vibecarbon 0.1.0

package/carbon/scripts/docker-up.js

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+/**
+ * Start Docker Compose services based on enabled features
+ *
+ * Usage:
+ *   node scripts/docker-up.js           # Start dev services
+ *   node scripts/docker-up.js --prod    # Start production services
+ *   node scripts/docker-up.js --dry-run # Show command without running
+ */
+
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import {
+  buildComposeCommand,
+  discoverOptionalServices,
+  getEnabledServices,
+  loadManifest,
+  parseArgs,
+} from './lib/manifest.js';
+
+/**
+ * Read environment value from .env files
+ */
+function getEnvValue(key) {
+  const envFiles = ['.env.local', '.env'];
+  for (const file of envFiles) {
+    if (existsSync(file)) {
+      const content = readFileSync(file, 'utf-8');
+      const match = content.match(new RegExp(`^${key}=["']?([^"'\\n]+)["']?`, 'm'));
+      if (match) return match[1];
+    }
+  }
+  return null;
+}
+
+/**
+ * Calculate port with offset, respecting explicit overrides
+ */
+function getPort(envKey, defaultPort, offset) {
+  const explicit = getEnvValue(envKey);
+  if (explicit) return explicit;
+  return String(defaultPort + offset);
+}
+
+/**
+ * Build environment variables for port configuration
+ * Applies DEV_PORT_OFFSET to all configurable ports
+ */
+function getPortEnvVars() {
+  const portOffset = Number.parseInt(getEnvValue('DEV_PORT_OFFSET') || '0', 10);
+
+  return {
+    DEV_DB_PORT: getPort('DEV_DB_PORT', 5432, portOffset),
+    DEV_KONG_PORT: getPort('DEV_KONG_PORT', 8000, portOffset),
+    DEV_KONG_SSL_PORT: getPort('DEV_KONG_SSL_PORT', 8443, portOffset),
+    DEV_TRAEFIK_PORT: getPort('DEV_TRAEFIK_PORT', 80, portOffset),
+    DEV_PROMETHEUS_PORT: getPort('DEV_PROMETHEUS_PORT', 9190, portOffset),
+    DEV_GRAFANA_PORT: getPort('DEV_GRAFANA_PORT', 3002, portOffset),
+    DEV_LOKI_PORT: getPort('DEV_LOKI_PORT', 3100, portOffset),
+  };
+}
+
+/**
+ * Run DB init scripts for optional services.
+ * These scripts are idempotent (IF NOT EXISTS, ALTER ROLE) so they're safe
+ * to run on every startup. This handles the case where a service is added
+ * after the DB volume already exists — Postgres only runs entrypoint scripts
+ * on first volume initialization.
+ */
+function runServiceDbInit(manifest, { all, verbose }) {
+  let serviceNames;
+  if (all) {
+    // Extract service names from compose file names: docker-compose.metabase.yml → metabase
+    serviceNames = discoverOptionalServices().map((f) => f.replace('docker-compose.', '').replace('.yml', ''));
+  } else {
+    serviceNames = getEnabledServices(manifest);
+  }
+
+  const scripts = serviceNames
+    .map((name) => ({ name, path: `volumes/db/${name}-init.sh` }))
+    .filter(({ path }) => existsSync(path));
+
+  if (scripts.length === 0) return;
+
+  if (verbose) console.log('Phase 1.5 — running DB init scripts for services:', scripts.map((s) => s.name).join(', '));
+
+  for (const { name, path } of scripts) {
+    if (verbose) console.log(`  Running DB init for ${name}...`);
+    try {
+      execSync(`docker compose -f docker-compose.yml exec -T db bash < ${path}`, {
+        stdio: verbose ? 'inherit' : 'pipe',
+        env: { ...process.env, ...getPortEnvVars() },
+      });
+    } catch (error) {
+      console.warn(`Warning: DB init for ${name} failed (${error.message}). The service may not connect.`);
+    }
+  }
+}
+
+const args = parseArgs(process.argv.slice(2));
+
+if (args.help) {
+  console.log(`
+Usage: node scripts/docker-up.js [options]
+
+Options:
+  --all       Include all optional services (ignores .vibecarbon.json)
+  --prod      Include production overlay (docker-compose.prod.yml)
+  --dry-run   Print the command without executing it
+  -v          Verbose output
+  -h, --help  Show this help message
+
+Examples:
+  node scripts/docker-up.js              # Start services from .vibecarbon.json
+  node scripts/docker-up.js --all        # Start ALL optional services
+  node scripts/docker-up.js --prod       # Start with production config
+  pnpm docker:up                         # Via package.json script
+  pnpm docker:up -- --all                # Start all services via pnpm
+`);
+  process.exit(0);
+}
+
+const manifest = loadManifest();
+
+// Get port configuration with offset applied
+const portEnv = getPortEnvVars();
+const execOpts = { stdio: 'inherit', env: { ...process.env, ...portEnv } };
+
+// Check if any optional services (metabase, n8n, observability, etc.) are enabled.
