vibecarbon 0.3.1 → 0.5.0

package/src/scale.js

@@ -13,8 +13,7 @@
  * prompt covers that need without tying up two top-level letters.
  */
 
-import { existsSync, readFileSync, unlinkSync } from 'node:fs';
-import os from 'node:os';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import * as p from '@clack/prompts';
 import { getGHCRCredentials } from './lib/build.js';
@@ -25,6 +24,7 @@ import { c, printBanner } from './lib/colors.js';
 import { runCommand } from './lib/command.js';
 import { loadCredentials, saveProjectConfig } from './lib/config.js';
 import { buildCostBreakdown, formatCostLines } from './lib/cost.js';
+import { useDnsChallenge } from './lib/deploy/acme.js';
 import {
   backupCompose,
   dockerLoginOnServer,
@@ -48,7 +48,7 @@ import { assertInProjectDir } from './lib/project-guard.js';
 import { HetznerProvider } from './lib/providers/hetzner.js';
 import { buildComposeTypeOptions, buildSimpleTypeOptions } from './lib/server-types.js';
 import { parseDotenv } from './lib/shell.js';
-import { scpDownload, scpUpload, sshRun, sshRunScript } from './lib/ssh.js';
+import { sshRun, sshRunScript } from './lib/ssh.js';
 import { VERSION } from './lib/version.js';
 
 // ============================================================================
@@ -265,6 +265,11 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
   const sshKeyPath = join(process.cwd(), '.vibecarbon', `deploy_key_${environment}`);
   const sshPubKeyPath = `${sshKeyPath}.pub`;
   const domain = envConfig.domain || null;
+  // Managed-DNS (cloudflare/hetzner) deploys issue certs via ACME DNS-01, so
+  // the new/recreated server needs the DNS-01 Traefik override and has no
+  // HTTP-01 race to wait on or reset. `manual` keeps HTTP-01.
+  const dnsProvider = envConfig.dnsProvider || envConfig.dns?.provider || null;
+  const dnsChallenge = useDnsChallenge(dnsProvider);
 
   // Read SSH public key and register/reuse in Hetzner
   const sshPubKey = readFileSync(sshPubKeyPath, 'utf-8').trim();
@@ -290,12 +295,14 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       envConfig.deployMode === 'compose-ha' ? `${server.role} (${server.ip})` : server.ip;
     const s = p.spinner();
 
-    // 1. Backup database on old server (--clean so restore can run without DROP DATABASE)
+    // 1. Backup database on old server via wal-g (pushes directly to S3)
     s.start(`Backing up database on ${label}...`);
-    const archiveName = await perfAsync('scale.backupOldServer', async () =>
-      backupCompose(server.ip, sshKeyPath, projectName, { clean: true }),
+    await perfAsync('scale.backupOldServer', async () =>
+      backupCompose(server.ip, sshKeyPath, projectName, {
+        retain: envConfig.backup?.retentionDays,
+      }),
     );
-    s.stop(`Database backed up: ${archiveName}`);
+    s.stop('Database backed up (wal-g base backup pushed to S3)');
 
     // 2. Create new server. user_data front-loads ufw + unattended-upgrades
     // during boot so setupServer is a ~2s marker-file probe below.
@@ -383,6 +390,14 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
           n8n: services.n8n,
           metabase: services.metabase,
           redis: services.redis,
+          // DNS-01: ship the Traefik override + re-affirm ACME_DNS_PROVIDER.
+          // The provider token flows through `envOverrides: oldEnv` (the
+          // original deploy baked it into the server .env); tokens are passed
+          // too so a fresh bundle still works if the old server was unreachable.
+          dnsChallenge,
+          dnsProvider,
+          hetznerApiToken: apiToken,
+          cloudflareApiToken: loadCredentials().cloudflare?.apiToken || null,
           // Replay every env var the old server had. renderBundle's existing
           // envOverrides path overlays these onto the project-local `.env`
           // baseline, then re-applies the deploy-time overrides (DOMAIN,
@@ -473,69 +488,59 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       );
       s.stop('Services started');
 
