vibecarbon 0.1.0

package/carbon/docker-compose.yml

@@ -0,0 +1,508 @@
+# Vibecarbon Docker Compose
+# Supabase self-hosted + Hono API + Traefik reverse proxy
+
+services:
+  # ===========================================
+  # REVERSE PROXY
+  # ===========================================
+  traefik:
+    image: traefik:v3.6.11
+    container_name: ${PROJECT_NAME}-traefik
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - NET_BIND_SERVICE
+    read_only: true
+    tmpfs:
+      - /tmp
+    command:
+      - "--api.dashboard=true"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.file.directory=/etc/traefik/dynamic"
+      - "--entrypoints.web.address=:80"
+      - "--log.level=INFO"
+    ports:
+      - "${DEV_TRAEFIK_PORT:-80}:80"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./volumes/traefik:/etc/traefik/dynamic:ro
+    networks:
+      - vibecarbon-network
+    labels:
+      - "traefik.enable=true"
+      # Subdomain routing - auth added via prod overlay (docker-compose.prod.yml)
+      - "traefik.http.routers.dashboard.rule=Host(`traefik.${DOMAIN:-localhost}`)"
+      - "traefik.http.routers.dashboard.entrypoints=web"
+      - "traefik.http.routers.dashboard.service=api@internal"
+
+  # ===========================================
+  # APPLICATION
+  # ===========================================
+  app:
+    build:
+      context: .
+      args:
+        VITE_PROJECT_NAME: ${PROJECT_NAME}
+        VITE_SUPABASE_URL: ${SITE_URL}
+        VITE_SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
+        VITE_PLAUSIBLE_DOMAIN: ${VITE_PLAUSIBLE_DOMAIN:-}
+        VITE_PLAUSIBLE_SCRIPT_URL: ${VITE_PLAUSIBLE_SCRIPT_URL:-}
+    container_name: ${PROJECT_NAME}-app
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp
+    environment:
+      - NODE_ENV=production
+      - SUPABASE_URL=http://kong:8000
+      - SUPABASE_ANON_KEY=${SUPABASE_ANON_KEY}
+      - SUPABASE_SERVICE_ROLE_KEY=${SUPABASE_SERVICE_ROLE_KEY}
+      - SITE_URL=${SITE_URL:-http://localhost:5173}
+    depends_on:
+      # The Hono backend uses the Supabase JS client (calls flow through Kong)
+      # and never touches postgres directly, so we don't need `db: healthy`
+      # gating app startup. `service_started` on both lets the app boot in
+      # parallel with db's ~20-30s initial warmup.
+      db:
+        condition: service_started
+      kong:
+        condition: service_started
+    networks:
+      - vibecarbon-network
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.app.rule=Host(`localhost`)"
+      - "traefik.http.routers.app.entrypoints=web"
+      - "traefik.http.services.app.loadbalancer.server.port=3000"
+
+  # ===========================================
+  # SUPABASE CORE SERVICES
+  # ===========================================
+
+  # PostgreSQL Database
+  db:
+    build:
+      context: ./db
+    image: ${PROJECT_NAME}-db:latest
+    # The db image is built locally from ./db (no registry to pull from).
+    # Without this, compose's default `pull_policy: missing` first attempts
+    # a Docker Hub pull, which 401s with "pull access denied for {image}"
+    # before falling back to the local build. Functional but scary noise on
+    # every `docker compose up` invocation.
+    pull_policy: build
+    container_name: ${PROJECT_NAME}-db
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "localhost"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      # First-time init runs all Supabase migrations + WAL-G init before the
+      # server accepts TCP connections (~60-150s under fanout-3 load — observed
+      # restore re-deploy failing at deploy.compose.up=160s while the same db
+      # eventually became healthy ~3min later, fanout9 e1 2026-05-01). Without
+      # start_period, retries × interval = 50s expires before first init
+      # completes, compose marks db unhealthy, and dependent services fail
+      # with "dependency failed to start". start_period suppresses the
+      # unhealthy verdict during initial boot.
+      start_period: 180s
+    command:
+      - postgres
+      - -c
+      - config_file=/etc/postgresql/postgresql.conf
+      - -c
+      - log_min_messages=fatal
+      - -c
+      - wal_level=replica
+      - -c
+      - archive_mode=on
+      - -c
+      - archive_command=/usr/local/bin/wal-g wal-push %p
+      - -c
+      - archive_timeout=60
+      - -c
+      # hot_standby=on lets a server in recovery mode (i.e. our standby)
+      # accept read-only psql connections. Required so failover's
+      # pg_promote() call can connect to the standby (psql connections
+      # otherwise return "database is not accepting connections / Hot
+      # standby mode is disabled" and pg_promote can't be invoked).
