underpost 3.2.70 → 3.2.90

package/CLI-HELP.md

@@ -1,6 +1,6 @@
 ## Underpost CLI
 
-> underpost ci/cd cli v3.2.70
+> underpost ci/cd cli v3.2.90
 
 **Usage:** `underpost [options] [command]`
 
@@ -210,6 +210,7 @@ Manages commits to a GitHub repository, supporting various commit types and opti
 | `--edit` | Edit last commit. |
 | `--deploy-id <deploy-id>` | Sets the deployment configuration ID for the commit context. |
 | `--cached` | Commit staged changes only or context. |
+| `--init-repo [origin]` | Initialize a git repository at the specified path. Optionally set the git remote origin URL. |
 | `--hashes <hashes>` | Comma-separated list of specific file hashes of commits. |
 | `--extension <extension>` | specific file extensions of commits. |
 | `--changelog` | Print the plain changelog of the last N commits (see --from-n-commit, default 1). |
@@ -410,7 +411,7 @@ Manages Kubernetes clusters, defaulting to Kind cluster initialization.
 | Option | Description |
 | --- | --- |
 | `--reset` | Deletes all clusters and prunes all related data and caches. |
-| `--reset-mongodb` | Performs a hard cleanup of only MongoDB-related resources (StatefulSet, PVCs/PVs, Secrets, ConfigMaps, caches) without restarting the whole node. |
+| `--reset-mongodb` | Performs a hard cleanup of only MongoDB-related resources (StatefulSet, PVCs/PVs, Secrets, ConfigMaps, caches) without restarting the whole node. Combined with --mongodb it instead wipes the retained hostPath volumes as part of that deploy, so the replica set starts from empty data. |
 | `--mariadb` | Initializes the cluster with a MariaDB statefulset. |
 | `--mysql` | Initializes the cluster with a MySQL statefulset. |
 | `--mongodb` | Initializes the cluster with a MongoDB statefulset. |
@@ -420,6 +421,9 @@ Manages Kubernetes clusters, defaulting to Kind cluster initialization.
 | `--valkey` | Initializes the cluster with a Valkey service. |
 | `--ipfs` | Initializes the cluster with an ipfs-cluster statefulset. |
 | `--contour` | Initializes the cluster with Project Contour base HTTPProxy and Envoy. |
+| `--gateway-api` | Initializes the cluster with the Gateway API control plane (CRDs, Envoy Gateway, GatewayClass) used by generated HTTPRoute + QUIC/HTTP3 manifests. With --dev the data plane binds the listener ports on the host network for direct browser access. |
+| `--gateway-class <name>` | GatewayClass name to provision (default "eg"). |
+| `--ingress-node <node-name>` | Dedicated node for underpost-ingress when both routing stacks coexist. Workload placement flags do not move it. |
 | `--node-port` | Exposes enabled ready services (e.g. MongoDB 4.4, Valkey) to the host/public network via their NodePort Service manifest. |
 | `--node-selector <k8s-node-name>` | Pins the just-deployed StatefulSet (MongoDB 4.4 / Valkey) to the given Kubernetes node once it is ready (via a kubernetes.io/hostname nodeSelector). |
 | `--cert-manager` | Initializes the cluster with a Let's Encrypt production ClusterIssuer. |
@@ -467,13 +471,14 @@ Manages application deployments, defaulting to deploying development pods.
 | `--remove` | Deletes specified deployments and their associated services. |
 | `--sync` | Synchronizes deployment environment variables, ports, and replica counts. |
 | `--info-router` | Displays the current router structure and configuration. |
-| `--expose` | Exposes services matching the provided deployment ID list. |
 | `--cert` | Resets TLS/SSL certificate secrets for deployments. |
 | `--cert-hosts <hosts>` | Resets TLS/SSL certificate secrets for specified hosts. |
 | `--self-signed` | Use a pre-created self-signed TLS secret (kubernetes.io/tls) instead of cert-manager. The secret must already exist in the namespace with the same name as the host. Enables TLS in the Contour HTTPProxy virtualhost without requiring a production ClusterIssuer. |
 | `--node <node>` | Sets optional node for deployment operations. |
+| `--ingress-node <node-name>` | Explicitly relocates the shared host-network ingress; ordinary --node placement never moves it. |
 | `--ssh-key-path <path>` | Private key path for node SSH operations. Currently used when shipping a hostPath volume to a remote target node over SSH. Defaults to engine-private/deploy/id_rsa. |
