vibecarbon 0.3.1 → 0.4.0

package/src/restore.js

@@ -35,15 +35,9 @@ import { getS3Credentials } from './lib/hetzner-guided-setup.js';
 import { requireLicense } from './lib/licensing/index.js';
 import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
+import { listPodBackups } from './lib/pod-backups.js';
 import { assertInProjectDir } from './lib/project-guard.js';
-import {
-  getPostgresPod,
-  getSSHKeyPath,
-  scpUpload,
-  sshKubectl,
-  sshRun,
-  sshRunScript,
-} from './lib/ssh.js';
+import { getPostgresPod, getSSHKeyPath, scpUpload, sshKubectl, sshRunScript } from './lib/ssh.js';
 import { createTracker } from './lib/tracker.js';
 import { validateBackupFilename } from './lib/validators.js';
 import { VERSION } from './lib/version.js';
@@ -97,45 +91,6 @@ const SPEC = {
   ],
 };
 
-// ============================================================================
-// KUBECTL HELPERS (k8s mode)
-// ============================================================================
-
-function listRemoteBackups(ip, sshKeyPath) {
-  const pod = getPostgresPod(ip, sshKeyPath);
-
-  try {
-    const output = sshKubectl(ip, sshKeyPath, [
-      'exec',
-      '-n',
-      'vibecarbon',
-      pod,
-      '--',
-      'sh',
-      '-c',
-      'ls -lt /backups/*_full.tar.gz /backups/*.sql.gz 2>/dev/null || echo NO_BACKUPS',
-    ]);
-
-    if (output === 'NO_BACKUPS' || !output) {
-      return [];
-    }
-
-    return output
-      .split('\n')
-      .filter((line) => line.includes('.tar.gz') || line.includes('.sql.gz'))
-      .map((line) => {
-        const parts = line.split(/\s+/);
-        return {
-          size: parts[4],
-          date: `${parts[5]} ${parts[6]} ${parts[7]}`,
-          name: parts[parts.length - 1].replace('/backups/', ''),
-        };
-      });
-  } catch {
-    return [];
-  }
-}
-
 // ============================================================================
 // RESTORE OPERATIONS (k8s mode)
 // ============================================================================
@@ -175,175 +130,8 @@ function verifyPostgres(ip, sshKeyPath) {
   ]);
 }
 
