vibecarbon 0.4.0 → 0.5.1

package/carbon/src/client/locales/de.json

@@ -394,6 +394,35 @@
         "description": "Jede Route validiert mit Zod, jede Abfrage nutzt den richtigen Supabase-Client, jede Tabelle hat RLS. KI-Agenten replizieren jedes Mal dieselben korrekten Muster."
       }
     },
+    "deploy": {
+      "headline": "Deploye nach deinen Vorstellungen,",
+      "headlineHighlight": "mit einem Befehl",
+      "subheading": "Von einem einzelnen VPS bis zu Multi-Region-Kubernetes — wähle dein Maß an Skalierung und Ausfallsicherheit. Wechsle jederzeit in die nächste Stufe.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "Ein VPS, dein kompletter Stack inklusive.",
+        "features": ["1 Server", "Einzelne Region"],
+        "bestFor": "MVPs & interne Tools"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Zwei Server, automatisches Failover.",
+        "features": ["2 Server", "Streaming-Replikation", "Auto-Failover"],
+        "bestFor": "Produktions-SaaS ohne Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Automatisch skalierender k3s-Cluster.",
+        "features": ["Einzelne Region", "Horizontale Autoskalierung", "Rollierende Updates"],
+        "bestFor": "Anwendungen mit hohem Traffic"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Multi-Region-Cluster, maximale Verfügbarkeit.",
+        "features": ["2 Regionen", "Regions-Failover", "Autoskalierung"],
+        "bestFor": "Geschäftskritisch & global"
+      }
+    },
     "pricing": {
       "headline1": "Von der",
       "headlineSketch": "Idee",

package/carbon/src/client/locales/en.json

@@ -394,6 +394,35 @@
         "description": "Every route validates with Zod, every query uses the right Supabase client, every table has RLS. AI agents replicate the same correct patterns every time."
       }
     },
+    "deploy": {
+      "headline": "Deploy your way,",
+      "headlineHighlight": "in one command",
+      "subheading": "From a single VPS to multi-region Kubernetes — choose your level of scale and resilience. Grow into the next tier whenever you're ready.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "One VPS, your full stack included.",
+        "features": ["1 server", "Single region"],
+        "bestFor": "MVPs & internal tools"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Two servers, automatic failover.",
+        "features": ["2 servers", "Streaming replication", "Auto-failover"],
+        "bestFor": "Production SaaS without Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Auto-scaling k3s cluster.",
+        "features": ["Single region", "Horizontal autoscaling", "Rolling updates"],
+        "bestFor": "High-traffic apps"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Multi-region clusters, maximum uptime.",
+        "features": ["2 regions", "Region failover", "Autoscaling"],
+        "bestFor": "Mission-critical & global"
+      }
+    },
     "pricing": {
       "headline1": "From",
       "headlineSketch": "sketch",

package/carbon/src/client/locales/es.json

@@ -394,6 +394,35 @@
         "description": "Cada ruta valida con Zod, cada consulta usa el cliente Supabase correcto, cada tabla tiene RLS. Los agentes de IA replican los mismos patrones correctos en todo momento."
       }
     },
+    "deploy": {
+      "headline": "Despliega a tu manera,",
+      "headlineHighlight": "en un solo comando",
+      "subheading": "De un único VPS a Kubernetes multirregión — elige tu nivel de escalado y resiliencia. Sube al siguiente nivel cuando quieras.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "Un VPS, con todo tu stack incluido.",
+        "features": ["1 servidor", "Región única"],
+        "bestFor": "MVPs y herramientas internas"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Dos servidores, conmutación automática.",
+        "features": ["2 servidores", "Replicación en streaming", "Conmutación automática"],
+        "bestFor": "SaaS en producción sin Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Clúster k3s con autoescalado.",
+        "features": ["Región única", "Autoescalado horizontal", "Actualizaciones progresivas"],
+        "bestFor": "Apps de alto tráfico"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Clústeres multirregión, máxima disponibilidad.",
+        "features": ["2 regiones", "Conmutación de región", "Autoescalado"],
+        "bestFor": "Críticos y globales"
+      }
+    },
     "pricing": {
       "headline1": "Del",
       "headlineSketch": "boceto",

