vibecarbon 0.1.0

package/carbon/content/docs/environments.mdx

@@ -0,0 +1,84 @@
+---
+title: "Environments"
+description: "Manage multiple deployment environments with per-environment configuration and defaults."
+order: 8
+---
+
+## Overview
+
+Vibecarbon supports multiple named environments. Each environment is an independent deployment with its own infrastructure, database, secrets, and configuration.
+
+```bash
+npx vibecarbon deploy prod      # Production
+npx vibecarbon deploy staging   # Staging
+npx vibecarbon deploy dev       # Dev / preview
+```
+
+The environment name is free-form — use any name that fits your workflow. `prod` (and its alias `production`) is the only special name and unlocks production-grade defaults.
+
+## Environment Defaults
+
+The following defaults differ between `prod` and all other environments:
+
+| Setting | `prod` | `staging` / `dev` / `qa` |
+|---------|--------|--------------------------|
+| Default server type | `cpx21` (3 vCPU, 4GB) | `cx22` (2 vCPU, 4GB) |
+| Backup schedule | Every 6 hours | Daily at 2 AM |
+| Backup retention | 30 days | 7 days |
+
+All settings can be overridden interactively during the deploy prompt. After the first deploy, choices are saved to `.vibecarbon.json` and reused automatically on subsequent deploys.
+
+## Managing Multiple Environments
+
+You can run as many environments as you need. A typical setup:
+
+| Environment | Purpose |
+|-------------|---------|
+| `prod` | Live traffic, production data |
+| `staging` | Pre-release validation, mirrors prod config |
+| `dev` | Feature development, throwaway data |
+
+Each environment gets its own cluster, domain, and database — they share nothing at the infrastructure level.
+
+## Node Scaling
+
+Worker nodes are bounds-controlled at deploy time — the default is `min=1, max=3` (cluster-autoscaler scales 0..(max-min) workers on top of the static floor). Worker bounds are set during the `vibecarbon deploy` interactive prompt or in `.vibecarbon.json`.
+
+```bash
+# Pick mode interactively, including k8s/k8s-ha and worker bounds
+npx vibecarbon deploy prod
+
+# Scripted: explicit mode, region, and skip prompts
+npx vibecarbon deploy prod -mode k8s-ha -region hel1 -y
+```
+
+Available modes: `compose`, `compose-ha` (multi-region with streaming replication), `k8s`, and `k8s-ha`. All modes are available on Diamond and Fullerene.
+
+To re-tune bounds or worker server types on an existing cluster, run `npx vibecarbon scale` — the wizard walks you through what's changeable. Power users can seed a server-type change with `-type` (e.g. `npx vibecarbon scale prod -type cx33 -y`).
+
+## Backups
+
+Backups run automatically on a schedule that differs by environment:
+
+```bash
+# Create a manual backup
+npx vibecarbon backup staging
+
+# List backups
+npx vibecarbon backup prod -l
+
+# Restore (interactive picker)
+npx vibecarbon restore staging
+```
+
+See the [Deployment](/docs/deployment) guide for full backup and restore options.
+
+## Destroying an Environment
+
+To tear down an environment and all its infrastructure:
+
+```bash
+npx vibecarbon destroy staging
+```
+
+This removes the cluster, load balancers, volumes, and DNS records for that environment. Production environments prompt for confirmation before proceeding.

