vibecarbon 0.1.0

package/carbon/k8s/LICENSE

@@ -0,0 +1,99 @@
+Elastic License 2.0 (ELv2)
+
+## Acceptance
+
+By using the Software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the Software, in each case subject
+to the limitations and conditions below.
+
+## Limitations
+
+You may not provide the Software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set
+of the features or functionality of the Software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the Software, and you may not remove or obscure any functionality in the
+Software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor in the Software. Any use of the licensor's trademarks
+is subject to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the Software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the Software. If you or your company make any written claim that the Software
+infringes or contributes to infringement of any patent, your patent license
+for the Software granted under these terms ends immediately. If your company
+makes such a claim, your patent license ends immediately for work on behalf of
+your company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the Software from
+you also gets a copy of these terms.
+
+If you modify the Software, you must include in any modified copies of the
+Software prominent notices stating that you have modified the Software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the Software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license
+no later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your
+licenses to terminate automatically and permanently.
+
+## No Liability
+
+As far as the law allows, the Software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the Software, under any kind of
+legal claim.
+
+## Definitions
+
+The "licensor" is the entity offering these terms, Vibecarbon.
+
+The "Software" is the software the licensor makes available under these terms,
+including any portion of it.
+
+"You" refers to the individual or entity agreeing to these terms.
+
+"Your company" is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+"Control" means ownership of substantially all the assets of an entity, or the
+power to direct its management and policies by vote, contract, or otherwise.
+Control can be direct or indirect.
+
+"Your licenses" are all the licenses granted to you for the Software under
+these terms.
+
+"Use" means anything you do with the Software requiring one of your licenses.
+
+"Trademark" means trademarks, service marks, and similar rights.
+
+---
+
+Copyright (c) 2026 Vibecarbon
+
+For the full Elastic License 2.0 text, see:
+https://www.elastic.co/licensing/elastic-license

