vibecarbon 0.1.0

package/src/lib/deploy/index.js

@@ -0,0 +1,119 @@
+/**
+ * Deployment Module Registry
+ *
+ * Four deployment modes:
+ * - compose: Docker Compose on single VPS (Fast + Pro)
+ * - compose-ha: Docker Compose HA on 2 VPS with PostgreSQL replication (Fast + Pro)
+ * - standard: Kubernetes single-region (Pro only)
+ * - ha: Kubernetes multi-region HA (Pro only)
+ */
+
+export {
+  deployComposeHA,
+  destroyComposeHA,
+  getComposeHAStatus,
+} from './compose/ha.js';
+export {
+  backupCompose,
+  deployCompose,
+  destroyCompose,
+  getComposeStatus,
+  redeployCompose,
+  restoreCompose,
+  setupServer,
+  setupServerFiles,
+  waitForSSH as waitForComposeSSH,
+} from './compose/index.js';
+export { deployK8sHA, destroyK8sHA, getK8sHAStatus, triggerFailover } from './k8s/ha/index.js';
+export { destroyK8s, getK8sStatus } from './k8s/index.js';
+export { deployK3s } from './k8s/k3s.js';
+
+/**
+ * Get the appropriate deploy function based on mode
+ * @param {string} mode - 'compose', 'compose-ha', 'kubernetes', or 'ha'
+ * @returns {Promise<Function>} Deploy function
+ */
+export function getDeployFunction(mode = 'compose') {
+  if (mode === 'ha') {
+    return import('./k8s/ha/index.js').then((m) => m.deployK8sHA);
+  }
+  if (mode === 'compose-ha') {
+    return import('./compose/ha.js').then((m) => m.deployComposeHA);
+  }
+  if (mode === 'kubernetes') {
+    return import('./k8s/k3s.js').then((m) => m.deployK3s);
+  }
+  return import('./compose/index.js').then((m) => m.deployCompose);
+}
+
+/**
+ * Get the appropriate destroy function based on mode
+ * @param {string} mode - 'compose', 'compose-ha', 'kubernetes', or 'ha'
+ * @returns {Promise<Function>} Destroy function
+ */
+export function getDestroyFunction(mode = 'compose') {
+  if (mode === 'ha') {
+    return import('./k8s/ha/index.js').then((m) => m.destroyK8sHA);
+  }
+  if (mode === 'compose-ha') {
+    return import('./compose/ha.js').then((m) => m.destroyComposeHA);
+  }
+  if (mode === 'kubernetes') {
+    return import('./k8s/index.js').then((m) => m.destroyK8s);
+  }
+  return import('./compose/index.js').then((m) => m.destroyCompose);
+}
+
+/**
+ * Deployment mode information
+ */
+export const MODES = {
+  compose: {
+    name: 'Compose',
+    displayName: 'Docker Compose',
+    description: 'Single-server deployment with Docker Compose',
+    tier: 'diamond',
+    features: [
+      'Docker Compose on single VPS',
+      'Auto HTTPS via Traefik/Caddy',
+      'All add-ons supported',
+      'Direct image transfer (no registry needed)',
+    ],
+  },
+  'compose-ha': {
+    name: 'Compose HA',
+    displayName: 'Docker Compose HA',
+    description: 'Multi-region Docker Compose with PostgreSQL replication',
+    tier: 'diamond',
+    features: [
+      'Docker Compose on 2 VPS',
+      'PostgreSQL streaming replication',
+      'Cloudflare health checks + failover',
+      'Auto HTTPS via Traefik',
+    ],
+  },
+  standard: {
+    name: 'Standard',
+    displayName: 'Kubernetes',
+    description: 'Single-region Kubernetes cluster',
+    tier: 'fullerene',
+    features: [
+      'Kubernetes cluster (1 master + workers)',
+      'Horizontal Pod Autoscaling',
+      'Traefik ingress with auto-SSL',
+      'Local Docker build & push',
+    ],
+  },
+  ha: {
+    name: 'HA',
+    displayName: 'Kubernetes HA',
+    description: 'Multi-region Kubernetes with high availability',
+    tier: 'fullerene',
+    features: [
+      'Multi-region clusters',
+      'PostgreSQL streaming replication',
+      'One-command failover',
+      'DNS health checks',
+    ],
+  },
+};

package/src/lib/deploy/k8s/LICENSE

@@ -0,0 +1,99 @@
+Elastic License 2.0 (ELv2)
+
+## Acceptance
+
+By using the Software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the Software, in each case subject
+to the limitations and conditions below.
