vibecarbon 0.1.6 → 0.2.0

package/package.json

@@ -1,14 +1,16 @@
 {
   "name": "vibecarbon",
-  "version": "0.1.6",
+  "version": "0.2.0",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",
   "files": [
     "src",
-    "carbon"
+    "carbon",
+    "services"
   ],
   "scripts": {
+    "dev": "node scripts/dev.js",
     "lint": "node scripts/check-shell-safety.js && node scripts/check-stale-deploy-references.js && biome check src/ tests/",
     "lint:shell": "node scripts/check-shell-safety.js",
     "lint:stale-deploy": "node scripts/check-stale-deploy-references.js",

package/services/index.json

@@ -0,0 +1,29 @@
+[
+  {
+    "name": "observability",
+    "description": "Prometheus, Grafana, Loki monitoring stack",
+    "version": "1.0.0",
+    "url": "http://grafana.localhost"
+  },
+  {
+    "name": "n8n",
+    "description": "Workflow automation platform",
+    "version": "1.0.0",
+    "port": 5678,
+    "url": "http://localhost:5678"
+  },
+  {
+    "name": "redis",
+    "description": "In-memory data store for caching and sessions",
+    "version": "1.0.0",
+    "port": 6379,
+    "url": "redis://localhost:6379"
+  },
+  {
+    "name": "metabase",
+    "description": "Business intelligence and analytics dashboard",
+    "version": "1.0.0",
+    "port": 3001,
+    "url": "http://metabase.localhost"
+  }
+]

package/services/metabase/compose/docker-compose.override.yml

@@ -0,0 +1,14 @@
+# Development overrides for Metabase
+# Use with: docker compose -f docker-compose.yml -f docker-compose.metabase.yml -f docker-compose.metabase.override.yml up -d
+
+services:
+  metabase:
+    labels:
+      # Dev: No auth required (same as studio/traefik in local dev)
+      # Production uses ForwardAuth via docker-compose.metabase.yml labels
+      # Empty middlewares override removes ForwardAuth requirement
+      - "traefik.enable=true"
+      - "traefik.http.routers.metabase.rule=Host(`metabase.localhost`)"
+      - "traefik.http.routers.metabase.entrypoints=web"
+      - "traefik.http.routers.metabase.middlewares="
+      - "traefik.http.services.metabase.loadbalancer.server.port=3000"

package/services/metabase/compose/docker-compose.prod.yml

@@ -0,0 +1,29 @@
+# Metabase Production Overrides
+# Use with: docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.metabase.yml -f docker-compose.metabase.prod.yml up -d
+#
+# Adds:
+# - SSL subdomain routing for Metabase (metabase.yourdomain.com)
+# - ForwardAuth (super_admin role required)
+# - HTTP to HTTPS redirect
+
+services:
+  metabase:
+    environment:
+      # Override site URL for production subdomain
+      - MB_SITE_URL=https://metabase.${DOMAIN}
+      - MB_EMBEDDING_APP_ORIGIN=https://${DOMAIN}
+    ports: []  # Reached via Traefik over the compose network; no host port in prod
+    labels:
+      # Production Traefik routing with SSL
+      - "traefik.enable=true"
+      # HTTPS router with super_admin auth + security headers
+      - "traefik.http.routers.metabase.rule=Host(`metabase.${DOMAIN}`)"
+      - "traefik.http.routers.metabase.entrypoints=websecure"
+      - "traefik.http.routers.metabase.tls=true"
+      - "traefik.http.routers.metabase.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.metabase.middlewares=super-admin-auth@file,security-headers@file"
+      - "traefik.http.services.metabase.loadbalancer.server.port=3000"
+      # HTTP to HTTPS redirect
+      - "traefik.http.routers.metabase-http.rule=Host(`metabase.${DOMAIN}`)"
+      - "traefik.http.routers.metabase-http.entrypoints=web"
+      - "traefik.http.routers.metabase-http.middlewares=redirect-to-https"