package/carbon/src/client/locales/fr.json

@@ -394,6 +394,35 @@
         "description": "Chaque route valide avec Zod, chaque requête utilise le bon client Supabase, chaque table a RLS. Les agents IA reproduisent les mêmes schémas corrects à chaque fois."
       }
     },
+    "deploy": {
+      "headline": "Déployez à votre façon,",
+      "headlineHighlight": "en une commande",
+      "subheading": "D'un seul VPS à Kubernetes multi-région — choisissez votre niveau d'évolutivité et de résilience. Passez au palier supérieur quand vous le souhaitez.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "Un VPS, toute votre stack incluse.",
+        "features": ["1 serveur", "Région unique"],
+        "bestFor": "MVP et outils internes"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Deux serveurs, bascule automatique.",
+        "features": ["2 serveurs", "Réplication en flux", "Bascule automatique"],
+        "bestFor": "SaaS en production sans Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Cluster k3s à mise à l'échelle automatique.",
+        "features": ["Région unique", "Mise à l'échelle horizontale", "Mises à jour progressives"],
+        "bestFor": "Applications à fort trafic"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Clusters multi-région, disponibilité maximale.",
+        "features": ["2 régions", "Bascule de région", "Mise à l'échelle auto"],
+        "bestFor": "Critique et mondial"
+      }
+    },
     "pricing": {
       "headline1": "Du",
       "headlineSketch": "brouillon",

package/carbon/src/client/locales/pt.json

@@ -394,6 +394,35 @@
         "description": "Cada rota valida com Zod, cada consulta usa o cliente Supabase correto, cada tabela tem RLS. Os agentes de IA replicam sempre os mesmos padrões corretos."
       }
     },
+    "deploy": {
+      "headline": "Implante do seu jeito,",
+      "headlineHighlight": "com um único comando",
+      "subheading": "De um único VPS a Kubernetes multirregião — escolha seu nível de escala e resiliência. Suba para o próximo nível quando quiser.",
+      "compose": {
+        "name": "Docker Compose",
+        "tagline": "Um VPS, com toda a sua stack incluída.",
+        "features": ["1 servidor", "Região única"],
+        "bestFor": "MVPs e ferramentas internas"
+      },
+      "composeHa": {
+        "name": "Compose HA",
+        "tagline": "Dois servidores, failover automático.",
+        "features": ["2 servidores", "Replicação em streaming", "Failover automático"],
+        "bestFor": "SaaS em produção sem Kubernetes"
+      },
+      "k8s": {
+        "name": "Kubernetes",
+        "tagline": "Cluster k3s com escalonamento automático.",
+        "features": ["Região única", "Escalonamento horizontal", "Atualizações graduais"],
+        "bestFor": "Apps de alto tráfego"
+      },
+      "k8sHa": {
+        "name": "Kubernetes HA",
+        "tagline": "Clusters multirregião, disponibilidade máxima.",
+        "features": ["2 regiões", "Failover de região", "Escalonamento automático"],
+        "bestFor": "Crítico e global"
+      }
+    },
     "pricing": {
       "headline1": "Do",
       "headlineSketch": "esboço",

package/carbon/src/client/pages/Home.tsx

@@ -16,6 +16,7 @@ import { AIIntegrationSection } from '../components/AIIntegrationSection';
 import { ArchitectureSection } from '../components/ArchitectureSection';
 import { ComparisonSection } from '../components/ComparisonSection';
 import { CTAFooter } from '../components/CTAFooter';
+import { DeploymentScenariosSection } from '../components/DeploymentScenariosSection';
 import { FilmGrainOverlay } from '../components/effects/FilmGrainOverlay';
 import { VGlowEffect } from '../components/effects/VGlowEffect';
 import { FAQSection } from '../components/FAQSection';
@@ -168,6 +169,10 @@ export default function VibecarbonHome() {
             <ArchitectureSection />
           </ScrollSection>
 