package/carbon/content/docs/getting-started.mdx

@@ -0,0 +1,112 @@
+---
+title: "Getting Started"
+description: "Scaffold a full-stack app, run it locally, and deploy to production."
+order: 1
+---
+
+## Prerequisites
+
+- **Node.js 22+** — [Download](https://nodejs.org)
+- **Docker** — [Download](https://docker.com/get-started)
+- **pnpm** — Install with `npm install -g pnpm`
+
+## 1. Create Your Project
+
+```bash
+npx vibecarbon create my-app
+```
+
+This scaffolds a complete full-stack application. You'll be prompted for an admin email and password — these become your first sign-in credentials.
+
+Behind the scenes, `create` generates secure secrets, copies the template, installs dependencies, and initializes a git repository. When it finishes you'll have a complete project in the `my-app/` directory, ready for local development.
+
+### What's Included
+
+| Category | Features |
+|----------|----------|
+| Auth | Email/password, magic links, OAuth (Google, GitHub, Microsoft, Apple, Discord), MFA |
+| Billing | Multi-provider (Stripe, Paddle, Polar) subscriptions, checkout, portal, plan gating |
+| Admin | Super admin panel, user/org management, impersonation, notifications, jobs, contact, newsletter |
+| Content | MDX blog, changelog, docs (with search), legal pages (privacy, terms) |
+| Engagement | Contact form, newsletter (double opt-in), language switcher, analytics (Plausible) |
+| Infrastructure | File uploads, i18n, background jobs (pg_cron), onboarding wizard, rate limiting |
+
+## 2. Start Developing
+
+```bash
+cd my-app
+npx vibecarbon up
+```
+
+This single command boots your entire development environment:
+
+1. **Starts Docker services** — PostgreSQL, Supabase (Auth, REST, Realtime, Storage, Studio), and Traefik reverse proxy
+2. **Runs database migrations** — Creates tables, security policies, and your admin user
+3. **Launches dev servers** — Hono API on port 3000 and Vite on port 5173 with hot reloading
+
+Open [http://app.localhost](http://app.localhost) and sign in with the credentials you chose during creation. You'll be guided through onboarding to set up your profile, create an organization, and choose a plan.
+
+| Service | URL |
+|---------|-----|
+| App | http://app.localhost |
+| Supabase Studio | http://studio.localhost |
+| Traefik Dashboard | http://traefik.localhost |
+
+Before deploying, configure `DOMAIN` in `.env.local` to match your production domain.
+
+## 3. Deploy to Production
+
+Deployment requires a license key. Vibecarbon has three tiers:
+
+| Tier | Price | Who it's for |
+|------|-------|--------------|
+| **Graphite** | Free | Everyone — create projects, develop locally, use every add-on |
+| **Diamond** | $149 lifetime | Full automation for indie hackers & startups |
+| **Fullerene** | $499 lifetime | Commercial license for agencies & enterprise |
+
+Diamond and Fullerene have **identical technical capabilities**. The difference is use rights: Diamond covers indie hackers and startups deploying their own products; Fullerene is the commercial license for agencies and enterprise deploying on behalf of clients or organizations.
+
+Activate your license, then deploy:
+
+```bash
+npx vibecarbon activate <your-key>
+npx vibecarbon deploy
+```
+
+The bare `deploy` command opens a guided prompt that walks you through environment selection, mode (`compose`, `compose-ha`, `k8s`, or `k8s-ha`), region, and other settings. Behind the scenes it builds your app, pushes container images, and applies your infrastructure configuration. Traefik handles SSL certificates automatically via Let's Encrypt.
+
+See the [Deployment](/docs/deployment) guide for details on Docker Compose and Kubernetes options.
+
+## Project Structure
+
+```
+src/
+├── client/              # React SPA (Vite)
+├── server/              # Hono API (Node.js)
+└── shared/              # Shared TypeScript types
+
+supabase/
+└── migrations/          # SQL migrations
+
+content/
+├── blog/                # Blog posts (MDX)
+├── changelog/           # Release notes (MDX)
+└── docs/                # Documentation (MDX)
+
+docker-compose.yml       # Local dev environment (Supabase, Traefik)
+docker-compose.prod.yml  # Production overlay
+k8s/                     # Kubernetes manifests (Kustomize)
+.env.local               # Local environment variables (git-ignored)
+```
+
+## Next Steps
+
+- [CLI Reference](/docs/cli) — All commands, options, and flags
+- [Development](/docs/development) — Commands, adding pages, routes, and content
+- [Authentication](/docs/authentication) — Sign-in methods and security
+- [Database](/docs/database) — Supabase, migrations, and RLS
+- [Deployment](/docs/deployment) — Deploy to production
+- [Background Jobs](/docs/background-jobs) — Scheduled tasks with pg_cron
+- [Analytics](/docs/analytics) — Privacy-friendly analytics with Plausible
+- [Environments](/docs/environments) — Manage staging, dev, and production environments
+- [Optional Services](/docs/optional-services) — Add n8n, Metabase, Redis, and more