+      # No-op on the primary — hot_standby only affects standbys. PG15
+      # default is on, but supabase/postgres:15.8.1.085 ships with it
+      # off, so set it explicitly. RCA: compose-ha 2026-05-01 fanout13
+      # failover — pg_promote retried 5 times against an unreachable
+      # standby psql before aborting.
+      - hot_standby=on
+    environment:
+      POSTGRES_HOST: /var/run/postgresql
+      PGPORT: 5432
+      POSTGRES_PORT: 5432
+      PGPASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      PGDATABASE: postgres
+      POSTGRES_DB: postgres
+      JWT_SECRET: ${JWT_SECRET}
+      JWT_EXP: 3600
+      # WAL-G Configuration
+      # `:-` defaults so local dev (no .env-set S3 creds) doesn't trigger
+      # `WARN The "S3_*" variable is not set` for every compose invocation.
+      # WAL-G is dormant locally without these anyway; the warns were pure
+      # noise.
+      WALG_S3_PREFIX: s3://${S3_BACKUP_BUCKET:-${S3_BUCKET:-}}/backups/${PROJECT_NAME}/walg
+      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY:-}
+      AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY:-}
+      AWS_ENDPOINT: ${S3_ENDPOINT:-}
+      AWS_REGION: ${S3_REGION:-us-east-1}
+      WALG_COMPRESSION_METHOD: lz4
+    volumes:
+      - db_data:/var/lib/postgresql/data
+      - ./volumes/db/roles.sql:/docker-entrypoint-initdb.d/init-scripts/98-roles.sql:Z
+      - ./volumes/db/jwt.sql:/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql:Z
+      - ./volumes/db/realtime.sql:/docker-entrypoint-initdb.d/migrations/99-realtime.sql:Z
+      - ./volumes/db/set-passwords.sh:/docker-entrypoint-initdb.d/zz-set-passwords.sh:Z
+      - ./supabase/migrations:/migrations:ro
+    networks:
+      - vibecarbon-network
+
+  # Kong API Gateway
+  kong:
+    image: kong:3.9.1
+    container_name: ${PROJECT_NAME}-kong
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - SETGID
+      - SETUID
+    read_only: true
+    tmpfs:
+      - /tmp
+    ports:
+      - "${DEV_KONG_PORT:-8000}:8000/tcp"
+      - "${DEV_KONG_SSL_PORT:-8443}:8443/tcp"
+    healthcheck:
+      test: ["CMD", "kong", "health"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    entrypoint: /home/kong/docker-entrypoint.sh
+    environment:
+      KONG_DATABASE: "off"
+      KONG_PREFIX: /tmp/kong
+      KONG_DECLARATIVE_CONFIG: /tmp/kong.yml
+      KONG_DNS_ORDER: LAST,A,CNAME
+      KONG_PLUGINS: request-transformer,cors,key-auth,acl
+      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
+      KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
+      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
+      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
+    volumes:
+      - ./volumes/kong/kong.yml:/home/kong/kong.yml.template:ro
+      - ./volumes/kong/docker-entrypoint.sh:/home/kong/docker-entrypoint.sh:ro
+    # Kong runs in DB-less mode (KONG_DATABASE: "off") — config comes from
+    # the declarative kong.yml volume. No postgres dependency at all, so
+    # we intentionally don't list `db` here. Kong can boot in parallel
+    # with the database, shaving ~20s off the compose cold start.
