vibecarbon 0.4.0 → 0.5.0

package/src/scale.js

@@ -13,8 +13,7 @@
  * prompt covers that need without tying up two top-level letters.
  */
 
-import { existsSync, readFileSync, unlinkSync } from 'node:fs';
-import os from 'node:os';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import * as p from '@clack/prompts';
 import { getGHCRCredentials } from './lib/build.js';
@@ -49,7 +48,7 @@ import { assertInProjectDir } from './lib/project-guard.js';
 import { HetznerProvider } from './lib/providers/hetzner.js';
 import { buildComposeTypeOptions, buildSimpleTypeOptions } from './lib/server-types.js';
 import { parseDotenv } from './lib/shell.js';
-import { scpDownload, scpUpload, sshRun, sshRunScript } from './lib/ssh.js';
+import { sshRun, sshRunScript } from './lib/ssh.js';
 import { VERSION } from './lib/version.js';
 
 // ============================================================================
@@ -296,12 +295,14 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       envConfig.deployMode === 'compose-ha' ? `${server.role} (${server.ip})` : server.ip;
     const s = p.spinner();
 
-    // 1. Backup database on old server (--clean so restore can run without DROP DATABASE)
+    // 1. Backup database on old server via wal-g (pushes directly to S3)
     s.start(`Backing up database on ${label}...`);
-    const archiveName = await perfAsync('scale.backupOldServer', async () =>
-      backupCompose(server.ip, sshKeyPath, projectName, { clean: true }),
+    await perfAsync('scale.backupOldServer', async () =>
+      backupCompose(server.ip, sshKeyPath, projectName, {
+        retain: envConfig.backup?.retentionDays,
+      }),
     );
-    s.stop(`Database backed up: ${archiveName}`);
+    s.stop('Database backed up (wal-g base backup pushed to S3)');
 
     // 2. Create new server. user_data front-loads ufw + unattended-upgrades
     // during boot so setupServer is a ~2s marker-file probe below.
@@ -487,41 +488,24 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
       );
       s.stop('Services started');
 
-      // 7. Wait for DB to be ready (backup uses --clean so no DROP DATABASE needed)
-      s.start('Waiting for database to be ready...');
-      const remoteDir = `/opt/${projectName}`;
-      // Shell loop + `$(...)` needs a real shell; projectName is basename-validated.
-      sshRunScript(
-        newIp,
-        sshKeyPath,
-        `cd ${remoteDir} && for i in $(seq 1 30); do docker compose exec -T db pg_isready -U postgres >/dev/null 2>&1 && break || sleep 2; done`,
-        { timeout: 120_000 },
-      );
-      s.stop('Database ready for restore');
-
-      // 8. Transfer backup from old server to new server
-      s.start('Transferring backup to new server...');
-      const localTmpBackup = join(os.tmpdir(), archiveName);
-      try {
-        scpDownload(server.ip, sshKeyPath, `${remoteDir}/backups/${archiveName}`, localTmpBackup);
-        sshRun(newIp, sshKeyPath, ['mkdir', '-p', `${remoteDir}/backups`]);
-        scpUpload(newIp, sshKeyPath, localTmpBackup, `${remoteDir}/backups/${archiveName}`);
-      } finally {
-        try {
-          unlinkSync(localTmpBackup);
-        } catch {
-          // ignore cleanup errors
-        }
-      }
-      s.stop('Backup transferred');
-
-      // 9. Restore database on new server
-      s.start('Restoring database...');
+      // 7. Restore database on new server from S3 via wal-g. The base backup +
+      //    WAL were pushed straight to S3 by step 1's backupCompose, so the
+      //    restore fetches LATEST directly — no local archive to transfer.
+      //    S3 credentials come from the db container's env (sourced from .env)
+      //    so no opts are needed; restoreCompose handles its own verify loop
+      //    (pg_isready + pg_is_in_recovery() = f) before returning.
+      s.start('Restoring database from S3 via wal-g...');
       await perfAsync('scale.restoreDb', async () =>
-        restoreCompose(newIp, sshKeyPath, projectName, archiveName),
+        restoreCompose(newIp, sshKeyPath, projectName, 'latest'),
       );
       s.stop('Database restored');
 
+      // Remote compose project dir on the new server — used by the ACME reset
+      // and the post-restore service recreate below. (Previously declared by a
+      // since-removed pre-restore readiness step; restoreCompose now owns that
+      // wait, so declare it here.)
+      const remoteDir = `/opt/${projectName}`;
+
       // 9a. Update DNS to the new server. On HTTP-01 this must happen BEFORE
       // recreating services (Traefik challenges the A record on startup; a
       // stale record fails all challenges with a 30+ min retry). On DNS-01 the
@@ -577,34 +561,26 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
           : []),
         ...(services.redis ? ['-f docker-compose.redis.yml'] : []),
       ].join(' ');
+      // On compose-ha, docker-compose.replication.yml (written by configurePrimaryReplication)
+      // publishes 5433 → db:5432 for pg_basebackup / streaming replication.
+      // Append it when present so force-recreate doesn't silently drop the 5433 mapping.
+      // On single-server compose the file never exists — the shell conditional is a no-op.
+      const replOverlayFlag =
+        "$([ -f docker-compose.replication.yml ] && echo '-f docker-compose.replication.yml')";
       s.start('Recreating all services after restore...');
       sshRunScript(
         newIp,
         sshKeyPath,
-        `cd ${remoteDir} && docker compose ${composeFlags} up -d --force-recreate 2>&1`,
+        `cd ${remoteDir} && docker compose ${composeFlags} ${replOverlayFlag} up -d --force-recreate 2>&1`,
         { timeout: 600_000 },
       );
       s.stop('All services running');
 
-      // 11. Re-setup backup cron if configured. envConfig only persists
-      //     bucket/region/endpoint under `s3` — accessKey/secretKey live in
-      //     ~/.vibecarbon/credentials.json (loaded into `creds` at step 4b).
-      //     Without merging them in, setupComposeBackupCron would write a
-      //     /etc/vibecarbon/backup.env with empty AWS_ACCESS_KEY_ID /
-      //     AWS_SECRET_ACCESS_KEY and every cron-triggered backup would 403
-      //     against S3.
+      // 11. Re-setup backup cron if configured. wal-g reads its S3 config from
+      //     the db container's env (rendered into .env at deploy), so the cron
+      //     just runs compose-backup.sh on schedule — no separate S3 plumbing.
       if (envConfig.backup) {
-        const backupS3Config =
-          envConfig.s3 && creds.s3
-            ? {
-                bucket: envConfig.s3.bucket,
-                accessKey: creds.s3.accessKey,
-                secretKey: creds.s3.secretKey,
-                endpoint: envConfig.s3.endpoint,
-                region: envConfig.s3.region,
-              }
-            : null;
-        setupComposeBackupCron(newIp, sshKeyPath, projectName, backupS3Config, envConfig.backup);
+        setupComposeBackupCron(newIp, sshKeyPath, projectName, envConfig.backup);
         p.log.info('Backup cron restored on new server');
       }