underpost 3.2.22 → 3.2.28

package/.github/workflows/ghpkg.ci.yml

@@ -20,7 +20,7 @@ jobs:
       packages: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install required packages
         run: |

package/.github/workflows/gitlab.ci.yml

@@ -6,7 +6,7 @@ jobs:
     name: Update gitlab repo package Jobs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           lfs: true

package/.github/workflows/npmpkg.ci.yml

@@ -39,7 +39,7 @@ jobs:
       packages: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install required packages
         run: |

package/.github/workflows/publish.ci.yml

@@ -17,7 +17,7 @@ jobs:
       packages: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install required packages
         run: |
@@ -54,7 +54,7 @@ jobs:
       packages: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:

package/.github/workflows/pwa-microservices-template-page.cd.yml

@@ -33,7 +33,7 @@ jobs:
       image: quay.io/rockylinux/rockylinux:9
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         # with:
         #   lfs: true
       # - name: Checkout LFS objects

package/.github/workflows/pwa-microservices-template-test.ci.yml

@@ -11,7 +11,7 @@ jobs:
       options: --entrypoint /bin/bash
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install required packages
         run: |

package/CHANGELOG.md

@@ -1,6 +1,146 @@
 # Changelog
 
-## 2026-06-07
+## 2026-06-23
+
+### hardhat
+
+- Add chai devDependency in hardhat module ([bf20134d0](https://github.com/underpostnet/engine/commit/bf20134d0a61512b223b868129eed38c0e7583cf))
+- Fix hardhat undici base dependency ([c9ad2a9f0](https://github.com/underpostnet/engine/commit/c9ad2a9f09d893495d3b80be400ca023c96e91cc))
+- Hardhat 3 migration to nomicfoundation hardhat-toolbox-viem ([22c410635](https://github.com/underpostnet/engine/commit/22c4106355f3c7d6654f21179f131f6ed8fd20cc))
+
+### deploy
+
+- Fix verify secrets exists tls deployment in deploy pipeline ([0367676a9](https://github.com/underpostnet/engine/commit/0367676a9a6363e69f772739040bc100dc1c3ceb))
+
+### run-cli
+
+- move-node runner: Add skip the patch + rollout if the resource is already where node goal ([b88cf3c68](https://github.com/underpostnet/engine/commit/b88cf3c6833572e9128d4aa85eccf0c94b055609))
+- Add node-move k8s crd between nodes runner ([4c0259a63](https://github.com/underpostnet/engine/commit/4c0259a63380fea6d5261f55f94ba8daf0d9783f))
+
+### baremetal
+
+- FIx kubeadm join node logic workflow ([72d7994a7](https://github.com/underpostnet/engine/commit/72d7994a7d978841df83854e1032f7fe79a7e185))
+- Add flag --resume-infra-setup to restore ssh kubeadm remote node deployment ([78a41d400](https://github.com/underpostnet/engine/commit/78a41d4008eceb68a33a2445b4aafd4a7b5aa546))
+- Add engine repo customization in control and worker node commission workflows ([2b8c47f52](https://github.com/underpostnet/engine/commit/2b8c47f52b0c4a1eff82bc8b6cf966aa58f0fece))
+- Fix kubeadm join node logic in ssh remote commission workflows ([72f7e2527](https://github.com/underpostnet/engine/commit/72f7e252733be2f95f67afdfd758f471c1a590f6))
+- Fix SELinux config in install chroot in os deployed ([e7d46472e](https://github.com/underpostnet/engine/commit/e7d46472e41d4beb992918a3c5e2274614818609))
+- Add Timezone + keyboard now configured in the deployed OS ([de00c365d](https://github.com/underpostnet/engine/commit/de00c365d0a12d4abef9735f26dd4c56b77d5dc9))
+- Implement user and ssh keys customization --deploy-id and --user flags in commission workflow ([ec0720230](https://github.com/underpostnet/engine/commit/ec07202309371c8e56df0c2dbe63e0283ccb5c8a))
+- Implement worker and control plane automated infra setup post install os deploy ([d5edb41ab](https://github.com/underpostnet/engine/commit/d5edb41ab3855696198daa3ef44abe521768d260))
+- Implement Automate Rocky Linux bare-metal deployment with SSH and disk detection ([2a0cbf5f1](https://github.com/underpostnet/engine/commit/2a0cbf5f1a90ebc1c4bdae0ea5f37fb16f1395c4))
+
+### kickstart
+
+- Fix rocky ephemeral commission ssh server exposure ([b5d3007f6](https://github.com/underpostnet/engine/commit/b5d3007f65e9df0affca1ca21ecdfb6cbbea1724))
+
+### repository
+
+- Enhance routePath candidates logic build ([a3d7fd806](https://github.com/underpostnet/engine/commit/a3d7fd8068e31fbdacc5b9832047f09f720ba30c))
+
+### engine-cyberia
+
+- Shrinks cyberia-client and cyberia-server production Dockerfile ([dd218c847](https://github.com/underpostnet/engine/commit/dd218c847bbc0c2e3662833607731a8bbe6815c9))
