underpost 3.2.90 → 3.3.0

package/deploy/pwa-microservices-template/deploy.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/logging.sh"
+
+# Runs in the workflow's rockylinux:9 container against the checked-out
+# workspace instead of over SSH, so the repository root is this script's
+# grandparent rather than a fixed remote path.
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+main() {
+    echo "Starting github pages deploy"
+
+    cd "$REPO_ROOT"
+
+    run_quiet \
+        "Install required packages" \
+        "Target pod:" \
+        14 \
+        dnf install -y sudo tar gzip bzip2 git
+
+    run_quiet \
+        "Install curl" \
+        "Target pod:" \
+        14 \
+        dnf install -y curl --allowerasing
+
+    run_quiet \
+        "Add Node.js repository" \
+        "Target pod:" \
+        14 \
+        bash -c "curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -"
+
+    run_quiet \
+        "Install Node.js" \
+        "Target pod:" \
+        14 \
+        dnf install nodejs -y
+
+    run_quiet \
+        "Install dependencies" \
+        "Target pod:" \
+        14 \
+        npm install
+
+    run_quiet \
+        "Build dd-github-pages configuration" \
+        "Target pod:" \
+        14 \
+        node bin new --default-conf --conf-workflow-id dd-github-pages
+
+    run_quiet \
+        "Create dd-github-pages deployment" \
+        "Target pod:" \
+        14 \
+        node bin new --deploy-id dd-github-pages
+
+    run_quiet \
+        "Load dd-github-pages production environment" \
+        "Target pod:" \
+        14 \
+        node bin env dd-github-pages production
+
+    run_quiet \
+        "Build dd-github-pages client" \
+        "Target pod:" \
+        14 \
+        env NODE_ENV=production node bin client dd-github-pages '' underpostnet.github.io /pwa-microservices-template-ghpkg
+}
+
+main "$@"

package/deploy/release/deploy.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/logging.sh"
+
+ENGINE_ROOT=/home/dd/engine
+
+main() {
+    echo "Starting remote release deploy"
+
+    run_quiet \
+        "Pull repository" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run pull"
+
+    run_quiet \
+        "Install dependencies" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install"
+
+    run_quiet \
+        "Sync secrets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run secret"
+
+    run_quiet \
+        "Install underpost CLI" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install -g underpost"
+
+    run_quiet \
+        "Resync secrets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run secret"
+
+    run_quiet \
+        "Configure git" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run --dev git-conf"
+
+    run_quiet \
+        "Build and publish docker images" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run docker-image"
+}
+
+main "$@"

package/docker-compose.yml

@@ -81,7 +81,7 @@ services:
   # (dd-default-development-blue). Connection targets use Docker service
   # discovery instead of hardcoded localhost.
   app:
-    image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.2.90}
+    image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.3.0}
     container_name: dd-app
     # The start command is supplied by the generated override docker/compose.app.yml
     # (see `underpost docker-compose --generate --deploy-id <id>`), keeping this

package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml

@@ -14,6 +14,10 @@ spec:
   failedJobsHistoryLimit: 1
   suspend: false
   jobTemplate:
+    metadata:
+      labels:
+        app: dd-cron-backup
+        managed-by: underpost
     spec:
       template:
         metadata:
@@ -23,7 +27,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-backup
-              image: underpost/underpost-engine:v3.2.90
+              image: underpost/underpost-engine:v3.3.0
               command:
                 - /bin/sh
                 - -c

package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-dns
-              image: underpost/underpost-engine:v3.2.90
+              image: underpost/underpost-engine:v3.3.0
               command:
                 - /bin/sh
                 - -c