+    networks:
+      - vibecarbon-network
+
+  # GoTrue Authentication
+  auth:
+    image: supabase/gotrue:v2.186.0
+    container_name: ${PROJECT_NAME}-auth
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9999/health"]
+      interval: 5s
+      timeout: 5s
+      retries: 3
+    environment:
+      GOTRUE_API_HOST: 0.0.0.0
+      GOTRUE_API_PORT: 9999
+      API_EXTERNAL_URL: ${SITE_URL}
+      GOTRUE_DB_DRIVER: postgres
+      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${POSTGRES_PASSWORD}@db:5432/postgres
+      GOTRUE_SITE_URL: ${SITE_URL}
+      GOTRUE_URI_ALLOW_LIST: "${SITE_URL}/**,http://localhost:${DEV_VITE_PORT:-5173}/**,http://localhost:${DEV_API_PORT:-3000}/**"
+      GOTRUE_DISABLE_SIGNUP: "false"
+      GOTRUE_JWT_ADMIN_ROLES: service_role
+      GOTRUE_JWT_AUD: authenticated
+      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
+      GOTRUE_JWT_EXP: 3600
+      GOTRUE_JWT_SECRET: ${JWT_SECRET}
+      GOTRUE_EXTERNAL_EMAIL_ENABLED: "true"
+      GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: "false"
+      GOTRUE_MAILER_AUTOCONFIRM: "true"
+      # MFA/TOTP
+      GOTRUE_MFA_ENABLED: "true"
+      # OAuth Providers
+      GOTRUE_EXTERNAL_GOOGLE_ENABLED: ${GOOGLE_ENABLED:-false}
+      GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
+      GOTRUE_EXTERNAL_GOOGLE_SECRET: ${GOOGLE_CLIENT_SECRET:-}
+      GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: ${SITE_URL}/auth/v1/callback
+      GOTRUE_EXTERNAL_AZURE_ENABLED: ${MICROSOFT_ENABLED:-false}
+      GOTRUE_EXTERNAL_AZURE_CLIENT_ID: ${MICROSOFT_CLIENT_ID:-}
+      GOTRUE_EXTERNAL_AZURE_SECRET: ${MICROSOFT_CLIENT_SECRET:-}
+      GOTRUE_EXTERNAL_AZURE_URL: https://login.microsoftonline.com/${MICROSOFT_TENANT_ID:-common}
+      GOTRUE_EXTERNAL_AZURE_REDIRECT_URI: ${SITE_URL}/auth/v1/callback
+      # SMTP (optional)
+      GOTRUE_SMTP_HOST: ${SMTP_HOST:-}
+      GOTRUE_SMTP_PORT: ${SMTP_PORT:-587}
+      GOTRUE_SMTP_USER: ${SMTP_USER:-}
+      GOTRUE_SMTP_PASS: ${SMTP_PASS:-}
+      GOTRUE_SMTP_ADMIN_EMAIL: ${SMTP_ADMIN_EMAIL:-}
+      GOTRUE_SMTP_SENDER_NAME: ${SMTP_SENDER_NAME:-}
+      GOTRUE_MAILER_URLPATHS_INVITE: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_CONFIRMATION: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_RECOVERY: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: /auth/v1/verify
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - vibecarbon-network
+
+  # PostgREST API
+  rest:
+    image: postgrest/postgrest:v14.6
+    container_name: ${PROJECT_NAME}-rest
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp
+    environment:
+      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@db:5432/postgres
+      PGRST_DB_SCHEMAS: public,storage,graphql_public
+      PGRST_DB_ANON_ROLE: anon
+      PGRST_JWT_SECRET: ${JWT_SECRET}
+      PGRST_DB_USE_LEGACY_GUCS: "false"
+      PGRST_APP_SETTINGS_JWT_SECRET: ${JWT_SECRET}
+      PGRST_APP_SETTINGS_JWT_EXP: 3600
+    command: postgrest
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - vibecarbon-network
+
+  # Realtime Server
+  realtime:
+    image: supabase/realtime:v2.76.5
+    container_name: ${PROJECT_NAME}-realtime
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    cap_add:
+      - SETUID
+      - SETGID
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /app/rel/realtime/tmp
+      - /app/rel/realtime/releases/2.76.5
+    healthcheck:
+      test: ["CMD-SHELL", "curl -so /dev/null -w '%{http_code}' http://localhost:4000/ | grep -qE '^[0-9]+$'"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    environment:
+      PORT: 4000
+      DB_HOST: db
+      DB_PORT: 5432
+      DB_USER: supabase_admin
+      DB_PASSWORD: ${POSTGRES_PASSWORD}
+      DB_NAME: postgres
+      DB_AFTER_CONNECT_QUERY: "SET search_path TO _realtime"
+      DB_ENC_KEY: ${DB_ENC_KEY:-devdbencryptkey1}
+      API_JWT_SECRET: ${JWT_SECRET}
+      SECRET_KEY_BASE: ${REALTIME_SECRET:-realtimesecret}
+      ERL_AFLAGS: -proto_dist inet_tcp
+      DNS_NODES: "''"
+      RLIMIT_NOFILE: "10000"
+      APP_NAME: realtime
+      SEED_SELF_HOST: "true"
+      FLY_ALLOC_ID: fly123
+      FLY_APP_NAME: realtime
+      REPLICATION_MODE: RLS
+      REPLICATION_POLL_INTERVAL: 100
+      SECURE_CHANNELS: "true"
