underpost 3.2.80 → 3.2.90

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (42) hide show
  1. package/CHANGELOG.md +182 -1
  2. package/CLI-HELP.md +37 -16
  3. package/README.md +2 -2
  4. package/bin/deploy.js +18 -16
  5. package/docker-compose.yml +1 -1
  6. package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml +1 -1
  7. package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml +1 -1
  8. package/manifests/deployment/dd-default-development/deployment.yaml +2 -2
  9. package/manifests/deployment/playwright/deployment.yaml +1 -1
  10. package/manifests/mongodb/kustomization.yaml +4 -1
  11. package/manifests/mongodb/statefulset.yaml +4 -0
  12. package/manifests/mongodb/storage-class.yaml +9 -2
  13. package/package.json +17 -17
  14. package/scripts/nat-iptables.sh +10 -4
  15. package/scripts/test-monitor.sh +4 -3
  16. package/src/cli/cluster.js +740 -55
  17. package/src/cli/db.js +2 -2
  18. package/src/cli/deploy.js +1679 -174
  19. package/src/cli/docker-compose.js +19 -178
  20. package/src/cli/image.js +15 -6
  21. package/src/cli/index.js +124 -35
  22. package/src/cli/ipfs.js +82 -11
  23. package/src/cli/monitor.js +1 -1
  24. package/src/cli/repository.js +1 -1
  25. package/src/cli/run.js +2161 -420
  26. package/src/cli/secrets.js +969 -0
  27. package/src/cli/ssh.js +8 -28
  28. package/src/client-builder/client-build.js +94 -11
  29. package/src/client-builder/ssr.js +27 -73
  30. package/src/db/mongo/MongoBootstrap.js +295 -54
  31. package/src/db/mongo/MongooseDB.js +47 -32
  32. package/src/index.js +1 -1
  33. package/src/server/conf.js +1208 -70
  34. package/src/server/cri.js +70 -0
  35. package/src/server/underpost-gateway.js +1073 -0
  36. package/src/server/underpost-ingress.js +364 -0
  37. package/test/cluster-instances.test.js +435 -0
  38. package/test/deploy-node-placement.test.js +45 -0
  39. package/test/instance-traffic-plan.test.js +710 -0
  40. package/test/sops-secret-store.test.js +612 -0
  41. package/test/underpost-gateway.test.js +469 -0
  42. package/test/underpost-ingress.test.js +253 -0
package/scripts/nat-iptables.sh CHANGED
@@ -32,6 +32,12 @@ sudo firewall-cmd --permanent --zone=public --add-service=ssh
32
32
  sudo firewall-cmd --permanent --zone=public --add-service=http
33
33
  sudo firewall-cmd --permanent --zone=public --add-service=https
34
34
 
35
+ # QUIC / HTTP3. The `https` service above covers TCP 443 only, so without this
36
+ # an HTTP/3 gateway advertises `Alt-Svc: h3=":443"` and every client that acts
37
+ # on it silently fails over UDP while HTTP/2 keeps working.
38
+ sudo firewall-cmd --permanent --zone=public --add-port=443/udp
39
+ sudo firewall-cmd --permanent --zone=public --add-port=80/udp
40
+
35
41
  echo "[INFO] Opening Kubernetes control plane ports..."
36
42
 
37
43
  # Kubernetes API Server
@@ -98,10 +104,10 @@ sudo firewall-cmd --reload
98
104
  echo
99
105
  echo "[INFO] Sysctl status:"
100
106
  sudo sysctl \
101
- net.ipv4.ip_forward \
102
- net.ipv6.conf.all.forwarding \
103
- net.bridge.bridge-nf-call-iptables \
104
- net.bridge.bridge-nf-call-ip6tables
107
+ net.ipv4.ip_forward \
108
+ net.ipv6.conf.all.forwarding \
109
+ net.bridge.bridge-nf-call-iptables \
110
+ net.bridge.bridge-nf-call-ip6tables
105
111
 
106
112
  echo
107
113
  echo "[INFO] Firewall status:"
package/scripts/test-monitor.sh CHANGED
@@ -24,7 +24,7 @@ MODE=runtime # runtime | instance
24
24
  ENV=development # development | production
25
25
  DEPLOY_ID=dd-test # deploy id (instance mode: parent of conf.instances.json)
26
26
  INSTANCE_IDS= # instance mode: csv of ids (default: all in conf.instances.json)
27
- IMAGE=underpost/wp:v3.2.80 # runtime mode image (instance mode reads image from conf)
27
+ IMAGE=underpost/wp:v3.2.90 # runtime mode image (instance mode reads image from conf)
28
28
  VERSIONS=green # csv of blue/green versions
29
29
  REPLICAS=1 # replicas per deployment
30
30
  NAMESPACE=default # k8s namespace
@@ -202,7 +202,8 @@ run_runtime_mode() {
202
202
  setup_tls_secrets $(hosts_from "$SERVER_CONF")
203
203
  expose_flags="--tls"
204
204
  fi
205
- [ "$DO_EXPOSE" = true ] && node bin deploy --expose --local-proxy "$DEPLOY_ID" "$ENV" $expose_flags
205
+ [ "$DO_EXPOSE" = true ] && node bin run expose "${DEPLOY_ID}-${ENV}-traffic-service" --namespace "$NAMESPACE" \
206
+ --local-proxy $DEV_FLAG $CLUSTER_FLAG $expose_flags
206
207
  }
207
208
 
208
209
  # ─────────────────────────── instance mode ───────────────────────────
@@ -234,7 +235,7 @@ run_instance_mode() {
234
235
  # Plain HTTP: port-forward each instance service port directly.
235
236
  for id in "${ids[@]}"; do
236
237
  [ -n "$id" ] || continue
237
- node bin deploy --expose "${DEPLOY_ID}-${id}" "$ENV" --namespace "$NAMESPACE" || true
238
+ node bin run expose "${DEPLOY_ID}-${id}-${ENV}-traffic-service" --namespace "$NAMESPACE" $CLUSTER_FLAG || true
238
239
  done
239
240
  fi
240
241
  }