+- Remove redundant saga index and fix null-safe frames access ([9947164e6](https://github.com/underpostnet/engine/commit/9947164e681ae7a5407af9227ae600c6a8a1aa84))
+- Migrate saga generation from DeepSeek to Gemini with staged generation ([6322cd197](https://github.com/underpostnet/engine/commit/6322cd19774d94f312f64173cb41ba62d3c5bba3))
+- Move cyberia server related modules to dedicated src/cyberia directory ([648309ece](https://github.com/underpostnet/engine/commit/648309ecee5b07bcf2132188d089c733f0646fb8))
+- Introduce Top-Down PCG (Semantic Reverse-Engineering) modules and cli command ([5664f536c](https://github.com/underpostnet/engine/commit/5664f536c54446116296a465fc1efd63b1dece42))
+- Clean up quotes and update comment in action service ([1668f95e6](https://github.com/underpostnet/engine/commit/1668f95e6fa266faba89dfecafe89b9654fd7b93))
+- Split action-provider and quest-provider status icons ([e3186a37d](https://github.com/underpostnet/engine/commit/e3186a37d962980e34e0c29234bf4dd3388553e2))
+- Add quest-by-cell lookup endpoint ([648eb1437](https://github.com/underpostnet/engine/commit/648eb14374a549f9e789a425533f9313b9292cfb))
+- Implement base client component ActionEngineCyberia with map-driven quest and action management ([cc89512c0](https://github.com/underpostnet/engine/commit/cc89512c098729012d99e5817b29480808044885))
+
+### docker-compose
+
+- Implement base docker-compose engine integration ([3374c7f1a](https://github.com/underpostnet/engine/commit/3374c7f1a4379256db577988d841f414947db0c4))
+
+### cyberia-cli
+
+- Update default generate-saga temperature ([dbc5ce5b8](https://github.com/underpostnet/engine/commit/dbc5ce5b83a8268f342a3be3af8c21d1628578a0))
+- In generate-saga pipeline add 'naming and character culture' customization ([516f0ded7](https://github.com/underpostnet/engine/commit/516f0ded7dde5d1990cde5a8e98b6a16807411db))
+- Refactor generate saga pipeline general theme purpose ([993aac921](https://github.com/underpostnet/engine/commit/993aac921a5ba0a41dee8f53fb508505c900ad1e))
+- Refactor saga pipeline replace THEME_DIMENSIONS to dedicated FACTIONS base theme scope ([1280edfde](https://github.com/underpostnet/engine/commit/1280edfdef885dd0e05afd00dd7dbb418a3d2896))
+- Refactor theme dimension scope in generate-sage pipeline, add --tone and simplify 4 mains and add flag --temperature to customizaction ([cc0a3e245](https://github.com/underpostnet/engine/commit/cc0a3e245a3020246e71149d88ed6f026fdff7e2))
+- Add maps semantic stage in generate-saga pipeline ([5c7bdab03](https://github.com/underpostnet/engine/commit/5c7bdab034a3de473e6197d5ffc5d3c61d71f4ef))
+- Fix quest generation with talk objectives case and related logic ([c4d9e397c](https://github.com/underpostnet/engine/commit/c4d9e397c155d5d7c48e42f387c30263cde5c149))
+- Add --space-context flag customization in generate-saga pipeline ([19d2f7ed6](https://github.com/underpostnet/engine/commit/19d2f7ed6aa8ea41ac72622c384f84a524464a4c))
+- Generate saga command: Add lore-grounded auto-theme generation - Auto-synthesize saga themes from CYBERIA-LORE.md when --prompt is omitted - Add --lore-path option to override the base lore document - Add temperature support to GeminiClient.chatJson for varied output - Default --out to ./engine-private/cyberia-sagas/<saga-code>.json - Remove hard requirement for --prompt or --import - Update docs and help text to reflect auto-generation mode ([5b1a668a7](https://github.com/underpostnet/engine/commit/5b1a668a7c1e2b48652b717934d56ec6e9902d54))
+
+### package
+
+- Fix nodemailer version ([7d27b7f48](https://github.com/underpostnet/engine/commit/7d27b7f4826b656abdd1d2a10c5d5bb478cd90bf))
+- Fix dependency vulnerability ([13991a0fe](https://github.com/underpostnet/engine/commit/13991a0fe4594887da89de16ac502be4ef7112cb))
+
+### cyberia-docs
+
+- Add base Cyberia Lore: The Frontier of Hyperspace ([d389b881f](https://github.com/underpostnet/engine/commit/d389b881ff8dadb9154bb1f7078a515246150031))
+
+### build
+
+- Fix catalog generic deploy-id handling ([413f3fc63](https://github.com/underpostnet/engine/commit/413f3fc63851d678267a5618c6779fffc49cb14e))
+
+### engine
+
+- Refactor introduce new projects module and client-builder modules split from server ([4d14ee552](https://github.com/underpostnet/engine/commit/4d14ee552258cb3c2f70e43291945798b4d95f1a))
+
+### api
+