+// These can have slow health checks (e.g. Metabase JVM takes 2-4 min), so we start
+// core Supabase services first with --wait, then launch optional services in the
+// background without blocking.
+const hasOptionalServices = args.all || getEnabledServices(manifest).length > 0;
+
+if (hasOptionalServices) {
+  const coreCmd = buildComposeCommand('up -d --wait', { services: {} }, { prod: args.prod });
+  const fullCmd = buildComposeCommand('up -d', manifest, { prod: args.prod, all: args.all });
+
+  if (args.dryRun) {
+    console.log('Phase 1 (core, blocking):', coreCmd);
+    console.log('Phase 1.5 (service DB init): run idempotent init scripts via exec -T db bash');
+    console.log('Phase 2 (optional, background):', fullCmd);
+    console.log('With port env:', portEnv);
+    process.exit(0);
+  }
+
+  // Phase 1: Start core services and wait until healthy (~17s)
+  if (args.verbose) console.log('Phase 1 — core services:', coreCmd);
+  try {
+    execSync(coreCmd, execOpts);
+  } catch (error) {
+    diagnoseFailure();
+    process.exit(error.status || 1);
+  }
+
+  // Phase 1.5: Run idempotent DB init scripts for services that need their own database/user.
+  // Postgres skips /docker-entrypoint-initdb.d/ when the data volume already exists,
+  // so we pipe the scripts into the running container to ensure roles/databases exist.
+  runServiceDbInit(manifest, { all: args.all, verbose: args.verbose });
+
+  // Phase 2: Start optional services in background (no --wait)
+  // Core services are already running so Docker skips them (idempotent up -d)
+  if (args.verbose) console.log('Phase 2 — optional services:', fullCmd);
+  console.log('Starting optional services in background...');
+  try {
+    execSync(fullCmd, execOpts);
+  } catch (error) {
+    // Non-fatal: optional services failing to launch shouldn't block dev
+    console.warn('Warning: some optional services may have failed to start.');
+  }
+
+} else {
+  const cmd = buildComposeCommand('up -d --wait', manifest, { prod: args.prod, all: args.all });
+
+  if (args.dryRun) {
+    console.log('Would run:', cmd);
+    console.log('With port env:', portEnv);
+    process.exit(0);
+  }
+
+  if (args.verbose) console.log('Running:', cmd);
+
+  try {
+    execSync(cmd, execOpts);
+  } catch (error) {
+    diagnoseFailure();
+    process.exit(error.status || 1);
+  }
+}
+
+/**
+ * Check unhealthy containers for common issues and print helpful messages.