+          <ScrollSection id="deploy-scenarios">
+            <DeploymentScenariosSection />
+          </ScrollSection>
+
           <ScrollSection id="pricing">
             <PricingSection />
           </ScrollSection>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecarbon",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",
@@ -57,12 +57,12 @@
     "url": "https://github.com/hyperformant/vibecarbon.git"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1017.0",
-    "@clack/prompts": "^1.1.0",
-    "@pulumi/hcloud": "^1.32.2",
-    "@pulumi/pulumi": "^3.231.0",
+    "@aws-sdk/client-s3": "^3.1058.0",
+    "@clack/prompts": "^1.5.0",
+    "@pulumi/hcloud": "^1.38.0",
+    "@pulumi/pulumi": "^3.244.0",
     "bcryptjs": "^3.0.3",
-    "undici": "^8.1.0",
+    "undici": "^8.3.0",
     "which": "^7.0.0"
   },
   "pnpm": {
@@ -81,18 +81,18 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.9",
+    "@biomejs/biome": "^2.4.16",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
     "@types/better-sqlite3": "^7.6.13",
-    "@vitest/coverage-v8": "^4.1.1",
+    "@vitest/coverage-v8": "^4.1.8",
     "autocannon": "^8.0.0",
-    "better-sqlite3": "^12.8.0",
+    "better-sqlite3": "^12.10.0",
     "conventional-changelog-conventionalcommits": "^9.3.1",
     "semantic-release": "^25.0.3",
-    "tsx": "^4.21.0",
-    "vite": "^8.0.14",
-    "vitest": "^4.1.1",
-    "zod": "^4.3.6"
+    "tsx": "^4.22.4",
+    "vite": "^8.0.16",
+    "vitest": "^4.1.8",
+    "zod": "^4.4.3"
   }
 }

package/src/backup.js

@@ -448,6 +448,7 @@ export async function run(args) {
     sshKeyPath,
     projectName,
     envName,
+    backupRetain: envConfig.backup?.retentionDays,
     yes: !!values.y,
   });
   tracker.finish();
@@ -647,6 +648,7 @@ async function runCreate({
   sshKeyPath,
   projectName,
   envName,
+  backupRetain,
   yes,
 }) {
   if (!yes) {
@@ -660,37 +662,16 @@ async function runCreate({
   }
 
   if (isCompose) {
-    s.start('Creating backup via Docker Compose...');
+    s.start('Creating wal-g base backup...');
     try {
-      const { backupCompose, uploadComposeBackupToS3 } = await import(
-        './lib/deploy/compose/index.js'
-      );
-      const backupFile = backupCompose(serverIp, sshKeyPath, projectName);
-      s.stop('Backup created');
-      p.log.success(`Backup: ${c.bold(backupFile)}`);
-      p.log.info(`Location: /opt/${projectName}/backups/${backupFile}`);
-
-      if (useS3) {
-        s.start('Uploading backup to S3...');
-        try {
-          await uploadComposeBackupToS3(serverIp, sshKeyPath, projectName, backupFile, s3Config);
-          s.stop(`Uploaded to S3: ${s3Config.bucket}/backups/${backupFile}`);
-        } catch (uploadError) {
-          s.stop(`S3 upload failed: ${uploadError.message}`);
-          p.log.warn('Backup is available on the server but was not uploaded to S3.');
-          // Dump the raw error to stderr so automation captures the
-          // actual AWS SDK error code + HTTP status — the spinner
-          // message above hides the detail e2e/CI needs.
-          console.error(
-            `[backup] S3 upload failed — name=${uploadError.name} code=${uploadError.Code ?? uploadError.code ?? 'n/a'} status=${uploadError.$metadata?.httpStatusCode ?? 'n/a'} bucket=${s3Config.bucket} endpoint=${s3Config.endpoint} region=${s3Config.region}`,
-          );
-          if (uploadError.stack) {
-            console.error(uploadError.stack);
-          }
-        }
-      } else {
-        p.log.info(`Download: scp root@${serverIp}:/opt/${projectName}/backups/${backupFile} .`);
-      }
+      const { backupCompose } = await import('./lib/deploy/compose/index.js');
+      backupCompose(serverIp, sshKeyPath, projectName, { retain: backupRetain });
+      // "uploaded to S3" wording matches the k8s path (line ~689) and the e2e
+      // backup-step verification (which greps /uploaded to s3/i to confirm the
+      // backup is durable before allowing destroy → restore).
+      s.stop('wal-g base backup uploaded to S3');
+      p.log.success('Backup uploaded to S3 — wal-g pushed the base backup directly.');
+      p.log.info(`List backups: ${c.info(`vibecarbon backup ${envName} -l`)}`);
     } catch (error) {
       s.stop('Backup failed');
       p.log.error(error.message);

