vibecarbon 0.1.0

package/src/lib/deploy/compose/acme-verify.js

@@ -0,0 +1,121 @@
+/**
+ * Verify Traefik has acquired Let's Encrypt certificates after compose-up,
+ * and self-heal a stuck ACME state by restarting Traefik.
+ *
+ * Why this exists: Traefik's ACME engine bursts ~7 attempts in ~30s on
+ * container start, then waits ~24h for the next renewal-check tick. If
+ * the first burst fails (typically because DNS hasn't propagated yet —
+ * see src/lib/dns-propagation.js for the cold-deploy fix), Traefik
+ * settles into a state where acme.json has 0 issued certs and the
+ * customer's browser sees the TRAEFIK DEFAULT CERT
+ * (NET::ERR_CERT_AUTHORITY_INVALID).
+ *
+ * Cold deploys on v3.6.2+ avoid the original race by writing DNS before
+ * compose-up. But customers stuck on v3.6.1's failure state can't recover
+ * via warm redeploy alone — `docker compose up -d` is a no-op for
+ * Traefik when nothing changed, so the broken in-memory state persists.
+ *
+ * This helper polls acme.json post-deploy expecting at least one cert;
+ * if Traefik is still empty after ~90s, it restarts the container,
+ * which forces a fresh ACME run against now-valid DNS. Healthy DNS
+ * yields a cert in ~30s of the restart. If the restart still doesn't
+ * produce a cert, we log a warning but don't fail the deploy — could
+ * be LE rate limits, port 80 unreachable, etc., none of which a CLI
+ * restart can fix.
+ */
+
+import { sshRunAsync } from './index.js';
+
+const POLL_INTERVAL_MS = 5_000;
+const INITIAL_POLL_TIMEOUT_MS = 90_000;
+const POST_RESTART_POLL_TIMEOUT_MS = 90_000;
+
+/**
+ * SSH into the server, exec `cat /letsencrypt/acme.json` inside the
+ * Traefik container, return the count of issued certs (0 if anything
+ * goes wrong — empty acme.json, malformed JSON, SSH error, etc.).
+ */
+async function readAcmeCertCount(ip, sshKeyPath, projectName) {
+  let raw;
+  try {
+    raw = await sshRunAsync(
+      ip,
+      sshKeyPath,
+      `cd /opt/${projectName} && docker compose exec -T traefik cat /letsencrypt/acme.json 2>/dev/null`,
+      { timeout: 15_000 },
+    );
+  } catch {
+    return 0;
+  }
+  if (!raw || typeof raw !== 'string') return 0;
+  try {
+    const parsed = JSON.parse(raw);
+    const certs = parsed?.letsencrypt?.Certificates;
+    return Array.isArray(certs) ? certs.length : 0;
+  } catch {
+    return 0;
+  }
+}
+
+async function pollForCert(ip, sshKeyPath, projectName, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if ((await readAcmeCertCount(ip, sshKeyPath, projectName)) > 0) return true;
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    await new Promise((r) => setTimeout(r, Math.min(POLL_INTERVAL_MS, remaining)));
+  }
+  return false;
+}
+
+/**
+ * Wait for Traefik to acquire at least one cert; if it doesn't within
+ * the initial budget, restart the container and wait again. Logs progress
+ * via the provided logger (typically @clack/prompts p.log). Never throws
+ * — TLS issuance is best-effort; the deploy succeeds even if the cert
+ * never lands (operator can investigate via SSH).
+ *
+ * @param {string} ip - server IP
+ * @param {string} sshKeyPath - path to private key
+ * @param {string} projectName - compose project name (= directory in /opt/)
+ * @param {string} domain - configured domain (for log messages only)
+ * @param {{ message?: Function, success?: Function, warn?: Function }} log
+ */
+export async function ensureTraefikCert(ip, sshKeyPath, projectName, domain, log) {
+  log.message?.(`Verifying TLS certificate for ${domain}...`);
+  const acquired = await pollForCert(ip, sshKeyPath, projectName, INITIAL_POLL_TIMEOUT_MS);
+  if (acquired) {
+    log.success?.(`TLS certificate issued for ${domain}`);
+    return;
+  }
+  log.warn?.(
+    `Traefik has no certificate for ${domain} after ${INITIAL_POLL_TIMEOUT_MS / 1000}s — ` +
+      `restarting to clear stale ACME state and retry`,
+  );
+  try {
+    await sshRunAsync(ip, sshKeyPath, `cd /opt/${projectName} && docker compose restart traefik`, {
+      timeout: 60_000,
+    });
+  } catch (err) {
+    log.warn?.(`Traefik restart failed: ${err instanceof Error ? err.message : String(err)}`);
+    return;
+  }
+  const acquiredAfterRestart = await pollForCert(
+    ip,
+    sshKeyPath,
+    projectName,
+    POST_RESTART_POLL_TIMEOUT_MS,
+  );
+  if (acquiredAfterRestart) {
+    log.success?.(`TLS certificate issued for ${domain} after Traefik restart`);
+    return;
+  }
+  log.warn?.(
+    `Traefik still has no certificate for ${domain} after restart. ` +
+      `Check DNS resolution (dig +short ${domain}) and acme.json on the server. ` +
+      `If both look correct, ACME may complete in the background within minutes.`,
+  );
+}
+
+// Re-exported for tests; not part of the public surface.
+export const __test__ = { readAcmeCertCount, pollForCert };