+- Introduce base cyberia-saga api / model ([2f02f5d6a](https://github.com/underpostnet/engine/commit/2f02f5d6a2ff2258146498bb50ac3e65b51beced))
+- Update canonical action defaults with typed quest dialogues and add Wason errand quest ([5e380abee](https://github.com/underpostnet/engine/commit/5e380abeef4954567717138af5218b506b3da414))
+- Refactor action model: remove type and grantQuestCode, add per-quest dialogue map and getByCode endpoint ([3ce9f4c18](https://github.com/underpostnet/engine/commit/3ce9f4c18ef993da85fe5f9b10b61cf7987e5457))
+- Update quest defaults: replace SCP-2040 references with Kishins ([bf6fa827d](https://github.com/underpostnet/engine/commit/bf6fa827d0fffbe5fcf97756263af50eade0af4b))
+- Add fallback defaults to dialogue and quest services ([ab2894dd4](https://github.com/underpostnet/engine/commit/ab2894dd4f591cc7247d6708a25ea737ea059c56))
+- Refactor CyberiaAction model to cell-based binding and remove provideItemId ([614a2aa60](https://github.com/underpostnet/engine/commit/614a2aa60bfa8e2330722c9c4e9fea4afc3adf3c))
+- Add quest metadata REST endpoint GET /api/cyberia-quest/code/:code ([c6f7cfa94](https://github.com/underpostnet/engine/commit/c6f7cfa94a4b3cc9f398cd63c24082b8c47db642))
+
+### grpc
+
+- Scope quest delivery to instance map codes ([d357c0cce](https://github.com/underpostnet/engine/commit/d357c0cce491078ea00a294f15f1b886fb92c05d))
+- Add prerequisiteCodes and canonical item fallback to instance config ([e34683e23](https://github.com/underpostnet/engine/commit/e34683e2372f48be034435fc2ce25915e5447aad))
+
+### hardhar
+
+- Fix prevent crash build due coverage build: Error HHE905: Couldn't download compiler version list. ([b841b5598](https://github.com/underpostnet/engine/commit/b841b55980cc5a3d19b6413f2ebb72c45b8906fb))
+
+### cli-run
+
+- Add  shared-dir-add-user runner: Add user to an existing shared directory without changing file owners ([b5c7ea7c8](https://github.com/underpostnet/engine/commit/b5c7ea7c83cf85775eaf3fc3071097f2e5e9d59f))
+
+### scripts
+
+- Update scripts/rpmfusion-ffmpeg-setup.sh ([975f7e9f3](https://github.com/underpostnet/engine/commit/975f7e9f30f7f224bcf0faa78a617b7f67fc6c96))
+
+### client-cyberia
+
+- Update default bot skin in fallback world ([a7df2b9f6](https://github.com/underpostnet/engine/commit/a7df2b9f6fd80c62b1aa3fff2ce58d0a3dc18d7a))
+- Fix headerName of metadata cid and render cid in ObjectLayerManagement component ([1d1419001](https://github.com/underpostnet/engine/commit/1d14190017c6b080c502a9478f65a35364c413df))
+- Add Kishins skin item to shared defaults ([acf13ba0e](https://github.com/underpostnet/engine/commit/acf13ba0e2a6acabc7ee1ee233275cdb31311c0d))
+- Fix render section title label in  ObjectLayerEngineModal ([2b9a88bed](https://github.com/underpostnet/engine/commit/2b9a88bed67fe2b205f648050af411a9c1e7588d))
+
+### docs
+
+- Update action and quest system documentation for cell-based binding and explicit quest accept ([fadd9e360](https://github.com/underpostnet/engine/commit/fadd9e3605e686d8487aad1ef28b2668388256c4))
+- Update quest system documentation with kill and collect objective details ([1695e17d9](https://github.com/underpostnet/engine/commit/1695e17d9ec628ed9907859d6dd4ec890f113240))
+- Document mission system: action-provider NPCs and fallback world instantiation ([469094678](https://github.com/underpostnet/engine/commit/469094678a35d4bbd03c79181f78d7720614179c))
+- Update cyberia client docs url env parsing ([77923cfa4](https://github.com/underpostnet/engine/commit/77923cfa4977fd21ed5acbe6e2e5dfdaa70a614d))
+
+### cyberia-instance
+
+- Give action provider NPCs small wander radius ([b56389b5a](https://github.com/underpostnet/engine/commit/b56389b5a63b964ee1c94fcce0d9dafea4c1b2f6))
+- Add action-provider NPC generation and cell reservation to fallback world builder ([985ba010c](https://github.com/underpostnet/engine/commit/985ba010c0ca76dc10bd12fffbc07871c01e0e90))
+
+### grcp
+
+- Deliver actions and quests in InstanceConfig for mission content ([e26466e9a](https://github.com/underpostnet/engine/commit/e26466e9a401ada9a5add5b658243e9cf34879a9))
+
+### cli-cyberia
+
+- Add DefaultCyberiaActions, DefaultCyberiaQuests, and seed-actions-quests CLI command ([cc9f21377](https://github.com/underpostnet/engine/commit/cc9f21377ba77c0e141d153f852dbb9777d74525))
+
+### fs
+
+- Add Single-file handling in upload use case in cloudinary storage ([6061d8bf2](https://github.com/underpostnet/engine/commit/6061d8bf290f00c2c4e46a0206419ba4b1119f2e))
+
+## New release v:3.2.22 (2026-06-07)
 