+
+## Limitations
+
+You may not provide the Software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set
+of the features or functionality of the Software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the Software, and you may not remove or obscure any functionality in the
+Software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor in the Software. Any use of the licensor's trademarks
+is subject to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the Software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the Software. If you or your company make any written claim that the Software
+infringes or contributes to infringement of any patent, your patent license
+for the Software granted under these terms ends immediately. If your company
+makes such a claim, your patent license ends immediately for work on behalf of
+your company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the Software from
+you also gets a copy of these terms.
+
+If you modify the Software, you must include in any modified copies of the
+Software prominent notices stating that you have modified the Software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the Software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license
+no later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your
+licenses to terminate automatically and permanently.
+
+## No Liability
+
+As far as the law allows, the Software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the Software, under any kind of
+legal claim.
+
+## Definitions
+
+The "licensor" is the entity offering these terms, Vibecarbon.
+
+The "Software" is the software the licensor makes available under these terms,
+including any portion of it.
+
+"You" refers to the individual or entity agreeing to these terms.
+
+"Your company" is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+"Control" means ownership of substantially all the assets of an entity, or the
+power to direct its management and policies by vote, contract, or otherwise.
+Control can be direct or indirect.
+
+"Your licenses" are all the licenses granted to you for the Software under
+these terms.
+
+"Use" means anything you do with the Software requiring one of your licenses.
+
+"Trademark" means trademarks, service marks, and similar rights.
+
+---
+
+Copyright (c) 2026 Vibecarbon
+
+For the full Elastic License 2.0 text, see:
+https://www.elastic.co/licensing/elastic-license

package/src/lib/deploy/k8s/gitops-deploy.js

@@ -0,0 +1,298 @@
+/**
+ * Phase 4.3c of the GitOps refactor: the thin GitOps-driven deploy path.
+ *
+ * stale-deploy-ignore: historical context — describes what this file replaced.
+ * Replaces the ~2000 LOC imperative `applyKubernetesManifests` with:
+ *   1. Render deploy-time-varying manifests into the customer's k8s/ tree
+ *      (image tag in app Deployment, rendered Supabase values.yaml).
+ *   2. git add k8s/ && git commit && git push.
+ *   3. Seed GitHub Environment secrets + vars + upload KUBECONFIG_B64.
+ *   4. Trigger .github/workflows/deploy.yml + wait for completion.
+ *
+ * The workflow (Phase 4.3b.C) installs Flux + root Kustomization + applies
+ * vibecarbon-secrets / hetzner-api-token / kube-system/hcloud Secrets.
+ * Flux reconciles the rest from the committed k8s/ tree.
+ *
+ * Callers: `vibecarbon configure cicd <env>` (PR 7) layers this onto an
+ * already-running local-first cluster. Pre-PR-5 it was the default for
+ * `vibecarbon deploy --k8s --gitops`; that flag was retired with PR 5.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import * as p from '@clack/prompts';
+import {
+  seedEnvironmentSecrets,
+  seedOrgSecrets,
+  triggerDeployWorkflow,
+  uploadKubeconfig,
+  waitForLatestWorkflowRun,
+} from '../../github-environments.js';
+
+/**
+ * Render `{{PLACEHOLDER}}` tokens in a text file in-place. Used to bake
+ * the deploy-time image tag + domain into manifests before committing.
+ */
+function renderInPlace(path, vars) {
+  if (!existsSync(path)) return;
+  let content = readFileSync(path, 'utf-8');
+  for (const [key, value] of Object.entries(vars)) {
+    content = content.replaceAll(`{{${key}}}`, String(value ?? ''));
+  }
+  writeFileSync(path, content);
+}
+
+/**
+ * Resolve the real `{owner, name}` of the deploy target repo.