package/manifests/cronjobs/dd-cron/dd-cron-vultr.yaml

@@ -0,0 +1,52 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: dd-cron-vultr
+  namespace: default
+  labels:
+    app: dd-cron-vultr
+    managed-by: underpost
+spec:
+  schedule: "*/30 * * * *"
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 200
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
+  suspend: false
+  jobTemplate:
+    metadata:
+      labels:
+        app: dd-cron-vultr
+        managed-by: underpost
+    spec:
+      template:
+        metadata:
+          labels:
+            app: dd-cron-vultr
+            managed-by: underpost
+        spec:
+          containers:
+            - name: dd-cron-vultr
+              image: underpost/underpost-engine:v3.3.0
+              command:
+                - /bin/sh
+                - -c
+                - >
+                  cd /home/dd/engine &&
+                  node bin env dd-cron production &&
+                  node bin cron dd-cron vultr --git --kubeadm 
+              volumeMounts:
+                - mountPath: /home/dd/engine
+                  name: underpost-cron-container-volume
+                - mountPath: /usr/lib/node_modules/underpost
+                  name: underpost-share-env
+          volumes:
+            - hostPath:
+                path: /home/dd/engine
+                type: Directory
+              name: underpost-cron-container-volume
+            - hostPath:
+                path: /root/.nvm/versions/node/v24.15.0/lib/node_modules/underpost
+                type: DirectoryOrCreate
+              name: underpost-share-env
+          restartPolicy: OnFailure

package/manifests/deployment/dd-default-development/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-blue
-          image: underpost/underpost-engine:v3.2.90
+          image: underpost/underpost-engine:v3.3.0
           #          resources:
           #            requests:
           #              memory: "124Ki"
@@ -98,7 +98,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-green
-          image: underpost/underpost-engine:v3.2.90
+          image: underpost/underpost-engine:v3.3.0
           #          resources:
           #            requests:
           #              memory: "124Ki"

package/package.json

@@ -2,7 +2,7 @@
     "type": "module",
     "main": "src/index.js",
     "name": "underpost",
-    "version": "3.2.90",
+    "version": "3.3.0",
     "description": "Underpost Platform — end-to-end CI/CD and application-delivery toolchain CLI. Covers bare metal, Kubernetes, K3s, kubeadm, LXD, container/image orchestration, secrets, databases, cron jobs, monitoring, SSH, runners, PWA + Workbox delivery, and release orchestration. Extensible via downstream CLIs.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
@@ -78,7 +78,7 @@
         "@neodrag/vanilla": "^2.3.1",
         "adm-zip": "^0.6.0",
         "ag-grid-community": "^36.1.0",
-        "bumpp": "^12.2.0",
+        "bumpp": "^12.2.1",
         "axios": "^1.19.0",
         "chai": "^6.2.2",
         "clipboardy": "^5.3.2",
@@ -89,10 +89,10 @@
         "cookie-parser": "^1.4.7",
         "cors": "^2.8.6",
         "d3": "^7.9.0",
-        "dexie": "^4.4.4",
+        "dexie": "^4.4.5",
         "dotenv": "^17.4.2",
         "easymde": "^2.21.0",
-        "esbuild": "^0.28.1",
+        "esbuild": "^0.28.2",
         "escape-string-regexp": "^5.0.0",
         "express": "^5.2.1",
         "express-fileupload": "^1.4.3",
@@ -111,7 +111,7 @@
         "jsonwebtoken": "^9.0.3",
         "mariadb": "^3.5.3",
         "marked": "^18.0.9",
-        "mongoose": "^9.9.1",
+        "mongoose": "^9.9.2",
         "mocha": "^11.8.0",
         "morgan": "^1.11.0",
         "nodemailer": "^9.0.5",

package/scripts/audit-selinux.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SINCE="recent"
+FAIL_ON_AVC="1"
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --since)
+            [ "$#" -ge 2 ] || { echo "--since requires an ausearch time value" >&2; exit 2; }
+            SINCE="$2"
+            shift 2
+            ;;
+        --no-fail)
+            FAIL_ON_AVC="0"
+            shift
+            ;;
+        -h|--help)
+            echo "Usage: $0 [--since recent|today|boot|TIME] [--no-fail]"
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            exit 2
+            ;;
+    esac
+done
+
+command -v getenforce >/dev/null 2>&1 || {
+    echo "SELinux userspace is unavailable. Install policycoreutils." >&2
+    exit 2
+}
+command -v ausearch >/dev/null 2>&1 || {
+    echo "ausearch is unavailable. Install audit and start auditd." >&2
+    exit 2
+}
+
+MODE="$(getenforce)"
+echo "SELinux mode: $MODE"
+[ "$MODE" = "Enforcing" ] || echo "WARNING: expected Enforcing mode" >&2
+command -v sestatus >/dev/null 2>&1 && sestatus
+
+AUDIT=(ausearch)
+[ "$(id -u)" -eq 0 ] || AUDIT=(sudo ausearch)
+RAW_FILE="$(mktemp /tmp/underpost-selinux-avc.XXXXXX)"
+trap 'rm -f "$RAW_FILE"' EXIT
+
+"${AUDIT[@]}" -m AVC,USER_AVC,SELINUX_ERR -ts "$SINCE" --raw > "$RAW_FILE" 2>/dev/null || true
+if ! grep -q '^type=' "$RAW_FILE"; then
+    echo "No SELinux AVC denials found since: $SINCE"
+    [ "$MODE" = "Enforcing" ]
+    exit
+fi
+
+echo "SELinux AVC denials found since: $SINCE" >&2
+"${AUDIT[@]}" -m AVC,USER_AVC,SELINUX_ERR -ts "$SINCE" -i || true
+if command -v sealert >/dev/null 2>&1; then
+    echo "sealert analysis:"
+    sealert -a "$RAW_FILE" || true
+else
+    echo "Install setroubleshoot-server for sealert analysis." >&2
+fi
+
+[ "$FAIL_ON_AVC" = "0" ] || exit 1

