vibecarbon 0.4.0 → 0.5.0

package/carbon/src/client/locales/pt.json

@@ -394,6 +394,35 @@
         "description": "Cada rota valida com Zod, cada consulta usa o cliente Supabase correto, cada tabela tem RLS. Os agentes de IA replicam sempre os mesmos padrões corretos."
       }
     },
+    "deploy": {
+      "headline": "Implante do seu jeito,",
+      "headlineHighlight": "com um único comando",
+      "subheading": "De um único VPS a Kubernetes multirregião — escolha seu nível de escala e resiliência. Suba para o próximo nível quando quiser.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "Um VPS, com toda a sua stack incluída.",
+        "features": ["1 servidor", "Região única"],
+        "bestFor": "MVPs e ferramentas internas"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Dois servidores, failover automático.",
+        "features": ["2 servidores", "Replicação em streaming", "Failover automático"],
+        "bestFor": "SaaS em produção sem Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Cluster k3s com escalonamento automático.",
+        "features": ["Região única", "Escalonamento horizontal", "Atualizações graduais"],
+        "bestFor": "Apps de alto tráfego"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Clusters multirregião, disponibilidade máxima.",
+        "features": ["2 regiões", "Failover de região", "Escalonamento automático"],
+        "bestFor": "Crítico e global"
+      }
+    },
     "pricing": {
       "headline1": "Do",
       "headlineSketch": "esboço",

package/carbon/src/client/pages/Home.tsx

@@ -16,6 +16,7 @@ import { AIIntegrationSection } from '../components/AIIntegrationSection';
 import { ArchitectureSection } from '../components/ArchitectureSection';
 import { ComparisonSection } from '../components/ComparisonSection';
 import { CTAFooter } from '../components/CTAFooter';
+import { DeploymentScenariosSection } from '../components/DeploymentScenariosSection';
 import { FilmGrainOverlay } from '../components/effects/FilmGrainOverlay';
 import { VGlowEffect } from '../components/effects/VGlowEffect';
 import { FAQSection } from '../components/FAQSection';
@@ -168,6 +169,10 @@ export default function VibecarbonHome() {
             <ArchitectureSection />
           </ScrollSection>
 
+          <ScrollSection id="deploy-scenarios">
+            <DeploymentScenariosSection />
+          </ScrollSection>
+
           <ScrollSection id="pricing">
             <PricingSection />
           </ScrollSection>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecarbon",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",

package/src/backup.js

@@ -448,6 +448,7 @@ export async function run(args) {
     sshKeyPath,
     projectName,
     envName,
+    backupRetain: envConfig.backup?.retentionDays,
     yes: !!values.y,
   });
   tracker.finish();
@@ -647,6 +648,7 @@ async function runCreate({
   sshKeyPath,
   projectName,
   envName,
+  backupRetain,
   yes,
 }) {
   if (!yes) {
@@ -660,37 +662,16 @@ async function runCreate({
   }
 
   if (isCompose) {
-    s.start('Creating backup via Docker Compose...');
+    s.start('Creating wal-g base backup...');
     try {
-      const { backupCompose, uploadComposeBackupToS3 } = await import(
-        './lib/deploy/compose/index.js'
-      );
-      const backupFile = backupCompose(serverIp, sshKeyPath, projectName);
-      s.stop('Backup created');
-      p.log.success(`Backup: ${c.bold(backupFile)}`);
-      p.log.info(`Location: /opt/${projectName}/backups/${backupFile}`);
-
-      if (useS3) {
-        s.start('Uploading backup to S3...');
-        try {
-          await uploadComposeBackupToS3(serverIp, sshKeyPath, projectName, backupFile, s3Config);
-          s.stop(`Uploaded to S3: ${s3Config.bucket}/backups/${backupFile}`);
-        } catch (uploadError) {
-          s.stop(`S3 upload failed: ${uploadError.message}`);
-          p.log.warn('Backup is available on the server but was not uploaded to S3.');
-          // Dump the raw error to stderr so automation captures the
-          // actual AWS SDK error code + HTTP status — the spinner
-          // message above hides the detail e2e/CI needs.
-          console.error(
-            `[backup] S3 upload failed — name=${uploadError.name} code=${uploadError.Code ?? uploadError.code ?? 'n/a'} status=${uploadError.$metadata?.httpStatusCode ?? 'n/a'} bucket=${s3Config.bucket} endpoint=${s3Config.endpoint} region=${s3Config.region}`,
-          );
-          if (uploadError.stack) {
-            console.error(uploadError.stack);
-          }
-        }
-      } else {
-        p.log.info(`Download: scp root@${serverIp}:/opt/${projectName}/backups/${backupFile} .`);
-      }
+      const { backupCompose } = await import('./lib/deploy/compose/index.js');
+      backupCompose(serverIp, sshKeyPath, projectName, { retain: backupRetain });
+      // "uploaded to S3" wording matches the k8s path (line ~689) and the e2e
+      // backup-step verification (which greps /uploaded to s3/i to confirm the
+      // backup is durable before allowing destroy → restore).
+      s.stop('wal-g base backup uploaded to S3');
+      p.log.success('Backup uploaded to S3 — wal-g pushed the base backup directly.');
+      p.log.info(`List backups: ${c.info(`vibecarbon backup ${envName} -l`)}`);
     } catch (error) {
       s.stop('Backup failed');
       p.log.error(error.message);

