vibecarbon 0.3.0 → 0.4.0

package/src/backup.js

@@ -30,6 +30,7 @@ import { getS3Credentials } from './lib/hetzner-guided-setup.js';
 import { requireLicense } from './lib/licensing/index.js';
 import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
+import { listPodBackups } from './lib/pod-backups.js';
 import { assertInProjectDir } from './lib/project-guard.js';
 import {
   getPostgresPod,
@@ -101,41 +102,6 @@ const ACTION_CHOICES = [
 // LEGACY POD HELPERS (used when a k8s env has no S3 configured)
 // ============================================================================
 
-async function listPodBackups(ip, sshKeyPath) {
-  const pod = getPostgresPod(ip, sshKeyPath);
-
-  try {
-    const output = sshKubectl(ip, sshKeyPath, [
-      'exec',
-      '-n',
-      'vibecarbon',
-      pod,
-      '--',
-      'sh',
-      '-c',
-      'ls -lhS /backups/*_full.tar.gz /backups/*.sql.gz 2>/dev/null || echo NO_BACKUPS',
-    ]);
-
-    if (output === 'NO_BACKUPS' || !output) {
-      return [];
-    }
-
-    return output
-      .split('\n')
-      .filter((line) => line.includes('.tar.gz') || line.includes('.sql.gz'))
-      .map((line) => {
-        const parts = line.split(/\s+/);
-        return {
-          size: parts[4],
-          date: `${parts[5]} ${parts[6]} ${parts[7]}`,
-          name: parts[parts.length - 1].replace('/backups/', ''),
-        };
-      });
-  } catch {
-    return [];
-  }
-}
-
 async function downloadPodBackup(ip, sshKeyPath, filename) {
   const pod = getPostgresPod(ip, sshKeyPath);
 
@@ -613,7 +579,7 @@ async function runList({
     return;
   }
 
-  const backups = await listPodBackups(serverIp, sshKeyPath);
+  const backups = listPodBackups(serverIp, sshKeyPath, { sort: 'largest' });
   s.stop('Backups retrieved');
   printBackupList(backups, envName);
 }

package/src/create.js

@@ -751,6 +751,12 @@ async function bootstrap(cliArgs) {
   copyTemplate('.dockerignore', join(projectDir, '.dockerignore'), variables);
   copyTemplate('docker-compose.yml', join(projectDir, 'docker-compose.yml'), variables);
   copyTemplate('docker-compose.prod.yml', join(projectDir, 'docker-compose.prod.yml'), variables);
+  // DNS-01 ACME override — applied at deploy only for managed-DNS (cloudflare/hetzner).
+  copyTemplate(
+    'docker-compose.dns01.prod.yml',
+    join(projectDir, 'docker-compose.dns01.prod.yml'),
+    variables,
+  );
   copyTemplate(
     'docker-compose.override.yml',
     join(projectDir, 'docker-compose.override.yml'),
@@ -818,10 +824,10 @@ async function bootstrap(cliArgs) {
     variables,
   );
 
-  copyTemplate('backup/backup.sh', join(projectDir, 'backup/backup.sh'), variables);
+  // Compose backups run as a host cron (compose-backup.sh). k8s backups are
+  // wal-g co-located in the db pod (carbon/db image), so the old standalone
+  // backup container (backup.sh + backup/Dockerfile) was removed.
   copyTemplate('backup/compose-backup.sh', join(projectDir, 'backup/compose-backup.sh'), variables);
-  copyTemplate('backup/Dockerfile', join(projectDir, 'backup/Dockerfile'), variables);
-  chmodSync(join(projectDir, 'backup/backup.sh'), 0o755);
   chmodSync(join(projectDir, 'backup/compose-backup.sh'), 0o755);
   // CI/CD workflow files are NOT shipped at create time — `vibecarbon
   // configure` → CI/CD installs them from src/lib/ci-setup.js when the user
@@ -860,7 +866,6 @@ async function bootstrap(cliArgs) {
   // Make shell scripts executable
   const shellScripts = [
     'k8s/test-local.sh',
-    'backup/backup.sh',
     'docker-entrypoint.sh',
     'volumes/kong/docker-entrypoint.sh',
     'volumes/db/set-passwords.sh',