package/carbon/content/docs/legal/privacy-policy.mdx

@@ -0,0 +1,89 @@
+---
+title: "Privacy Policy"
+description: "How we collect, use, and protect your personal information."
+order: 100
+---
+
+**Last updated:** March 2026
+
+This Privacy Policy describes how {{PROJECT_NAME}} ("we", "us", or "our") collects, uses, and shares your personal information when you use our service.
+
+## Information We Collect
+
+### Information You Provide
+
+- **Account information**: Email address, name, and password when you create an account.
+- **Billing information**: Payment details processed securely through our payment provider. We do not store credit card numbers.
+- **Organization data**: Organization names, member roles, and settings you configure.
+- **Content**: Any data, files, or content you create or upload through the service.
+- **Communications**: Messages you send to us through contact forms or email.
+
+### Information Collected Automatically
+
+- **Usage data**: Pages visited, features used, and actions taken within the service.
+- **Device information**: Browser type, operating system, and device identifiers.
+- **Log data**: IP addresses, access times, and referring URLs.
+- **Cookies**: Essential cookies for authentication and session management. We do not use advertising or tracking cookies.
+
+## How We Use Your Information
+
+We use your information to:
+
+- Provide, maintain, and improve the service
+- Process transactions and send billing-related communications
+- Send service-related notices (security alerts, updates, support messages)
+- Respond to your requests and provide customer support
+- Detect, prevent, and address technical issues and security threats
+- Comply with legal obligations
+
+## Data Sharing
+
+We do not sell your personal information. We may share your information with:
+
+- **Service providers**: Payment processors, email delivery services, and hosting providers that help us operate the service.
+- **Legal requirements**: When required by law, subpoena, or to protect our rights and the safety of our users.
+- **Business transfers**: In connection with a merger, acquisition, or sale of assets, with notice to affected users.
+
+## Data Security
+
+We implement industry-standard security measures including:
+
+- Encryption in transit (TLS/HTTPS) and at rest
+- Row-level security (RLS) for database access control
+- Rate limiting and brute force protection
+- Regular security audits and monitoring
+- Account lockout after repeated failed login attempts
+
+## Data Retention
+
+- **Account data**: Retained while your account is active. Deleted upon account closure, subject to legal retention requirements.
+- **Backups**: Database backups are retained for 30 days and then permanently deleted.
+- **Logs**: Server logs are retained for 90 days for security and debugging purposes.
+
+## Your Rights
+
+Depending on your jurisdiction, you may have the right to:
+
+- **Access**: Request a copy of the personal information we hold about you.
+- **Correction**: Request correction of inaccurate personal information.
+- **Deletion**: Request deletion of your personal information.
+- **Portability**: Receive your data in a structured, machine-readable format.
+- **Objection**: Object to processing of your personal information.
+
+To exercise these rights, contact us at the email address below.
+
+## International Data Transfers
+
+Your data may be processed in countries other than your country of residence. We ensure appropriate safeguards are in place for any international data transfers.
+
+## Children's Privacy
+
+Our service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us.
+
+## Changes to This Policy
+
+We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date.
+
+## Contact Us
+
+If you have questions about this Privacy Policy, please contact us at **{{ADMIN_EMAIL}}**.

