vibecarbon 0.1.7 → 0.2.0

package/services/redis/compose/docker-compose.yml

@@ -0,0 +1,24 @@
+# Redis - In-memory data store
+# Added via: vibecarbon add redis
+
+services:
+  redis:
+    image: redis:alpine
+    container_name: {{PROJECT_NAME}}-redis
+    restart: unless-stopped
+    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis_data:/data
+    networks:
+      - vibecarbon-network
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  redis_data:
+    driver: local

package/services/redis/docs/integration.md

@@ -0,0 +1,148 @@
+# Redis Integration Guide
+
+Redis is an in-memory data store used for caching, session management, rate limiting, and pub/sub messaging.
+
+## Connection Details
+
+- **Host**: `redis` (internal) / `localhost` (external)
+- **Port**: `6379`
+- **Password**: See `REDIS_PASSWORD` in `.env.local`
+
+## Usage in Your Application
+
+### Install Redis Client
+
+```bash
+pnpm add ioredis
+```
+
+### Server-Side Integration
+
+Create `src/server/lib/redis.ts`:
+
+```typescript
+import Redis from 'ioredis';
+import { env } from './env';
+
+export const redis = new Redis({
+  host: env.REDIS_HOST || 'redis',
+  port: parseInt(env.REDIS_PORT || '6379'),
+  password: env.REDIS_PASSWORD,
+});
+
+// Connection event handlers
+redis.on('connect', () => console.log('Redis connected'));
+redis.on('error', (err) => console.error('Redis error:', err));
+```
+
+### Caching Example
+
+```typescript
+import { redis } from './lib/redis';
+
+// Cache a value for 1 hour
+await redis.setex('user:123', 3600, JSON.stringify(userData));
+
+// Retrieve cached value
+const cached = await redis.get('user:123');
+if (cached) {
+  return JSON.parse(cached);
+}
+```
+
+### Session Storage
+
+```typescript
+import { redis } from './lib/redis';
+
+// Store session
+await redis.hset(`session:${sessionId}`, {
+  userId: user.id,
+  email: user.email,
+  createdAt: Date.now(),
+});
+await redis.expire(`session:${sessionId}`, 86400); // 24 hours
+
+// Retrieve session
+const session = await redis.hgetall(`session:${sessionId}`);
+```
+
+### Rate Limiting
+
+```typescript
+import { redis } from './lib/redis';
+
+async function rateLimit(key: string, limit: number, windowSecs: number): Promise<boolean> {
+  const current = await redis.incr(key);
+  if (current === 1) {
+    await redis.expire(key, windowSecs);
+  }
+  return current <= limit;
+}
+
+// Usage: 100 requests per minute per IP
+const allowed = await rateLimit(`ratelimit:${ip}`, 100, 60);
+```
+
+### Pub/Sub Example
+
+```typescript
+import Redis from 'ioredis';
+
+const subscriber = new Redis({ /* config */ });
+const publisher = new Redis({ /* config */ });
+
+// Subscribe to channel
+subscriber.subscribe('notifications', (err, count) => {
+  console.log(`Subscribed to ${count} channels`);
+});
+
+subscriber.on('message', (channel, message) => {
+  console.log(`Received ${message} from ${channel}`);
+});
+
+// Publish message
+await publisher.publish('notifications', JSON.stringify({ type: 'alert', data: '...' }));
+```
+
+## Environment Variables
+
+Add to your `.env.local`:
+
+```env
+REDIS_HOST=redis
+REDIS_PORT=6379
+REDIS_PASSWORD=your-generated-password
+```
+
+## Docker Commands
+
+```bash
+# View Redis logs
+pnpm docker:logs redis
+
+# Connect to Redis CLI
+docker exec -it {{PROJECT_NAME}}-redis redis-cli -a $REDIS_PASSWORD
+
+# Monitor Redis commands in real-time
+docker exec -it {{PROJECT_NAME}}-redis redis-cli -a $REDIS_PASSWORD MONITOR
+```
+
+## Performance Tips
+
+1. **Use pipelining** for multiple commands:
+   ```typescript
+   const pipeline = redis.pipeline();
+   pipeline.get('key1');
+   pipeline.get('key2');
+   const results = await pipeline.exec();
+   ```
+
+2. **Set appropriate TTLs** to prevent memory bloat
+
+3. **Use Redis data structures** (hashes, sets, sorted sets) instead of serialized JSON when possible
+
+4. **Monitor memory usage**:
+   ```bash
+   redis-cli -a $REDIS_PASSWORD INFO memory
+   ```

package/services/redis/k8s/deployment.yaml

@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  labels:
+    app: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - name: redis
+        image: redis:alpine
+        command:
+        - redis-server
+        - --appendonly
+        - 'yes'
+        - --requirepass
+        - $(REDIS_PASSWORD)
+        ports:
+        - containerPort: 6379
+        env:
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: vibecarbon-secrets
+              key: REDIS_PASSWORD
+        volumeMounts:
+        - name: redis-data
+          mountPath: /data
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
+        livenessProbe:
+          exec:
+            command:
+            - redis-cli
+            - -a
+            - $(REDIS_PASSWORD)
+            - ping
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        readinessProbe:
+          exec:
+            command:
+            - redis-cli
+            - -a
+            - $(REDIS_PASSWORD)
+            - ping
+          initialDelaySeconds: 5
+          periodSeconds: 5
+        securityContext:
+          allowPrivilegeEscalation: false
+      volumes:
+      - name: redis-data
+        persistentVolumeClaim:
+          claimName: redis-pvc
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault

package/services/redis/k8s/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml
+  - pvc.yaml
+  - network-policy.yaml

package/services/redis/k8s/network-policy.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: redis-policy
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: redis
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow connections from the application server only
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-app
+      ports:
+        - protocol: TCP
+          port: 6379

package/services/redis/k8s/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-pvc
+  labels:
+    app: redis
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

package/services/redis/k8s/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  labels:
+    app: redis
+spec:
+  type: ClusterIP
+  ports:
+    - port: 6379
+      targetPort: 6379
+      protocol: TCP
+      name: redis
+  selector:
+    app: redis

package/services/redis/manifest.json

@@ -0,0 +1,30 @@
+{
+  "name": "redis",
+  "description": "In-memory data store for caching and sessions",
+  "version": "1.0.0",
+  "port": 6379,
+  "url": "redis://localhost:6379",
+
+  "files": {
+    "compose/docker-compose.yml": "docker-compose.redis.yml",
+    "compose/docker-compose.prod.yml": "docker-compose.redis.prod.yml",
+    "k8s/": "k8s/base/redis/",
+    "docs/integration.md": "redis-integration.md"
+  },
+
+  "envVars": {
+    "REDIS_PASSWORD": { "generate": "password", "length": 32 }
+  },
+
+  "kustomization": {
+    "entry": "redis/"
+  },
+
+  "credentials": {
+    "title": "Redis",
+    "fields": [
+      { "label": "Host", "value": "localhost:6379" },
+      { "label": "Credentials", "value": "Stored in .env.local (REDIS_PASSWORD)" }
+    ]
+  }
+}

package/services/s3/compose/docker-compose.s3-ha.yml

@@ -0,0 +1,86 @@
+# S3 HA Storage Backend Configuration
+# Overlay for Supabase Storage with cross-region replication via rclone
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.s3-ha.yml up -d
+#
+# Required environment variables in .env:
+#   S3_ACCESS_KEY - Hetzner S3 access key
+#   S3_SECRET_KEY - Hetzner S3 secret key
+#   S3_PRIMARY_BUCKET - Primary region bucket name
+#   S3_STANDBY_BUCKET - Standby region bucket name
+#   S3_PRIMARY_ENDPOINT - Primary region endpoint
+#   S3_STANDBY_ENDPOINT - Standby region endpoint
+#   S3_PRIMARY_REGION - Primary region (e.g., fsn1)
+#   S3_STANDBY_REGION - Standby region (e.g., hel1)
+#   S3_SYNC_INTERVAL - Sync interval in minutes (default: 5)
+
+services:
+  storage:
+    environment:
+      # Override storage backend from 'file' to 's3'
+      STORAGE_BACKEND: s3
+      # S3 bucket configuration (uses primary bucket)
+      GLOBAL_S3_BUCKET: ${S3_PRIMARY_BUCKET}
+      GLOBAL_S3_ENDPOINT: ${S3_PRIMARY_ENDPOINT}
+      GLOBAL_S3_FORCE_PATH_STYLE: "true"
+      REGION: ${S3_PRIMARY_REGION}
+      # S3 credentials
+      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
+      AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
+
+  imgproxy:
+    environment:
+      # Enable S3 backend for image transformations
+      IMGPROXY_USE_S3: "true"
+      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
+      AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
+      AWS_REGION: ${S3_PRIMARY_REGION}
+      IMGPROXY_S3_ENDPOINT: ${S3_PRIMARY_ENDPOINT}
+
+  # Cross-region S3 synchronization service
+  s3-sync:
+    image: rclone/rclone:latest
+    restart: unless-stopped
+    environment:
+      # Primary bucket configuration
+      RCLONE_CONFIG_PRIMARY_TYPE: s3
+      RCLONE_CONFIG_PRIMARY_PROVIDER: Other
+      RCLONE_CONFIG_PRIMARY_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
+      RCLONE_CONFIG_PRIMARY_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
+      RCLONE_CONFIG_PRIMARY_ENDPOINT: ${S3_PRIMARY_ENDPOINT}
+      RCLONE_CONFIG_PRIMARY_ACL: private
+      # Standby bucket configuration
+      RCLONE_CONFIG_STANDBY_TYPE: s3
+      RCLONE_CONFIG_STANDBY_PROVIDER: Other
+      RCLONE_CONFIG_STANDBY_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
+      RCLONE_CONFIG_STANDBY_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
+      RCLONE_CONFIG_STANDBY_ENDPOINT: ${S3_STANDBY_ENDPOINT}
+      RCLONE_CONFIG_STANDBY_ACL: private
+    command: |
+      sh -c '
+        echo "Starting S3 cross-region sync..."
+        echo "Primary: ${S3_PRIMARY_BUCKET} @ ${S3_PRIMARY_ENDPOINT}"
+        echo "Standby: ${S3_STANDBY_BUCKET} @ ${S3_STANDBY_ENDPOINT}"
+        echo "Sync interval: ${S3_SYNC_INTERVAL:-5} minutes"
+        while true; do
+          echo "[$(date)] Starting sync from primary to standby..."
+          rclone sync primary:${S3_PRIMARY_BUCKET} standby:${S3_STANDBY_BUCKET} \
+            --transfers 8 \
+            --checkers 16 \
+            --fast-list \
+            --stats 30s \
+            --stats-one-line
+          echo "[$(date)] Sync complete. Sleeping for ${S3_SYNC_INTERVAL:-5} minutes..."
+          sleep ${S3_SYNC_INTERVAL:-5}m
+        done
+      '
+    healthcheck:
+      test: ["CMD", "rclone", "version"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+    deploy:
+      resources:
+        limits:
+          memory: 256M

