v11.5.0

changelog.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 2026-03-19 - 11.5.0 - feat(opsserver)
+add configurable OpsServer port and update related tests and documentation
+
+- introduces an optional `opsServerPort` configuration that overrides the default OpsServer port 3000
+- updates OpsServer startup logic to use the configured port
+- adjusts integration tests to run against dedicated OpsServer ports to avoid conflicts
+- documents the new OpsServer port option in the README and TypeScript docs
+- includes dependency updates and a remote ingress port range type refinement
+
+## 2026-03-19 - 11.4.0 - feat(docs)
+document OCI container deployment and enable verbose docker build scripts
+
+- adds a new README section covering Docker/OCI container deployment, environment variables, and image build/push commands
+- updates docker build and release npm scripts to pass the --verbose flag for more detailed output
+
 ## 2026-03-18 - 11.3.0 - feat(docker)
 add OCI container startup configuration and migrate Docker release pipeline to tsdocker
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "11.3.0",
+  "version": "11.5.0",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "exports": {
@@ -16,8 +16,8 @@
     "start": "(node --max_old_space_size=250 ./cli.js)",
     "startTs": "(node cli.ts.js)",
     "build": "(tsbuild tsfolders --allowimplicitany && npm run bundle)",
-    "build:docker": "tsdocker build",
+    "build:docker": "tsdocker build --verbose",
-    "release:docker": "tsdocker push",
+    "release:docker": "tsdocker push --verbose",
     "bundle": "(tsbundle)",
     "watch": "tswatch"
   },
@@ -25,7 +25,7 @@
     "@git.zone/tsbuild": "^4.3.0",
     "@git.zone/tsbundle": "^2.9.1",
     "@git.zone/tsrun": "^2.0.1",
-    "@git.zone/tstest": "^3.3.2",
+    "@git.zone/tstest": "^3.5.0",
     "@git.zone/tswatch": "^3.3.0",
     "@types/node": "^25.5.0"
   },
@@ -40,7 +40,7 @@
     "@push.rocks/lik": "^6.3.1",
     "@push.rocks/projectinfo": "^5.0.2",
     "@push.rocks/qenv": "^6.1.3",
-    "@push.rocks/smartacme": "^9.1.3",
+    "@push.rocks/smartacme": "^9.3.0",
     "@push.rocks/smartdata": "^7.1.0",
     "@push.rocks/smartdns": "^7.9.0",
     "@push.rocks/smartfile": "^13.1.2",
@@ -53,15 +53,15 @@
     "@push.rocks/smartnetwork": "^4.4.0",
     "@push.rocks/smartpath": "^6.0.0",
     "@push.rocks/smartpromise": "^4.2.3",
-    "@push.rocks/smartproxy": "^25.11.24",
+    "@push.rocks/smartproxy": "^25.14.1",
     "@push.rocks/smartradius": "^1.1.1",
     "@push.rocks/smartrequest": "^5.0.1",
     "@push.rocks/smartrx": "^3.0.10",
     "@push.rocks/smartstate": "^2.2.0",
     "@push.rocks/smartunique": "^3.0.9",
-    "@serve.zone/catalog": "^2.7.0",
+    "@serve.zone/catalog": "^2.9.0",
     "@serve.zone/interfaces": "^5.3.0",
-    "@serve.zone/remoteingress": "^4.9.0",
+    "@serve.zone/remoteingress": "^4.13.0",
     "@tsclass/tsclass": "^9.4.0",
     "lru-cache": "^11.2.7",
     "uuid": "^13.0.0"

readme.md

@@ -30,6 +30,7 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 - [API Reference](#api-reference)
 - [Sub-Modules](#sub-modules)
 - [Testing](#testing)
+- [Docker / OCI Container Deployment](#docker--oci-container-deployment)
 - [License and Legal Information](#license-and-legal-information)
 
 ## Features
@@ -343,7 +344,7 @@ graph TB
 
 DcRouter acts purely as an **orchestrator** — it doesn't implement protocols itself. Instead, it wires together best-in-class packages for each protocol:
 
-1. **On `start()`**: DcRouter initializes OpsServer (port 3000), then spins up SmartProxy, smartmta, SmartDNS, SmartRadius, and RemoteIngress based on which configs are provided.
+1. **On `start()`**: DcRouter initializes OpsServer (default port 3000, configurable via `opsServerPort`), then spins up SmartProxy, smartmta, SmartDNS, SmartRadius, and RemoteIngress based on which configs are provided.
 2. **During operation**: Each service handles its own protocol independently. SmartProxy uses a Rust-powered engine for maximum throughput. smartmta uses a hybrid TypeScript + Rust architecture for reliable email delivery. RemoteIngress runs a Rust data plane for edge tunnel networking. SmartAcme v9 handles all certificate operations with built-in concurrency control and rate limiting.
 3. **On `stop()`**: All services are gracefully shut down in parallel, including cleanup of HTTP agents and DNS clients.
 
