underpost 2.8.87 → 2.8.88

package/src/cli/baremetal.js

@@ -1,3 +1,10 @@
+/**
+ * Baremetal module for managing the generation and deployment of cloud-init configuration files
+ * and associated scripts for baremetal provisioning.
+ * @module src/cli/baremetal.js
+ * @namespace UnderpostBaremetal
+ */
+
 import { getNpmRootPath, getUnderpostRootPath } from '../server/conf.js';
 import { openTerminal, pbcopy, shellExec } from '../server/process.js';
 import dotenv from 'dotenv';
@@ -40,6 +47,7 @@ class UnderpostBaremetal {
      * @param {boolean} [options.nfsUnmount=false] - Flag to unmount the NFS root filesystem.
      * @param {boolean} [options.nfsSh=false] - Flag to chroot into the NFS environment for shell access.
      * @param {string} [options.logs=''] - Specifies which logs to display ('dhcp', 'cloud', 'machine', 'cloud-config').
+     * @memberof UnderpostBaremetal
      * @returns {void}
      */
     async callback(
@@ -576,6 +584,7 @@ menuentry '${menuentryStr}' {
      * @param {object} params.maas - MAAS configuration details.
      * @param {string} params.networkInterfaceName - The name of the network interface.
      * @returns {Promise<void>} A promise that resolves when commissioning is initiated or after a delay.
+     * @memberof UnderpostBaremetal
      */
     async commissionMonitor({ macAddress, nfsHostPath, underpostRoot, hostname, maas, networkInterfaceName }) {
       {
@@ -725,6 +734,7 @@ menuentry '${menuentryStr}' {
      * This is necessary for cross-architecture execution within a chroot environment.
      * @param {object} params - The parameters for the function.
      * @param {string} params.nfsHostPath - The path to the NFS root filesystem on the host.
+     * @memberof UnderpostBaremetal
      * @returns {void}
      */
     mountBinfmtMisc({ nfsHostPath }) {
@@ -747,6 +757,7 @@ menuentry '${menuentryStr}' {
      * @description Deletes all specified machines from MAAS.
      * @param {object} params - The parameters for the function.
      * @param {Array<object>} params.machines - An array of machine objects, each with a `system_id`.
+     * @memberof UnderpostBaremetal
      * @returns {Array<object>} An empty array after machines are removed.
      */
     removeMachines({ machines }) {
@@ -761,6 +772,7 @@ menuentry '${menuentryStr}' {
      * @description Clears all observed discoveries in MAAS and optionally forces a new scan.
      * @param {object} params - The parameters for the function.
      * @param {boolean} params.force - If true, forces a new discovery scan after clearing.
+     * @memberof UnderpostBaremetal
      * @returns {void}
      */
     clearDiscoveries({ force }) {
@@ -776,6 +788,7 @@ menuentry '${menuentryStr}' {
      * This is used to wait for the target machine to report its MAC address.
      * @param {object} params - The parameters for the function.
      * @param {string} params.nfsHostPath - The NFS host path where the MAC file is expected.
+     * @memberof UnderpostBaremetal
      * @returns {Promise<void>} A promise that resolves when the MAC file is found or after a delay.
      */
     async macMonitor({ nfsHostPath }) {
@@ -794,6 +807,7 @@ menuentry '${menuentryStr}' {
      * for cross-architecture execution within a chroot environment.
      * @param {object} params - The parameters for the function.
      * @param {string} params.nfsHostPath - The path to the NFS root filesystem on the host.
+     * @memberof UnderpostBaremetal
      * @param {'arm64'|'amd64'} params.debootstrapArch - The target architecture of the debootstrap environment.
      * @returns {void}
      */
@@ -825,6 +839,7 @@ menuentry '${menuentryStr}' {
      * @param {string} params.nfsHostPath - The path to the NFS root filesystem on the host.
      * @param {'arm64'|'amd64'} params.debootstrapArch - The target architecture of the debootstrap environment.
      * @param {object} params.callbackMetaData - Metadata about the callback, including runner host architecture.
+     * @memberof UnderpostBaremetal
      * @param {string[]} params.steps - An array of shell commands to execute.
      * @returns {void}
      */
@@ -860,6 +875,7 @@ EOF`);
      * This helps in visualizing and debugging the execution flow of provisioning steps.
      * @param {string[]} [steps=[]] - An array of shell commands.
      * @param {boolean} [yaml=true] - If true, formats the output as YAML list items.
+     * @memberof UnderpostBaremetal
      * @returns {string} The formatted string of commands.
      */
     stepsRender(steps = [], yaml = true) {
@@ -892,6 +908,7 @@ EOF`);
      * @param {string} params.workflowId - The identifier for the workflow configuration.
      * @param {boolean} [params.mount] - If true, attempts to mount the NFS paths.
      * @param {boolean} [params.unmount] - If true, attempts to unmount the NFS paths.
+     * @memberof UnderpostBaremetal
      * @returns {{isMounted: boolean}} An object indicating whether any NFS path is currently mounted.