package/carbon/k8s/README.md

@@ -0,0 +1,272 @@
+# Vibecarbon Kubernetes Deployment (Fullerene Tier)
+
+> **Note**: Kubernetes deployment requires a Vibecarbon Fullerene license. For compose-based deployments (including HA with PostgreSQL replication), see the [Hetzner deployment guide](../../docs/deploy-hetzner.md).
+
+This directory contains Kubernetes manifests for deploying Vibecarbon with enterprise-grade autoscaling and high availability.
+
+## Architecture Overview
+
+```
+                       Cloudflare DNS
+                    (health checks, failover)
+                           |
+           +---------------+---------------+
+           |                               |
+    Hetzner LB (nbg1)              Hetzner LB (hel1)
+           |                               |
+    k3s Cluster                     k3s Cluster
+    +--------------+               +--------------+
+    | app: 2-10    |               | app: 0 (standby)
+    | kong: 2      |   WAL repl    | kong: 0
+    | rest: 2-5    | <-----------> | rest: 0
+    | PostgreSQL   |               | PostgreSQL (replica)
+    | PRIMARY      |               | HOT STANDBY
+    +--------------+               +--------------+
+```
+
+## Directory Structure
+
+```
+k8s/
+├── base/                          # Base Kubernetes manifests
+│   ├── namespace.yaml
+│   ├── network-policy.yaml        # Default-deny NetworkPolicy
+│   ├── secrets/                   # Secrets and ConfigMaps
+│   ├── hetzner-ccm/              # Hetzner Cloud Controller
+│   ├── hetzner-csi/              # Hetzner CSI Driver
+│   ├── app/                      # Vibecarbon application
+│   │   ├── deployment.yaml
+│   │   ├── local-registry.yaml   # Local OCI registry for k3s image distribution
+│   │   └── rbac.yaml             # ServiceAccount for pod listing
+│   ├── supabase/                 # Supabase services
+│   │   ├── postgres/
+│   │   ├── kong/
+│   │   ├── auth/
+│   │   ├── rest/
+│   │   ├── realtime/
+│   │   ├── storage/
+│   │   ├── imgproxy/
+│   │   ├── meta/
+│   │   └── studio/
+│   └── traefik/                  # Ingress controller
+├── infra/                         # Infrastructure-level resources (applied once)
+│   └── cert-manager-resources/   # ClusterIssuers for TLS certificates
+├── overlays/                      # Environment-specific patches
+│   ├── production-nbg1/          # Primary region (Nuremberg)
+│   └── production-hel1/          # Standby region (Helsinki)
+└── flux/                          # GitOps configuration
+    └── clusters/
+        ├── primary/
+        └── standby/
+```
+
+## Prerequisites
+
+1. **Hetzner Cloud Account** with API token
+2. **Cloudflare Account** with API token and domain
+3. **kubectl** installed locally
+4. **kustomize** installed (or use `kubectl -k`)
+5. **Flux CLI** (optional, for GitOps)
+
+## Deployment Steps
+
+### Step 1: Provision Infrastructure
+
+`vibecarbon deploy <env>` provisions the Hetzner servers, network, firewall,
+and floating IP via Pulumi (Automation API; no Pulumi CLI required). Stack
+state is stored in your Hetzner S3 bucket — there are no `.tf` files or
+local state to manage.
+
+```bash
+vibecarbon deploy production
+```
+
+For HA (two regions), pass `--ha`. The command writes the resulting
+kubeconfig(s) to `~/.vibecarbon/kubeconfig-<env>-<region>.yaml`.
+
+### Step 2: Get Kubeconfig
+
+```bash
+export KUBECONFIG=~/.vibecarbon/kubeconfig-production-nbg1.yaml
+
+# For HA, the standby kubeconfig is alongside it:
+# ~/.vibecarbon/kubeconfig-production-hel1.yaml
+```
+
+### Step 3: Deploy Secrets
+
+Before deploying, update the secrets with real values:
+
+```bash
+# Create secrets manually (recommended for initial setup)
+kubectl create secret generic vibecarbon-secrets \
+  --namespace=vibecarbon \
+  --from-literal=DB_PASSWORD=<your-password> \
+  --from-literal=JWT_SECRET=<your-jwt-secret> \
+  --from-literal=ANON_KEY=<your-anon-key> \
+  --from-literal=SERVICE_ROLE_KEY=<your-service-key> \
+  --from-literal=REALTIME_SECRET=<your-realtime-secret> \
+  --from-literal=VAULT_ENC_KEY=<your-vault-key> \
+  --from-literal=PG_META_CRYPTO_KEY=<your-meta-key> \
+  --from-literal=LOGFLARE_API_KEY=<your-logflare-key>
+
+kubectl create secret generic hcloud-token \
+  --namespace=vibecarbon \
+  --from-literal=token=<your-hetzner-token>
+```
+
+### Step 4: Deploy to Primary Cluster
+
+```bash
+export KUBECONFIG=kubeconfig-nbg1.yaml
+
+# Using kustomize
+kubectl apply -k overlays/production-nbg1
+
+# Or using kubectl
+kustomize build overlays/production-nbg1 | kubectl apply -f -
+```
+
+### Step 5: Deploy to Standby Cluster
+
+```bash
+export KUBECONFIG=kubeconfig-hel1.yaml
+kubectl apply -k overlays/production-hel1
+```
+
+### Step 6: Verify Deployment
+
+```bash
+# Check pods
+kubectl get pods -n vibecarbon
+
+# Check HPA
+kubectl get hpa -n vibecarbon
+
+# Check services
+kubectl get svc -n vibecarbon
+
+# Check ingress/load balancer
+kubectl get svc traefik -n vibecarbon
+```
+
+## Autoscaling
+
+### Horizontal Pod Autoscaler (HPA)
+
+The following services have HPA configured:
+
+| Service | Min Replicas | Max Replicas | CPU Target |
+|---------|--------------|--------------|------------|
+| app     | 2            | 10           | 70%        |
+| rest    | 2            | 5            | 70%        |
+
+Worker VMs are provisioned via `vibecarbon deploy --min-workers N --max-workers M` (default `min=1, max=3`). The static floor is Pulumi-managed; cluster-autoscaler spawns and reaps additional workers (up to `max - min`) based on pending-pod pressure. See the Cluster Autoscaler section below.
+
+### Cluster Autoscaler (VPS-level)
+
+VPS-level autoscaling is on by default with a bounded ceiling — every k8s deploy installs cluster-autoscaler against the Hetzner Cloud API.
+
+**Defaults**
+
+- `min=1, max=3` — one static worker, plus up to two CA-spawned workers on demand.
+
+**Deploy-time bounds**
+
+```bash
+# Override the default bounds at deploy
+vibecarbon deploy prod --k8s --min-workers 2 --max-workers 10
+```
+
+**Re-tuning bounds without a full deploy**
+
+```bash
+# Change the upper bound only — no Pulumi run needed for the CA-managed pool
+vibecarbon scale prod --max-workers 8
+
+# Or both bounds at once
+vibecarbon scale prod --min-workers 2 --max-workers 8
+```
+
+**Static floor + CA-on-top model**
+
+| Layer | Managed by | Server name pattern |
+|-------|-----------|---------------------|
+| Static floor (`minWorkers` nodes) | Pulumi | `<cluster>-worker-N` (deterministic) |
+| CA-spawned (0 to `max - min` extra nodes) | cluster-autoscaler via Hetzner Cloud API | `worker-pool-<rand>` |
+
+The static floor is what your project quota is reserved for; CA scales additional workers on top of it as pending pods appear, then reaps them when CPU pressure subsides.
+
+**HA mode symmetry**
+
+In `--ha` mode both clusters use the same `--min-workers/--max-workers` bounds — the standby is kept failover-ready (its scaler doesn't bring up additional workers while the cluster is dormant, but the bounds are pre-configured so failover is instant).
+
+**Hetzner project quota**
+
+Trial Hetzner Cloud projects cap at ~50 servers across all resource types; verified accounts get higher limits. If you set `--max-workers` aggressively, make sure your project quota covers the worst case across all clusters in the project (master + supabase + workers + CA-spawned, x2 in HA).
+
+**Token requirement: Read+Write**
+
+The Hetzner Cloud API token in your `hcloud-token` secret must have **Read+Write** permissions on the project. Read-only tokens cannot create servers, and CA scale-up will fail silently with permission errors in the cluster-autoscaler pod logs. Verify with:
+
+```bash
+kubectl logs -n kube-system -l app=cluster-autoscaler --tail=200 | grep -i 'permission\|forbidden\|unauthor'
+```
+
+## Failover
+
+Cloudflare DNS health checks monitor both regions every 60 seconds. When the primary region fails, initiate failover with one command:
+
+```bash
+vibecarbon failover prod
+```
+
+This promotes the standby database to primary, scales up services in the standby region, and updates DNS to point to the new primary.
+
+### Manual Failover (kubectl)
+
+To failover manually with kubectl:
+
+```bash
+# Scale up standby
+export KUBECONFIG=kubeconfig-hel1.yaml
+kubectl scale deployment app --replicas=2 -n vibecarbon
+kubectl scale deployment kong --replicas=2 -n vibecarbon
+kubectl scale deployment auth --replicas=2 -n vibecarbon
+kubectl scale deployment rest --replicas=2 -n vibecarbon
+kubectl scale deployment realtime --replicas=2 -n vibecarbon
+```
+
+## Monitoring (Optional)
+
+To enable Prometheus + Grafana monitoring:
+
+```bash
+kubectl apply -k base/monitoring/  # If monitoring manifests exist
+```
+
+## Troubleshooting
+
+### Pods not starting
+
+```bash
+kubectl describe pod <pod-name> -n vibecarbon
+kubectl logs <pod-name> -n vibecarbon
+```
+
+### Load Balancer not created
+
+```bash
+kubectl describe svc traefik -n vibecarbon
+kubectl logs -l app=hcloud-cloud-controller-manager -n kube-system
+```
+
+## Cost Estimate
+
+| Component | Monthly Cost (EUR) |
+|-----------|-------------------|
+| k3s master x2 | 8.70 |
+| k3s workers (1-10) | 4-44 |
+| Hetzner LB x2 | 10.78 |
+| Hetzner volumes | ~2 |
+| **Total** | **~25-65** |