-      // 7. Wait for DB to be ready (backup uses --clean so no DROP DATABASE needed)
-      s.start('Waiting for database to be ready...');
-      const remoteDir = `/opt/${projectName}`;
-      // Shell loop + `$(...)` needs a real shell; projectName is basename-validated.
-      sshRunScript(
-        newIp,
-        sshKeyPath,
-        `cd ${remoteDir} && for i in $(seq 1 30); do docker compose exec -T db pg_isready -U postgres >/dev/null 2>&1 && break || sleep 2; done`,
-        { timeout: 120_000 },
-      );
-      s.stop('Database ready for restore');
-
-      // 8. Transfer backup from old server to new server
-      s.start('Transferring backup to new server...');
-      const localTmpBackup = join(os.tmpdir(), archiveName);
-      try {
-        scpDownload(server.ip, sshKeyPath, `${remoteDir}/backups/${archiveName}`, localTmpBackup);
-        sshRun(newIp, sshKeyPath, ['mkdir', '-p', `${remoteDir}/backups`]);
-        scpUpload(newIp, sshKeyPath, localTmpBackup, `${remoteDir}/backups/${archiveName}`);
-      } finally {
-        try {
-          unlinkSync(localTmpBackup);
-        } catch {
-          // ignore cleanup errors
-        }
-      }
-      s.stop('Backup transferred');
-
-      // 9. Restore database on new server
-      s.start('Restoring database...');
+      // 7. Restore database on new server from S3 via wal-g. The base backup +
+      //    WAL were pushed straight to S3 by step 1's backupCompose, so the
+      //    restore fetches LATEST directly — no local archive to transfer.
+      //    S3 credentials come from the db container's env (sourced from .env)
+      //    so no opts are needed; restoreCompose handles its own verify loop
+      //    (pg_isready + pg_is_in_recovery() = f) before returning.
+      s.start('Restoring database from S3 via wal-g...');
       await perfAsync('scale.restoreDb', async () =>
-        restoreCompose(newIp, sshKeyPath, projectName, archiveName),
+        restoreCompose(newIp, sshKeyPath, projectName, 'latest'),
       );
       s.stop('Database restored');
 
-      // 9a. Update DNS BEFORE recreating services so Traefik can get ACME certs.
-      // Traefik attempts HTTP-01 challenges immediately on startup; if DNS still
-      // points to the old server, all challenges fail and the next retry is 30+ min.
+      // Remote compose project dir on the new server — used by the ACME reset
+      // and the post-restore service recreate below. (Previously declared by a
+      // since-removed pre-restore readiness step; restoreCompose now owns that
+      // wait, so declare it here.)
+      const remoteDir = `/opt/${projectName}`;
+
+      // 9a. Update DNS to the new server. On HTTP-01 this must happen BEFORE
+      // recreating services (Traefik challenges the A record on startup; a
+      // stale record fails all challenges with a 30+ min retry). On DNS-01 the
+      // ordering is irrelevant — lego validates a TXT record, not the A record.
       if (domain) {
         s.start('Updating DNS to new server...');
         await perfAsync('scale.updateDNS', () => updateDNS(envConfig, apiToken, domain, newIp));
         s.stop('DNS updated');
 
-        // Poll until Cloudflare/Google DNS returns the new IP (max 120s).
-        // Fixed waits are unreliable — propagation speed varies per resolver.
-        s.start('Waiting for DNS propagation...');
-        const dnsOk = await perfAsync('scale.waitForDNS', () =>
-          waitForDNSPropagation(domain, newIp, 120_000),
-        );
-        s.stop(dnsOk ? 'DNS propagated' : 'DNS propagation timed out (proceeding anyway)');
+        // HTTP-01 only: poll until public resolvers return the new IP (max
+        // 120s) so Traefik's first challenge sees it. DNS-01 doesn't gate on
+        // A-record propagation, so skip the wait.
+        if (!dnsChallenge) {
+          s.start('Waiting for DNS propagation...');
+          const dnsOk = await perfAsync('scale.waitForDNS', () =>
+            waitForDNSPropagation(domain, newIp, 120_000),
+          );
+          s.stop(dnsOk ? 'DNS propagated' : 'DNS propagation timed out (proceeding anyway)');
+        }
       }
 