package/src/destroy.js

@@ -1055,49 +1055,11 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
       backupSpinner.start('Creating backup...');
       try {
         if (envConfig.deployMode === 'compose' || envConfig.deployMode === 'compose-ha') {
-          const { backupCompose, uploadComposeBackupToS3 } = await import(
-            './lib/deploy/compose/index.js'
-          );
-          const backupFile = backupCompose(serverIp, sshKeyPath, projectConfig.projectName);
-
-          const backupS3 = envConfig.backupS3;
-          if (backupS3) {
-            const { getS3Credentials } = await import('./lib/hetzner-guided-setup.js');
-            const creds = await getS3Credentials(projectConfig.projectName, { save: false });
-            if (creds) {
-              await uploadComposeBackupToS3(
-                serverIp,
-                sshKeyPath,
-                projectConfig.projectName,
-                backupFile,
-                {
-                  ...backupS3,
-                  accessKey: creds.accessKey,
-                  secretKey: creds.secretKey,
-                },
-              );
-              backupSpinner.stop(`Backup saved to S3: ${backupS3.bucket}/backups/${backupFile}`);
-            } else {
-              backupSpinner.stop(`Backup created on server: ${backupFile}`);
-              p.log.warn(
-                'Could not upload to S3 (no credentials). Download before destroy completes:',
-              );
-              p.log.info(
-                `  scp root@${serverIp}:/opt/${projectConfig.projectName}/backups/${backupFile} .`,
-              );
-            }
-          } else {
-            // No S3 — download locally
-            const { scpDownload } = await import('./lib/ssh.js');
-            const localPath = join(cwd, backupFile);
-            scpDownload(
-              serverIp,
-              sshKeyPath,
-              `/opt/${projectConfig.projectName}/backups/${backupFile}`,
-              localPath,
-            );
-            backupSpinner.stop(`Backup saved locally: ${backupFile}`);
-          }
+          const { backupCompose } = await import('./lib/deploy/compose/index.js');
+          backupCompose(serverIp, sshKeyPath, projectConfig.projectName, {
+            retain: envConfig.backup?.retentionDays,
+          });
+          backupSpinner.stop('wal-g base backup pushed to S3');
         }
       } catch (backupError) {
         backupSpinner.stop(`Backup failed: ${backupError.message}`);

package/src/lib/deploy/bundle.js

@@ -13,13 +13,21 @@ import { DNS01_OVERRIDE_FILE, dnsChallengeEnv } from './acme.js';
 /**
  * Render the reconcile.sh script
  */
-function renderReconcileScript(projectName, composeFlags, isFast = false) {
+export function renderReconcileScript(projectName, composeFlags, isFast = false) {
+  // On compose-ha servers the replication overlay (docker-compose.replication.yml)
+  // publishes port 5433 → db:5432 for pg_basebackup / streaming replication.
+  // reconcile.sh is baked with static composeFlags at deploy time, so we embed a
+  // shell conditional here that appends the overlay at runtime when present.
+  // On single-server compose the file never exists, so this is a safe no-op.
+  const replOverlayFlag =
+    "$([ -f docker-compose.replication.yml ] && echo '-f docker-compose.replication.yml')";
+
   const pullStep = isFast
     ? ''
     : `
 # 1. Pull latest images if needed
 echo "Pulling images..."
-docker compose ${composeFlags} pull --quiet --policy missing --ignore-buildable || true
+docker compose ${composeFlags} ${replOverlayFlag} pull --quiet --policy missing --ignore-buildable || true
 `;
 