      */
     nfsMountCallback({ hostname, workflowId, mount, unmount }) {
@@ -929,7 +946,8 @@ EOF`);
      * @method getHostArch
      * @description Determines the architecture of the host machine.
      * This is crucial for cross-compilation and selecting the correct QEMU binaries.
-     * @returns {'amd64'|'arm64'} The host architecture.
+     * @memberof UnderpostBaremetal
+     * @returns {{alias: 'amd64'|'arm64', name: 'x86_64'|'aarch64'}} The host architecture.
      * @throws {Error} If the host architecture is unsupported.
      */
     getHostArch() {
@@ -944,12 +962,16 @@ EOF`);
      * @property {object} systemProvisioningFactory
      * @description A factory object containing functions for system provisioning based on OS type.
      * Each OS type (e.g., 'ubuntu') provides methods for base system setup, user creation,
-     * timezone configuration, and keyboard layout settings.
+     * timezone configuration, and keyboard layout settings.     *
+     * @memberof UnderpostBaremetal
+     * @namespace UnderpostBaremetal.systemProvisioningFactory
      */
     systemProvisioningFactory: {
       /**
        * @property {object} ubuntu
        * @description Provisioning steps for Ubuntu-based systems.
+       * @memberof UnderpostBaremetal.systemProvisioningFactory
+       * @namespace UnderpostBaremetal.systemProvisioningFactory.ubuntu
        */
       ubuntu: {
         /**
@@ -959,6 +981,7 @@ EOF`);
          * kernel modules, cloud-init, SSH server, and other core utilities.
          * @param {object} params - The parameters for the function.
          * @param {string} params.kernelLibVersion - The specific kernel library version to install.
+         * @memberof UnderpostBaremetal.systemProvisioningFactory.ubuntu
          * @returns {string[]} An array of shell commands.
          */
         base: ({ kernelLibVersion }) => [
@@ -991,6 +1014,7 @@ SOURCES`,
          * @method user
          * @description Generates shell commands for creating a root user and configuring SSH access.
          * This is a critical security step for initial access to the provisioned system.
+         * @memberof UnderpostBaremetal.systemProvisioningFactory.ubuntu
          * @returns {string[]} An array of shell commands.
          */
         user: () => [
@@ -1014,6 +1038,7 @@ SOURCES`,
          * @param {string} params.timezone - The timezone string (e.g., 'America/New_York').
          * @param {string} params.chronyConfPath - The path to the Chrony configuration file.
          * @param {string} [alias='chrony'] - The alias for the chrony service.
+         * @memberof UnderpostBaremetal.systemProvisioningFactory.ubuntu
          * @returns {string[]} An array of shell commands.
          */
         timezone: ({ timezone, chronyConfPath }, alias = 'chrony') => [
@@ -1081,6 +1106,7 @@ logdir /var/log/chrony
          * @method keyboard
          * @description Generates shell commands for configuring the keyboard layout.
          * This ensures correct input behavior on the provisioned system.
+         * @memberof UnderpostBaremetal.systemProvisioningFactory.ubuntu
          * @returns {string[]} An array of shell commands.
          */
         keyboard: () => [
@@ -1099,6 +1125,7 @@ logdir /var/log/chrony
      * This is crucial for allowing baremetal machines to boot via NFS.
      * @param {object} params - The parameters for the function.
      * @param {string} params.nfsHostPath - The path to be exported by the NFS server.
+     * @memberof UnderpostBaremetal
      * @param {string} [params.subnet='192.168.1.0/24'] - The subnet allowed to access the NFS export.
      * @returns {void}
      */
@@ -1169,6 +1196,7 @@ udp-port = 32766
      * @param {string} params.clientIp - The static IP address for the client device.
      * @param {string} params.subnet - The subnet mask for the client device.
      * @param {string} params.gateway - The gateway IP address for the client device.
+     * @memberof UnderpostBaremetal
      * @returns {string} The generated boot configuration content.
      * @throws {Error} If an invalid workflow ID is provided.
      */
@@ -1229,12 +1257,14 @@ GATEWAY=${gateway}`;
      * @property {object} workflowsConfig
      * @description Configuration for different baremetal provisioning workflows.
      * Each workflow defines specific parameters like system provisioning type,
-     * kernel version, Chrony settings, debootstrap image details, and NFS mounts.
+     * kernel version, Chrony settings, debootstrap image details, and NFS mounts.     *
+     * @memberof UnderpostBaremetal
      */
     workflowsConfig: {
       /**
        * @property {object} rpi4mb
        * @description Configuration for the Raspberry Pi 4 Model B workflow.
+       * @memberof UnderpostBaremetal.workflowsConfig
        */
       rpi4mb: {
         menuentryStr: 'UNDERPOST.NET UEFI/GRUB/MAAS RPi4 commissioning (ARM64)',