+      SLOT_NAME: supabase_realtime_rls
+      TEMPORARY_SLOT: "true"
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - vibecarbon-network
+
+  # ===========================================
+  # SUPABASE STORAGE
+  # ===========================================
+
+  storage:
+    image: supabase/storage-api:v1.44.2
+    container_name: ${PROJECT_NAME}-storage
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:5000/status"]
+      interval: 5s
+      timeout: 5s
+      retries: 3
+    environment:
+      ANON_KEY: ${SUPABASE_ANON_KEY}
+      SERVICE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
+      POSTGREST_URL: http://rest:3000
+      PGRST_JWT_SECRET: ${JWT_SECRET}
+      DATABASE_URL: postgres://supabase_storage_admin:${POSTGRES_PASSWORD}@db:5432/postgres
+      FILE_SIZE_LIMIT: 52428800
+      STORAGE_BACKEND: s3
+      TENANT_ID: stub
+      REGION: ${S3_REGION:-stub}
+      GLOBAL_S3_BUCKET: ${S3_BUCKET:-stub}
+      GLOBAL_S3_ENDPOINT: ${S3_ENDPOINT:-}
+      GLOBAL_S3_FORCE_PATH_STYLE: "true"
+      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY:-}
+      AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY:-}
+      ENABLE_IMAGE_TRANSFORMATION: "true"
+      IMGPROXY_URL: http://imgproxy:5001
+      VAULT_ENC_KEY: ${VAULT_ENC_KEY:-vaultenckey}
+    volumes:
+      - storage_data:/var/lib/storage
+    depends_on:
+      db:
+        condition: service_healthy
+      rest:
+        condition: service_started
+      imgproxy:
+        condition: service_started
+    networks:
+      - vibecarbon-network
+
+  imgproxy:
+    image: darthsim/imgproxy:v3.30.1
+    container_name: ${PROJECT_NAME}-imgproxy
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp
+    healthcheck:
+      test: ["CMD", "imgproxy", "health"]
+      interval: 5s
+      timeout: 5s
+      retries: 3
+    environment:
+      IMGPROXY_BIND: ":5001"
+      IMGPROXY_LOCAL_FILESYSTEM_ROOT: /
+      IMGPROXY_USE_ETAG: "true"
+      IMGPROXY_ENABLE_WEBP_DETECTION: "true"
+    volumes:
+      - storage_data:/var/lib/storage
+    networks:
+      - vibecarbon-network
+
+  # ===========================================
+  # SUPABASE MANAGEMENT
+  # ===========================================
+
+  meta:
+    image: supabase/postgres-meta:v0.95.2
+    container_name: ${PROJECT_NAME}-meta
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    environment:
+      PG_META_PORT: 8080
+      PG_META_DB_HOST: db
+      PG_META_DB_PORT: 5432
+      PG_META_DB_NAME: postgres
+      PG_META_DB_USER: supabase_admin
+      PG_META_DB_PASSWORD: ${POSTGRES_PASSWORD}
+      PG_META_CRYPTO_KEY: ${PG_META_CRYPTO_KEY:-pgmetacryptokey}
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - vibecarbon-network
+
+  studio:
+    image: supabase/studio:2026.03.16-sha-5528817
+    container_name: ${PROJECT_NAME}-studio
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    healthcheck:
+      disable: true
+    environment:
+      STUDIO_PG_META_URL: http://meta:8080
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      DEFAULT_ORGANIZATION_NAME: ${PROJECT_NAME}
+      DEFAULT_PROJECT_NAME: ${PROJECT_NAME}
+      SUPABASE_URL: http://kong:8000
+      SUPABASE_PUBLIC_URL: ${SITE_URL}
+      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
+      SUPABASE_SERVICE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
+      AUTH_JWT_SECRET: ${JWT_SECRET}
+      LOGFLARE_API_KEY: ${LOGFLARE_API_KEY:-logflarekey}
+      LOGFLARE_URL: http://analytics:4000
+      NEXT_PUBLIC_ENABLE_LOGS: "false"
+      NEXT_ANALYTICS_BACKEND_PROVIDER: postgres
+    labels:
+      - "traefik.enable=true"
+      # Subdomain routing - auth added via prod overlay (docker-compose.prod.yml)
+      - "traefik.http.routers.studio.rule=Host(`studio.${DOMAIN:-localhost}`)"
+      - "traefik.http.routers.studio.entrypoints=web"
+      - "traefik.http.services.studio.loadbalancer.server.port=3000"
+    depends_on:
+      db:
+        condition: service_healthy
+      meta:
+        condition: service_started
+    networks:
+      - vibecarbon-network
+
+volumes:
+  db_data:
+  storage_data:
+
+networks:
+  vibecarbon-network:
+    driver: bridge

package/carbon/docker-entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+echo "Starting ${PROJECT_NAME}..."