+ */
+function diagnoseFailure() {
+  try {
+    const logs = execSync('docker compose logs --tail 20 auth rest storage 2>&1', {
+      encoding: 'utf-8',
+      env: { ...process.env, ...getPortEnvVars() },
+    });
+
+    if (logs.includes('password authentication failed')) {
+      console.error(`
+\x1b[33m┌──────────────────────────────────────────────────────────┐
+│  Database credentials mismatch detected                  │
+│                                                          │
+│  The database volume was initialized with different      │
+│  credentials than your current .env.local.               │
+│                                                          │
+│  This happens when you recreate a project without        │
+│  removing the old Docker volumes.                        │
+│                                                          │
+│  Fix:  vibecarbon reset                                 │
+│                                                          │
+│  This will remove volumes and reinitialize the database. │
+│  ⚠  All local database data will be lost.                │
+└──────────────────────────────────────────────────────────┘\x1b[0m
+`);
+    }
+  } catch {
+    // Diagnostic check failed, don't block the error exit
+  }
+}

package/carbon/scripts/generate-dev-configs.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+#
+# Generate dev config files from templates
+# Replaces {{PLACEHOLDERS}} with hardcoded dev values
+#
+# Usage:
+#   ./generate-dev-configs.sh          # Only generate missing files
+#   ./generate-dev-configs.sh --force  # Regenerate all files
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CARBON_DIR="$(dirname "$SCRIPT_DIR")"
+
+FORCE=false
+if [[ "${1:-}" == "--force" ]]; then
+  FORCE=true
+fi
+
+cd "$CARBON_DIR"
+
+# Dev value substitutions (add new placeholders here).
+# Note: ANON_KEY and SERVICE_ROLE_KEY are signed at runtime by
+# scripts/_dev-jwt.mjs against JWT_SECRET. Committing literal JWT
+# strings tripped GitHub's secret-scanner on every push; signing on
+# the fly keeps the dev workflow deterministic without leaking
+# service-role-shaped values into git history.
+JWT_SECRET_VALUE="local-dev-jwt-secret-must-be-at-least-32-chars-padded-padded"
+ANON_KEY_VALUE=$(JWT_SECRET="$JWT_SECRET_VALUE" node "$SCRIPT_DIR/_dev-jwt.mjs" anon)
+SERVICE_ROLE_KEY_VALUE=$(JWT_SECRET="$JWT_SECRET_VALUE" node "$SCRIPT_DIR/_dev-jwt.mjs" service_role)
+
+declare -A SUBSTITUTIONS=(
+  ["{{PROJECT_NAME}}"]="vibecarbon"
+  ["{{ANON_KEY}}"]="$ANON_KEY_VALUE"
+  ["{{SERVICE_ROLE_KEY}}"]="$SERVICE_ROLE_KEY_VALUE"
+  ["{{JWT_SECRET}}"]="$JWT_SECRET_VALUE"
+  ["{{DB_PASSWORD}}"]="local-postgres-password-for-dev-only"
+  ["{{ADMIN_EMAIL}}"]="admin@localhost"
+  ["{{ADMIN_PASSWORD}}"]="local-admin-password"
+  ["{{GRAFANA_PASSWORD}}"]="admin"
+  ["{{N8N_PASSWORD}}"]="local-n8n-password"
+  ["{{REALTIME_SECRET}}"]="local-realtime-secret-padded"
+  ["{{VAULT_ENC_KEY}}"]="local-vault-encryption-key-1234567890"
+  ["{{DB_ENC_KEY}}"]="devdbencryptkey1"
+)
+
+# Files that need dev variants (relative to carbon/)
+# Format: "template_path:dev_path"
+declare -a CONFIG_PAIRS=(
+  # Grafana dashboards
+  "volumes/grafana/provisioning/dashboards/dashboards.yml:volumes/grafana/provisioning/dashboards/dashboards.dev.yml"
+  # Database initialization (only super-admin needs dev variant — roles/services use runtime env vars)
+  "volumes/db/super-admin.sql:volumes/db/super-admin.dev.sql"
+)
+
+# Directories where all files need dev variants
+declare -a CONFIG_DIRS=(
+  "volumes/grafana/dashboards:volumes/grafana/dashboards.dev"
+)
+
+generate_dev_file() {
+  local src="$1"
+  local dest="$2"
+
+  if [[ ! -f "$src" ]]; then
+    echo "  SKIP: $src (template not found)"
+    return
+  fi
+
+  if [[ -f "$dest" && "$FORCE" == "false" ]]; then
+    echo "  SKIP: $dest (exists, use --force to regenerate)"
+    return
+  fi
+
+  # Start with source content
+  local content
+  content=$(<"$src")
+
+  # Apply all substitutions
+  for placeholder in "${!SUBSTITUTIONS[@]}"; do
+    local value="${SUBSTITUTIONS[$placeholder]}"
+    content="${content//${placeholder}/${value}}"
+  done
+
+  # Write dev file
+  mkdir -p "$(dirname "$dest")"
+  echo "$content" > "$dest"
+
+  if [[ "$FORCE" == "true" ]]; then
+    echo "  REGENERATED: $dest"
+  else
+    echo "  CREATED: $dest"
+  fi
+}
+
+echo "Generating dev config files..."
+echo ""
+
+# Process individual file pairs
+echo "Config files:"
+for pair in "${CONFIG_PAIRS[@]}"; do
+  src="${pair%%:*}"
+  dest="${pair##*:}"
+  generate_dev_file "$src" "$dest"
+done
+
+echo ""
+
+# Process directories
+echo "Config directories:"
+for dir_pair in "${CONFIG_DIRS[@]}"; do
+  src_dir="${dir_pair%%:*}"
+  dest_dir="${dir_pair##*:}"
+
+  if [[ ! -d "$src_dir" ]]; then
+    echo "  SKIP: $src_dir (not found)"
+    continue
+  fi
+
+  mkdir -p "$dest_dir"
+
+  for src_file in "$src_dir"/*; do
+    if [[ -f "$src_file" ]]; then
+      filename=$(basename "$src_file")
+      generate_dev_file "$src_file" "$dest_dir/$filename"
+    fi
+  done
+done
+
+echo ""
+echo "Done. Remember to verify the generated files before committing."

package/carbon/scripts/generate-rss.ts

@@ -0,0 +1,116 @@
+/**
+ * Build-time RSS feed generator.
+ *
+ * Run: npx tsx scripts/generate-rss.ts
+ *
+ * Reads blog post frontmatter from content/blog/*.mdx and generates an RSS feed.
+ */
+
+import { readdirSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+interface PostMeta {
+  slug: string;
+  title: string;
+  description: string;
+  date: string;
+  author?: string;
+}
+
+function loadSiteUrl(): string {
+  try {
+    const envContent = readFileSync(resolve(__dirname, '../.env.local'), 'utf-8');
+    const match = envContent.match(/^SITE_URL=["']?(.+?)["']?\s*$/m);
+    if (match) return match[1];
+  } catch {
+    // .env.local may not exist in CI
+  }
+  return process.env.SITE_URL || 'http://localhost:5173';
+}
+
+function loadProjectName(): string {
+  try {
+    const pkgContent = readFileSync(resolve(__dirname, '../package.json'), 'utf-8');
+    const pkg = JSON.parse(pkgContent);
+    return pkg.name || 'My SaaS';
+  } catch {
+    return 'My SaaS';
+  }
+}
+
+function parseFrontmatter(content: string): Record<string, string> {
+  const match = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!match) return {};
+  const fm: Record<string, string> = {};
+  for (const line of match[1].split('\n')) {
+    const [key, ...rest] = line.split(':');
+    if (key && rest.length) {
+      fm[key.trim()] = rest.join(':').trim().replace(/^["']|["']$/g, '');
+    }
+  }
+  return fm;
+}
+
+function loadPosts(): PostMeta[] {
+  const blogDir = resolve(__dirname, '../content/blog');
+  const files = readdirSync(blogDir).filter((f) => f.endsWith('.mdx'));
+
+  return files
+    .map((file) => {
+      const content = readFileSync(resolve(blogDir, file), 'utf-8');
+      const fm = parseFrontmatter(content);
+      return {
+        slug: file.replace('.mdx', ''),
+        title: fm.title || file.replace('.mdx', ''),
+        description: fm.description || '',
+        date: fm.date || new Date().toISOString(),
+        author: fm.author,
+      };
+    })
+    .sort((a, b) => new Date(b.date).getTime() - new Date(a.date).getTime());
+}
+
+function generateRss(posts: PostMeta[], siteUrl: string, projectName: string): string {
+  const items = posts
+    .map(
+      (post) => `    <item>
+      <title>${escapeXml(post.title)}</title>
+      <link>${siteUrl}/blog/${post.slug}</link>