package/services/metabase/compose/docker-compose.yml

@@ -0,0 +1,68 @@
+# Metabase - Business intelligence dashboard
+# Added via: vibecarbon add metabase
+
+services:
+  metabase:
+    image: metabase/metabase:latest
+    container_name: {{PROJECT_NAME}}-metabase
+    restart: unless-stopped
+    ports:
+      - "3001:3000"
+    environment:
+      # Metabase application database (stores dashboards, questions, etc.)
+      MB_DB_TYPE: postgres
+      MB_DB_DBNAME: metabase
+      MB_DB_PORT: 5432
+      MB_DB_USER: metabase
+      MB_DB_PASS: ${POSTGRES_PASSWORD}
+      MB_DB_HOST: db
+      # Performance settings
+      JAVA_OPTS: "-Xmx1g"
+    volumes:
+      - metabase_plugins:/plugins
+    networks:
+      - vibecarbon-network
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
+      interval: 15s
+      timeout: 5s
+      retries: 8
+      start_period: 120s
+    labels:
+      # Traefik routing with ForwardAuth protection
+      - "traefik.enable=true"
+      - "traefik.http.routers.metabase.rule=Host(`metabase.localhost`)"
+      - "traefik.http.routers.metabase.entrypoints=web"
+      # Note: No ForwardAuth - Metabase has its own authentication
+      - "traefik.http.services.metabase.loadbalancer.server.port=3000"
+
+  metabase-setup:
+    image: alpine:latest
+    container_name: {{PROJECT_NAME}}-metabase-setup
+    volumes:
+      - ./volumes/metabase/scripts:/scripts:ro
+    environment:
+      METABASE_URL: http://metabase:3000
+      METABASE_ADMIN_EMAIL: ${METABASE_ADMIN_EMAIL:-admin@localhost}
+      METABASE_ADMIN_PASSWORD: ${METABASE_ADMIN_PASSWORD}
+      METABASE_ADMIN_FIRST_NAME: ${METABASE_ADMIN_FIRST_NAME:-Admin}
+      METABASE_ADMIN_LAST_NAME: ${METABASE_ADMIN_LAST_NAME:-User}
+      APP_DB_HOST: db
+      APP_DB_PORT: 5432
+      APP_DB_NAME: postgres
+      APP_DB_USER: postgres
+      DB_PASSWORD: ${DB_PASSWORD}
+    entrypoint: ["/bin/sh", "-c", "apk add --no-cache curl jq && sh /scripts/setup.sh"]
+    depends_on:
+      metabase:
+        condition: service_healthy
+    networks:
+      - vibecarbon-network
+    restart: "no"
+
+volumes:
+  metabase_plugins:
+    driver: local

package/services/metabase/db/init.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -e
+
+# Metabase Database Initialization
+# Creates the metabase database and user for analytics
+# Password is injected from POSTGRES_PASSWORD env var at runtime (never hardcoded)
+
+# Create metabase role if it doesn't exist (quoted heredoc — no variable expansion)
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<'EOSQL'
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metabase') THEN
+        CREATE ROLE metabase WITH LOGIN;
+    END IF;
+END
+$$;
+EOSQL
+
+# Set password and create database (unquoted heredoc — POSTGRES_PASSWORD is expanded)
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<EOSQL
+ALTER ROLE metabase WITH PASSWORD '${POSTGRES_PASSWORD}';
+SELECT 'CREATE DATABASE metabase WITH OWNER metabase ENCODING ''UTF8'' TEMPLATE template0'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'metabase')\gexec
+GRANT ALL PRIVILEGES ON DATABASE metabase TO metabase;
+GRANT CONNECT ON DATABASE postgres TO metabase;
+GRANT USAGE ON SCHEMA public TO metabase;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO metabase;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO metabase;
+EOSQL

