vibecarbon 0.3.1 → 0.5.0

package/carbon/k8s/base/network-policies.yaml

@@ -93,3 +93,36 @@ spec:
           port: 53
         - protocol: TCP
           port: 53
+
+---
+# Allow the supabase-db pod to egress to S3 (HTTPS) for wal-g: continuous WAL
+# archiving (archive_command → wal-g wal-push) and the nightly base backup
+# (kubectl exec → wal-g backup-push) both run INSIDE the db container and push
+# to Hetzner Object Storage. Without this, the implicit default-deny-egress
+# (allow-dns/allow-intra-namespace-egress select all pods with Egress type)
+# drops the db pod's outbound 443 and wal-g hangs/fails.
+# Selector matches the chart-generated db pod labels; base kustomize `labels:`
+# does not include selectors, so these are not mutated.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: supabase-db-s3-egress
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: supabase-db
+      app.kubernetes.io/instance: supabase
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443

package/carbon/k8s/base/traefik/certificate.yaml

@@ -1,11 +1,17 @@
 # TLS Certificate for Vibecarbon application
 # Requires cert-manager to be installed (kubectl apply -k k8s/infra/)
 #
-# issuerRef.name is patched per-deployment by applyK3sManifests in
-# src/lib/deploy/k8s/k3s.js — it picks letsencrypt-{prod,staging}-{
-# cloudflare,hetzner,manual} based on dnsProvider + ACME_CA_SERVER.
-# The placeholder below keeps this template valid for kustomize and
-# is overwritten before cert-manager ever sees a Certificate request.
+# issuerRef.name and dnsNames are BOTH patched per-deployment by
+# applyK3sManifests in src/lib/deploy/k8s/k3s.js:
+#   - issuerRef.name → letsencrypt-{prod,staging}-{cloudflare,hetzner,manual}
+#     based on dnsProvider + ACME_CA_SERVER.
+#   - dnsNames → [domain] for manual (HTTP-01) issuers;
+#                [domain, "*.domain"] for DNS-01 (cloudflare/hetzner) issuers.
+#     DNS-01 allows a wildcard SAN so one cert covers every subdomain
+#     (api, studio, dashboard, grafana, n8n, ...) without separate ACME orders.
+#
+# The placeholders below keep this template valid for kustomize; they are
+# overwritten before cert-manager ever sees a Certificate request.
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -17,5 +23,5 @@ spec:
     kind: ClusterIssuer
   dnsNames:
     - app.example.com  # Patched with actual domain at deploy time
-  # Optional: Include additional subdomains
-  # - "*.app.example.com"
+    # For DNS-01 (managed-DNS) deploys the wildcard is added at deploy time:
+    # - "*.app.example.com"

