underpost 3.2.90 → 3.3.0

package/.github/workflows/ghpkg.ci.yml

@@ -20,7 +20,13 @@ permissions:
   id-token: write
 jobs:
   pwa-microservices-template-ghpk:
-    if: github.repository == 'underpostnet/pwa-microservices-template' && startsWith(github.event.head_commit.message, 'ci(package-pwa-microservices-template-ghpkg)')
+    if: >-
+      github.repository == 'underpostnet/pwa-microservices-template' &&
+       (
+         startsWith(github.event.head_commit.message, 'ci(package-pwa-microservices-template-ghpkg)')
+         || 
+         github.event_name == 'workflow_dispatch'
+       )
     name: Update github repo package Jobs
     runs-on: ubuntu-latest
     container:

package/.github/workflows/pwa-microservices-template-page.cd.yml

@@ -32,23 +32,8 @@ jobs:
       # - name: Checkout LFS objects
       #   run: git lfs checkout
 
-      - name: Install required packages
-        run: |
-          dnf install -y sudo tar gzip bzip2 git
-          dnf install -y curl --allowerasing
-
-      - name: Install Node.js
-        run: |
-          curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
-          dnf install nodejs -y
-
       - name: Build the site
-        run: |
-          npm install
-          node bin new --default-conf --conf-workflow-id dd-github-pages
-          node bin new --deploy-id dd-github-pages
-          node bin env dd-github-pages production
-          NODE_ENV=production node bin client dd-github-pages '' underpostnet.github.io /pwa-microservices-template-ghpkg
+        run: bash deploy/pwa-microservices-template/deploy.sh
       # git lfs install
       # git lfs track
       # git lfs ls-files

package/.github/workflows/pwa-microservices-template-test.ci.yml

@@ -30,4 +30,4 @@ jobs:
         run: npm install
 
       - name: Run test
-        run: npm test
+        run: scripts/coverall-test.sh

package/.github/workflows/release.cd.yml

@@ -35,12 +35,4 @@ jobs:
           script: |
             set -e
             set -o pipefail
-            echo "Starting remote release deploy"
-            cd /home/dd/engine
-            sudo -n -- /bin/bash -lc "node bin run pull"
-            sudo -n -- /bin/bash -lc "npm install"
-            sudo -n -- /bin/bash -lc "node bin run secret"
-            sudo -n -- /bin/bash -lc "npm install -g underpost"
-            sudo -n -- /bin/bash -lc "node bin run secret"
-            sudo -n -- /bin/bash -lc "node bin run --dev git-conf"
-            sudo -n -- /bin/bash -lc "node bin run docker-image"
+            bash /home/dd/engine/deploy/release/deploy.sh

