feat(deploy): add deploy vps command

Deploy an SSH-able VPS on a processor without an acurast.json:
vendors the app-tunnel/cargo example (Shell runtime, dropbear over
the Acurast reverse tunnel) as a CLI-shipped template and
synthesizes the project config from flags, VPS_* env vars, or an
interactive wizard (precedence in that order).

- extract executeDeployFlow from the deploy action so both commands
  share signer/balance/pricing/submission logic
- enable positional options so flags shared with `deploy`
  (--dry-run, --min-memory, ...) reach the subcommand
- image aliases: ubuntu24 (noble, default) / ubuntu25 (questing),
  pinned proot-distro tarballs with sha256
- SSH auth: password and/or authorized key (SSH_AUTHORIZED_KEY
  written to authorized_keys by the template's start.sh)

Author: AndreasGassmann

README.md

@@ -46,6 +46,7 @@ To use the Acurast CLI, type `acurast` followed by any of the available options
 
 - `new <project-name>` - Create a new Acurast project from a template.
 - `deploy [options] [project]` - Deploy the current project to the Acurast platform.
+- `deploy vps [options]` - Deploy an SSH-able VPS on an Acurast processor (see [Deploy a VPS](#deploy-a-vps)).
 - `cancel <deployment-id> [options]` - Cancel (deregister) a deployment on-chain and return any unused locked funds.
 - `estimate-fee [options] [project]` - Estimate the fee for the current project.
 - `deployments [arg] [options]` - List, view, and manage deployments.
@@ -275,6 +276,59 @@ ACURAST_DEVNET_INDEXER_API_KEY=<your-key>
 
 Then in `acurast.json` set `"network": "devnet"` on the project entry.
 
+## Deploy a VPS
+
+`acurast deploy vps` turns a processor into an SSH-able "VPS": it deploys a Shell-runtime app (based on the [app-tunnel example](https://github.com/Acurast/acurast-example-apps/tree/main/apps/app-tunnel/cargo)) that runs an Ubuntu rootfs, starts a [Dropbear](https://github.com/mkj/dropbear) SSH server and exposes it through the Acurast reverse tunnel. No `acurast.json` is needed — the app ships with the CLI.
+
+```bash
+acurast deploy vps \
+  --image ubuntu24 \
+  --min-memory 2GB \
+  --min-storage 10GB \
+  --min-compute-score 100 \
+  --authorized-ssh-key "ssh-ed25519 AAAA... user@host" \
+  --duration 24h \
+  --callback-url https://webhook.watch/your-endpoint
+```
+
+Running `acurast deploy vps` without flags starts an interactive wizard that asks for anything missing. `ACURAST_MNEMONIC` must be set (or use `acurast login` for remote signing).
+
+### Options
+
+| Flag                       | Env var                      | Description                                                                                             |
+| -------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------- |
+| `--image <alias>`          | `VPS_IMAGE`                  | `ubuntu24` (24.04 LTS, default) or `ubuntu25` (25.10). proot-distro rootfs tarballs, aarch64.           |
+| `--min-memory <size>`      | `VPS_MIN_MEMORY`             | Minimum total RAM of the processor (e.g. `2GB`).                                                        |
+| `--min-storage <size>`     | `VPS_MIN_STORAGE`            | Minimum available storage (e.g. `10GB`).                                                                |
+| `--min-compute-score <n>`  | `VPS_MIN_COMPUTE_SCORE`      | Minimum CPU single-core benchmark score.                                                                |
+| `--authorized-ssh-key <k>` | `VPS_AUTHORIZED_SSH_KEY`     | SSH public key appended to `/root/.ssh/authorized_keys`.                                                |
+| `--ssh-password <pw>`      | `VPS_SSH_PASSWORD`           | Root password. Defaults to `password` — set your own for anything sensitive.                            |
+| `--duration <dur>`         | `VPS_DURATION`               | How long the VPS runs (e.g. `1h`, `24h`, `2d`). Default `24h`.                                          |
+| `--callback-url <url>`     | `VPS_CALLBACK_URL`           | Webhook receiving `log`/`started`/`error` events; the `started` event contains the SSH connect command. |
+| `--network <net>`          | `VPS_NETWORK`                | `mainnet`, `canary` (default) or `devnet`.                                                              |
+| `--replicas <n>`           | `VPS_REPLICAS`               | Number of VPS instances. Default 1.                                                                     |
+| `--max-cost-per-execution` | `VPS_MAX_COST_PER_EXECUTION` | Reward per execution in the smallest token unit.                                                        |
+
+Flags win over `VPS_*` environment variables (which can live in your `.env`); the wizard only asks for values that neither provides. `--dry-run`, `--non-interactive`, `--only-upload`, `--exit-early` and `--output json` work like they do for `acurast deploy`.
+
+### Connecting
+
+The tunnel identity is generated on the processor, so the public hostname is only known once the deployment starts. Set `--callback-url` (e.g. a [webhook.watch](https://webhook.watch) endpoint) and wait for the `started` event:
+
+```json
+{
+  "event": "started",
+  "webUrl": "https://<clientId>.<domain>",
+  "sshUrl": "https://<secondaryClientId>.<domain>",
+  "sshPort": 2222,
+  "connect": "ssh -o ProxyCommand='openssl s_client -quiet -servername ... -connect ...:443' root@<secondaryClientId>"
+}
+```
+
+Run the `connect` command to open the SSH session (SSH is wrapped in TLS via the tunnel's secondary connection). Without a callback URL, the same information is printed in the deployment logs — `acurast devtools <deployment-id>` gives you a log viewer URL. The deployment also serves a small status page over the primary tunnel connection (`webUrl`).
+
+Requires processors running Acurast v1.26.0 or later (`minProcessorVersions.android` is set automatically).
+
 ## Live Code Feature
 