 ### repository
 

package/CLI-HELP.md

@@ -1,6 +1,6 @@
 ## Underpost CLI
 
-> underpost ci/cd cli v3.2.22
+> underpost ci/cd cli v3.2.28
 
 **Usage:** `underpost [options] [command]`
 
@@ -40,6 +40,7 @@
 | [`monitor`](#underpost-monitor) | Manages health server monitoring for specified deployments. |
 | [`ssh`](#underpost-ssh) | Manages SSH credentials and sessions for remote access to cluster nodes or services. |
 | [`run`](#underpost-run) | Runs specified scripts using various runners. |
+| [`docker-compose`](#underpost-docker-compose) | General-purpose Docker Compose development pipeline (mirrors the Kubernetes dev stack). |
 | [`lxd`](#underpost-lxd) | Manages LXD virtual machines as K3s nodes (control plane or workers). |
 | [`baremetal`](#underpost-baremetal) | Manages baremetal server operations, including installation, database setup, commissioning, and user management. |
 | [`release`](#underpost-release) | Release orchestrator for building new versions and deploying releases of the Underpost CLI. |
@@ -815,7 +816,7 @@ Runs specified scripts using various runners.
 
 | Argument | Description |
 | --- | --- |
-| `runner-id` | The runner ID to run. Options: dev-cluster,etc-hosts,ipfs-expose,metadata,svc-ls,svc-rm,ssh-deploy-info,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,ssh-deploy-stop,ssh-deploy-db-rollback,ssh-deploy-db,ssh-deploy-db-status,tz,get-proxy,instance-promote,instance,instance-build-manifest,ls-deployments,host-update,install-crio,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,deploy,disk-clean,disk-devices,disk-usage,dev,service,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,pull-rocky-image,rmi,kill,generate-pass,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job,push-bundle,pull-bundle,build-cluster-deployment-manifests,monitor-ui,shared-dir. |
+| `runner-id` | The runner ID to run. Options: dev-cluster,etc-hosts,ipfs-expose,metadata,svc-ls,svc-rm,ssh-deploy-info,node-move,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,ssh-deploy-stop,ssh-deploy-db-rollback,ssh-deploy-db,ssh-deploy-db-status,tz,get-proxy,instance-promote,instance,instance-build-manifest,ls-deployments,host-update,install-crio,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,deploy,disk-clean,disk-devices,disk-usage,dev,service,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,pull-rocky-image,rmi,kill,generate-pass,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job,push-bundle,pull-bundle,build-cluster-deployment-manifests,monitor-ui,shared-dir,shared-dir-add-user. |
 | `path` | The input value, identifier, or path for the operation. |
 
