underpost 3.2.90 → 3.3.0

package/src/cli/cluster.js

@@ -4,10 +4,18 @@
  * @namespace UnderpostCluster
  */
 
-import { clusterTypeFactory, gatewayApiEnabledFactory, getNpmRootPath, resolveReplicaCount } from '../server/conf.js';
+import { clusterTypeFactory, gatewayApiEnabledFactory, resolveReplicaCount } from '../server/conf.js';
+import { getNpmRootPath, HOST_VOLUME_ROOT } from '../server/environment.js';
 import { loggerFactory } from '../server/logger.js';
 import { shellExec } from '../server/process.js';
 import { crictlCommandFactory, resolveCriSocket } from '../server/cri.js';
+import {
+  runSELinuxCommands,
+  selinuxContainerSharedContextCommandsFactory,
+  selinuxEnforcingCommandsFactory,
+  selinuxPackagesCommandFactory,
+  selinuxRestoreconCommandFactory,
+} from '../server/selinux.js';
 import { UNDERPOST_GATEWAY, seedDefaultStatusPage } from '../server/underpost-gateway.js';
 import {
   UNDERPOST_INGRESS,
@@ -24,17 +32,31 @@ import Underpost from '../index.js';
 
 const logger = loggerFactory(import.meta);
 
-// Pinned Gateway API control plane. The CRD release and the implementation are
-// upgraded together, and the pairing is not free choice: Envoy Gateway builds
-// against one `sigs.k8s.io/gateway-api` version (v1.8.3 -> v1.5.1) and reads
-// fields the older CRD schemas do not define, which the API
-// server silently strips. Check the implementation's go.mod before moving
-// either pin.
 const GATEWAY_API_RELEASE = 'v1.5.1';
 const ENVOY_GATEWAY_VERSION = 'v1.8.3';
-// Namespace the upstream Contour render deploys into, and the only one where an
-// `app=envoy` selector resolves to its DaemonSet.
 const CONTOUR_NAMESPACE = 'projectcontour';
+const KUBEADM_CONTAINER_MOUNT_PATHS = ['/etc/kubernetes', '/var/lib/etcd', '/var/lib/calico'];
+const HOST_VOLUME_PATHS = ['/data', '/opt/local-path-provisioner', HOST_VOLUME_ROOT];
+const K3S_SELINUX_PATHS = [
+  '/usr/local/bin/k3s',
+  '/etc/rancher',
+  '/var/lib/rancher',
+  '/var/lib/kubelet',
+  '/var/lib/cni',
+];
+
+const shareWithContainers = (paths = []) => {
+  for (const path of paths) shellExec(`sudo mkdir -p ${path}`);
+  runSELinuxCommands(selinuxContainerSharedContextCommandsFactory(paths), { execute: shellExec });
+};
+
+const enforceSELinux = (paths = []) => {
+  shellExec(
+    `if [ -f /etc/redhat-release ] && command -v dnf >/dev/null 2>&1 && { ! command -v restorecon >/dev/null 2>&1 || ! command -v semanage >/dev/null 2>&1; }; then ${selinuxPackagesCommandFactory()}; fi`,
+  );
+  const commands = selinuxEnforcingCommandsFactory({ restorePaths: paths });
+  runSELinuxCommands(commands, { execute: shellExec });
+};
 
 /**
  * @class UnderpostCluster
@@ -227,8 +249,11 @@ class UnderpostCluster {
           // balancer. The platform exposes services explicitly via Project
           // Contour / Envoy and NodePort services (see --node-port); leaving the
           // K3s built-ins enabled would bind the same host ports and conflict.
-          shellExec(`curl -sfL https://get.k3s.io | sh -s - --disable=traefik --disable=servicelb`);
+          shellExec(
+            `curl -sfL https://get.k3s.io | sh -s - $(if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then printf '%s' '--selinux'; fi) --disable=traefik --disable=servicelb`,
+          );
           logger.info('K3s installation completed.');
+          runSELinuxCommands([selinuxRestoreconCommandFactory(K3S_SELINUX_PATHS)], { execute: shellExec });
 
           Underpost.cluster.chown('k3s');
 