-      // 9b. Reset ACME state so Traefik retries cert challenges with the correct DNS.
-      // startComposeStack (step 6) ran before DNS was updated — all challenges failed
-      // and are cached as errors in the letsencrypt_data volume.
-      // Use docker compose exec (Traefik is already running) instead of pulling alpine.
+      // 9b. HTTP-01 only: reset ACME state so Traefik retries challenges with
+      // the corrected DNS — step 6's startComposeStack ran before the A record
+      // moved, so failed challenges are cached as errors in letsencrypt_data.
+      // DNS-01 has no such cached HTTP-01 failure to clear (and wiping acme.json
+      // would force a needless re-issue), so skip it.
       // Uses an SCP'd script so quoting/redirection stay intact without local shell.
-      sshRunScript(
-        newIp,
-        sshKeyPath,
-        `cd ${remoteDir} && docker compose exec -T traefik sh -c 'echo "{}" > /letsencrypt/acme.json && chmod 600 /letsencrypt/acme.json'`,
-        { timeout: 30_000 },
-      );
+      if (!dnsChallenge) {
+        sshRunScript(
+          newIp,
+          sshKeyPath,
+          `cd ${remoteDir} && docker compose exec -T traefik sh -c 'echo "{}" > /letsencrypt/acme.json && chmod 600 /letsencrypt/acme.json'`,
+          { timeout: 30_000 },
+        );
+      }
 
       // 9c. Recreate all services after restore so they reconnect to the restored DB.
       // Include all feature compose file flags so feature containers (redis, n8n,
@@ -545,6 +550,8 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       const composeFlags = [
         '-f docker-compose.yml',
         '-f docker-compose.prod.yml',
+        // DNS-01 override must follow prod.yml so it replaces the Traefik command.
+        ...(dnsChallenge ? ['-f docker-compose.dns01.prod.yml'] : []),
         ...(services.observability
           ? ['-f docker-compose.observability.yml', '-f docker-compose.observability.prod.yml']
           : []),
@@ -554,34 +561,26 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
           : []),
         ...(services.redis ? ['-f docker-compose.redis.yml'] : []),
       ].join(' ');
+      // On compose-ha, docker-compose.replication.yml (written by configurePrimaryReplication)
+      // publishes 5433 → db:5432 for pg_basebackup / streaming replication.
+      // Append it when present so force-recreate doesn't silently drop the 5433 mapping.
+      // On single-server compose the file never exists — the shell conditional is a no-op.
+      const replOverlayFlag =
+        "$([ -f docker-compose.replication.yml ] && echo '-f docker-compose.replication.yml')";
       s.start('Recreating all services after restore...');
       sshRunScript(
         newIp,
         sshKeyPath,
-        `cd ${remoteDir} && docker compose ${composeFlags} up -d --force-recreate 2>&1`,
+        `cd ${remoteDir} && docker compose ${composeFlags} ${replOverlayFlag} up -d --force-recreate 2>&1`,
         { timeout: 600_000 },
       );
       s.stop('All services running');
 
-      // 11. Re-setup backup cron if configured. envConfig only persists
-      //     bucket/region/endpoint under `s3` — accessKey/secretKey live in
-      //     ~/.vibecarbon/credentials.json (loaded into `creds` at step 4b).
-      //     Without merging them in, setupComposeBackupCron would write a
-      //     /etc/vibecarbon/backup.env with empty AWS_ACCESS_KEY_ID /
-      //     AWS_SECRET_ACCESS_KEY and every cron-triggered backup would 403
-      //     against S3.
+      // 11. Re-setup backup cron if configured. wal-g reads its S3 config from
+      //     the db container's env (rendered into .env at deploy), so the cron
+      //     just runs compose-backup.sh on schedule — no separate S3 plumbing.
       if (envConfig.backup) {
-        const backupS3Config =
-          envConfig.s3 && creds.s3
-            ? {
-                bucket: envConfig.s3.bucket,
-                accessKey: creds.s3.accessKey,
-                secretKey: creds.s3.secretKey,
-                endpoint: envConfig.s3.endpoint,
-                region: envConfig.s3.region,
-              }
-            : null;
-        setupComposeBackupCron(newIp, sshKeyPath, projectName, backupS3Config, envConfig.backup);
+        setupComposeBackupCron(newIp, sshKeyPath, projectName, envConfig.backup);
         p.log.info('Backup cron restored on new server');
       }
 