 | `--build-manifest` | Builds Kubernetes YAML manifests, including deployments, services, proxies, and secrets. |
+| `--sync-static` | Places the SSR status pages and intercepted contexts in the gateway static utility tree, so the edge serves them instead of the application pods. Prefers the running workload and falls back to this checkout, so it can seed the tree before the deployment exists and refresh it once the deployment is Ready. |
 | `--replicas <replicas>` | Sets a custom number of replicas for deployments. |
 | `--image <image>` | Sets a custom image for deployments. |
 | `--versions <deployment-versions>` | A comma-separated list of custom deployment versions. |
@@ -483,28 +488,25 @@ Manages application deployments, defaulting to deploying development pods.
 | `--retry-count <count>` | Sets HTTPProxy per-route retry count (e.g., 3). |
 | `--retry-per-try-timeout <duration>` | Sets HTTPProxy retry per-try timeout (e.g., "150ms"). |
 | `--disable-update-deployment` | Disables updates to deployments. |
-| `--disable-runtime-probes` | Omits the internal-status HTTP probes from generated deployment manifests. |
+| `--disable-runtime-probes` | Deprecated compatibility flag; readiness probes remain mandatory. Use --tcp-probes for legacy workloads. |
 | `--tcp-probes` | Generates legacy TCP socket probes instead of HTTP internal-status probes (migration). |
 | `--disable-update-proxy` | Disables updates to proxies. |
 | `--disable-deployment-proxy` | Disables proxies of deployments. |
+| `--gateway-api` | Routes through the Gateway API stack (Gateway + HTTPRoute) instead of the Contour HTTPProxy. Both manifest sets are always generated; this selects which one is applied. |
+| `--gateway-class <name>` | GatewayClass name for generated Gateway manifests (default "eg"). |
+| `--disable-http3` | Omits the QUIC/HTTP3 listener config and the Alt-Svc advertisement from Gateway API manifests. |
+| `--quic-port <port>` | UDP port advertised for QUIC/HTTP3 in generated Gateway API manifests (default 443). |
 | `--disable-update-volume` | Disables updates to volume mounts during deployment. |
-| `--status` | Retrieves current network traffic data from resource deployments and the host machine network configuration. |
 | `--kubeadm` | Enables the kubeadm context for deployment operations. |
 | `--k3s` | Enables the k3s context for deployment operations. |
 | `--kind` | Enables the kind context for deployment operations. |
 | `--git-clean` | Runs git clean on volume mount paths before copying. |
 | `--disable-update-underpost-config` | Disables updates to Underpost configuration during deployment. |
 | `--namespace <namespace>` | Kubernetes namespace for deployment operations (defaults to "default"). |
-| `--kind-type <kind-type>` | Specifies the Kind cluster type for deployment operations. |
-| `--port <port>` | Sets up port forwarding from local to remote ports. |
-| `--expose-port <port>` | Sets the local:remote port to expose when --expose is active (overrides auto-detected service port). |
-| `--expose-local-port <port>` | Sets a different local port for --expose (e.g. 80) while keeping the remote service port. Useful for /etc/hosts local access without specifying a port in the browser. |
-| `--local-proxy` | Forward all service TCP ports locally and start the Node.js path-routing proxy. Enables full path-based routing (e.g. /wp alongside /) without needing --expose-local-port. Requires --expose. |
 | `--cmd <cmd>` | Custom initialization command for deployment (comma-separated commands). |
 | `--skip-full-build` | Skip client bundle rebuild; container will pull pre-built bundle via pull-bundle instead. |
 | `--pull-bundle` | Explicitly pull the pre-built client bundle from Cloudinary inside the container. Use together with --skip-full-build. |
 | `--image-pull-policy <policy>` | Override container imagePullPolicy in the generated deployment manifest (Always, IfNotPresent, Never). Defaults to Never for localhost/ images and IfNotPresent otherwise. |
-| `--tls` | Enables TLS for the local proxy started by --expose --local-proxy. The proxy will serve HTTPS on port 443 using self-signed certificates resolved from the local SSL store. Use together with --expose and --local-proxy. |
 | `-h, --help` | display help for command |
 