 For easier development of acurast deployments, we added a feature that we call "Live Code". To use this feature, you can dedicate one or multiple processors to run a piece of code for an extended period of time, which can then on-demand execute your code and return the result. This makes development and debugging a lot faster because you can see console.logs and errors.

e2e/scripts/lib/run-cli.sh

@@ -41,6 +41,13 @@ run_new_interactive() {
   expect "$E2E_LIB_DIR/new.exp" "$@"
 }
 
+# Drive the real interactive `acurast deploy vps` wizard with --dry-run.
+# Usage: run_vps_interactive_dry_run
+run_vps_interactive_dry_run() {
+  _require_expect
+  expect "$E2E_LIB_DIR/vps.exp" "$@"
+}
+
 # Build a throwaway local git template repo so `acurast new` runs fully offline
 # and its interactive template picker is deterministic (a single choice, so
 # Enter always selects it). Exports ACURAST_TEMPLATES_REPO pointing at it.

e2e/scripts/lib/vps.exp

@@ -0,0 +1,63 @@
+#!/usr/bin/env expect
+# Drive the interactive `acurast deploy vps` wizard with --dry-run.
+# Usage: expect vps.exp
+# Requires ACURAST_MNEMONIC in the environment.
+
+# A real terminal size and TERM are required, otherwise the CLI's ora spinner
+# re-renders in a tight loop and floods the pty.
+set stty_init "rows 40 cols 120"
+set env(TERM) "xterm-256color"
+
+set timeout 120
+
+spawn acurast deploy vps --dry-run
+
+expect {
+  timeout { puts "\nTIMEOUT: image prompt"; exit 2 }
+  "Which image should the VPS run?"
+}
+send "\r"
+
+expect {
+  timeout { puts "\nTIMEOUT: duration prompt"; exit 2 }
+  "How long should the VPS run?"
+}
+send "1h\r"
+
+expect {
+  timeout { puts "\nTIMEOUT: hardware requirements prompt"; exit 2 }
+  "Set minimum hardware requirements"
+}
+send "\r"
+
+expect {
+  timeout { puts "\nTIMEOUT: ssh key prompt"; exit 2 }
+  "Authorized SSH public key"
+}
+send "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF7e2edummykey e2e@acurast\r"
+
+expect {
+  timeout { puts "\nTIMEOUT: password prompt"; exit 2 }
+  "Root password"
+}
+send "\r"
+
+expect {
+  timeout { puts "\nTIMEOUT: callback url prompt"; exit 2 }
+  "Callback URL"
+}
+send "\r"
+
+expect {
+  timeout { puts "\nTIMEOUT: VPS summary"; exit 2 }
+  "Deploying VPS"
+}
+
+expect {
+  timeout { puts "\nTIMEOUT: dry-run line"; exit 2 }
+  "Dry run, not deploying"
+}
+
+expect eof
+catch wait result
+exit [lindex $result 3]