+      <description>${escapeXml(post.description)}</description>
+      <pubDate>${new Date(post.date).toUTCString()}</pubDate>
+      <guid>${siteUrl}/blog/${post.slug}</guid>
+    </item>`,
+    )
+    .join('\n');
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
+  <channel>
+    <title>${escapeXml(projectName)} Blog</title>
+    <link>${siteUrl}/blog</link>
+    <description>Updates, guides, and insights from ${escapeXml(projectName)}.</description>
+    <language>en-us</language>
+    <atom:link href="${siteUrl}/rss.xml" rel="self" type="application/rss+xml"/>
+${items}
+  </channel>
+</rss>
+`;
+}
+
+function escapeXml(str: string): string {
+  return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+const siteUrl = loadSiteUrl();
+const projectName = loadProjectName();
+const posts = loadPosts();
+const rss = generateRss(posts, siteUrl, projectName);
+
+const outDir = resolve(__dirname, '../dist/client');
+mkdirSync(outDir, { recursive: true });
+writeFileSync(resolve(outDir, 'rss.xml'), rss);
+
+console.log(`RSS feed generated with ${posts.length} posts → dist/client/rss.xml`);

package/carbon/scripts/generate-sitemap.ts

@@ -0,0 +1,102 @@
+/**
+ * Build-time sitemap generator.
+ *
+ * Run: npx tsx scripts/generate-sitemap.ts
+ *
+ * Reads SITE_URL from .env.local and outputs sitemap.xml to dist/client/.
+ * Includes static routes and dynamic blog post routes.
+ */
+
+import { readdirSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// Public routes that should be indexed
+const PUBLIC_ROUTES = ['/', '/login', '/signup', '/blog', '/changelog', '/docs'];
+
+function loadSiteUrl(): string {
+  try {
+    const envContent = readFileSync(resolve(__dirname, '../.env.local'), 'utf-8');
+    const match = envContent.match(/^SITE_URL=["']?(.+?)["']?\s*$/m);
+    if (match) return match[1];
+  } catch {
+    // .env.local may not exist in CI
+  }
+  return process.env.SITE_URL || 'http://localhost:5173';
+}
+
+function getBlogSlugs(): string[] {
+  try {
+    const blogDir = resolve(__dirname, '../content/blog');
+    return readdirSync(blogDir)
+      .filter((f) => f.endsWith('.mdx'))
+      .map((f) => f.replace('.mdx', ''));
+  } catch {
+    return [];
+  }
+}
+
+function getChangelogSlugs(): string[] {
+  try {
+    const changelogDir = resolve(__dirname, '../content/changelog');
+    return readdirSync(changelogDir)
+      .filter((f) => f.endsWith('.mdx'))
+      .map((f) => f.replace('.mdx', ''));
+  } catch {
+    return [];
+  }
+}
+
+function getDocsSlugs(): string[] {
+  try {
+    const docsDir = resolve(__dirname, '../content/docs');
+    return readdirSync(docsDir)
+      .filter((f) => f.endsWith('.mdx'))
+      .map((f) => f.replace('.mdx', ''));
+  } catch {
+    return [];
+  }
+}
+
+function generateSitemap(siteUrl: string): string {
+  const today = new Date().toISOString().split('T')[0];
+  const blogSlugs = getBlogSlugs();
+  const changelogSlugs = getChangelogSlugs();
+  const docsSlugs = getDocsSlugs();
+  const allRoutes = [
+    ...PUBLIC_ROUTES,
+    ...blogSlugs.map((s) => `/blog/${s}`),