package/src/destroy.js

@@ -1055,49 +1055,11 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
       backupSpinner.start('Creating backup...');
       try {
         if (envConfig.deployMode === 'compose' || envConfig.deployMode === 'compose-ha') {
-          const { backupCompose, uploadComposeBackupToS3 } = await import(
-            './lib/deploy/compose/index.js'
-          );
-          const backupFile = backupCompose(serverIp, sshKeyPath, projectConfig.projectName);
-
-          const backupS3 = envConfig.backupS3;
-          if (backupS3) {
-            const { getS3Credentials } = await import('./lib/hetzner-guided-setup.js');
-            const creds = await getS3Credentials(projectConfig.projectName, { save: false });
-            if (creds) {
-              await uploadComposeBackupToS3(
-                serverIp,
-                sshKeyPath,
-                projectConfig.projectName,
-                backupFile,
-                {
-                  ...backupS3,
-                  accessKey: creds.accessKey,
-                  secretKey: creds.secretKey,
-                },
-              );
-              backupSpinner.stop(`Backup saved to S3: ${backupS3.bucket}/backups/${backupFile}`);
-            } else {
-              backupSpinner.stop(`Backup created on server: ${backupFile}`);
-              p.log.warn(
-                'Could not upload to S3 (no credentials). Download before destroy completes:',
-              );
-              p.log.info(
-                `  scp root@${serverIp}:/opt/${projectConfig.projectName}/backups/${backupFile} .`,
-              );
-            }
-          } else {
-            // No S3 — download locally
-            const { scpDownload } = await import('./lib/ssh.js');
-            const localPath = join(cwd, backupFile);
-            scpDownload(
-              serverIp,
-              sshKeyPath,
-              `/opt/${projectConfig.projectName}/backups/${backupFile}`,
-              localPath,
-            );
-            backupSpinner.stop(`Backup saved locally: ${backupFile}`);
-          }
+          const { backupCompose } = await import('./lib/deploy/compose/index.js');
+          backupCompose(serverIp, sshKeyPath, projectConfig.projectName, {
+            retain: envConfig.backup?.retentionDays,
+          });
+          backupSpinner.stop('wal-g base backup pushed to S3');
         }
       } catch (backupError) {
         backupSpinner.stop(`Backup failed: ${backupError.message}`);

package/src/lib/deploy/bundle.js

@@ -13,13 +13,21 @@ import { DNS01_OVERRIDE_FILE, dnsChallengeEnv } from './acme.js';
 /**
  * Render the reconcile.sh script
  */
-function renderReconcileScript(projectName, composeFlags, isFast = false) {
+export function renderReconcileScript(projectName, composeFlags, isFast = false) {
+  // On compose-ha servers the replication overlay (docker-compose.replication.yml)
+  // publishes port 5433 → db:5432 for pg_basebackup / streaming replication.
+  // reconcile.sh is baked with static composeFlags at deploy time, so we embed a
+  // shell conditional here that appends the overlay at runtime when present.
+  // On single-server compose the file never exists, so this is a safe no-op.
+  const replOverlayFlag =
+    "$([ -f docker-compose.replication.yml ] && echo '-f docker-compose.replication.yml')";
+
   const pullStep = isFast
     ? ''
     : `
 # 1. Pull latest images if needed
 echo "Pulling images..."
-docker compose ${composeFlags} pull --quiet --policy missing --ignore-buildable || true
+docker compose ${composeFlags} ${replOverlayFlag} pull --quiet --policy missing --ignore-buildable || true
 `;
 