   return `#!/bin/bash
@@ -47,7 +55,7 @@ fi
 ${pullStep}
 # 2. Re-create containers if state differs
 echo "Updating containers..."
-docker compose ${composeFlags} up -d --remove-orphans
+docker compose ${composeFlags} ${replOverlayFlag} up -d --remove-orphans
 
 # 3. Ensure systemd service is active (if applicable)
 if [ -f "/etc/systemd/system/${projectName}.service" ]; then
@@ -107,6 +115,90 @@ function composeFileFlags(options = {}) {
   return files.join(' ');
 }
 
+/**
+ * Render the Traefik dynamic-config file that instructs Traefik to obtain and
+ * serve ONE cert for the entire deploy as the TLS default store entry.
+ *
+ * With `defaultGeneratedCert`, Traefik proactively requests a single cert via
+ * the named resolver at startup and serves it by default for every TLS router
+ * that does NOT carry an explicit `tls.certresolver` label. All our production
+ * routers use `tls=true` without a resolver — they all get this cert via SNI.
+ *
+ * Challenge-type differences:
+ *   - DNS-01 (managed DNS — cloudflare/hetzner): `sans: ["*.${domain}"]`.
+ *     One wildcard cert covers all subdomains, no per-subdomain ACME orders.
+ *   - HTTP-01 (manual DNS): wildcards require DNS-01 (LE policy), so we list
+ *     the explicit subdomains that are active for this deploy instead.
+ *     `main` stays `${domain}` (the app root); `sans` lists api/studio/dashboard
+ *     plus any enabled feature subdomains (grafana/prometheus, n8n, metabase).
+ *
+ * The file is written into `volumes/traefik/` which is already bind-mounted
+ * as `/etc/traefik/dynamic:ro`. Traefik hot-reloads files from that dir.
+ * Multiple files in the dir coexist fine; this file adds only a top-level
+ * `tls:` key that has no overlap with the `http:` keys in middlewares.yml.
+ *
+ * @param {{domain: string, dnsChallenge: boolean, features?: {observability?: boolean, n8n?: boolean, metabase?: boolean}}} opts
+ * @returns {string} YAML string suitable for writing to `volumes/traefik/tls-default.yml`
+ */
+export function renderTraefikDefaultCert({ domain, dnsChallenge, features = {} }) {
+  // The default store cert covers the SUBDOMAINS only. The app at the bare apex
+  // (`${domain}`) gets its OWN single-domain cert via the app router's
+  // `tls.certresolver` label — it is deliberately NOT in this cert.
+  //
+  // Why split apex off the wildcard: a cert for [`${domain}`, `*.${domain}`] has
+  // TWO ACME authorizations that BOTH validate via the SAME TXT record
+  // `_acme-challenge.${domain}`, so both challenge values must be present there
+  // simultaneously. The Hetzner lego DNS provider REPLACES the TXT rrset instead
+  // of holding both values, so one authorization always fails with
+  // "403 unauthorized :: Incorrect TXT record". (Cloudflare holds both and
+  // worked — RCA 2026-06-01, compose e2e wildcard verify-deploy.) As two
+  // SEPARATE single-authz certs (apex via the app router, `*.${domain}` here),
+  // Traefik obtains them serially, so `_acme-challenge.${domain}` only ever
+  // needs one value at a time — robust on Hetzner AND Cloudflare.
+  let main;
+  let sans;
+  if (dnsChallenge) {
+    // DNS-01: one wildcard covers every subdomain (most general level).
+    main = `*.${domain}`;
+    sans = [];
+  } else {
+    // HTTP-01: wildcards require DNS-01 (LE policy), so enumerate the active
+    // subdomains. `api` (kong), `studio`, `dashboard` always exist; the rest are
+    // feature-gated. The apex app is covered by its own router cert, not here.
+    const subs = ['studio', 'dashboard'];
+    if (features.observability) subs.push('grafana', 'prometheus');
+    if (features.n8n) subs.push('n8n');
+    if (features.metabase) subs.push('metabase');
+    main = `api.${domain}`;
+    sans = subs.map((s) => `${s}.${domain}`);
+  }
+
+  const lines = [
+    'tls:',
+    '  stores:',
+    '    default:',
+    '      defaultGeneratedCert:',
+    '        resolver: letsencrypt',
+    '        domain:',
+    `          main: "${main}"`,
+  ];
+  if (sans.length) {
+    lines.push('          sans:');
+    for (const d of sans) lines.push(`            - "${d}"`);
+  }
+
+  return `# Traefik default TLS certificate — generated by Vibecarbon at deploy time.
+#
+# Serves as the default cert for ALL TLS routers carrying \`tls=true\` without an
+# explicit certresolver (SNI fallback). Covers the SUBDOMAINS; the apex app gets
+# its own cert via the app router's \`tls.certresolver\`.
+#
+# DNS-01 (cloudflare/hetzner): one wildcard cert covering every subdomain.
+# HTTP-01 (manual DNS): explicit subdomain SANs (LE policy forbids wildcards).
+${lines.join('\n')}
+`;
+}
+
 /**
  * Render the deployment bundle to a local temp directory
  * @param {string} projectName
@@ -233,13 +325,36 @@ export function renderBundle(projectName, options = {}) {
   // template ships a stub at functions/main/index.ts. RCA: prod-1 2026-05-26.
   copyDirIfExist('functions', 'functions');
 