+ *
+ * At `vibecarbon create` time both placeholders bake to `projectName`
+ * (see src/create.js:616), producing `ghcr.io/<project>/<project>` image
+ * refs and `github.com/<project>/<project>` Flux URLs. Those paths only
+ * match reality when the user later runs `vibecarbon configure` → CI/CD
+ * with project name == repo name (which calls updateImageReferences()).
+ * E2E tests (and any user whose repo slug differs) need the real
+ * owner/repo wired in at deploy time, which is what this helper handles.
+ */
+function resolveOwnerAndRepo(projectDir) {
+  try {
+    const out = execFileSync(
+      'gh',
+      ['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner'],
+      { cwd: projectDir, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] },
+    ).trim();
+    const [owner, name] = out.split('/');
+    if (owner && name) return { owner, name };
+  } catch {}
+  try {
+    const url = execFileSync('git', ['remote', 'get-url', 'origin'], {
+      cwd: projectDir,
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/);
+    if (m) return { owner: m[1], name: m[2] };
+  } catch {}
+  return null;
+}
+
+function escapeForRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Rewrite stale `<project>/<project>` owner+repo pairs in ghcr.io image
+ * refs and github.com Flux URLs to the real `<owner>/<repoName>` pair.
+ * Idempotent: after one pass the paths no longer match the stale pattern
+ * so subsequent calls are no-ops.
+ */
+function rewriteOwnerAndRepo(projectDir, projectName, owner, repoName) {
+  const pn = escapeForRegex(projectName);
+  // ghcr.io/<stale>/<project>[-db|-backup]  → ghcr.io/<owner>/<repoName>[-db|-backup]
+  const ghcrRe = new RegExp(`ghcr\\.io/[^/\\s:]+/${pn}(-db|-backup)?\\b`, 'g');
+  // github.com/<stale>/<project>  → github.com/<owner>/<repoName>
+  //   Match plain `github.com/a/b` plus optional `.git` suffix. Avoid
+  //   devouring a trailing path segment (e.g. branch names) by anchoring
+  //   on word-boundary / end.
+  const ghRe = new RegExp(`github\\.com/[^/\\s:]+/${pn}(?=\\.git\\b|[^\\w-]|$)`, 'g');
+
+  const files = [
+    'k8s/base/app/deployment.yaml',
+    'k8s/base/backup/cronjob.yaml',
+    'k8s/values/supabase.values.yaml',
+    'k8s/overlays/production/kustomization.yaml',
+    'k8s/flux/clusters/primary/vibecarbon.yaml',
+    'k8s/flux/clusters/standby/vibecarbon.yaml',
+  ];
+
+  for (const rel of files) {
+    const path = join(projectDir, rel);
+    if (!existsSync(path)) continue;
+    const before = readFileSync(path, 'utf-8');
+    const after = before
+      .replace(ghcrRe, (_match, suffix) => `ghcr.io/${owner}/${repoName}${suffix ?? ''}`)
+      .replace(ghRe, `github.com/${owner}/${repoName}`);
+    if (after !== before) writeFileSync(path, after);
+  }
+}
+
+/**
+ * Commit the k8s/ tree + push to origin/main. Returns true if a commit was
+ * actually made, false if the tree was already clean.
+ */
+function commitAndPushManifests(cwd, message) {
+  // Stage only k8s/ — don't accidentally commit unrelated dirty files.
+  execFileSync('git', ['add', 'k8s/'], { cwd });
+
+  // `git diff --cached --quiet` exits 0 if nothing staged, 1 if changes.
+  const hasChanges = (() => {
+    try {
+      execFileSync('git', ['diff', '--cached', '--quiet'], { cwd });
+      return false;
+    } catch {
+      return true;
+    }
+  })();
+
+  if (hasChanges) {
+    execFileSync('git', ['commit', '-m', message], { cwd });
+  }
+  // Push unconditionally — the remote may have commits we need to fast-forward
+  // (e.g., previous deploy from a different workstation). If the commit above
+  // was a no-op, this is a cheap no-op too.
+  execFileSync('git', ['push', 'origin', 'HEAD:main'], { cwd });
+  return hasChanges;
+}
+
+/**
+ * Full GitOps deploy: render manifests, commit + push, seed GitHub
+ * Environment, trigger workflow, wait for Flux reconciliation.
