underpost 3.2.9 → 3.2.11

package/manifests/mongodb/statefulset.yaml

@@ -4,7 +4,8 @@ metadata:
   name: mongodb # Specifies the name of the statefulset
 spec:
   serviceName: 'mongodb-service' # Specifies the service to use
-  replicas: 2
+  podManagementPolicy: OrderedReady # or Parallel
+  replicas: 3
   selector:
     matchLabels:
       app: mongodb
@@ -13,80 +14,58 @@ spec:
       labels:
         app: mongodb
     spec:
+      subdomain: mongodb-service
+      securityContext:
+        fsGroup: 999
+      initContainers:
+        - name: internal-keyfile-provisioner
+          image: docker.io/library/mongo:latest
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+          command:
+            - sh
+            - -c
+            - |
+              set -ex
+              mkdir -p /opt/mongodb
+              cp /tmp/raw-keyfile/mongodb-keyfile /opt/mongodb/mongodb-keyfile
+              chmod 400 /opt/mongodb/mongodb-keyfile
+              chown -R 999:999 /opt/mongodb
+              chown -R 999:999 /data/db
+              rm -f /data/db/mongod.lock
+          volumeMounts:
+            - name: raw-secret-keyfile-volume
+              mountPath: /tmp/raw-keyfile
+            - name: isolated-runtime-keyfile-volume
+              mountPath: /opt/mongodb
+            - name: mongodb-storage
+              mountPath: /data/db
       containers:
         - name: mongodb
           image: docker.io/library/mongo:latest
           command:
             - mongod
+          args:
             - '--replSet'
             - 'rs0'
-            # - '--config'
-            # - '-f'
-            # - '/etc/mongod.conf'
-            # - '--auth'
-            # - '--clusterAuthMode'
-            # - 'keyFile'
-            # - '--keyFile'
-            # - '/etc/mongodb-keyfile'
-            # - '--interleave'
-            # - 'all'
-            # - '--wiredTigerCacheSizeGB'
-            # - '0.25'
-            # - '--setParameter'
-            # - 'authenticationMechanisms=SCRAM-SHA-1'
-            # - '--fork'
-            - '--logpath'
-            - '/var/log/mongodb/mongod.log'
+            - '--auth'
+            - '--clusterAuthMode'
+            - 'keyFile'
+            - '--keyFile'
+            - '/opt/mongodb/mongodb-keyfile'
             - '--bind_ip_all'
-          # command: ['sh', '-c']
-          # args:
-          #   - |
-          #     mongod --replSet rs0 --bind_ip_all &
-          #     sleep 1000
-          #     if mongosh --host mongodb-0.mongodb-service:27017 --eval "rs.status()" | grep -q "not yet initialized"; then
-          #       mongosh --host mongodb-0.mongodb-service:27017 <<EOF
-          #       use admin;
-          #       rs.initiate({
-          #         _id: "rs0",
-          #         members: [
-          #           { _id: 0, host: "mongodb-0.mongodb-service:27017", priority: 1 },
-          #           { _id: 1, host: "mongodb-1.mongodb-service:27017", priority: 1 }
-          #         ]
-          #       });
-          #       db.getSiblingDB("admin").createUser({
-          #         user: process.env.MONGO_INITDB_ROOT_USERNAME,
-          #         pwd: process.env.MONGO_INITDB_ROOT_PASSWORD,
-          #         roles: [{ role: "userAdminAnyDatabase", db: "admin" }]
-          #       });
-          #       use default;
-          #       db.createUser(
-          #         {
-          #           user: process.env.MONGO_INITDB_ROOT_USERNAME,
-          #           pwd: process.env.MONGO_INITDB_ROOT_PASSWORD,
-          #           roles: [
-          #             { role: "read", db: "test" },
-          #             { role: "readWrite", db: "default" }
-          #           ]
-          #         }
-          #       );
-          #       EOF
-          #     fi
-          #     wait
+
           ports:
             - containerPort: 27017
           volumeMounts:
+            - name: isolated-runtime-keyfile-volume
+              mountPath: /opt/mongodb
             - name: mongodb-storage
               mountPath: /data/db
-            - name: keyfile
-              mountPath: /etc/mongodb-keyfile
-              readOnly: true
-            # - name: mongodb-configuration-file
-            #   mountPath: /etc/mongod.conf
-            #   subPath: mongod.conf
-            #   readOnly: true
-            # - name: mongodb-config
-            #   mountPath: /config
           env:
+            - name: MONGO_REPLICA_SET_NAME
+              value: rs0
             - name: MONGO_INITDB_ROOT_USERNAME
               valueFrom:
                 secretKeyRef:
@@ -97,6 +76,18 @@ spec:
                 secretKeyRef:
                   name: mongodb-secret
                   key: password
+          readinessProbe:
+            tcpSocket:
+              port: 27017
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            tcpSocket:
+              port: 27017
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
           resources:
             requests:
               cpu: '100m'
@@ -105,16 +96,12 @@ spec:
               cpu: '500m'
               memory: '512Mi'
       volumes:
-        - name: keyfile
+        - name: raw-secret-keyfile-volume
           secret:
             secretName: mongodb-keyfile
             defaultMode: 0400
-        # - name: mongodb-configuration-file
-        #   configMap:
-        #     name: mongodb-config-file
-        # - name: mongodb-config
-        #   configMap:
-        #     name: mongodb-config
+        - name: isolated-runtime-keyfile-volume
+          emptyDir: {}
   volumeClaimTemplates:
     - metadata:
         name: mongodb-storage