package/src/cli/cloud-init.js

@@ -1,3 +1,10 @@
+/**
+ * Cloud-init module for managing the generation and deployment of cloud-init configuration files
+ * and associated scripts for baremetal provisioning.
+ * @module src/cli/cloud-init.js
+ * @namespace UnderpostCloudInit
+ */
+
 import dotenv from 'dotenv';
 import { shellExec } from '../server/process.js';
 import fs from 'fs-extra';
@@ -15,6 +22,7 @@ const logger = loggerFactory(import.meta);
  * and associated scripts for baremetal provisioning. This class provides methods
  * to build various shell scripts and a cloud-init configuration file tailored
  * for MAAS (Metal as a Service) integration.
+ * @memberof UnderpostCloudInit
  */
 class UnderpostCloudInit {
   static API = {
@@ -30,6 +38,7 @@ class UnderpostCloudInit {
      * @param {object} params.callbackMetaData - Metadata about the callback, used for dynamic configuration.
      * @param {boolean} params.dev - Development mode flag.
      * @returns {void}
+     * @memberof UnderpostCloudInit
      */
     buildTools({ workflowId, nfsHostPath, hostname, callbackMetaData, dev }) {
       // Destructure workflow configuration for easier access.
@@ -281,6 +290,7 @@ curl -X POST \\
      * @param {object} [authCredentials={}] - Optional MAAS authentication credentials.
      * @param {string} [path='/etc/cloud/cloud.cfg.d/90_maas.cfg'] - The target path for the cloud-init configuration file.
      * @returns {string} The generated cloud-init configuration content.
+     * @memberof UnderpostCloudInit
      */
     configFactory(
       {
@@ -494,6 +504,7 @@ EOF_MAAS_CFG`;
      * This method parses the output of `maas apikey` to extract the consumer key,
      * consumer secret, token key, and token secret.
      * @returns {object} An object containing the MAAS authentication credentials.
+     * @memberof UnderpostCloudInit
      * @throws {Error} If the MAAS API key format is invalid.
      */
     authCredentialsFactory() {