package/carbon/backup/Dockerfile

@@ -1,75 +0,0 @@
-# syntax=docker/dockerfile:1
-FROM ubuntu:22.04
-
-# Base image is ubuntu, not alpine, because wal-g v3.x stopped publishing
-# alpine-musl prebuilt binaries — only ubuntu glibc builds remain. We need
-# wal-g v3+ for the current S3 + Postgres 16 wire protocol support.
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-# Install PostgreSQL 16 client + utilities. PG 16 isn't in the default
-# ubuntu 22.04 repos; pull it from the postgresql apt repo. AWS CLI is
-# installed as the standalone v2 binary further down (the apt-shipped
-# `awscli` is v1 and pulls ~500MB of Python deps; v2 is ~80MB self-
-# contained and the only version AWS itself supports for new code).
-#
-# apt cache mount: keeps /var/cache/apt populated across rebuilds so
-# `apt-get install` reuses .deb files. The cache lives outside the layer,
-# so we don't need the historical `rm -rf /var/lib/apt/lists/*` to keep
-# the final image small — that's still done below as a belt-and-braces
-# measure for cases where the cache mount isn't honored (e.g. legacy
-# `docker build` without BuildKit).
-# `sharing=locked` serializes parallel builds against the same cache
-# (apt's lock semantics expect exclusive access).
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates curl gnupg lsb-release \
-        bash tar gzip unzip && \
-    install -d /usr/share/postgresql-common/pgdg && \
-    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
-        -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc && \
-    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt jammy-pgdg main" \
-        > /etc/apt/sources.list.d/pgdg.list && \
-    apt-get update && apt-get install -y --no-install-recommends \
-        postgresql-client-16
-
-# Install AWS CLI v2 standalone binary (~80MB) instead of `apt-get install
-# awscli` (v1 with ~500MB of Python/boto3 deps). Saves ~400MB on the
-# final image, which matters because the backup image is sideloaded to
-# every k3s node (~6 nodes in HA = ~2.4GB less network per deploy).
-# --fail makes curl exit non-zero on HTTP 4xx/5xx instead of piping a
-# 404 HTML body into unzip.
-RUN curl -fL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip \
-        -o /tmp/awscli.zip && \
-    unzip -q /tmp/awscli.zip -d /tmp && \
-    /tmp/aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli && \
-    rm -rf /tmp/aws /tmp/awscli.zip
-
-# Install WAL-G v3.0.5 (ubuntu 22.04 amd64 build).
-# --fail makes curl exit non-zero on HTTP 4xx/5xx instead of piping a 404
-# HTML body into tar (the previous v3.0.3-alpine URL 404'd, tar saw "<html>"
-# and errored "not in gzip format" — observed 2026-04-26 matrix run #2).
-RUN curl -fL https://github.com/wal-g/wal-g/releases/download/v3.0.5/wal-g-pg-ubuntu-22.04-amd64.tar.gz \
-        | tar -xz && \
-    mv wal-g-pg-ubuntu-22.04-amd64 /usr/local/bin/wal-g && \
-    chmod +x /usr/local/bin/wal-g
-
-# Security: non-root system user. We can't reuse the name `backup` —
-# ubuntu pre-populates a `backup` system group (GID 34, used for system
-# backup operations) and `groupadd backup` errors with exit 9 ("group
-# 'backup' already exists"). The previous alpine version sidestepped
-# this because alpine doesn't ship the same default. Use a unique name
-# (`vbbackup`) and let --system pick a free system GID/UID.
-# The k8s manifest doesn't pin runAsUser so any UID works.
-RUN groupadd --system vbbackup && \
-    useradd --system -g vbbackup -s /usr/sbin/nologin -M vbbackup
-
-# Copy backup script
-COPY backup.sh /usr/local/bin/backup.sh
-RUN chmod +x /usr/local/bin/backup.sh
-
-USER vbbackup
-
-# CronJob handles scheduling — script runs once and exits
-ENTRYPOINT ["/usr/local/bin/backup.sh"]

package/carbon/backup/backup.sh

@@ -1,95 +0,0 @@
-#!/bin/bash
-set -e
-# pipefail is critical: the pg_dump | gzip pipeline below silently uploaded
-# 170-byte gzip-header-only tarballs when pg_dump failed (wrong PGHOST),
-# making restore think backups existed when they were empty. Observed
-# 2026-04-27 k8s-ha matrix #6 — restore failed "No backups found in S3"
-# because the broken tarball had no SQL inside.
-set -o pipefail
-
-# ============================================================================
-# Vibecarbon Blazing Fast Backup Script (WAL-G)
-#
-# Optimized for performance and robustness using continuous archiving.
-# Fallback to pg_dump for legacy compatibility.
-#
-# Environment Variables:
-#   PGHOST, PGPORT, PGUSER, PGDATABASE, PGPASSWORD  - PostgreSQL connection
-#   S3_BUCKET, S3_ENDPOINT, S3_ACCESS_KEY, S3_SECRET_KEY, S3_REGION - S3 config
-#   S3_BACKUP_BUCKET       - Dedicated backup bucket (falls back to S3_BUCKET)
-#   BACKUP_RETENTION_DAYS  - Days to keep backups (default: 7)
-#   PROJECT_NAME           - Project name for backup naming
-#   BACKUP_MODE            - "walg" (default) or "pg_dump"
-# ============================================================================
-
-TIMESTAMP=$(date +%Y%m%d_%H%M%S)
-PROJECT="${PROJECT_NAME:-vibecarbon}"
-MODE="${BACKUP_MODE:-walg}"
-RETENTION_DAYS="${BACKUP_RETENTION_DAYS:-7}"
-
-echo "=== Vibecarbon Backup (${MODE}) ==="
-echo "Started at $(date)"
-
-# --- S3 CONFIGURATION ---
-UPLOAD_BUCKET="${S3_BACKUP_BUCKET:-${S3_BUCKET}}"
-export AWS_ACCESS_KEY_ID="${S3_ACCESS_KEY}"
-export AWS_SECRET_ACCESS_KEY="${S3_SECRET_KEY}"
-export AWS_DEFAULT_REGION="${S3_REGION:-us-east-1}"
-export AWS_ENDPOINT="${S3_ENDPOINT}"
-
-if [ -z "${UPLOAD_BUCKET}" ] || [ -z "${AWS_ACCESS_KEY_ID}" ] || [ -z "${AWS_SECRET_ACCESS_KEY}" ] || [ -z "${AWS_ENDPOINT}" ]; then
-  echo "Error: S3 configuration missing. Backup cannot proceed."
-  exit 1
-fi
-
-# --- WAL-G CONFIGURATION ---
-export WALG_S3_PREFIX="s3://${UPLOAD_BUCKET}/backups/${PROJECT}/walg"
-# Use the same credentials for WAL-G (it uses AWS_* by default, but we can be explicit)
-export WALE_S3_PREFIX="${WALG_S3_PREFIX}"
-# Parallelism for faster compression/upload
-export WALG_COMPRESSION_METHOD="lz4"
-export WALG_UPLOAD_CONCURRENCY=4
-
-if [ "${MODE}" = "walg" ]; then
-  echo "Creating full base backup with WAL-G..."
-  # WAL-G requires PGHOST to be reachable.
-  # If running in a sidecar, it might need to connect via socket or network.
-  # We assume PGHOST is set correctly (e.g. "db").
-  export PGDATA="/var/lib/postgresql/data"
-  
-  # Check if we can run backup-push. 
-  # Note: backup-push usually needs to run on the database server or have access to PGDATA
-  # if it's doing a direct filesystem scan. 
-  # If this script runs in a separate container, it uses the network protocol.
-  
-  wal-g backup-push "${PGDATA}"
-  
-  echo "Full base backup completed."
-  
-  echo "Cleaning up old backups (retention: ${RETENTION_DAYS} days)..."
-  wal-g delete before "$(date -d "-${RETENTION_DAYS} days" +%Y-%m-%dT%H:%M:%SZ)" --confirm
-  
-else
-  # --- LEGACY PG_DUMP FALLBACK ---
-  echo "Falling back to pg_dump..."
-  WORK_DIR="/tmp/backup_${TIMESTAMP}"
-  mkdir -p "${WORK_DIR}"
-  ARCHIVE_NAME="${PROJECT}_${TIMESTAMP}_full.tar.gz"
-
-  PGPASSWORD="${PGPASSWORD}" pg_dump \
-    -h "${PGHOST:-postgres}" \
-    -p "${PGPORT:-5432}" \
-    -U "${PGUSER:-supabase_admin}" \
-    "${PGDATABASE:-postgres}" | gzip > "${WORK_DIR}/postgres.sql.gz"
-
-  tar czf "/tmp/${ARCHIVE_NAME}" -C "${WORK_DIR}" .
-  
-  aws s3 cp "/tmp/${ARCHIVE_NAME}" \
-    "s3://${UPLOAD_BUCKET}/backups/${ARCHIVE_NAME}" \
-    --endpoint-url "${S3_ENDPOINT}"
-
-  rm -rf "${WORK_DIR}"
-  rm "/tmp/${ARCHIVE_NAME}"
-fi
-
-echo "=== Backup completed at $(date) ==="

package/carbon/runtime.Dockerfile

@@ -1,17 +0,0 @@
-# syntax=docker/dockerfile:1
-# Vibecarbon Runtime Base Image
-# This image contains the pre-installed node_modules for the Vibecarbon template.
-# Using this as a base for your app image reduces build times from minutes to seconds.
-
-FROM node:22-alpine3.23 AS base
-
-RUN npm install -g pnpm@9
-WORKDIR /app
-
-# Pre-install dependencies
-COPY package.json pnpm-lock.yaml ./
-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
-    pnpm install --frozen-lockfile
-
-# This image is meant to be a base, so we stop here.
-# The app build will continue FROM this image.

package/src/lib/deploy/compose/acme-verify.js

@@ -1,121 +0,0 @@
-/**
- * Verify Traefik has acquired Let's Encrypt certificates after compose-up,
- * and self-heal a stuck ACME state by restarting Traefik.
- *
- * Why this exists: Traefik's ACME engine bursts ~7 attempts in ~30s on
- * container start, then waits ~24h for the next renewal-check tick. If
- * the first burst fails (typically because DNS hasn't propagated yet —
- * see src/lib/dns-propagation.js for the cold-deploy fix), Traefik
- * settles into a state where acme.json has 0 issued certs and the
- * customer's browser sees the TRAEFIK DEFAULT CERT
- * (NET::ERR_CERT_AUTHORITY_INVALID).
- *
- * Cold deploys on v3.6.2+ avoid the original race by writing DNS before
- * compose-up. But customers stuck on v3.6.1's failure state can't recover
- * via warm redeploy alone — `docker compose up -d` is a no-op for
- * Traefik when nothing changed, so the broken in-memory state persists.
- *
- * This helper polls acme.json post-deploy expecting at least one cert;
- * if Traefik is still empty after ~90s, it restarts the container,
- * which forces a fresh ACME run against now-valid DNS. Healthy DNS
- * yields a cert in ~30s of the restart. If the restart still doesn't
- * produce a cert, we log a warning but don't fail the deploy — could
- * be LE rate limits, port 80 unreachable, etc., none of which a CLI
- * restart can fix.
- */
-
-import { sshRunAsync } from './index.js';
-
-const POLL_INTERVAL_MS = 5_000;
-const INITIAL_POLL_TIMEOUT_MS = 90_000;
-const POST_RESTART_POLL_TIMEOUT_MS = 90_000;
-
-/**
- * SSH into the server, exec `cat /letsencrypt/acme.json` inside the
- * Traefik container, return the count of issued certs (0 if anything
- * goes wrong — empty acme.json, malformed JSON, SSH error, etc.).
- */
-async function readAcmeCertCount(ip, sshKeyPath, projectName) {
-  let raw;
-  try {
-    raw = await sshRunAsync(
-      ip,
-      sshKeyPath,
-      `cd /opt/${projectName} && docker compose exec -T traefik cat /letsencrypt/acme.json 2>/dev/null`,
-      { timeout: 15_000 },
-    );
-  } catch {
-    return 0;
-  }
-  if (!raw || typeof raw !== 'string') return 0;
-  try {
-    const parsed = JSON.parse(raw);
-    const certs = parsed?.letsencrypt?.Certificates;
-    return Array.isArray(certs) ? certs.length : 0;
-  } catch {
-    return 0;
-  }
-}
-
-async function pollForCert(ip, sshKeyPath, projectName, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if ((await readAcmeCertCount(ip, sshKeyPath, projectName)) > 0) return true;
-    const remaining = deadline - Date.now();
-    if (remaining <= 0) break;
-    await new Promise((r) => setTimeout(r, Math.min(POLL_INTERVAL_MS, remaining)));
-  }
-  return false;
-}
-
-/**
- * Wait for Traefik to acquire at least one cert; if it doesn't within
- * the initial budget, restart the container and wait again. Logs progress
- * via the provided logger (typically @clack/prompts p.log). Never throws
- * — TLS issuance is best-effort; the deploy succeeds even if the cert
- * never lands (operator can investigate via SSH).
- *
- * @param {string} ip - server IP
- * @param {string} sshKeyPath - path to private key
- * @param {string} projectName - compose project name (= directory in /opt/)
- * @param {string} domain - configured domain (for log messages only)
- * @param {{ message?: Function, success?: Function, warn?: Function }} log
- */
-export async function ensureTraefikCert(ip, sshKeyPath, projectName, domain, log) {
-  log.message?.(`Verifying TLS certificate for ${domain}...`);
-  const acquired = await pollForCert(ip, sshKeyPath, projectName, INITIAL_POLL_TIMEOUT_MS);
-  if (acquired) {
-    log.success?.(`TLS certificate issued for ${domain}`);
-    return;
-  }
-  log.warn?.(
-    `Traefik has no certificate for ${domain} after ${INITIAL_POLL_TIMEOUT_MS / 1000}s — ` +
-      `restarting to clear stale ACME state and retry`,
-  );
-  try {
-    await sshRunAsync(ip, sshKeyPath, `cd /opt/${projectName} && docker compose restart traefik`, {
-      timeout: 60_000,
-    });
-  } catch (err) {
-    log.warn?.(`Traefik restart failed: ${err instanceof Error ? err.message : String(err)}`);
-    return;
-  }
-  const acquiredAfterRestart = await pollForCert(
-    ip,
-    sshKeyPath,
-    projectName,
-    POST_RESTART_POLL_TIMEOUT_MS,
-  );
-  if (acquiredAfterRestart) {
-    log.success?.(`TLS certificate issued for ${domain} after Traefik restart`);
-    return;
-  }
-  log.warn?.(
-    `Traefik still has no certificate for ${domain} after restart. ` +
-      `Check DNS resolution (dig +short ${domain}) and acme.json on the server. ` +
-      `If both look correct, ACME may complete in the background within minutes.`,
-  );
-}
-
-// Re-exported for tests; not part of the public surface.
-export const __test__ = { readAcmeCertCount, pollForCert };