@@ -240,6 +265,7 @@ class UnderpostCluster {
         } else if (options.kubeadm) {
           Underpost.cluster.config();
           Underpost.cluster.natSetup({ underpostRoot });
+          shareWithContainers([...KUBEADM_CONTAINER_MOUNT_PATHS, ...HOST_VOLUME_PATHS]);
           logger.info('Initializing Kubeadm control plane...');
           // Set default values if not provided
           const podNetworkCidr = options.podNetworkCidr || '192.168.0.0/16';
@@ -272,6 +298,13 @@ class UnderpostCluster {
           shellExec(
             `kubectl apply -f https://cdn.jsdelivr.net/gh/rancher/local-path-provisioner@master/deploy/local-path-storage.yaml`,
           );
+
+          // The CNI lands asynchronously, and the node stays NotReady until it
+          // does. Block here so the deploy steps that follow (MongoDB and the
+          // application workloads) schedule onto a node that can actually run
+          // them, instead of racing the Calico rollout.
+          logger.info('Waiting for the node to become Ready (Calico rollout)...');
+          shellExec(`kubectl wait --for=condition=Ready node --all --timeout=300s`);
         } else {
           Underpost.cluster.config();
           Underpost.cluster.natSetup({ underpostRoot });
@@ -1198,11 +1231,13 @@ EOF
         }
       }
       const liveConf = canHotReload
-        ? `${execIngress('cat /tmp/nginx.conf', {
-            stdout: true,
-            silent: true,
-            silentOnError: true,
-          }) || ''}`
+        ? `${
+            execIngress('cat /tmp/nginx.conf', {
+              stdout: true,
+              silent: true,
+              silentOnError: true,
+            }) || ''
+          }`
         : '';
       const shouldHotReload = canHotReload && liveConf.trimEnd() !== `${conf}`.trimEnd();
 
@@ -1222,10 +1257,10 @@ EOF
             { silent: true },
           );
         } catch (error) {
-          execIngress(
-            `sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`,
-            { silent: true, silentOnError: true },
-          );
+          execIngress(`sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`, {
+            silent: true,
+            silentOnError: true,
+          });
           throw error;
         }
       }
@@ -1241,10 +1276,10 @@ EOF
 `);
       } catch (error) {
         if (shouldHotReload)
-          execIngress(
-            `sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`,
-            { silent: true, silentOnError: true },
-          );
+          execIngress(`sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`, {
+            silent: true,
+            silentOnError: true,
+          });
         throw error;
       }
       if (shouldHotReload)
@@ -1257,18 +1292,16 @@ EOF
       // ready replica that made canHotReload true. Do not let the caller delete
       // the old route kind until the replacement edge is actually Available.
       if (!canHotReload || changesNode)
-        shellExec(
-          `kubectl rollout status deployment/${UNDERPOST_INGRESS.name} -n ${namespace} --timeout=5m`,
-          { silent: true },
-        );
+        shellExec(`kubectl rollout status deployment/${UNDERPOST_INGRESS.name} -n ${namespace} --timeout=5m`, {
+          silent: true,
+        });
       else if (shouldHotReload)
         // `nginx -s reload` returns after signalling the master. Give it one
         // scheduling turn to start the new workers before the caller removes
         // the old stack's route object.
         shellExec('sleep 1', { silent: true });
       shellExec(
-        `kubectl wait --for=condition=Available deployment/${UNDERPOST_INGRESS.name} ` +
-          `-n ${namespace} --timeout=5m`,
+        `kubectl wait --for=condition=Available deployment/${UNDERPOST_INGRESS.name} ` + `-n ${namespace} --timeout=5m`,
         { silent: true },
       );
       execIngress('nginx -t -c /tmp/nginx.conf', { silent: true });
@@ -1350,26 +1383,17 @@ EOF
     config(options = { underpostRoot: '.' }) {
       const { underpostRoot } = options;
       console.log('Applying host configuration: SELinux, Docker, Containerd, and Sysctl settings.');
-      // Disable SELinux (permissive mode)
-      shellExec(`sudo setenforce 0`, {
-        silentOnError: true,
-      });
-      shellExec(`sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config`, {
-        silentOnError: true,
-      });
+      enforceSELinux(['/var/lib/kubelet', '/var/lib/containerd']);
 