@@ -424,6 +425,10 @@ interface IDcRouterOptions {
     };
   };
 
+  // ── OpsServer ────────────────────────────────────────────────
+  /** Port for the OpsServer web dashboard (default: 3000) */
+  opsServerPort?: number;
+
   // ── TLS & Certificates ────────────────────────────────────────
   tls?: {
     contactEmail: string;
@@ -1015,7 +1020,7 @@ action: {
 
 ## OpsServer Dashboard
 
-The OpsServer provides a web-based management interface served on port 3000. It's built with modern web components using [@design.estate/dees-catalog](https://code.foss.global/design.estate/dees-catalog).
+The OpsServer provides a web-based management interface served on port 3000 by default (configurable via `opsServerPort`). It's built with modern web components using [@design.estate/dees-catalog](https://code.foss.global/design.estate/dees-catalog).
 
 ### Dashboard Views
 
@@ -1278,6 +1283,49 @@ tstest test/test.opsserver-api.ts --verbose --timeout 60
 | `test.protected-endpoint.ts` | Admin auth, identity verification, public endpoints | 8 |
 | `test.storagemanager.ts` | Memory, filesystem, custom backends, concurrency | 8 |
 
+## Docker / OCI Container Deployment
+
+DcRouter ships with a `Dockerfile` and supports environment-variable-driven configuration for OCI container deployments. When `DCROUTER_MODE=OCI_CONTAINER` is set, DcRouter automatically reads configuration from environment variables (and optionally from a JSON config file).
+
+### Running with Docker
+
+```bash
+docker run -d \
+  -e DCROUTER_MODE=OCI_CONTAINER \
+  -e DCROUTER_TLS_EMAIL=admin@example.com \
+  -e DCROUTER_PUBLIC_IP=203.0.113.1 \
+  -e DCROUTER_DNS_NS_DOMAINS=ns1.example.com,ns2.example.com \
+  -e DCROUTER_DNS_SCOPES=example.com \
+  -p 80:80 -p 443:443 -p 25:25 -p 53:53/udp -p 3000:3000 \
+  code.foss.global/serve.zone/dcrouter:latest
+```
+
+### Environment Variables
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `DCROUTER_MODE` | Set to `OCI_CONTAINER` to enable container mode | `OCI_CONTAINER` |
+| `DCROUTER_CONFIG_PATH` | Path to a JSON config file (loaded as base, env vars override) | `/config/dcrouter.json` |
+| `DCROUTER_BASE_DIR` | Override base data directory | `/data/dcrouter` |
+| `DCROUTER_TLS_EMAIL` | ACME contact email | `admin@example.com` |
+| `DCROUTER_TLS_DOMAIN` | Primary TLS domain | `example.com` |
+| `DCROUTER_PUBLIC_IP` | Public IP for DNS records | `203.0.113.1` |
+| `DCROUTER_PROXY_IPS` | Comma-separated ingress proxy IPs | `198.51.100.1,198.51.100.2` |
+| `DCROUTER_DNS_NS_DOMAINS` | Comma-separated nameserver domains | `ns1.example.com,ns2.example.com` |
+| `DCROUTER_DNS_SCOPES` | Comma-separated authoritative domains | `example.com,other.com` |
+| `DCROUTER_EMAIL_HOSTNAME` | SMTP server hostname | `mail.example.com` |
+| `DCROUTER_EMAIL_PORTS` | Comma-separated email ports | `25,587,465` |
+| `DCROUTER_CACHE_ENABLED` | Enable/disable cache database | `true` |
+
+### Building the Image
+
+```bash
+pnpm run build:docker    # Build the container image
+pnpm run release:docker  # Push to registry
+```
+
+The Docker build supports multi-platform (`linux/amd64`, `linux/arm64`) via [tsdocker](https://code.foss.global/git.zone/tsdocker).
+
 ## License and Legal Information
 
 This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.

test/test.dcrouter.email.ts

@@ -129,6 +129,7 @@ tap.test('DcRouter class - Email config with domains and routes', async () => {
     tls: {
       contactEmail: 'test@example.com'
     },
+    opsServerPort: 3104,
     cacheConfig: {
       enabled: false,
     }

test/test.dns-socket-handler.ts

@@ -9,6 +9,7 @@ tap.test('should NOT instantiate DNS server when dnsNsDomains is not set', async
     smartProxyConfig: {
       routes: []
     },
+    opsServerPort: 3100,
     cacheConfig: { enabled: false }
   });
 

test/test.jwt-auth.ts

@@ -9,6 +9,7 @@ let identity: interfaces.data.IIdentity;
 tap.test('should start DCRouter with OpsServer', async () => {
   testDcRouter = new DcRouter({
     // Minimal config for testing
+    opsServerPort: 3102,
     cacheConfig: { enabled: false },
   });
   