+
+# Note: Database migrations are handled by Supabase
+# Run migrations manually with: docker compose exec db psql -U postgres -d postgres -f /migrations/init.sql
+
+echo "Starting application..."
+
+# Execute the main command
+exec "$@"

package/carbon/ha/activate-standby.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# Promote a standby PostgreSQL to primary and scale up services.
+#
+# This script runs ON the standby master node and uses kubectl to:
+#   1. Promote PostgreSQL from standby to primary
+#   2. Wait for the promotion to complete
+#   3. Scale up Supabase and application services
+#
+# Optional env vars:
+#   NAMESPACE — Kubernetes namespace (default: vibecarbon)
+
+set -euo pipefail
+
+NAMESPACE="${NAMESPACE:-vibecarbon}"
+PGDATA="/var/lib/postgresql/data"
+
+# Find the postgres pod
+POD=$(kubectl get pods -n "$NAMESPACE" -l app.kubernetes.io/name=supabase-db -o jsonpath='{.items[0].metadata.name}')
+if [ -z "$POD" ]; then
+  echo "ERROR: No postgres pod found in namespace $NAMESPACE"
+  exit 1
+fi
+
+echo "Promoting standby: pod=$POD"
+
+# 1. Promote PostgreSQL
+echo "Promoting PostgreSQL standby to primary..."
+kubectl exec -n "$NAMESPACE" "$POD" -- su postgres -c "pg_ctl promote -D $PGDATA" 2>/dev/null || true
+
+# 2. Wait for promotion to complete
+echo "Waiting for promotion..."
+for i in $(seq 1 30); do
+  result=$(kubectl exec -n "$NAMESPACE" "$POD" -- psql -U supabase_admin -tAc 'SELECT pg_is_in_recovery()' 2>/dev/null || echo "t")
+  if [ "$result" = "f" ]; then
+    echo "PostgreSQL promoted successfully"
+    break
+  fi
+  if [ "$i" = "30" ]; then
+    echo "WARNING: Promotion not confirmed after 60 seconds"
+  fi
+  sleep 2
+done
+
+# 3. Scale up services
+echo "Scaling up services..."
+kubectl scale deployment app -n "$NAMESPACE" --replicas=2
+kubectl scale deployment auth -n "$NAMESPACE" --replicas=2
+kubectl scale deployment rest -n "$NAMESPACE" --replicas=2
+kubectl scale deployment realtime -n "$NAMESPACE" --replicas=2
+kubectl scale deployment storage -n "$NAMESPACE" --replicas=1
+
+echo "Standby activation complete"

package/carbon/ha/primary-init.sql

@@ -0,0 +1,36 @@
+-- Configure primary PostgreSQL for streaming replication.
+-- Run on the primary database before initializing the standby.
+--
+-- This script is idempotent: safe to run multiple times.
+
+-- Create dedicated replication role (if not exists), or update its password on re-runs.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'replicator') THEN
+    CREATE ROLE replicator WITH REPLICATION LOGIN PASSWORD 'repl_password';
+  ELSE
+    ALTER ROLE replicator WITH PASSWORD 'repl_password';
+  END IF;
+END $$;
+
+-- Enable WAL-level replication
+ALTER SYSTEM SET wal_level = 'replica';
+ALTER SYSTEM SET max_wal_senders = 5;
+ALTER SYSTEM SET wal_keep_size = '512MB';
+
+-- Create a physical replication slot for the standby. Without a slot, the
+-- standby's follow position isn't persisted on primary; if it falls behind
+-- by more than wal_keep_size (512MB), primary recycles WAL and streaming
+-- breaks silently. The slot tells primary to hold WAL until the standby
+-- confirms receipt. Idempotent: wrapped in a DO block that checks existence.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_replication_slots WHERE slot_name = 'vibecarbon_standby_slot'
+  ) THEN
+    PERFORM pg_create_physical_replication_slot('vibecarbon_standby_slot');
+  END IF;
+END $$;
+
+-- Reload config (wal_level change requires restart, handled by caller)
+SELECT pg_reload_conf();

package/carbon/ha/standby-init.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+# Initialize standby PostgreSQL as a streaming replica of the primary.