       // Enable and start Docker and Kubelet services
       shellExec(`sudo systemctl enable --now docker`); // Docker might not be needed for K3s
       shellExec(`sudo systemctl enable --now kubelet`); // Kubelet might not be needed for K3s (K3s uses its own agent)
 
-      // Configure containerd for SystemdCgroup and explicitly disable SELinux
-      // This is crucial for kubelet/k3s to interact correctly with containerd
+      // Configure containerd for systemd cgroups and SELinux labeling.
       shellExec(`containerd config default | sudo tee /etc/containerd/config.toml > /dev/null`);
       shellExec(`sudo sed -i -e "s/SystemdCgroup = false/SystemdCgroup = true/g" /etc/containerd/config.toml`);
-      // Add a new line to disable SELinux for the runc runtime
-      // shellExec(
-      //   `sudo sed -i '/SystemdCgroup = true/a       selinux_disabled = true' /etc/containerd/config.toml`,
-      // );
+      shellExec(`sudo sed -i -e "s/enable_selinux = false/enable_selinux = true/g" /etc/containerd/config.toml`);
+      runSELinuxCommands([selinuxRestoreconCommandFactory('/etc/containerd')], { execute: shellExec });
       // Restart docker after containerd config changes. Rocky 9 uses systemctl,
       // not the legacy service command.
       shellExec(`sudo systemctl restart docker || sudo service docker restart || true`);
@@ -1400,7 +1424,7 @@ EOF
      * This applies only what K3s genuinely requires, and every step is guarded
      * so it is a no-op when the relevant tooling is absent (e.g. minimal images
      * without SELinux userspace):
-     *   - SELinux → permissive (only if SELinux tooling is present).
+     *   - SELinux remains Enforcing.
      *   - swap off (Kubernetes best practice).
      *   - br_netfilter + bridge/forward sysctls (pod networking).
      *   - inotify limits.
@@ -1415,16 +1439,8 @@ EOF
       // forever (the upstream unit ships TimeoutStartSec=0).
       shellExec(`if systemctl is-active --quiet firewalld; then sudo systemctl disable --now firewalld; fi`);
 
-      // SELinux → permissive, but only when the tooling exists. Rocky has it;
-      // minimal LXD images may not. K3s also installs k3s-selinux for enforcing
-      // mode, so this is a best-effort dev convenience, not a hard requirement.
-      shellExec(`if command -v setenforce >/dev/null 2>&1; then sudo setenforce 0; fi`, {
-        silentOnError: true,
-      });
-      shellExec(
-        `if [ -f /etc/selinux/config ]; then sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config; fi`,
-        { silentOnError: true },
-      );
+      enforceSELinux(K3S_SELINUX_PATHS);
+      shareWithContainers(HOST_VOLUME_PATHS);
 
       // Disable swap. `swapoff -a` is a no-op without swap; the sed only edits
       // fstab when a swap line is present.
@@ -1697,17 +1713,8 @@ fi`);
       if (options.removeVolumeHostPaths) Underpost.cluster._cleanHostPathPvs();
       else logger.info('  -> Skipping (pass --remove-volume-host-paths to enable).');
 
-      logger.info('Phase 2/7: SELinux permissive + restore contexts (when present)...');
-      shellExec(`if command -v setenforce >/dev/null 2>&1; then sudo setenforce 0; fi`);
-      shellExec(
-        `if [ -f /etc/selinux/config ]; then sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config; fi`,
-      );
-      shellExec(
-        `if command -v restorecon >/dev/null 2>&1 && [ -d /var/lib/kubelet ]; then sudo restorecon -Rv /var/lib/kubelet; fi`,
-      );
-      shellExec(
-        `if command -v restorecon >/dev/null 2>&1 && [ -d /var/lib/containerd ]; then sudo restorecon -Rv /var/lib/containerd; fi`,
-      );
+      logger.info('Phase 2/7: Enforcing SELinux and restoring runtime contexts...');
+      enforceSELinux(['/var/lib/kubelet', '/var/lib/containerd']);
 
       logger.info('Phase 3/7: Stopping host kubelet and container runtimes (kubeadm-scope only)...');
       shellExec(`if systemctl is-active --quiet kubelet; then sudo systemctl stop kubelet; fi`);
@@ -1981,10 +1988,8 @@ EOF`);
       shellExec(`sudo rm -f /etc/sysctl.d/99-k8s-ipforward.conf`);
       shellExec(`sudo rm -f /etc/sysctl.d/99-k8s.conf`);
 