package/CHANGELOG.md

@@ -1,6 +1,115 @@
 # Changelog
 
-## 2026-08-11
+## 2026-08-18
+
+### github-actions
+
+- Add workflow_dispatch trigger event handling in .github/workflows/ghpkg.ci.yml ([e21320cf](https://github.com/underpostnet/engine/commit/e21320cf7542680823758f331bd34d619ca185cd))
+- Reorder coverall test list ([eb20336b](https://github.com/underpostnet/engine/commit/eb20336b29e87f4371528f78099768e8ee36b586))
+- Replace default npm coverall test with scripts/coverall-test.sh ([3471f300](https://github.com/underpostnet/engine/commit/3471f3009391a3f8a1a66cedd1e4761fe5f76712))
+- Refactor move CD workflow commands into deployment scripts with run_quiet wrapper ([222a18d7](https://github.com/underpostnet/engine/commit/222a18d719f33fd678a72f9b05639f86ec4037cd))
+- Update .github/workflows/engine-test.cd.yml ([94e42e58](https://github.com/underpostnet/engine/commit/94e42e58ee4f9eb6542a010e96899000458f3a7b))
+- Add import-default-items steps to cyberia CD ([350444f9](https://github.com/underpostnet/engine/commit/350444f9fb4b34cd15541458c1897299fed7b287))
+- Update.github/workflows/engine-cyberia.cd.yml ([53e9da17](https://github.com/underpostnet/engine/commit/53e9da17127a850aebaa0e5e0e90b593ee0ac03d))
+- Update base node in engine-core CD pipeline ([fa039f25](https://github.com/underpostnet/engine/commit/fa039f25763bb719496b73dd8044af4570be859e))
+
+### cli-cyberia
+
+- Include deploy strategies in generated projects ([66bc733e](https://github.com/underpostnet/engine/commit/66bc733eb22bd74aff5ff249dade0959c876cdae))
+- Refactor make data.item.id is now a unique index for every case ([1391efce](https://github.com/underpostnet/engine/commit/1391efce32f96f56271a1060304bb7b26556b80d))
+- Add WebSocket load test runner command ([eebec67e](https://github.com/underpostnet/engine/commit/eebec67edd1bfda0bf6f8205305a90cd73441e4c))
+
+### engine
+
+- Expand server module JSDoc annotations ([213a5519](https://github.com/underpostnet/engine/commit/213a55191dc388d227315f07116148d5b731b883))
+- Move writeEnv helper into environment module ([9c57e362](https://github.com/underpostnet/engine/commit/9c57e3629a682da0c7aa45e0cb24d24d3af3cdab))
+- Fix SELinux host paths mounts logic and definition ([6cf8dda1](https://github.com/underpostnet/engine/commit/6cf8dda113b92fea011e3825035147ae33a1bc7f))
+- Extract environment and cron deploy helpers into dedicated modules ([6ba3fa4c](https://github.com/underpostnet/engine/commit/6ba3fa4c372a2eb1afe87c6fc5c0681209a96b07))
+- Enforce SELinux across cluster, SSH, and provisioning ([9d57a359](https://github.com/underpostnet/engine/commit/9d57a359dd94067dfb48fceab9006e3ef3d7d502))
+
+### cli-wireguard
+
+- Add SSH forwarding via VPS edge ([54de1e6e](https://github.com/underpostnet/engine/commit/54de1e6e5dddccad5c056da152cb32712ab3ba25))
+- Extract forward proxy and systemd helpers into server modules ([97be08d1](https://github.com/underpostnet/engine/commit/97be08d107e825c2ff5a97382ebb9367a6ad3523))
+- Implement HTTP/CONNECT forward proxy for WireGuard ([a95163df](https://github.com/underpostnet/engine/commit/a95163df2797bbfa86d3d1f422fe0afd224b72b3))
+- Implement idempotent in Restart, reconnect, and reset pipeline ([65710c3b](https://github.com/underpostnet/engine/commit/65710c3bd3056b1f2cc49e3b82517d081f7f25df))
+- Implement Edge Hub WireGuard and HAProxy CLI module ([2e293b87](https://github.com/underpostnet/engine/commit/2e293b87540a43489bb535e2ab731581809b1848))
+
+### catalog-cyberia
+
+- Add coverall cyberia trigger script ([c8e59eed](https://github.com/underpostnet/engine/commit/c8e59eed08c113d39a99f5151d8d6b4af96fb4e9))
+
+### scripts
+
+- Mark scripts as executable ([8f04cbc7](https://github.com/underpostnet/engine/commit/8f04cbc700e2bc17b917ea49450efabc766e27ed))
+
+### release
+
+- Fix missing file bump version scopes ([4aa983a5](https://github.com/underpostnet/engine/commit/4aa983a5d8aea7983295ee01799c358ed1b9c2bc))
+
+### deploy
+
+- Mark deploy scripts as executable ([b18151bf](https://github.com/underpostnet/engine/commit/b18151bfaa52c17b2540e0a2706b79a8850fee84))
+
+### hardhat
+
+- Update hardhat npm module version to sync current project scope v3.2.90 ([8fc717b9](https://github.com/underpostnet/engine/commit/8fc717b9913c69a41c2c9e88b2b7f720a4a7cb09))
+- Update undici override dependency to v6.28.0 ([fb2d2aa3](https://github.com/underpostnet/engine/commit/fb2d2aa3b502b5552212f63d9a01f23d2333b296))
+
+### dependabot
+
+- Disable typescript autoupdate ([8bd76183](https://github.com/underpostnet/engine/commit/8bd7618336423a1df1d4ca77cd138aef51902d6c))
+
+### cli-client
+
+- Add only ssr build workload flag option and logic ([92026a66](https://github.com/underpostnet/engine/commit/92026a66ec3c403219af62bfc5bcc78917d537ed))
+
+### cli-cron
+
+- Fix cron CLI setup flag and single job execution ([84eab73d](https://github.com/underpostnet/engine/commit/84eab73d9a618244b46e699ba65b469940d1a267))
+
+### cli-repository
+
+- Add getDefaultBranch resolve in switchRemote method ([04bc8743](https://github.com/underpostnet/engine/commit/04bc8743b6f4c5f9edd891276137183fa444d447))
+
+### cli-ssh
+
+- Add initializeDefaultSshConfig method ([84f5f869](https://github.com/underpostnet/engine/commit/84f5f8698810596f084e632487208ea909feddfd))
+
+### cli-vultr
+
+- Add Vultr Bandwidth Monitor cron job CLI Module ([22fb9249](https://github.com/underpostnet/engine/commit/22fb9249ad40ba24a8cd87da43d742b1972c4fbb))
+
+### cli-dns
+
+- Add blokc/unblock ingress/egress workflow handling ([980fab35](https://github.com/underpostnet/engine/commit/980fab35aba6a279b94701550edfd765c8b422a2))
+
+### underpost-ingress
+
+- Enable response compression in ingress and gateway ([7763f9da](https://github.com/underpostnet/engine/commit/7763f9da2b81128042cef2a73ca5570938dcd3f5))
+
+### test
+
+- Fix missing pngjs import in object-layer test pipeline ([20c1f24d](https://github.com/underpostnet/engine/commit/20c1f24d865d5cdeb70a365c93f8c797c28fe960))
+- Add WebSocket load test for cyberia-server ([e3ff2777](https://github.com/underpostnet/engine/commit/e3ff277725e33dace3ed3268e6f60299ea146f59))
+
+### engine-cyberia
+
+- Remove eiri from entity default inventory ([e8f8d03c](https://github.com/underpostnet/engine/commit/e8f8d03c7e326fac012722f659def7d7a7da882c))
+- Add fallback world default items staging and hot reload ([e646c430](https://github.com/underpostnet/engine/commit/e646c430d72ea7a319cf1640bd4c7505cbb40b87))
+- Add playerBaseSpeed field to instance config defaults ([7cdbd23d](https://github.com/underpostnet/engine/commit/7cdbd23d255bb47e253e60f7ec0cc6c3600d5678))
+- Add WebSocket connection limit env to cyberia-server ([c6f834c7](https://github.com/underpostnet/engine/commit/c6f834c7dc7bcae24d4f493a005cdb2d1b76a73d))
+
+### client-cyberia
+
+- Add Fallback World Engine editor view ([cf61dfe8](https://github.com/underpostnet/engine/commit/cf61dfe8e7eec7556f5bd07e445d6759d9b432e4))
+- Implement IPFS cid filters in ObjectLayerEngineViewer component ([93eb6992](https://github.com/underpostnet/engine/commit/93eb69928bf8ea6915f70b1ca4307fa582cc17b6))
+
+### docs
+
+- Document moveAck reconciliation and move coalescing in Cyberia replication ([24b14ca4](https://github.com/underpostnet/engine/commit/24b14ca4ee4c9ef0ce4dc9e3135e4990ed0a8274))
+
+## New release v:3.2.90 (2026-08-11)
 
