar-anchor; do
+for SVC in kampodine-api kamal-proxy kampodine-anchor; do
   if rc-service "$SVC" status > /dev/null 2>&1; then
     echo "RUNNING: $SVC (unit file was overwritten — rc-service $SVC restart to apply, on your call)"
   fi
@@ -483,26 +483,26 @@ if [[ $DO_PULL -eq 1 ]]; then
   # installs it later; vm-prepare runs BEFORE any ansible)
   vm 'busybox wget -q -O /dev/null http://127.0.0.1:5000/v2/' || {
     pkill -f "ssh.*-R 5000" 2>/dev/null || true; sleep 1
-    nohup ssh -R 5000:127.0.0.1:5000 -N -o ServerAliveInterval=30 -o ExitOnForwardFailure=yes "$HOST" >/tmp/esellar-tunnel.log 2>&1 &
+    nohup ssh -R 5000:127.0.0.1:5000 -N -o ServerAliveInterval=30 -o ExitOnForwardFailure=yes "$HOST" >/tmp/kampodine-tunnel.log 2>&1 &
     sleep 3
   }
-  vm 'busybox wget -q -O /dev/null http://127.0.0.1:5000/v2/' || die "registry tunnel did not come up (/tmp/esellar-tunnel.log)"
-  vm 'podman pull --tls-verify=false 127.0.0.1:5000/esellar-api:latest' || die "app image pull failed"
+  vm 'busybox wget -q -O /dev/null http://127.0.0.1:5000/v2/' || die "registry tunnel did not come up (/tmp/kampodine-tunnel.log)"
+  vm 'podman pull --tls-verify=false 127.0.0.1:5000/kampodine-api:latest' || die "app image pull failed"
 else
   say "skipping app-image pre-pull (pass --pull-images, or let the first deploy pull)"
 fi
 
-# --- 7. converge esellar-api ONLY if a previous deploy left image + env ---------
+# --- 7. converge kampodine-api ONLY if a previous deploy left image + env ---------
 # On a truly fresh VM neither exists — the FIRST DEPLOY provides both and
 # starts the service. Re-runs of this script after a deploy heal drift.
-say "esellar-api start check (needs image + /etc/esellar/env — first deploy provides both)…"
+say "kampodine-api start check (needs image + /etc/kampodine/env — first deploy provides both)…"
 # shellcheck disable=SC2016
-vm_sh <<'API_CONVERGE' || die "esellar-api start failed (image + env present — investigate: podman logs esellar-api)"
-if [ -f /etc/esellar/env ] && podman image exists 127.0.0.1:5000/esellar-api:latest; then
-  rc-service esellar-api start
-  echo "esellar-api started (image + env present)"
+vm_sh <<'API_CONVERGE' || die "kampodine-api start failed (image + env present — investigate: podman logs kampodine-api)"
+if [ -f /etc/kampodine/env ] && podman image exists 127.0.0.1:5000/kampodine-api:latest; then
+  rc-service kampodine-api start
+  echo "kampodine-api started (image + env present)"
 else
-  echo "esellar-api deferred: no image and/or /etc/esellar/env yet (normal on a fresh VM — first deploy handles it)"
+  echo "kampodine-api deferred: no image and/or /etc/kampodine/env yet (normal on a fresh VM — first deploy handles it)"
 fi
 API_CONVERGE
 
@@ -522,16 +522,16 @@ vm 'grep -q "127.0.0.1:5000" /etc/containers/registries.conf && grep -q "insecur
   || die "registries.conf incomplete (127.0.0.1:5000 insecure + docker.io search)"
 
 say "gate: services enabled in the default runlevel"
-vm 'rc-update show default | grep -qE "^[[:space:]]*esellar-api[[:space:]]*\\|"' || die "esellar-api not in the default runlevel"
+vm 'rc-update show default | grep -qE "^[[:space:]]*kampodine-api[[:space:]]*\\|"' || die "kampodine-api not in the default runlevel"
 vm 'rc-update show default | grep -qE "^[[:space:]]*kamal-proxy[[:space:]]*\\|"' || die "kamal-proxy not in the default runlevel"
 vm 'rc-service kamal-proxy status >/dev/null' || die "kamal-proxy service not started"
 
-say "gate: esellar-anchor watcher running + INERT (no anchor conf on a fresh VM)"
-vm 'rc-update show default | grep -qE "^[[:space:]]*esellar-anchor[[:space:]]*\\|"' || die "esellar-anchor not in the default runlevel"
-vm 'rc-service esellar-anchor status >/dev/null' || die "esellar-anchor service not started"
-vm '! test -e /etc/esellar/anchor.conf' || die "/etc/esellar/anchor.conf already exists on a fresh VM (wrong machine?)"
-vm 'grep -q "no anchor conf" /var/log/esellar-anchor.log' \
-  || die "esellar-anchor is started but never logged its idle transition (watcher loop not running?)"
+say "gate: kampodine-anchor watcher running + INERT (no anchor conf on a fresh VM)"
+vm 'rc-update show default | grep -qE "^[[:space:]]*kampodine-anchor[[:space:]]*\\|"' || die "kampodine-anchor not in the default runlevel"
+vm 'rc-service kampodine-anchor status >/dev/null' || die "kampodine-anchor service not started"
+vm '! test -e /etc/kampodine/anchor.conf' || die "/etc/kampodine/anchor.conf already exists on a fresh VM (wrong machine?)"
+vm 'grep -q "no anchor conf" /var/log/kampodine-anchor.log' \
+  || die "kampodine-anchor is started but never logged its idle transition (watcher loop not running?)"
 
 # --- summary ---------------------------------------------------------------------
 IP="${HOST#*@}"