 #### Options
@@ -894,6 +895,45 @@ Runs specified scripts using various runners.
 
 ---
 
+### underpost docker-compose
+
+General-purpose Docker Compose development pipeline (mirrors the Kubernetes dev stack).
+
+**Usage:** `underpost docker-compose [options] [target]`
+
+#### Arguments
+
+| Argument | Description |
+| --- | --- |
+| `target` | Optional service name for --logs, --shell, --restart, or --build. |
+
+#### Options
+
+| Option | Description |
+| --- | --- |
+| `--install` | Install Docker Engine and the Compose v2 plugin on RHEL/Rocky hosts. |
+| `--reset` | Comprehensive teardown (equivalent to cluster --reset): removes all stack containers, the network, named volumes (destroys data), orphans, and generated artifacts. |
+| `--force` | Force reinstall (--install), remove volumes (--down), or also drop the env-file (--reset). |
+| `--deploy-id <deploy-id>` | Deployment to run as the app container (default: dd-default). 'dd-default' self-bootstraps a fresh engine; any other id runs the standard 'underpost start' command (mirrors src/cli/deploy.js). |
+| `--env <env>` | Deployment environment for non-default deploy ids (default: development). |
+| `--generate` | Render dynamic supporting files (nginx router config, env-file, app-command override). |
+| `--up` | Start the full stack detached (regenerates config first). |
+| `--down` | Stop and remove containers (and orphans). |
+| `--volumes` | With --down, also remove named volumes (destroys persisted data). |
+| `--restart` | Restart services (optionally a single [target]). |
+| `--build` | With --up rebuild images; alone, rebuilds images with --no-cache. |
+| `--pull` | Pull upstream images for all services. |
+| `--logs` | Follow logs for all services (optionally a single [target]). |
+| `--status` | Show a formatted status table of services. |
+| `--shell` | Open an interactive shell in [target] (default: app). |
+| `--exec <subcommand>` | General-purpose passthrough docker compose subcommand. |
+| `--compose-file <path>` | Path to the compose file (default: docker-compose.yml). |
+| `--env-file <path>` | Path to the compose env-file (default: docker/compose.env). |
+| `--nginx-conf <path>` | Path to the generated nginx config (default: docker/nginx/default.conf). |
+| `-h, --help` | display help for command |
+
+---
+
 ### underpost lxd
 
 Manages LXD virtual machines as K3s nodes (control plane or workers).
@@ -976,6 +1016,18 @@ Manages baremetal server operations, including installation, database setup, com
 | `--remove-machines <system-ids>` | Removes baremetal machines by comma-separated system IDs, or use "all" |
 | `--clear-discovered` | Clears all discovered baremetal machines from the database. |
 | `--commission` | Init workflow for commissioning a physical machine. |
+| `--install-disk [device]` | Explicit target install disk for Rocky deployment (e.g. /dev/nvme0n1). Omit or leave empty to auto-detect the internal disk. |
+| `--no-auto-install` | Disables the ephemeral runtime AUTO_INSTALL fallback (controller must trigger install). |
+| `--no-remote-install` | Skips the controller-side remote install orchestration over SSH. |
+| `--worker` | Post-install infra role: join the deployed node as a Kubernetes worker (requires --control <ip>). Without this flag the node is set up as a control-plane. |
+| `--control <ip>` | Control-plane IP the worker node joins (used with --worker for kubeadm infra setup). |
+| `--ssh-key-dir <dir>` | Directory holding the SSH key pair used for commissioning/orchestration (expects <dir>/id_rsa and <dir>/id_rsa.pub). Overrides the workflow "sshKeyDir"; defaults to engine-private/deploy. Supports a leading ~. |
+| `--deploy-id <deploy-id>` | Deployment ID whose user key pair is used for SSH (key from engine-private/conf/<deploy-id>/users/<user>/id_rsa). Same user↔deployId↔key convention as the ssh command. |
+| `--user <user>` | SSH user paired with --deploy-id for key resolution and the login user on an existing control-plane (defaults to root). Mirrors the ssh command --user. |
+| `--engine-repo <url>` | Custom engine repo cloned + normalized to /home/dd/engine on the node (default: <GITHUB_USERNAME>/engine). |
+| `--engine-branch <branch>` | Branch of the engine repo to clone on the node. |
+| `--engine-private-repo <url>` | Custom private repo cloned + normalized to /home/dd/engine/engine-private on the node (default: <GITHUB_USERNAME>/engine-<id>-private). |
+| `--engine-private-branch <branch>` | Branch of the engine-private repo to clone on the node. |
 | `--bootstrap-http-server-run` | Runs a temporary bootstrap HTTP server for generic purposes such as serving iPXE scripts or ISO images during commissioning. |
 | `--bootstrap-http-server-path <path>` | Sets a custom bootstrap HTTP server path for baremetal commissioning. |
 | `--bootstrap-http-server-port <port>` | Sets a custom bootstrap HTTP server port for baremetal commissioning. |
@@ -997,6 +1049,8 @@ Manages baremetal server operations, including installation, database setup, com
 | `--logs <log-id>` | Displays logs for log id: dhcp,dhcp-lease,dhcp-lan,cloud-init,cloud-init-machine,cloud-init-config |
 | `--dev` | Sets the development context environment for baremetal operations. |
 | `--ls` | Lists available boot resources and machines. |
+| `--resume-infra-setup` | Skip commissioning, OS install, and all bootstrapping; resume only the SSH-based infra setup (kubeadm join/init) on a node that already has the OS installed and is reachable via SSH. |
+| `--resume-join` | Skip everything except the kubeadm join command. Assumes engine, Node.js, CRI-O, kubelet, and kubeadm are already installed. Only retrieves a fresh join token from the control-plane and runs kubeadm join. |
 | `-h, --help` | display help for command |
 