@@ -18,7 +19,7 @@ tap.test('should start DCRouter with OpsServer', async () => {
 
 tap.test('should login with admin credentials and receive JWT', async () => {
   const loginRequest = new TypedRequest<interfaces.requests.IReq_AdminLoginWithUsernameAndPassword>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3102/typedrequest',
     'adminLoginWithUsernameAndPassword'
   );
   
@@ -41,7 +42,7 @@ tap.test('should login with admin credentials and receive JWT', async () => {
 
 tap.test('should verify valid JWT identity', async () => {
   const verifyRequest = new TypedRequest<interfaces.requests.IReq_VerifyIdentity>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3102/typedrequest',
     'verifyIdentity'
   );
   
@@ -57,7 +58,7 @@ tap.test('should verify valid JWT identity', async () => {
 
 tap.test('should reject invalid JWT', async () => {
   const verifyRequest = new TypedRequest<interfaces.requests.IReq_VerifyIdentity>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3102/typedrequest',
     'verifyIdentity'
   );
   
@@ -74,7 +75,7 @@ tap.test('should reject invalid JWT', async () => {
 
 tap.test('should verify JWT matches identity data', async () => {
   const verifyRequest = new TypedRequest<interfaces.requests.IReq_VerifyIdentity>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3102/typedrequest',
     'verifyIdentity'
   );
   
@@ -91,7 +92,7 @@ tap.test('should verify JWT matches identity data', async () => {
 
 tap.test('should handle logout', async () => {
   const logoutRequest = new TypedRequest<interfaces.requests.IReq_AdminLogout>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3102/typedrequest',
     'adminLogout'
   );
   
@@ -105,7 +106,7 @@ tap.test('should handle logout', async () => {
 
 tap.test('should reject wrong credentials', async () => {
   const loginRequest = new TypedRequest<interfaces.requests.IReq_AdminLoginWithUsernameAndPassword>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3102/typedrequest',
     'adminLoginWithUsernameAndPassword'
   );
   

test/test.opsserver-api.ts

@@ -9,6 +9,7 @@ let adminIdentity: interfaces.data.IIdentity;
 tap.test('should start DCRouter with OpsServer', async () => {
   testDcRouter = new DcRouter({
     // Minimal config for testing
+    opsServerPort: 3101,
     cacheConfig: { enabled: false },
   });
 
@@ -18,7 +19,7 @@ tap.test('should start DCRouter with OpsServer', async () => {
 
 tap.test('should login as admin', async () => {
   const loginRequest = new TypedRequest<interfaces.requests.IReq_AdminLoginWithUsernameAndPassword>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3101/typedrequest',
     'adminLoginWithUsernameAndPassword'
   );
 
@@ -33,7 +34,7 @@ tap.test('should login as admin', async () => {
 
 tap.test('should respond to health status request', async () => {
   const healthRequest = new TypedRequest<interfaces.requests.IReq_GetHealthStatus>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3101/typedrequest',
     'getHealthStatus'
   );
 
@@ -49,7 +50,7 @@ tap.test('should respond to health status request', async () => {
 
 tap.test('should respond to server statistics request', async () => {
   const statsRequest = new TypedRequest<interfaces.requests.IReq_GetServerStatistics>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3101/typedrequest',
     'getServerStatistics'
   );
 
@@ -66,7 +67,7 @@ tap.test('should respond to server statistics request', async () => {
 
 tap.test('should respond to configuration request', async () => {
   const configRequest = new TypedRequest<interfaces.requests.IReq_GetConfiguration>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3101/typedrequest',
     'getConfiguration'
   );
 
@@ -87,7 +88,7 @@ tap.test('should respond to configuration request', async () => {
 
 tap.test('should handle log retrieval request', async () => {
   const logsRequest = new TypedRequest<interfaces.requests.IReq_GetRecentLogs>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3101/typedrequest',
     'getRecentLogs'
   );
 
@@ -104,7 +105,7 @@ tap.test('should handle log retrieval request', async () => {
 
 tap.test('should reject unauthenticated requests', async () => {
   const healthRequest = new TypedRequest<interfaces.requests.IReq_GetHealthStatus>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3101/typedrequest',
     'getHealthStatus'
   );
 

test/test.protected-endpoint.ts

@@ -9,6 +9,7 @@ let adminIdentity: interfaces.data.IIdentity;
 tap.test('should start DCRouter with OpsServer', async () => {
   testDcRouter = new DcRouter({
     // Minimal config for testing
+    opsServerPort: 3103,
     cacheConfig: { enabled: false },
   });
 