 ### cli-run
 

package/CLI-HELP.md

@@ -1,6 +1,6 @@
 ## Underpost CLI
 
-> underpost ci/cd cli v3.2.90
+> underpost ci/cd cli v3.3.0
 
 **Usage:** `underpost [options] [command]`
 
@@ -39,6 +39,9 @@
 | [`test`](#underpost-test) | Manages and runs tests, defaulting to the current Underpost default test suite. |
 | [`monitor`](#underpost-monitor) | Manages health server monitoring for specified deployments. |
 | [`ssh`](#underpost-ssh) | Manages SSH credentials and sessions for remote access to cluster nodes or services. |
+| [`wireguard`](#underpost-wireguard) | Manages the WireGuard L3 hub-and-spoke transport and the HAProxy edge gateway in front of it. |
+| [`haproxy`](#underpost-haproxy) | Manages the HAProxy edge gateway over the WireGuard transport (same subsystem as `underpost wireguard`). |
+| [`vultr`](#underpost-vultr) | Meters the edge VPS bandwidth against its Vultr plan quota and blocks egress before overage accrues. |
 | [`run`](#underpost-run) | Runs specified scripts using various runners. |
 | [`docker-compose`](#underpost-docker-compose) | General-purpose Docker Compose development pipeline (mirrors the Kubernetes dev stack). |
 | [`lxd`](#underpost-lxd) | Manages LXD virtual machines as K3s nodes (control plane or workers). |
@@ -106,6 +109,7 @@ Builds client assets, single replicas, and/or syncs environment ports.
 | `--merge-zip <build-prefix>` | Merge split ZIP parts back into a single ZIP file for the given build prefix |
 | `--lite-build` | Skip full build (default is full build) |
 | `--icons-build` | Build icons |
+| `--ssr` | Rebuild only SSR views defined in conf.ssr.json, leaving client assets untouched |
 | `-h, --help` | display help for command |
 
 ---
@@ -227,7 +231,7 @@ Manages commits to a GitHub repository, supporting various commit types and opti
 | `--has-changes` | Prints "1" if there are staged or unstaged git changes in the repository, empty string otherwise. |
 | `--remote-url` | Prints the current git remote URL (origin) in plain text. |
 | `--switch-repo <url>` | Switches the git remote (origin) to <url> and force-pulls the target branch, overwriting the current working tree (discards local commits and tracked changes). Accepts a full URL or "owner/repo". |
-| `--target-branch <branch>` | Target branch for --switch-repo (default: master). |
+| `--target-branch <branch>` | Target branch for --switch-repo (default: remote default branch). |
 | `-h, --help` | display help for command |
 
 ---
@@ -389,6 +393,10 @@ Displays the current public machine IP addresses.
 | `--ban-egress-clear` | Clears all banned egress IP addresses. |
 | `--ban-both-add` | Adds IP addresses to both banned ingress and egress lists. |
 | `--ban-both-remove` | Removes IP addresses from both banned ingress and egress lists. |
+| `--block-all-egress` | Blocks all outbound traffic from this host (keeps established/related connections). |
+| `--unblock-all-egress` | Unblocks all outbound traffic and restores default ACCEPT policy. |
+| `--block-all-ingress` | Blocks all new inbound traffic to this host (keeps established/related connections). |
+| `--unblock-all-ingress` | Unblocks all inbound traffic and restores default ACCEPT policy. |
 | `--mac` | Prints the MAC address of the main network interface. |
 | `-h, --help` | display help for command |
 