   return `#!/bin/bash
@@ -47,7 +55,7 @@ fi
 ${pullStep}
 # 2. Re-create containers if state differs
 echo "Updating containers..."
-docker compose ${composeFlags} up -d --remove-orphans
+docker compose ${composeFlags} ${replOverlayFlag} up -d --remove-orphans
 
 # 3. Ensure systemd service is active (if applicable)
 if [ -f "/etc/systemd/system/${projectName}.service" ]; then
@@ -107,6 +115,90 @@ function composeFileFlags(options = {}) {
   return files.join(' ');
 }
 
+/**
+ * Render the Traefik dynamic-config file that instructs Traefik to obtain and
+ * serve ONE cert for the entire deploy as the TLS default store entry.
+ *
+ * With `defaultGeneratedCert`, Traefik proactively requests a single cert via
+ * the named resolver at startup and serves it by default for every TLS router
+ * that does NOT carry an explicit `tls.certresolver` label. All our production
+ * routers use `tls=true` without a resolver — they all get this cert via SNI.
+ *
+ * Challenge-type differences:
+ *   - DNS-01 (managed DNS — cloudflare/hetzner): `sans: ["*.${domain}"]`.
+ *     One wildcard cert covers all subdomains, no per-subdomain ACME orders.
+ *   - HTTP-01 (manual DNS): wildcards require DNS-01 (LE policy), so we list
+ *     the explicit subdomains that are active for this deploy instead.
+ *     `main` stays `${domain}` (the app root); `sans` lists api/studio/dashboard
+ *     plus any enabled feature subdomains (grafana/prometheus, n8n, metabase).
+ *
+ * The file is written into `volumes/traefik/` which is already bind-mounted
+ * as `/etc/traefik/dynamic:ro`. Traefik hot-reloads files from that dir.
+ * Multiple files in the dir coexist fine; this file adds only a top-level
+ * `tls:` key that has no overlap with the `http:` keys in middlewares.yml.
+ *
+ * @param {{domain: string, dnsChallenge: boolean, features?: {observability?: boolean, n8n?: boolean, metabase?: boolean}}} opts
+ * @returns {string} YAML string suitable for writing to `volumes/traefik/tls-default.yml`
+ */
+export function renderTraefikDefaultCert({ domain, dnsChallenge, features = {} }) {
+  // The default store cert covers the SUBDOMAINS only. The app at the bare apex
+  // (`${domain}`) gets its OWN single-domain cert via the app router's
+  // `tls.certresolver` label — it is deliberately NOT in this cert.
+  //
+  // Why split apex off the wildcard: a cert for [`${domain}`, `*.${domain}`] has
+  // TWO ACME authorizations that BOTH validate via the SAME TXT record
+  // `_acme-challenge.${domain}`, so both challenge values must be present there
+  // simultaneously. The Hetzner lego DNS provider REPLACES the TXT rrset instead
+  // of holding both values, so one authorization always fails with
+  // "403 unauthorized :: Incorrect TXT record". (Cloudflare holds both and
+  // worked — RCA 2026-06-01, compose e2e wildcard verify-deploy.) As two
+  // SEPARATE single-authz certs (apex via the app router, `*.${domain}` here),
+  // Traefik obtains them serially, so `_acme-challenge.${domain}` only ever
+  // needs one value at a time — robust on Hetzner AND Cloudflare.
+  let main;
+  let sans;
+  if (dnsChallenge) {
+    // DNS-01: one wildcard covers every subdomain (most general level).
+    main = `*.${domain}`;
+    sans = [];
+  } else {
+    // HTTP-01: wildcards require DNS-01 (LE policy), so enumerate the active
+    // subdomains. `api` (kong), `studio`, `dashboard` always exist; the rest are
+    // feature-gated. The apex app is covered by its own router cert, not here.
+    const subs = ['studio', 'dashboard'];
+    if (features.observability) subs.push('grafana', 'prometheus');
+    if (features.n8n) subs.push('n8n');
+    if (features.metabase) subs.push('metabase');
+    main = `api.${domain}`;
+    sans = subs.map((s) => `${s}.${domain}`);
+  }
+
+  const lines = [
+    'tls:',
+    '  stores:',
+    '    default:',
+    '      defaultGeneratedCert:',
+    '        resolver: letsencrypt',
+    '        domain:',
+    `          main: "${main}"`,
+  ];
+  if (sans.length) {
+    lines.push('          sans:');
+    for (const d of sans) lines.push(`            - "${d}"`);
+  }
+
+  return `# Traefik default TLS certificate — generated by Vibecarbon at deploy time.
+#
+# Serves as the default cert for ALL TLS routers carrying \`tls=true\` without an
+# explicit certresolver (SNI fallback). Covers the SUBDOMAINS; the apex app gets
+# its own cert via the app router's \`tls.certresolver\`.
+#
+# DNS-01 (cloudflare/hetzner): one wildcard cert covering every subdomain.
+# HTTP-01 (manual DNS): explicit subdomain SANs (LE policy forbids wildcards).
+${lines.join('\n')}
+`;
+}
+
 /**
  * Render the deployment bundle to a local temp directory
  * @param {string} projectName
@@ -233,13 +325,36 @@ export function renderBundle(projectName, options = {}) {
   // template ships a stub at functions/main/index.ts. RCA: prod-1 2026-05-26.
   copyDirIfExist('functions', 'functions');
 