 ---
@@ -513,13 +515,13 @@ Manages application deployments, defaulting to deploying development pods.
 
 Manages secrets for various platforms.
 
-**Usage:** `underpost secret [options] <platform>`
+**Usage:** `underpost secret [options] [platform]`
 
 #### Arguments
 
 | Argument | Description |
 | --- | --- |
-| `platform` | The secret management platform. Options: underpost, sanitizeSecretEnvFile, globalSecretClean. |
+| `platform` | The secret management platform. Options: underpost, sops, sanitizeSecretEnvFile, globalSecretClean. Defaults to "sops". (default: "sops") |
 
 #### Options
 
@@ -530,6 +532,17 @@ Manages secrets for various platforms.
 | `--create-from-env` | Creates secrets from container environment variables (envFrom: secretRef). |
 | `--global-clean` | Removes all filesystem traces of secrets (engine-private, .env, conf cache). |
 | `--list` | Lists all available secrets for the platform. |
+| `--encrypt <plaintext-path>` | Encrypts a plaintext Secret manifest into the Git-tracked SOPS store and shreds the source (sops platform). |
+| `--apply` | Decrypts stored SOPS manifests and streams them into kubectl apply, without writing plaintext to disk (sops platform). |
+| `--namespace <namespace>` | Kubernetes namespace for secret operations (defaults to "default"). |
+| `--install-tools` | Installs the sops and age host binaries only, without running a full cluster host initialization. |
+| `--rotate` | Re-keys every stored SOPS manifest onto --recipient. Secret values are unchanged, so no workload restart is needed. |
+| `--recipient <age-public-key>` | Incoming Age public recipient for --rotate. |
+| `--prune-recipients` | With --rotate, makes --recipient the only recipient, revoking every previous key (use after a key compromise). Requires --force, and revokes CI/CD keys too unless they are named in --keep-recipients. |
+| `--keep-recipients <age-public-keys>` | Comma-separated recipients to retain while --prune-recipients revokes the rest (e.g. the CI/CD key). |
+| `--purge <secret-name>` | Emergency removal: deletes the live Kubernetes Secret and takes its encrypted manifest out of the store. |
+| `--force` | Confirms the irreversible variant: deletes the manifest instead of archiving it (--purge), revokes recipients (--rotate --prune-recipients), or replaces an existing manifest (--encrypt). |
+| `--dry-run` | Reports what --apply, --rotate, or --purge would do without changing anything. |
 | `-h, --help` | display help for command |
 
 ---
@@ -824,7 +837,7 @@ Runs specified scripts using various runners.
 
 | Argument | Description |
 | --- | --- |
-| `runner-id` | The runner ID to run. Options: dev-cluster,etc-hosts,ipfs-expose,metadata,svc-ls,svc-rm,ssh-deploy-info,node-move,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,ssh-deploy-stop,ssh-deploy-db-rollback,ssh-deploy-db,ssh-deploy-db-status,tz,get-proxy,instance-promote,instance,deploy-key,instance-build-manifest,ls-deployments,host-update,install-crio,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,deploy,disk-clean,disk-devices,disk-usage,dev,service,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,pull-rocky-image,rmi,kill,generate-pass,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job,push-bundle,pull-bundle,build-cluster-deployment-manifests,monitor-ui,shared-dir,shared-dir-add-user. |
+| `runner-id` | The runner ID to run. Options: status,expose,dev-cluster,metadata,ipfs-expose,svc-ls,svc-rm,node-move,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,tz,get-traffic,restore-mongo,ingress-refresh,instance-promote,instance,deploy-key,instance-build-manifest,ls-deployments,host-update,install-crio,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,gateway-status,deploy,disk-clean,disk-devices,disk-usage,dev,service,etc-hosts,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,pull-rocky-image,rmi,kill,generate-pass,sops-setup,sops-status,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job,push-bundle,pull-bundle,build-cluster-deployment-manifests,monitor-ui,shared-dir,shared-dir-add-user. |
 | `path` | The input value, identifier, or path for the operation. |
 
