vibecarbon 0.1.0

package/carbon/volumes/n8n/hooks.js

@@ -0,0 +1,131 @@
+/**
+ * n8n ForwardAuth SSO Hook
+ *
+ * Reads X-User-Email set by Traefik ForwardAuth, looks up or auto-creates
+ * the n8n user, and issues a session cookie — bypassing n8n's login page.
+ *
+ * When ForwardAuth headers are absent (dev mode without Traefik, or direct
+ * container access), falls through to n8n's normal login flow.
+ *
+ * Loaded via EXTERNAL_HOOK_FILES environment variable.
+ */
+
+const SKIP_PATHS = ['/healthz', '/webhook', '/assets', '/rest/oauth2-credential'];
+
+function shouldSkip(url) {
+  return SKIP_PATHS.some((p) => url.startsWith(p));
+}
+
+module.exports = {
+  n8n: {
+    ready: [
+      async function (server) {
+        const userRepo = this.dbCollections?.User;
+        if (!userRepo) {
+          console.warn('[hooks.js] User repository not available — SSO hook disabled');
+          return;
+        }
+
+        // Get AuthService from DI container for issueCookie
+        let authService;
+        try {
+          const { Container } = require('@n8n/di');
+          const { AuthService } = require('/usr/local/lib/node_modules/n8n/dist/auth/auth.service');
+          authService = Container.get(AuthService);
+        } catch (err) {
+          console.warn('[hooks.js] Could not resolve AuthService:', err.message);
+        }
+
+        const app = server.app;
+        if (!app) {
+          console.warn('[hooks.js] server.app not available');
+          return;
+        }
+
+        // Express 5 uses app.router.stack, Express 4 uses app._router.stack
+        const layers = app.router?.stack ?? app._router?.stack;
+        if (!layers) {
+          console.warn('[hooks.js] Could not access Express router stack — SSO hook disabled');
+          return;
+        }
+
+        let cookieParserIdx = -1;
+        for (let i = 0; i < layers.length; i++) {
+          if (layers[i].name === 'cookieParser') {
+            cookieParserIdx = i;
+            break;
+          }
+        }
+
+        const middleware = async (req, res, next) => {
+          try {
+            if (shouldSkip(req.url)) return next();
+
+            // Skip if session already exists
+            if (req.cookies?.['n8n-auth']) return next();
+
+            const email = req.headers['x-user-email'];
+            if (!email) return next(); // No ForwardAuth headers — normal login
+
+            let user = await userRepo.findOne({
+              where: { email },
+              relations: ['role'],
+            });
+
+            if (!user) {
+              // Auto-create user with owner role and random password
+              const crypto = require('node:crypto');
+              const { hashSync } = require('bcryptjs');
+              const randomPassword = crypto.randomBytes(32).toString('hex');
+
+              user = userRepo.create({
+                email,
+                firstName: email.split('@')[0],
+                lastName: '',
+                password: hashSync(randomPassword, 10),
+                roleSlug: 'global:owner',
+              });
+              user = await userRepo.save(user);
+              // Reload with role relation
+              user = await userRepo.findOne({
+                where: { email },
+                relations: ['role'],
+              });
+            }
+
+            if (!user) return next();
+
+            // Issue session cookie via AuthService
+            if (authService) {
+              try {
+                authService.issueCookie(res, user, false, undefined);
+              } catch (cookieErr) {
+                console.error('[hooks.js] SSO: issueCookie failed:', cookieErr.message);
+              }
+            }
+
+            return next();
+          } catch (err) {
+            console.error('[hooks.js] ForwardAuth SSO error:', err.message);
+            return next();
+          }
+        };
+
+        // Inject middleware after cookie-parser so req.cookies is available.
+        // Must create a proper Layer instance (Express 5 router calls layer.match()).
+        if (cookieParserIdx >= 0) {
+          try {
+            const Layer = require('router/lib/layer');
+            const layer = new Layer('/', { end: false }, middleware);
+            layers.splice(cookieParserIdx + 1, 0, layer);
+            console.log('[hooks.js] ForwardAuth SSO middleware installed');
+          } catch (err) {
+            console.warn('[hooks.js] Could not create router Layer:', err.message);
+          }
+        } else {
+          console.warn('[hooks.js] cookie-parser not found — SSO hook disabled');
+        }
+      },
+    ],
+  },
+};