-  // volumes/traefik/middlewares.yml
+  // volumes/traefik/ — dynamic-config directory mounted into Traefik.
+  // Always ensure the dir exists in the bundle so Traefik's file provider
+  // has a valid mount target even if the source dir is absent.
+  mkdirSync(join(stageDir, 'volumes', 'traefik'), { recursive: true });
+
   const traefikMiddlewares = join(cwd, 'volumes', 'traefik', 'middlewares.yml');
   if (existsSync(traefikMiddlewares)) {
-    mkdirSync(join(stageDir, 'volumes', 'traefik'), { recursive: true });
     cpSync(traefikMiddlewares, join(stageDir, 'volumes', 'traefik', 'middlewares.yml'));
   }
 
+  // Render tls-default.yml only when a domain is known (production deploys).
+  // This instructs Traefik to proactively obtain ONE cert for the deploy and
+  // serve it as the default for all TLS routers via SNI. DNS-01 deploys get
+  // a wildcard SAN (*.${domain}); HTTP-01 deploys get explicit subdomain SANs.
+  // The file coexists with middlewares.yml — both live under the same `tls:`
+  // / `http:` top-level keys respectively; Traefik merges all files in the dir.
+  if (options.domain) {
+    const tlsDefaultYaml = renderTraefikDefaultCert({
+      domain: options.domain,
+      dnsChallenge: Boolean(options.dnsChallenge),
+      features: {
+        observability: options.observability,
+        n8n: options.n8n,
+        metabase: options.metabase,
+      },
+    });
+    writeFileSync(join(stageDir, 'volumes', 'traefik', 'tls-default.yml'), tlsDefaultYaml);
+    if (options.verbose) console.log('[bundle] Rendered volumes/traefik/tls-default.yml');
+  }
+
   copyDirIfExist('backup', 'backup');
   if (options.n8n) copyDirIfExist('volumes/n8n', 'volumes/n8n');
   if (options.metabase) copyDirIfExist('volumes/metabase', 'volumes/metabase');

package/src/lib/deploy/compose/ha.js

@@ -31,6 +31,7 @@ import {
   isLocalOnlyImageTag,
   pullComposeImages,
   runMigrations,
+  setupComposeBackupCron,
   setupServer,
   setupServerFiles,
   sshRun,
@@ -161,6 +162,51 @@ async function deleteFirewallByName(name, hetznerHeaders, deadlineMs = 30_000) {
 // POSTGRESQL STREAMING REPLICATION SETUP
 // ============================================================================
 