package/services/s3/compose/docker-compose.s3.yml

@@ -0,0 +1,35 @@
+# S3 Storage Backend Configuration
+# Overlay for Supabase Storage to use Hetzner Object Storage (S3-compatible)
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.s3.yml up -d
+#
+# Required environment variables in .env:
+#   S3_ACCESS_KEY - Hetzner S3 access key
+#   S3_SECRET_KEY - Hetzner S3 secret key
+#   S3_BUCKET - S3 bucket name
+#   S3_ENDPOINT - S3 endpoint URL (e.g., https://fsn1.your-objectstorage.com)
+#   S3_REGION - S3 region (e.g., fsn1)
+
+services:
+  storage:
+    environment:
+      # Override storage backend from 'file' to 's3'
+      STORAGE_BACKEND: s3
+      # S3 bucket configuration
+      GLOBAL_S3_BUCKET: ${S3_BUCKET}
+      GLOBAL_S3_ENDPOINT: ${S3_ENDPOINT}
+      GLOBAL_S3_FORCE_PATH_STYLE: "true"
+      REGION: ${S3_REGION}
+      # S3 credentials
+      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
+      AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
+
+  imgproxy:
+    environment:
+      # Enable S3 backend for image transformations
+      IMGPROXY_USE_S3: "true"
+      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
+      AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
+      AWS_REGION: ${S3_REGION}
+      IMGPROXY_S3_ENDPOINT: ${S3_ENDPOINT}

package/services/s3/manifest.json

@@ -0,0 +1,87 @@
+{
+  "name": "s3",
+  "displayName": "Hetzner S3 Object Storage",
+  "description": "S3-compatible object storage for Supabase file storage backend",
+  "version": "1.0.0",
+  "type": "infrastructure",
+  "requiresCredentials": true,
+
+  "envVars": {
+    "S3_ACCESS_KEY": {
+      "prompt": true,
+      "secure": true,
+      "description": "Hetzner S3 access key"
+    },
+    "S3_SECRET_KEY": {
+      "prompt": true,
+      "secure": true,
+      "description": "Hetzner S3 secret key"
+    },
+    "S3_BUCKET": {
+      "generate": "from-project-name",
+      "description": "S3 bucket name"
+    },
+    "S3_ENDPOINT": {
+      "generate": "from-region",
+      "description": "S3 endpoint URL"
+    },
+    "S3_REGION": {
+      "prompt": true,
+      "options": ["fsn1", "nbg1", "hel1"],
+      "default": "fsn1",
+      "description": "S3 storage region"
+    }
+  },
+
+  "haEnvVars": {
+    "S3_PRIMARY_BUCKET": {
+      "generate": "from-project-name-primary",
+      "description": "Primary region bucket name"
+    },
+    "S3_STANDBY_BUCKET": {
+      "generate": "from-project-name-standby",
+      "description": "Standby region bucket name"
+    },
+    "S3_PRIMARY_ENDPOINT": {
+      "generate": "from-region",
+      "description": "Primary region endpoint"
+    },
+    "S3_STANDBY_ENDPOINT": {
+      "generate": "from-region",
+      "description": "Standby region endpoint"
+    },
+    "S3_PRIMARY_REGION": {
+      "prompt": true,
+      "options": ["fsn1", "nbg1", "hel1"],
+      "default": "fsn1",
+      "description": "Primary storage region"
+    },
+    "S3_STANDBY_REGION": {
+      "prompt": true,
+      "options": ["fsn1", "nbg1", "hel1"],
+      "default": "hel1",
+      "description": "Standby storage region"
+    },
+    "S3_SYNC_INTERVAL": {
+      "default": "5",
+      "description": "Cross-region sync interval in minutes"
+    }
+  },
+
+  "compose": {
+    "standard": "compose/docker-compose.s3.yml",
+    "ha": "compose/docker-compose.s3-ha.yml"
+  },
+
+  "instructions": {
+    "title": "Hetzner Object Storage Setup",
+    "url": "https://console.hetzner.cloud/",
+    "steps": [
+      "Go to https://console.hetzner.cloud/",
+      "Select your project (or create one)",
+      "Click 'Object Storage' in the sidebar",
+      "Click 'Create Credentials'",
+      "Copy the Access Key and Secret Key (secret shown only once!)"
+    ]
+  }
+}