package/carbon/k8s/values/supabase.values.yaml

@@ -54,6 +54,18 @@ secret:
       password: DB_PASSWORD
       database: DB_NAME
 
+# Override the db image with vibecarbon's wal-g-equipped build (carbon/db/
+# Dockerfile: FROM supabase/postgres + wal-g v3.0.5). The stock chart image
+# has no wal-g, which is why k8s historically had no WAL archiving / PITR.
+# Built + sideloaded to the supabase node by deployK3s (k3s-db-build /
+# k3s-db-sideload); IfNotPresent so the sideloaded image is used, not pulled.
+# {{DB_IMAGE}}/{{DB_IMAGE_TAG}} substituted at deploy time in installSupabase.
+image:
+  db:
+    repository: "{{DB_IMAGE}}"
+    tag: "{{DB_IMAGE_TAG}}"
+    pullPolicy: IfNotPresent
+
 # Component enable toggles — chart's path is deployment.<comp>.enabled.
 # Top-level `functions:`/`analytics:`/`vector:` are silently ignored
 # (was the bug behind the 2026-04-26 e2e helm-wait timeout).
@@ -81,6 +93,129 @@ deployment:
         operator: Equal
         value: supabase
         effect: NoSchedule
+    # Headroom for the daily wal-g base backup, which runs INSIDE this
+    # container's cgroup (via `kubectl exec`, see k8s/base/backup/cronjob.yaml).
+    # backup-push streams PGDATA → lz4 → S3; size the limit for the backup
+    # window, not steady state, or it throttles postgres too. WALG_UPLOAD_
+    # CONCURRENCY is kept at 2 (vs compose's 4) to bound the burst.
+    resources:
+      requests:
+        cpu: 250m
+        memory: 512Mi
+      limits:
+        cpu: "2"
+        memory: 2Gi
+    # Mount the fault-tolerant WAL-archive wrapper that postgres'
+    # archive_command calls (enabled at runtime via ALTER SYSTEM in
+    # applyK3sManifests). Script body lives in the vibecarbon-wal-archive
+    # ConfigMap (k8s/base/backup/configmap-walg.yaml) — verbatim copy of
+    # carbon/volumes/db/wal-archive.sh (retry + exit-0 prevents disk-fill).
+    volumeMounts:
+      - name: wal-archive-script
+        mountPath: /etc/postgresql/wal-archive.sh
+        subPath: wal-archive.sh
+        readOnly: true
+      - name: walg-s3-creds
+        mountPath: /etc/walg
+        readOnly: true
+    volumes:
+      - name: wal-archive-script
+        configMap:
+          # Invoked as `bash /etc/postgresql/wal-archive.sh` (archive_command),
+          # so no exec bit is required on the mounted file.
+          name: vibecarbon-wal-archive
+      - name: walg-s3-creds
+        secret:
+          secretName: vibecarbon-secrets
+          # Optional so a no-S3 (dev) deploy still schedules the db pod; wal-g
+          # is simply unconfigured then. items maps the INI key → credentials.
+          optional: true
+          items:
+            - key: S3_CREDENTIALS_INI
+              path: credentials
+    # Restore bootstrap: a marker-gated init container that, ONLY when a
+    # restore is requested (RESTORE_TARGET set in vibecarbon-secrets), fetches
+    # the latest wal-g base backup into PGDATA before postgres starts. On a
+    # normal boot RESTORE_TARGET is empty and the init container is a no-op.
+    # Uses the same wal-g-equipped db image. RESTORE_TARGET is an OPTIONAL
+    # secretKeyRef so deploys without the key still schedule.
+    extraInitContainers:
+      - name: walg-restore
+        image: "{{DB_IMAGE}}:{{DB_IMAGE_TAG}}"
+        imagePullPolicy: IfNotPresent
+        command:
+          - /bin/bash
+          - -c
+          - |
+            set -euo pipefail
+            if [ -z "${RESTORE_TARGET:-}" ]; then
+              echo "walg-restore: RESTORE_TARGET empty — normal boot, skipping."
+              exit 0
+            fi
+            echo "walg-restore: RESTORE_TARGET=${RESTORE_TARGET} — restoring from S3."
+            if [ -f "${PGDATA}/PG_VERSION" ]; then
+              echo "walg-restore: existing PGDATA — clearing for backup-fetch."
+              rm -rf "${PGDATA:?}/"* "${PGDATA:?}/".* 2>/dev/null || true
+            fi
+            # Fetch the latest base backup into PGDATA. (For PITR the base that
+            # precedes the target is also the latest base — base backups are
+            # frequent, so LATEST is the right starting point either way.)
+            wal-g backup-fetch "${PGDATA}" LATEST
+            # Configure archive recovery. A fetched base backup is only
+            # consistent AFTER replaying the WAL from its redo point to its
+            # stop point — and that WAL lives in S3, not in the fetched PGDATA.
+            # Without restore_command + recovery.signal postgres aborts startup
+            # with "could not locate required checkpoint record" (the bug this
+            # fixes — the `latest` branch previously did neither). restore_command
+            # pulls each segment back from S3 via `wal-g wal-fetch`; recovery.signal
+            # puts postgres into archive recovery; on reaching the end of WAL (or
+            # the PITR target) it promotes to read-write. (RCA 2026-05-31: e2e
+            # k8s/k8s-ha restore — postgres crash-looped post-fetch.)
+            {
+              echo "restore_command = 'wal-g wal-fetch \"%f\" \"%p\"'"
+              echo "recovery_target_action = 'promote'"
+              # Pin recovery to the fetched base backup's OWN timeline. Default
+              # 'latest' makes postgres chase the newest timeline with a .history
+              # file; in HA, repeated restore→promote cycles leave DIVERGENT
+              # timelines in the shared wal-g S3 prefix, and 'latest' can pick one
+              # that forked before this base backup → crash-loop "requested
+              # timeline N is not a child of this server's history". 'current'
+              # recovers along the base backup's timeline, then promotes fresh.
+              echo "recovery_target_timeline = 'current'"
+              if [ "${RESTORE_TARGET}" != "latest" ]; then
+                # PITR: RESTORE_TARGET is an ISO-8601 timestamp — replay only up
+                # to that point instead of to the end of the WAL stream.
+                echo "recovery_target_time = '${RESTORE_TARGET}'"
+              fi
+            } >> "${PGDATA}/postgresql.auto.conf"
+            touch "${PGDATA}/recovery.signal"
+            echo "walg-restore: backup-fetch complete; archive recovery configured."
+        env:
+          - name: PGDATA
+            value: /var/lib/postgresql/data
+          - name: RESTORE_TARGET
+            valueFrom:
+              secretKeyRef:
+                name: vibecarbon-secrets
+                key: RESTORE_TARGET
+                optional: true
+          - name: WALG_S3_PREFIX
+            value: "{{WALG_S3_PREFIX}}"
+          - name: WALG_COMPRESSION_METHOD
+            value: lz4
+          - name: AWS_ENDPOINT
+            value: "{{S3_ENDPOINT}}"
+          - name: AWS_REGION
+            value: "{{S3_REGION}}"
+          - name: AWS_SHARED_CREDENTIALS_FILE
+            value: /etc/walg/credentials
+        volumeMounts:
+          - name: postgres-volume
+            mountPath: /var/lib/postgresql/data
+            subPath: postgres-data
+          - name: walg-s3-creds
+            mountPath: /etc/walg
+            readOnly: true
 