-  // volumes/traefik/middlewares.yml
+  // volumes/traefik/ — dynamic-config directory mounted into Traefik.
+  // Always ensure the dir exists in the bundle so Traefik's file provider
+  // has a valid mount target even if the source dir is absent.
+  mkdirSync(join(stageDir, 'volumes', 'traefik'), { recursive: true });
+
   const traefikMiddlewares = join(cwd, 'volumes', 'traefik', 'middlewares.yml');
   if (existsSync(traefikMiddlewares)) {
-    mkdirSync(join(stageDir, 'volumes', 'traefik'), { recursive: true });
     cpSync(traefikMiddlewares, join(stageDir, 'volumes', 'traefik', 'middlewares.yml'));
   }
 
+  // Render tls-default.yml only when a domain is known (production deploys).
+  // This instructs Traefik to proactively obtain ONE cert for the deploy and
+  // serve it as the default for all TLS routers via SNI. DNS-01 deploys get
+  // a wildcard SAN (*.${domain}); HTTP-01 deploys get explicit subdomain SANs.
+  // The file coexists with middlewares.yml — both live under the same `tls:`
+  // / `http:` top-level keys respectively; Traefik merges all files in the dir.
+  if (options.domain) {
+    const tlsDefaultYaml = renderTraefikDefaultCert({
+      domain: options.domain,
+      dnsChallenge: Boolean(options.dnsChallenge),
+      features: {
+        observability: options.observability,
+        n8n: options.n8n,
+        metabase: options.metabase,
+      },
+    });
+    writeFileSync(join(stageDir, 'volumes', 'traefik', 'tls-default.yml'), tlsDefaultYaml);
+    if (options.verbose) console.log('[bundle] Rendered volumes/traefik/tls-default.yml');
+  }
+
   copyDirIfExist('backup', 'backup');
   if (options.n8n) copyDirIfExist('volumes/n8n', 'volumes/n8n');
   if (options.metabase) copyDirIfExist('volumes/metabase', 'volumes/metabase');