vibecarbon 0.3.0 → 0.4.0

package/carbon/backup/backup.sh

@@ -1,95 +0,0 @@
-#!/bin/bash
-set -e
-# pipefail is critical: the pg_dump | gzip pipeline below silently uploaded
-# 170-byte gzip-header-only tarballs when pg_dump failed (wrong PGHOST),
-# making restore think backups existed when they were empty. Observed
-# 2026-04-27 k8s-ha matrix #6 — restore failed "No backups found in S3"
-# because the broken tarball had no SQL inside.
-set -o pipefail
-
-# ============================================================================
-# Vibecarbon Blazing Fast Backup Script (WAL-G)
-#
-# Optimized for performance and robustness using continuous archiving.
-# Fallback to pg_dump for legacy compatibility.
-#
-# Environment Variables:
-#   PGHOST, PGPORT, PGUSER, PGDATABASE, PGPASSWORD  - PostgreSQL connection
-#   S3_BUCKET, S3_ENDPOINT, S3_ACCESS_KEY, S3_SECRET_KEY, S3_REGION - S3 config
-#   S3_BACKUP_BUCKET       - Dedicated backup bucket (falls back to S3_BUCKET)
-#   BACKUP_RETENTION_DAYS  - Days to keep backups (default: 7)
-#   PROJECT_NAME           - Project name for backup naming
-#   BACKUP_MODE            - "walg" (default) or "pg_dump"
-# ============================================================================
-
-TIMESTAMP=$(date +%Y%m%d_%H%M%S)
-PROJECT="${PROJECT_NAME:-vibecarbon}"
-MODE="${BACKUP_MODE:-walg}"
-RETENTION_DAYS="${BACKUP_RETENTION_DAYS:-7}"
-
-echo "=== Vibecarbon Backup (${MODE}) ==="
-echo "Started at $(date)"
-
-# --- S3 CONFIGURATION ---
-UPLOAD_BUCKET="${S3_BACKUP_BUCKET:-${S3_BUCKET}}"
-export AWS_ACCESS_KEY_ID="${S3_ACCESS_KEY}"
-export AWS_SECRET_ACCESS_KEY="${S3_SECRET_KEY}"
-export AWS_DEFAULT_REGION="${S3_REGION:-us-east-1}"
-export AWS_ENDPOINT="${S3_ENDPOINT}"
-
-if [ -z "${UPLOAD_BUCKET}" ] || [ -z "${AWS_ACCESS_KEY_ID}" ] || [ -z "${AWS_SECRET_ACCESS_KEY}" ] || [ -z "${AWS_ENDPOINT}" ]; then
-  echo "Error: S3 configuration missing. Backup cannot proceed."
-  exit 1
-fi
-
-# --- WAL-G CONFIGURATION ---
-export WALG_S3_PREFIX="s3://${UPLOAD_BUCKET}/backups/${PROJECT}/walg"
-# Use the same credentials for WAL-G (it uses AWS_* by default, but we can be explicit)
-export WALE_S3_PREFIX="${WALG_S3_PREFIX}"
-# Parallelism for faster compression/upload
-export WALG_COMPRESSION_METHOD="lz4"
-export WALG_UPLOAD_CONCURRENCY=4
-
-if [ "${MODE}" = "walg" ]; then
-  echo "Creating full base backup with WAL-G..."
-  # WAL-G requires PGHOST to be reachable.
-  # If running in a sidecar, it might need to connect via socket or network.
-  # We assume PGHOST is set correctly (e.g. "db").
-  export PGDATA="/var/lib/postgresql/data"
-  
-  # Check if we can run backup-push. 
-  # Note: backup-push usually needs to run on the database server or have access to PGDATA
-  # if it's doing a direct filesystem scan. 
-  # If this script runs in a separate container, it uses the network protocol.
-  
-  wal-g backup-push "${PGDATA}"
-  
-  echo "Full base backup completed."
-  
-  echo "Cleaning up old backups (retention: ${RETENTION_DAYS} days)..."
-  wal-g delete before "$(date -d "-${RETENTION_DAYS} days" +%Y-%m-%dT%H:%M:%SZ)" --confirm
-  
-else
-  # --- LEGACY PG_DUMP FALLBACK ---
-  echo "Falling back to pg_dump..."
-  WORK_DIR="/tmp/backup_${TIMESTAMP}"
-  mkdir -p "${WORK_DIR}"
-  ARCHIVE_NAME="${PROJECT}_${TIMESTAMP}_full.tar.gz"
-
-  PGPASSWORD="${PGPASSWORD}" pg_dump \
-    -h "${PGHOST:-postgres}" \
-    -p "${PGPORT:-5432}" \
-    -U "${PGUSER:-supabase_admin}" \
-    "${PGDATABASE:-postgres}" | gzip > "${WORK_DIR}/postgres.sql.gz"
-
-  tar czf "/tmp/${ARCHIVE_NAME}" -C "${WORK_DIR}" .
-  
-  aws s3 cp "/tmp/${ARCHIVE_NAME}" \
-    "s3://${UPLOAD_BUCKET}/backups/${ARCHIVE_NAME}" \
-    --endpoint-url "${S3_ENDPOINT}"
-
-  rm -rf "${WORK_DIR}"
-  rm "/tmp/${ARCHIVE_NAME}"
-fi
-
-echo "=== Backup completed at $(date) ==="

package/carbon/runtime.Dockerfile

@@ -1,17 +0,0 @@
-# syntax=docker/dockerfile:1
-# Vibecarbon Runtime Base Image
-# This image contains the pre-installed node_modules for the Vibecarbon template.
-# Using this as a base for your app image reduces build times from minutes to seconds.
-
-FROM node:22-alpine3.23 AS base
-
-RUN npm install -g pnpm@9
-WORKDIR /app
-
-# Pre-install dependencies
-COPY package.json pnpm-lock.yaml ./
-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
-    pnpm install --frozen-lockfile
-
-# This image is meant to be a base, so we stop here.
-# The app build will continue FROM this image.

package/src/lib/deploy/compose/acme-verify.js

@@ -1,121 +0,0 @@
-/**
- * Verify Traefik has acquired Let's Encrypt certificates after compose-up,
- * and self-heal a stuck ACME state by restarting Traefik.
- *
- * Why this exists: Traefik's ACME engine bursts ~7 attempts in ~30s on
- * container start, then waits ~24h for the next renewal-check tick. If
- * the first burst fails (typically because DNS hasn't propagated yet —
- * see src/lib/dns-propagation.js for the cold-deploy fix), Traefik
- * settles into a state where acme.json has 0 issued certs and the
- * customer's browser sees the TRAEFIK DEFAULT CERT
- * (NET::ERR_CERT_AUTHORITY_INVALID).
- *
- * Cold deploys on v3.6.2+ avoid the original race by writing DNS before
- * compose-up. But customers stuck on v3.6.1's failure state can't recover
- * via warm redeploy alone — `docker compose up -d` is a no-op for
- * Traefik when nothing changed, so the broken in-memory state persists.
- *
- * This helper polls acme.json post-deploy expecting at least one cert;
- * if Traefik is still empty after ~90s, it restarts the container,
- * which forces a fresh ACME run against now-valid DNS. Healthy DNS
- * yields a cert in ~30s of the restart. If the restart still doesn't
- * produce a cert, we log a warning but don't fail the deploy — could
- * be LE rate limits, port 80 unreachable, etc., none of which a CLI
- * restart can fix.
- */
-
-import { sshRunAsync } from './index.js';
-
-const POLL_INTERVAL_MS = 5_000;
-const INITIAL_POLL_TIMEOUT_MS = 90_000;
-const POST_RESTART_POLL_TIMEOUT_MS = 90_000;
-
-/**
- * SSH into the server, exec `cat /letsencrypt/acme.json` inside the
- * Traefik container, return the count of issued certs (0 if anything
- * goes wrong — empty acme.json, malformed JSON, SSH error, etc.).
- */
-async function readAcmeCertCount(ip, sshKeyPath, projectName) {
-  let raw;
-  try {
-    raw = await sshRunAsync(
-      ip,
-      sshKeyPath,
-      `cd /opt/${projectName} && docker compose exec -T traefik cat /letsencrypt/acme.json 2>/dev/null`,
-      { timeout: 15_000 },
-    );
-  } catch {
-    return 0;
-  }
-  if (!raw || typeof raw !== 'string') return 0;
-  try {
-    const parsed = JSON.parse(raw);
-    const certs = parsed?.letsencrypt?.Certificates;
-    return Array.isArray(certs) ? certs.length : 0;
-  } catch {
-    return 0;
-  }
-}
-
-async function pollForCert(ip, sshKeyPath, projectName, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if ((await readAcmeCertCount(ip, sshKeyPath, projectName)) > 0) return true;
-    const remaining = deadline - Date.now();
-    if (remaining <= 0) break;
-    await new Promise((r) => setTimeout(r, Math.min(POLL_INTERVAL_MS, remaining)));
-  }
-  return false;
-}
-
-/**
- * Wait for Traefik to acquire at least one cert; if it doesn't within
- * the initial budget, restart the container and wait again. Logs progress
- * via the provided logger (typically @clack/prompts p.log). Never throws
- * — TLS issuance is best-effort; the deploy succeeds even if the cert
- * never lands (operator can investigate via SSH).
- *
- * @param {string} ip - server IP
- * @param {string} sshKeyPath - path to private key
- * @param {string} projectName - compose project name (= directory in /opt/)
- * @param {string} domain - configured domain (for log messages only)
- * @param {{ message?: Function, success?: Function, warn?: Function }} log
- */
-export async function ensureTraefikCert(ip, sshKeyPath, projectName, domain, log) {
-  log.message?.(`Verifying TLS certificate for ${domain}...`);
-  const acquired = await pollForCert(ip, sshKeyPath, projectName, INITIAL_POLL_TIMEOUT_MS);
-  if (acquired) {
-    log.success?.(`TLS certificate issued for ${domain}`);
-    return;
-  }
-  log.warn?.(
-    `Traefik has no certificate for ${domain} after ${INITIAL_POLL_TIMEOUT_MS / 1000}s — ` +
-      `restarting to clear stale ACME state and retry`,
-  );
-  try {
-    await sshRunAsync(ip, sshKeyPath, `cd /opt/${projectName} && docker compose restart traefik`, {
-      timeout: 60_000,
-    });
-  } catch (err) {
-    log.warn?.(`Traefik restart failed: ${err instanceof Error ? err.message : String(err)}`);
-    return;
-  }
-  const acquiredAfterRestart = await pollForCert(
-    ip,
-    sshKeyPath,
-    projectName,
-    POST_RESTART_POLL_TIMEOUT_MS,
-  );
-  if (acquiredAfterRestart) {
-    log.success?.(`TLS certificate issued for ${domain} after Traefik restart`);
-    return;
-  }
-  log.warn?.(
-    `Traefik still has no certificate for ${domain} after restart. ` +
-      `Check DNS resolution (dig +short ${domain}) and acme.json on the server. ` +
-      `If both look correct, ACME may complete in the background within minutes.`,
-  );
-}
-
-// Re-exported for tests; not part of the public surface.
-export const __test__ = { readAcmeCertCount, pollForCert };

package/src/lib/deploy/index.js

@@ -1,119 +0,0 @@
-/**
- * Deployment Module Registry
- *
- * Four deployment modes:
- * - compose: Docker Compose on single VPS (Fast + Pro)
- * - compose-ha: Docker Compose HA on 2 VPS with PostgreSQL replication (Fast + Pro)
- * - standard: Kubernetes single-region (Pro only)
- * - ha: Kubernetes multi-region HA (Pro only)
- */
-
-export {
-  deployComposeHA,
-  destroyComposeHA,
-  getComposeHAStatus,
-} from './compose/ha.js';
-export {
-  backupCompose,
-  deployCompose,
-  destroyCompose,
-  getComposeStatus,
-  redeployCompose,
-  restoreCompose,
-  setupServer,
-  setupServerFiles,
-  waitForSSH as waitForComposeSSH,
-} from './compose/index.js';
-export { deployK8sHA, destroyK8sHA, getK8sHAStatus, triggerFailover } from './k8s/ha/index.js';
-export { destroyK8s, getK8sStatus } from './k8s/index.js';
-export { deployK3s } from './k8s/k3s.js';
-
-/**
- * Get the appropriate deploy function based on mode
- * @param {string} mode - 'compose', 'compose-ha', 'kubernetes', or 'ha'
- * @returns {Promise<Function>} Deploy function
- */
-export function getDeployFunction(mode = 'compose') {
-  if (mode === 'ha') {
-    return import('./k8s/ha/index.js').then((m) => m.deployK8sHA);
-  }
-  if (mode === 'compose-ha') {
-    return import('./compose/ha.js').then((m) => m.deployComposeHA);
-  }
-  if (mode === 'kubernetes') {
-    return import('./k8s/k3s.js').then((m) => m.deployK3s);
-  }
-  return import('./compose/index.js').then((m) => m.deployCompose);
-}
-
-/**
- * Get the appropriate destroy function based on mode
- * @param {string} mode - 'compose', 'compose-ha', 'kubernetes', or 'ha'
- * @returns {Promise<Function>} Destroy function
- */
-export function getDestroyFunction(mode = 'compose') {
-  if (mode === 'ha') {
-    return import('./k8s/ha/index.js').then((m) => m.destroyK8sHA);
-  }
-  if (mode === 'compose-ha') {
-    return import('./compose/ha.js').then((m) => m.destroyComposeHA);
-  }
-  if (mode === 'kubernetes') {
-    return import('./k8s/index.js').then((m) => m.destroyK8s);
-  }
-  return import('./compose/index.js').then((m) => m.destroyCompose);
-}
-
-/**
- * Deployment mode information
- */
-export const MODES = {
-  compose: {
-    name: 'Compose',
-    displayName: 'Docker Compose',
-    description: 'Single-server deployment with Docker Compose',
-    tier: 'diamond',
-    features: [
-      'Docker Compose on single VPS',
-      'Auto HTTPS via Traefik/Caddy',
-      'All add-ons supported',
-      'Direct image transfer (no registry needed)',
-    ],
-  },
-  'compose-ha': {
-    name: 'Compose HA',
-    displayName: 'Docker Compose HA',
-    description: 'Multi-region Docker Compose with PostgreSQL replication',
-    tier: 'diamond',
-    features: [
-      'Docker Compose on 2 VPS',
-      'PostgreSQL streaming replication',
-      'Cloudflare health checks + failover',
-      'Auto HTTPS via Traefik',
-    ],
-  },
-  standard: {
-    name: 'Standard',
-    displayName: 'Kubernetes',
-    description: 'Single-region Kubernetes cluster',
-    tier: 'fullerene',
-    features: [
-      'Kubernetes cluster (1 master + workers)',
-      'Horizontal Pod Autoscaling',
-      'Traefik ingress with auto-SSL',
-      'Local Docker build & push',
-    ],
-  },
-  ha: {
-    name: 'HA',
-    displayName: 'Kubernetes HA',
-    description: 'Multi-region Kubernetes with high availability',
-    tier: 'fullerene',
-    features: [
-      'Multi-region clusters',
-      'PostgreSQL streaming replication',
-      'One-command failover',
-      'DNS health checks',
-    ],
-  },
-};

