vibecarbon 0.1.7 → 0.2.0

package/services/observability/k8s/grafana-pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: grafana-pvc
+  labels:
+    app: vibecarbon-grafana
+    component: observability
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: hcloud-volumes
+  resources:
+    requests:
+      storage: 5Gi

package/services/observability/k8s/grafana-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: grafana
+  labels:
+    app: vibecarbon-grafana
+    component: observability
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: vibecarbon-grafana

package/services/observability/k8s/ingressroute.yaml

@@ -0,0 +1,22 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vibecarbon-grafana
+  namespace: vibecarbon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # No strip-prefix: Grafana handles the subpath itself via GF_SERVER_SERVE_FROM_SUB_PATH
+    # and GF_SERVER_ROOT_URL=$(SITE_URL)/admin/grafana/.
+    - match: PathPrefix(`/admin/grafana`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: grafana
+          port: 3000
+      middlewares:
+        - name: admin-auth
+        - name: security-headers
+  tls:
+    secretName: vibecarbon-tls

package/services/observability/k8s/kustomization.yaml

@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  # Prometheus
+  - prometheus-rbac.yaml
+  - prometheus-configmap.yaml
+  - prometheus-pvc.yaml
+  - prometheus-deployment.yaml
+  - prometheus-service.yaml
+  # Grafana
+  - grafana-pvc.yaml
+  - grafana-provisioning-configmap.yaml
+  - grafana-deployment.yaml
+  - grafana-service.yaml
+  # Loki
+  - loki-configmap.yaml
+  - loki-pvc.yaml
+  - loki-deployment.yaml
+  - loki-service.yaml
+  # Network policies
+  - network-policy.yaml
+  # IngressRoute (applied when service is deployed)
+  - ingressroute.yaml

package/services/observability/k8s/loki-configmap.yaml

@@ -0,0 +1,74 @@
+# =============================================================================
+# LOKI CONFIGURATION
+# =============================================================================
+# Single-process mode with local filesystem storage.
+# Suitable for single-node clusters; for HA, switch to S3-backed storage.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: loki-config
+  labels:
+    app: vibecarbon-loki
+    component: observability
+data:
+  loki-config.yaml: |
+    auth_enabled: false
+
+    server:
+      http_listen_port: 3100
+      grpc_listen_port: 9096
+
+    common:
+      path_prefix: /loki
+      storage:
+        filesystem:
+          chunks_directory: /loki/chunks
+          rules_directory: /loki/rules
+      replication_factor: 1
+      ring:
+        instance_addr: 127.0.0.1
+        kvstore:
+          store: inmemory
+
+    query_range:
+      results_cache:
+        cache:
+          embedded_cache:
+            enabled: true
+            max_size_mb: 100
+
+    schema_config:
+      configs:
+        - from: "2024-01-01"
+          store: tsdb
+          object_store: filesystem
+          schema: v13
+          index:
+            prefix: index_
+            period: 24h
+
+    storage_config:
+      tsdb_shipper:
+        active_index_directory: /loki/tsdb-index
+        cache_location: /loki/tsdb-cache
+
+    limits_config:
+      reject_old_samples: true
+      reject_old_samples_max_age: 168h    # 7 days
+      max_query_series: 5000
+      max_query_parallelism: 2
+
+    compactor:
+      working_directory: /loki/compactor
+      compaction_interval: 10m
+      retention_enabled: true
+      retention_delete_delay: 2h
+      retention_delete_worker_count: 150
+      # Loki 3.x requires delete_request_store when retention_enabled is true,
+      # else the container crash-loops with "CONFIG ERROR: invalid compactor
+      # config". Mirrors the compose fix (volumes/loki/loki-config.yml);
+      # filesystem matches object_store above.
+      delete_request_store: filesystem
+
+    analytics:
+      reporting_enabled: false

package/services/observability/k8s/loki-deployment.yaml

@@ -0,0 +1,72 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: loki
+  labels:
+    app: vibecarbon-loki
+    component: observability
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: vibecarbon-loki
+  template:
+    metadata:
+      labels:
+        app: vibecarbon-loki
+        component: observability
+    spec:
+      securityContext:
+        fsGroup: 10001
+        runAsUser: 10001
+        runAsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: loki
+        image: grafana/loki:latest
+        imagePullPolicy: IfNotPresent
+        args:
+        - -config.file=/etc/loki/loki-config.yaml
+        ports:
+        - containerPort: 3100
+          name: http
+        volumeMounts:
+        - name: config
+          mountPath: /etc/loki
+        - name: data
+          mountPath: /loki
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+        livenessProbe:
+          httpGet:
+            path: /ready
+            port: http
+          initialDelaySeconds: 30
+          periodSeconds: 20
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: http
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          timeoutSeconds: 3
+          failureThreshold: 3
+        securityContext:
+          allowPrivilegeEscalation: false
+      volumes:
+      - name: config
+        configMap:
+          name: loki-config
+      - name: data
+        persistentVolumeClaim:
+          claimName: loki-pvc