package/manifests/mongodb-4.4/headless-service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongodb-service
+spec:
+  clusterIP: None
+  selector:
+    app: mongodb
+  ports:
+    - port: 27017

package/manifests/mongodb-4.4/kustomization.yaml

@@ -4,4 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - pv-pvc.yaml
-  - service-deployment.yaml
+  - storage-class.yaml
+  - headless-service.yaml
+  - statefulset.yaml

package/manifests/mongodb-4.4/mongodb-nodeport.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongodb-nodeport
+  labels:
+    app: mongodb
+spec:
+  type: NodePort
+  externalTrafficPolicy: Cluster
+  selector:
+    app: mongodb
+  ports:
+    - name: mongodb
+      protocol: TCP
+      port: 27017
+      targetPort: 27017
+      nodePort: 32017

package/manifests/mongodb-4.4/pv-pvc.yaml

@@ -1,23 +1,19 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: mongodb-pv
+  name: mongodb-pv-0
+  labels:
+    app: mongodb
 spec:
   capacity:
     storage: 5Gi
   accessModes:
     - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: mongodb-storage-class
+  claimRef:
+    namespace: default
+    name: mongodb-storage-mongodb-0
   hostPath:
-    path: /data/mongodb
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: mongodb-pvc
-spec:
-  storageClassName: ''
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
+    path: /data/mongodb/v0
+    type: DirectoryOrCreate

package/manifests/mongodb-4.4/statefulset.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mongodb # Specifies the name of the statefulset
+spec:
+  serviceName: 'mongodb-service' # Specifies the service to use
+  podManagementPolicy: OrderedReady # or Parallel
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mongodb
+  template:
+    metadata:
+      labels:
+        app: mongodb
+    spec:
+      subdomain: mongodb-service
+      securityContext:
+        fsGroup: 999
+      initContainers:
+        - name: data-dir-permissions
+          image: docker.io/library/mongo:4.4
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+          command:
+            - sh
+            - -c
+            - |
+              chown -R 999:999 /data/db
+              rm -f /data/db/mongod.lock
+          volumeMounts:
+            - name: mongodb-storage
+              mountPath: /data/db
+      containers:
+        - name: mongodb
+          image: docker.io/library/mongo:4.4
+          command:
+            - mongod
+          args:
+            - '--replSet'
+            - 'rs0'
+            - '--bind_ip_all'
+          ports:
+            - containerPort: 27017
+          volumeMounts:
+            - name: mongodb-storage
+              mountPath: /data/db
+          env:
+            - name: MONGO_REPLICA_SET_NAME
+              value: rs0
+          readinessProbe:
+            tcpSocket:
+              port: 27017
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            tcpSocket:
+              port: 27017
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: '100m'
+              memory: '256Mi'
+            limits:
+              cpu: '500m'
+              memory: '512Mi'
+  volumeClaimTemplates:
+    - metadata:
+        name: mongodb-storage
+      spec:
+        accessModes: ['ReadWriteOnce']
+        storageClassName: mongodb-storage-class
+        resources:
+          requests:
+            storage: 5Gi