package/carbon/content/docs/legal/terms-of-service.mdx

@@ -0,0 +1,99 @@
+---
+title: "Terms of Service"
+description: "Terms and conditions for using our service."
+order: 101
+---
+
+**Last updated:** March 2026
+
+These Terms of Service ("Terms") govern your use of {{PROJECT_NAME}} ("the Service"), operated by {{PROJECT_NAME}} ("we", "us", or "our"). By using the Service, you agree to these Terms.
+
+## 1. Account Registration
+
+- You must provide accurate and complete information when creating an account.
+- You are responsible for maintaining the confidentiality of your account credentials.
+- You must be at least 16 years old to use the Service.
+- You are responsible for all activities that occur under your account.
+- Notify us immediately if you suspect unauthorized access to your account.
+
+## 2. Acceptable Use
+
+You agree not to:
+
+- Use the Service for any unlawful purpose or in violation of any applicable laws
+- Attempt to gain unauthorized access to the Service or its related systems
+- Interfere with or disrupt the Service or its infrastructure
+- Upload malicious code, viruses, or harmful content
+- Scrape, crawl, or use automated means to access the Service without permission
+- Impersonate another person or entity
+- Use the Service to send spam or unsolicited communications
+- Circumvent any access controls, rate limits, or security measures
+
+## 3. Subscriptions and Billing
+
+- Some features require a paid subscription. Prices are displayed on our pricing page.
+- Subscriptions are billed in advance on a recurring basis (monthly or annually).
+- You may cancel your subscription at any time. Cancellation takes effect at the end of the current billing period.
+- We reserve the right to change pricing with 30 days' notice to active subscribers.
+- Refunds are handled on a case-by-case basis. Contact us if you have billing concerns.
+
+## 4. Your Data
+
+- You retain all rights to the data and content you upload to the Service.
+- You grant us a limited license to host, store, and process your data solely to provide the Service.
+- We will not access your data except as necessary to provide the Service, prevent abuse, or comply with legal obligations.
+- You are responsible for maintaining backups of your data. While we perform regular backups, we are not liable for data loss.
+- Upon account deletion, your data will be removed in accordance with our Privacy Policy.
+
+## 5. Organizations and Teams
+
+- Organization owners are responsible for managing members and their access levels.
+- Organization owners can transfer ownership to another member.
+- When you join an organization, the organization owner and admins can manage your membership and access within that organization.
+
+## 6. Intellectual Property
+
+- The Service, including its design, code, and documentation, is protected by intellectual property laws.
+- We grant you a limited, non-exclusive, non-transferable license to use the Service in accordance with these Terms.
+- Feedback and suggestions you provide about the Service may be used by us without obligation to you.
+
+## 7. Service Availability
+
+- We strive to maintain high availability but do not guarantee uninterrupted access.
+- We may perform scheduled maintenance with advance notice when possible.
+- We are not liable for any downtime, data loss, or service interruptions.
+
+## 8. Limitation of Liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW:
+
+- THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED.
+- WE ARE NOT LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES.
+- OUR TOTAL LIABILITY SHALL NOT EXCEED THE AMOUNT YOU PAID US IN THE 12 MONTHS PRECEDING THE CLAIM.
+
+## 9. Indemnification
+
+You agree to indemnify and hold us harmless from any claims, damages, or expenses arising from your use of the Service or violation of these Terms.
+
+## 10. Termination
+
+- We may suspend or terminate your account if you violate these Terms.
+- You may terminate your account at any time by contacting us.
+- Upon termination, your right to use the Service ceases immediately.
+- Provisions that by their nature should survive termination will survive (including limitations of liability, indemnification, and dispute resolution).
+
+## 11. Dispute Resolution
+
+- These Terms are governed by the laws of the jurisdiction in which we operate.
+- Any disputes shall be resolved through good-faith negotiation first.
+- If negotiation fails, disputes shall be resolved through binding arbitration or in the courts of competent jurisdiction.
+
+## 12. Changes to These Terms
+
+- We may update these Terms from time to time.
+- Material changes will be communicated via email or through a notice on the Service.
+- Continued use of the Service after changes constitutes acceptance of the updated Terms.
+
+## 13. Contact Us
+
+If you have questions about these Terms, please contact us at **{{ADMIN_EMAIL}}**.