+ *
+ * @param {object} args
+ * @param {string} args.projectDir - customer repo root
+ * @param {string} args.environment - "dev" | "staging" | "prod"
+ * @param {string} args.domain - deployed domain
+ * @param {string} args.projectName
+ * @param {string} args.kubeconfigPath - path to kubeconfig fetched from the cluster
+ * @param {string} args.networkId - Hetzner private network ID (Pulumi output)
+ * @param {string} args.dnsProvider - "cloudflare" | "hetzner" | "manual"
+ * @param {object} args.creds - ~/.vibecarbon/credentials.json contents
+ * @param {string} [args.imageTag] - specific image tag to bake into app Deployment (default "main")
+ * @param {number} [args.workflowTimeoutSec] - default 60 min. deploy.yml's
+ *   internal Flux waits cap at 10m (vibecarbon-base) + 20m (vibecarbon-supabase)
+ *   = 30m, on top of ~5m Flux install + ~5m CRD apply. A 30m outer budget
+ *   ties with the internal ceiling — every timeout was racing the workflow
+ *   to its own error. 3600s gives the workflow room to fail naturally and
+ *   surface its own log.
+ */
+export async function deployK8sGitOps(args) {
+  const {
+    projectDir,
+    environment,
+    domain,
+    projectName,
+    kubeconfigPath,
+    networkId,
+    dnsProvider,
+    creds,
+    imageTag,
+    workflowTimeoutSec = 3600,
+    skipCi = false,
+  } = args;
+
+  const s = p.spinner();
+  const skipCiStr = skipCi ? ' [skip ci]' : '';
+
+  // 1. Render image tag + values.yaml into the repo. The Supabase values.yaml
+  // (Phase 4.3a) already renders here; repeat is idempotent. The app
+  // Deployment manifest uses {{GITHUB_OWNER}}/{{PROJECT_NAME}} from create
+  // time — we add {{IMAGE_TAG}} rendering so Flux pulls the exact tag the
+  // CI build just published.
+  s.start('Rendering manifests for GitOps deploy');
+  // Flux GitRepository URL + every ghcr.io image ref bakes in owner/repo at
+  // create time as <project>/<project>. Rewrite to the real pair before we
+  // commit, otherwise Flux source-controller 403s cloning the nonexistent
+  // github.com/<project>/<project> and Kustomizations never reconcile.
+  const resolvedRepo = resolveOwnerAndRepo(projectDir);
+  const repoOwner = args.githubOwner || resolvedRepo?.owner;
+  const repoName = resolvedRepo?.name || projectName;
+  if (!repoOwner) {
+    throw new Error(
+      `GitOps deploy: could not resolve GitHub owner for ${projectDir}. ` +
+        `Run 'gh repo view' or 'git remote get-url origin' and ensure origin points at github.com.`,
+    );
+  }
+  rewriteOwnerAndRepo(projectDir, projectName, repoOwner, repoName);
+  const appDeployment = join(projectDir, 'k8s', 'base', 'app', 'deployment.yaml');
+  if (existsSync(appDeployment) && imageTag) {
+    // Only substitute — don't touch tags that are already concrete. The
+    // default template uses `:main`; callers passing a pinned imageTag can
+    // rewrite that via renderInPlace if the template exposes {{IMAGE_TAG}}
+    // (follow-up: switch template to use {{IMAGE_TAG}} so SHAs can pin).
+    renderInPlace(appDeployment, { IMAGE_TAG: imageTag });
+  }
+  const supabaseValues = join(projectDir, 'k8s', 'gitops', 'supabase', 'values.yaml');
+  if (existsSync(supabaseValues)) {
+    // values.yaml is already rendered by Phase 4.3a's ensureVibecarbonSecrets
+    // call chain, but re-render here with {{DOMAIN}}/{{PROJECT_NAME}} in
+    // case the caller landed us without that step (e.g., `vibecarbon
+    // configure cicd <env>` against a cluster whose initial deploy
+    // didn't run the imperative bundle path).
