vibecarbon 0.1.0

package/carbon/k8s/infra/cert-manager-resources/cluster-issuers-hetzner.yaml

@@ -0,0 +1,59 @@
+# Let's Encrypt ClusterIssuers for the `hetzner` DNS provider strategy.
+#
+# Uses cert-manager's webhook solver pointed at the OFFICIAL
+# `cert-manager-webhook-hetzner` chart from charts.hetzner.cloud. The
+# webhook calls the Hetzner Cloud DNS API (api.hetzner.cloud/v1/zones)
+# to write the `_acme-challenge.<domain>` TXT record.
+#
+# Hetzner retired the separate DNS Console (dns.hetzner.com) in
+# May 2026 and folded zone management into the main Cloud Console.
+# As a result the same Cloud API token used elsewhere in vibecarbon
+# now covers DNS — there is NO separate "DNS API token" anymore.
+#
+# Requires:
+#   1. The cert-manager-webhook-hetzner Deployment to be Available in
+#      the cert-manager namespace (installed by applyK3sManifests via
+#      `helm upgrade --install` from charts.hetzner.cloud).
+#   2. Secret `hetzner` with key `token` in the cert-manager namespace,
+#      holding the Hetzner Cloud API token. `applyK3sManifests` lands
+#      both before applying these issuers.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod-hetzner
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: "{{ADMIN_EMAIL}}"
+    privateKeySecretRef:
+      name: letsencrypt-prod-hetzner-account-key
+    solvers:
+      - dns01:
+          webhook:
+            groupName: acme.hetzner.com
+            solverName: hetzner
+            config:
+              tokenSecretKeyRef:
+                name: hetzner
+                key: token
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging-hetzner
+spec:
+  acme:
+    # Staging has higher rate limits but issues untrusted certs.
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: "{{ADMIN_EMAIL}}"
+    privateKeySecretRef:
+      name: letsencrypt-staging-hetzner-account-key
+    solvers:
+      - dns01:
+          webhook:
+            groupName: acme.hetzner.com
+            solverName: hetzner
+            config:
+              tokenSecretKeyRef:
+                name: hetzner
+                key: token

package/carbon/k8s/infra/cert-manager-resources/cluster-issuers-manual.yaml

@@ -0,0 +1,43 @@
+# Let's Encrypt ClusterIssuers for the `manual` DNS provider strategy.
+#
+# Uses HTTP-01 ACME validation: cert-manager temporarily exposes a
+# challenge token at http://<domain>/.well-known/acme-challenge/<token>
+# and Let's Encrypt fetches it to prove control. This works only when
+# port 80 is reachable from the public internet straight to traefik —
+# i.e., NOT behind a reverse proxy that terminates TLS at the edge
+# (Cloudflare orange-cloud, Fastly, etc.). For those, use the matching
+# `*-cloudflare` or `*-hetzner` DNS-01 issuer instead.
+#
+# The `letsencrypt-{prod,staging}-manual` issuer is selected by
+# applyK3sManifests in src/lib/deploy/k8s/k3s.js when
+# dnsProvider === 'manual' (or unknown).
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod-manual
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: "{{ADMIN_EMAIL}}"
+    privateKeySecretRef:
+      name: letsencrypt-prod-manual-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging-manual
+spec:
+  acme:
+    # Staging has higher rate limits but issues untrusted certs.
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: "{{ADMIN_EMAIL}}"
+    privateKeySecretRef:
+      name: letsencrypt-staging-manual-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik

package/carbon/k8s/infra/cert-manager-resources/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# cert-manager custom resources (per-DNS-provider ClusterIssuers).
+# IMPORTANT: Apply this AFTER cert-manager CRDs are installed and ready.
+# Usage: kubectl apply -k k8s/infra/cert-manager-resources/
+#
+# All issuer sets ship together; cert-manager only acts on the one
+# referenced by the Certificate (issuerRef.name is patched per
+# deployment in src/lib/deploy/k8s/k3s.js → applyK3sManifests).
+
+resources:
+  - cluster-issuers-manual.yaml
+  - cluster-issuers-cloudflare.yaml
+  - cluster-issuers-hetzner.yaml

package/carbon/k8s/infra/kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# cert-manager installation — applied directly by the deploy script, NOT via kustomize.
+#
+# kustomize v5 (bundled with kubectl 1.27+) no longer supports raw HTTP remote resources
+# in the `resources:` field. Only git-style kustomize bases are supported. cert-manager
+# distributes a monolithic YAML file (not a kustomize base), so it must be applied with
+# kubectl apply -f directly.
+#
+# cert-manager version: v1.20.2
+# cert-manager URL: https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml
+#
+# To upgrade cert-manager: update CERT_MANAGER_VERSION in src/lib/deploy/k8s/k3s.js
+# (and bump cert-manager-webhook-hetzner in lockstep — see HETZNER_WEBHOOK_CHART_VERSION).
+#
+# IMPORTANT: ClusterIssuers are applied separately AFTER cert-manager is ready
+# See: k8s/infra/cert-manager-resources/ for ClusterIssuers
+
+# No resources here — cert-manager is applied directly by the deploy script.
+# hetzner-ccm and hetzner-csi are installed via cloud-init (see master-init.sh)

package/carbon/k8s/infra/traefik-crds/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Traefik CRDs for IngressRoute, Middleware, etc.
+# Apply this BEFORE base manifests that use Traefik CRs
+# Usage: kubectl apply -k k8s/infra/traefik-crds/
+
+resources:
+  # Traefik v3 CRDs from official repository
+  - https://raw.githubusercontent.com/traefik/traefik/v3.3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml

package/carbon/k8s/overlays/local/configmap.yaml

@@ -0,0 +1,23 @@
+# Local development configuration
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vibecarbon-config
+data:
+  # Site Configuration (local URLs)
+  SITE_URL: "http://localhost:8080"
+  PROJECT_NAME: "vibecarbon-local"
+
+  # Database
+  DB_HOST: "postgres"
+  DB_PORT: "5432"
+  DB_NAME: "postgres"
+
+  # Internal Service URLs
+  KONG_URL: "http://kong:8000"
+  AUTH_URL: "http://auth:9999"
+  REST_URL: "http://rest:3000"
+  REALTIME_URL: "http://realtime:4000"
+  STORAGE_URL: "http://storage:5000"
+  META_URL: "http://meta:8080"
+  IMGPROXY_URL: "http://imgproxy:5001"

package/carbon/k8s/overlays/local/ingressroute-studio.yaml

@@ -0,0 +1,104 @@
+# ============================================================================
+# LOCAL DEVELOPMENT ROUTES
+# ============================================================================
+# For local development, we use host-based routing for simplicity.
+# Production uses path-based /admin/* routes with ForwardAuth protection.
+#
+# Local URLs (no auth required):
+#   http://studio.localhost:8080  - Supabase Studio
+#   http://n8n.localhost:8080     - n8n Workflows
+#   http://traefik.localhost:8080 - Traefik Dashboard
+#
+# Production-like URLs (requires admin role):
+#   http://localhost:8080/admin/studio
+#   http://localhost:8080/admin/n8n
+# ============================================================================
+
+# Studio - direct access for local development
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: studio-local
+  labels:
+    app: vibecarbon-studio
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`studio.localhost`)
+      kind: Rule
+      services:
+        - name: studio
+          port: 3000
+---
+# n8n - direct access for local development
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: n8n-local
+  labels:
+    app: vibecarbon-n8n
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`n8n.localhost`)
+      kind: Rule
+      services:
+        - name: n8n
+          port: 5678
+---
+# Traefik dashboard - direct access for local development
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: traefik-dashboard-local
+  labels:
+    app: vibecarbon-traefik
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`traefik.localhost`)
+      kind: Rule
+      services:
+        - name: traefik-dashboard
+          port: 8080
+---
+# ============================================================================
+# PRODUCTION-LIKE ROUTES (for testing ForwardAuth locally)
+# ============================================================================
+# These routes mirror production but are only enabled when testing the full
+# auth flow locally. Requires the app to be running with verify-role endpoint.
+
+# Admin routes with ForwardAuth (production-like)
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: admin-routes-local
+  labels:
+    app: vibecarbon-admin
+spec:
+  entryPoints:
+    - web
+  routes:
+    # /admin/studio with ForwardAuth
+    - match: PathPrefix(`/admin/studio`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: studio
+          port: 3000
+      middlewares:
+        - name: admin-auth
+        - name: strip-admin-studio-prefix
+    # /admin/n8n with ForwardAuth
+    - match: PathPrefix(`/admin/n8n`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: n8n
+          port: 5678
+      middlewares:
+        - name: admin-auth
+        - name: strip-admin-n8n-prefix

package/carbon/k8s/overlays/local/kustomization.yaml

@@ -0,0 +1,215 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vibecarbon
+
+# Local overlay - only includes components needed for local testing
+# Excludes: hetzner-ccm, hetzner-csi, cert-manager
+resources:
+  - namespace.yaml
+  - ../../base/app/
+  - ../../base/supabase/postgres/
+  - ../../base/supabase/kong/
+  - ../../base/supabase/auth/
+  - ../../base/supabase/rest/
+  - ../../base/supabase/realtime/
+  - ../../base/supabase/storage/
+  - ../../base/supabase/imgproxy/
+  - ../../base/supabase/meta/
+  - ../../base/supabase/studio/
+  - ../../base/traefik/
+  - secrets.yaml
+  - configmap.yaml
+  - ingressroute-studio.yaml
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: vibecarbon
+      environment: local
+    includeSelectors: false
+
+patches:
+  # Use emptyDir instead of PVC for local ephemeral storage
+  # Override postStart to use hardcoded local dev password
+  - target:
+      kind: StatefulSet
+      name: postgres
+    patch: |-
+      - op: remove
+        path: /spec/volumeClaimTemplates
+      - op: add
+        path: /spec/template/spec/volumes
+        value:
+          - name: postgres-data
+            emptyDir: {}
+      - op: replace
+        path: /spec/template/spec/containers/0/lifecycle/postStart/exec/command
+        value:
+          - /bin/sh
+          - -c
+          - |
+            sleep 15
+            until pg_isready -U supabase_admin -h /var/run/postgresql; do sleep 2; done
+            sleep 5
+            psql -U supabase_admin -h /var/run/postgresql -c "
+              ALTER ROLE authenticator WITH PASSWORD 'local-dev-password-12345';
+              ALTER ROLE supabase_auth_admin WITH PASSWORD 'local-dev-password-12345';
+              ALTER ROLE supabase_storage_admin WITH PASSWORD 'local-dev-password-12345';
+              ALTER ROLE supabase_admin WITH PASSWORD 'local-dev-password-12345';
+              CREATE SCHEMA IF NOT EXISTS _realtime;
+              GRANT ALL ON SCHEMA _realtime TO postgres, authenticator;
+              -- n8n database and user
+              DO \$\$ BEGIN
+                IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'n8n') THEN
+                  CREATE ROLE n8n WITH LOGIN PASSWORD 'local-dev-password-12345';
+                END IF;
+              END \$\$;
+              CREATE DATABASE n8n WITH OWNER n8n ENCODING 'UTF8' TEMPLATE template0;
+              GRANT ALL PRIVILEGES ON DATABASE n8n TO n8n;
+            " || true
+
+  # Use local-path for storage PVC
+  - target:
+      kind: PersistentVolumeClaim
+      name: storage-data
+    patch: |-
+      - op: replace
+        path: /spec/storageClassName
+        value: local-path
+      - op: replace
+        path: /spec/resources/requests/storage
+        value: 1Gi
+
+  # Use local-path for n8n PVC
+  - target:
+      kind: PersistentVolumeClaim
+      name: n8n-data
+    patch: |-
+      - op: replace
+        path: /spec/storageClassName
+        value: local-path
+      - op: replace
+        path: /spec/resources/requests/storage
+        value: 1Gi
+
+  # Use pause container for app (local dev builds app separately, this is just a placeholder)
+  - target:
+      kind: Deployment
+      name: app
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/image
+        value: registry.k8s.io/pause:3.9
+      - op: replace
+        path: /spec/template/spec/containers/0/ports/0/containerPort
+        value: 80
+      - op: remove
+        path: /spec/template/spec/containers/0/env
+      - op: remove
+        path: /spec/template/spec/containers/0/livenessProbe
+      - op: remove
+        path: /spec/template/spec/containers/0/readinessProbe
+
+  # Reduce replicas for local testing (base now has correct memory limits)
+  - target:
+      kind: Deployment
+      name: kong
+    patch: |-
+      - op: replace
+        path: /spec/replicas
+        value: 1
+
+  - target:
+      kind: Deployment
+      name: auth
+    patch: |-
+      - op: replace
+        path: /spec/replicas
+        value: 1
+
+  - target:
+      kind: Deployment
+      name: rest
+    patch: |-
+      - op: replace
+        path: /spec/replicas
+        value: 1
+
+  - target:
+      kind: Deployment
+      name: realtime
+    patch: |-
+      - op: replace
+        path: /spec/replicas
+        value: 1
+
+  - target:
+      kind: Deployment
+      name: traefik
+    patch: |-
+      - op: replace
+        path: /spec/replicas
+        value: 1
+      # Remove HTTPS redirect args for local HTTP testing
+      - op: replace
+        path: /spec/template/spec/containers/0/args
+        value:
+          - "--api.dashboard=true"
+          - "--api.insecure=true"
+          - "--providers.kubernetescrd"
+          - "--providers.kubernetesingress"
+          - "--entrypoints.web.address=:80"
+          - "--entrypoints.websecure.address=:443"
+          - "--entrypoints.traefik.address=:8080"
+          - "--ping=true"
+          - "--log.level=INFO"
+          - "--accesslog=true"
+
+  # Change IngressRoute to use HTTP (web) for local testing
+  # Remove admin routes (using host-based routing locally: studio.localhost, n8n.localhost)
+  - target:
+      kind: IngressRoute
+      name: vibecarbon-app
+    patch: |-
+      - op: replace
+        path: /spec/entryPoints
+        value:
+          - web
+      - op: remove
+        path: /spec/tls
+      - op: remove
+        path: /spec/routes/3
+      - op: remove
+        path: /spec/routes/2
+
+  # Remove HTTP redirect route (not needed for local)
+  - target:
+      kind: IngressRoute
+      name: vibecarbon-http-redirect
+    patch: |-
+      $patch: delete
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRoute
+      metadata:
+        name: vibecarbon-http-redirect
+
+  # Disable HPA for local testing
+  - target:
+      kind: HorizontalPodAutoscaler
+    patch: |-
+      $patch: delete
+      apiVersion: autoscaling/v2
+      kind: HorizontalPodAutoscaler
+      metadata:
+        name: placeholder
+
+  # Disable cert-manager Certificate for local testing (since cert-manager isn't deployed locally)
+  - target:
+      kind: Certificate
+      name: vibecarbon-tls
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: Certificate
+      metadata:
+        name: vibecarbon-tls

package/carbon/k8s/overlays/local/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vibecarbon
+  labels:
+    app.kubernetes.io/name: vibecarbon
+    app.kubernetes.io/managed-by: kustomize
+    environment: local

package/carbon/k8s/overlays/local/secrets.yaml

@@ -0,0 +1,32 @@
+# Local development secrets — applied by carbon/k8s/test-local.sh to a k3d
+# cluster. These values exist only so the kustomize Secret resource has the
+# expected keys; they are NOT valid JWTs (the previous JWT-shaped strings
+# tripped GitHub's secret-scanning bot when committed-into-throwaway-e2e
+# repos pushed by the test runner — every push generated a "Supabase Service
+# Key detected" email even though the signatures were never actually valid).
+#
+# To run a working local Supabase auth flow you must replace ANON_KEY +
+# SERVICE_ROLE_KEY with real JWTs signed against JWT_SECRET. The Supabase
+# CLI (`supabase status`) prints a working pair you can paste in.
+#
+# DO NOT use these values in production!
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vibecarbon-secrets
+type: Opaque
+stringData:
+  DB_PASSWORD: "local-dev-password-12345"
+  JWT_SECRET: "local-jwt-secret-for-development-only-must-be-at-least-32-chars"
+  ANON_KEY: "REPLACE-WITH-LOCAL-ANON-JWT-FROM-supabase-status"
+  SERVICE_ROLE_KEY: "REPLACE-WITH-LOCAL-SERVICE-ROLE-JWT-FROM-supabase-status"
+  REALTIME_SECRET: "local-realtime-secret-for-development-must-be-at-least-64-bytes-long-for-cookie-store"
+  VAULT_ENC_KEY: "local-vault-encryption-key"
+  PG_META_CRYPTO_KEY: "local-pg-meta-crypto-key"
+  LOGFLARE_API_KEY: "local-logflare-api-key"
+  N8N_PASSWORD: "local-n8n-password"
+  S3_ACCESS_KEY: "local-s3-access-key"
+  S3_SECRET_KEY: "local-s3-secret-key"
+  S3_REGION: "us-east-1"
+  S3_BUCKET: "vibecarbon-local-bucket"
+  S3_ENDPOINT: "http://localhost:9000"

package/carbon/k8s/overlays/production/kustomization.yaml

@@ -0,0 +1,34 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vibecarbon
+
+resources:
+  - ../../base
+
+labels:
+  - pairs:
+      environment: production
+
+configMapGenerator:
+  - name: vibecarbon-config
+    behavior: merge
+    literals:
+      - SITE_URL={{DOMAIN}}
+      - PROJECT_NAME=vibecarbon
+      # Service names follow the Supabase community Helm chart convention
+      # (release name `supabase` + chart name `supabase` → `supabase-supabase-*`).
+      - DB_HOST=supabase-supabase-db
+      - DB_PORT=5432
+      - DB_NAME=postgres
+      - KONG_URL=http://supabase-supabase-kong:8000
+      - AUTH_URL=http://supabase-supabase-auth:9999
+      - REST_URL=http://supabase-supabase-rest:3000
+      - REALTIME_URL=http://supabase-supabase-realtime:4000
+      - STORAGE_URL=http://supabase-supabase-storage:5000
+      - META_URL=http://supabase-supabase-meta:8080
+      - IMGPROXY_URL=http://supabase-supabase-imgproxy:5001
+
+images:
+  - name: ghcr.io/{{GITHUB_OWNER}}/{{PROJECT_NAME}}
+    newTag: main