 #### Options
@@ -838,8 +851,12 @@ Runs specified scripts using various runners.
 | `--replicas <replicas>` | Sets a custom number of replicas for deployment. |
 | `--pod-name <pod-name>` | Optional: Specifies the pod name for execution. |
 | `--node-name <node-name>` | Optional: Specifies the node name for execution. |
+| `--ingress-node <node-name>` | Dedicated node for the host-network underpost-ingress listener. Workload --node-name never relocates it. |
 | `--ssh-key-path <path>` | Optional: Private key path for node SSH operations, forwarded to volume shipping over SSH. Defaults to engine-private/deploy/id_rsa. |
 | `--port <port>` | Optional: Specifies the port for execution. |
+| `--expose-container-ports <ports>` | Comma-separated Service/container ports; multiple matched resources consume values by resource index. |
+| `--expose-host-ports <ports>` | Comma-separated host ports paired with container ports by resource/port index. |
+| `--local-proxy` | Starts the development path proxy after the expose runner creates its port-forwards. |
 | `--etc-hosts` | Enables etc-hosts context for the runner execution. |
 | `--volume-host-path <volume-host-path>` | Optional: Specifies the volume host path for test execution. |
 | `--volume-mount-path <volume-mount-path>` | Optional: Specifies the volume mount path for test execution. |
@@ -866,7 +883,7 @@ Runs specified scripts using various runners.
 | `--limits-memory <limits-memory>` | Sets memory limit for the runner execution. |
 | `--limits-cpu <limits-cpu>` | Sets CPU limit for the runner execution. |
 | `--resource-template-id <resource-template-id >` | Specifies a resource template ID for the runner execution. |
-| `--expose` | Enables service exposure for the runner execution. |
+| `--expose` | Enables exposure-only behavior in compatible runners; the expose runner itself does not require this flag. |
 | `--conf-server-path <conf-server-path>` | Sets a custom configuration server path. |
 | `--underpost-root <underpost-root>` | Sets a custom Underpost root path. |
 | `--cmd-cron-jobs <cmd-cron-jobs>` | Pre-script commands to run before cron job execution. |
@@ -875,7 +892,7 @@ Runs specified scripts using various runners.
 | `--kubeadm` | Sets the kubeadm cluster context for the runner execution. |
 | `--k3s` | Sets the k3s cluster context for the runner execution. |
 | `--kind` | Sets the kind cluster context for the runner execution. |
-| `--traffic <traffic>` | Blue/green traffic colour to bake into generated manifests (default: blue). |
+| `--traffic <traffic>` | Blue/green traffic colour to bake into generated manifests (default: blue). `stop` accepts a comma list, e.g. blue,green. |
 | `--git-clean` | Runs git clean on volume mount paths before copying. |
 | `--deploy-id <deploy-id>` | Sets deploy id context for the runner execution. |
 | `--user <user>` | Sets user context for the runner execution. |
@@ -886,6 +903,11 @@ Runs specified scripts using various runners.
 | `--timeout-idle <duration>` | Sets HTTPProxy per-route idle timeout (e.g., "10s", "infinity"). |
 | `--retry-count <count>` | Sets HTTPProxy per-route retry count (e.g., 3). |
 | `--retry-per-try-timeout <duration>` | Sets HTTPProxy retry per-try timeout (e.g., "150ms"). |
+| `--gateway-api` | Routes through the Gateway API stack (Gateway + HTTPRoute) instead of the Contour HTTPProxy. Both manifest sets are always generated; this selects which one is applied. |
+| `--disable-gateway-api` | Falls back to the Contour HTTPProxy stack in runners where the Gateway API is the default (cluster). |
+| `--gateway-class <name>` | GatewayClass name for generated Gateway manifests (default "eg"). |
+| `--disable-http3` | Omits the QUIC/HTTP3 listener config and the Alt-Svc advertisement from Gateway API manifests. |
+| `--quic-port <port>` | UDP port advertised for QUIC/HTTP3 in generated Gateway API manifests (default 443). |
 | `--disable-private-conf-update` | Disables updates to private configuration during execution. |
 | `--logs` | Streams logs during the runner execution. |
 | `--monitor-status <status>` | Sets the status to monitor for pod/resource (default: "Running"). |
@@ -901,6 +923,7 @@ Runs specified scripts using various runners.
 | `--pull-bundle` | Explicitly download the pre-built client bundle from Cloudinary inside the container (supported by: sync, template-deploy). Use together with --skip-full-build. |
 | `--remove` | Remove/teardown resources |
 | `--test` | Enables test/generic-purpose mode for the runner (e.g. use self-signed TLS instead of cert-manager). |
+| `--branch <branch>` | Sets the branch for git operations (default: current branch). |
 | `-h, --help` | display help for command |
 
 ---

package/README.md

@@ -10,13 +10,13 @@
 
 <div align="center">
 
-<a target="_top" href='https://download.rockylinux.org/pub/rocky/9/'><img alt='rockylinux' src='https://img.shields.io/badge/Rocky Linux v9.6-100000?style=flat&logo=rockylinux&logoColor=white&labelColor=10b981&color=727273'/></a> <a target="_top" href='https://www.npmjs.com/package/npm?activeTab=versions'><img alt='npm' src='https://img.shields.io/badge/npm v11.6.2-100000?style=flat&logo=npm&logoColor=white&labelColor=CB3837&color=727273'/></a> <a target="_top" href='https://nodejs.org/download/release'><img alt='nodedotjs' src='https://img.shields.io/badge/node v24.15.0-100000?style=flat&logo=nodedotjs&logoColor=white&labelColor=5FA04E&color=727273'/></a> <a target="_top" href='https://pgp.mongodb.com/'><img alt='mongodb' src='https://img.shields.io/badge/mongodb_server v7.0-100000?style=flat&logo=mongodb&logoColor=white&labelColor=47A248&color=727273'/></a>
+<a target="_top" href='https://download.rockylinux.org/pub/rocky/9/'><img alt='rockylinux' src='https://img.shields.io/badge/Rocky Linux v9.8-100000?style=flat&logo=rockylinux&logoColor=white&labelColor=10b981&color=727273'/></a> <a target="_top" href='https://www.npmjs.com/package/npm?activeTab=versions'><img alt='npm' src='https://img.shields.io/badge/npm v11.6.2-100000?style=flat&logo=npm&logoColor=white&labelColor=CB3837&color=727273'/></a> <a target="_top" href='https://nodejs.org/download/release'><img alt='nodedotjs' src='https://img.shields.io/badge/node v24.15.0-100000?style=flat&logo=nodedotjs&logoColor=white&labelColor=5FA04E&color=727273'/></a> <a target="_top" href='https://pgp.mongodb.com/'><img alt='mongodb' src='https://img.shields.io/badge/mongodb_server v7.0-100000?style=flat&logo=mongodb&logoColor=white&labelColor=47A248&color=727273'/></a>
 