 # Per-component environment — chart's path is environment.<comp>.
 environment:
@@ -99,6 +234,23 @@ environment:
     GOTRUE_MAILER_AUTOCONFIRM: "true"
   realtime:
     DB_NAME: postgres
+  # Non-secret WAL-G env for the db container (continuous WAL archiving +
+  # the exec'd base-backup CronJob both read these). The chart renders
+  # environment.<comp> as plain `value:` strings (no valueFrom), so the
+  # SECRET keys (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) are injected
+  # separately via a StatefulSet env patch in applyK3sManifests.
+  # {{WALG_S3_PREFIX}} resolves to s3://<backup-bucket|storage-bucket>/
+  # backups/<project>/walg (fallback handled in installSupabase).
+  db:
+    WALG_S3_PREFIX: "{{WALG_S3_PREFIX}}"
+    WALG_COMPRESSION_METHOD: lz4
+    WALG_UPLOAD_CONCURRENCY: "2"
+    AWS_ENDPOINT: "{{S3_ENDPOINT}}"
+    AWS_REGION: "{{S3_REGION}}"
+    # wal-g (AWS SDK) reads S3 creds from this INI file, mounted from
+    # vibecarbon-secrets (deployment.db.volumes below). File-mount, not env,
+    # so it's helm-owned and survives every upgrade with no db restart.
+    AWS_SHARED_CREDENTIALS_FILE: /etc/walg/credentials
   storage:
     STORAGE_BACKEND: s3
   imgproxy:

package/carbon/scripts/docker-up.js

@@ -124,7 +124,19 @@ const manifest = loadManifest();
 
 // Get port configuration with offset applied
 const portEnv = getPortEnvVars();
-const execOpts = { stdio: 'inherit', env: { ...process.env, ...portEnv } };
+
+// Pin local builds to the `default` (docker-driver) BuildKit builder.
+// `docker compose up` delegates image builds to `buildx bake`, which uses the
+// globally-selected builder. A long-lived `docker-container` builder (e.g. a
+// `vc-multiarch` builder left active via `buildx create --use` after a
+// multi-arch release build) freezes its /etc/resolv.conf at creation time — so
+// after a laptop changes network/subnet it keeps querying a dead DNS server and
+// builds fail with "i/o timeout" resolving registry-1.docker.io. The default
+// builder builds through the daemon's live DNS on every build, sidestepping
+// that whole class. Local dev/test never needs multi-arch; an explicit
+// BUILDX_BUILDER in the environment still wins, for anyone who wants otherwise.
+const buildEnv = { BUILDX_BUILDER: process.env.BUILDX_BUILDER || 'default' };
+const execOpts = { stdio: 'inherit', env: { ...process.env, ...portEnv, ...buildEnv } };
 
 // Check if any optional services (metabase, n8n, observability, etc.) are enabled.
 // These can have slow health checks (e.g. Metabase JVM takes 2-4 min), so we start

package/carbon/src/client/components/DeploymentScenariosSection.tsx

@@ -0,0 +1,171 @@
+import { motion } from 'framer-motion';
+import { ArrowLeftRight, CornerDownRight, RefreshCw, Server } from 'lucide-react';
+import { useTranslation } from 'react-i18next';
+import vibecarbonIcon from '../assets/vibecarbon-icon.svg';
+
+type Shape = 'single' | 'pair' | 'cluster' | 'multiCluster';
+type Accent = 'teal' | 'magenta';
+
+interface Scenario {
+  id: string;
+  shape: Shape;
+  accent: Accent;
+}
+
+const ACCENTS: Record<Accent, { text: string; pill: string; cluster: string; hover: string }> = {
+  teal: {
+    text: 'text-primary',
+    pill: 'border-primary/30 text-primary',
+    cluster: 'border-primary/30',
+    hover: 'hover:border-primary/30',
+  },
+  magenta: {
+    text: 'text-secondary-accent',
+    pill: 'border-secondary-accent/30 text-secondary-accent',
+    cluster: 'border-secondary-accent/30',
+    hover: 'hover:border-secondary-accent/30',
+  },
+};
+
+const SCENARIOS: Scenario[] = [
+  { id: 'compose', shape: 'single', accent: 'teal' },
+  { id: 'composeHa', shape: 'pair', accent: 'magenta' },
+  { id: 'k8s', shape: 'cluster', accent: 'teal' },
+  { id: 'k8sHa', shape: 'multiCluster', accent: 'magenta' },
+];
+
+// A single server "node" — same visual language as WorkflowSection's DeployVisual pods.
+function Node({ color }: { color: string }) {
+  return (
+    <div className="flex items-center justify-center rounded-md border border-border/60 bg-background/60 p-1.5 dark:border-white/10 dark:bg-white/[0.03]">
+      <Server className={`size-3.5 ${color}`} strokeWidth={1.5} />
+    </div>
+  );
+}
+
+// A dashed "cluster" outline wrapping N nodes. `count` is a fixed literal per topology
+// (2 or 3), so naming the nodes gives each a stable, reorder-free key.
+const NODE_KEYS = ['n1', 'n2', 'n3'];
+
+function Cluster({ color, border, count }: { color: string; border: string; count: number }) {
+  return (
+    <div className={`flex items-center gap-1 rounded-lg border border-dashed ${border} p-1.5`}>
+      {NODE_KEYS.slice(0, count).map((key) => (
+        <Node key={key} color={color} />
+      ))}
+    </div>
+  );
+}
+
+// Topology glyph: 1 node / 2 nodes + failover / 3-node cluster / 2 clusters + region failover.
+function Topology({ shape, accent }: { shape: Shape; accent: Accent }) {
+  const { text, cluster } = ACCENTS[accent];
+  switch (shape) {
+    case 'single':
+      return <Node color={text} />;
+    case 'pair':
+      return (
+        <div className="flex items-center gap-2">
+          <Node color={text} />
+          <RefreshCw className={`size-3.5 ${text}`} strokeWidth={1.5} />
+          <Node color={text} />
+        </div>
+      );
+    case 'cluster':
+      return <Cluster color={text} border={cluster} count={3} />;
+    case 'multiCluster':
+      return (
+        <div className="flex items-center gap-2">
+          <Cluster color={text} border={cluster} count={2} />
+          <ArrowLeftRight className={`size-3.5 ${text}`} strokeWidth={1.5} />
+          <Cluster color={text} border={cluster} count={2} />
+        </div>
+      );
+  }
+}
+
+export function DeploymentScenariosSection() {
+  const { t } = useTranslation();
+
+  return (
+    <section className="relative py-24 md:py-36">
+      <div className="mx-auto max-w-5xl px-6">
+        <div className="mb-10 text-center">
+          <motion.div
+            className="mb-6 flex justify-center"
+            animate={{ y: [0, -6, 0] }}
+            transition={{ duration: 3, repeat: Infinity, ease: 'easeInOut' }}
+          >
+            <img
+              src={vibecarbonIcon}
+              alt=""
+              width={56}
+              height={56}
+              className="drop-shadow-[0_0_12px_oklch(0.82_0.14_192/0.6)]"
+            />
+          </motion.div>
+          <h2 className="mb-4 text-3xl font-black tracking-tight md:text-5xl">
+            {t('landing.deploy.headline')}{' '}
+            <span className="bg-gradient-to-r from-primary via-cyan-400 to-secondary-accent bg-clip-text text-transparent">
+              {t('landing.deploy.headlineHighlight')}
+            </span>
+          </h2>
+          <p className="mx-auto max-w-2xl text-lg text-muted-foreground">
+            {t('landing.deploy.subheading')}
+          </p>
+        </div>
+
+        <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
+          {SCENARIOS.map((scenario, index) => {
+            const accent = ACCENTS[scenario.accent];
+            const features = t(`landing.deploy.${scenario.id}.features`, {
+              returnObjects: true,
+            }) as string[];
+
+            return (
+              <motion.div
+                key={scenario.id}
+                initial={{ opacity: 0, y: 20 }}
+                whileInView={{ opacity: 1, y: 0 }}
+                viewport={{ once: true, margin: '-50px' }}
+                transition={{ duration: 0.4, delay: index * 0.08 }}
+                className={`group flex flex-col rounded-2xl border border-border/60 bg-muted/40 p-6 transition-all duration-300 dark:border-white/10 dark:bg-white/5 ${accent.hover} hover:bg-muted/80 dark:hover:bg-white/10`}
+              >
+                {/* Topology glyph */}
+                <div className="mb-5 flex h-12 items-center">
+                  <Topology shape={scenario.shape} accent={scenario.accent} />
+                </div>
+
+                {/* Name + tagline */}
+                <h3 className="text-lg font-bold text-foreground">
+                  {t(`landing.deploy.${scenario.id}.name`)}
+                </h3>
+                <p className="mt-1 text-sm text-muted-foreground">
+                  {t(`landing.deploy.${scenario.id}.tagline`)}
+                </p>
+
+                {/* Attribute pills */}
+                <div className="mt-4 flex flex-wrap gap-2">
+                  {features.map((feature) => (
+                    <span
+                      key={feature}
+                      className={`rounded-full border px-2.5 py-0.5 text-xs font-medium ${accent.pill}`}
+                    >
+                      {feature}
+                    </span>
+                  ))}
+                </div>
+
+                {/* Best for */}
+                <div className="mt-5 flex items-center gap-1.5 text-sm text-muted-foreground">
+                  <CornerDownRight className={`size-4 shrink-0 ${accent.text}`} strokeWidth={1.5} />
+                  <span>{t(`landing.deploy.${scenario.id}.bestFor`)}</span>
+                </div>
+              </motion.div>
+            );
+          })}
+        </div>
+      </div>
+    </section>
+  );
+}

package/carbon/src/client/locales/de.json

@@ -394,6 +394,35 @@
         "description": "Jede Route validiert mit Zod, jede Abfrage nutzt den richtigen Supabase-Client, jede Tabelle hat RLS. KI-Agenten replizieren jedes Mal dieselben korrekten Muster."
       }
     },
+    "deploy": {
+      "headline": "Deploye nach deinen Vorstellungen,",
+      "headlineHighlight": "mit einem Befehl",
+      "subheading": "Von einem einzelnen VPS bis zu Multi-Region-Kubernetes — wähle dein Maß an Skalierung und Ausfallsicherheit. Wechsle jederzeit in die nächste Stufe.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "Ein VPS, dein kompletter Stack inklusive.",
+        "features": ["1 Server", "Einzelne Region"],
+        "bestFor": "MVPs & interne Tools"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Zwei Server, automatisches Failover.",
+        "features": ["2 Server", "Streaming-Replikation", "Auto-Failover"],
+        "bestFor": "Produktions-SaaS ohne Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Automatisch skalierender k3s-Cluster.",
+        "features": ["Einzelne Region", "Horizontale Autoskalierung", "Rollierende Updates"],
+        "bestFor": "Anwendungen mit hohem Traffic"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Multi-Region-Cluster, maximale Verfügbarkeit.",
+        "features": ["2 Regionen", "Regions-Failover", "Autoskalierung"],
+        "bestFor": "Geschäftskritisch & global"
+      }
+    },
     "pricing": {
       "headline1": "Von der",
       "headlineSketch": "Idee",

package/carbon/src/client/locales/en.json

@@ -394,6 +394,35 @@
         "description": "Every route validates with Zod, every query uses the right Supabase client, every table has RLS. AI agents replicate the same correct patterns every time."
       }
     },
+    "deploy": {
+      "headline": "Deploy your way,",
+      "headlineHighlight": "in one command",
+      "subheading": "From a single VPS to multi-region Kubernetes — choose your level of scale and resilience. Grow into the next tier whenever you're ready.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "One VPS, your full stack included.",
+        "features": ["1 server", "Single region"],
+        "bestFor": "MVPs & internal tools"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Two servers, automatic failover.",
+        "features": ["2 servers", "Streaming replication", "Auto-failover"],
+        "bestFor": "Production SaaS without Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Auto-scaling k3s cluster.",
+        "features": ["Single region", "Horizontal autoscaling", "Rolling updates"],
+        "bestFor": "High-traffic apps"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Multi-region clusters, maximum uptime.",
+        "features": ["2 regions", "Region failover", "Autoscaling"],
+        "bestFor": "Mission-critical & global"
+      }
+    },
     "pricing": {
       "headline1": "From",
       "headlineSketch": "sketch",

package/carbon/src/client/locales/es.json

@@ -394,6 +394,35 @@
         "description": "Cada ruta valida con Zod, cada consulta usa el cliente Supabase correcto, cada tabla tiene RLS. Los agentes de IA replican los mismos patrones correctos en todo momento."
       }
     },
+    "deploy": {
+      "headline": "Despliega a tu manera,",
+      "headlineHighlight": "en un solo comando",
+      "subheading": "De un único VPS a Kubernetes multirregión — elige tu nivel de escalado y resiliencia. Sube al siguiente nivel cuando quieras.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "Un VPS, con todo tu stack incluido.",
+        "features": ["1 servidor", "Región única"],
+        "bestFor": "MVPs y herramientas internas"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Dos servidores, conmutación automática.",
+        "features": ["2 servidores", "Replicación en streaming", "Conmutación automática"],
+        "bestFor": "SaaS en producción sin Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Clúster k3s con autoescalado.",
+        "features": ["Región única", "Autoescalado horizontal", "Actualizaciones progresivas"],
+        "bestFor": "Apps de alto tráfico"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Clústeres multirregión, máxima disponibilidad.",
+        "features": ["2 regiones", "Conmutación de región", "Autoescalado"],
+        "bestFor": "Críticos y globales"
+      }
+    },
     "pricing": {
       "headline1": "Del",
       "headlineSketch": "boceto",

package/carbon/src/client/locales/fr.json

@@ -394,6 +394,35 @@
         "description": "Chaque route valide avec Zod, chaque requête utilise le bon client Supabase, chaque table a RLS. Les agents IA reproduisent les mêmes schémas corrects à chaque fois."
       }
     },
+    "deploy": {
+      "headline": "Déployez à votre façon,",
+      "headlineHighlight": "en une commande",
+      "subheading": "D'un seul VPS à Kubernetes multi-région — choisissez votre niveau d'évolutivité et de résilience. Passez au palier supérieur quand vous le souhaitez.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "Un VPS, toute votre stack incluse.",
+        "features": ["1 serveur", "Région unique"],
+        "bestFor": "MVP et outils internes"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Deux serveurs, bascule automatique.",
+        "features": ["2 serveurs", "Réplication en flux", "Bascule automatique"],
+        "bestFor": "SaaS en production sans Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Cluster k3s à mise à l'échelle automatique.",
+        "features": ["Région unique", "Mise à l'échelle horizontale", "Mises à jour progressives"],
+        "bestFor": "Applications à fort trafic"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Clusters multi-région, disponibilité maximale.",
+        "features": ["2 régions", "Bascule de région", "Mise à l'échelle auto"],
+        "bestFor": "Critique et mondial"
+      }
+    },
     "pricing": {
       "headline1": "Du",
       "headlineSketch": "brouillon",

package/carbon/src/client/locales/pt.json

@@ -394,6 +394,35 @@
         "description": "Cada rota valida com Zod, cada consulta usa o cliente Supabase correto, cada tabela tem RLS. Os agentes de IA replicam sempre os mesmos padrões corretos."
       }
     },
+    "deploy": {
+      "headline": "Implante do seu jeito,",
+      "headlineHighlight": "com um único comando",
+      "subheading": "De um único VPS a Kubernetes multirregião — escolha seu nível de escala e resiliência. Suba para o próximo nível quando quiser.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "Um VPS, com toda a sua stack incluída.",
+        "features": ["1 servidor", "Região única"],
+        "bestFor": "MVPs e ferramentas internas"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Dois servidores, failover automático.",
+        "features": ["2 servidores", "Replicação em streaming", "Failover automático"],
+        "bestFor": "SaaS em produção sem Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Cluster k3s com escalonamento automático.",
+        "features": ["Região única", "Escalonamento horizontal", "Atualizações graduais"],
+        "bestFor": "Apps de alto tráfego"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Clusters multirregião, disponibilidade máxima.",
+        "features": ["2 regiões", "Failover de região", "Escalonamento automático"],
+        "bestFor": "Crítico e global"
+      }
+    },
     "pricing": {
       "headline1": "Do",
       "headlineSketch": "esboço",

package/carbon/src/client/pages/Home.tsx

@@ -16,6 +16,7 @@ import { AIIntegrationSection } from '../components/AIIntegrationSection';
 import { ArchitectureSection } from '../components/ArchitectureSection';
 import { ComparisonSection } from '../components/ComparisonSection';
 import { CTAFooter } from '../components/CTAFooter';
+import { DeploymentScenariosSection } from '../components/DeploymentScenariosSection';
 import { FilmGrainOverlay } from '../components/effects/FilmGrainOverlay';
 import { VGlowEffect } from '../components/effects/VGlowEffect';
 import { FAQSection } from '../components/FAQSection';
@@ -168,6 +169,10 @@ export default function VibecarbonHome() {
             <ArchitectureSection />
           </ScrollSection>
 
+          <ScrollSection id="deploy-scenarios">
+            <DeploymentScenariosSection />
+          </ScrollSection>
+
           <ScrollSection id="pricing">
             <PricingSection />
           </ScrollSection>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecarbon",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",
@@ -89,7 +89,6 @@
     "autocannon": "^8.0.0",
     "better-sqlite3": "^12.8.0",
     "conventional-changelog-conventionalcommits": "^9.3.1",
-    "msw": "^2.12.14",
     "semantic-release": "^25.0.3",
     "tsx": "^4.21.0",
     "vite": "^8.0.14",