package/src/deploy.js

@@ -112,6 +112,12 @@ const SPEC = {
       boolean: true,
       description: 'Clear resume state and redo every step from scratch',
     },
+    {
+      name: 'restore',
+      value: '<latest|timestamp>',
+      description:
+        'Disaster recovery: seed the fresh DB from the latest wal-g backup in S3 (or PITR to an ISO-8601 timestamp). Skips migrations — the restored DB is authoritative. k8s only.',
+    },
   ],
   examples: [
     { command: 'vibecarbon deploy', description: 'prompts for env (defaults to prod)' },
@@ -124,6 +130,10 @@ const SPEC = {
       command: 'vibecarbon deploy prod -full',
       description: 'redo a previously-failed deploy from scratch',
     },
+    {
+      command: 'vibecarbon deploy prod -mode k8s -restore latest -y',
+      description: 'stand up a fresh cluster and restore the DB from S3 (DR)',
+    },
   ],
 };
 
@@ -168,6 +178,8 @@ function buildLegacyArgs(values, positional) {
     // initialized for the orchestrator's resolveBuildMode read.
     direct: false,
     push: false,
+    // DR: seed the fresh DB from S3 via wal-g (k8s only). null = normal deploy.
+    restore: values.restore || null,
   };
 }
 

package/src/lib/backup-s3.js

@@ -137,37 +137,6 @@ export async function uploadS3Backup(s3Config, localPath, s3Key) {
   throw lastErr;
 }
 
-/**
- * Delete expired backups from S3 based on retention policy.
- * Parses dates from filenames: {project}_{YYYYMMDD}_{HHMMSS}_full.tar.gz
- */
-export async function deleteExpiredS3Backups(s3Config, projectName, retentionDays) {
-  const { DeleteObjectCommand, ListObjectsV2Command } = await import('@aws-sdk/client-s3');
-  const client = await getS3Client(s3Config);
-
-  const command = new ListObjectsV2Command({
-    Bucket: s3Config.bucket,
-    Prefix: `backups/${projectName}_`,
-  });
-
-  const response = await client.send(command);
-  const objects = response.Contents || [];
-
-  const cutoffDate = new Date();
-  cutoffDate.setDate(cutoffDate.getDate() - retentionDays);
-  const cutoffStr = cutoffDate.toISOString().slice(0, 10).replace(/-/g, '');
-
-  let deleted = 0;
-  for (const obj of objects) {
-    const match = obj.Key.match(/_(\d{8})_\d{6}_full\.tar\.gz$/);
-    if (match && match[1] < cutoffStr) {
-      await client.send(new DeleteObjectCommand({ Bucket: s3Config.bucket, Key: obj.Key }));
-      deleted++;
-    }
-  }
-  return deleted;
-}
-
 /**
  * Format a byte count as a human-readable string.
  */

package/src/lib/cloudflare.js

@@ -33,27 +33,6 @@ export async function getZones(apiToken) {
   return data.result;
 }
 
-/**
- * Get the Cloudflare account ID
- *
- * @param {string} apiToken - Cloudflare API token
- * @returns {Promise<string|null>} - Account ID or null if not found
- */
-export async function getAccountId(apiToken) {
-  const response = await fetchWithRetry('https://api.cloudflare.com/client/v4/accounts', {
-    headers: {
-      Authorization: `Bearer ${apiToken}`,
-      'Content-Type': 'application/json',
-    },
-  });
-
-  const data = await response.json();
-  if (data.result && data.result.length > 0) {
-    return data.result[0].id;
-  }
-  return null;
-}
-
 // ============================================================================
 // DNS RECORD OPERATIONS
 // ============================================================================
@@ -347,44 +326,6 @@ export async function setupHA(apiToken, zoneId, domain, servers) {
  * @param {string} serverIp - Server IP address
  * @returns {Promise<object>} - Setup result
  */
-/**
- * Set the zone-level SSL mode on Cloudflare. Used when we want Cloudflare's
- * edge to terminate TLS (so the origin can skip ACME / cert-manager).
- *
- *   - 'off' — no encryption (don't use in prod)
- *   - 'flexible' — CF↔browser HTTPS, CF↔origin HTTP (allows origin to run
- *     without any TLS; not recommended — redirect loops with origin-side
- *     HTTPS)
- *   - 'full' — CF↔browser HTTPS, CF↔origin HTTPS with ANY cert (self-signed
- *     OK). Our sweet spot when the user opts into the TLS-proxy path.
- *   - 'strict' — CF↔origin HTTPS with a valid cert. Requires real ACME,
- *     defeats the purpose of TLS proxy.
- *
- * @param {string} apiToken
- * @param {string} zoneId
- * @param {'off'|'flexible'|'full'|'strict'} mode
- */
-export async function setZoneSslMode(apiToken, zoneId, mode) {
-  const response = await fetchWithRetry(
-    `https://api.cloudflare.com/client/v4/zones/${zoneId}/settings/ssl`,
-    {
-      method: 'PATCH',
-      headers: {
-        Authorization: `Bearer ${apiToken}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({ value: mode }),
-    },
-  );
-  const data = await response.json();
-  if (!data.success) {
-    throw new Error(
-      `Cloudflare zone SSL mode update failed: ${JSON.stringify(data.errors ?? data)}`,
-    );
-  }
-  return data.result;
-}
-
 export async function setupSimple(apiToken, zoneId, domain, serverIp, options = {}) {
   // proxied default flipped to false (DNS-only / gray-cloud) on
   // 2026-04-26 after e2e run #3 surfaced the orange-cloud

package/src/lib/config.js

@@ -2,7 +2,7 @@
  * Project configuration management
  */
 
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
 
@@ -155,18 +155,6 @@ export function loadS3Config(envName, cwd = process.cwd()) {
   return config?.environments?.[envName]?.s3 || null;
 }
 
-/**
- * Load backup configuration for a specific environment
- *
- * @param {string} envName - Environment name (e.g., 'prod', 'staging')
- * @param {string} [cwd] - Working directory (defaults to process.cwd())
- * @returns {object|null} - Backup config or null if not configured
- */
-export function loadBackupConfig(envName, cwd = process.cwd()) {
-  const config = loadProjectConfig(cwd);
-  return config?.environments?.[envName]?.backup || null;
-}
-
 /**
  * Load backup S3 configuration for a specific environment.
  * This is the dedicated backup bucket (separate from storage bucket).
@@ -235,18 +223,6 @@ export function saveCredentials(credentials, configDir = DEFAULT_CONFIG_DIR) {
   writeFileSync(credPath, `${JSON.stringify(merged, null, 2)}\n`, { mode: 0o600 });
 }
 
-/**
- * Delete the credentials file
- *
- * @param {string} [configDir] - Config directory for testability
- */
-export function clearCredentials(configDir = DEFAULT_CONFIG_DIR) {
-  const credPath = join(configDir, 'credentials.json');
-  if (existsSync(credPath)) {
-    unlinkSync(credPath);
-  }
-}
-
 /**
  * Load the global project registry
  *
@@ -298,23 +274,6 @@ export function registerProject(name, projectPath, configDir = DEFAULT_CONFIG_DI
   writeFileSync(registryPath, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 });
 }
 
-/**
- * Remove a project from the global registry by path.
- *
- * @param {string} projectPath - Project directory path
- * @param {string} [configDir] - Config directory for testability
- */
-export function unregisterProject(projectPath, configDir = DEFAULT_CONFIG_DIR) {
-  const absPath = resolve(projectPath);
-  const registry = loadGlobalRegistry(configDir);
-  registry.projects = registry.projects.filter((p) => p.path !== absPath);
-
-  const registryPath = join(configDir, 'projects.json');
-  if (existsSync(join(configDir))) {
-    writeFileSync(registryPath, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 });
-  }
-}
-
 /**
  * Remove registry entries where the directory no longer exists.
  *

package/src/lib/deploy/acme.js

@@ -0,0 +1,57 @@
+/**
+ * ACME / TLS challenge strategy for Compose deploys.
+ *
+ * Managed-DNS providers (cloudflare, hetzner) expose an API that lego — the
+ * ACME client embedded in Traefik — can use to solve the DNS-01 challenge:
+ * Traefik writes a `_acme-challenge` TXT record, Let's Encrypt validates it,
+ * and a cert is issued. DNS-01 needs no inbound port-80 reachability and does
+ * not race against A-record propagation, so it eliminates the cold-deploy ACME
+ * race that the DNS-propagation poll (src/lib/dns-propagation.js) and the
+ * Traefik cert self-heal were built to paper over.
+ *
+ * `manual` DNS has no API we can drive, so it falls back to the HTTP-01
+ * challenge (and keeps the DNS-propagation poll that guards it).
+ *
+ * Tokens: lego selects the provider implementation from ACME_DNS_PROVIDER and
+ * reads that provider's token env var. Hetzner consolidated its DNS into the
+ * core Cloud API (api.hetzner.cloud) — the legacy dns.hetzner.com console was
+ * retired May 2026 — so lego v4.27+ reads HETZNER_API_TOKEN, the SAME Cloud
+ * token used for server ops (no separate DNS credential). That lego ships in
+ * Traefik >= 3.6.6; we pin v3.6.11. Cloudflare uses CF_DNS_API_TOKEN.
+ */
+
+/** Compose override file that swaps Traefik from HTTP-01 to DNS-01. */
+export const DNS01_OVERRIDE_FILE = 'docker-compose.dns01.prod.yml';
+
+const DNS01_PROVIDERS = new Set(['cloudflare', 'hetzner']);
+
+/**
+ * True when the deploy's DNS provider exposes an API lego can use for DNS-01.
+ * @param {string|null|undefined} dnsProvider
+ * @returns {boolean}
+ */
+export function useDnsChallenge(dnsProvider) {
+  return DNS01_PROVIDERS.has(dnsProvider);
+}
+
+/**
+ * Env vars Traefik needs to solve the DNS-01 challenge for the given provider.
+ * Returns `{}` for non-DNS-01 (manual / unknown) providers so callers can
+ * spread it unconditionally. Token keys are omitted when the corresponding
+ * token is absent, so an empty `${VAR:-}` interpolation stays empty rather
+ * than landing a literal "undefined".
+ *
+ * @param {string|null|undefined} dnsProvider
+ * @param {{cloudflareApiToken?: string|null, hetznerApiToken?: string|null}} [tokens]
+ * @returns {Record<string, string>}
+ */
+export function dnsChallengeEnv(dnsProvider, { cloudflareApiToken, hetznerApiToken } = {}) {
+  if (!useDnsChallenge(dnsProvider)) return {};
+  const env = { ACME_DNS_PROVIDER: dnsProvider };
+  if (dnsProvider === 'cloudflare') {
+    if (cloudflareApiToken) env.CF_DNS_API_TOKEN = cloudflareApiToken;
+  } else if (dnsProvider === 'hetzner') {
+    if (hetznerApiToken) env.HETZNER_API_TOKEN = hetznerApiToken;
+  }
+  return env;
+}

package/src/lib/deploy/admin-user.js

@@ -0,0 +1,105 @@
+/**
+ * Shared GoTrue admin-user provisioning.
+ *
+ * The production app super-admin — an `auth.users` row with
+ * `app_metadata.role = super_admin` — is created post-deploy by POSTing to
+ * GoTrue's admin API. The HTTP contract is identical across every deploy
+ * mode; only the tunnel used to reach GoTrue differs:
+ *   - compose / compose-ha: `ssh -L` to the gateway (Kong :8000, `/auth/v1`).
+ *   - k8s / k8s-ha:          `kubectl port-forward` to auth (:9999, `/admin`).
+ *
+ * This module is the tunnel-agnostic half: given a reachable base URL it
+ * polls health and upserts the admin user. Callers own the tunnel lifecycle
+ * and pass the resolved URLs. Keeping the fetch logic here means the 422
+ * idempotency + bearer-auth contract lives in exactly one place (and is
+ * unit-tested without standing up SSH or a cluster).
+ */
+
+/**
+ * The GoTrue admin-API request body for the super-admin.
+ * `email_confirm: true` skips the confirmation email (the operator can log in
+ * immediately); `app_metadata.role` is what the app's authz checks read.
+ *
+ * @param {string} adminEmail
+ * @param {string} adminPassword
+ */
+export function adminUserBody(adminEmail, adminPassword) {
+  return {
+    email: adminEmail,
+    password: adminPassword,
+    email_confirm: true,
+    app_metadata: { role: 'super_admin' },
+  };
+}
+
+/**
+ * Poll a forwarded GoTrue `/health` endpoint until it answers as GoTrue.
+ *
+ * @param {string} healthUrl - e.g. http://localhost:9999/health
+ * @param {object} [opts]
+ * @param {number} [opts.attempts=15]
+ * @param {number} [opts.intervalMs=1000]
+ * @param {typeof fetch} [opts.fetchImpl=fetch]
+ * @returns {Promise<boolean>} true once reachable, false after attempts
+ */
+export async function waitForGotrueHealth(
+  healthUrl,
+  { attempts = 15, intervalMs = 1000, fetchImpl = fetch } = {},
+) {
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await fetchImpl(healthUrl, { signal: AbortSignal.timeout(2000) });
+      // GoTrue's /health returns 200 with a body naming itself; any 2xx from
+      // the forwarded port means the tunnel + service are live.
+      if (res.ok) return true;
+    } catch {
+      // tunnel/service not up yet
+    }
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+  return false;
+}
+
+/**
+ * Upsert the super-admin via GoTrue's admin API. Idempotent: a 422 means the
+ * user already exists, which we treat as success so re-deploys are clean.
+ *
+ * @param {object} args
+ * @param {string} args.adminUsersUrl - e.g. http://localhost:9999/admin/users
+ * @param {string} args.serviceRoleKey - the Supabase service-role JWT
+ * @param {string} args.adminEmail
+ * @param {string} args.adminPassword
+ * @param {typeof fetch} [args.fetchImpl=fetch]
+ * @returns {Promise<{success: boolean, message: string}>}
+ */
+export async function postAdminUser({
+  adminUsersUrl,
+  serviceRoleKey,
+  adminEmail,
+  adminPassword,
+  fetchImpl = fetch,
+}) {
+  const response = await fetchImpl(adminUsersUrl, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${serviceRoleKey}`,
+      apikey: serviceRoleKey,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify(adminUserBody(adminEmail, adminPassword)),
+    signal: AbortSignal.timeout(15000),
+  });
+
+  if (response.ok) {
+    return { success: true, message: `Admin user created: ${adminEmail}` };
+  }
+  // 422 = "User already registered" — already provisioned on a prior deploy.
+  if (response.status === 422) {
+    return { success: true, message: `Admin user already exists: ${adminEmail}` };
+  }
+  const body = await response.text().catch(() => '');
+  return {
+    success: false,
+    message: `GoTrue admin API returned ${response.status}: ${body.slice(0, 200)}`,
+  };
+}

package/src/lib/deploy/bundle.js

@@ -8,6 +8,7 @@ import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { escapeDotenv } from '../shell.js';
+import { DNS01_OVERRIDE_FILE, dnsChallengeEnv } from './acme.js';
 
 /**
  * Render the reconcile.sh script
@@ -86,6 +87,10 @@ WantedBy=multi-user.target
  */
 function composeFileFlags(options = {}) {
   const files = ['-f', 'docker-compose.yml', '-f', 'docker-compose.prod.yml'];
+  // DNS-01 override must follow prod.yml so it replaces the Traefik command.
+  if (options.dnsChallenge) {
+    files.push('-f', DNS01_OVERRIDE_FILE);
+  }
   if (options.observability) {
     files.push('-f', 'docker-compose.observability.yml');
     files.push('-f', 'docker-compose.observability.prod.yml');
@@ -129,6 +134,7 @@ export function renderBundle(projectName, options = {}) {
     rootFiles.push('docker-compose.metabase.yml', 'docker-compose.metabase.prod.yml');
   }
   if (options.redis) rootFiles.push('docker-compose.redis.yml', 'docker-compose.redis.prod.yml');
+  if (options.dnsChallenge) rootFiles.push(DNS01_OVERRIDE_FILE);
 
   for (const file of rootFiles) {
     const src = join(cwd, file);
@@ -168,6 +174,17 @@ export function renderBundle(projectName, options = {}) {
   if (projectName) {
     envOverrides.PROJECT_NAME = projectName;
   }
+  // DNS-01: lego reads ACME_DNS_PROVIDER + the matching provider token from the
+  // server .env (consumed by docker-compose.dns01.prod.yml's Traefik env).
+  if (options.dnsChallenge) {
+    Object.assign(
+      envOverrides,
+      dnsChallengeEnv(options.dnsProvider, {
+        cloudflareApiToken: options.cloudflareApiToken,
+        hetznerApiToken: options.hetznerApiToken,
+      }),
+    );
+  }
 
   // Merge overrides into local copy
   const lines = envContent.split('\n');