 </div>
 
 <div align="center">
 
-[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![](https://data.jsdelivr.com/v1/package/npm/underpost/badge)](https://www.jsdelivr.com/package/npm/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.70)](https://socket.dev/npm/package/underpost/overview/3.2.70) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
+[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![](https://data.jsdelivr.com/v1/package/npm/underpost/badge)](https://www.jsdelivr.com/package/npm/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.90)](https://socket.dev/npm/package/underpost/overview/3.2.90) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
 
 </div>
 
@@ -88,7 +88,7 @@ npm run dev
 <!-- cli-index-start -->
 ## Underpost CLI
 
-> underpost ci/cd cli v3.2.70
+> underpost ci/cd cli v3.2.90
 
 **Usage:** `underpost [options] [command]`
 

package/bin/build.js

@@ -14,7 +14,8 @@ import {
   updatePrivateEngineTestRepo,
 } from '../src/server/conf.js';
 import { loadDeployCatalog } from '../src/server/catalog.js';
-import UnderpostRepository from '../src/cli/repository.js';
+import Underpost from '../src/index.js';
+import { DOCKER_SCRIPTS } from '../src/api/cyberia-server-defaults/cyberia-server-defaults.js';
 
 const baseConfPath = './engine-private/conf/dd-cron/.env.production';
 if (fs.existsSync(baseConfPath)) dotenv.config({ path: baseConfPath, override: true });
@@ -34,8 +35,8 @@ const buildDeployTemplate = async (confName) => {
   const catalog = await loadDeployCatalog(confName);
 
   if (catalog.sourceMoves.length) {
-    UnderpostRepository.API.sparseCheckoutDirectory(`conf/${confName}`);
-    if (catalog.sourceMoves.some(([src]) => !fs.existsSync(src))) UnderpostRepository.API.pullSourceRepo(repoName);
+    Underpost.repo.sparseCheckoutDirectory(`conf/${confName}`);
+    if (catalog.sourceMoves.some(([src]) => !fs.existsSync(src))) Underpost.repo.pullSourceRepo(repoName);
   }
   syncDeployIdSources(catalog.sourceMoves);
 
@@ -125,9 +126,14 @@ const buildDeployTemplate = async (confName) => {
       packageJson.description = catalog.description;
       const { CyberiaDependencies } = await import(`../src/api/cyberia-server-defaults/cyberia-server-defaults.js`);
       packageJson.dependencies = {
-        ...originPackageJson.dependencies,
+        underpost: '^' + Underpost.version.replace('v', ''),
+        'adm-zip': '^0.6.0',
         ...CyberiaDependencies,
       };
+      packageJson.scripts = {
+        ...packageJson.scripts,
+        ...DOCKER_SCRIPTS,
+      };
       fs.writeFileSync(`${basePath}/bin/index.js`, fs.readFileSync(`./bin/cyberia.js`, 'utf8'), 'utf8');
       // Canonical Cyberia doc; engine-cyberia/README.md is a generated copy — never hand-edited.
       fs.writeFileSync(