package/manifests/mongodb-4.4/storage-class.yaml

@@ -0,0 +1,9 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: mongodb-storage-class
+  annotations:
+    storageclass.kubernetes.io/is-default-class: 'false'
+provisioner: rancher.io/local-path
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer

package/manifests/valkey/statefulset.yaml

@@ -19,7 +19,7 @@ spec:
           image: docker.io/valkey/valkey:latest
           imagePullPolicy: IfNotPresent
           command: ['valkey-server']
-          args: ['--port', '6379']
+          args: ['--port', '6379', '--bind', '0.0.0.0', '--protected-mode', 'no']
           ports:
             - containerPort: 6379
           startupProbe:

package/manifests/valkey/valkey-nodeport.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: valkey-nodeport
+  labels:
+    app: valkey-service
+spec:
+  type: NodePort
+  externalTrafficPolicy: Cluster
+  selector:
+    app: valkey-service
+  ports:
+    - name: valkey
+      protocol: TCP
+      port: 6379
+      targetPort: 6379
+      nodePort: 32079

package/package.json

@@ -2,8 +2,8 @@
     "type": "module",
     "main": "src/index.js",
     "name": "underpost",
-    "version": "3.2.9",
-    "description": "pwa api rest template",
+    "version": "3.2.11",
+    "description": "Underpost Platform — end-to-end CI/CD and application-delivery toolchain CLI. Covers bare metal, Kubernetes, K3s, kubeadm, LXD, container/image orchestration, secrets, databases, cron jobs, monitoring, SSH, runners, PWA + Workbox delivery, and release orchestration. Extensible via downstream CLIs.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
         "build": "node bin client",
@@ -35,7 +35,21 @@
         "url": "git+https://github.com/underpostnet/pwa-microservices-template.git"
     },
     "keywords": [
+        "underpost",
+        "underpost-platform",
+        "cli",
+        "toolchain",
+        "ci-cd",
+        "devops",
+        "kubernetes",
+        "k3s",
+        "kubeadm",
+        "lxd",
+        "bare-metal",
+        "container-orchestration",
+        "image-management",
         "pwa",
+        "workbox",
         "microservices",
         "template",
         "builder",
@@ -53,12 +67,13 @@
     "dependencies": {
         "@fortawesome/fontawesome-free": "^7.2.0",
         "@fullcalendar/rrule": "^6.1.20",
-        "@grpc/grpc-js": "^1.12.5",
-        "@grpc/proto-loader": "^0.8.0",
+        "@grpc/grpc-js": "^1.14.4",
+        "@grpc/proto-loader": "^0.8.1",
         "@neodrag/vanilla": "^2.3.1",
         "adm-zip": "^0.5.17",
-        "ag-grid-community": "^35.2.1",
-        "axios": "^1.16.0",
+        "ag-grid-community": "^35.3.0",
+        "axios": "^1.16.1",
+        "bumpp": "^11.1.0",
         "chai": "^6.2.2",
         "clipboardy": "^5.3.1",
         "cloudinary": "^2.10.0",
@@ -75,13 +90,13 @@
         "escape-string-regexp": "^5.0.0",
         "express": "^5.2.1",
         "express-fileupload": "^1.4.3",
-        "express-rate-limit": "^8.4.1",
+        "express-rate-limit": "^8.5.2",
         "express-slow-down": "^3.1.0",
         "fast-json-stable-stringify": "^2.1.0",
         "favicons": "^7.2.0",
         "fs-extra": "^11.3.5",
         "fullcalendar": "^6.1.15",
-        "helmet": "^8.1.0",
+        "helmet": "^8.2.0",
         "html-minifier-terser": "^7.2.0",
         "http-proxy-middleware": "^4.0.0",
         "ignore-walk": "^9.0.0",
@@ -89,16 +104,16 @@
         "json-colorizer": "^3.0.1",
         "jsonwebtoken": "^9.0.3",
         "mariadb": "^3.2.2",
-        "marked": "^18.0.3",
-        "mocha": "^11.3.0",
+        "mocha": "^11.7.6",
+        "marked": "^18.0.4",
         "mongoose": "^9.6.2",
         "morgan": "^1.10.0",
-        "nodemailer": "^8.0.7",
+        "nodemailer": "^8.0.9",
         "nodemon": "^3.0.1",
         "peer": "^1.0.2",
         "peerjs": "^1.5.5",
         "prom-client": "^15.1.2",
-        "read": "^5.0.1",
+        "read": "^6.0.0",
         "rrule": "^2.8.1",
         "shelljs": "^0.10.0",
         "sitemap": "^9.0.1",