package/scripts/coverall-test.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -u -o pipefail
+
+EXCLUDES=(
+    --exclude="test/cyberia-instance-conf-defaults.test.js"
+    --exclude="test/cyberia-load.test.js"
+    --exclude="test/object-layer-item-id.test.js"
+    --exclude="test/api.test.js"
+    --exclude="test/crypto.test.js"
+    --exclude="test/shape-generator.test.js"
+)
+
+TESTS=(
+    test/cluster-instances.test.js
+    test/deploy-monitor.test.js
+    test/deploy-node-placement.test.js
+    test/instance-traffic-plan.test.js
+    test/sops-secret-store.test.js
+    test/underpost-gateway.test.js
+    test/underpost-ingress.test.js
+    test/wireguard-edge.test.js
+)
+
+c8 "${EXCLUDES[@]}" mocha "${TESTS[@]}"

package/scripts/k3s-node-setup.sh

@@ -49,22 +49,25 @@ if [ -z "$(ls -A "$ENGINE_ROOT")" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# NVM and Node.js — required for `node bin ...` entrypoints
+# System-wide Node.js is required by service units under SELinux.
 # ---------------------------------------------------------------------------
-echo "Installing NVM and Node.js v24.15.0..."
-
-curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
-
-export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-# shellcheck disable=SC1090
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+if command -v dnf >/dev/null 2>&1; then
+    sudo dnf install -y policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
+fi
 
-nvm install 24.15.0
-nvm use 24.15.0
-nvm alias default 24.15.0
-ln -sf "$(command -v node)" /usr/local/bin/node
-ln -sf "$(command -v npm)" /usr/local/bin/npm
-ln -sf "$(command -v npx)" /usr/local/bin/npx
+if ! command -v node >/dev/null 2>&1 || ! node --version 2>/dev/null | grep -q '^v24'; then
+    echo "Installing system-wide Node.js 24..."
+    if command -v dnf >/dev/null 2>&1; then
+        curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+        sudo dnf install -y nodejs
+    elif command -v apt-get >/dev/null 2>&1; then
+        curl -fsSL https://deb.nodesource.com/setup_24.x | sudo bash -
+        sudo apt-get install -y nodejs
+    else
+        echo "ERROR: a supported system package manager is required for Node.js 24" >&2
+        exit 1
+    fi
+fi
 
 echo "
 ██╗░░░██╗███╗░░██╗██████╗░███████╗██████╗░██████╗░░█████╗░░██████╗████████╗
@@ -116,7 +119,7 @@ if [ "$ROLE" = "control" ]; then
     curl -sfL https://get.k3s.io | \
     K3S_URL="https://${CONTROL_IP}:6443" \
     K3S_TOKEN="${K3S_TOKEN}" \
-    sh -s - agent
+    sh -s - agent $(if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then printf '%s' '--selinux'; fi)
     
     echo ""
     echo "K3s worker joined https://${CONTROL_IP}:6443 successfully."