@@ -18,7 +19,7 @@ tap.test('should start DCRouter with OpsServer', async () => {
 
 tap.test('should login as admin', async () => {
   const loginRequest = new TypedRequest<interfaces.requests.IReq_AdminLoginWithUsernameAndPassword>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3103/typedrequest',
     'adminLoginWithUsernameAndPassword'
   );
 
@@ -34,7 +35,7 @@ tap.test('should login as admin', async () => {
 
 tap.test('should allow admin to verify identity', async () => {
   const verifyRequest = new TypedRequest<interfaces.requests.IReq_VerifyIdentity>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3103/typedrequest',
     'verifyIdentity'
   );
 
@@ -49,7 +50,7 @@ tap.test('should allow admin to verify identity', async () => {
 
 tap.test('should reject verify identity without identity', async () => {
   const verifyRequest = new TypedRequest<interfaces.requests.IReq_VerifyIdentity>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3103/typedrequest',
     'verifyIdentity'
   );
 
@@ -64,7 +65,7 @@ tap.test('should reject verify identity without identity', async () => {
 
 tap.test('should reject verify identity with invalid JWT', async () => {
   const verifyRequest = new TypedRequest<interfaces.requests.IReq_VerifyIdentity>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3103/typedrequest',
     'verifyIdentity'
   );
 
@@ -84,7 +85,7 @@ tap.test('should reject verify identity with invalid JWT', async () => {
 
 tap.test('should reject protected endpoints without auth', async () => {
   const healthRequest = new TypedRequest<interfaces.requests.IReq_GetHealthStatus>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3103/typedrequest',
     'getHealthStatus'
   );
 
@@ -100,7 +101,7 @@ tap.test('should reject protected endpoints without auth', async () => {
 
 tap.test('should allow authenticated access to protected endpoints', async () => {
   const configRequest = new TypedRequest<interfaces.requests.IReq_GetConfiguration>(
-    'http://localhost:3000/typedrequest',
+    'http://localhost:3103/typedrequest',
     'getConfiguration'
   );
 

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '11.3.0',
+  version: '11.5.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

ts/classes.dcrouter.ts

@@ -163,6 +163,9 @@ export interface IDcRouterOptions {
    * Remote Ingress configuration for edge tunnel nodes
    * Enables edge nodes to accept incoming connections and tunnel them to this DcRouter
    */
+  /** Port for the OpsServer web UI (default: 3000) */
+  opsServerPort?: number;
+
   remoteIngressConfig?: {
     /** Enable remote ingress hub (default: false) */
     enabled?: boolean;

ts/opsserver/classes.opsserver.ts

@@ -50,7 +50,7 @@ export class OpsServer {
     // Set up handlers
     await this.setupHandlers();
 
-    await this.server.start(3000);
+    await this.server.start(this.dcRouterRef.options.opsServerPort ?? 3000);
   }
   
   /**

ts/readme.md

@@ -37,7 +37,7 @@ const router = new DcRouter({
 });
 
 await router.start();
-// OpsServer dashboard at http://localhost:3000
+// OpsServer dashboard at http://localhost:3000 (configurable via opsServerPort)
 
 // Graceful shutdown
 await router.stop();
@@ -71,7 +71,10 @@ ts/
 │       ├── email.handler.ts        # Email operations
 │       ├── certificate.handler.ts  # Certificate management
 │       ├── radius.handler.ts       # RADIUS management
-│       └── remoteingress.handler.ts # Remote ingress edge + token management
+│       ├── remoteingress.handler.ts # Remote ingress edge + token management
+│       ├── route-management.handler.ts # Programmatic route CRUD
+│       ├── api-token.handler.ts    # API token management
+│       └── security.handler.ts     # Security metrics + connections
 ├── radius/                         # RADIUS server integration
 ├── remoteingress/                  # Remote ingress hub integration
 │   ├── classes.remoteingress-manager.ts  # Edge CRUD + port derivation

ts/remoteingress/classes.remoteingress-manager.ts

@@ -7,7 +7,7 @@ const STORAGE_PREFIX = '/remote-ingress/';
 /**
  * Flatten a port range (number | number[] | Array<{from, to}>) to a sorted unique number array.
  */
-function extractPorts(portRange: number | number[] | Array<{ from: number; to: number }>): number[] {
+function extractPorts(portRange: number | Array<number | { from: number; to: number }>): number[] {
   const ports = new Set<number>();
   if (typeof portRange === 'number') {
     ports.add(portRange);

ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '11.3.0',
+  version: '11.5.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }