underpost 3.2.8 → 3.2.10

package/package.json

@@ -2,8 +2,8 @@
     "type": "module",
     "main": "src/index.js",
     "name": "underpost",
-    "version": "3.2.8",
-    "description": "pwa api rest template",
+    "version": "3.2.10",
+    "description": "Underpost Platform — end-to-end CI/CD and application-delivery toolchain CLI. Covers bare metal, Kubernetes, K3s, kubeadm, LXD, container/image orchestration, secrets, databases, cron jobs, monitoring, SSH, runners, PWA + Workbox delivery, and release orchestration. Extensible via downstream CLIs.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
         "build": "node bin client",
@@ -35,7 +35,21 @@
         "url": "git+https://github.com/underpostnet/pwa-microservices-template.git"
     },
     "keywords": [
+        "underpost",
+        "underpost-platform",
+        "cli",
+        "toolchain",
+        "ci-cd",
+        "devops",
+        "kubernetes",
+        "k3s",
+        "kubeadm",
+        "lxd",
+        "bare-metal",
+        "container-orchestration",
+        "image-management",
         "pwa",
+        "workbox",
         "microservices",
         "template",
         "builder",
@@ -53,12 +67,13 @@
     "dependencies": {
         "@fortawesome/fontawesome-free": "^7.2.0",
         "@fullcalendar/rrule": "^6.1.20",
-        "@grpc/grpc-js": "^1.12.5",
-        "@grpc/proto-loader": "^0.8.0",
+        "@grpc/grpc-js": "^1.14.4",
+        "@grpc/proto-loader": "^0.8.1",
         "@neodrag/vanilla": "^2.3.1",
         "adm-zip": "^0.5.17",
-        "ag-grid-community": "^35.2.1",
-        "axios": "^1.15.2",
+        "ag-grid-community": "^35.3.0",
+        "axios": "^1.16.1",
+        "bumpp": "^10.1.0",
         "chai": "^6.2.2",
         "clipboardy": "^5.3.1",
         "cloudinary": "^2.10.0",
@@ -70,35 +85,35 @@
         "d3": "^7.9.0",
         "dexie": "^4.2.1",
         "dotenv": "^17.4.2",
-        "easymde": "^2.18.0",
+        "easymde": "^2.21.0",
         "esbuild": "^0.28.0",
         "escape-string-regexp": "^5.0.0",
         "express": "^5.2.1",
         "express-fileupload": "^1.4.3",
-        "express-rate-limit": "^8.4.1",
+        "express-rate-limit": "^8.5.2",
         "express-slow-down": "^3.1.0",
         "fast-json-stable-stringify": "^2.1.0",
         "favicons": "^7.2.0",
-        "fs-extra": "^11.3.4",
+        "fs-extra": "^11.3.5",
         "fullcalendar": "^6.1.15",
-        "helmet": "^8.1.0",
+        "helmet": "^8.2.0",
         "html-minifier-terser": "^7.2.0",
-        "http-proxy-middleware": "^3.0.5",
-        "ignore-walk": "^8.0.0",
+        "http-proxy-middleware": "^4.0.0",
+        "ignore-walk": "^9.0.0",
         "iovalkey": "^0.3.3",
         "json-colorizer": "^3.0.1",
         "jsonwebtoken": "^9.0.3",
         "mariadb": "^3.2.2",
-        "marked": "^18.0.2",
-        "mocha": "^11.3.0",
-        "mongoose": "^9.5.0",
+        "mocha": "^11.7.6",
+        "marked": "^18.0.4",
+        "mongoose": "^9.6.2",
         "morgan": "^1.10.0",
-        "nodemailer": "^8.0.6",
+        "nodemailer": "^8.0.8",
         "nodemon": "^3.0.1",
         "peer": "^1.0.2",
         "peerjs": "^1.5.5",
         "prom-client": "^15.1.2",
-        "read": "^5.0.1",
+        "read": "^6.0.0",
         "rrule": "^2.8.1",
         "shelljs": "^0.10.0",
         "sitemap": "^9.0.1",
@@ -108,17 +123,17 @@
         "swagger-autogen": "^2.23.7",
         "swagger-ui-express": "^5.0.0",
         "typedoc": "^0.28.19",
-        "typescript": "^5.8.0",
+        "typescript": "^6.0.3",
         "validator": "^13.15.35",
         "vanilla-jsoneditor": "^3.12.0",
         "winston": "^3.19.0",
-        "workbox-background-sync": "^7.4.0",
-        "workbox-cacheable-response": "^7.4.0",
-        "workbox-core": "^7.4.0",
-        "workbox-expiration": "^7.4.0",
-        "workbox-precaching": "^7.4.0",
-        "workbox-routing": "^7.4.0",
-        "workbox-strategies": "^7.4.0"
+        "workbox-background-sync": "^7.4.1",
+        "workbox-cacheable-response": "^7.4.1",
+        "workbox-core": "^7.4.1",
+        "workbox-expiration": "^7.4.1",
+        "workbox-precaching": "^7.4.1",
+        "workbox-routing": "^7.4.1",
+        "workbox-strategies": "^7.4.1"
     },
     "publishConfig": {
         "provenance": true,

package/scripts/k3s-node-setup.sh

@@ -8,6 +8,13 @@ set -e
 #   --worker                    Initialize as K3s worker node
 #   --control-ip=<ip>           Control plane IP (required for --worker)
 #   --token=<token>             K3s node token (required for --worker)
+#
+# DESIGN NOTES:
+# - This script installs the underpost CLI globally via npm.
+# - It then uses the global CLI binary for configuration and K3s setup.
+# - Engine source replication (e.g. via --bootstrap-engine from the host)
+#   is a SEPARATE step. This script does NOT depend on /home/dd/engine
+#   being pre-pushed. Use --bootstrap-engine after --init-vm completes.
 # ---------------------------------------------------------------------------
 
 ROLE="control"
@@ -32,8 +39,8 @@ curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
 export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
 [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
 
-nvm install 24.10.0
-nvm use 24.10.0
+nvm install 24.15.0
+nvm use 24.15.0
 
 echo "
 ██╗░░░██╗███╗░░██╗██████╗░███████╗██████╗░██████╗░░█████╗░░██████╗████████╗
@@ -48,19 +55,31 @@ Installing underpost VM node...
 
 npm install -g underpost
 
-cd /home/dd/engine
-
 echo "Applying host configuration..."
 
-npm install
-
-node bin run secret
-
-node bin cluster --dev --config
+# Use the globally installed underpost CLI
+# NOTE: --dev is used to match the host dev context
+underpost cluster --dev --config
+
+# Check if /home/dd/engine exists locally for engine-specific operations.
+# This directory is populated by the host running --bootstrap-engine.
+# If absent, the global underpost CLI handles all operations.
+if [ -d /home/dd/engine ]; then
+  echo "Local engine source found at /home/dd/engine. Using local underpost."
+  cd /home/dd/engine
+  npm install
+  node bin run secret
+else
+  echo "No local engine source at /home/dd/engine. Using global underpost CLI."
+  echo "Engine source can be replicated later with --bootstrap-engine from the host."
+  # The globally installed underpost handles secret generation via its own config
+  underpost secret underpost --init
+fi
 
 if [ "$ROLE" = "control" ]; then
   echo "Initializing K3s control plane..."
-  node bin cluster --dev --k3s
+  # Use global underpost CLI for K3s setup
+  underpost cluster --dev --k3s
 
   echo ""
   echo "K3s control plane is ready."
@@ -86,4 +105,4 @@ elif [ "$ROLE" = "worker" ]; then
   echo ""
   echo "K3s worker node joined the cluster at https://${CONTROL_IP}:6443 successfully."
   sudo systemctl status k3s-agent --no-pager
-fi
+fi

package/scripts/nat-iptables.sh

@@ -1,26 +1,111 @@
 #!/bin/bash
 set -euo pipefail
 
-# Disable firewalld
-sudo systemctl disable --now iptables
-sudo systemctl disable --now ufw
-sudo systemctl disable --now firewalld
+echo "[INFO] Enabling firewalld..."
+sudo systemctl enable --now firewalld
 
+echo "[INFO] Configuring kernel networking..."
 
-# Remove any existing entries, then append exactly one
-sudo sed -i '/^net.ipv4.ip_forward/d' /etc/sysctl.conf
-sudo sed -i '/^net.ipv6.conf.all.forwarding/d' /etc/sysctl.conf
-echo "net.ipv4.ip_forward = 1"               | sudo tee -a /etc/sysctl.conf
-echo "net.ipv6.conf.all.forwarding = 1"       | sudo tee -a /etc/sysctl.conf
-# ---
+sudo tee /etc/sysctl.d/99-kubernetes.conf >/dev/null <<'EOF'
+# Kubernetes networking
+net.ipv4.ip_forward = 1
+net.ipv6.conf.all.forwarding = 1
 
-sudo sysctl -p
+# Required for Kubernetes iptables
+net.bridge.bridge-nf-call-iptables = 1
+net.bridge.bridge-nf-call-ip6tables = 1
 
-# Accept all traffic
-sudo iptables -P INPUT ACCEPT
-sudo iptables -P FORWARD ACCEPT
-sudo iptables -P OUTPUT ACCEPT
+# Better conntrack handling
+net.netfilter.nf_conntrack_max = 131072
+EOF
 
-# List iptables rules and forwarding flag
-sudo iptables -L -n
-sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding
+# Load br_netfilter immediately
+sudo modprobe br_netfilter
+
+# Apply sysctl
+sudo sysctl --system
+
+echo "[INFO] Opening common WAN/public services..."
+
+# Public services
+sudo firewall-cmd --permanent --zone=public --add-service=ssh
+sudo firewall-cmd --permanent --zone=public --add-service=http
+sudo firewall-cmd --permanent --zone=public --add-service=https
+
+echo "[INFO] Opening Kubernetes control plane ports..."
+
+# Kubernetes API Server
+sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp
+
+# etcd
+sudo firewall-cmd --permanent --zone=public --add-port=2379-2380/tcp
+
+# kubelet API
+sudo firewall-cmd --permanent --zone=public --add-port=10250/tcp
+
+# kube-scheduler
+sudo firewall-cmd --permanent --zone=public --add-port=10259/tcp
+
+# kube-controller-manager
+sudo firewall-cmd --permanent --zone=public --add-port=10257/tcp
+
+echo "[INFO] Opening Kubernetes networking ports..."
+
+# CoreDNS
+sudo firewall-cmd --permanent --zone=public --add-port=53/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=53/udp
+
+# NodePort Services
+sudo firewall-cmd --permanent --zone=public --add-port=30000-32767/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=30000-32767/udp
+
+# Calico VXLAN
+sudo firewall-cmd --permanent --zone=public --add-port=4789/udp
+
+# Calico BGP
+sudo firewall-cmd --permanent --zone=public --add-port=179/tcp
+
+# Calico Typha (required for multi-node Calico deployments)
+sudo firewall-cmd --permanent --zone=public --add-port=5473/tcp
+
+# Calico WireGuard (optional encrypted overlay)
+sudo firewall-cmd --permanent --zone=public --add-port=51820/udp
+sudo firewall-cmd --permanent --zone=public --add-port=51821/udp
+
+# Flannel VXLAN (UDP, required if using Flannel CNI)
+sudo firewall-cmd --permanent --zone=public --add-port=8472/udp
+
+# kube-proxy healthz
+sudo firewall-cmd --permanent --zone=public --add-port=10256/tcp
+
+# metrics-server
+sudo firewall-cmd --permanent --zone=public --add-port=4443/tcp
+
+echo "[INFO] Configuring trusted zone for inter-node pod/service CIDRs..."
+# Allow all traffic from the default pod CIDR and service CIDR so that
+# cross-node pod-to-pod and service routing works without explicit per-port rules.
+sudo firewall-cmd --permanent --zone=trusted --add-source=192.168.0.0/16
+sudo firewall-cmd --permanent --zone=trusted --add-source=10.96.0.0/12
+
+echo "[INFO] Enabling masquerade and forwarding..."
+
+sudo firewall-cmd --permanent --zone=public --add-masquerade
+
+echo "[INFO] Reloading firewall..."
+
+sudo firewall-cmd --reload
+
+echo
+echo "[INFO] Sysctl status:"
+sudo sysctl \
+  net.ipv4.ip_forward \
+  net.ipv6.conf.all.forwarding \
+  net.bridge.bridge-nf-call-iptables \
+  net.bridge.bridge-nf-call-ip6tables
+
+echo
+echo "[INFO] Firewall status:"
+sudo firewall-cmd --zone=public --list-all
+
+echo
+echo "[INFO] Kubernetes firewall configuration completed."