 ---

package/README.md

@@ -16,7 +16,7 @@
 
 <div align="center">
 
-[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![](https://data.jsdelivr.com/v1/package/npm/underpost/badge)](https://www.jsdelivr.com/package/npm/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.22)](https://socket.dev/npm/package/underpost/overview/3.2.22) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
+[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![](https://data.jsdelivr.com/v1/package/npm/underpost/badge)](https://www.jsdelivr.com/package/npm/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.28)](https://socket.dev/npm/package/underpost/overview/3.2.28) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
 
 </div>
 
@@ -88,7 +88,7 @@ npm run dev
 <!-- cli-index-start -->
 ## Underpost CLI
 
-> underpost ci/cd cli v3.2.22
+> underpost ci/cd cli v3.2.28
 
 **Usage:** `underpost [options] [command]`
 
@@ -128,6 +128,7 @@ npm run dev
 | [`monitor`](CLI-HELP.md#underpost-monitor) | Manages health server monitoring for specified deployments. |
 | [`ssh`](CLI-HELP.md#underpost-ssh) | Manages SSH credentials and sessions for remote access to cluster nodes or services. |
 | [`run`](CLI-HELP.md#underpost-run) | Runs specified scripts using various runners. |
+| [`docker-compose`](CLI-HELP.md#underpost-docker-compose) | General-purpose Docker Compose development pipeline (mirrors the Kubernetes dev stack). |
 | [`lxd`](CLI-HELP.md#underpost-lxd) | Manages LXD virtual machines as K3s nodes (control plane or workers). |
 | [`baremetal`](CLI-HELP.md#underpost-baremetal) | Manages baremetal server operations, including installation, database setup, commissioning, and user management. |
 | [`release`](CLI-HELP.md#underpost-release) | Release orchestrator for building new versions and deploying releases of the Underpost CLI. |

package/baremetal/commission-workflows.json

@@ -174,6 +174,7 @@
     "type": "iso-ram",
     "osIdLike": "rhel centos fedora",
     "architecture": "amd64",
+    "infraSetup": "underpost-kubeadm-contour",
     "isoUrl": "https://download.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9-latest-x86_64-boot.iso",
     "tftpPrefix": "envy-rocky9",
     "bootstrapHttpServerPort": 8888,

package/bin/build.js

@@ -140,6 +140,7 @@ const buildDeployTemplate = async (confName) => {
       break;
     }
     default:
+      for (const path of catalog.templatePaths) fs.copySync(`.${path}`, `${basePath}${path}`);
       break;
   }
 