-      // Restore SELinux to enforcing
-      console.log('Restoring SELinux to enforcing mode...');
-      // shellExec(`sudo setenforce 1`);
-      // shellExec(`sudo sed -i 's/^SELINUX=permissive$/SELINUX=enforcing/' /etc/selinux/config`);
+      console.log('Keeping SELinux in enforcing mode...');
+      enforceSELinux();
 
       console.log('Uninstall process completed.');
     },

package/src/cli/db.js

@@ -6,12 +6,19 @@
  * Supports MariaDB and MongoDB with import/export capabilities, Git integration, and multi-pod operations.
  */
 
-import { mergeFile, splitFileFactory, loadConfServerJson, resolveConfSecrets, loadConfInstances } from '../server/conf.js';
+import {
+  loadConfInstances,
+  loadConfServerJson,
+  loadReplicas,
+  mergeFile,
+  pathPortAssignmentFactory,
+  splitFileFactory,
+} from '../server/conf.js';
 import { loggerFactory } from '../server/logger.js';
 import { shellExec } from '../server/process.js';
 import fs from 'fs-extra';
 import { DataBaseProviderService } from '../db/DataBaseProvider.js';
-import { loadReplicas, pathPortAssignmentFactory, loadCronDeployEnv } from '../server/conf.js';
+import { loadCronDeployEnv } from '../server/cron.js';
 import { MongoBootstrap } from '../db/mongo/MongoBootstrap.js';
 import Underpost from '../index.js';
 import { timer } from '../client/components/core/CommonJs.js';

package/src/cli/deploy.js

@@ -10,7 +10,6 @@ import {
   buildProxyRouter,
   clusterTypeFactory,
   Config,
-  cronDeployIdResolve,
   deployHostsFactory,
   deployRangePortFactory,
   gatewayApiEnabledFactory,
@@ -24,8 +23,11 @@ import {
   schedulableNodeFactory,
   trafficFromRoutingInfoFactory,
 } from '../server/conf.js';
+import { cronDeployIdResolve } from '../server/cron.js';
 import { loggerFactory } from '../server/logger.js';
+import { HOST_VOLUME_ROOT } from '../server/environment.js';
 import { shellExec } from '../server/process.js';
+import { runSELinuxCommands, selinuxRestoreconCommandFactory } from '../server/selinux.js';
 import { INTERNAL_READY_PATH, INTERNAL_HEALTH_PATH } from '../server/runtime-status.js';
 import { staticContextRoutesFactory, statusPageRoutesFactory } from '../client-builder/client-build.js';
 import {
@@ -152,6 +154,13 @@ const gatewayDurationFactory = (value) => {
 
 const logger = loggerFactory(import.meta);
 
+// hostPath volume trees are written under the operator's home directory, which
+// carries a label no unprivileged container can read. Cluster bring-up registers
+// the persistent mapping for HOST_VOLUME_ROOT; this applies it to what a deploy
+// just wrote. A no-op where SELinux or its userspace is absent.
+const restoreContainerContext = (path) =>
+  runSELinuxCommands([selinuxRestoreconCommandFactory(path)], { execute: shellExec });
+
 /**
  * @class UnderpostDeploy
  * @description Manages the deployment of applications and services.
@@ -724,7 +733,7 @@ ${Underpost.deploy
               if (!volume.claimName) continue;
               const pvcId = `${volume.claimName}-${deployId}-${env}-${deploymentVersion}`;
               const pvId = pvcId.replace(/^pvc-/, 'pv-');
-              const hostPath = `/home/dd/engine/volume/${pvId}`;
+              const hostPath = `${HOST_VOLUME_ROOT}/${pvId}`;
               volumeYaml += `---\n${Underpost.deploy.persistentVolumeFactory({
                 pvcId,
                 namespace: options.namespace,
@@ -1697,13 +1706,13 @@ ${rules}`;
 