@@ -678,18 +686,19 @@ Manages cron jobs: execute jobs directly or generate and apply K8s CronJob manif
 
 | Argument | Description |
 | --- | --- |
-| `deploy-list` | A comma-separated list of deployment IDs (e.g., "default-a,default-b"). |
-| `job-list` | A comma-separated list of job IDs. Options: dns,backup. Defaults to all available jobs. |
+| `deploy-list` | A comma-separated list of deployment IDs (e.g., "default-a,default-b"). In manifest modes its first entry is the manifest owner deploy-id. |
+| `job-list` | A comma-separated list of job IDs. Options: dns,backup,vultr. Defaults to all available jobs, and restricts which jobs are generated in manifest modes. |
 
 #### Options
 
 | Option | Description |
 | --- | --- |
 | `--generate-k8s-cronjobs` | Generates Kubernetes CronJob YAML manifests from cron configuration. |
-| `--apply` | Applies generated K8s CronJob manifests to the cluster via kubectl. |
-| `--setup-start [deploy-id]` | Updates deploy-id package.json start script and generates+applies its K8s CronJob manifests. |
+| `--apply` | Generates and applies K8s CronJob manifests to the cluster via kubectl (never runs jobs). |
+| `--setup-start` | Updates deploy-list package.json start script and generates+applies its K8s CronJob manifests. |
 | `--namespace <namespace>` | Kubernetes namespace for the CronJob resources (default: "default"). |
 | `--image <image>` | Custom container image for the CronJob pods. |
+| `--node-name <node-name>` | Pins the CronJob pods to this node via a kubernetes.io/hostname nodeSelector. |
 | `--git` | Pass --git flag to cron job execution. |
 | `--cmd <cmd>` | Optional pre-script commands to run before cron execution. |
 | `--dev` | Use local ./ base path instead of global underpost installation. |
@@ -697,7 +706,7 @@ Manages cron jobs: execute jobs directly or generate and apply K8s CronJob manif
 | `--kind` | Use kind cluster context (apply via kind-worker container). |
 | `--kubeadm` | Use kubeadm cluster context (apply directly on host). |
 | `--dry-run` | Preview cron jobs without executing them. |
-| `--create-job-now` | After applying manifests, immediately create a Job from each CronJob (requires --apply). |
+| `--create-job-now` | Creates a Job from each CronJob on the cluster now (implies manifest mode; combine with --apply to publish first). |
 | `-h, --help` | display help for command |
 
 ---
@@ -827,6 +836,127 @@ Manages SSH credentials and sessions for remote access to cluster nodes or servi
 