package/docker-compose.yml

@@ -0,0 +1,224 @@
+# Production-style Docker Compose stack mirroring the Kubernetes development
+# environment defined under manifests/{mongodb,valkey,deployment/dd-default-development}.
+#
+# Mapping summary (K8s -> Compose):
+#   StatefulSet mongodb (replSet rs0, keyFile auth)   -> mongodb + mongodb-keyfile-init + mongodb-rs-init
+#   StatefulSet valkey-service                         -> valkey-service
+#   Deployment dd-default-development-blue             -> app
+#   HTTPProxy default.net / www.default.net (Contour)  -> proxy (nginx reverse proxy)
+#   Service type LoadBalancer / NodePort               -> published host ports via the proxy
+#   Secret mongodb-secret / mongodb-keyfile            -> .env values + generated keyfile volume
+#   PVC mongodb-storage / volumeClaimTemplates         -> named volumes
+
+name: dd-default-development
+
+services:
+  # --- MongoDB -------------------------------------------------------------
+  # Mirrors manifests/mongodb/statefulset.yaml: replSet rs0, keyFile cluster
+  # auth, --auth, bind to all interfaces. Single-node replica set for local dev.
+  #
+  # Bootstrap follows src/db/mongo/MongoBootstrap.js rather than the image's
+  # MONGO_INITDB_ROOT_USERNAME auto-init (whose temp server + keyFile combination
+  # is unreliable). The generated entrypoint (docker/mongodb/entrypoint.sh)
+  # generates the keyfile, starts mongod, and bootstraps the replica set + root
+  # user over the loopback localhost exception. The healthcheck gates readiness
+  # on an authenticated writable primary.
+  mongodb:
+    image: ${MONGO_IMAGE:-mongo:latest}
+    container_name: dd-mongodb
+    entrypoint: ["bash", "/docker-init/entrypoint.sh"]
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: ${MONGO_INITDB_ROOT_USERNAME:?set MONGO_INITDB_ROOT_USERNAME in docker/compose.env}
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD:?set MONGO_INITDB_ROOT_PASSWORD in docker/compose.env}
+      DB_REPLICA_SET: ${DB_REPLICA_SET:-rs0}
+    volumes:
+      - ./docker/mongodb:/docker-init:ro
+      - mongodb-keyfile:/opt/keyfile
+      - mongodb-data:/data/db
+    networks:
+      - dd-internal
+    expose:
+      - "27017"
+    ports:
+      - "${MONGO_HOST_PORT:-27017}:27017"
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >
+          mongosh --quiet -u "$$MONGO_INITDB_ROOT_USERNAME" -p "$$MONGO_INITDB_ROOT_PASSWORD"
+          --authenticationDatabase admin --eval "db.hello().isWritablePrimary" | grep -q true
+      interval: 10s
+      timeout: 5s
+      retries: 20
+      start_period: 60s
+    restart: unless-stopped
+
+  # --- Valkey --------------------------------------------------------------
+  # Mirrors manifests/valkey/statefulset.yaml.
+  valkey-service:
+    image: ${VALKEY_IMAGE:-valkey/valkey:latest}
+    container_name: dd-valkey
+    command: ["valkey-server", "--port", "6379", "--bind", "0.0.0.0", "--protected-mode", "no"]
+    volumes:
+      - valkey-data:/data
+    networks:
+      - dd-internal
+    expose:
+      - "6379"
+    # NodePort equivalent (manifests/valkey/valkey-nodeport.yaml nodePort 32079).
+    ports:
+      - "${VALKEY_NODEPORT:-32079}:6379"
+    healthcheck:
+      test: ["CMD", "valkey-cli", "-p", "6379", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+    restart: unless-stopped
+
+  # --- Application ---------------------------------------------------------
+  # Mirrors manifests/deployment/dd-default-development/deployment.yaml
+  # (dd-default-development-blue). Connection targets use Docker service
+  # discovery instead of hardcoded localhost.
+  app:
+    image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.2.22}
+    container_name: dd-app
+    # The start command is supplied by the generated override docker/compose.app.yml
+    # (see `underpost docker-compose --generate --deploy-id <id>`), keeping this
+    # file deployment-agnostic.
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      DB_PROVIDER: ${DB_PROVIDER:-mongoose}
+      DB_HOST: ${DB_HOST:-mongodb://mongodb:27017}
+      DB_NAME: ${DB_NAME:-default}
+      DB_REPLICA_SET: ${DB_REPLICA_SET:-rs0}
+      DB_AUTH_SOURCE: ${DB_AUTH_SOURCE:-admin}
+      DB_USER: ${MONGO_INITDB_ROOT_USERNAME:?}
+      DB_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD:?}
+      VALKEY_HOST: ${VALKEY_HOST:-valkey-service}
+      VALKEY_PORT: ${VALKEY_PORT:-6379}
+    networks:
+      - dd-internal
+    expose:
+      - "4001"
+      - "4002"
+      - "4003"
+      - "4004"