     /**
      * Node directory backing the static utility's volume, following the same
-     * `/home/dd/engine/volume/<pv>` convention as every other hostPath volume.
+     * `HOST_VOLUME_ROOT/<pv>` convention as every other hostPath volume.
      * @param {object} [options] - Deploy/run options.
      * @returns {string} Absolute host path.
      * @memberof UnderpostDeploy
      */
     underpostGatewayRootFactory(options = {}) {
-      return options.underpostGatewayRoot || `/home/dd/engine/volume/${UNDERPOST_GATEWAY.volumeName}`;
+      return options.underpostGatewayRoot || `${HOST_VOLUME_ROOT}/${UNDERPOST_GATEWAY.volumeName}`;
     },
 
     /**
@@ -1881,6 +1890,12 @@ ${rules}`;
               ? 'project'
               : null,
           });
+      // The documents were just written under the operator's home tree, whose
+      // policy label (user_home_t) the unprivileged gateway container cannot
+      // read — it would answer 403 for every one of them. The persistent
+      // mapping is registered at cluster bring-up; restore it here so files
+      // this pass created carry it too.
+      restoreContainerContext(hostRoot);
       logger.info('Static edge documents placed', {
         deployId,
         podName: podName || '(no running workload; placed from this checkout)',
@@ -2632,7 +2647,7 @@ EOF`);
       const clusterContext = options.clusterContext || 'kind';
       const pvcId = `${volume.claimName}-${deployId}-${env}-${version}`;
       const pvId = `${volume.claimName.replace('pvc-', 'pv-')}-${deployId}-${env}-${version}`;
-      const rootVolumeHostPath = `/home/dd/engine/volume/${pvId}`;
+      const rootVolumeHostPath = `${HOST_VOLUME_ROOT}/${pvId}`;
       if (options.gitClean && volume.volumeMountPath) {
         Underpost.repo.clean({ paths: [volume.volumeMountPath] });
       }
@@ -2656,6 +2671,7 @@ EOF`);
           // Target node is the control plane / current host: write directly.
           if (!fs.existsSync(rootVolumeHostPath)) fs.mkdirSync(rootVolumeHostPath, { recursive: true });
           fs.copySync(volume.volumeMountPath, rootVolumeHostPath);
+          restoreContainerContext(rootVolumeHostPath);
         } else {
           // Target node is remote: fs.copySync would only write the control-plane
           // filesystem, leaving the real node's hostPath empty. Ship the folder to

package/src/cli/docker-compose.js

@@ -192,7 +192,7 @@ services:
 MONGO_IMAGE=mongo:latest
 VALKEY_IMAGE=valkey/valkey:latest
 APP_IMAGE=underpost/underpost-engine
-APP_TAG=v3.2.90
+APP_TAG=v3.3.0
 PROXY_IMAGE=nginx:stable-alpine
 PROMETHEUS_IMAGE=prom/prometheus:latest
 GRAFANA_IMAGE=grafana/grafana:latest

package/src/cli/env.js

@@ -4,7 +4,7 @@
  * @namespace UnderpostEnv
  */
 
-import { getNpmRootPath, writeEnv } from '../server/conf.js';
+import { getNpmRootPath, writeEnv } from '../server/environment.js';
 import fs from 'fs-extra';
 import { loggerFactory } from '../server/logger.js';
 import dotenv from 'dotenv';

package/src/cli/image.js

@@ -10,7 +10,6 @@ import nodePath from 'path';
 import crypto from 'crypto';
 import { loggerFactory } from '../server/logger.js';
 import Underpost from '../index.js';
-import { getNpmRootPath } from '../server/conf.js';
 import { shellExec } from '../server/process.js';
 import { crictlCommandFactory } from '../server/cri.js';
 

package/src/cli/index.js

@@ -2,7 +2,8 @@ import dotenv from 'dotenv';
 import fs from 'fs-extra';
 
 import { Command } from 'commander';
-import { getNpmRootPath, getUnderpostRootPath, loadConf } from '../server/conf.js';
+import { loadConf } from '../server/conf.js';
+import { getNpmRootPath, getUnderpostRootPath } from '../server/environment.js';
 import { commitData } from '../client/components/core/CommonJs.js';
 
 import Underpost from '../index.js';
@@ -51,6 +52,7 @@ program
   .option('--merge-zip <build-prefix>', 'Merge split ZIP parts back into a single ZIP file for the given build prefix')
   .option('--lite-build', 'Skip full build (default is full build)')
   .option('--icons-build', 'Build icons')
+  .option('--ssr', 'Rebuild only SSR views defined in conf.ssr.json, leaving client assets untouched')
   .description('Builds client assets, single replicas, and/or syncs environment ports.')
   .action(Underpost.repo.client);
 