+    ...changelogSlugs.map((s) => `/changelog/${s}`),
+    ...docsSlugs.map((s) => `/docs/${s}`),
+  ];
+
+  const urls = allRoutes
+    .map(
+      (route) => `  <url>
+    <loc>${siteUrl}${route === '/' ? '' : route}</loc>
+    <lastmod>${today}</lastmod>
+  </url>`,
+    )
+    .join('\n');
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+${urls}
+</urlset>
+`;
+}
+
+const siteUrl = loadSiteUrl();
+const sitemap = generateSitemap(siteUrl);
+
+const outDir = resolve(__dirname, '../dist/client');
+mkdirSync(outDir, { recursive: true });
+writeFileSync(resolve(outDir, 'sitemap.xml'), sitemap);
+
+const blogCount = getBlogSlugs().length;
+const changelogCount = getChangelogSlugs().length;
+const docsCount = getDocsSlugs().length;
+const totalUrls = PUBLIC_ROUTES.length + blogCount + changelogCount + docsCount;
+console.log(`Sitemap generated with ${totalUrls} URLs (${blogCount} blog, ${changelogCount} changelog, ${docsCount} docs) → dist/client/sitemap.xml`);

package/carbon/scripts/k8s-apply.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+/**
+ * Apply Kubernetes manifests using Kustomize
+ *
+ * Usage:
+ *   node scripts/k8s-apply.js                    # Apply local overlay
+ *   node scripts/k8s-apply.js production-nbg1    # Apply specific overlay
+ *   node scripts/k8s-apply.js --dry-run          # Show what would be applied
+ */
+
+import { execSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { loadManifest, getEnabledFeatures, parseArgs } from './lib/manifest.js';
+
+const args = parseArgs(process.argv.slice(2));
+
+if (args.help) {
+  console.log(`
+Usage: node scripts/k8s-apply.js [overlay] [options]
+
+Arguments:
+  overlay     Kustomize overlay to apply (default: local)
+              Available: local, production-nbg1, production-hel1
+
+Options:
+  --dry-run   Show what would be applied without executing
+  --verbose   Verbose output
+  -h, --help  Show this help message
+
+Examples:
+  node scripts/k8s-apply.js              # Apply local overlay
+  node scripts/k8s-apply.js production-nbg1  # Apply production overlay
+  pnpm k8s:apply                         # Via package.json script
+`);
+  process.exit(0);
+}
+
+const manifest = loadManifest();
+const overlay = args.positional[0] || 'local';
+const overlayPath = join(process.cwd(), 'k8s', 'overlays', overlay);
+
+if (!existsSync(overlayPath)) {
+  console.error(`Error: Overlay '${overlay}' not found at ${overlayPath}`);
+  console.error('Available overlays: local, production-nbg1, production-hel1');
+  process.exit(1);
+}
+
+const features = getEnabledFeatures(manifest);
+if (args.verbose && features.length > 0) {
+  console.log('Enabled features:', features.join(', '));
+}
+
+// Build the kubectl apply command
+const dryRunFlag = args.dryRun ? ' --dry-run=client' : '';
+const cmd = `kubectl apply -k ${overlayPath}${dryRunFlag}`;
+
+if (args.dryRun) {
+  console.log('Would run:', cmd);
+  console.log('\nDry run output:');
+}
+
+if (args.verbose) {
+  console.log('Running:', cmd);
+}
+
+try {
+  execSync(cmd, { stdio: 'inherit' });
+} catch (error) {
+  process.exit(error.status || 1);
+}