vibecarbon 0.1.0

package/carbon/docker-compose.metabase.yml

@@ -0,0 +1,84 @@
+# Metabase Analytics - Docker Compose Override
+# Use with: docker compose -f docker-compose.yml -f docker-compose.metabase.yml up -d
+#
+# Access:
+#   Local dev: http://metabase.localhost (subdomain routing)
+#   Production: /admin/metabase (path routing via docker-compose.prod.yml)
+# Auth: Requires super_admin role via Traefik ForwardAuth
+# Docs: https://www.metabase.com/docs/latest/
+
+services:
+  # Extend db service to add metabase database initialization
+  db:
+    volumes:
+      - ./volumes/db/metabase-init.sh:/docker-entrypoint-initdb.d/zz-metabase-init.sh:Z
+
+  metabase:
+    image: metabase/metabase:latest
+    container_name: ${PROJECT_NAME:-vibecarbon}-metabase
+    restart: unless-stopped
+    environment:
+      # Database connection for Metabase app data
+      - MB_DB_TYPE=postgres
+      - MB_DB_DBNAME=metabase
+      - MB_DB_PORT=5432
+      - MB_DB_USER=metabase
+      - MB_DB_PASS=${POSTGRES_PASSWORD}
+      - MB_DB_HOST=db
+      # Site configuration
+      - MB_SITE_URL=${METABASE_SITE_URL:-http://metabase.localhost}
+      - MB_SITE_NAME=${PROJECT_NAME:-Vibecarbon} Analytics
+      # Embedding configuration for iframe access
+      - MB_EMBEDDING_APP_ORIGIN=${SITE_URL:-http://localhost:5173}
+      - MB_ENABLE_EMBEDDING=true
+      # Security settings
+      - MB_PASSWORD_COMPLEXITY=strong
+      - MB_SESSION_COOKIES=true
+      - MB_COOKIE_SAMESITE=lax
+      # Timezone
+      - MB_TIMEZONE=${TIMEZONE:-UTC}
+      - JAVA_TIMEZONE=${TIMEZONE:-UTC}
+      # Performance
+      - JAVA_OPTS=-Xmx2g
+    volumes:
+      - metabase_data:/metabase-data
+    networks:
+      - vibecarbon-network
+    labels:
+      # Traefik routing with ForwardAuth (super_admin only)
+      # Local dev uses subdomain: metabase.localhost
+      - "traefik.enable=true"
+      - "traefik.http.routers.metabase.rule=Host(`metabase.localhost`)"
+      - "traefik.http.routers.metabase.entrypoints=web"
+      - "traefik.http.routers.metabase.middlewares=super-admin-auth@file"
+      - "traefik.http.services.metabase.loadbalancer.server.port=3000"
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:3000/api/health || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 8
+      start_period: 120s
+
+  metabase-setup:
+    image: alpine:latest
+    container_name: ${PROJECT_NAME:-vibecarbon}-metabase-setup
+    volumes:
+      - ./volumes/metabase/scripts:/scripts:ro
+    environment:
+      - METABASE_URL=http://metabase:3000
+      - METABASE_ADMIN_EMAIL=${METABASE_ADMIN_EMAIL:-${ADMIN_EMAIL}}
+      - METABASE_ADMIN_PASSWORD=${METABASE_ADMIN_PASSWORD:-${ADMIN_PASSWORD}}
+      - DB_PASSWORD=${DB_PASSWORD}
+    entrypoint: ["/bin/sh", "-c", "apk add --no-cache curl jq && sh /scripts/setup.sh"]
+    depends_on:
+      metabase:
+        condition: service_healthy
+    networks:
+      - vibecarbon-network
+    restart: "no"
+
+volumes:
+  metabase_data:

package/carbon/docker-compose.n8n.override.yml

@@ -0,0 +1,14 @@
+# Development overrides for n8n
+# Use with: docker compose -f docker-compose.yml -f docker-compose.n8n.yml -f docker-compose.n8n.override.yml up -d
+
+services:
+  n8n:
+    labels:
+      # Dev: No auth required (same as studio/traefik in local dev)
+      # Production uses ForwardAuth via docker-compose.n8n.yml labels
+      # Empty middlewares override removes ForwardAuth requirement
+      - "traefik.enable=true"
+      - "traefik.http.routers.n8n.rule=Host(`n8n.localhost`)"
+      - "traefik.http.routers.n8n.entrypoints=web"
+      - "traefik.http.routers.n8n.middlewares="
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"