@@ -143,7 +145,7 @@ program
     '--switch-repo <url>',
     'Switches the git remote (origin) to <url> and force-pulls the target branch, overwriting the current working tree (discards local commits and tracked changes). Accepts a full URL or "owner/repo".',
   )
-  .option('--target-branch <branch>', 'Target branch for --switch-repo (default: master).')
+  .option('--target-branch <branch>', 'Target branch for --switch-repo (default: remote default branch).')
   .description('Manages commits to a GitHub repository, supporting various commit types and options.')
   .action(Underpost.repo.commit);
 
@@ -254,6 +256,10 @@ program
   .option('--ban-egress-clear', 'Clears all banned egress IP addresses.')
   .option('--ban-both-add', 'Adds IP addresses to both banned ingress and egress lists.')
   .option('--ban-both-remove', 'Removes IP addresses from both banned ingress and egress lists.')
+  .option('--block-all-egress', 'Blocks all outbound traffic from this host (keeps established/related connections).')
+  .option('--unblock-all-egress', 'Unblocks all outbound traffic and restores default ACCEPT policy.')
+  .option('--block-all-ingress', 'Blocks all new inbound traffic to this host (keeps established/related connections).')
+  .option('--unblock-all-ingress', 'Unblocks all inbound traffic and restores default ACCEPT policy.')
   .option('--mac', 'Prints the MAC address of the main network interface.')
   .description('Displays the current public machine IP addresses.')
   .action(Underpost.dns.ipDispatcher);
@@ -592,19 +598,23 @@ program
 
 program
   .command('cron')
-  .argument('[deploy-list]', 'A comma-separated list of deployment IDs (e.g., "default-a,default-b").')
+  .argument(
+    '[deploy-list]',
+    'A comma-separated list of deployment IDs (e.g., "default-a,default-b"). In manifest modes its first entry is the manifest owner deploy-id.',
+  )
   .argument(
     '[job-list]',
-    `A comma-separated list of job IDs. Options: ${Underpost.cron.getJobsIDs()}. Defaults to all available jobs.`,
+    `A comma-separated list of job IDs. Options: ${Underpost.cron.getJobsIDs()}. Defaults to all available jobs, and restricts which jobs are generated in manifest modes.`,
   )
   .option('--generate-k8s-cronjobs', 'Generates Kubernetes CronJob YAML manifests from cron configuration.')
-  .option('--apply', 'Applies generated K8s CronJob manifests to the cluster via kubectl.')
+  .option('--apply', 'Generates and applies K8s CronJob manifests to the cluster via kubectl (never runs jobs).')
   .option(
-    '--setup-start [deploy-id]',
-    'Updates deploy-id package.json start script and generates+applies its K8s CronJob manifests.',
+    '--setup-start',
+    'Updates deploy-list package.json start script and generates+applies its K8s CronJob manifests.',
   )
   .option('--namespace <namespace>', 'Kubernetes namespace for the CronJob resources (default: "default").')
   .option('--image <image>', 'Custom container image for the CronJob pods.')
+  .option('--node-name <node-name>', 'Pins the CronJob pods to this node via a kubernetes.io/hostname nodeSelector.')
   .option('--git', 'Pass --git flag to cron job execution.')
   .option('--cmd <cmd>', 'Optional pre-script commands to run before cron execution.')
   .option('--dev', 'Use local ./ base path instead of global underpost installation.')
@@ -614,7 +624,7 @@ program
   .option('--dry-run', 'Preview cron jobs without executing them.')
   .option(
     '--create-job-now',
-    'After applying manifests, immediately create a Job from each CronJob (requires --apply).',
+    'Creates a Job from each CronJob on the cluster now (implies manifest mode; combine with --apply to publish first).',
   )
   .description('Manages cron jobs: execute jobs directly or generate and apply K8s CronJob manifests.')
   .action(Underpost.cron.callback);
@@ -696,6 +706,108 @@ program
   .description('Manages SSH credentials and sessions for remote access to cluster nodes or services.')
   .action(Underpost.ssh.callback);
 