package/bin/deploy.js

@@ -223,21 +223,23 @@ try {
         .readFileSync(`./engine-private/deploy/dd.router`, 'utf8')
         .split(`,`)
         .concat(['dd-cron'])) {
-        if (fs.existsSync(`./engine-private/conf/${deployId}/build/development/deployment.yaml`))
-          fs.copySync(
-            `./engine-private/conf/${deployId}/build/development/deployment.yaml`,
-            `./manifests/deployment/${deployId}-development/deployment.yaml`,
-          );
-        if (fs.existsSync(`./engine-private/conf/${deployId}/build/development/proxy.yaml`))
-          fs.copySync(
-            `./engine-private/conf/${deployId}/build/development/proxy.yaml`,
-            `./manifests/deployment/${deployId}-development/proxy.yaml`,
-          );
-        if (fs.existsSync(`./engine-private/conf/${deployId}/build/development/pv-pvc.yaml`))
-          fs.copySync(
-            `./engine-private/conf/${deployId}/build/development/pv-pvc.yaml`,
-            `./manifests/deployment/${deployId}-development/pv-pvc.yaml`,
-          );
+        // The same set `deploy --build-manifest` mirrors. Anything missing here
+        // is a manifest the project repo silently stops carrying while the
+        // private build dir still has it.
+        for (const file of [
+          'deployment.yaml',
+          'proxy.yaml',
+          'gateway.yaml',
+          'httproute.yaml',
+          'pv-pvc.yaml',
+          'traffic-service.yaml',
+          'grpc-service.yaml',
+        ]) {
+          const source = `./engine-private/conf/${deployId}/build/development/${file}`;
+          const target = `./manifests/deployment/${deployId}-development/${file}`;
+          if (fs.existsSync(source)) fs.copySync(source, target);
+          else fs.removeSync(target);
+        }
         shellExec(`node bin new --dev --default-conf --deploy-id ${deployId}`);
       }
       break;
@@ -763,7 +765,7 @@ nvidia/gpu-operator \
 
     case 'pw-conf': {
       const scriptPath = process.argv[3];
-      shellExec(`kubectl delete configmap playwright-script`);
+      shellExec(`kubectl delete configmap playwright-script --ignore-not-found`);
       shellExec(`kubectl create configmap playwright-script \
   --from-file=script.js=${scriptPath} \
   --dry-run=client -o yaml | kubectl apply -f -

package/docker-compose.yml

@@ -81,7 +81,7 @@ services:
   # (dd-default-development-blue). Connection targets use Docker service
   # discovery instead of hardcoded localhost.
   app:
-    image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.2.70}
+    image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.2.90}
     container_name: dd-app
     # The start command is supplied by the generated override docker/compose.app.yml
     # (see `underpost docker-compose --generate --deploy-id <id>`), keeping this

package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-backup
-              image: underpost/underpost-engine:v3.2.70
+              image: underpost/underpost-engine:v3.2.90
               command:
                 - /bin/sh
                 - -c

package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-dns
-              image: underpost/underpost-engine:v3.2.70
+              image: underpost/underpost-engine:v3.2.90
               command:
                 - /bin/sh
                 - -c

package/manifests/deployment/dd-default-development/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-blue
-          image: underpost/underpost-engine:v3.2.70
+          image: underpost/underpost-engine:v3.2.90
           #          resources:
           #            requests:
           #              memory: "124Ki"
@@ -98,7 +98,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-green
-          image: underpost/underpost-engine:v3.2.70
+          image: underpost/underpost-engine:v3.2.90
           #          resources:
           #            requests:
           #              memory: "124Ki"

package/manifests/deployment/playwright/deployment.yaml

@@ -14,7 +14,7 @@ spec:
     spec:
       containers:
         - name: playwright
-          image: mcr.microsoft.com/playwright:v1.59.0-jammy
+          image: mcr.microsoft.com/playwright:v1.62.1-jammy
           command:
             - /bin/bash
             - -c

package/manifests/mongodb/kustomization.yaml

@@ -3,7 +3,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - pv-pvc.yaml
+  # pv-pvc.yaml is intentionally absent: the PersistentVolume set is one-per-replica, so it is
+  # generated from the effective replica count by MongoBootstrap.applyReplicaVolumes() and applied
+  # just before this kustomization. A static file can only describe a fixed number of members, and
+  # any --replicas above it leaves the surplus claims unbindable.
   - headless-service.yaml
   - statefulset.yaml
   # - backup-pv-pvc.yaml

package/manifests/mongodb/statefulset.yaml

@@ -105,6 +105,10 @@ spec:
   volumeClaimTemplates:
     - metadata:
         name: mongodb-storage
+        # Without this label `kubectl delete pvc -l app=mongodb` matches nothing, leaving stale
+        # claims bound to retained PVs across redeploys.
+        labels:
+          app: mongodb
       spec:
         accessModes: ['ReadWriteOnce']
         storageClassName: mongodb-storage-class

package/manifests/mongodb/storage-class.yaml

@@ -3,7 +3,14 @@ kind: StorageClass
 metadata:
   name: mongodb-storage-class
   annotations:
-    storageclass.kubernetes.io/is-default-class: "false"
-provisioner: rancher.io/local-path
+    storageclass.kubernetes.io/is-default-class: 'false'
+# Static class: the replica volumes are hostPath PVs generated one per member by
+# MongoBootstrap.applyReplicaVolumes(), each pinned to one member via `claimRef`. It must NOT name a dynamic provisioner — with
+# `rancher.io/local-path` the local-path controller also provisions for these PVCs, racing the
+# static binder, so which volume a member ends up on is not deterministic. Two members landing
+# on one directory is fatal: mongod dies on `WiredTiger.lock: fcntl: Resource temporarily
+# unavailable`, since kind bind-mounts /data/mongodb from the host into every node.
+provisioner: kubernetes.io/no-provisioner
 reclaimPolicy: Retain
+# Static hostPath PVs carry no nodeAffinity, so binding can safely wait for the scheduler.
 volumeBindingMode: WaitForFirstConsumer