package/src/api/core/core.router.js

@@ -5,20 +5,25 @@ import express from 'express';
 
 const logger = loggerFactory(import.meta);
 
-const CoreRouter = (options) => {
-  const router = express.Router();
-  const authMiddleware = options.authMiddleware;
-  router.post(`/:id`, authMiddleware, adminGuard, async (req, res) => await CoreController.post(req, res, options));
-  router.post(`/`, authMiddleware, adminGuard, async (req, res) => await CoreController.post(req, res, options));
-  router.get(`/:id`, authMiddleware, adminGuard, async (req, res) => await CoreController.get(req, res, options));
-  router.get(`/`, authMiddleware, adminGuard, async (req, res) => await CoreController.get(req, res, options));
-  router.put(`/:id`, authMiddleware, adminGuard, async (req, res) => await CoreController.put(req, res, options));
-  router.put(`/`, authMiddleware, adminGuard, async (req, res) => await CoreController.put(req, res, options));
-  router.delete(`/:id`, authMiddleware, adminGuard, async (req, res) => await CoreController.delete(req, res, options));
-  router.delete(`/`, authMiddleware, adminGuard, async (req, res) => await CoreController.delete(req, res, options));
-  return router;
-};
+class CoreRouter {
+  /**
+   * @param {import('../types.js').RouterOptions} options
+   * @returns {import('express').Router}
+   */
+  static router(options) {
+    const router = express.Router();
+    router.post(`/:id`, options.authMiddleware, adminGuard, async (req, res) => await CoreController.post(req, res, options));
+    router.post(`/`, options.authMiddleware, adminGuard, async (req, res) => await CoreController.post(req, res, options));
+    router.get(`/:id`, options.authMiddleware, adminGuard, async (req, res) => await CoreController.get(req, res, options));
+    router.get(`/`, options.authMiddleware, adminGuard, async (req, res) => await CoreController.get(req, res, options));
+    router.put(`/:id`, options.authMiddleware, adminGuard, async (req, res) => await CoreController.put(req, res, options));
+    router.put(`/`, options.authMiddleware, adminGuard, async (req, res) => await CoreController.put(req, res, options));
+    router.delete(`/:id`, options.authMiddleware, adminGuard, async (req, res) => await CoreController.delete(req, res, options));
+    router.delete(`/`, options.authMiddleware, adminGuard, async (req, res) => await CoreController.delete(req, res, options));
+    return router;
+  }
+}
 
-const ApiRouter = CoreRouter;
+const ApiRouter = (options) => CoreRouter.router(options);
 
 export { ApiRouter, CoreRouter };

package/src/api/core/core.service.js

@@ -1,4 +1,4 @@
-import { DataBaseProvider } from '../../db/DataBaseProvider.js';
+import { DataBaseProviderService } from '../../db/DataBaseProvider.js';
 import { loggerFactory } from '../../server/logger.js';
 import { shellExec } from '../../server/process.js';
 