package/services/observability/k8s/loki-pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: loki-pvc
+  labels:
+    app: vibecarbon-loki
+    component: observability
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: hcloud-volumes
+  resources:
+    requests:
+      storage: 10Gi

package/services/observability/k8s/loki-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: loki
+  labels:
+    app: vibecarbon-loki
+    component: observability
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3100
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: vibecarbon-loki

package/services/observability/k8s/network-policy.yaml

@@ -0,0 +1,141 @@
+# =============================================================================
+# OBSERVABILITY NETWORK POLICIES
+# =============================================================================
+# Each observability service gets its own policy to satisfy the default-deny-all
+# baseline. Only explicitly needed traffic paths are opened.
+
+---
+# =============================================================================
+# PROMETHEUS NETWORK POLICY
+# =============================================================================
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: prometheus-policy
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: vibecarbon-prometheus
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow health checks from the app (services-status API)
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-app
+      ports:
+        - protocol: TCP
+          port: 9090
+    # Allow Grafana to query metrics
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-grafana
+      ports:
+        - protocol: TCP
+          port: 9090
+  egress:
+    # Scrape all pods in the namespace (any port, since scrape targets vary)
+    - to:
+        - podSelector: {}
+    # Scrape kubelet/cAdvisor on k3s nodes (port 10250)
+    # Node IPs are outside the cluster CIDR, so allow broad egress to node network
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.42.0.0/16   # Exclude pod CIDR (already covered by podSelector above)
+      ports:
+        - protocol: TCP
+          port: 10250
+
+---
+# =============================================================================
+# GRAFANA NETWORK POLICY
+# =============================================================================
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: grafana-policy
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: vibecarbon-grafana
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow traffic from Traefik (IngressRoute for /admin/grafana)
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-traefik
+      ports:
+        - protocol: TCP
+          port: 3000
+    # Allow health checks from the app (services-status API)
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-app
+      ports:
+        - protocol: TCP
+          port: 3000
+  egress:
+    # Query Prometheus for metrics
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-prometheus
+      ports:
+        - protocol: TCP
+          port: 9090
+    # Query Loki for logs
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-loki
+      ports:
+        - protocol: TCP
+          port: 3100
+
+---
+# =============================================================================
+# LOKI NETWORK POLICY
+# =============================================================================
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: loki-policy
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: vibecarbon-loki
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow the app to push logs
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-app
+      ports:
+        - protocol: TCP
+          port: 3100
+    # Allow Grafana to query logs
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-grafana
+      ports:
+        - protocol: TCP
+          port: 3100
+  egress: []
+  # Loki in single-process mode with local storage has no outbound dependencies.
+  # DNS is handled by the allow-dns policy at the namespace level.

package/services/observability/k8s/prometheus-configmap.yaml

@@ -0,0 +1,80 @@
+# =============================================================================
+# PROMETHEUS CONFIGURATION
+# =============================================================================
+# Scrape config for k8s node metrics and postgres-exporter.
+# Add additional scrape targets as services are deployed.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: prometheus-config
+  labels:
+    app: vibecarbon-prometheus
+    component: observability
+data:
+  prometheus.yml: |
+    global:
+      scrape_interval: 30s
+      evaluation_interval: 30s
+
+    scrape_configs:
+      # Scrape Prometheus's own metrics
+      - job_name: "prometheus"
+        static_configs:
+          - targets: ["localhost:9090"]
+
+      # Scrape Kubernetes node metrics via kubelet
+      # k3s exposes metrics on the default kubelet port
+      - job_name: "kubernetes-nodes"
+        scheme: https
+        tls_config:
+          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          insecure_skip_verify: true
+        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+        kubernetes_sd_configs:
+          - role: node
+        relabel_configs:
+          - action: labelmap
+            regex: __meta_kubernetes_node_label_(.+)
+
+      # Scrape cAdvisor metrics from kubelet (container resource usage)
+      - job_name: "kubernetes-cadvisor"
+        scheme: https
+        tls_config:
+          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          insecure_skip_verify: true
+        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+        kubernetes_sd_configs:
+          - role: node
+        metrics_path: /metrics/cadvisor
+        relabel_configs:
+          - action: labelmap
+            regex: __meta_kubernetes_node_label_(.+)
+
+      # Scrape pods with prometheus.io/scrape annotation
+      - job_name: "kubernetes-pods"
+        kubernetes_sd_configs:
+          - role: pod
+            namespaces:
+              names:
+                - vibecarbon
+        relabel_configs:
+          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
+            action: keep
+            regex: "true"
+          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
+            action: replace
+            target_label: __metrics_path__
+            regex: (.+)
+          - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
+            action: replace
+            regex: ([^:]+)(?::\d+)?;(\d+)
+            replacement: $1:$2
+            target_label: __address__
+          - action: labelmap
+            regex: __meta_kubernetes_pod_label_(.+)
+          - source_labels: [__meta_kubernetes_namespace]
+            action: replace
+            target_label: kubernetes_namespace
+          - source_labels: [__meta_kubernetes_pod_name]
+            action: replace
+            target_label: kubernetes_pod_name

package/services/observability/k8s/prometheus-deployment.yaml

@@ -0,0 +1,78 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prometheus
+  labels:
+    app: vibecarbon-prometheus
+    component: observability
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: vibecarbon-prometheus
+  template:
+    metadata:
+      labels:
+        app: vibecarbon-prometheus
+        component: observability
+    spec:
+      serviceAccountName: prometheus
+      securityContext:
+        fsGroup: 65534
+        runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: prometheus
+        image: prom/prometheus:latest
+        imagePullPolicy: IfNotPresent
+        args:
+        - --config.file=/etc/prometheus/prometheus.yml
+        - --storage.tsdb.path=/prometheus
+        - --storage.tsdb.retention.time=15d
+        - --web.console.libraries=/etc/prometheus/console_libraries
+        - --web.console.templates=/etc/prometheus/consoles
+        - --web.enable-lifecycle
+        ports:
+        - containerPort: 9090
+          name: http
+        volumeMounts:
+        - name: config
+          mountPath: /etc/prometheus
+        - name: data
+          mountPath: /prometheus
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+        livenessProbe:
+          httpGet:
+            path: /-/healthy
+            port: http
+          initialDelaySeconds: 15
+          periodSeconds: 20
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /-/ready
+            port: http
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 3
+          failureThreshold: 3
+        securityContext:
+          allowPrivilegeEscalation: false
+      volumes:
+      - name: config
+        configMap:
+          name: prometheus-config
+      - name: data
+        persistentVolumeClaim:
+          claimName: prometheus-pvc

package/services/observability/k8s/prometheus-pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prometheus-pvc
+  labels:
+    app: vibecarbon-prometheus
+    component: observability
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: hcloud-volumes
+  resources:
+    requests:
+      storage: 10Gi

package/services/observability/k8s/prometheus-rbac.yaml

@@ -0,0 +1,55 @@
+# =============================================================================
+# PROMETHEUS RBAC
+# =============================================================================
+# Prometheus needs cluster-wide read access to discover and scrape targets.
+# ServiceAccount is namespace-scoped; ClusterRole + ClusterRoleBinding grant
+# read access to nodes, pods, services, and endpoints across all namespaces.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: prometheus
+  labels:
+    app: vibecarbon-prometheus
+    component: observability
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vibecarbon-prometheus
+  labels:
+    app: vibecarbon-prometheus
+    component: observability
+rules:
+  - apiGroups: [""]
+    resources:
+      - nodes
+      - nodes/proxy
+      - nodes/metrics
+      - services
+      - endpoints
+      - pods
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources:
+      - ingresses
+    verbs: ["get", "list", "watch"]
+  - nonResourceURLs:
+      - /metrics
+      - /metrics/cadvisor
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vibecarbon-prometheus
+  labels:
+    app: vibecarbon-prometheus
+    component: observability
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vibecarbon-prometheus
+subjects:
+  - kind: ServiceAccount
+    name: prometheus
+    namespace: vibecarbon

package/services/observability/k8s/prometheus-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: prometheus
+  labels:
+    app: vibecarbon-prometheus
+    component: observability
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9090
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: vibecarbon-prometheus

package/services/observability/manifest.json

@@ -0,0 +1,28 @@
+{
+  "name": "observability",
+  "description": "Prometheus, Grafana, Loki monitoring stack",
+  "version": "1.0.0",
+  "url": "http://grafana.localhost",
+
+  "files": {
+    "compose/docker-compose.yml": "docker-compose.observability.yml",
+    "compose/docker-compose.prod.yml": "docker-compose.observability.prod.yml",
+    "compose/docker-compose.override.yml": "docker-compose.observability.override.yml",
+    "volumes/": "volumes/",
+    "k8s/": "k8s/base/observability/",
+    "docs/integration.md": "observability-integration.md"
+  },
+
+  "credentials": {
+    "title": "Observability Stack",
+    "fields": [
+      { "label": "Grafana", "value": "http://grafana.localhost (k8s: /admin/grafana via Traefik admin-auth)" },
+      { "label": "Prometheus", "value": "http://prometheus.localhost (k8s: in-cluster :9090)" },
+      { "label": "Loki", "value": "http://loki.localhost (k8s: in-cluster :3100)" }
+    ]
+  },
+
+  "kustomization": {
+    "entry": "observability/"
+  }
+}

package/services/redis/compose/docker-compose.prod.yml

@@ -0,0 +1,10 @@
+# Redis - Production Overrides
+# Use with: docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.redis.yml -f docker-compose.redis.prod.yml up -d
+#
+# Redis is an internal cache/session store — the app reaches it over the compose
+# network (redis://redis:6379). Drop the dev host-port publishing so prod never
+# binds 6379 on the host (defense-in-depth behind the 22/80/443-only firewall).
+
+services:
+  redis:
+    ports: []