vibecarbon 0.1.0

package/carbon/k8s/base/registry/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - local-registry.yaml

package/carbon/k8s/base/registry/local-registry.yaml

@@ -0,0 +1,193 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: local-registry
+  namespace: vibecarbon
+  labels:
+    app: local-registry
+spec:
+  replicas: 1
+  # Recreate (not RollingUpdate) because hostPort: 5000 can only be held by one pod at a time.
+  # RollingUpdate would leave the new pod Pending until the old one releases the port.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: local-registry
+  template:
+    metadata:
+      labels:
+        app: local-registry
+    spec:
+      # Run only on master node — hostPort exposes 5000 on master's private IP for SSH tunnel access.
+      # S3 backend stores all image layers externally; this affinity is for stable hostPort placement.
+      nodeSelector:
+        node-role.kubernetes.io/control-plane: "true"
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+      containers:
+        - name: registry
+          image: registry:2
+          # Strip https:// prefix from S3_ENDPOINT — registry:2 needs a bare hostname.
+          # REGISTRY_STORAGE_S3_SECURE=true controls HTTPS separately.
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              if [ -z "$REGISTRY_STORAGE_S3_REGION" ]; then
+                # S3 not configured — fall back to local filesystem storage.
+                # Unset all S3 env vars so registry:2 uses its default filesystem driver.
+                unset REGISTRY_STORAGE \
+                      REGISTRY_STORAGE_S3_ACCESSKEY \
+                      REGISTRY_STORAGE_S3_SECRETKEY \
+                      REGISTRY_STORAGE_S3_REGION \
+                      REGISTRY_STORAGE_S3_BUCKET \
+                      REGISTRY_STORAGE_S3_REGIONENDPOINT \
+                      REGISTRY_STORAGE_S3_ROOTDIRECTORY \
+                      REGISTRY_STORAGE_S3_SECURE \
+                      REGISTRY_STORAGE_S3_V4AUTH
+              else
+                # S3 configured — strip https:// prefix from endpoint (registry:2 needs bare hostname).
+                REGISTRY_STORAGE_S3_REGIONENDPOINT="${REGISTRY_STORAGE_S3_REGIONENDPOINT#https://}"
+                REGISTRY_STORAGE_S3_REGIONENDPOINT="${REGISTRY_STORAGE_S3_REGIONENDPOINT#http://}"
+                export REGISTRY_STORAGE_S3_REGIONENDPOINT
+              fi
+              exec /entrypoint.sh /etc/docker/registry/config.yml
+          securityContext:
+            runAsUser: 1000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+          env:
+            - name: REGISTRY_STORAGE
+              value: s3
+            - name: REGISTRY_STORAGE_S3_ACCESSKEY
+              valueFrom:
+                secretKeyRef: { name: vibecarbon-secrets, key: S3_ACCESS_KEY }
+            - name: REGISTRY_STORAGE_S3_SECRETKEY
+              valueFrom:
+                secretKeyRef: { name: vibecarbon-secrets, key: S3_SECRET_KEY }
+            - name: REGISTRY_STORAGE_S3_REGION
+              valueFrom:
+                secretKeyRef: { name: vibecarbon-secrets, key: S3_REGION }
+            - name: REGISTRY_STORAGE_S3_BUCKET
+              valueFrom:
+                secretKeyRef: { name: vibecarbon-secrets, key: S3_BUCKET }
+            - name: REGISTRY_STORAGE_S3_REGIONENDPOINT
+              valueFrom:
+                secretKeyRef: { name: vibecarbon-secrets, key: S3_ENDPOINT }
+            - name: REGISTRY_STORAGE_S3_ROOTDIRECTORY
+              value: registry/
+            - name: REGISTRY_STORAGE_S3_SECURE
+              value: "true"
+            - name: REGISTRY_STORAGE_S3_V4AUTH
+              value: "true"
+            - name: REGISTRY_STORAGE_CACHE_BLOBDESCRIPTOR
+              value: inmemory
+            - name: REGISTRY_STORAGE_DELETE_ENABLED
+              value: "true"
+          ports:
+            - containerPort: 5000
+              # hostPort exposes the registry on the master's private IP (10.0.1.1:5000).
+              # Worker and supabase kubelets use 10.0.1.1:5000 to pull images — kubelet uses
+              # node DNS (not cluster DNS) so it can't resolve the "local-registry" service name.
+              hostPort: 5000
+              protocol: TCP
+          volumeMounts:
+            - name: registry-tmp
+              mountPath: /var/lib/registry
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              # 1Gi headroom: registry:2 with the S3 driver buffers
+              # multipart uploads in memory, and large image layers
+              # (the backup image is ~300MB) can spike past 512Mi.
+              memory: 1Gi
+          readinessProbe:
+            httpGet:
+              path: /v2/
+              port: 5000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            # Default timeoutSeconds=1 is hostile to a registry busy
+            # streaming a layer to S3 — give it 10s before we declare
+            # the probe failed and pull it from the Service.
+            timeoutSeconds: 10
+            failureThreshold: 5
+          livenessProbe:
+            httpGet:
+              path: /v2/
+              port: 5000
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            # Same reasoning as readinessProbe — but with a larger
+            # failureThreshold because killing the pod mid-push aborts
+            # the upload with `manifest blob unknown`/`EOF` (exactly
+            # the failure mode that bit e2e on 2026-04-30).
+            timeoutSeconds: 10
+            failureThreshold: 6
+      volumes:
+        - name: registry-tmp
+          emptyDir: {}       # temp only; all image layers stored in S3
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: registry-policy
+  namespace: vibecarbon
+  labels:
+    app.kubernetes.io/part-of: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: local-registry
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow image pulls from any pod in the namespace via ClusterIP
+    - ports:
+        - port: 5000
+          protocol: TCP
+  egress:
+    # Allow DNS resolution (required to resolve S3 endpoint hostnames)
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # Allow S3 access (Hetzner Object Storage and compatible providers)
+    - ports:
+        - port: 443
+          protocol: TCP
+      to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+---
+# ClusterIP Service for in-cluster push paths (e.g., a CI pod inside the
+# cluster running `docker push` to localhost:5000 via kube-proxy). Kubelet
+# itself does NOT use this Service — it pulls via hostPort because it
+# resolves names against node DNS, not cluster DNS. See registries.yaml
+# in cloud-init for the kubelet-side mirror config.
+apiVersion: v1
+kind: Service
+metadata:
+  name: local-registry
+  namespace: vibecarbon
+  labels:
+    app: local-registry
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5000
+      targetPort: 5000
+      protocol: TCP
+  selector:
+    app: local-registry

package/carbon/k8s/base/traefik/certificate.yaml

@@ -0,0 +1,21 @@
+# TLS Certificate for Vibecarbon application
+# Requires cert-manager to be installed (kubectl apply -k k8s/infra/)
+#
+# issuerRef.name is patched per-deployment by applyK3sManifests in
+# src/lib/deploy/k8s/k3s.js — it picks letsencrypt-{prod,staging}-{
+# cloudflare,hetzner,manual} based on dnsProvider + ACME_CA_SERVER.
+# The placeholder below keeps this template valid for kustomize and
+# is overwritten before cert-manager ever sees a Certificate request.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vibecarbon-tls
+spec:
+  secretName: vibecarbon-tls
+  issuerRef:
+    name: letsencrypt-prod-manual
+    kind: ClusterIssuer
+  dnsNames:
+    - app.example.com  # Patched with actual domain at deploy time
+  # Optional: Include additional subdomains
+  # - "*.app.example.com"

package/carbon/k8s/base/traefik/configmap.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: traefik-config
+  labels:
+    app: vibecarbon-traefik
+    component: ingress
+data:
+  # Additional Traefik configuration can be added here
+  # This is used by the Traefik deployment via volume mount if needed
+  traefik.yml: |
+    # Static configuration (if needed beyond CLI args)
+    # Currently most config is passed via CLI args

package/carbon/k8s/base/traefik/deployment.yaml

@@ -0,0 +1,165 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik
+  labels:
+    app: vibecarbon-traefik
+    component: ingress
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vibecarbon-traefik
+  template:
+    metadata:
+      labels:
+        app: vibecarbon-traefik
+        component: ingress
+    spec:
+      serviceAccountName: traefik
+      nodeSelector:
+        node-role.kubernetes.io/control-plane: 'true'
+      tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
+      containers:
+      - name: traefik
+        image: traefik:v3.6.11
+        imagePullPolicy: IfNotPresent
+        args:
+        - --api.dashboard=true
+        - --api.insecure=false
+        - --providers.kubernetescrd
+        - --providers.kubernetesingress
+        - --entrypoints.web.address=:80
+        - --entrypoints.websecure.address=:443
+        - --entrypoints.traefik.address=:8080
+        - --ping=true
+        - --log.level=INFO
+        - --accesslog=true
+        ports:
+        - containerPort: 80
+          name: web
+          hostPort: 80
+        - containerPort: 443
+          name: websecure
+          hostPort: 443
+        - containerPort: 8080
+          name: traefik
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 500m
+            memory: 256Mi
+        livenessProbe:
+          httpGet:
+            path: /ping
+            port: traefik
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: traefik
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 3
+          failureThreshold: 3
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - name: tmp-vol-0
+          mountPath: /tmp
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+      - name: tmp-vol-0
+        emptyDir: {}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik
+  labels:
+    app: vibecarbon-traefik
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: traefik
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - services
+  - endpoints
+  - secrets
+  - configmaps
+  - pods
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  - networking.k8s.io
+  resources:
+  - ingresses
+  - ingressclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  - networking.k8s.io
+  resources:
+  - ingresses/status
+  verbs:
+  - update
+- apiGroups:
+  - traefik.io
+  resources:
+  - middlewares
+  - middlewaretcps
+  - ingressroutes
+  - traefikservices
+  - ingressroutetcps
+  - ingressrouteudps
+  - tlsoptions
+  - tlsstores
+  - serverstransports
+  - serverstransporttcps
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: traefik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik
+subjects:
+- kind: ServiceAccount
+  name: traefik
+  namespace: vibecarbon

package/carbon/k8s/base/traefik/ingressroute.yaml

@@ -0,0 +1,141 @@
+# Traefik CRDs - IngressRoute for Vibecarbon
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vibecarbon-app
+  labels:
+    app: vibecarbon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # Main application routes
+    - match: PathPrefix(`/`)
+      kind: Rule
+      priority: 1
+      services:
+        - name: app
+          port: 3000
+      middlewares:
+        - name: security-headers
+    # API routes go to Kong (Supabase gateway)
+    - match: PathPrefix(`/auth`) || PathPrefix(`/rest`) || PathPrefix(`/realtime`) || PathPrefix(`/storage`)
+      kind: Rule
+      priority: 10
+      services:
+        - name: supabase-supabase-kong
+          port: 8000
+      middlewares:
+        - name: security-headers
+    # Admin routes - protected by ForwardAuth (requires admin role)
+    # Studio dashboard
+    - match: PathPrefix(`/admin/studio`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: supabase-supabase-studio
+          port: 3000
+      middlewares:
+        - name: admin-auth
+        - name: security-headers
+        - name: strip-admin-studio-prefix
+    # Next.js static assets for Studio (/_next/... paths are absolute in Next.js builds).
+    # The main app uses Vite, so /_next/ requests only ever originate from Studio's HTML.
+    # Priority 15: higher than the app catch-all (1), lower than explicit admin routes (20).
+    - match: PathPrefix(`/_next`)
+      kind: Rule
+      priority: 15
+      middlewares:
+        - name: admin-auth
+      services:
+        - name: supabase-supabase-studio
+          port: 3000
+    # Studio's internal Next.js routes. After strip-prefix serves the root HTML,
+    # Studio redirects the browser to /project/default (the default project dashboard).
+    # These routes are protected by admin-auth so only super admins can access them.
+    - match: PathPrefix(`/project`)
+      kind: Rule
+      priority: 15
+      services:
+        - name: supabase-supabase-studio
+          port: 3000
+      middlewares:
+        - name: admin-auth
+        - name: security-headers
+  tls:
+    secretName: vibecarbon-tls
+---
+# HTTP fallback - redirects HTTP to HTTPS via redirect-https middleware.
+# When a domain is configured, this ensures all HTTP traffic is upgraded to HTTPS.
+# When no TLS cert exists yet, Traefik serves with its default self-signed cert
+# on the websecure entrypoint while cert-manager provisions the real certificate.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vibecarbon-http-direct
+  labels:
+    app: vibecarbon
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: PathPrefix(`/`)
+      kind: Rule
+      priority: 1
+      services:
+        - name: app
+          port: 3000
+      middlewares:
+        - name: redirect-https
+    - match: PathPrefix(`/auth`) || PathPrefix(`/rest`) || PathPrefix(`/realtime`) || PathPrefix(`/storage`)
+      kind: Rule
+      priority: 10
+      services:
+        - name: supabase-supabase-kong
+          port: 8000
+      middlewares:
+        - name: redirect-https
+---
+# Traefik Dashboard - exposed on websecure entrypoint via /admin/traefik/dashboard/
+# Protected by admin-auth (ForwardAuth requires super_admin).
+#
+# How it works:
+# - Dashboard HTML loads at /admin/traefik/dashboard/ (strip-prefix → /dashboard/)
+# - Assets use ./relative paths so they resolve to /admin/traefik/dashboard/assets/...
+#   which the strip-prefix route forwards correctly as /dashboard/assets/...
+# - The dashboard JS hardcodes window.APIUrl = "/api/" so API calls go to /api/version,
+#   /api/overview, /api/http/... etc. — these don't overlap with the Hono API paths
+#   (/api/v1/, /api/health, /api/_internal/, /api/webhooks/, /api/docs).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: traefik-dashboard
+  labels:
+    app: vibecarbon-traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # Dashboard UI — strip /admin/traefik so Traefik's api@internal receives /dashboard/
+    - match: PathPrefix(`/admin/traefik`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: api@internal
+          kind: TraefikService
+      middlewares:
+        - name: admin-auth
+        - name: security-headers
+        - name: strip-admin-traefik-prefix
+    # Traefik REST API — dashboard JS calls /api/version, /api/overview, /api/http/, etc.
+    # These paths don't overlap with Hono API routes so we can route them here.
+    - match: PathPrefix(`/api/version`) || PathPrefix(`/api/overview`) || PathPrefix(`/api/http`) || PathPrefix(`/api/tcp`) || PathPrefix(`/api/udp`) || PathPrefix(`/api/entrypoints`) || PathPrefix(`/api/rawdata`)
+      kind: Rule
+      priority: 12
+      services:
+        - name: api@internal
+          kind: TraefikService
+      middlewares:
+        - name: admin-auth
+  tls:
+    secretName: vibecarbon-tls

package/carbon/k8s/base/traefik/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml
+  - configmap.yaml
+  - ingressroute.yaml
+  - middleware.yaml
+  - certificate.yaml
+  - network-policy.yaml

package/carbon/k8s/base/traefik/middleware.yaml

@@ -0,0 +1,109 @@
+# Traefik Middlewares
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: security-headers
+  labels:
+    app: vibecarbon
+spec:
+  headers:
+    browserXssFilter: true
+    contentTypeNosniff: true
+    frameDeny: true
+    stsIncludeSubdomains: true
+    stsPreload: true
+    stsSeconds: 31536000
+    customFrameOptionsValue: "SAMEORIGIN"
+    customResponseHeaders:
+      X-Robots-Tag: "noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  labels:
+    app: vibecarbon
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-admin-studio-prefix
+  labels:
+    app: vibecarbon
+spec:
+  stripPrefix:
+    prefixes:
+      - /admin/studio
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-admin-n8n-prefix
+  labels:
+    app: vibecarbon
+spec:
+  stripPrefix:
+    prefixes:
+      - /admin/n8n
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-admin-metabase-prefix
+  labels:
+    app: vibecarbon
+spec:
+  stripPrefix:
+    prefixes:
+      - /admin/metabase
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-admin-traefik-prefix
+  labels:
+    app: vibecarbon
+spec:
+  stripPrefix:
+    prefixes:
+      - /admin/traefik
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: rate-limit
+  labels:
+    app: vibecarbon
+spec:
+  rateLimit:
+    average: 100
+    burst: 200
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: compress
+  labels:
+    app: vibecarbon
+spec:
+  compress: {}
+---
+# ForwardAuth middleware for admin routes
+# Verifies user is authenticated and has admin role via app's verify-role endpoint
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: admin-auth
+  labels:
+    app: vibecarbon
+spec:
+  forwardAuth:
+    address: http://app:3000/api/_internal/verify-role?role=super_admin
+    authResponseHeaders:
+      - X-User-Id
+      - X-User-Email
+      - X-User-Role