@@ -7,22 +7,22 @@ const logger = loggerFactory(import.meta);
 class CoreService {
   static post = async (req, res, options) => {
     /** @type {import('./core.model.js').CoreModel} */
-    const Core = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.Core;
+    const Core = DataBaseProviderService.getModel("Core", options);
     return await new Core(req.body).save();
   };
   static get = async (req, res, options) => {
     /** @type {import('./core.model.js').CoreModel} */
-    const Core = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.Core;
+    const Core = DataBaseProviderService.getModel("Core", options);
     return await Core.findById(req.params.id);
   };
   static put = async (req, res, options) => {
     /** @type {import('./core.model.js').CoreModel} */
-    const Core = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.Core;
+    const Core = DataBaseProviderService.getModel("Core", options);
     return await Core.findByIdAndUpdate(req.params.id, req.body);
   };
   static delete = async (req, res, options) => {
     /** @type {import('./core.model.js').CoreModel} */
-    const Core = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.Core;
+    const Core = DataBaseProviderService.getModel("Core", options);
     return await Core.findByIdAndDelete(req.params.id);
   };
 }

package/src/api/default/default.router.js

@@ -4,24 +4,28 @@ import express from 'express';
 
 const logger = loggerFactory(import.meta);
 
-const DefaultRouter = (options) => {
-  const router = express.Router();
-  const authMiddleware = options.authMiddleware;
-  router.post(`/:id`, async (req, res) => await DefaultController.post(req, res, options));
-  router.post(`/`, async (req, res) => await DefaultController.post(req, res, options));
-  router.get(
-    `/:id`,
-    // authMiddleware,
-    async (req, res) => await DefaultController.get(req, res, options),
-  );
-  router.get(`/`, async (req, res) => await DefaultController.get(req, res, options));
-  router.put(`/:id`, async (req, res) => await DefaultController.put(req, res, options));
-  router.put(`/`, async (req, res) => await DefaultController.put(req, res, options));
-  router.delete(`/:id`, async (req, res) => await DefaultController.delete(req, res, options));
-  router.delete(`/`, async (req, res) => await DefaultController.delete(req, res, options));
-  return router;
-};
+class DefaultRouter {
+  /**
+   * @param {import('../types.js').RouterOptions} options
+   * @returns {import('express').Router}
+   */
+  static router(options) {
+    const router = express.Router();
+    router.post(`/:id`, async (req, res) => await DefaultController.post(req, res, options));
+    router.post(`/`, async (req, res) => await DefaultController.post(req, res, options));
+    router.get(`/:id`,
+      // options.authMiddleware,
+      async (req, res) => await DefaultController.get(req, res, options),
+    );
+    router.get(`/`, async (req, res) => await DefaultController.get(req, res, options));
+    router.put(`/:id`, async (req, res) => await DefaultController.put(req, res, options));
+    router.put(`/`, async (req, res) => await DefaultController.put(req, res, options));
+    router.delete(`/:id`, async (req, res) => await DefaultController.delete(req, res, options));
+    router.delete(`/`, async (req, res) => await DefaultController.delete(req, res, options));
+    return router;
+  }
+}
 
-const ApiRouter = DefaultRouter;
+const ApiRouter = (options) => DefaultRouter.router(options);
 
 export { ApiRouter, DefaultRouter };

package/src/api/default/default.service.js

@@ -1,4 +1,4 @@
-import { DataBaseProvider } from '../../db/DataBaseProvider.js';
+import { DataBaseProviderService } from '../../db/DataBaseProvider.js';
 import { loggerFactory } from '../../server/logger.js';
 import { DataQuery } from '../../server/data-query.js';
 
@@ -7,12 +7,12 @@ const logger = loggerFactory(import.meta);
 class DefaultService {
   static post = async (req, res, options) => {
     /** @type {import('./default.model.js').DefaultModel} */
-    const Default = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.Default;
+    const Default = DataBaseProviderService.getModel("Default", options);
     return await new Default(req.body).save();
   };
   static get = async (req, res, options) => {
     /** @type {import('./default.model.js').DefaultModel} */
-    const Default = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.Default;
+    const Default = DataBaseProviderService.getModel("Default", options);
     if (req.params.id) return await Default.findById(req.params.id);
 