+// WAL-G / ARCHIVING DOVETAIL INVARIANTS (wal-g unify, 2026-05-31)
+//
+// Invariant 1 — archiving survives failover.
+//   carbon/docker-compose.yml hardcodes `archive_mode=on` and
+//   `archive_command=bash /etc/postgresql/wal-archive.sh %p` in the db
+//   container's `command:`. A promoted standby runs the SAME image/command,
+//   so it starts archiving WAL on the new timeline immediately after promotion.
+//   No extra step is needed.
+//   WALG_S3_PREFIX is derived from S3_BACKUP_BUCKET + PROJECT_NAME (see
+//   docker-compose.yml:197) and is identical on both nodes — same .env is
+//   deployed to both servers via setupServerFiles. The WAL timeline is therefore
+//   continuous across failover: pre-promotion WAL is on TL1, post-promotion WAL
+//   is on TL2, both under the same S3 prefix.
+//   Note: a PostgreSQL standby with archive_mode=on does NOT archive while it is
+//   in recovery — only the primary archives. There is no double-archive risk
+//   before failover.
+//
+// Invariant 2 — backup guard means only the active primary backs up.
+//   carbon/backup/compose-backup.sh checks `pg_is_in_recovery()='f'` before
+//   calling `wal-g backup-push` (and self-skips with exit 0 when no S3 backup
+//   target / credentials are configured). Before failover: standby cron is a
+//   no-op; primary cron backs up. After failover: promoted standby cron backs
+//   up; old primary (if still alive) is now a standby, so its cron is a no-op.
+//   The scheduled backup cron is installed on BOTH nodes at the end of
+//   deployComposeHA (see the setupComposeBackupCron fan-out after replication
+//   verification). The standby's cron is a guarded no-op until it is promoted —
+//   installing on both means the survivor always has the cron after a failover,
+//   so scheduled backups don't silently stop when DNS flips to the standby.
+//
+// Invariant 3 — restore seeds the primary; standby is REBUILT afterward.
+//   compose restore (restoreCompose in compose/index.js) rewinds the primary's
+//   data directory and replays WAL from S3. A standby that was streaming from the
+//   old (pre-restore) primary then has WAL *ahead* of the restored primary's LSN
+//   and CANNOT resume streaming — PG would reject it with "requested timeline
+//   does not contain minimum recovery point" (timeline divergence). The correct
+//   post-restore sequence is:
+//     1. Restore the primary (restoreCompose → backup-fetch + archive recovery).
+//     2. Re-seed the standby via configureStandbyReplication (pg_basebackup
+//        from the now-restored primary). This wipes the diverged standby state
+//        and brings it in sync with the new primary timeline.
+//   This is wired in restore.js:runComposeRestore — after restoreCompose on the
+//   primary, it re-runs configureStandbyReplication against the standby whenever
+//   deployMode === 'compose-ha' (skipped for single-region compose, which has no
+//   standby). configureStandbyReplication is exported from this file for that.
+
 /**
  * Configure the primary PostgreSQL server for streaming replication.
  *
@@ -279,7 +325,7 @@ END $$;
  * 3. Write standby.signal and configure primary_conninfo
  * 4. Restart as hot standby
  */
-async function configureStandbyReplication(standbyIp, primaryIp, sshKeyPath, projectName) {
+export async function configureStandbyReplication(standbyIp, primaryIp, sshKeyPath, projectName) {
   const remoteDir = `/opt/${projectName}`;
   // replPassword is generated at create time from crypto.randomBytes and is
   // restricted to base64url characters — no shell escaping needed.
@@ -293,6 +339,33 @@ async function configureStandbyReplication(standbyIp, primaryIp, sshKeyPath, pro
     );
   }
 