package/carbon/content/docs/optional-services.mdx

@@ -0,0 +1,160 @@
+---
+title: "Optional Services"
+description: "Add workflow automation, analytics, caching, monitoring, and CI/CD to your project."
+order: 10
+---
+
+## Overview
+
+Vibecarbon ships with a core stack (Supabase, Traefik, Hono API, React SPA). You can extend it with optional services using the CLI:
+
+```bash
+# Interactive — prompts for which service to add
+npx vibecarbon add
+
+# Or seed the service name to skip the prompt
+npx vibecarbon add <service>
+```
+
+Each service adds Docker Compose files, Kubernetes manifests, environment variables, and feature flags to your project. Running the command multiple times is safe — it won't duplicate anything.
+
+```bash
+# See available services in the interactive prompt body
+npx vibecarbon add
+
+# Remove a previously added service
+npx vibecarbon remove <service>
+```
+
+## n8n — Workflow Automation
+
+A self-hosted workflow automation platform for building integrations, scheduled jobs, and webhook-driven pipelines.
+
+```bash
+npx vibecarbon add n8n
+```
+
+**What gets added:**
+- `docker-compose.n8n.yml` — n8n container with PostgreSQL backend
+- `k8s/base/n8n/` — Kubernetes manifests
+- `volumes/db/n8n-init.sh` — Database initialization script
+- Environment variables: `N8N_WEBHOOK_URL`, `N8N_API_KEY`
+- Feature flags: `VITE_N8N_ENABLED`, `N8N_ENABLED`
+
+| Setting | Value |
+|---------|-------|
+| Dev URL | http://n8n.localhost |
+| Port | 5678 |
+| Production auth | Traefik ForwardAuth (`super_admin` role) |
+
+## Metabase — Business Intelligence
+
+A self-hosted analytics dashboard that connects directly to your Supabase PostgreSQL database.
+
+```bash
+npx vibecarbon add metabase
+```
+
+**What gets added:**
+- `docker-compose.metabase.yml` — Metabase container
+- `k8s/base/metabase/` — Kubernetes manifests
+- `volumes/db/metabase-init.sh` — Database initialization script
+- Environment variables: `METABASE_ADMIN_EMAIL`, `METABASE_ADMIN_PASSWORD`
+- Feature flags: `VITE_METABASE_ENABLED`, `METABASE_ENABLED`
+
+| Setting | Value |
+|---------|-------|
+| Dev URL | http://metabase.localhost |
+| Port | 3001 |
+| Production auth | Traefik ForwardAuth (`super_admin` role) |
+
+## Redis — Caching & Sessions
+
+An in-memory data store for server-side caching, rate limiting, and session storage.
+
+```bash
+npx vibecarbon add redis
+```
+
+**What gets added:**
+- `docker-compose.redis.yml` — Redis container
+- `k8s/base/redis/` — Kubernetes manifests
+- Environment variables: `REDIS_PASSWORD` (auto-generated)
+- Feature flags: `VITE_REDIS_ENABLED`, `REDIS_ENABLED`
+
+| Setting | Value |
+|---------|-------|
+| Host | localhost:6379 |
+| Credentials | Stored in `.env.local` (`REDIS_PASSWORD`) |
+
+When `REDIS_URL` is set, the built-in rate limiter automatically uses Redis for distributed limiting across multiple replicas. Without Redis, it falls back to an in-memory store — this works for single-instance deployments but does not share state across replicas.
+
+## Observability — Monitoring Stack
+
+Enables the built-in Prometheus, Grafana, and Loki stack for metrics, dashboards, and log aggregation.
+
+```bash
+npx vibecarbon add observability
+```
+
+**What gets added:**
+- Enables `docker-compose.observability.yml` (already bundled in your project)
+- Feature flags: `VITE_OBSERVABILITY_ENABLED`, `OBSERVABILITY_ENABLED`
+
+| Setting | Value |
+|---------|-------|
+| Grafana URL | http://grafana.localhost |
+| Prometheus Port | 9190 |
+| Loki Port | 3100 |
+| Production auth | Traefik ForwardAuth (`super_admin` role) |
+
+## GitHub — Repository & CI/CD
+
+CI/CD lives in `vibecarbon configure`, not `vibecarbon add`. It creates the GitHub repository (if missing), installs the canonical build + deploy workflows under `.github/workflows/`, rewrites image references to `ghcr.io/<owner>/<project>`, and flips `cicdEnabled: true` in `vibecarbon.json`.
+
+```bash
+npx vibecarbon configure
+```
+
+Pick **CI/CD** from the feature list. The wizard handles repo creation, image-ref rewriting, and workflow installation in one pass.
+
+**Prerequisites:** The [GitHub CLI](https://cli.github.com/) (`gh`) must be installed and authenticated.
+
+**What gets added:**
+- `.github/workflows/vibecarbon-build.yml` — image build pipeline
+- `.github/workflows/deploy.yml` — k8s push-deploy pipeline
+- Container image + Flux GitRepository references updated to `<owner>/<project>`
+
+## Production Auth for Admin Services
+
+In development, n8n, Metabase, and Grafana are accessible without authentication. In production, they are protected by Traefik ForwardAuth — only users with the `super_admin` role can access them.
+
+The dev override compose files disable this requirement locally. When adding a new service that needs protection, follow the same pattern:
+
+1. Add `traefik.http.routers.<name>.middlewares=super-admin-auth@file` in the service compose file
+2. Create a dev override that sets the middleware to empty
+
+## Feature Flags
+
+Each service sets client and server feature flags in `.env.local`:
+
+| Service | Client Flag | Server Flag |
+|---------|------------|-------------|
+| n8n | `VITE_N8N_ENABLED` | `N8N_ENABLED` |
+| Metabase | `VITE_METABASE_ENABLED` | `METABASE_ENABLED` |
+| Redis | `VITE_REDIS_ENABLED` | `REDIS_ENABLED` |
+| Observability | `VITE_OBSERVABILITY_ENABLED` | `OBSERVABILITY_ENABLED` |
+
+Use these flags to conditionally render UI elements or enable server-side integrations:
+
+```typescript
+// Client-side
+if (import.meta.env.VITE_N8N_ENABLED === 'true') {
+  // Show n8n link in admin sidebar
+}
+
+// Server-side
+if (process.env.REDIS_ENABLED === 'true') {
+  // Use Redis for caching
+}
+```