package/services/metabase/docs/integration.md

@@ -0,0 +1,191 @@
+# Metabase Integration Guide
+
+Metabase is an open-source business intelligence tool that lets you create dashboards and visualizations from your data without writing SQL.
+
+## Getting Started
+
+Metabase is **automatically configured** when you start your development environment:
+
+1. **Start services**: `npx vibecarbon up`
+2. **Access Metabase**: http://metabase.localhost
+3. **Sign in** with your admin email and password
+
+The setup container automatically:
+- Creates the admin user
+- Connects to your application database (named "Application Data")
+- Configures recommended settings
+
+> **Security Note**: In production, Metabase is protected by Traefik ForwardAuth requiring the `super_admin` role. Users must be signed in to the main application with super admin privileges to access it.
+
+## Architecture
+
+Metabase uses **two database connections**:
+
+1. **Application Database** (`metabase` db): Stores Metabase's own data - dashboards, saved questions, user accounts, etc.
+2. **Your Data** (`postgres` db): The database you want to analyze - automatically configured as "Application Data"
+
+## Creating Dashboards
+
+### Basic Workflow
+
+1. **Ask a Question**: Click "New" > "Question"
+2. **Choose Data**: Select "Application Data" and your table
+3. **Build Query**: Use the visual query builder or write SQL
+4. **Save & Visualize**: Save to a collection and add to dashboards
+
+### Example Queries
+
+**User signups over time:**
+```sql
+SELECT
+  DATE_TRUNC('day', created_at) as signup_date,
+  COUNT(*) as signups
+FROM auth.users
+GROUP BY 1
+ORDER BY 1
+```
+
+**Active users last 30 days:**
+```sql
+SELECT COUNT(DISTINCT id)
+FROM auth.users
+WHERE last_sign_in_at > NOW() - INTERVAL '30 days'
+```
+
+## Embedding Dashboards
+
+Metabase supports embedding dashboards in your application:
+
+### Public Links (Simple)
+
+1. Enable sharing on dashboard
+2. Copy public link
+3. Embed via iframe
+
+### Signed Embedding (Secure)
+
+```typescript
+import jwt from 'jsonwebtoken';
+
+// Use environment variable for flexibility between local/production
+const METABASE_SITE_URL = process.env.METABASE_URL || "http://localhost:3001";
+// In production: "https://your-domain.com/admin/metabase"
+
+const METABASE_SECRET_KEY = "your-embedding-secret"; // From Admin > Embedding
+
+function getEmbedUrl(dashboardId: number, params: Record<string, any> = {}) {
+  const payload = {
+    resource: { dashboard: dashboardId },
+    params,
+    exp: Math.round(Date.now() / 1000) + (10 * 60) // 10 minute expiration
+  };
+
+  const token = jwt.sign(payload, METABASE_SECRET_KEY);
+  return `${METABASE_SITE_URL}/embed/dashboard/${token}`;
+}
+```
+
+## Environment Variables
+
+These are automatically configured:
+
+```env
+# Metabase admin credentials
+METABASE_ADMIN_EMAIL=admin@localhost
+METABASE_ADMIN_PASSWORD=<generated>
+```
+
+## Manual Database Connection
+
+If you need to add additional database connections manually:
+
+| Setting | Value |
+|---------|-------|
+| Database type | PostgreSQL |
+| Display name | Your choice |
+| Host | `db` |
+| Port | `5432` |
+| Database name | Your database |
+| Username | Your user |
+| Password | Your password |
+
+## Docker Commands
+
+```bash
+# View Metabase logs
+pnpm docker:logs metabase
+
+# View setup logs
+docker logs {{PROJECT_NAME}}-metabase-setup
+
+# Restart Metabase
+docker restart {{PROJECT_NAME}}-metabase
+
+# Re-run setup (if needed)
+docker restart {{PROJECT_NAME}}-metabase-setup
+
+# Access Metabase shell
+docker exec -it {{PROJECT_NAME}}-metabase /bin/sh
+```
+
+## Backup & Restore
+
+### Backup Metabase Data
+
+```bash
+# Backup metabase database
+docker exec {{PROJECT_NAME}}-db pg_dump -U postgres metabase > metabase-backup.sql
+```
+
+### Restore Metabase Data
+
+```bash
+# Restore metabase database
+docker exec -i {{PROJECT_NAME}}-db psql -U postgres metabase < metabase-backup.sql
+```
+
+## Performance Tips
+
+1. **Add database indexes** for columns you frequently filter/group by
+2. **Use caching**: Admin > Performance > enable query caching
+3. **Schedule refreshes**: Set dashboards to refresh on a schedule rather than live
+4. **Limit results**: Use LIMIT in custom SQL to prevent large result sets
+
+## Troubleshooting
+
+### Setup didn't run
+
+Check the setup container logs:
+```bash
+docker logs {{PROJECT_NAME}}-metabase-setup
+```
+
+Re-run setup:
+```bash
+docker restart {{PROJECT_NAME}}-metabase-setup
+```
+
+### Metabase won't start
+
+Check if the metabase database was created:
+```bash
+docker exec {{PROJECT_NAME}}-db psql -U postgres -c "\l" | grep metabase
+```
+
+If missing, run the init script:
+```bash
+docker exec {{PROJECT_NAME}}-db bash /docker-entrypoint-initdb.d/zz-metabase-init.sh
+```
+
+### Connection refused to db
+
+Ensure the database is healthy:
+```bash
+docker exec {{PROJECT_NAME}}-db pg_isready
+```
+
+### Slow queries
+
+1. Check query in Metabase > Admin > Troubleshooting > Logs
+2. Add indexes to your database tables
+3. Enable query caching in Admin > Performance