package/carbon/k8s/base/app/deployment.yaml

@@ -0,0 +1,130 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  labels:
+    app: vibecarbon-app
+    component: application
+spec:
+  replicas: 2
+  # 900s (15m) — cold k8s deploys race the rollout window: `kubectl set image`
+  # triggers the rollout BEFORE `helm install supabase --wait` returns, and the
+  # app's readiness probe (/api/health/ready) stays 503 until kong is up. On
+  # the slow HA path the sideload + helm install consumed >29m before kong was
+  # reachable; the old 120s deadline tripped before kong existed and the
+  # subsequent `kubectl rollout status` failed even though pods were healthy
+  # by then. 900s covers worst-observed cold path; warm rollouts still finish
+  # in <60s so this only matters on the cold cycle.
+  progressDeadlineSeconds: 900
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: vibecarbon-app
+  template:
+    metadata:
+      labels:
+        app: vibecarbon-app
+        component: application
+    spec:
+      terminationGracePeriodSeconds: 30
+      serviceAccountName: vibecarbon-app
+      containers:
+      - name: app
+        image: ghcr.io/{{GITHUB_OWNER}}/{{PROJECT_NAME}}:main
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 1000
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+        ports:
+        - containerPort: 3000
+          name: http
+        envFrom:
+        - configMapRef:
+            name: vibecarbon-config
+        env:
+        - name: NODE_ENV
+          value: production
+        - name: SUPABASE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: vibecarbon-config
+              key: KONG_URL
+        - name: SITE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: vibecarbon-config
+              key: SITE_URL
+        - name: SUPABASE_ANON_KEY
+          valueFrom:
+            secretKeyRef:
+              name: vibecarbon-secrets
+              key: ANON_KEY
+        - name: SUPABASE_SERVICE_ROLE_KEY
+          valueFrom:
+            secretKeyRef:
+              name: vibecarbon-secrets
+              key: SERVICE_ROLE_KEY
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 1000m
+            memory: 512Mi
+        startupProbe:
+          httpGet:
+            path: /api/health
+            port: http
+          failureThreshold: 5
+          periodSeconds: 1
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: http
+          initialDelaySeconds: 10
+          periodSeconds: 30
+          timeoutSeconds: 5
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /api/health/ready
+            port: http
+          initialDelaySeconds: 0
+          periodSeconds: 3
+          timeoutSeconds: 3
+          failureThreshold: 3
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - sh
+              - -c
+              - sleep 5
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+      volumes:
+      - name: tmp
+        emptyDir: {}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app: vibecarbon-app
+              topologyKey: kubernetes.io/hostname
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault

package/carbon/k8s/base/app/hpa.yaml

@@ -0,0 +1,44 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: app
+  labels:
+    app: vibecarbon-app
+    component: application
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: app
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: 80
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 60
+      policies:
+        - type: Pods
+          value: 4
+          periodSeconds: 60
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+      selectPolicy: Max
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Pods
+          value: 1
+          periodSeconds: 120

package/carbon/k8s/base/app/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml
+  - hpa.yaml
+  - pdb.yaml
+  - rbac.yaml
+  - network-policy.yaml

package/carbon/k8s/base/app/network-policy.yaml

@@ -0,0 +1,124 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: app-policy
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: vibecarbon-app
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow traffic from Traefik ingress controller (runs in same namespace)
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-traefik
+      ports:
+        - protocol: TCP
+          port: 3000
+  egress:
+    # Allow connection to Kong (Supabase API gateway)
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-kong
+      ports:
+        - protocol: TCP
+          port: 8000
+    # Allow connection to database (direct queries)
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    # Allow access to Kubernetes API server for reading pod logs (admin dashboard)
+    # 10.43.0.1:443 = ClusterIP via kube-proxy DNAT (works on worker nodes)
+    - to:
+        - ipBlock:
+            cidr: 10.43.0.1/32
+      ports:
+        - protocol: TCP
+          port: 443
+    # 0.0.0.0/0:6443 = apiserver, dial-anywhere on apiserver-protocol port.
+    # See carbon/k8s/base/traefik/network-policy.yaml for the full RCA. tl;dr:
+    # kube-proxy DNATs 10.43.0.1 to the master's node IP at the OUTPUT chain
+    # BEFORE the CNI evaluates egress, so the policy sees the post-NAT IP.
+    # With --node-ip=public (master-init.sh) and the CCM HCLOUD_NETWORK patch
+    # reverted (kubelet cert SAN), the master IP is public — outside any
+    # private CIDR we could list. Allow any destination on 6443; deny-by-
+    # default is preserved on every other port.
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - protocol: TCP
+          port: 6443
+    # Allow outbound HTTPS (Stripe, SMTP provider, external APIs)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443
+    # Allow connection to Redis (if configured)
+    - to:
+        - podSelector:
+            matchLabels:
+              app: redis
+      ports:
+        - protocol: TCP
+          port: 6379
+    # Allow health checks to optional services (n8n, metabase, observability)
+    # These are only used for the admin services-status API; unused rules are harmless.
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-n8n
+      ports:
+        - protocol: TCP
+          port: 5678
+    - to:
+        - podSelector:
+            matchLabels:
+              app: metabase
+      ports:
+        - protocol: TCP
+          port: 3000
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-prometheus
+      ports:
+        - protocol: TCP
+          port: 9090
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-grafana
+      ports:
+        - protocol: TCP
+          port: 3000
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-loki
+      ports:
+        - protocol: TCP
+          port: 3100
+    # Allow health checks to Studio (for admin services-status API)
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-studio
+      ports:
+        - protocol: TCP
+          port: 3000

package/carbon/k8s/base/app/pdb.yaml

@@ -0,0 +1,14 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: app
+  labels:
+    app: vibecarbon-app
+    component: application
+spec:
+  # Ensure at least 1 pod is available during voluntary disruptions
+  # (e.g., node upgrades, cluster maintenance, kubectl drain)
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: vibecarbon-app