package/src/lib/kubectl.js

@@ -1,81 +0,0 @@
-/**
- * Kubectl helpers that avoid exposing secrets in argv.
- *
- * Any Kubernetes manifest containing secret data MUST use
- * kubectlApplyManifest so the bytes flow through stdin instead of the
- * shell command line.
- */
-
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-/**
- * Apply a Kubernetes manifest via `kubectl apply -f -` piped from stdin.
- * The manifest body (including any secret data) never appears in argv.
- *
- * @param {object} manifest - Kubernetes resource as a plain object
- * @param {object} [options]
- * @param {string} [options.namespace]
- * @param {object} [options.env]
- * @param {number} [options.timeout=60000]
- * @returns {string} - kubectl stdout
- */
-export function kubectlApplyManifest(manifest, options = {}) {
-  const yaml = JSON.stringify(manifest);
-  const args = ['apply', '-f', '-'];
-  if (options.namespace) args.push('-n', options.namespace);
-  const res = spawnSync('kubectl', args, {
-    input: yaml,
-    encoding: 'utf-8',
-    env: options.env ?? process.env,
-    timeout: options.timeout ?? 60_000,
-  });
-  if (res.status !== 0) {
-    const stderr = (res.stderr || '').trim();
-    const exitCode = res.status ?? '(null)';
-    // NEVER include res.stdout — kubectl may echo the submitted manifest on
-    // failure, and the manifest may contain secret data.
-    throw new Error(`kubectl apply failed (exit ${exitCode}): ${stderr || '(no stderr)'}`);
-  }
-  return res.stdout;
-}
-
-/**
- * Apply a strategic-merge patch to a resource via a temp patch file.
- * Use this instead of interpolating JSON into a shell command line.
- *
- * @param {string} resourceRef - e.g. 'deployment/app' or 'serviceaccount/default'
- * @param {string} namespace
- * @param {object} patch - patch object
- * @param {object} [options]
- * @param {string} [options.type='strategic'] - 'strategic' | 'merge' | 'json'
- * @param {object} [options.env]
- * @param {boolean} [options.ignoreError]
- * @param {number} [options.timeout=60000]
- * @returns {string|null} - kubectl stdout, or null when ignoreError + failure
- */
-export function kubectlPatch(resourceRef, namespace, patch, options = {}) {
-  const { type = 'strategic', env, ignoreError = false, timeout = 60_000 } = options;
-  const dir = mkdtempSync(join(tmpdir(), 'vibecarbon-patch-'));
-  const patchFile = join(dir, 'patch.json');
-  try {
-    writeFileSync(patchFile, JSON.stringify(patch), { mode: 0o600 });
-    const args = ['patch', resourceRef, '-n', namespace, '--type', type, '--patch-file', patchFile];
-    const res = spawnSync('kubectl', args, {
-      encoding: 'utf-8',
-      env: env ?? process.env,
-      timeout,
-    });
-    if (res.status !== 0) {
-      if (ignoreError) return null;
-      const stderr = (res.stderr || '').trim();
-      const exitCode = res.status ?? '(null)';
-      throw new Error(`kubectl patch failed (exit ${exitCode}): ${stderr || '(no stderr)'}`);
-    }
-    return res.stdout;
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}