+    # Direct access to the LoadBalancer-equivalent ports (manifest 4001-4004).
+    ports:
+      - "${APP_PORT_4001:-4001}:4001"
+      - "${APP_PORT_4002:-4002}:4002"
+      - "${APP_PORT_4003:-4003}:4003"
+      - "${APP_PORT_4004:-4004}:4004"
+    healthcheck:
+      test: ["CMD-SHELL", "timeout 2 bash -c '</dev/tcp/127.0.0.1/4001' || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
+    depends_on:
+      mongodb:
+        condition: service_healthy
+      valkey-service:
+        condition: service_healthy
+    restart: unless-stopped
+
+  # --- Reverse proxy / NodePort-equivalent load balancer -------------------
+  # Mirrors manifests/deployment/dd-default-development/proxy.yaml (Contour
+  # HTTPProxy) using nginx with websocket upgrade support.
+  proxy:
+    image: ${PROXY_IMAGE:-nginx:stable-alpine}
+    container_name: dd-proxy
+    volumes:
+      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
+    networks:
+      - dd-internal
+    ports:
+      - "${PROXY_HTTP_PORT:-80}:80"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1/healthz"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    depends_on:
+      app:
+        condition: service_started
+    restart: unless-stopped
+
+  # --- Monitoring: Prometheus ----------------------------------------------
+  # Mirrors manifests/prometheus/deployment.yaml. Scrapes the app's /metrics
+  # endpoint (prom-client) over the internal network. Config is generated by
+  # `underpost docker-compose --generate` into docker/prometheus/prometheus.yml.
+  prometheus:
+    image: ${PROMETHEUS_IMAGE:-prom/prometheus:latest}
+    container_name: dd-prometheus
+    command:
+      - --config.file=/etc/prometheus/prometheus.yml
+      - --storage.tsdb.path=/prometheus
+    volumes:
+      - ./docker/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus-data:/prometheus
+    networks:
+      - dd-internal
+    expose:
+      - "9090"
+    ports:
+      - "${PROMETHEUS_PORT:-9090}:9090"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:9090/-/healthy"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+    depends_on:
+      app:
+        condition: service_started
+    restart: unless-stopped
+
+  # --- Monitoring: Grafana -------------------------------------------------
+  # Mirrors manifests/grafana/deployment.yaml. Prometheus datasource is
+  # pre-provisioned (generated) so dashboards work out of the box.
+  grafana:
+    image: ${GRAFANA_IMAGE:-grafana/grafana:latest}
+    container_name: dd-grafana
+    environment:
+      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
+      GF_USERS_ALLOW_SIGN_UP: "false"
+    volumes:
+      - ./docker/grafana/provisioning:/etc/grafana/provisioning:ro
+      - grafana-data:/var/lib/grafana
+    networks:
+      - dd-internal
+    expose:
+      - "3000"
+    ports:
+      - "${GRAFANA_PORT:-3000}:3000"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:3000/api/health"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+    depends_on:
+      prometheus:
+        condition: service_started
+    restart: unless-stopped
+
+networks:
+  dd-internal:
+    name: dd-internal
+    driver: bridge
+
+volumes:
+  mongodb-data:
+    name: dd-mongodb-data
+  mongodb-keyfile:
+    name: dd-mongodb-keyfile
+  valkey-data:
+    name: dd-valkey-data
+  prometheus-data:
+    name: dd-prometheus-data
+  grafana-data:
+    name: dd-grafana-data

package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-backup
-              image: underpost/underpost-engine:v3.2.22
+              image: underpost/underpost-engine:v3.2.28
               command:
                 - /bin/sh
                 - -c

package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-dns
-              image: underpost/underpost-engine:v3.2.22
+              image: underpost/underpost-engine:v3.2.28
               command:
                 - /bin/sh
                 - -c

package/manifests/deployment/dd-default-development/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-blue
-          image: underpost/underpost-engine:v3.2.22
+          image: underpost/underpost-engine:v3.2.28
           #          resources:
           #            requests:
           #              memory: "124Ki"
@@ -98,7 +98,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-green
-          image: underpost/underpost-engine:v3.2.22
+          image: underpost/underpost-engine:v3.2.28
           #          resources:
           #            requests:
           #              memory: "124Ki"