package/services/metabase/k8s/deployment.yaml

@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: metabase
+  labels:
+    app: metabase
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: metabase
+  template:
+    metadata:
+      labels:
+        app: metabase
+    spec:
+      containers:
+      - name: metabase
+        image: metabase/metabase:latest
+        ports:
+        - containerPort: 3000
+        env:
+        - name: MB_DB_TYPE
+          value: postgres
+        - name: MB_DB_DBNAME
+          value: metabase
+        - name: MB_DB_PORT
+          value: '5432'
+        - name: MB_DB_USER
+          value: metabase
+        - name: MB_DB_PASS
+          valueFrom:
+            secretKeyRef:
+              name: vibecarbon-secrets
+              key: DB_PASSWORD
+        - name: MB_DB_HOST
+          value: postgres
+        - name: MB_PASSWORD_COMPLEXITY
+          value: strong
+        - name: MB_SESSION_COOKIES
+          value: 'true'
+        - name: MB_COOKIE_SAMESITE
+          value: lax
+        - name: MB_SITE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: vibecarbon-config
+              key: SITE_URL
+        - name: JAVA_OPTS
+          value: -Xmx1536m
+        volumeMounts:
+        - name: metabase-plugins
+          mountPath: /plugins
+        - name: tmp-vol-0
+          mountPath: /tmp
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 500m
+          limits:
+            memory: 2Gi
+            cpu: 1000m
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: 3000
+          initialDelaySeconds: 120
+          periodSeconds: 30
+          timeoutSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /api/health
+            port: 3000
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 5
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+      volumes:
+      - name: metabase-plugins
+        persistentVolumeClaim:
+          claimName: metabase-plugins-pvc
+      - name: tmp-vol-0
+        emptyDir: {}
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault

package/services/metabase/k8s/ingressroute.yaml

@@ -0,0 +1,22 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vibecarbon-metabase
+  namespace: vibecarbon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # Metabase uses relative asset paths so strip-prefix works correctly.
+    - match: PathPrefix(`/admin/metabase`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: metabase
+          port: 3000
+      middlewares:
+        - name: admin-auth
+        - name: security-headers
+        - name: strip-admin-metabase-prefix
+  tls:
+    secretName: vibecarbon-tls

package/services/metabase/k8s/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml
+  - pvc.yaml
+  - network-policy.yaml
+  - ingressroute.yaml

package/services/metabase/k8s/network-policy.yaml

@@ -0,0 +1,74 @@
+---
+# Network policy for Metabase analytics service
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: metabase-policy
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: metabase
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-traefik
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-app
+      ports:
+        - protocol: TCP
+          port: 3000
+  egress:
+    # DNS resolution
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # PostgreSQL
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    # External HTTP/HTTPS (for license checks, plugin downloads, etc.)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443
+        - protocol: TCP
+          port: 80
+---
+# Allow metabase to connect to postgres
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: metabase-database-ingress
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: vibecarbon-postgres
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: metabase
+      ports:
+        - protocol: TCP
+          port: 5432

package/services/metabase/k8s/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: metabase-plugins-pvc
+  labels:
+    app: metabase
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

package/services/metabase/k8s/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: metabase
+  labels:
+    app: metabase
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: 3000
+      protocol: TCP
+      name: http
+  selector:
+    app: metabase

package/services/metabase/manifest.json

@@ -0,0 +1,34 @@
+{
+  "name": "metabase",
+  "description": "Business intelligence and analytics dashboard",
+  "version": "1.0.0",
+  "port": 3001,
+  "url": "http://metabase.localhost",
+
+  "files": {
+    "compose/docker-compose.yml": "docker-compose.metabase.yml",
+    "compose/docker-compose.prod.yml": "docker-compose.metabase.prod.yml",
+    "compose/docker-compose.override.yml": "docker-compose.metabase.override.yml",
+    "k8s/": "k8s/base/metabase/",
+    "db/init.sh": "volumes/db/metabase-init.sh",
+    "scripts/setup.sh": "volumes/metabase/scripts/setup.sh",
+    "docs/integration.md": "metabase-integration.md"
+  },
+
+  "envVars": {
+    "METABASE_ADMIN_PASSWORD": { "from": "ADMIN_PASSWORD" },
+    "METABASE_ADMIN_EMAIL": { "from": "ADMIN_EMAIL", "default": "admin@localhost" }
+  },
+
+  "kustomization": {
+    "entry": "metabase/"
+  },
+
+  "credentials": {
+    "title": "Metabase",
+    "fields": [
+      { "label": "URL", "value": "http://metabase.localhost" },
+      { "label": "Auth", "value": "Traefik ForwardAuth (super_admin)" }
+    ]
+  }
+}