package/carbon/volumes/n8n/scripts/setup.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+# n8n DB-Only Setup Script
+# Updates the skeleton owner user that n8n creates during migration,
+# setting email/name so n8n's setup wizard is skipped.
+# In dev, uses a default password (changeme). In production, ForwardAuth + hooks.js
+# handles SSO so the password is just a placeholder.
+# Added via: vibecarbon add n8n
+
+set -e
+
+DB_HOST="${N8N_DB_HOST:-db}"
+DB_NAME="${N8N_DB_NAME:-n8n}"
+DB_USER="${N8N_DB_USER:-n8n}"
+DB_PASSWORD="${N8N_DB_PASSWORD}"
+ADMIN_EMAIL="${N8N_ADMIN_EMAIL:-admin@localhost}"
+
+# Pre-computed bcrypt hash of "changeme" — used as default dev password.
+# In production, ForwardAuth SSO bypasses the login page entirely.
+DEFAULT_PW_HASH='$2a$10$K7L1OJ45/4Y2nIvhRVpCe.FSmhDdWoXehVzJtl/Q0T1FWYvv1nWi2'
+
+log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >&2; }
+
+if [ -z "$DB_PASSWORD" ]; then
+  log "ERROR: N8N_DB_PASSWORD is required"
+  exit 1
+fi
+
+# Wait for n8n's user table to exist (created by n8n's own migrations)
+log "Waiting for n8n user table..."
+for i in $(seq 1 60); do
+  if PGPASSWORD="$DB_PASSWORD" psql -h "$DB_HOST" -U "$DB_USER" -d "$DB_NAME" -tAc \
+    "SELECT 1 FROM information_schema.tables WHERE table_name='user'" 2>/dev/null | grep -q 1; then
+    break
+  fi
+  [ "$i" -eq 60 ] && { log "ERROR: user table not found after 5 minutes"; exit 1; }
+  sleep 5
+done
+
+# n8n v2.x creates a skeleton owner row (no email) during migration.
+# Update it with the admin email so the setup wizard is skipped.
+PGPASSWORD="$DB_PASSWORD" psql -h "$DB_HOST" -U "$DB_USER" -d "$DB_NAME" -q <<SQL
+-- Update the skeleton owner (n8n v2.x creates one with no email during migration).
+-- Set email, name, bcrypt password, and lastActiveAt.
+-- n8n's hasInstanceOwner() requires password IS NOT NULL or lastActiveAt IS NOT NULL.
+UPDATE "user"
+SET email = '${ADMIN_EMAIL}',
+    "firstName" = 'Admin',
+    "lastName" = 'User',
+    password = '${DEFAULT_PW_HASH}',
+    "lastActiveAt" = CURRENT_DATE
+WHERE "roleSlug" = 'global:owner' AND (email IS NULL OR email = '')
+  AND NOT EXISTS (SELECT 1 FROM "user" WHERE email = '${ADMIN_EMAIL}');
+
+-- If no skeleton owner existed (or email was already set), ensure one exists.
+INSERT INTO "user" (email, "firstName", "lastName", password, "roleSlug", "lastActiveAt")
+SELECT '${ADMIN_EMAIL}', 'Admin', 'User', '${DEFAULT_PW_HASH}', 'global:owner', CURRENT_DATE
+WHERE NOT EXISTS (SELECT 1 FROM "user" WHERE email = '${ADMIN_EMAIL}')
+ON CONFLICT (email) DO NOTHING;
+
+-- Mark instance owner as set up so n8n skips the setup wizard.
+-- n8n checks both this setting and hasInstanceOwner() on every request.
+UPDATE settings SET value = 'true'
+WHERE key = 'userManagement.isInstanceOwnerSetUp' AND value != 'true';
+SQL
+
+log "n8n owner setup complete (email: ${ADMIN_EMAIL})"

package/carbon/volumes/prometheus/prometheus.yml

@@ -0,0 +1,43 @@
+# Prometheus Configuration for Vibecarbon
+# Scrapes metrics from all stack components
+
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  # Prometheus self-monitoring
+  - job_name: 'prometheus'
+    static_configs:
+      - targets: ['localhost:9090']
+
+  # PostgreSQL database metrics via postgres-exporter
+  - job_name: 'postgres'
+    static_configs:
+      - targets: ['postgres-exporter:9187']
+
+  # Kong API Gateway metrics
+  # Note: Requires Kong prometheus plugin to be enabled
+  - job_name: 'kong'
+    static_configs:
+      - targets: ['kong:8001']
+    metrics_path: '/metrics'
+    scrape_interval: 30s
+
+  # n8n workflow automation (if enabled)
+  # n8n exposes metrics at /metrics when N8N_METRICS=true
+  - job_name: 'n8n'
+    static_configs:
+      - targets: ['n8n:5678']
+    metrics_path: '/metrics'
+    scrape_interval: 30s
+    # Fail silently if n8n is not running
+    honor_labels: true
+
+  # Application metrics (optional)
+  # Uncomment if your app exposes Prometheus metrics
+  # - job_name: 'app'
+  #   static_configs:
+  #     - targets: ['app:3000']
+  #   metrics_path: '/api/metrics'
+  #   scrape_interval: 30s

package/carbon/volumes/promtail/promtail-config.yml

@@ -0,0 +1,64 @@
+# Promtail Configuration for Vibecarbon
+# Collects logs from all Docker containers
+
+server:
+  http_listen_port: 9080
+  grpc_listen_port: 0
+
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+  - url: http://loki:3100/loki/api/v1/push
+
+scrape_configs:
+  # Discover and scrape all Docker containers
+  - job_name: docker
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+        refresh_interval: 5s
+    relabel_configs:
+      # Extract container name (remove leading /)
+      - source_labels: ['__meta_docker_container_name']
+        regex: '/(.*)'
+        target_label: 'container'
+
+      # Extract compose service name
+      - source_labels: ['__meta_docker_container_label_com_docker_compose_service']
+        target_label: 'service'
+
+      # Extract compose project name
+      - source_labels: ['__meta_docker_container_label_com_docker_compose_project']
+        target_label: 'project'
+
+      # Extract container ID (short form)
+      - source_labels: ['__meta_docker_container_id']
+        regex: '(.{12}).*'
+        target_label: 'container_id'
+
+      # Add environment label if present
+      - source_labels: ['__meta_docker_container_label_environment']
+        target_label: 'environment'
+
+    pipeline_stages:
+      # Parse JSON logs if present
+      - json:
+          expressions:
+            level: level
+            msg: msg
+            message: message
+            timestamp: timestamp
+            time: time
+
+      # Extract log level for filtering
+      - labels:
+          level:
+
+      # Handle plain text logs
+      - match:
+          selector: '{service=~".+"}'
+          stages:
+            - regex:
+                expression: '(?P<level>INFO|WARN|ERROR|DEBUG|FATAL)'
+            - labels:
+                level:

package/carbon/volumes/traefik/middlewares.dev.yml

@@ -0,0 +1,83 @@
+# Traefik Dynamic Configuration (Development)
+# Middlewares for admin routes with ForwardAuth authentication
+# Uses host.docker.internal to reach the app running on the host via pnpm dev
+
+http:
+  middlewares:
+    # Strip X-User-* headers from client requests before ForwardAuth sets real values.
+    # Prevents spoofing if a request bypasses Traefik or hits the service directly.
+    strip-proxy-headers:
+      headers:
+        customRequestHeaders:
+          X-User-Id: ""
+          X-User-Email: ""
+          X-User-Role: ""
+
+    # ForwardAuth - verifies user is authenticated with admin role
+    admin-forward-auth:
+      forwardAuth:
+        address: "http://host.docker.internal:3000/api/_internal/verify-role?role=admin"
+        authRequestHeaders:
+          - "Cookie"
+          - "Authorization"
+          - "Accept"
+        authResponseHeaders:
+          - "X-User-Id"
+          - "X-User-Email"
+          - "X-User-Role"
+        trustForwardHeader: true
+
+    # Chain: strip spoofed headers → verify admin role
+    admin-auth:
+      chain:
+        middlewares:
+          - strip-proxy-headers
+          - admin-forward-auth
+
+    # ForwardAuth - verifies user is authenticated with super_admin role
+    # Used for sensitive admin tools: n8n, Metabase
+    super-admin-forward-auth:
+      forwardAuth:
+        address: "http://host.docker.internal:3000/api/_internal/verify-role?role=super_admin"
+        authRequestHeaders:
+          - "Cookie"
+          - "Authorization"
+          - "Accept"
+        authResponseHeaders:
+          - "X-User-Id"
+          - "X-User-Email"
+          - "X-User-Role"
+        trustForwardHeader: true
+
+    # Chain: strip spoofed headers → verify super_admin role
+    super-admin-auth:
+      chain:
+        middlewares:
+          - strip-proxy-headers
+          - super-admin-forward-auth
+
+    # Strip prefix middlewares for path-based admin routing
+    strip-admin-studio:
+      stripPrefix:
+        prefixes:
+          - "/admin/studio"
+
+    strip-admin-traefik:
+      stripPrefix:
+        prefixes:
+          - "/admin/traefik"
+
+    strip-admin-grafana:
+      stripPrefix:
+        prefixes:
+          - "/admin/grafana"
+
+    strip-admin-n8n:
+      stripPrefix:
+        prefixes:
+          - "/admin/n8n"
+
+    strip-admin-metabase:
+      stripPrefix:
+        prefixes:
+          - "/admin/metabase"

package/carbon/volumes/traefik/middlewares.yml

@@ -0,0 +1,95 @@
+# Traefik Dynamic Configuration
+# Middlewares for admin routes with ForwardAuth authentication
+
+http:
+  middlewares:
+    # Strip X-User-* headers from client requests before ForwardAuth sets real values.
+    # Prevents spoofing if a request bypasses Traefik or hits the service directly.
+    strip-proxy-headers:
+      headers:
+        customRequestHeaders:
+          X-User-Id: ""
+          X-User-Email: ""
+          X-User-Role: ""
+
+    # ForwardAuth - verifies user is authenticated with admin role
+    admin-forward-auth:
+      forwardAuth:
+        address: "http://app:3000/api/_internal/verify-role?role=admin"
+        authRequestHeaders:
+          - "Cookie"
+          - "Authorization"
+          - "Accept"
+        authResponseHeaders:
+          - "X-User-Id"
+          - "X-User-Email"
+          - "X-User-Role"
+        trustForwardHeader: true
+
+    # Chain: strip spoofed headers → verify admin role
+    admin-auth:
+      chain:
+        middlewares:
+          - strip-proxy-headers
+          - admin-forward-auth
+
+    # ForwardAuth - verifies user is authenticated with super_admin role
+    # Used for sensitive admin tools: n8n, Metabase
+    super-admin-forward-auth:
+      forwardAuth:
+        address: "http://app:3000/api/_internal/verify-role?role=super_admin"
+        authRequestHeaders:
+          - "Cookie"
+          - "Authorization"
+          - "Accept"
+        authResponseHeaders:
+          - "X-User-Id"
+          - "X-User-Email"
+          - "X-User-Role"
+        trustForwardHeader: true
+
+    # Chain: strip spoofed headers → verify super_admin role
+    super-admin-auth:
+      chain:
+        middlewares:
+          - strip-proxy-headers
+          - super-admin-forward-auth
+
+    # Strip prefix middlewares for path-based admin routing
+    strip-admin-studio:
+      stripPrefix:
+        prefixes:
+          - "/admin/studio"
+
+    strip-admin-traefik:
+      stripPrefix:
+        prefixes:
+          - "/admin/traefik"
+
+    strip-admin-grafana:
+      stripPrefix:
+        prefixes:
+          - "/admin/grafana"
+
+    strip-admin-n8n:
+      stripPrefix:
+        prefixes:
+          - "/admin/n8n"
+
+    strip-admin-metabase:
+      stripPrefix:
+        prefixes:
+          - "/admin/metabase"
+
+    # Security headers — applied to admin services (Grafana, n8n, etc.)
+    security-headers:
+      headers:
+        browserXssFilter: true
+        contentTypeNosniff: true
+        frameDeny: true
+        stsIncludeSubdomains: true
+        stsPreload: true
+        stsSeconds: 31536000
+        customFrameOptionsValue: "SAMEORIGIN"
+        customResponseHeaders:
+          X-Robots-Tag: "noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"

package/carbon/volumes/traefik/vite-dev.yml

@@ -0,0 +1,20 @@
+# Traefik Dynamic Configuration for Vite Dev Server
+# Routes app.localhost to the Vite dev server running on the host
+#
+# This enables ForwardAuth to work in development by ensuring all services
+# (app, n8n, metabase, etc.) are accessed via *.localhost subdomains,
+# allowing auth cookies to be shared across all services.
+
+http:
+  routers:
+    vite-dev:
+      rule: "Host(`app.localhost`)"
+      entrypoints:
+        - web
+      service: vite-dev
+
+  services:
+    vite-dev:
+      loadBalancer:
+        servers:
+          - url: "http://host.docker.internal:5173"

package/package.json

@@ -0,0 +1,95 @@
+{
+  "name": "vibecarbon",
+  "version": "0.1.0",
+  "description": "Create and manage production-ready Vibecarbon applications",
+  "type": "module",
+  "bin": "./src/cli.js",
+  "files": [
+    "src",
+    "carbon"
+  ],
+  "scripts": {
+    "lint": "node scripts/check-shell-safety.js && node scripts/check-stale-deploy-references.js && biome check src/ tests/",
+    "lint:shell": "node scripts/check-shell-safety.js",
+    "lint:stale-deploy": "node scripts/check-stale-deploy-references.js",
+    "lint:fix": "biome check --write src/ tests/",
+    "format": "biome format --write src/ tests/",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:unit": "vitest run --project unit",
+    "test:integration": "vitest run --project integration",
+    "test:cli": "vitest run --project integration tests/integration/cli",
+    "test:docker": "DOCKER_INTEGRATION=true vitest run --project integration tests/integration/docker",
+    "test:template": "vitest run --project integration tests/integration/template",
+    "test:modules": "vitest run --project integration tests/integration/modules",
+    "test:coverage": "vitest run --coverage",
+    "test:loadtest": "tsx tests/loadtest/cli.ts",
+    "test:ci": "vitest run --reporter=junit --outputFile=test-results.xml",
+    "test:e2e": "REAL_INFRA=true tsx tests/e2e/runner.ts",
+    "test:e2e:batch": "REAL_INFRA=true tsx tests/e2e/runner.ts --batch",
+    "test:e2e:expanded": "REAL_INFRA=true tsx tests/e2e/runner.ts --batch --expanded",
+    "test:e2e:single": "REAL_INFRA=true vitest run --project e2e tests/e2e/single",
+    "test:e2e:ci": "REAL_INFRA=true vitest run --project e2e",
+    "test:e2e:report": "tsx tests/e2e/metrics/reporter.ts",
+    "bump:patch": "node scripts/bump.js patch",
+    "bump:minor": "node scripts/bump.js minor",
+    "bump:major": "node scripts/bump.js major",
+    "prepare": "git config core.hooksPath git-hooks",
+    "test:prepush": "pnpm lint && pnpm test:unit && pnpm test:integration",
+    "prepublishOnly": "pnpm test:unit && pnpm lint"
+  },
+  "keywords": [
+    "vibecarbon",
+    "react",
+    "hono",
+    "vite",
+    "supabase",
+    "saas",
+    "starter",
+    "boilerplate"
+  ],
+  "author": "",
+  "license": "AGPL-3.0-only",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/hyperformant/vibecarbon.git"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.1017.0",
+    "@clack/prompts": "^1.1.0",
+    "@pulumi/hcloud": "^1.32.2",
+    "@pulumi/pulumi": "^3.231.0",
+    "bcryptjs": "^3.0.3",
+    "undici": "^8.1.0",
+    "which": "^6.0.1"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3"
+    ],
+    "overrides": {
+      "postcss@<8.5.10": ">=8.5.10",
+      "uuid@<14.0.0": ">=14.0.0",
+      "fast-xml-parser@<5.7.0": ">=5.7.0",
+      "fast-xml-builder@<1.1.7": ">=1.1.7",
+      "ip-address@<10.1.1": ">=10.1.1",
+      "protobufjs@<7.5.6": "^7.5.6",
+      "@protobufjs/utf8@<1.1.1": "^1.1.1"
+    }
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.9",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@types/better-sqlite3": "^7.6.13",
+    "@vitest/coverage-v8": "^4.1.1",
+    "autocannon": "^8.0.0",
+    "better-sqlite3": "^12.8.0",
+    "msw": "^2.12.14",
+    "semantic-release": "^23.0.8",
+    "tsx": "^4.21.0",
+    "vite": "^7.3.2",
+    "vitest": "^4.1.1",
+    "zod": "^4.3.6"
+  }
+}