-/**
- * Restore from a full archive (.tar.gz containing postgres.sql.gz + optional storage.tar.gz)
- */
-function restoreFromArchive(ip, sshKeyPath, remotePath) {
-  const pod = getPostgresPod(ip, sshKeyPath);
-
-  // Extract the archive on the server — argv form; remotePath is never shell-interpolated.
-  sshRun(ip, sshKeyPath, ['mkdir', '-p', '/tmp/restore']);
-  // GNU tar strips leading `/` by default (no `-P` / `--absolute-names`),
-  // so absolute paths in a hostile archive never escape /tmp/restore.
-  sshRun(ip, sshKeyPath, [
-    'tar',
-    '--no-xattrs',
-    '--no-same-owner',
-    '-xzf',
-    remotePath,
-    '-C',
-    '/tmp/restore',
-  ]);
-
-  // Check archive contents
-  const contents = sshRun(ip, sshKeyPath, ['ls', '/tmp/restore/']);
-
-  // Restore database
-  if (contents.includes('postgres.sql.gz')) {
-    sshKubectl(ip, sshKeyPath, [
-      'cp',
-      '/tmp/restore/postgres.sql.gz',
-      `vibecarbon/${pod}:/tmp/postgres.sql.gz`,
-    ]);
-    sshKubectl(ip, sshKeyPath, [
-      'exec',
-      '-n',
-      'vibecarbon',
-      pod,
-      '--',
-      'sh',
-      '-c',
-      'gunzip -c /tmp/postgres.sql.gz | psql -U supabase_admin postgres',
-    ]);
-    sshKubectl(ip, sshKeyPath, [
-      'exec',
-      '-n',
-      'vibecarbon',
-      pod,
-      '--',
-      'rm',
-      '-f',
-      '/tmp/postgres.sql.gz',
-    ]);
-  }
-
-  // Restore storage files if present and using file backend
-  if (contents.includes('storage.tar.gz')) {
-    // kubectl get returns empty string if STORAGE_BACKEND env var is unset;
-    // default to 'file' so the legacy single-backend path still works.
-    let storageBackend;
-    try {
-      storageBackend = sshKubectl(ip, sshKeyPath, [
-        'get',
-        'deployment',
-        'storage',
-        '-n',
-        'vibecarbon',
-        '-o',
-        'jsonpath={.spec.template.spec.containers[0].env[?(@.name=="STORAGE_BACKEND")].value}',
-      ]);
-    } catch {
-      storageBackend = 'file';
-    }
-    if (!storageBackend) storageBackend = 'file';
-
-    if (storageBackend === 'file') {
-      const storagePod = sshKubectl(ip, sshKeyPath, [
-        'get',
-        'pods',
-        '-n',
-        'vibecarbon',
-        '-l',
-        'app.kubernetes.io/name=supabase-storage',
-        '-o',
-        'jsonpath={.items[0].metadata.name}',
-      ]);
-
-      sshKubectl(ip, sshKeyPath, [
-        'cp',
-        '/tmp/restore/storage.tar.gz',
-        `vibecarbon/${storagePod}:/tmp/storage.tar.gz`,
-      ]);
-      sshKubectl(ip, sshKeyPath, [
-        'exec',
-        '-n',
-        'vibecarbon',
-        storagePod,
-        '--',
-        'sh',
-        '-c',
-        'tar --no-xattrs --no-same-owner -xzf /tmp/storage.tar.gz -C / && rm -f /tmp/storage.tar.gz',
-      ]);
-    } else {
-      p.log.info('Storage backend is S3 — skipping file restore (files already in S3)');
-    }
-  }
-
-  // Cleanup
-  sshRun(ip, sshKeyPath, ['rm', '-rf', '/tmp/restore']);
-}
-
-/**
- * Restore from a legacy .sql.gz file (database only)
- */
-function restoreFromSqlGz(ip, sshKeyPath, backupName) {
-  const pod = getPostgresPod(ip, sshKeyPath);
-
-  // backupName is validated via validateBackupFilename at entry; still pass it
-  // as a positional sh arg so the remote shell never expands it as code.
-  sshKubectl(ip, sshKeyPath, [
-    'exec',
-    '-n',
-    'vibecarbon',
-    pod,
-    '--',
-    'sh',
-    '-c',
-    'gunzip -c "/backups/$1" | psql -U supabase_admin postgres',
-    '_',
-    backupName,
-  ]);
-}
-
-async function restoreFromRemote(ip, sshKeyPath, backupName) {
-  scaleDownApp(ip, sshKeyPath);
-
-  if (backupName.endsWith('_full.tar.gz')) {
-    restoreFromArchive(ip, sshKeyPath, `/tmp/${backupName}`);
-  } else {
-    restoreFromSqlGz(ip, sshKeyPath, backupName);
-  }
-
-  scaleUpApp(ip, sshKeyPath);
-  verifyPostgres(ip, sshKeyPath);
-}
-
-async function uploadAndRestore(ip, sshKeyPath, localFile) {
-  const filename = basename(localFile);
-
-  // Upload local file to server
-  scpUpload(ip, sshKeyPath, localFile, `/tmp/${filename}`);
-
-  scaleDownApp(ip, sshKeyPath);
-
-  if (filename.endsWith('_full.tar.gz')) {
-    restoreFromArchive(ip, sshKeyPath, `/tmp/${filename}`);
-  } else if (filename.endsWith('.sql.gz')) {
-    const pod = getPostgresPod(ip, sshKeyPath);
-    sshKubectl(ip, sshKeyPath, [
-      'cp',
-      `/tmp/${filename}`,
-      `vibecarbon/${pod}:/backups/${filename}`,
-    ]);
-    restoreFromSqlGz(ip, sshKeyPath, filename);
-  }
-
-  // Clean up temp file on host
-  sshRun(ip, sshKeyPath, ['rm', '-f', `/tmp/${filename}`]);
-
-  scaleUpApp(ip, sshKeyPath);
-  verifyPostgres(ip, sshKeyPath);
-}
+// (k8s pg_dump restore helpers removed — k8s restore is now wal-g-native via
+// the db pod's init container; see runK8sRestore below.)
 
 // ============================================================================
 // SOURCE INTERPRETATION
@@ -511,19 +299,32 @@ export async function run(args) {
   // restores) ask for "the most recent" without first listing + parsing
   // names from `vibecarbon backup -l`.
   const wantsLatest = values.source === 'latest';
-  const chosenSource =
-    !wantsLatest && values.source
-      ? classifySource(/** @type {string} */ (values.source))
-      : await pickInteractiveSource({
-          isCompose,
-          envName,
-          projectName,
-          serverIp,
-          sshKeyPath,
-          s3,
-          useS3,
-          yes: wantsLatest || !!values.y,
-        });
+  let chosenSource;
+  if (!wantsLatest && values.source) {
+    chosenSource = classifySource(/** @type {string} */ (values.source));
+  } else if (wantsLatest && !isCompose) {
+    // k8s restore is wal-g-native: `latest` resolves to the LATEST base backup
+    // INSIDE the cluster — the db pod's walg-restore init container runs
+    // `wal-g backup-fetch LATEST` (see runK8sRestore). pickInteractiveSource
+    // lists pg_dump `*_full.tar.gz` backups via listS3Backups, which cannot see
+    // wal-g `base_*` objects, so routing k8s `-source latest` through it wrongly
+    // exits "No backups found in S3" even though a wal-g base backup exists.
+    // Hand runK8sRestore the `latest` sentinel directly and let wal-g resolve
+    // it. (RCA 2026-05-31: e2e k8s/k8s-ha restore step — never reached before
+    // the backup chain (#4/#5/#6) was fixed.)
+    chosenSource = { kind: 's3', name: 'latest' };
+  } else {
+    chosenSource = await pickInteractiveSource({
+      isCompose,
+      envName,
+      projectName,
+      serverIp,
+      sshKeyPath,
+      s3,
+      useS3,
+      yes: wantsLatest || !!values.y,
+    });
+  }
 
   if (!chosenSource) {
     p.log.error('No backup selected.');
@@ -579,8 +380,6 @@ export async function run(args) {
         envName,
         serverIp,
         sshKeyPath,
-        s3,
-        useS3,
       });
     }
   } catch (error) {
@@ -662,7 +461,7 @@ async function runList({ isCompose, envName, projectName, serverIp, sshKeyPath }
   }
 
   // K8s pod fallback
-  const backups = listRemoteBackups(serverIp, sshKeyPath);
+  const backups = listPodBackups(serverIp, sshKeyPath);
   printBackupList(backups, envName);
 }
 
@@ -757,7 +556,7 @@ async function pickInteractiveSource({
 
   // K8s pod fallback
   s.start('Fetching available backups');
-  const backups = listRemoteBackups(serverIp, sshKeyPath);
+  const backups = listPodBackups(serverIp, sshKeyPath);
   s.stop('Backups retrieved');
   if (backups.length === 0) {
     p.log.error('No backups found on the server.');
@@ -822,42 +621,76 @@ async function runComposeRestore({
   void envName;
 }
 
-async function runK8sRestore({ s, chosenSource, envName, serverIp, sshKeyPath, s3, useS3 }) {
-  s.start('Restoring database (app will be temporarily unavailable)');
+// k8s restore is wal-g-native: postgres + wal-g live in the supabase-db pod,
+// which continuously archives WAL + base backups to S3. Restore = set a
+// RESTORE_TARGET marker on vibecarbon-secrets → bounce the db StatefulSet so
+// its walg-restore init container runs `wal-g backup-fetch` into PGDATA before
+// postgres starts → clear the marker. No bytes flow through the operator and
+// no pg_dump/kubectl-cp; wal-g pulls from S3 inside the cluster. Mirrors the
+// compose wal-g restore, adapted to the StatefulSet/init-container shape.
+const DB_STATEFULSET = 'supabase-supabase-db';
+
+/** Set or clear the RESTORE_TARGET marker the init container reads. */
+function setRestoreMarker(ip, sshKeyPath, value) {
+  sshKubectl(ip, sshKeyPath, [
+    'patch',
+    'secret',
+    'vibecarbon-secrets',
+    '-n',
+    'vibecarbon',
+    '--type=merge',
+    '-p',
+    JSON.stringify({ stringData: { RESTORE_TARGET: value } }),
+  ]);
+}
 
+async function runK8sRestore({ s, chosenSource, envName, serverIp, sshKeyPath }) {
   if (chosenSource.kind === 'local') {
-    if (!chosenSource.path.endsWith('.sql.gz') && !chosenSource.path.endsWith('.tar.gz')) {
-      throw new Error('Backup file must be a .sql.gz or .tar.gz file');
-    }
-    await perfAsync('restore.uploadAndRestore', () =>
-      uploadAndRestore(serverIp, sshKeyPath, chosenSource.path),
-    );
-    s.stop('Database restored');
-  } else if (useS3) {
-    s.message('Downloading backup from S3');
-    const tempPath = join(process.cwd(), `.restore-tmp-${chosenSource.name}`);
-    await perfAsync('restore.downloadS3', () =>
-      downloadS3Backup(s3, `backups/${chosenSource.name}`, tempPath),
-    );
-    s.message('Uploading backup to server');
-    await perfAsync('restore.scpUpload', async () =>
-      scpUpload(serverIp, sshKeyPath, tempPath, `/tmp/${chosenSource.name}`),
+    throw new Error(
+      'k8s restore is wal-g-based and pulls from S3 — local backup files are not supported. Use `-source latest` (or a timestamp for PITR).',
     );
-    try {
-      unlinkSync(tempPath);
-    } catch {
-      // ignore cleanup errors
-    }
-    s.message('Restoring database');
-    await perfAsync('restore.restoreFromRemote', () =>
-      restoreFromRemote(serverIp, sshKeyPath, chosenSource.name),
-    );
-    s.stop('Database restored');
-  } else {
-    // Pod-only fallback: backup name refers to a file already in the pod.
-    await restoreFromRemote(serverIp, sshKeyPath, chosenSource.name);
-    s.stop('Database restored');
   }
+  // wal-g target: 'latest' → LATEST base backup; otherwise treat the source
+  // name as an ISO-8601 timestamp for point-in-time recovery.
+  const target =
+    chosenSource.name === 'latest' || !chosenSource.name ? 'latest' : chosenSource.name;
+
+  s.start('Restoring database via wal-g (app will be temporarily unavailable)');
+  // 1. Mark the restore so the db pod's init container fetches on next boot.
+  setRestoreMarker(serverIp, sshKeyPath, target);
+  // 2. Quiesce the app so it isn't querying mid-swap.
+  await perfAsync('restore.scaleDownApp', async () => scaleDownApp(serverIp, sshKeyPath));
+  try {
+    // 3. Bounce the db StatefulSet → walg-restore init container clears PGDATA
+    //    and runs `wal-g backup-fetch` before postgres starts.
+    s.message('Fetching from S3 + recovering (wal-g)');
+    await perfAsync('restore.walgFetch', async () => {
+      sshKubectl(serverIp, sshKeyPath, [
+        'rollout',
+        'restart',
+        `statefulset/${DB_STATEFULSET}`,
+        '-n',
+        'vibecarbon',
+      ]);
+      sshKubectl(serverIp, sshKeyPath, [
+        'rollout',
+        'status',
+        `statefulset/${DB_STATEFULSET}`,
+        '-n',
+        'vibecarbon',
+        '--timeout=600s',
+      ]);
+    });
+    // 4. Confirm postgres accepts connections post-recovery.
+    await perfAsync('restore.verifyPostgres', async () => verifyPostgres(serverIp, sshKeyPath));
+  } finally {
+    // 5. Always clear the marker so an unrelated future pod restart does NOT
+    //    re-fetch and wipe live data. Runs even if the restore failed.
+    setRestoreMarker(serverIp, sshKeyPath, '');
+  }
+  // 6. Bring the app back.
+  await perfAsync('restore.scaleUpApp', async () => scaleUpApp(serverIp, sshKeyPath));
+  s.stop('Database restored');
 
   p.log.success('Restore completed successfully');
   p.log.info('The application has been scaled back up.');

package/src/scale.js

@@ -25,6 +25,7 @@ import { c, printBanner } from './lib/colors.js';
 import { runCommand } from './lib/command.js';
 import { loadCredentials, saveProjectConfig } from './lib/config.js';
 import { buildCostBreakdown, formatCostLines } from './lib/cost.js';
+import { useDnsChallenge } from './lib/deploy/acme.js';
 import {
   backupCompose,
   dockerLoginOnServer,
@@ -265,6 +266,11 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
   const sshKeyPath = join(process.cwd(), '.vibecarbon', `deploy_key_${environment}`);
   const sshPubKeyPath = `${sshKeyPath}.pub`;
   const domain = envConfig.domain || null;
+  // Managed-DNS (cloudflare/hetzner) deploys issue certs via ACME DNS-01, so
+  // the new/recreated server needs the DNS-01 Traefik override and has no
+  // HTTP-01 race to wait on or reset. `manual` keeps HTTP-01.
+  const dnsProvider = envConfig.dnsProvider || envConfig.dns?.provider || null;
+  const dnsChallenge = useDnsChallenge(dnsProvider);
 
   // Read SSH public key and register/reuse in Hetzner
   const sshPubKey = readFileSync(sshPubKeyPath, 'utf-8').trim();
@@ -383,6 +389,14 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
           n8n: services.n8n,
           metabase: services.metabase,
           redis: services.redis,
+          // DNS-01: ship the Traefik override + re-affirm ACME_DNS_PROVIDER.
+          // The provider token flows through `envOverrides: oldEnv` (the
+          // original deploy baked it into the server .env); tokens are passed
+          // too so a fresh bundle still works if the old server was unreachable.
+          dnsChallenge,
+          dnsProvider,
+          hetznerApiToken: apiToken,
+          cloudflareApiToken: loadCredentials().cloudflare?.apiToken || null,
           // Replay every env var the old server had. renderBundle's existing
           // envOverrides path overlays these onto the project-local `.env`
           // baseline, then re-applies the deploy-time overrides (DOMAIN,
@@ -508,34 +522,41 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       );
       s.stop('Database restored');
 
-      // 9a. Update DNS BEFORE recreating services so Traefik can get ACME certs.
-      // Traefik attempts HTTP-01 challenges immediately on startup; if DNS still
-      // points to the old server, all challenges fail and the next retry is 30+ min.
+      // 9a. Update DNS to the new server. On HTTP-01 this must happen BEFORE
+      // recreating services (Traefik challenges the A record on startup; a
+      // stale record fails all challenges with a 30+ min retry). On DNS-01 the
+      // ordering is irrelevant — lego validates a TXT record, not the A record.
       if (domain) {
         s.start('Updating DNS to new server...');
         await perfAsync('scale.updateDNS', () => updateDNS(envConfig, apiToken, domain, newIp));
         s.stop('DNS updated');
 
-        // Poll until Cloudflare/Google DNS returns the new IP (max 120s).
-        // Fixed waits are unreliable — propagation speed varies per resolver.
-        s.start('Waiting for DNS propagation...');
-        const dnsOk = await perfAsync('scale.waitForDNS', () =>
-          waitForDNSPropagation(domain, newIp, 120_000),
-        );
-        s.stop(dnsOk ? 'DNS propagated' : 'DNS propagation timed out (proceeding anyway)');
+        // HTTP-01 only: poll until public resolvers return the new IP (max
+        // 120s) so Traefik's first challenge sees it. DNS-01 doesn't gate on
+        // A-record propagation, so skip the wait.
+        if (!dnsChallenge) {
+          s.start('Waiting for DNS propagation...');
+          const dnsOk = await perfAsync('scale.waitForDNS', () =>
+            waitForDNSPropagation(domain, newIp, 120_000),
+          );
+          s.stop(dnsOk ? 'DNS propagated' : 'DNS propagation timed out (proceeding anyway)');
+        }
       }
 
-      // 9b. Reset ACME state so Traefik retries cert challenges with the correct DNS.
-      // startComposeStack (step 6) ran before DNS was updated — all challenges failed
-      // and are cached as errors in the letsencrypt_data volume.
-      // Use docker compose exec (Traefik is already running) instead of pulling alpine.
+      // 9b. HTTP-01 only: reset ACME state so Traefik retries challenges with
+      // the corrected DNS — step 6's startComposeStack ran before the A record
+      // moved, so failed challenges are cached as errors in letsencrypt_data.
+      // DNS-01 has no such cached HTTP-01 failure to clear (and wiping acme.json
+      // would force a needless re-issue), so skip it.
       // Uses an SCP'd script so quoting/redirection stay intact without local shell.
-      sshRunScript(
-        newIp,
-        sshKeyPath,
-        `cd ${remoteDir} && docker compose exec -T traefik sh -c 'echo "{}" > /letsencrypt/acme.json && chmod 600 /letsencrypt/acme.json'`,
-        { timeout: 30_000 },
-      );
+      if (!dnsChallenge) {
+        sshRunScript(
+          newIp,
+          sshKeyPath,
+          `cd ${remoteDir} && docker compose exec -T traefik sh -c 'echo "{}" > /letsencrypt/acme.json && chmod 600 /letsencrypt/acme.json'`,
+          { timeout: 30_000 },
+        );
+      }
 
       // 9c. Recreate all services after restore so they reconnect to the restored DB.
       // Include all feature compose file flags so feature containers (redis, n8n,
@@ -545,6 +566,8 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       const composeFlags = [
         '-f docker-compose.yml',
         '-f docker-compose.prod.yml',
+        // DNS-01 override must follow prod.yml so it replaces the Traefik command.
+        ...(dnsChallenge ? ['-f docker-compose.dns01.prod.yml'] : []),
         ...(services.observability
           ? ['-f docker-compose.observability.yml', '-f docker-compose.observability.prod.yml']
           : []),

package/carbon/backup/Dockerfile

@@ -1,75 +0,0 @@
-# syntax=docker/dockerfile:1
-FROM ubuntu:22.04
-
-# Base image is ubuntu, not alpine, because wal-g v3.x stopped publishing
-# alpine-musl prebuilt binaries — only ubuntu glibc builds remain. We need
-# wal-g v3+ for the current S3 + Postgres 16 wire protocol support.
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-# Install PostgreSQL 16 client + utilities. PG 16 isn't in the default
-# ubuntu 22.04 repos; pull it from the postgresql apt repo. AWS CLI is
-# installed as the standalone v2 binary further down (the apt-shipped
-# `awscli` is v1 and pulls ~500MB of Python deps; v2 is ~80MB self-
-# contained and the only version AWS itself supports for new code).
-#
-# apt cache mount: keeps /var/cache/apt populated across rebuilds so
-# `apt-get install` reuses .deb files. The cache lives outside the layer,
-# so we don't need the historical `rm -rf /var/lib/apt/lists/*` to keep
-# the final image small — that's still done below as a belt-and-braces
-# measure for cases where the cache mount isn't honored (e.g. legacy
-# `docker build` without BuildKit).
-# `sharing=locked` serializes parallel builds against the same cache
-# (apt's lock semantics expect exclusive access).
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates curl gnupg lsb-release \
-        bash tar gzip unzip && \
-    install -d /usr/share/postgresql-common/pgdg && \
-    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
-        -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc && \
-    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt jammy-pgdg main" \
-        > /etc/apt/sources.list.d/pgdg.list && \
-    apt-get update && apt-get install -y --no-install-recommends \
-        postgresql-client-16
-
-# Install AWS CLI v2 standalone binary (~80MB) instead of `apt-get install
-# awscli` (v1 with ~500MB of Python/boto3 deps). Saves ~400MB on the
-# final image, which matters because the backup image is sideloaded to
-# every k3s node (~6 nodes in HA = ~2.4GB less network per deploy).
-# --fail makes curl exit non-zero on HTTP 4xx/5xx instead of piping a
-# 404 HTML body into unzip.
-RUN curl -fL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip \
-        -o /tmp/awscli.zip && \
-    unzip -q /tmp/awscli.zip -d /tmp && \
-    /tmp/aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli && \
-    rm -rf /tmp/aws /tmp/awscli.zip
-
-# Install WAL-G v3.0.5 (ubuntu 22.04 amd64 build).
-# --fail makes curl exit non-zero on HTTP 4xx/5xx instead of piping a 404
-# HTML body into tar (the previous v3.0.3-alpine URL 404'd, tar saw "<html>"
-# and errored "not in gzip format" — observed 2026-04-26 matrix run #2).
-RUN curl -fL https://github.com/wal-g/wal-g/releases/download/v3.0.5/wal-g-pg-ubuntu-22.04-amd64.tar.gz \
-        | tar -xz && \
-    mv wal-g-pg-ubuntu-22.04-amd64 /usr/local/bin/wal-g && \
-    chmod +x /usr/local/bin/wal-g
-
-# Security: non-root system user. We can't reuse the name `backup` —
-# ubuntu pre-populates a `backup` system group (GID 34, used for system
-# backup operations) and `groupadd backup` errors with exit 9 ("group
-# 'backup' already exists"). The previous alpine version sidestepped
-# this because alpine doesn't ship the same default. Use a unique name
-# (`vbbackup`) and let --system pick a free system GID/UID.
-# The k8s manifest doesn't pin runAsUser so any UID works.
-RUN groupadd --system vbbackup && \
-    useradd --system -g vbbackup -s /usr/sbin/nologin -M vbbackup
-
-# Copy backup script
-COPY backup.sh /usr/local/bin/backup.sh
-RUN chmod +x /usr/local/bin/backup.sh
-
-USER vbbackup
-
-# CronJob handles scheduling — script runs once and exits
-ENTRYPOINT ["/usr/local/bin/backup.sh"]