package/src/lib/deploy/index.js

@@ -1,119 +0,0 @@
-/**
- * Deployment Module Registry
- *
- * Four deployment modes:
- * - compose: Docker Compose on single VPS (Fast + Pro)
- * - compose-ha: Docker Compose HA on 2 VPS with PostgreSQL replication (Fast + Pro)
- * - standard: Kubernetes single-region (Pro only)
- * - ha: Kubernetes multi-region HA (Pro only)
- */
-
-export {
-  deployComposeHA,
-  destroyComposeHA,
-  getComposeHAStatus,
-} from './compose/ha.js';
-export {
-  backupCompose,
-  deployCompose,
-  destroyCompose,
-  getComposeStatus,
-  redeployCompose,
-  restoreCompose,
-  setupServer,
-  setupServerFiles,
-  waitForSSH as waitForComposeSSH,
-} from './compose/index.js';
-export { deployK8sHA, destroyK8sHA, getK8sHAStatus, triggerFailover } from './k8s/ha/index.js';
-export { destroyK8s, getK8sStatus } from './k8s/index.js';
-export { deployK3s } from './k8s/k3s.js';
-
-/**
- * Get the appropriate deploy function based on mode
- * @param {string} mode - 'compose', 'compose-ha', 'kubernetes', or 'ha'
- * @returns {Promise<Function>} Deploy function
- */
-export function getDeployFunction(mode = 'compose') {
-  if (mode === 'ha') {
-    return import('./k8s/ha/index.js').then((m) => m.deployK8sHA);
-  }
-  if (mode === 'compose-ha') {
-    return import('./compose/ha.js').then((m) => m.deployComposeHA);
-  }
-  if (mode === 'kubernetes') {
-    return import('./k8s/k3s.js').then((m) => m.deployK3s);
-  }
-  return import('./compose/index.js').then((m) => m.deployCompose);
-}
-
-/**
- * Get the appropriate destroy function based on mode
- * @param {string} mode - 'compose', 'compose-ha', 'kubernetes', or 'ha'
- * @returns {Promise<Function>} Destroy function
- */
-export function getDestroyFunction(mode = 'compose') {
-  if (mode === 'ha') {
-    return import('./k8s/ha/index.js').then((m) => m.destroyK8sHA);
-  }
-  if (mode === 'compose-ha') {
-    return import('./compose/ha.js').then((m) => m.destroyComposeHA);
-  }
-  if (mode === 'kubernetes') {
-    return import('./k8s/index.js').then((m) => m.destroyK8s);
-  }
-  return import('./compose/index.js').then((m) => m.destroyCompose);
-}
-
-/**
- * Deployment mode information
- */
-export const MODES = {
-  compose: {
-    name: 'Compose',
-    displayName: 'Docker Compose',
-    description: 'Single-server deployment with Docker Compose',
-    tier: 'diamond',
-    features: [
-      'Docker Compose on single VPS',
-      'Auto HTTPS via Traefik/Caddy',
-      'All add-ons supported',
-      'Direct image transfer (no registry needed)',
-    ],
-  },
-  'compose-ha': {
-    name: 'Compose HA',
-    displayName: 'Docker Compose HA',
-    description: 'Multi-region Docker Compose with PostgreSQL replication',
-    tier: 'diamond',
-    features: [
-      'Docker Compose on 2 VPS',
-      'PostgreSQL streaming replication',
-      'Cloudflare health checks + failover',
-      'Auto HTTPS via Traefik',
-    ],
-  },
-  standard: {
-    name: 'Standard',
-    displayName: 'Kubernetes',
-    description: 'Single-region Kubernetes cluster',
-    tier: 'fullerene',
-    features: [
-      'Kubernetes cluster (1 master + workers)',
-      'Horizontal Pod Autoscaling',
-      'Traefik ingress with auto-SSL',
-      'Local Docker build & push',
-    ],
-  },
-  ha: {
-    name: 'HA',
-    displayName: 'Kubernetes HA',
-    description: 'Multi-region Kubernetes with high availability',
-    tier: 'fullerene',
-    features: [
-      'Multi-region clusters',
-      'PostgreSQL streaming replication',
-      'One-command failover',
-      'DNS health checks',
-    ],
-  },
-};