package/carbon/docker-compose.n8n.prod.yml

@@ -0,0 +1,31 @@
+# n8n Production Overrides
+# Use with: docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.n8n.yml -f docker-compose.n8n.prod.yml up -d
+#
+# Adds:
+# - SSL subdomain routing for n8n (n8n.yourdomain.com)
+# - ForwardAuth (super_admin role required)
+# - HTTP to HTTPS redirect
+
+services:
+  n8n:
+    environment:
+      # Override URLs for production subdomain
+      - N8N_HOST=n8n.${DOMAIN}
+      - N8N_PROTOCOL=https
+      - WEBHOOK_URL=https://n8n.${DOMAIN}/
+      - N8N_EDITOR_BASE_URL=https://n8n.${DOMAIN}/
+      - N8N_SECURE_COOKIE=true
+    labels:
+      # Production Traefik routing with SSL
+      - "traefik.enable=true"
+      # HTTPS router with super_admin auth
+      - "traefik.http.routers.n8n.rule=Host(`n8n.${DOMAIN}`)"
+      - "traefik.http.routers.n8n.entrypoints=websecure"
+      - "traefik.http.routers.n8n.tls=true"
+      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.n8n.middlewares=super-admin-auth@file"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+      # HTTP to HTTPS redirect
+      - "traefik.http.routers.n8n-http.rule=Host(`n8n.${DOMAIN}`)"
+      - "traefik.http.routers.n8n-http.entrypoints=web"
+      - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"

package/carbon/docker-compose.n8n.yml

@@ -0,0 +1,97 @@
+# n8n Workflow Automation - Docker Compose Override
+# Use with: docker compose -f docker-compose.yml -f docker-compose.n8n.yml up -d
+#
+# Access:
+#   Local dev: http://n8n.localhost (subdomain routing)
+#   Production: /admin/n8n (path routing via docker-compose.prod.yml)
+# Auth (dev): n8n's built-in auth (owner user created by setup.sh)
+# Auth (prod): ForwardAuth SSO via Traefik + hooks.js (cookie sharing works across subdomains)
+# Docs: https://docs.n8n.io/hosting/
+
+services:
+  # Extend db service to add n8n database initialization
+  db:
+    volumes:
+      - ./volumes/db/n8n-init.sh:/docker-entrypoint-initdb.d/zz-n8n-init.sh:Z
+
+  n8n:
+    image: n8nio/n8n:latest
+    container_name: ${PROJECT_NAME:-vibecarbon}-n8n
+    restart: unless-stopped
+    environment:
+      # Database connection (uses project PostgreSQL)
+      - DB_TYPE=postgresdb
+      - DB_POSTGRESDB_HOST=db
+      - DB_POSTGRESDB_PORT=5432
+      - DB_POSTGRESDB_DATABASE=n8n
+      - DB_POSTGRESDB_USER=n8n
+      # Uses project POSTGRES_PASSWORD (same as n8n-init.sh sets for the n8n role)
+      - DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD}
+      # Webhook and external URL configuration
+      - N8N_HOST=${N8N_HOST:-n8n.localhost}
+      - N8N_PORT=5678
+      - N8N_PROTOCOL=${N8N_PROTOCOL:-http}
+      - WEBHOOK_URL=${N8N_WEBHOOK_URL:-http://n8n.localhost/}
+      - N8N_EDITOR_BASE_URL=${N8N_EDITOR_BASE_URL:-http://n8n.localhost/}
+      # Security
+      # Dev default: n8n_dev_encryption_key (set N8N_ENCRYPTION_KEY in .env for production)
+      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY:-n8n_dev_encryption_key}
+      - N8N_SECURE_COOKIE=false
+      # ForwardAuth SSO hook
+      - EXTERNAL_HOOK_FILES=/home/node/.n8n/hooks.js
+      # Execution settings
+      - EXECUTIONS_MODE=queue
+      - QUEUE_BULL_REDIS_HOST=redis
+      - QUEUE_BULL_REDIS_PORT=6379
+      - QUEUE_BULL_REDIS_PASSWORD=${REDIS_PASSWORD:-}
+      # Timezone
+      - GENERIC_TIMEZONE=${TIMEZONE:-UTC}
+      - TZ=${TIMEZONE:-UTC}
+      # Metrics for Prometheus (optional)
+      - N8N_METRICS=true
+      - N8N_METRICS_PREFIX=n8n_
+    volumes:
+      - n8n_data:/home/node/.n8n
+      - ./volumes/n8n/hooks.js:/home/node/.n8n/hooks.js:ro
+    networks:
+      - vibecarbon-network
+    labels:
+      # Traefik routing — subdomain: n8n.localhost
+      # No ForwardAuth in dev (cookies don't cross localhost → n8n.localhost).
+      # Production overlay adds super-admin-auth@file middleware.
+      - "traefik.enable=true"
+      - "traefik.http.routers.n8n.rule=Host(`n8n.localhost`)"
+      - "traefik.http.routers.n8n.entrypoints=web"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:5678/healthz || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
+  n8n-setup:
+    image: alpine:latest
+    container_name: ${PROJECT_NAME:-vibecarbon}-n8n-setup
+    volumes:
+      - ./volumes/n8n/scripts:/scripts:ro
+    environment:
+      - N8N_ADMIN_EMAIL=${N8N_ADMIN_EMAIL:-${ADMIN_EMAIL}}
+      - N8N_DB_HOST=db
+      - N8N_DB_NAME=n8n
+      - N8N_DB_USER=n8n
+      # Uses project POSTGRES_PASSWORD (same as n8n-init.sh sets for the n8n role)
+      - N8N_DB_PASSWORD=${POSTGRES_PASSWORD}
+    entrypoint: ["/bin/sh", "-c", "apk add --no-cache postgresql16-client && sh /scripts/setup.sh"]
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - vibecarbon-network
+    restart: "no"
+
+volumes:
+  n8n_data:

package/carbon/docker-compose.observability.override.yml

@@ -0,0 +1,18 @@
+# Development overrides for observability stack
+# Use with: docker compose -f docker-compose.yml -f docker-compose.observability.yml -f docker-compose.observability.override.yml up -d
+
+services:
+  grafana:
+    volumes:
+      - ./volumes/grafana/provisioning/dashboards/dashboards.dev.yml:/etc/grafana/provisioning/dashboards/dashboards.yml:ro
+      - ./volumes/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
+      - ./volumes/grafana/dashboards.dev:/var/lib/grafana/dashboards:ro
+      - grafana_data:/var/lib/grafana
+    labels:
+      # Dev: No auth required (same as studio/traefik in local dev)
+      # Empty middlewares override removes ForwardAuth requirement
+      - "traefik.enable=true"
+      - "traefik.http.routers.grafana.rule=Host(`grafana.localhost`)"
+      - "traefik.http.routers.grafana.entrypoints=web"
+      - "traefik.http.routers.grafana.middlewares="
+      - "traefik.http.services.grafana.loadbalancer.server.port=3000"

package/carbon/docker-compose.observability.prod.yml

@@ -0,0 +1,28 @@
+# Observability Production Overrides
+# Use with: docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.observability.yml -f docker-compose.observability.prod.yml up -d
+#
+# Adds:
+# - SSL subdomain routing for Grafana (grafana.yourdomain.com)
+# - Security headers
+# - HTTP to HTTPS redirect
+
+services:
+  grafana:
+    environment:
+      # Override ROOT_URL for production subdomain
+      - GF_SERVER_ROOT_URL=https://grafana.${DOMAIN}
+    ports: []  # Disable direct port exposure in production
+    labels:
+      # Production Traefik routing with SSL
+      - "traefik.enable=true"
+      # HTTPS router
+      - "traefik.http.routers.grafana.rule=Host(`grafana.${DOMAIN}`)"
+      - "traefik.http.routers.grafana.entrypoints=websecure"
+      - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
+      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
+      # Security headers
+      - "traefik.http.routers.grafana.middlewares=super-admin-auth@file,security-headers@file"
+      # HTTP to HTTPS redirect
+      - "traefik.http.routers.grafana-http.rule=Host(`grafana.${DOMAIN}`)"
+      - "traefik.http.routers.grafana-http.entrypoints=web"
+      - "traefik.http.routers.grafana-http.middlewares=redirect-to-https"

package/carbon/docker-compose.observability.yml

@@ -0,0 +1,125 @@
+# Observability Stack - Docker Compose Override
+# Use with: docker compose -f docker-compose.yml -f docker-compose.observability.yml up -d
+#
+# Includes:
+# - Prometheus: Metrics collection and storage
+# - Grafana: Dashboards and visualization
+# - Loki: Log aggregation
+# - Promtail: Docker log shipper
+# - postgres-exporter: PostgreSQL metrics
+
+services:
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: ${PROJECT_NAME:-vibecarbon}-prometheus
+    restart: unless-stopped
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.path=/prometheus'
+      - '--storage.tsdb.retention.time=15d'
+      - '--web.enable-lifecycle'
+    volumes:
+      - ./volumes/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus_data:/prometheus
+    ports:
+      # Default to 9190 to avoid conflict with Google's Antigravity IDE (uses 9090-9092)
+      - "${DEV_PROMETHEUS_PORT:-9190}:9090"
+    networks:
+      - vibecarbon-network
+    healthcheck:
+      test: ['CMD', 'wget', '--spider', '-q', 'http://localhost:9090/-/healthy']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    depends_on:
+      db:
+        condition: service_healthy
+
+  grafana:
+    image: grafana/grafana:latest
+    container_name: ${PROJECT_NAME:-vibecarbon}-grafana
+    restart: unless-stopped
+    environment:
+      - GF_SECURITY_ADMIN_USER=${ADMIN_EMAIL}
+      - GF_SECURITY_ADMIN_PASSWORD=${ADMIN_PASSWORD}
+      - GF_USERS_ALLOW_SIGN_UP=false
+      - GF_SERVER_ROOT_URL=${GRAFANA_URL:-http://localhost:3002}
+      - GF_AUTH_ANONYMOUS_ENABLED=true
+      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
+      - GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH=/var/lib/grafana/dashboards/overview.json
+    volumes:
+      - ./volumes/grafana/provisioning:/etc/grafana/provisioning:ro
+      - ./volumes/grafana/dashboards:/var/lib/grafana/dashboards:ro
+      - grafana_data:/var/lib/grafana
+    ports:
+      - "${DEV_GRAFANA_PORT:-3002}:3000"
+    networks:
+      - vibecarbon-network
+    healthcheck:
+      test: ['CMD', 'wget', '--spider', '-q', 'http://localhost:3000/api/health']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    labels:
+      # Traefik routing with ForwardAuth (super_admin only)
+      # Anonymous auth is enabled so super_admins don't need a second Grafana login
+      - "traefik.enable=true"
+      - "traefik.http.routers.grafana.rule=Host(`grafana.localhost`)"
+      - "traefik.http.routers.grafana.entrypoints=web"
+      - "traefik.http.routers.grafana.middlewares=super-admin-auth@file"
+      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
+    depends_on:
+      - prometheus
+      - loki
+
+  loki:
+    image: grafana/loki:3.3.0
+    container_name: ${PROJECT_NAME:-vibecarbon}-loki
+    restart: unless-stopped
+    command: -config.file=/etc/loki/loki-config.yml
+    volumes:
+      - ./volumes/loki/loki-config.yml:/etc/loki/loki-config.yml:ro
+      - loki_data:/loki
+    ports:
+      - "${DEV_LOKI_PORT:-3100}:3100"
+    networks:
+      - vibecarbon-network
+    healthcheck:
+      test: ['CMD', 'wget', '--spider', '-q', 'http://localhost:3100/ready']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+
+  promtail:
+    image: grafana/promtail:3.3.0
+    container_name: ${PROJECT_NAME:-vibecarbon}-promtail
+    restart: unless-stopped
+    command: -config.file=/etc/promtail/promtail-config.yml
+    volumes:
+      - ./volumes/promtail/promtail-config.yml:/etc/promtail/promtail-config.yml:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+    networks:
+      - vibecarbon-network
+    depends_on:
+      - loki
+
+  postgres-exporter:
+    image: prometheuscommunity/postgres-exporter:v0.19.1
+    container_name: ${PROJECT_NAME:-vibecarbon}-postgres-exporter
+    restart: unless-stopped
+    environment:
+      DATA_SOURCE_NAME: "postgresql://supabase_admin:${POSTGRES_PASSWORD}@db:5432/postgres?sslmode=disable"
+    networks:
+      - vibecarbon-network
+    depends_on:
+      db:
+        condition: service_healthy
+
+volumes:
+  prometheus_data:
+  grafana_data:
+  loki_data:

package/carbon/docker-compose.override.yml

@@ -0,0 +1,28 @@
+# Development overrides - automatically loaded by docker compose
+# Note: Admin services (studio, traefik) have no auth in local dev - auth added via prod overlay
+#
+# IMPORTANT: For ForwardAuth to work with admin services (n8n, metabase, etc.),
+# access the app at http://app.localhost instead of http://localhost:5173.
+# This ensures auth cookies are shared across all *.localhost subdomains.
+#
+# Secrets (DB passwords, JWTs) are read from env vars at runtime — no dev-specific
+# SQL files needed for roles or service init. Only super-admin uses a dev override
+# (for the admin email and password hash).
+
+services:
+  db:
+    ports:
+      - "${DEV_DB_PORT:-5432}:5432"
+    volumes:
+      - ./volumes/db/super-admin.dev.sql:/tmp/super-admin.sql:Z
+
+  # Traefik dev config: add extra_hosts so it can reach the Vite dev server on the host
+  # Also mount dev middlewares that use host.docker.internal for ForwardAuth
+  traefik:
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./volumes/traefik:/etc/traefik/dynamic:ro
+      # Override middlewares to use host.docker.internal for ForwardAuth in dev
+      - ./volumes/traefik/middlewares.dev.yml:/etc/traefik/dynamic/middlewares.yml:ro