     // Parse query parameters using DataQuery helper
@@ -28,12 +28,12 @@ class DefaultService {
   };
   static put = async (req, res, options) => {
     /** @type {import('./default.model.js').DefaultModel} */
-    const Default = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.Default;
+    const Default = DataBaseProviderService.getModel("Default", options);
     return await Default.findByIdAndUpdate(req.params.id, req.body);
   };
   static delete = async (req, res, options) => {
     /** @type {import('./default.model.js').DefaultModel} */
-    const Default = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.Default;
+    const Default = DataBaseProviderService.getModel("Default", options);
     if (req.params.id) return await Default.findByIdAndDelete(req.params.id);
     else return await Default.deleteMany();
   };

package/src/api/document/document.router.js

@@ -1,31 +1,36 @@
 import { loggerFactory } from '../../server/logger.js';
 import { DocumentController } from './document.controller.js';
 import express from 'express';
-import fs from 'fs-extra';
+
 const logger = loggerFactory(import.meta);
 
-const DocumentRouter = (options) => {
-  const router = express.Router();
-  const authMiddleware = options.authMiddleware;
-  router.post(`/:id`, authMiddleware, async (req, res) => await DocumentController.post(req, res, options));
-  router.post(`/`, authMiddleware, async (req, res) => await DocumentController.post(req, res, options));
-  router.get(`/public/high`, async (req, res) => await DocumentController.get(req, res, options));
-  router.get(`/public`, async (req, res) => await DocumentController.get(req, res, options));
-  router.get(`/:id`, authMiddleware, async (req, res) => await DocumentController.get(req, res, options));
-  router.get(`/`, authMiddleware, async (req, res) => await DocumentController.get(req, res, options));
-  router.put(`/:id`, authMiddleware, async (req, res) => await DocumentController.put(req, res, options));
-  router.put(`/`, authMiddleware, async (req, res) => await DocumentController.put(req, res, options));
-  router.patch(`/:id/copy-share-link`, async (req, res) => await DocumentController.patch(req, res, options));
-  router.patch(
-    `/:id/toggle-public`,
-    authMiddleware,
-    async (req, res) => await DocumentController.patch(req, res, options),
-  );
-  router.delete(`/:id`, authMiddleware, async (req, res) => await DocumentController.delete(req, res, options));
-  router.delete(`/`, authMiddleware, async (req, res) => await DocumentController.delete(req, res, options));
-  return router;
-};
+class DocumentRouter {
+  /**
+   * @param {import('../types.js').RouterOptions} options
+   * @returns {import('express').Router}
+   */
+  static router(options) {
+    const router = express.Router();
+    router.post(`/:id`, options.authMiddleware, async (req, res) => await DocumentController.post(req, res, options));
+    router.post(`/`, options.authMiddleware, async (req, res) => await DocumentController.post(req, res, options));
+    router.get(`/public/high`, async (req, res) => await DocumentController.get(req, res, options));
+    router.get(`/public`, async (req, res) => await DocumentController.get(req, res, options));
+    router.get(`/:id`, options.authMiddleware, async (req, res) => await DocumentController.get(req, res, options));
+    router.get(`/`, options.authMiddleware, async (req, res) => await DocumentController.get(req, res, options));
+    router.put(`/:id`, options.authMiddleware, async (req, res) => await DocumentController.put(req, res, options));
+    router.put(`/`, options.authMiddleware, async (req, res) => await DocumentController.put(req, res, options));
+    router.patch(`/:id/copy-share-link`, async (req, res) => await DocumentController.patch(req, res, options));
+    router.patch(
+      `/:id/toggle-public`,
+      options.authMiddleware,
+      async (req, res) => await DocumentController.patch(req, res, options),
+    );
+    router.delete(`/:id`, options.authMiddleware, async (req, res) => await DocumentController.delete(req, res, options));
+    router.delete(`/`, options.authMiddleware, async (req, res) => await DocumentController.delete(req, res, options));
+    return router;
+  }
+}
 
-const ApiRouter = DocumentRouter;
+const ApiRouter = (options) => DocumentRouter.router(options);
 
 export { ApiRouter, DocumentRouter };