+// `underpost wireguard` and `underpost haproxy` are two entrypoints onto one
+// subsystem: the L3 transport and the gateway in front of it are configured from
+// the same deploy state, so they share a single option set and a single action
+// rather than drifting into two half-overlapping command surfaces.
+const edgeCommandFactory = (name, description) =>
+  program
+    .command(name)
+    .option(
+      '--deploy-id <deploy-id>',
+      'Deploy IDs whose conf.server.json/conf.instances.json define the routes. ' +
+        'Accepts one id or a comma-separated list; defaults to "dd", every deploy in dd.router, ' +
+        'because the edge holds one pair of map files for the whole cluster.',
+    )
+    .option('--interface <name>', 'WireGuard interface name (default: "wg0").')
+    .option('--wireguard-install', 'Installs the wireguard-tools, haproxy and iptables host packages.')
+    .option('--wireguard-setup', 'Generates keys, builds the interface config, and applies local network rules.')
+    .option('--server', 'Configures this node as the hub endpoint accepting inbound tunnel traffic.')
+    .option('--client', 'Configures this node as a spoke endpoint maintaining an outbound tunnel.')
+    .option('--port <port>', 'WireGuard UDP listening port (default: 51820).')
+    .option(
+      '--cidr <cidr>',
+      'Hub interface address with prefix when used with --server (e.g. "10.0.0.1/24"); ' +
+        'the overlay subnet a spoke routes back through the hub when used with --client (default: "10.0.0.0/24").',
+    )
+    .option('--peer-ip <ip>', 'Tunnel address of the target spoke. Required with --client and --peer-add.')
+    .option('--endpoint <host:port>', 'Hub host and port a spoke dials. Required with --client.')
+    .option('--public-key <key>', 'Hub public key with --client; spoke public key with --peer-add.')
+    .option('--peer-add <peer-id>', 'Registers a spoke and applies it to the running hub without a restart.')
+    .option('--peer-remove <peer-id>', 'Removes a spoke from the registry and from the running hub.')
+    .option('--allowed-ips <cidrs>', 'Comma-separated CIDRs routed to the spoke (e.g. "10.0.0.2/32,192.168.10.0/24").')
+    .option('--hosts <hosts>', 'Comma-separated hostnames bound to the spoke, overriding instance resolution.')
+    .option('--instances <instances>', 'Comma-separated conf.instances.json ids bound to the spoke.')
+    .option('--default', 'Marks the spoke as the fallback for hostnames that match no other binding.')
+    .option('--haproxy-setup', 'Installs HAProxy, publishes the current routes, and enables the daemon.')
+    .option('--haproxy-sync', 'Recompiles the SNI/Host maps from deploy config and hot-reloads HAProxy.')
+    .option(
+      '--status',
+      'Prints the whole edge context without changing anything: role, interface, tunnel address, ' +
+        'public key, daemon states, peers with their bindings and link health, and the resolved routing.',
+    )
+    .option(
+      '--build-conf',
+      'Writes only engine-private/deploy/conf.wireguard.json and touches no host state. ' +
+        'Combine with --wireguard-setup / --peer-add / --peer-remove to author the topology off-box; ' +
+        'alone it normalizes and validates the existing registry.',
+    )
+    .option(
+      '--forward-proxy-server',
+      'Ensures the hub HTTP/CONNECT forward proxy runs as the underpost-forward-proxy systemd service, ' +
+        'bound to the tunnel address only (default port 1080), and returns. Authenticates every request with ' +
+        'FORWARD_PROXY_API_KEY, so spokes can reach the internet through the VPS public address. Idempotent: ' +
+        're-running converges on the one service and restarts it only when the unit actually changed.',
+    )
+    .option(
+      '--forward-proxy-server-host <host>',
+      'Address the forward proxy binds, overriding the hub tunnel address from the registry.',
+    )
+    .option('--forward-proxy-server-port <port>', 'Port the forward proxy binds (default: 1080).')
+    .option(
+      '--ssh-forward-port <port>',