package/scripts/ipxe-setup.sh

@@ -14,39 +14,39 @@ REBUILD=false
 EMBED_SCRIPT=""
 
 while [[ $# -gt 0 ]]; do
-  case $1 in
-    --rebuild)
-      REBUILD=true
-      shift # past argument
-      ;;
-    --target-arch)
-      case "$2" in
-        arm64)
-          TARGET_ARCH="aarch64"
-          ;;
-        amd64)
-          TARGET_ARCH="x86_64"
-          ;;
+    case $1 in
+        --rebuild)
+            REBUILD=true
+            shift # past argument
+        ;;
+        --target-arch)
+            case "$2" in
+                arm64)
+                    TARGET_ARCH="aarch64"
+                ;;
+                amd64)
+                    TARGET_ARCH="x86_64"
+                ;;
+                *)
+                    echo "Error: Unsupported architecture '$2'. Use 'arm64' or 'amd64'."
+                    exit 1
+                ;;
+            esac
+            shift # past argument
+            shift # past value
+        ;;
+        --embed-script)
+            EMBED_SCRIPT="$2"
+            shift # past argument
+            shift # past value
+        ;;
         *)
-          echo "Error: Unsupported architecture '$2'. Use 'arm64' or 'amd64'."
-          exit 1
-          ;;
-      esac
-      shift # past argument
-      shift # past value
-      ;;
-    --embed-script)
-      EMBED_SCRIPT="$2"
-      shift # past argument
-      shift # past value
-      ;;
-    *)
-      if [ -z "$TARGET_DIR_ARG" ]; then
-          TARGET_DIR_ARG="$1"
-      fi
-      shift # past argument
-      ;;
-  esac
+            if [ -z "$TARGET_DIR_ARG" ]; then
+                TARGET_DIR_ARG="$1"
+            fi
+            shift # past argument
+        ;;
+    esac
 done
 
 # Use argument if provided, otherwise env var, otherwise current dir
@@ -64,7 +64,7 @@ echo "Embed Script:        ${EMBED_SCRIPT:-none}"
 # Determine iPXE build target based on requested architecture
 if [ "$TARGET_ARCH" = "aarch64" ]; then
     BUILD_TARGET="bin-arm64-efi/ipxe.efi"
-elif [ "$TARGET_ARCH" = "x86_64" ]; then
+    elif [ "$TARGET_ARCH" = "x86_64" ]; then
     BUILD_TARGET="bin-x86_64-efi/ipxe.efi"
 else
     echo "Error: Unsupported target architecture '$TARGET_ARCH'"
@@ -79,49 +79,50 @@ DO_BUILD=false
 