+  // Ensure the physical replication slot exists on the PRIMARY before the
+  // standby's pg_basebackup -S below. configurePrimaryReplication creates it at
+  // deploy time, but a wal-g RESTORE overwrites the primary's PGDATA — which
+  // includes pg_replslot — so the slot is wiped. Without re-creating it,
+  // pg_basebackup fails late with `replication slot "vibecarbon_standby_slot"
+  // does not exist` (it connects + checkpoints, then the -Xs WAL receiver's
+  // START_REPLICATION errors). This bit the failover re-seed after a wal-g
+  // restore — the pg_dump restore never had this problem because it loaded
+  // logical data without touching pg_replslot. Idempotent (IF NOT EXISTS), so
+  // it's a safe no-op on the deploy path where the slot already exists.
+  // RCA 2026-06-01: compose-ha failover after wal-g restore.
+  const ensureSlotSql = `DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_replication_slots WHERE slot_name = 'vibecarbon_standby_slot'
+  ) THEN
+    PERFORM pg_create_physical_replication_slot('vibecarbon_standby_slot');
+  END IF;
+END $$;`;
+  const ensureSlotB64 = Buffer.from(ensureSlotSql).toString('base64');
+  sshRun(
+    primaryIp,
+    sshKeyPath,
+    `cd ${remoteDir} && echo ${ensureSlotB64} | base64 -d | docker compose exec -T db psql -U supabase_admin -d postgres`,
+    { timeout: 30_000 },
+  );
+
   // Stop the standby database
   sshRun(standbyIp, sshKeyPath, `cd ${remoteDir} && docker compose stop db`, {
     timeout: 60_000,
@@ -1170,6 +1243,39 @@ export async function deployComposeHA(options) {
     p.log.warn('Streaming replication not detected — standby may fall behind');
   }
 
+  // Install the scheduled wal-g backup cron on BOTH nodes. Invariant 2: the
+  // standby's cron is a harmless no-op — compose-backup.sh guards on
+  // `pg_is_in_recovery()='f'` and exits 0 on a standby without pushing. We
+  // install on both so that after a failover the SURVIVOR (whichever node was
+  // promoted) already has the cron and keeps backing up — without it, a
+  // failover to the standby would silently lose scheduled backups until the
+  // operator re-ran deploy. setupComposeBackupCron defaults schedule + retain
+  // when backupConfig is absent; compose-backup.sh self-skips (exit 0) when no
+  // S3 backup target is configured, so an always-installed cron never hard-fails.
+  //
+  // allSettled (not all) + per-node warn: a cron-install hiccup on one node
+  // must not fail an already-serving HA deploy, nor mask the other node. The
+  // app + replication are already up by this point.
+  onProgress('Installing backup cron on both servers...');
+  const cronResults = await perfAsync('deploy.ha.compose.backupCron.both', () =>
+    Promise.allSettled([
+      perfAsync('deploy.ha.compose.backupCron.primary', async () =>
+        setupComposeBackupCron(primaryIp, sshKeyPath, projectName, backupConfig),
+      ),
+      perfAsync('deploy.ha.compose.backupCron.standby', async () =>
+        setupComposeBackupCron(standbyIp, sshKeyPath, projectName, backupConfig),
+      ),
+    ]),
+  );
+  for (const [i, result] of cronResults.entries()) {
+    if (result.status === 'rejected') {
+      const node = i === 0 ? `primary (${primaryIp})` : `standby (${standbyIp})`;
+      p.log.warn(
+        `Scheduled backup cron install failed on ${node} (deploy still succeeded): ${result.reason?.message ?? result.reason}`,
+      );
+    }
+  }
+
   // Finalize config — promote pending → deployed
   saveProjectConfig({
     ...projectConfig,
@@ -1568,6 +1674,13 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
   // — run pg_basebackup to guarantee schema parity, then promote. For a
   // real disaster failover where primary is unreachable, skip the re-seed
   // and promote whatever state standby has (best-effort recovery).
+  //
+  // WAL-G archiving invariant (Invariant 1): the promoted node starts
+  // archiving on the new timeline immediately after pg_promote() — the
+  // docker-compose.yml command hardcodes archive_mode=on + archive_command
+  // on the db image. WALG_S3_PREFIX is the same on both nodes (same .env),
+  // so the WAL timeline is continuous in S3 across the failover. No extra
+  // action needed here.
   const primaryReachable = await isPrimaryReachable(primaryServer.ip, sshKeyPath, remoteDir);
   if (primaryReachable) {
     s.start('Re-seeding standby from primary (pg_basebackup)');