package/src/cli/cron.js

@@ -64,7 +64,6 @@ class UnderpostCron {
             shellExec(Cmd.cron(deployId, job, name, confCronConfig.jobs[job].expression, options));
           }
         }
-        if (fs.existsSync(`./tmp/await-deploy`)) fs.remove(`./tmp/await-deploy`);
         return;
       }
       for (const _jobId of jobList.split(',')) {

package/src/cli/deploy.js

@@ -12,7 +12,6 @@ import { loggerFactory } from '../server/logger.js';
 import { shellExec } from '../server/process.js';
 import fs from 'fs-extra';
 import dotenv from 'dotenv';
-import { DataBaseProvider } from '../db/DataBaseProvider.js';
 import UnderpostRootEnv from './env.js';
 import UnderpostCluster from './cluster.js';
 import Underpost from '../index.js';
@@ -62,7 +61,7 @@ class UnderpostDeploy {
         )
         .join('');
     },
-    deploymentYamlPartsFactory({ deployId, env, suffix, resources, replicas }) {
+    deploymentYamlPartsFactory({ deployId, env, suffix, resources, replicas, image }) {
       return `apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -81,7 +80,7 @@ spec:
     spec:
       containers:
         - name: ${deployId}-${env}-${suffix}
-          image: localhost/rockylinux9-underpost:${Underpost.version}
+          image: ${image ?? `localhost/rockylinux9-underpost:${Underpost.version}`}
 #          resources:
 #            requests:
 #              memory: "${resources.requests.memory}"
@@ -118,6 +117,7 @@ spec:
     async buildManifest(deployList, env, options) {
       const resources = UnderpostDeploy.API.resourcesFactory();
       const replicas = options.replicas;
+      const image = options.image;
 
       for (const _deployId of deployList.split(',')) {
         const deployId = _deployId.trim();
@@ -144,6 +144,7 @@ ${UnderpostDeploy.API.deploymentYamlPartsFactory({
   suffix: deploymentVersion,
   resources,
   replicas,
+  image,
 }).replace('{{ports}}', buildKindPorts(fromPort, toPort))}
 `;
         }
@@ -153,21 +154,7 @@ ${UnderpostDeploy.API.deploymentYamlPartsFactory({
         let secretYaml = '';
 
         for (const host of Object.keys(confServer)) {
-          if (env === 'production')
-            secretYaml += `
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: ${host}
-spec:
-  commonName: ${host}
-  dnsNames:
-    - ${host}
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
-  secretName: ${host}`;
+          if (env === 'production') secretYaml += UnderpostDeploy.API.buildCertManagerCertificate({ host });
 
           const pathPortAssignment = pathPortAssignmentData[host];
           // logger.info('', { host, pathPortAssignment });
@@ -221,6 +208,22 @@ spec:
         }
       }
     },
+    buildCertManagerCertificate({ host }) {
+      return `
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ${host}
+spec:
+  commonName: ${host}
+  dnsNames:
+    - ${host}
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  secretName: ${host}`;
+    },
     getCurrentTraffic(deployId) {
       // kubectl get deploy,sts,svc,configmap,secret -n default -o yaml --export > default.yaml
       const hostTest = Object.keys(
@@ -230,7 +233,7 @@ spec:
       return info.match('blue') ? 'blue' : info.match('green') ? 'green' : null;
     },
     async callback(
-      deployList = 'default',
+      deployList = '',
       env = 'development',
       options = {
         remove: false,
@@ -240,7 +243,9 @@ spec:
         infoUtil: false,
         expose: false,
         cert: false,
+        certHosts: '',
         versions: '',
+        image: '',
         traffic: '',
         replicas: '',
         node: '',
@@ -302,6 +307,14 @@ docker login nvcr.io
 Username: $oauthtoken
 Password: <Your Key>
 `);
+      if (!deployList && options.certHosts) {
+        for (const host of options.certHosts.split(',')) {
+          shellExec(`sudo kubectl apply -f - <<EOF
+${UnderpostDeploy.API.buildCertManagerCertificate({ host })}
+EOF`);
+        }
+        return;
+      } else if (!deployList) deployList = 'dd-default';
       if (deployList === 'dd' && fs.existsSync(`./engine-private/deploy/dd.router`))
         deployList = fs.readFileSync(`./engine-private/deploy/dd.router`, 'utf8');
       if (options.infoTraffic === true) {
@@ -321,7 +334,7 @@ Password: <Your Key>
       if (!options.replicas) options.replicas = 1;
       if (options.sync) UnderpostDeploy.API.sync(deployList, options);
       if (options.buildManifest === true) await UnderpostDeploy.API.buildManifest(deployList, env, options);
-      if (options.infoRouter === true) {
+      if (options.infoRouter === true || options.buildManifest === true) {
         logger.info('router', await UnderpostDeploy.API.routerFactory(deployList, env));
         return;
       }
@@ -358,7 +371,8 @@ Password: <Your Key>
         const confServer = JSON.parse(fs.readFileSync(`./engine-private/conf/${deployId}/conf.server.json`, 'utf8'));
         for (const host of Object.keys(confServer)) {
           shellExec(`sudo kubectl delete HTTPProxy ${host}`);
-          if (env === 'production' && options.cert === true) shellExec(`sudo kubectl delete Certificate ${host}`);
+          if (UnderpostDeploy.API.isValidTLSContext({ host, env, options }))
+            shellExec(`sudo kubectl delete Certificate ${host}`);
           if (!options.remove === true && env === 'development') etcHosts.push(host);
         }
 
@@ -370,7 +384,8 @@ Password: <Your Key>
         if (!options.remove === true) {
           if (!options.disableUpdateDeployment) shellExec(`sudo kubectl apply -f ./${manifestsPath}/deployment.yaml`);
           shellExec(`sudo kubectl apply -f ./${manifestsPath}/proxy.yaml`);
-          if (env === 'production' && options.cert === true)
+
+          if (UnderpostDeploy.API.isValidTLSContext({ host: Object.keys(confServer)[0], env, options }))
             shellExec(`sudo kubectl apply -f ./${manifestsPath}/secret.yaml`);
         }
       }
@@ -455,7 +470,11 @@ Password: <Your Key>
           notReadyPods.push(pod);
         }
       }
-      return { ready: notReadyPods.length === 0, notReadyPods, readyPods };
+      return {
+        ready: pods.length > 0 && notReadyPods.length === 0,
+        notReadyPods,
+        readyPods,
+      };
     },
     configMap(env) {
       shellExec(`kubectl delete configmap underpost-config`);
@@ -479,6 +498,10 @@ Password: <Your Key>
       fs.writeFileSync(`/etc/hosts`, renderHosts, 'utf8');
       return { renderHosts };
     },
+    isValidTLSContext: ({ host, env, options }) =>
+      env === 'production' &&
+      options.cert === true &&
+      (!options.certHosts || options.certHosts.split(',').includes(host)),
   };
 }
 

package/src/cli/index.js

@@ -24,6 +24,7 @@ program
   .command('new')
   .argument('<app-name>', 'The name or deploy-id of the application to create.')
   .option('--deploy-id', 'Crete deploy ID conf env files')
+  .option('--cluster', 'Create deploy ID cluster files and sync to current cluster')
   .option('--dev', 'Sets the development cli context')
   .description('Initializes a new Underpost project with a predefined structure.')
   .action(Underpost.repo.new);
@@ -158,12 +159,14 @@ program
   .option('--expose', 'Exposes services matching the provided deployment ID list.')
   .option('--info-util', 'Displays useful `kubectl` utility management commands.')
   .option('--cert', 'Resets TLS/SSL certificate secrets for deployments.')
+  .option('--cert-hosts <hosts>', 'Resets TLS/SSL certificate secrets for specified hosts.')
   .option('--node <node>', 'Sets optional node for deployment operations.')
   .option(
     '--build-manifest',
     'Builds Kubernetes YAML manifests, including deployments, services, proxies, and secrets.',
   )
   .option('--replicas <replicas>', 'Sets a custom number of replicas for deployments.')
+  .option('--image <image>', 'Sets a custom image for deployments.')
   .option('--versions <deployment-versions>', 'A comma-separated list of custom deployment versions.')
   .option('--traffic <traffic-versions>', 'A comma-separated list of custom deployment traffic weights.')
   .option('--disable-update-deployment', 'Disables updates to deployments.')
@@ -348,6 +351,8 @@ program
   .option('--command <command-array>', 'Array of commands to run.')
   .option('--args <args-array>', 'Array of arguments to pass to the command.')
   .option('--dev', 'Sets the development context environment for the script.')
+  .option('--build', 'Set builder context runner')
+  .option('--replicas <replicas>', 'Sets a custom number of replicas for deployment.')
   .option('--pod-name <pod-name>', 'Optional: Specifies the pod name for test execution.')
   .option('--volume-host-path <volume-host-path>', 'Optional: Specifies the volume host path for test execution.')
   .option('--volume-mount-path <volume-mount-path>', 'Optional: Specifies the volume mount path for test execution.')

package/src/cli/lxd.js

@@ -1,3 +1,9 @@
+/**
+ * LXD module for managing LXD virtual machines and networks.
+ * @module src/cli/lxd.js
+ * @namespace UnderpostLxd
+ */
+
 import { getNpmRootPath } from '../server/conf.js';
 import { getLocalIPv4Address } from '../server/dns.js';
 import { pbcopy, shellExec } from '../server/process.js';
@@ -32,6 +38,7 @@ class UnderpostLxd {
      * @param {string} [options.deleteExpose=''] - Delete exposed ports from a VM (format: 'vmName:port1,port2').
      * @param {string} [options.test=''] - Test health, status and network connectivity for a VM.
      * @param {string} [options.autoExposeK8sPorts=''] - Automatically expose common Kubernetes ports for the VM.
+     * @memberof UnderpostLxd
      */
     async callback(
       options = {

package/src/cli/repository.js

@@ -1,6 +1,6 @@
 import { commitData } from '../client/components/core/CommonJs.js';
 import dotenv from 'dotenv';
-import { pbcopy, shellExec } from '../server/process.js';
+import { pbcopy, shellCd, shellExec } from '../server/process.js';
 import { actionInitLog, loggerFactory } from '../server/logger.js';
 import fs from 'fs-extra';
 import { getNpmRootPath } from '../server/conf.js';
@@ -13,7 +13,7 @@ const logger = loggerFactory(import.meta);
 
 class UnderpostRepository {
   static API = {
-    clone(gitUri = 'underpostnet/pwa-microservices-template', options = { bare: false, g8: false }) {
+    clone(gitUri = `${process.env.GITHUB_USERNAME}/pwa-microservices-template`, options = { bare: false, g8: false }) {
       const gExtension = options.g8 === true ? '.g8' : '.git';
       const repoName = gitUri.split('/').pop();
       if (fs.existsSync(`./${repoName}`)) fs.removeSync(`./${repoName}`);
@@ -26,7 +26,11 @@ class UnderpostRepository {
         },
       );
     },
-    pull(repoPath = './', gitUri = 'underpostnet/pwa-microservices-template', options = { g8: false }) {
+    pull(
+      repoPath = './',
+      gitUri = `${process.env.GITHUB_USERNAME}/pwa-microservices-template`,
+      options = { g8: false },
+    ) {
       const gExtension = options.g8 === true ? '.g8' : '.git';
       shellExec(
         `cd ${repoPath} && git pull https://${
@@ -49,6 +53,7 @@ class UnderpostRepository {
       },
     ) {
       if (commitType === 'reset') {
+        if (options.copy) pbcopy(shellExec(`git --no-pager log -1 --pretty=%B`, { stdout: true }));
         shellExec(`cd ${repoPath} && git reset --soft HEAD~${isNaN(parseInt(subModule)) ? 1 : parseInt(subModule)}`);
         return;
       }
@@ -60,7 +65,11 @@ class UnderpostRepository {
       shellExec(`cd ${repoPath} && git commit ${options?.empty ? `--allow-empty ` : ''}-m "${_message}"`);
     },
 
-    push(repoPath = './', gitUri = 'underpostnet/pwa-microservices-template', options = { f: false, g8: false }) {
+    push(
+      repoPath = './',
+      gitUri = `${process.env.GITHUB_USERNAME}/pwa-microservices-template}`,
+      options = { f: false, g8: false },
+    ) {
       const gExtension = options.g8 === true || options.G8 === true ? '.g8' : '.git';
       shellExec(
         `cd ${repoPath} && git push https://${process.env.GITHUB_TOKEN}@github.com/${gitUri}${gExtension}${
@@ -81,7 +90,7 @@ class UnderpostRepository {
       );
     },
 
-    new(repositoryName, options = { dev: false, deployId: false }) {
+    new(repositoryName, options = { dev: false, deployId: false, cluster: false }) {
       return new Promise(async (resolve, reject) => {
         try {
           await logger.setUpInfo();
@@ -90,7 +99,7 @@ class UnderpostRepository {
             return resolve(
               await UnderpostStartUp.API.listenPortController(UnderpostStartUp.API.listenServerFactory(), ':'),
             );
-          if (options.deployId === true) return Config.deployIdFactory(repositoryName);
+          if (options.deployId === true) return Config.deployIdFactory(repositoryName, options);
           const npmRoot = getNpmRootPath();
           const underpostRoot = options?.dev === true ? '.' : `${npmRoot}/underpost`;
           const destFolder = `./${repositoryName}`;
@@ -137,6 +146,33 @@ class UnderpostRepository {
         .concat(diffUntrackOutput.toString().split('\n').filter(Boolean))
         .filter((f) => !deleteFiles.includes(f));
     },
+    privateConfUpdate(deployId) {
+      shellCd(`/home/dd/engine`);
+      const privateRepoName = `engine-${deployId.split('dd-')[1]}-private`;
+      const privateRepoPath = `../${privateRepoName}`;
+      if (fs.existsSync(privateRepoPath)) fs.removeSync(privateRepoPath);
+      shellExec(`cd .. && underpost clone ${process.env.GITHUB_USERNAME}/${privateRepoName}`);
+      shellExec(`cd ${privateRepoPath} && underpost pull . ${process.env.GITHUB_USERNAME}/${privateRepoName}`);
+      const packageJsonDeploy = JSON.parse(fs.readFileSync(`./engine-private/conf/${deployId}/package.json`, 'utf8'));
+      const packageJsonEngine = JSON.parse(fs.readFileSync(`./package.json`, 'utf8'));
+      if (packageJsonDeploy.version !== packageJsonEngine.version) {
+        logger.warn(
+          `Version mismatch: deploy-version:${packageJsonDeploy.version} !== engine-version:${packageJsonEngine.version},
+Prevent build private config repo.`,
+        );
+        return {
+          validVersion: false,
+          engineVersion: packageJsonEngine.version,
+          deployVersion: packageJsonDeploy.version,
+        };
+      }
+      shellExec(`node bin/build ${deployId} conf`);
+      return {
+        validVersion: true,
+        engineVersion: packageJsonEngine.version,
+        deployVersion: packageJsonDeploy.version,
+      };
+    },
   };
 }