package/package.json

@@ -2,7 +2,7 @@
     "type": "module",
     "main": "src/index.js",
     "name": "underpost",
-    "version": "3.2.70",
+    "version": "3.2.90",
     "description": "Underpost Platform — end-to-end CI/CD and application-delivery toolchain CLI. Covers bare metal, Kubernetes, K3s, kubeadm, LXD, container/image orchestration, secrets, databases, cron jobs, monitoring, SSH, runners, PWA + Workbox delivery, and release orchestration. Extensible via downstream CLIs.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
@@ -71,17 +71,17 @@
     },
     "homepage": "https://github.com/underpostnet/pwa-microservices-template#readme",
     "dependencies": {
-        "@fortawesome/fontawesome-free": "^7.3.0",
-        "@fullcalendar/rrule": "^6.1.21",
+        "@fortawesome/fontawesome-free": "^7.3.1",
+        "@fullcalendar/rrule": "^7.0.2",
         "@grpc/grpc-js": "^1.14.4",
         "@grpc/proto-loader": "^0.8.1",
         "@neodrag/vanilla": "^2.3.1",
-        "adm-zip": "^0.5.18",
-        "ag-grid-community": "^36.0.0",
-        "axios": "^1.18.1",
-        "bumpp": "^11.1.0",
+        "adm-zip": "^0.6.0",
+        "ag-grid-community": "^36.1.0",
+        "bumpp": "^12.2.0",
+        "axios": "^1.19.0",
         "chai": "^6.2.2",
-        "clipboardy": "^5.3.1",
+        "clipboardy": "^5.3.2",
         "cloudinary": "^2.10.0",
         "colors": "^1.4.0",
         "commander": "^15.0.0",
@@ -96,25 +96,25 @@
         "escape-string-regexp": "^5.0.0",
         "express": "^5.2.1",
         "express-fileupload": "^1.4.3",
-        "express-rate-limit": "^8.5.2",
+        "express-rate-limit": "^8.6.2",
         "express-slow-down": "^3.1.0",
         "fast-json-stable-stringify": "^2.1.0",
-        "favicons": "^7.3.0",
-        "fs-extra": "^11.3.6",
-        "fullcalendar": "^6.1.21",
-        "helmet": "^8.2.0",
+        "favicons": "^7.3.1",
+        "fs-extra": "^11.4.0",
+        "fullcalendar": "^7.0.2",
+        "helmet": "^8.3.0",
         "html-minifier-terser": "^7.2.0",
         "http-proxy-middleware": "^4.2.0",
         "ignore-walk": "^9.0.0",
-        "iovalkey": "^0.3.3",
+        "iovalkey": "^0.4.0",
         "json-colorizer": "^3.0.1",
         "jsonwebtoken": "^9.0.3",
         "mariadb": "^3.5.3",
-        "marked": "^18.0.5",
-        "mocha": "^11.7.6",
-        "mongoose": "^9.7.3",
+        "marked": "^18.0.9",
+        "mongoose": "^9.9.1",
+        "mocha": "^11.8.0",
         "morgan": "^1.11.0",
-        "nodemailer": "^9.0.3",
+        "nodemailer": "^9.0.5",
         "nodemon": "^3.0.1",
         "peer": "^1.0.2",
         "peerjs": "^1.5.5",
@@ -129,9 +129,9 @@
         "swagger-autogen": "^2.23.7",
         "swagger-ui-express": "^5.0.0",
         "typedoc": "^0.28.20",
-        "typescript": "^6.0.3",
+        "typescript": "6.0.3",
         "validator": "^13.15.35",
-        "vanilla-jsoneditor": "^3.12.0",
+        "vanilla-jsoneditor": "^3.13.0",
         "winston": "^3.19.0",
         "workbox-background-sync": "^7.4.1",
         "workbox-cacheable-response": "^7.4.1",

package/scripts/nat-iptables.sh

@@ -32,6 +32,12 @@ sudo firewall-cmd --permanent --zone=public --add-service=ssh
 sudo firewall-cmd --permanent --zone=public --add-service=http
 sudo firewall-cmd --permanent --zone=public --add-service=https
 
+# QUIC / HTTP3. The `https` service above covers TCP 443 only, so without this
+# an HTTP/3 gateway advertises `Alt-Svc: h3=":443"` and every client that acts
+# on it silently fails over UDP while HTTP/2 keeps working.
+sudo firewall-cmd --permanent --zone=public --add-port=443/udp
+sudo firewall-cmd --permanent --zone=public --add-port=80/udp
+
 echo "[INFO] Opening Kubernetes control plane ports..."
 