 if [ "$REBUILD" = true ]; then
     DO_BUILD=true
-elif [ ! -f "$COMPILED_SRC_PATH" ]; then
+    elif [ ! -f "$COMPILED_SRC_PATH" ]; then
     echo "Binary not found at $COMPILED_SRC_PATH. Initiating build..."
     DO_BUILD=true
+    
 else
-    echo "Binary found at $COMPILED_SRC_PATH. Skipping build."
+    echo "Binary found at $COMPILED_SRC_PATH with matching embedded script. Skipping build."
 fi
 
 if [ "$DO_BUILD" = true ]; then
-
+    
     # Helper function for package manager
     if command -v dnf &> /dev/null; then
         PKG_MGR="dnf"
     else
         PKG_MGR="yum"
     fi
-
+    
     # --- 2. Install Dependencies (RHEL/CentOS/Fedora) ---
     echo ""
     echo "--- Installing Build Dependencies ---"
     echo "Requesting sudo permissions..."
-
+    
     COMMON_PKGS="git make binutils-devel xz-devel perl"
-
+    
     # Logic to determine if we need native or cross-compilers
     if [ "$HOST_ARCH" = "$TARGET_ARCH" ]; then
         # Native compilation
         echo "Architecture match ($HOST_ARCH). Installing native GCC..."
         sudo $PKG_MGR install -y $COMMON_PKGS gcc
         CROSS_COMPILE_PREFIX=""
-
-    elif [ "$HOST_ARCH" = "x86_64" ] && [ "$TARGET_ARCH" = "aarch64" ]; then
+        
+        elif [ "$HOST_ARCH" = "x86_64" ] && [ "$TARGET_ARCH" = "aarch64" ]; then
         # Cross-compilation: x86_64 host -> aarch64 target
         echo "Cross-compiling for $TARGET_ARCH on $HOST_ARCH..."
         # Note: Ensure EPEL repo is enabled on RHEL/CentOS for this package
         sudo $PKG_MGR install -y $COMMON_PKGS gcc-aarch64-linux-gnu
         CROSS_COMPILE_PREFIX="aarch64-linux-gnu-"
-
+        
     else
         echo "Error: No automated path defined for Host: $HOST_ARCH -> Target: $TARGET_ARCH"
         echo "You may need to install specific cross-compilers manually."
         exit 1
     fi
-
+    
     # --- 3. Clone iPXE Source ---
     echo ""
     echo "--- Downloading iPXE Source Code ---"
@@ -133,15 +134,15 @@ if [ "$DO_BUILD" = true ]; then
         git clone https://github.com/ipxe/ipxe.git $IPXE_SRC_DIR
         cd $IPXE_SRC_DIR
     fi
-
+    
     # --- 4. Compile the Binary ---
     echo ""
     echo "--- Compiling $EFI_FILENAME for $TARGET_ARCH ---"
     cd src
-
+    
     # Clean previous builds to ensure no arch mismatch
     make clean
-
+    
     # Build with embedded script if provided
     if [ -n "$EMBED_SCRIPT" ]; then
         echo "Embedding script into iPXE binary..."
@@ -155,7 +156,7 @@ if [ "$DO_BUILD" = true ]; then
         echo "Running make for target: $BUILD_TARGET..."
         make CROSS_COMPILE=$CROSS_COMPILE_PREFIX $BUILD_TARGET
     fi
-
+    
     if [ $? -ne 0 ]; then
         echo "Error: Compilation failed."
         if [ -n "$CROSS_COMPILE_PREFIX" ]; then
@@ -163,6 +164,8 @@ if [ "$DO_BUILD" = true ]; then
         fi
         exit 1
     fi
+    
+    
 fi
 
 # --- 5. Deploy Binary ---
@@ -176,10 +179,10 @@ if [ -f "$COMPILED_SRC_PATH" ]; then
         echo "Creating target directory: $TARGET_DIR"
         mkdir -p "$TARGET_DIR"
     fi
-
+    
     echo "Copying $COMPILED_SRC_PATH to $TARGET_DIR/$EFI_FILENAME..."
     cp "$COMPILED_SRC_PATH" "$TARGET_DIR/$EFI_FILENAME"
-
+    
     if [ $? -eq 0 ]; then
         echo "✓ Success!"
         echo "---------------------------------------------------"