+      'Publishes the default spoke SSH port on this public TCP port of the hub, so CI with no fixed ' +
+        'address can reach the cluster node (e.g. 2222). "0" closes it. Stored in the registry.',
+    )
+    .option('--wireguard-start', 'Enables and starts wg-quick@<interface> and the QUIC forward.')
+    .option('--wireguard-stop', 'Tears down the interface and removes its transient packet rules.')
+    .option('--wireguard-reset', 'Removes generated configs and packet rules, keeping the key pair and registry.')
+    .option('--wireguard-reinstall', 'Full purge, package reinstall and re-key; every spoke must re-register.')
+    .option('--dry-run', 'Prints the files and commands the run would apply, without touching the host.')
+    .description(description)
+    .action(Underpost.wireguard.callback);
+
+edgeCommandFactory(
+  'wireguard',
+  'Manages the WireGuard L3 hub-and-spoke transport and the HAProxy edge gateway in front of it.',
+);
+edgeCommandFactory(
+  'haproxy',
+  'Manages the HAProxy edge gateway over the WireGuard transport (same subsystem as `underpost wireguard`).',
+);
+
+program
+  .command('vultr')
+  .argument('[deploy-list]', 'A comma-separated list of deployment IDs, logged for attribution.')
+  .option('--instance-id <instance-id>', 'Vultr instance id to meter (default: VULTR_INSTANCE_ID).')
+  .option('--api-key <api-key>', 'Vultr API key (default: VULTR_API_KEY). Prefer the environment over this flag.')
+  .option(
+    '--threshold <ratio>',
+    'Fraction of the plan quota that triggers the egress block; "0.80" and "80" are both accepted (default: 0.80).',
+  )
+  .option('--metric <metric>', '"total" (incoming + outgoing, default) or "outgoing" for egress alone.')
+  .option('--month <yyyy-mm>', 'Billing month to sum (default: the current UTC month).')
+  .option('--all-dates', 'Sum every daily bucket the API returns instead of scoping to one month.')
+  .option('--host <ip>', 'Edge VPS to block (default: VULTR_VPS_IP, then DEFAULT_SSH_HOST).')
+  .option('--user <user>', 'SSH user on the edge VPS (default: VULTR_SSH_USER, then DEFAULT_SSH_USER, then "root").')
+  .option('--key-path <path>', 'SSH private key (default: VULTR_SSH_KEY_PATH, then DEFAULT_SSH_KEY_PATH).')
+  .option('--port <port>', 'SSH port on the edge VPS (default: VULTR_SSH_PORT, then DEFAULT_SSH_PORT, then 22).')
+  .option('--force', 'Re-apply the egress block even if it was already applied for this cycle.')
+  .option('--auto-unblock', 'Restore egress automatically once consumption falls back under the threshold.')
+  .option('--dry-run', 'Reports the consumption and the action it would take, without touching the edge VPS.')
+  .description('Meters the edge VPS bandwidth against its Vultr plan quota and blocks egress before overage accrues.')
+  .action(Underpost.vultr.callback);
+
 program
   .command('run')
   .argument('<runner-id>', `The runner ID to run. Options: ${Underpost.run.RUNNERS}.`)
@@ -769,7 +881,7 @@ program
   .option('--cmd-cron-jobs <cmd-cron-jobs>', 'Pre-script commands to run before cron job execution.')
   .option(
     '--deploy-id-cron-jobs <deploy-id-cron-jobs>',
-    'Specifies deployment IDs to synchronize cron jobs with during execution.',
+    'Cron deploy-id to set up during sync; defaults to dd.cron, "none" skips cron setup entirely.',
   )
   .option('--timezone <timezone>', 'Sets the timezone for the runner execution.')
   .option('--kubeadm', 'Sets the kubeadm cluster context for the runner execution.')

package/src/cli/lxd.js

@@ -5,7 +5,7 @@
  *
  */
 
-import { getNpmRootPath } from '../server/conf.js';
+import { getNpmRootPath } from '../server/environment.js';
 import { pbcopy, shellExec } from '../server/process.js';
 import walk from 'ignore-walk';
 import fs from 'fs-extra';

package/src/cli/monitor.js

@@ -8,10 +8,10 @@ import {
   loadReplicas,
   pathPortAssignmentFactory,
   loadConfServerJson,
-  loadCronDeployEnv,
   etcHostFactory,
   deployRangePortFactory,
 } from '../server/conf.js';
+import { loadCronDeployEnv } from '../server/cron.js';
 import { loggerFactory } from '../server/logger.js';
 import { timer } from '../client/components/core/CommonJs.js';
 import {