package/scripts/kubeadm-node-setup.sh

@@ -5,8 +5,8 @@ set -euo pipefail
 # Underpost Kubeadm Node Setup (bare-metal physical node)
 #
 # Mirrors scripts/k3s-node-setup.sh but for kubeadm on real hardware: it runs on
-# the freshly deployed OS (disk-installed Rocky) after first boot, installs NVM +
-# Node.js, ensures the engine source is present, and drives the cluster bring-up
+# the freshly deployed OS (disk-installed Rocky) after first boot, installs
+# system-wide Node.js, ensures the engine source is present, and drives the cluster bring-up
 # through the local engine entrypoint `node bin cluster` (src/cli/cluster.js) —
 # reusing its kubeadm + Contour + host-init logic instead of reimplementing it.
 #
@@ -146,33 +146,22 @@ if [ "$JOIN_ONLY" = "1" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 0. Base prerequisites — a minimal @core Rocky install lacks tar/xz/git, which
-#    NVM needs to extract Node.js and the engine clone needs. Install them first.
+# 0. Base prerequisites.
 # ---------------------------------------------------------------------------
-log "Installing base prerequisites (tar, xz, gzip, git, curl)..."
-sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils 2>/dev/null \
-|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils
+log "Installing base prerequisites..."
+sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit 2>/dev/null \
+|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
 
 # ---------------------------------------------------------------------------
-# 1. NVM and Node.js — required for the `node bin ...` entrypoints. Idempotent so
-#    a retried run does not reinstall Node from scratch.
+# 1. System-wide Node.js. Home-directory runtimes cannot be used by hardened
+#    systemd services under SELinux.
 # ---------------------------------------------------------------------------
 if command -v node >/dev/null 2>&1 && node --version 2>/dev/null | grep -q '^v24'; then
-    log "Node.js $(node --version) already installed; skipping NVM setup"
+    log "Node.js $(node --version) already installed"
 else
-    log "Installing NVM and Node.js v24.15.0..."
-    curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
-    
-    export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-    # shellcheck disable=SC1090
-    [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
-    
-    nvm install 24.15.0
-    nvm use 24.15.0
-    nvm alias default 24.15.0
-    ln -sf "$(command -v node)" /usr/local/bin/node
-    ln -sf "$(command -v npm)" /usr/local/bin/npm
-    ln -sf "$(command -v npx)" /usr/local/bin/npx
+    log "Installing system-wide Node.js 24..."
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+    sudo dnf install -y nodejs
 fi
 
 echo "

package/scripts/nat-iptables.sh

@@ -42,12 +42,14 @@ echo "[INFO] Opening Kubernetes control plane ports..."
 
 # Kubernetes API Server
 sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=6443/udp
 
 # etcd
 sudo firewall-cmd --permanent --zone=public --add-port=2379-2380/tcp
 
 # kubelet API
 sudo firewall-cmd --permanent --zone=public --add-port=10250/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=10250/udp
 
 # kube-scheduler
 sudo firewall-cmd --permanent --zone=public --add-port=10259/tcp

package/scripts/rocky-kickstart.sh

@@ -168,7 +168,7 @@ PermitEmptyPasswords no
 PasswordAuthentication ${SSHD_PASSWORD_AUTH}
 ChallengeResponseAuthentication ${SSHD_KBD_INTERACTIVE}
 KbdInteractiveAuthentication ${SSHD_KBD_INTERACTIVE}
-UsePAM no
+UsePAM yes
 X11Forwarding no
 PrintMotd no
 TCPKeepAlive yes
@@ -585,7 +585,7 @@ fi
 post_status "installing" "\"detail\":\"installing packages\",\"disk\":\"\$REAL_DISK\""
 
 ilog "Installing base packages with dnf --installroot ..."
-PKGS="@core kernel grub2-tools openssh-server NetworkManager chrony dracut-config-generic rocky-release"
+PKGS="@core kernel grub2-tools openssh-server NetworkManager chrony dracut-config-generic rocky-release policycoreutils policycoreutils-python-utils selinux-policy-targeted audit sudo"
 if [ "\$FW" = "uefi" ]; then
     PKGS="\$PKGS grub2-efi-x64 shim-x64 efibootmgr"
 else
@@ -622,15 +622,10 @@ ilog "Configuring installed system (hostname, network, ssh, users) ..."
 echo "\${TARGET_HOSTNAME:-rocky9}" > "\$TARGET_MNT/etc/hostname"
 
 chroot "\$TARGET_MNT" /bin/bash -s << CHROOTEOF >> "\$KS_LOG" 2>&1
-set +e
+set -e
 systemctl enable sshd NetworkManager chronyd 2>/dev/null
 