package/carbon/db/Dockerfile

@@ -0,0 +1,23 @@
+# syntax=docker/dockerfile:1
+FROM supabase/postgres:15.8.1.085
+
+# Install WAL-G v3.0.5 — kept in lockstep with carbon/backup/Dockerfile.
+# Earlier v3.0.3 URL 404'd in 2026-04-26 (alpine variant retired upstream),
+# and curl without --fail piped a 404 HTML body into tar which surfaced
+# as "not in gzip format" instead of an honest HTTP error. --fail makes
+# curl exit non-zero on 4xx/5xx so the failure is unmistakable.
+#
+# Single RUN with `apt-get purge -y --auto-remove curl` collapses the
+# install + cleanup into one layer so the curl binary doesn't end up
+# in the published image (saving ~5MB and reducing attack surface).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        curl \
+        ca-certificates \
+    && curl -fL https://github.com/wal-g/wal-g/releases/download/v3.0.5/wal-g-pg-ubuntu-22.04-amd64.tar.gz | tar -xz \
+    && mv wal-g-pg-ubuntu-22.04-amd64 /usr/local/bin/wal-g \
+    && chmod +x /usr/local/bin/wal-g \
+    && apt-get purge -y --auto-remove curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# The supabase image already has many configurations.
+# We will enable archiving via environment variables or a custom config snippet if needed.

package/carbon/docker-compose.dev-init.yml

@@ -0,0 +1,5 @@
+# Generated by dev-init.js — DO NOT COMMIT
+services:
+  db:
+    volumes:
+      - ./volumes/db/super-admin.generated.sql:/docker-entrypoint-initdb.d/post-init/super-admin.sql:Z

package/carbon/docker-compose.metabase.override.yml

@@ -0,0 +1,14 @@
+# Development overrides for Metabase
+# Use with: docker compose -f docker-compose.yml -f docker-compose.metabase.yml -f docker-compose.metabase.override.yml up -d
+
+services:
+  metabase:
+    labels:
+      # Dev: No auth required (same as studio/traefik in local dev)
+      # Production uses ForwardAuth via docker-compose.metabase.yml labels
+      # Empty middlewares override removes ForwardAuth requirement
+      - "traefik.enable=true"
+      - "traefik.http.routers.metabase.rule=Host(`metabase.localhost`)"
+      - "traefik.http.routers.metabase.entrypoints=web"
+      - "traefik.http.routers.metabase.middlewares="
+      - "traefik.http.services.metabase.loadbalancer.server.port=3000"

package/carbon/docker-compose.metabase.prod.yml

@@ -0,0 +1,28 @@
+# Metabase Production Overrides
+# Use with: docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.metabase.yml -f docker-compose.metabase.prod.yml up -d
+#
+# Adds:
+# - SSL subdomain routing for Metabase (metabase.yourdomain.com)
+# - ForwardAuth (super_admin role required)
+# - HTTP to HTTPS redirect
+
+services:
+  metabase:
+    environment:
+      # Override site URL for production subdomain
+      - MB_SITE_URL=https://metabase.${DOMAIN}
+      - MB_EMBEDDING_APP_ORIGIN=https://${DOMAIN}
+    labels:
+      # Production Traefik routing with SSL
+      - "traefik.enable=true"
+      # HTTPS router with super_admin auth
+      - "traefik.http.routers.metabase.rule=Host(`metabase.${DOMAIN}`)"
+      - "traefik.http.routers.metabase.entrypoints=websecure"
+      - "traefik.http.routers.metabase.tls=true"
+      - "traefik.http.routers.metabase.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.metabase.middlewares=super-admin-auth@file"
+      - "traefik.http.services.metabase.loadbalancer.server.port=3000"
+      # HTTP to HTTPS redirect
+      - "traefik.http.routers.metabase-http.rule=Host(`metabase.${DOMAIN}`)"
+      - "traefik.http.routers.metabase-http.entrypoints=web"
+      - "traefik.http.routers.metabase-http.middlewares=redirect-to-https"