 ---
 
+### underpost wireguard
+
+Manages the WireGuard L3 hub-and-spoke transport and the HAProxy edge gateway in front of it.
+
+**Usage:** `underpost wireguard [options]`
+
+#### Options
+
+| Option | Description |
+| --- | --- |
+| `--deploy-id <deploy-id>` | Deploy IDs whose conf.server.json/conf.instances.json define the routes. Accepts one id or a comma-separated list; defaults to "dd", every deploy in dd.router, because the edge holds one pair of map files for the whole cluster. |
+| `--interface <name>` | WireGuard interface name (default: "wg0"). |
+| `--wireguard-install` | Installs the wireguard-tools, haproxy and iptables host packages. |
+| `--wireguard-setup` | Generates keys, builds the interface config, and applies local network rules. |
+| `--server` | Configures this node as the hub endpoint accepting inbound tunnel traffic. |
+| `--client` | Configures this node as a spoke endpoint maintaining an outbound tunnel. |
+| `--port <port>` | WireGuard UDP listening port (default: 51820). |
+| `--cidr <cidr>` | Hub interface address with prefix when used with --server (e.g. "10.0.0.1/24"); the overlay subnet a spoke routes back through the hub when used with --client (default: "10.0.0.0/24"). |
+| `--peer-ip <ip>` | Tunnel address of the target spoke. Required with --client and --peer-add. |
+| `--endpoint <host:port>` | Hub host and port a spoke dials. Required with --client. |
+| `--public-key <key>` | Hub public key with --client; spoke public key with --peer-add. |
+| `--peer-add <peer-id>` | Registers a spoke and applies it to the running hub without a restart. |
+| `--peer-remove <peer-id>` | Removes a spoke from the registry and from the running hub. |
+| `--allowed-ips <cidrs>` | Comma-separated CIDRs routed to the spoke (e.g. "10.0.0.2/32,192.168.10.0/24"). |
+| `--hosts <hosts>` | Comma-separated hostnames bound to the spoke, overriding instance resolution. |
+| `--instances <instances>` | Comma-separated conf.instances.json ids bound to the spoke. |
+| `--default` | Marks the spoke as the fallback for hostnames that match no other binding. |
+| `--haproxy-setup` | Installs HAProxy, publishes the current routes, and enables the daemon. |
+| `--haproxy-sync` | Recompiles the SNI/Host maps from deploy config and hot-reloads HAProxy. |
+| `--status` | Prints the whole edge context without changing anything: role, interface, tunnel address, public key, daemon states, peers with their bindings and link health, and the resolved routing. |
+| `--build-conf` | Writes only engine-private/deploy/conf.wireguard.json and touches no host state. Combine with --wireguard-setup / --peer-add / --peer-remove to author the topology off-box; alone it normalizes and validates the existing registry. |
+| `--forward-proxy-server` | Ensures the hub HTTP/CONNECT forward proxy runs as the underpost-forward-proxy systemd service, bound to the tunnel address only (default port 1080), and returns. Authenticates every request with FORWARD_PROXY_API_KEY, so spokes can reach the internet through the VPS public address. Idempotent: re-running converges on the one service and restarts it only when the unit actually changed. |
+| `--forward-proxy-server-host <host>` | Address the forward proxy binds, overriding the hub tunnel address from the registry. |
+| `--forward-proxy-server-port <port>` | Port the forward proxy binds (default: 1080). |
+| `--ssh-forward-port <port>` | Publishes the default spoke SSH port on this public TCP port of the hub, so CI with no fixed address can reach the cluster node (e.g. 2222). "0" closes it. Stored in the registry. |
+| `--wireguard-start` | Enables and starts wg-quick@<interface> and the QUIC forward. |
+| `--wireguard-stop` | Tears down the interface and removes its transient packet rules. |
+| `--wireguard-reset` | Removes generated configs and packet rules, keeping the key pair and registry. |
+| `--wireguard-reinstall` | Full purge, package reinstall and re-key; every spoke must re-register. |
+| `--dry-run` | Prints the files and commands the run would apply, without touching the host. |
+| `-h, --help` | display help for command |
+
+---
+
+### underpost haproxy
+
+Manages the HAProxy edge gateway over the WireGuard transport (same subsystem as `underpost wireguard`).
+
+**Usage:** `underpost haproxy [options]`
+
+#### Options
+
+| Option | Description |
+| --- | --- |
+| `--deploy-id <deploy-id>` | Deploy IDs whose conf.server.json/conf.instances.json define the routes. Accepts one id or a comma-separated list; defaults to "dd", every deploy in dd.router, because the edge holds one pair of map files for the whole cluster. |
+| `--interface <name>` | WireGuard interface name (default: "wg0"). |
+| `--wireguard-install` | Installs the wireguard-tools, haproxy and iptables host packages. |
+| `--wireguard-setup` | Generates keys, builds the interface config, and applies local network rules. |
+| `--server` | Configures this node as the hub endpoint accepting inbound tunnel traffic. |
+| `--client` | Configures this node as a spoke endpoint maintaining an outbound tunnel. |
+| `--port <port>` | WireGuard UDP listening port (default: 51820). |
+| `--cidr <cidr>` | Hub interface address with prefix when used with --server (e.g. "10.0.0.1/24"); the overlay subnet a spoke routes back through the hub when used with --client (default: "10.0.0.0/24"). |
+| `--peer-ip <ip>` | Tunnel address of the target spoke. Required with --client and --peer-add. |
+| `--endpoint <host:port>` | Hub host and port a spoke dials. Required with --client. |
+| `--public-key <key>` | Hub public key with --client; spoke public key with --peer-add. |
+| `--peer-add <peer-id>` | Registers a spoke and applies it to the running hub without a restart. |
+| `--peer-remove <peer-id>` | Removes a spoke from the registry and from the running hub. |
+| `--allowed-ips <cidrs>` | Comma-separated CIDRs routed to the spoke (e.g. "10.0.0.2/32,192.168.10.0/24"). |
+| `--hosts <hosts>` | Comma-separated hostnames bound to the spoke, overriding instance resolution. |
+| `--instances <instances>` | Comma-separated conf.instances.json ids bound to the spoke. |
+| `--default` | Marks the spoke as the fallback for hostnames that match no other binding. |
+| `--haproxy-setup` | Installs HAProxy, publishes the current routes, and enables the daemon. |
+| `--haproxy-sync` | Recompiles the SNI/Host maps from deploy config and hot-reloads HAProxy. |
+| `--status` | Prints the whole edge context without changing anything: role, interface, tunnel address, public key, daemon states, peers with their bindings and link health, and the resolved routing. |
+| `--build-conf` | Writes only engine-private/deploy/conf.wireguard.json and touches no host state. Combine with --wireguard-setup / --peer-add / --peer-remove to author the topology off-box; alone it normalizes and validates the existing registry. |
+| `--forward-proxy-server` | Ensures the hub HTTP/CONNECT forward proxy runs as the underpost-forward-proxy systemd service, bound to the tunnel address only (default port 1080), and returns. Authenticates every request with FORWARD_PROXY_API_KEY, so spokes can reach the internet through the VPS public address. Idempotent: re-running converges on the one service and restarts it only when the unit actually changed. |
+| `--forward-proxy-server-host <host>` | Address the forward proxy binds, overriding the hub tunnel address from the registry. |
+| `--forward-proxy-server-port <port>` | Port the forward proxy binds (default: 1080). |
+| `--ssh-forward-port <port>` | Publishes the default spoke SSH port on this public TCP port of the hub, so CI with no fixed address can reach the cluster node (e.g. 2222). "0" closes it. Stored in the registry. |
+| `--wireguard-start` | Enables and starts wg-quick@<interface> and the QUIC forward. |
+| `--wireguard-stop` | Tears down the interface and removes its transient packet rules. |
+| `--wireguard-reset` | Removes generated configs and packet rules, keeping the key pair and registry. |
+| `--wireguard-reinstall` | Full purge, package reinstall and re-key; every spoke must re-register. |
+| `--dry-run` | Prints the files and commands the run would apply, without touching the host. |
+| `-h, --help` | display help for command |
+
+---
+
+### underpost vultr
+
+Meters the edge VPS bandwidth against its Vultr plan quota and blocks egress before overage accrues.
+
+**Usage:** `underpost vultr [options] [deploy-list]`
+
+#### Arguments
+
+| Argument | Description |
+| --- | --- |
+| `deploy-list` | A comma-separated list of deployment IDs, logged for attribution. |
+
+#### Options
+
+| Option | Description |
+| --- | --- |
+| `--instance-id <instance-id>` | Vultr instance id to meter (default: VULTR_INSTANCE_ID). |
+| `--api-key <api-key>` | Vultr API key (default: VULTR_API_KEY). Prefer the environment over this flag. |
+| `--threshold <ratio>` | Fraction of the plan quota that triggers the egress block; "0.80" and "80" are both accepted (default: 0.80). |
+| `--metric <metric>` | "total" (incoming + outgoing, default) or "outgoing" for egress alone. |
+| `--month <yyyy-mm>` | Billing month to sum (default: the current UTC month). |
+| `--all-dates` | Sum every daily bucket the API returns instead of scoping to one month. |
+| `--host <ip>` | Edge VPS to block (default: VULTR_VPS_IP, then DEFAULT_SSH_HOST). |
+| `--user <user>` | SSH user on the edge VPS (default: VULTR_SSH_USER, then DEFAULT_SSH_USER, then "root"). |
+| `--key-path <path>` | SSH private key (default: VULTR_SSH_KEY_PATH, then DEFAULT_SSH_KEY_PATH). |
+| `--port <port>` | SSH port on the edge VPS (default: VULTR_SSH_PORT, then DEFAULT_SSH_PORT, then 22). |
+| `--force` | Re-apply the egress block even if it was already applied for this cycle. |
+| `--auto-unblock` | Restore egress automatically once consumption falls back under the threshold. |
+| `--dry-run` | Reports the consumption and the action it would take, without touching the edge VPS. |
+| `-h, --help` | display help for command |
+
+---
+
 ### underpost run
 
 Runs specified scripts using various runners.
@@ -837,7 +967,7 @@ Runs specified scripts using various runners.
 
 | Argument | Description |
 | --- | --- |
-| `runner-id` | The runner ID to run. Options: status,expose,dev-cluster,metadata,ipfs-expose,svc-ls,svc-rm,node-move,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,tz,get-traffic,restore-mongo,ingress-refresh,instance-promote,instance,deploy-key,instance-build-manifest,ls-deployments,host-update,install-crio,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,gateway-status,deploy,disk-clean,disk-devices,disk-usage,dev,service,etc-hosts,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,pull-rocky-image,rmi,kill,generate-pass,sops-setup,sops-status,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job,push-bundle,pull-bundle,build-cluster-deployment-manifests,monitor-ui,shared-dir,shared-dir-add-user. |
+| `runner-id` | The runner ID to run. Options: status,expose,dev-cluster,metadata,ipfs-expose,svc-ls,svc-rm,node-move,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,tz,get-traffic,restore-mongo,ingress-refresh,instance-promote,instance,deploy-key,instance-build-manifest,ls-deployments,host-update,install-crio,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,gateway-status,deploy,disk-clean,disk-devices,disk-usage,dev,service,etc-hosts,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,pull-rocky-image,rmi,kill,generate-pass,sops-setup,sops-status,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job,push-bundle,pull-bundle,kubeadm-wireguard,build-cluster-deployment-manifests,monitor-ui,shared-dir,shared-dir-add-user. |
 | `path` | The input value, identifier, or path for the operation. |
 