e2e/scripts/run-all.sh

@@ -42,6 +42,7 @@ SCENARIOS=(
   "$SCRIPT_DIR/scenarios/04-estimate-fee.sh"
   "$SCRIPT_DIR/scenarios/05-new-nodejs.sh"
   "$SCRIPT_DIR/scenarios/06-new-init-deploy.sh"
+  "$SCRIPT_DIR/scenarios/07-deploy-vps-dry-run.sh"
 )
 
 for scenario in "${SCENARIOS[@]}"; do

e2e/scripts/scenarios/07-deploy-vps-dry-run.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../lib/assert.sh
+source "$SCRIPT_DIR/../lib/assert.sh"
+# shellcheck source=../lib/run-cli.sh
+source "$SCRIPT_DIR/../lib/run-cli.sh"
+
+E2E_ROOT="${E2E_ROOT:?}"
+WORK_ROOT="${WORK_ROOT:?}"
+
+# `deploy vps` needs no project files — the app template ships with the CLI.
+# Canary is required: the flow exits early on mainnet when the balance is 0.
+SCENARIO_DIR="$WORK_ROOT/deploy-vps"
+rm -rf "$SCENARIO_DIR"
+mkdir -p "$SCENARIO_DIR"
+cd "$SCENARIO_DIR"
+
+# Non-interactive: everything from flags.
+OUT="$(run_acurast deploy vps --non-interactive --dry-run \
+  --image ubuntu24 --min-memory 2GB --min-storage 10GB --min-compute-score 100 \
+  --authorized-ssh-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF7e2edummykey e2e@acurast" \
+  --duration 1h --output json 2>&1)"
+CODE=$?
+assert_exit "$CODE" 0 "acurast deploy vps --dry-run (non-interactive)"
+assert_stdout_contains "$OUT" "Dry run, not deploying"
+assert_no_deploy_artifacts "$SCENARIO_DIR"
+
+# VPS_* env vars: flags win, env fills the rest.
+OUT="$(VPS_MIN_MEMORY=2GB VPS_DURATION=1h VPS_SSH_PASSWORD=e2e-password \
+  run_acurast deploy vps --non-interactive --dry-run --output json 2>&1)"
+CODE=$?
+assert_exit "$CODE" 0 "acurast deploy vps --dry-run (VPS_* env)"
+assert_stdout_contains "$OUT" "Dry run, not deploying"
+assert_no_deploy_artifacts "$SCENARIO_DIR"
+
+# Interactive wizard driven through a pseudo-tty.
+OUT="$(run_vps_interactive_dry_run 2>&1)"
+CODE=$?
+assert_exit "$CODE" 0 "acurast deploy vps --dry-run (interactive wizard)"
+assert_stdout_contains "$OUT" "Dry run, not deploying"
+assert_no_deploy_artifacts "$SCENARIO_DIR"
+
+echo "OK: deploy vps dry-run (non-interactive, env vars, wizard)"

package.json

@@ -12,7 +12,7 @@
   ],
   "scripts": {
     "start": "npm run build && node dist/index.js",
-    "build": "npx tsc && node -e \"const fs=require('fs');fs.copyFileSync('./src/util/live-code-processor.js','./dist/util/live-code-processor.js');fs.chmodSync('./dist/index.js',0o755)\"",
+    "build": "npx tsc && node -e \"const fs=require('fs');fs.copyFileSync('./src/util/live-code-processor.js','./dist/util/live-code-processor.js');fs.cpSync('./src/templates','./dist/templates',{recursive:true});fs.chmodSync('./dist/index.js',0o755)\"",
     "setup": "npm run build && npm i -g .",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "test:e2e": "sh -c 'if command -v docker-compose >/dev/null 2>&1; then docker-compose -f e2e/docker-compose.yml run --rm e2e; else docker compose -f e2e/docker-compose.yml run --rm e2e; fi'",