-# SELinux -> permissive in the DEPLOYED OS. Critical: with SELinux enforcing on
-# first boot, files written from this installer chroot (authorized_keys, home
-# dirs) carry the wrong security context, so sshd drops sessions ("Connection
-# reset by peer") and PAM can block console logins. Permissive ignores contexts
-# (no relabel reboot needed) and matches what kubeadm/cluster.js expect.
-sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config 2>/dev/null || true
+sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
 
 # Ensure sshd host keys exist so sshd actually starts on first boot.
 ssh-keygen -A 2>/dev/null || true
@@ -708,11 +703,19 @@ fi
 # Key-only SSH on the installed system.
 mkdir -p /etc/ssh/sshd_config.d
 cat > /etc/ssh/sshd_config.d/00-underpost.conf <<SSHDEOF
+Port ${SSH_PORT}
 PermitRootLogin prohibit-password
 PubkeyAuthentication yes
 PasswordAuthentication no
+KbdInteractiveAuthentication no
+UsePAM yes
 SSHDEOF
 
+if [ "${SSH_PORT}" != "22" ]; then
+    semanage port -a -t ssh_port_t -p tcp "${SSH_PORT}" 2>/dev/null || \
+        semanage port -m -t ssh_port_t -p tcp "${SSH_PORT}"
+fi
+
 # Create the admin login accounts. create_user <name> writes the authorized key,
 # wheel membership and passwordless sudo. Passwords are applied after the chroot.
 create_user() {
@@ -738,11 +741,24 @@ chmod 600 /root/.ssh/authorized_keys
 create_user "\${ADMIN_USER}"
 create_user "\${DEPLOY_USER}"
 
+restorecon -RF /etc/ssh /etc/sudoers.d /root/.ssh /home 2>/dev/null
+touch /.autorelabel
+
 # Build initramfs for the installed kernel.
 KVER=\\\$(ls /lib/modules | head -1)
 [ -n "\\\$KVER" ] && dracut -f /boot/initramfs-\\\$KVER.img "\\\$KVER"
 CHROOTEOF
 
+CHROOT_RC=\$?
+if [ "\$CHROOT_RC" -ne 0 ]; then
+    ilog "FATAL: installed-system configuration failed (rc=\$CHROOT_RC)"
+    post_status "failed" "\"detail\":\"installed-system configuration rc=\$CHROOT_RC\""
+    for d in dev proc sys run; do umount -l "\$TARGET_MNT/\$d" 2>/dev/null; done
+    umount -R "\$TARGET_MNT" 2>/dev/null || true
+    rm -f "\$INSTALL_LOCK"
+    exit 1
+fi
+
 # Set console passwords AFTER the chroot heredoc, from decoded installer vars.
 # Primary path: pipe 'user:password' into 'chroot chpasswd' (keeps password
 # characters out of any heredoc). Fallback: hash with openssl and apply via

package/scripts/test-monitor.sh

@@ -24,7 +24,7 @@ MODE=runtime                                  # runtime | instance
 ENV=development                               # development | production
 DEPLOY_ID=dd-test                             # deploy id (instance mode: parent of conf.instances.json)
 INSTANCE_IDS=                                 # instance mode: csv of ids (default: all in conf.instances.json)
-IMAGE=underpost/wp:v3.2.90                    # runtime mode image (instance mode reads image from conf)
+IMAGE=underpost/wp:v3.3.0                    # runtime mode image (instance mode reads image from conf)
 VERSIONS=green                                # csv of blue/green versions
 REPLICAS=1                                    # replicas per deployment
 NAMESPACE=default                             # k8s namespace

package/src/cli/baremetal.js

@@ -5,9 +5,8 @@
  */
 
 import { fileURLToPath } from 'url';
-import { getNpmRootPath, getUnderpostRootPath } from '../server/conf.js';
+import { getNpmRootPath } from '../server/environment.js';
 import { pbcopy, shellExec } from '../server/process.js';
-import dotenv from 'dotenv';
 import { loggerFactory, loggerMiddleware } from '../server/logger.js';
 import fs from 'fs-extra';
 import path from 'path';

package/src/cli/cloud-init.js

@@ -8,7 +8,7 @@
 import { shellExec } from '../server/process.js';
 import fs from 'fs-extra';
 import { loggerFactory } from '../server/logger.js';
-import { getNpmRootPath } from '../server/conf.js';
+import { getNpmRootPath } from '../server/environment.js';
 import Underpost from '../index.js';
 
 const logger = loggerFactory(import.meta);