 #### Options
@@ -887,7 +1017,7 @@ Runs specified scripts using various runners.
 | `--conf-server-path <conf-server-path>` | Sets a custom configuration server path. |
 | `--underpost-root <underpost-root>` | Sets a custom Underpost root path. |
 | `--cmd-cron-jobs <cmd-cron-jobs>` | Pre-script commands to run before cron job execution. |
-| `--deploy-id-cron-jobs <deploy-id-cron-jobs>` | Specifies deployment IDs to synchronize cron jobs with during execution. |
+| `--deploy-id-cron-jobs <deploy-id-cron-jobs>` | Cron deploy-id to set up during sync; defaults to dd.cron, "none" skips cron setup entirely. |
 | `--timezone <timezone>` | Sets the timezone for the runner execution. |
 | `--kubeadm` | Sets the kubeadm cluster context for the runner execution. |
 | `--k3s` | Sets the k3s cluster context for the runner execution. |

package/README.md

@@ -16,7 +16,7 @@
 
 <div align="center">
 
-[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![](https://data.jsdelivr.com/v1/package/npm/underpost/badge)](https://www.jsdelivr.com/package/npm/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.90)](https://socket.dev/npm/package/underpost/overview/3.2.90) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
+[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![](https://data.jsdelivr.com/v1/package/npm/underpost/badge)](https://www.jsdelivr.com/package/npm/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.3.0)](https://socket.dev/npm/package/underpost/overview/3.3.0) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
 
 </div>
 
@@ -88,7 +88,7 @@ npm run dev
 <!-- cli-index-start -->
 ## Underpost CLI
 
-> underpost ci/cd cli v3.2.90
+> underpost ci/cd cli v3.3.0
 
 **Usage:** `underpost [options] [command]`
 
@@ -127,6 +127,9 @@ npm run dev
 | [`test`](CLI-HELP.md#underpost-test) | Manages and runs tests, defaulting to the current Underpost default test suite. |
 | [`monitor`](CLI-HELP.md#underpost-monitor) | Manages health server monitoring for specified deployments. |
 | [`ssh`](CLI-HELP.md#underpost-ssh) | Manages SSH credentials and sessions for remote access to cluster nodes or services. |
+| [`wireguard`](CLI-HELP.md#underpost-wireguard) | Manages the WireGuard L3 hub-and-spoke transport and the HAProxy edge gateway in front of it. |
+| [`haproxy`](CLI-HELP.md#underpost-haproxy) | Manages the HAProxy edge gateway over the WireGuard transport (same subsystem as `underpost wireguard`). |
+| [`vultr`](CLI-HELP.md#underpost-vultr) | Meters the edge VPS bandwidth against its Vultr plan quota and blocks egress before overage accrues. |
 | [`run`](CLI-HELP.md#underpost-run) | Runs specified scripts using various runners. |
 | [`docker-compose`](CLI-HELP.md#underpost-docker-compose) | General-purpose Docker Compose development pipeline (mirrors the Kubernetes dev stack). |
 | [`lxd`](CLI-HELP.md#underpost-lxd) | Manages LXD virtual machines as K3s nodes (control plane or workers). |

package/bin/build.js

@@ -15,7 +15,6 @@ import {
 } from '../src/server/conf.js';
 import { loadDeployCatalog } from '../src/server/catalog.js';
 import Underpost from '../src/index.js';
-import { DOCKER_SCRIPTS } from '../src/api/cyberia-server-defaults/cyberia-server-defaults.js';
 
 const baseConfPath = './engine-private/conf/dd-cron/.env.production';
 if (fs.existsSync(baseConfPath)) dotenv.config({ path: baseConfPath, override: true });
@@ -114,6 +113,9 @@ const buildDeployTemplate = async (confName) => {
 
   switch (confName) {
     case 'dd-cyberia': {
+      const { CyberiaDependencies, DOCKER_SCRIPTS } = await import(
+        `../src/api/cyberia-server-defaults/cyberia-server-defaults.js`
+      );
       fs.copyFileSync(`./bin/cyberia.js`, `${basePath}/bin/cyberia.js`);
       fs.copyFileSync(
         `./.github/workflows/publish.cyberia.ci.yml`,
@@ -124,7 +126,6 @@ const buildDeployTemplate = async (confName) => {
       packageJson.bin.cyberia = 'bin/index.js';
       packageJson.keywords = catalog.keywords;
       packageJson.description = catalog.description;
-      const { CyberiaDependencies } = await import(`../src/api/cyberia-server-defaults/cyberia-server-defaults.js`);
       packageJson.dependencies = {
         underpost: '^' + Underpost.version.replace('v', ''),
         'adm-zip': '^0.6.0',
@@ -155,9 +156,10 @@ const buildDeployTemplate = async (confName) => {
     JSON.stringify(packageJson, null, 4).replaceAll('pwa-microservices-template', repoName),
     'utf8',
   );
-
-  fs.copySync(`./src/cli`, `${basePath}/src/cli`);
-  if (!fs.existsSync(`${basePath}/images`)) fs.mkdirSync(`${basePath}/images`);
+  if (fs.existsSync(`./deploy/${confName}`))
+    fs.copySync(`./deploy/${confName}`, `${basePath}/deploy/${confName}`, {
+      overwrite: true,
+    });
 
   fs.copyFileSync(`./.github/workflows/${repoName}.ci.yml`, `${basePath}/.github/workflows/${repoName}.ci.yml`);
   if (fs.existsSync(`./.github/workflows/docker-image.${repoName}.ci.yml`))

package/bin/deploy.js

@@ -14,10 +14,10 @@ import {
   addWsConf,
   buildWsSrc,
   cloneSrcComponents,
-  writeEnv,
   buildCliDoc,
   loadConf,
 } from '../src/server/conf.js';
+import { writeEnv } from '../src/server/environment.js';
 import colors from 'colors';
 import { program } from '../src/cli/index.js';
 import { timer, getCapVariableName } from '../src/client/components/core/CommonJs.js';

package/deploy/lib/logging.sh

@@ -0,0 +1,96 @@
+# Shared logging helpers for deploy/<deploy-id>/*.sh. Sourced, never executed directly.
+#
+# Deploy script contract:
+# - one run_quiet call per remote command, with its own label
+# - the body lives in main(), invoked on the last line: the first remote command
+#   pulls this repository, rewriting the running script while bash reads it
+#
+# run_quiet hides normal output, prints only `patterns` matches plus the next
+# `lines_after` lines, and returns the command's exit status so `set -e` stops
+# the deployment. On failure it keeps two temp files and prints their paths in
+# red instead of their contents: the command's own stderr (native error message
+# and stack trace) and the full unfiltered log up to the error.
+
+RUN_QUIET_RED=$'\033[0;31m'
+RUN_QUIET_RESET=$'\033[0m'
+
+RUN_QUIET_NODE_NAME=$(hostname 2>/dev/null | tr '[:upper:]' '[:lower:]')
+RUN_QUIET_NODE_TAG=${RUN_QUIET_NODE_NAME:+ [$RUN_QUIET_NODE_NAME]}
+
+run_quiet() {
+    local label="$1"
+    local patterns="$2"
+    local lines_after="$3"
+    shift 3
+    
+    local debug_log
+    local error_log
+    local fifo_dir
+    local filter_pid
+    local stderr_pid
+    local status=0
+    
+    echo "$(date -Is) $RUN_QUIET_NODE_TAG ▶ $label"
+    
+    debug_log=$(mktemp --suffix=.debug.log)
+    error_log=$(mktemp --suffix=.error.log)
+    fifo_dir=$(mktemp -d)
+    mkfifo "$fifo_dir/merged" "$fifo_dir/stderr"
+    
+    # The filter reads the live stream rather than the finished log: a deployment
+    # monitor prints its matches for minutes before exiting, so a pass over the
+    # completed file would show nothing until then. fflush defeats awk's block
+    # buffering, which otherwise withholds matches whenever stdout is a pipe.
+    # awk writes the debug log itself rather than piping through tee, so the
+    # reader stays a single process that a kill can always release.
+    awk \
+    -v pattern="$patterns" \
+    -v lines_after="$lines_after" \
+    -v debug_log="$debug_log" '
+        {
+            print > debug_log
+        }
+        $0 ~ pattern {
+            remaining = lines_after + 1
+        }
+        remaining > 0 {
+            print
+            fflush()
+            remaining--
+        }
+    ' <"$fifo_dir/merged" &
+    filter_pid=$!
+    
+    # stderr is duplicated: on its own for the native error and stack trace, and
+    # into the merged stream so both the debug log and the filter see it in
+    # chronological order with stdout.
+    tee -a "$error_log" <"$fifo_dir/stderr" >"$fifo_dir/merged" &
+    stderr_pid=$!
+    
+    "$@" >"$fifo_dir/merged" 2>"$fifo_dir/stderr" || status=$?
+    
+    # Drain both readers before the paths are printed, or the trace can still be
+    # in flight. Bounded: a command that leaks a child holding a stream open must
+    # not hang the deployment, and by then everything read has been written.
+    run_quiet_drain "$stderr_pid"
+    run_quiet_drain "$filter_pid"
+    rm -rf "$fifo_dir"
+    
+    if [ "$status" -ne 0 ]; then
+        printf '%s✖ %s failed (exit %s)\n  error trace: %s\n  debug log:   %s%s\n' \
+        "$RUN_QUIET_RED" "$label" "$status" "$error_log" "$debug_log" "$RUN_QUIET_RESET" >&2
+        return "$status"
+    fi
+    
+    rm -f "$debug_log" "$error_log"
+    
+    return "$status"
+}
+
+run_quiet_drain() {
+    local pid="$1"
+    
+    timeout 10 tail --pid="$pid" -f /dev/null 2>/dev/null || true
+    kill "$pid" 2>/dev/null || true
+    wait "$pid" 2>/dev/null || true
+}