+#
+# This script runs ON the standby master node and uses kubectl to
+# exec into the postgres pod. It:
+#   1. Stops the standby database
+#   2. Wipes data and runs pg_basebackup from the primary
+#   3. Configures standby.signal and primary_conninfo
+#   4. Restarts as a hot standby
+#
+# Required env vars:
+#   PRIMARY_HOST  — IP address of the primary cluster (master node)
+#
+# Optional env vars:
+#   PRIMARY_PORT  — PostgreSQL port on the primary (default: 5432, use 30432 for NodePort)
+#   REPL_PASSWORD — Replication user password (required; generated by vibecarbon create in .env.local)
+#   NAMESPACE     — Kubernetes namespace (default: vibecarbon)
+
+set -euo pipefail
+
+: "${PRIMARY_HOST:?PRIMARY_HOST is required}"
+PRIMARY_PORT="${PRIMARY_PORT:-5432}"
+: "${REPL_PASSWORD:?REPL_PASSWORD is required — generate one in .env.local and export it before running standby-init.sh}"
+NAMESPACE="${NAMESPACE:-vibecarbon}"
+PGDATA="/var/lib/postgresql/data"
+
+# Find the postgres pod
+POD=$(kubectl get pods -n "$NAMESPACE" -l app.kubernetes.io/name=supabase-db -o jsonpath='{.items[0].metadata.name}')
+if [ -z "$POD" ]; then
+  echo "ERROR: No postgres pod found in namespace $NAMESPACE"
+  exit 1
+fi
+
+echo "Standby init: pod=$POD, primary=$PRIMARY_HOST:$PRIMARY_PORT"
+
+# 1. Stop postgres on standby
+echo "Stopping standby PostgreSQL..."
+kubectl exec -n "$NAMESPACE" "$POD" -- su postgres -c "pg_ctl stop -D $PGDATA -m fast" 2>/dev/null || true
+sleep 5
+
+# 2. Wipe data and run pg_basebackup from primary
+echo "Running pg_basebackup from primary ($PRIMARY_HOST:$PRIMARY_PORT)..."
+kubectl exec -n "$NAMESPACE" "$POD" -- bash -c "
+  rm -rf ${PGDATA}/*
+  PGPASSWORD='${REPL_PASSWORD}' pg_basebackup -h ${PRIMARY_HOST} -p ${PRIMARY_PORT} -U replicator -D ${PGDATA} -Fp -Xs -P -R
+"
+
+# 3. Configure standby signal and primary connection info
+echo "Configuring standby.signal and primary_conninfo..."
+kubectl exec -n "$NAMESPACE" "$POD" -- bash -c "
+  touch ${PGDATA}/standby.signal
+  echo \"primary_conninfo = 'host=${PRIMARY_HOST} port=${PRIMARY_PORT} user=replicator password=${REPL_PASSWORD}'\" >> ${PGDATA}/postgresql.auto.conf
+  chown -R postgres:postgres ${PGDATA}
+"
+
+# 4. Start postgres as hot standby
+echo "Starting standby PostgreSQL..."
+kubectl exec -n "$NAMESPACE" "$POD" -- su postgres -c "pg_ctl start -D $PGDATA -l /var/log/postgresql/postgresql.log"
+
+# 5. Verify recovery mode
+echo "Verifying standby is in recovery mode..."
+sleep 5
+for i in $(seq 1 15); do
+  result=$(kubectl exec -n "$NAMESPACE" "$POD" -- psql -U supabase_admin -tAc 'SELECT pg_is_in_recovery()' 2>/dev/null || echo "")
+  if [ "$result" = "t" ]; then
+    echo "Standby is in recovery mode — streaming replication active"
+    exit 0
+  fi
+  echo "  Waiting for standby to enter recovery mode (attempt $i/15)..."
+  sleep 2
+done
+
+echo "WARNING: Could not confirm standby is in recovery mode"
+exit 1