+    renderInPlace(supabaseValues, {
+      DOMAIN: domain,
+      PROJECT_NAME: projectName,
+      S3_BACKUP_BUCKET: args.s3BackupBucket || `${projectName}-backups`,
+      GITHUB_OWNER: repoOwner,
+    });
+  }
+  s.stop('Manifests rendered');
+
+  // 2. git add/commit/push — this is the deploy.
+  s.start('Committing + pushing k8s/ tree to customer repo');
+  const commitMsg = `deploy(${environment}): ${imageTag || 'latest'} @ ${new Date().toISOString()}${skipCiStr}`;
+  const pushed = commitAndPushManifests(projectDir, commitMsg);
+  s.stop(pushed ? 'Pushed new deploy commit' : 'Tree already clean, no new commit');
+
+  // 3. Seed GitHub Environment secrets + upload kubeconfig. Repo-level
+  // secrets (Hetzner token, Cloudflare token, S3 creds) are idempotent; env
+  // secrets + KUBECONFIG_B64 get written fresh every deploy (rotation path).
+  s.start(`Seeding GitHub Environment '${environment}'`);
+  await seedOrgSecrets(creds);
+
+  const envLocal = parseEnvLocal(projectDir);
+  const perEnvSecrets = {
+    DB_PASSWORD: envLocal.DB_PASSWORD,
+    JWT_SECRET: envLocal.JWT_SECRET,
+    SUPABASE_ANON_KEY: envLocal.SUPABASE_ANON_KEY || envLocal.ANON_KEY,
+    SUPABASE_SERVICE_ROLE_KEY: envLocal.SUPABASE_SERVICE_ROLE_KEY || envLocal.SERVICE_ROLE_KEY,
+    REALTIME_SECRET: envLocal.REALTIME_SECRET,
+    DB_ENC_KEY: envLocal.DB_ENC_KEY,
+    VAULT_ENC_KEY: envLocal.VAULT_ENC_KEY,
+    PG_META_CRYPTO_KEY: envLocal.PG_META_CRYPTO_KEY,
+    LOGFLARE_API_KEY: envLocal.LOGFLARE_API_KEY,
+    ADMIN_EMAIL: envLocal.ADMIN_EMAIL,
+    ADMIN_PASSWORD: envLocal.ADMIN_PASSWORD,
+    SMTP_PASSWORD: envLocal.SMTP_PASS,
+  };
+  const perEnvVars = {
+    SITE_URL: domain ? `https://${domain}` : '',
+    DNS_PROVIDER: dnsProvider || '',
+    HCLOUD_NETWORK_ID: networkId || '',
+  };
+  await seedEnvironmentSecrets(environment, perEnvSecrets, perEnvVars);
+  await uploadKubeconfig(environment, kubeconfigPath);
+  s.stop(`GitHub Environment '${environment}' seeded`);
+
+  // 4. Trigger the deploy workflow on the just-pushed commit + wait for
+  // completion. The workflow_dispatch trigger takes environment as an
+  // input; the concurrency group ensures only one run per env at a time.
+  s.start(`Triggering deploy.yml workflow for '${environment}'`);
+  await triggerDeployWorkflow(environment);
+  s.stop('Workflow triggered');
+
+  s.start('Waiting for Flux reconciliation (via GitHub Actions)');
+  const result = await waitForLatestWorkflowRun(workflowTimeoutSec);
+  s.stop(`Workflow run ${result.runId} succeeded`);
+
+  return { runId: result.runId, pushed };
+}
+
+/**
+ * Minimal .env.local parser. Handles double-quoted, single-quoted, and
+ * bare values; ignores comments and blank lines. Mirrors the readDotenv
+ * helper in src/lib/deploy/k8s/index.js — kept as a small duplicate here
+ * to avoid a cross-module import dependency that forces bringing the
+ * full k8s deploy module into GitOps flow.
+ */
+function parseEnvLocal(projectDir) {
+  const path = join(projectDir, '.env.local');
+  if (!existsSync(path)) return {};
+  const out = {};
+  for (const line of readFileSync(path, 'utf-8').split(/\r?\n/)) {
+    const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|(.*))\s*$/);
+    if (!m) continue;
+    const [, key, dq, sq, raw] = m;
+    out[key] = dq ?? sq ?? raw ?? '';
+  }
+  return out;
+}