package/src/lib/deploy/compose/build-args.js

@@ -0,0 +1,78 @@
+/**
+ * Collect VITE_* build args for compose production deploys.
+ *
+ * Why this exists: Vite inlines `import.meta.env.VITE_*` at build time —
+ * the values are baked into the JS bundle that the browser downloads.
+ * The Dockerfile declares matching `ARG VITE_*` directives. Without
+ * `docker build --build-arg KEY=VALUE` flags, the ARGs default to empty
+ * strings, `ENV VITE_*=$VITE_*` propagates "" to the Vite build, and the
+ * shipped bundle has e.g. `VITE_SUPABASE_URL=""`. The runtime guard at
+ * carbon/src/client/lib/supabase.ts throws "Missing Supabase environment
+ * variables" the moment the page loads.
+ *
+ * Local dev sidesteps this via `docker compose up --build` reading
+ * docker-compose.yml's `build.args:` block (which sources from .env.local).
+ * Production uses docker-compose.prod.yml which does `build: !reset null`
+ * — the prod stack pulls a pre-built image rather than building, so the
+ * args block doesn't run. The image is built earlier by vibecarbon's own
+ * code (orchestrator.js / compose/ha.js calling buildRemote or a plain
+ * `docker build`), and THAT path was passing no build args at all.
+ *
+ * Customer RCA: vibecarbon.com 2026-05-19, post-cert-fix the browser
+ * threw "Missing Supabase environment variables" because the bundle had
+ * empty VITE_SUPABASE_URL.
+ *
+ * Selection rule: every key in .env.local that starts with `VITE_` is
+ * pulled through. We further rewrite a couple of values that must differ
+ * between local dev and production (mirrors bundle.js's runtime .env
+ * rewrites at src/lib/deploy/bundle.js:147-152):
+ *   - VITE_PROJECT_NAME: forced to the deploy's projectName (the operator
+ *     might have changed it in .env.local during local dev iteration)
+ *   - VITE_SUPABASE_URL: rewritten to https://api.${domain} so the browser
+ *     talks to the production Kong gateway instead of localhost
+ *
+ * All other VITE_* values (feature flags, plausible config, etc.) flow
+ * through unchanged.
+ */
+
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseDotenv } from '../../shell.js';
+
+/**
+ * @param {string} cwd - Project root (where .env.local lives)
+ * @param {{ projectName?: string, domain?: string }} [opts]
+ * @returns {Record<string, string>} Build args keyed by ARG name
+ */
+export function collectComposeBuildArgs(cwd, opts = {}) {
+  const { projectName, domain } = opts;
+  const args = {};
+  const envPath = join(cwd, '.env.local');
+  if (existsSync(envPath)) {
+    const parsed = parseDotenv(readFileSync(envPath, 'utf-8'));
+    for (const [k, v] of Object.entries(parsed)) {
+      if (k.startsWith('VITE_')) args[k] = v;
+    }
+  }
+  // Prod rewrites — these must match what bundle.js writes into the
+  // server's runtime .env so the client + server agree on the URL.
+  if (projectName) args.VITE_PROJECT_NAME = projectName;
+  if (domain) args.VITE_SUPABASE_URL = `https://api.${domain}`;
+  return args;
+}
+
+/**
+ * Flatten a build-args dict into a `[..., '--build-arg', 'K=V', ...]`
+ * argv tail suitable for `docker build`. Skips entries with empty/null
+ * values — Docker treats empty `--build-arg K=` as a literal empty
+ * value which is rarely what callers want.
+ */
+export function buildArgFlags(args) {
+  /** @type {string[]} */
+  const out = [];
+  for (const [k, v] of Object.entries(args)) {
+    if (v === undefined || v === null || v === '') continue;
+    out.push('--build-arg', `${k}=${v}`);
+  }
+  return out;
+}