 # Kubernetes API Server
@@ -98,10 +104,10 @@ sudo firewall-cmd --reload
 echo
 echo "[INFO] Sysctl status:"
 sudo sysctl \
-  net.ipv4.ip_forward \
-  net.ipv6.conf.all.forwarding \
-  net.bridge.bridge-nf-call-iptables \
-  net.bridge.bridge-nf-call-ip6tables
+net.ipv4.ip_forward \
+net.ipv6.conf.all.forwarding \
+net.bridge.bridge-nf-call-iptables \
+net.bridge.bridge-nf-call-ip6tables
 
 echo
 echo "[INFO] Firewall status:"

package/scripts/test-monitor.sh

@@ -24,7 +24,7 @@ MODE=runtime                                  # runtime | instance
 ENV=development                               # development | production
 DEPLOY_ID=dd-test                             # deploy id (instance mode: parent of conf.instances.json)
 INSTANCE_IDS=                                 # instance mode: csv of ids (default: all in conf.instances.json)
-IMAGE=underpost/wp:v3.2.70                    # runtime mode image (instance mode reads image from conf)
+IMAGE=underpost/wp:v3.2.90                    # runtime mode image (instance mode reads image from conf)
 VERSIONS=green                                # csv of blue/green versions
 REPLICAS=1                                    # replicas per deployment
 NAMESPACE=default                             # k8s namespace
@@ -202,7 +202,8 @@ run_runtime_mode() {
     setup_tls_secrets $(hosts_from "$SERVER_CONF")
     expose_flags="--tls"
   fi
-  [ "$DO_EXPOSE" = true ] && node bin deploy --expose --local-proxy "$DEPLOY_ID" "$ENV" $expose_flags
+  [ "$DO_EXPOSE" = true ] && node bin run expose "${DEPLOY_ID}-${ENV}-traffic-service" --namespace "$NAMESPACE" \
+    --local-proxy $DEV_FLAG $CLUSTER_FLAG $expose_flags
 }
 
 # ─────────────────────────── instance mode ───────────────────────────
@@ -234,7 +235,7 @@ run_instance_mode() {
     # Plain HTTP: port-forward each instance service port directly.
     for id in "${ids[@]}"; do
       [ -n "$id" ] || continue
-      node bin deploy --expose "${DEPLOY_ID}-${id}" "$ENV" --namespace "$NAMESPACE" || true
+      node bin run expose "${DEPLOY_ID}-${id}-${ENV}-traffic-service" --namespace "$NAMESPACE" $CLUSTER_FLAG || true
     done
   fi
 }

package/src/api/core/core.controller.js

@@ -1,69 +1,8 @@
-import { loggerFactory } from '../../server/logger.js';
+import { buildCrudController, serviceHandler } from '../../server/middlewares.js';
 import { CoreService } from './core.service.js';
 
-const logger = loggerFactory(import.meta);
-
-class CoreController {
-  static post = async (req, res, options) => {
-    try {
-      const result = await CoreService.post(req, res, options);
-      return res.status(200).json({
-        status: 'success',
-        data: result,
-      });
-    } catch (error) {
-      logger.error(error, error.stack);
-      return res.status(400).json({
-        status: 'error',
-        message: error.message,
-      });
-    }
-  };
-  static get = async (req, res, options) => {
-    try {
-      const result = await CoreService.put(req, res, options);
-      return res.status(200).json({
-        status: 'success',
-        data: result,
-      });
-    } catch (error) {
-      logger.error(error, error.stack);
-      return res.status(400).json({
-        status: 'error',
-        message: error.message,
-      });
-    }
-  };
-  static put = async (req, res, options) => {
-    try {
-      const result = await CoreService.get(req, res, options);
-      return res.status(200).json({
-        status: 'success',
-        data: result,
-      });
-    } catch (error) {
-      logger.error(error, error.stack);
-      return res.status(400).json({
-        status: 'error',
-        message: error.message,
-      });
-    }
-  };
-  static delete = async (req, res, options) => {
-    try {
-      const result = await CoreService.delete(req, res, options);
-      return res.status(200).json({
-        status: 'success',
-        data: result,
-      });
-    } catch (error) {
-      logger.error(error, error.stack);
-      return res.status(400).json({
-        status: 'error',
-        message: error.message,
-      });
-    }
-  };
-}
+const CoreController = buildCrudController(CoreService, {
+  get: serviceHandler(CoreService.get),
+});
 
 export { CoreController };