feat(debezium)!: consolidate cdc capture on the outbox table

CHANGELOG.md

@@ -1,3 +1,5 @@
+## [20.3.1](https://github.com/maevsi/stack/compare/20.3.0...20.3.1) (2026-08-14)
+
 ## [20.3.0](https://github.com/maevsi/stack/compare/20.2.2...20.3.0) (2026-08-13)
 
 ## [20.2.2](https://github.com/maevsi/stack/compare/20.2.1...20.2.2) (2026-08-13)

Dockerfile.md

@@ -1,3 +1,3 @@
 # <DEPENDENCIES>
-FROM ghcr.io/dargstack/dargstack:4.12.3
+FROM ghcr.io/dargstack/dargstack:4.13.0
 # </DEPENDENCIES>

artifacts/.gitignore

@@ -1,4 +1,5 @@
 audit-log/
 certificates/
+configs/
 secrets/
 .env.merged

dargstack.yaml

@@ -14,7 +14,7 @@ environment:
     # tag: latest # optional, defaults to "latest"
 
 metadata:
-  compatibility: ">=4.9.2-0 <5.0.0"
+  compatibility: ">=4.13.0-0 <5.0.0"
   name: "vibetype"
   source:
     name: "maevsi"

src/development/debezium/configurations/entrypoint.sh

@@ -27,8 +27,18 @@ curl --fail --output /dev/null --silent --show-error \
     "database.password": "'"$POSTGRES_PASSWORD"'",
     "database.user": "'"$POSTGRES_USER"'",
     "plugin.name": "pgoutput",
-    "table.include.list": "vibetype.event,vibetype.upload,vibetype_private.notification",
-    "topic.prefix" : "vibetype"
+    "table.include.list": "vibetype_private.outbox",
+    "topic.prefix" : "vibetype",
+    "transforms": "outbox",
+    "transforms.outbox.type": "io.debezium.transforms.outbox.EventRouter",
+    "transforms.outbox.route.by.field": "aggregate_type",
+    "transforms.outbox.route.topic.replacement": "vibetype.outbox.${routedByValue}",
+    "transforms.outbox.table.field.event.key": "aggregate_id",
+    "transforms.outbox.table.field.event.payload": "payload",
+    "transforms.outbox.predicate": "isOutbox",
+    "predicates": "isOutbox",
+    "predicates.isOutbox.type": "org.apache.kafka.connect.transforms.predicates.TopicNameMatches",
+    "predicates.isOutbox.pattern": "vibetype\\.vibetype_private\\.outbox"
 }'
 
 echo "PostgreSQL connector '$CONNECTOR_NAME' is up to date."

src/development/postgraphile/compose.yaml

@@ -11,6 +11,10 @@ secrets:
   postgraphile-sentry-dsn:
     # The GraphQL API's Sentry DSN.
     file: ~~/artifacts/secrets/postgraphile-sentry-dsn.secret
+configs:
+  postgraphile-jwt-public-key:
+    # The GraphQL API's JWT public key, derived from postgraphile-jwt-secret.
+    file: ~~/artifacts/configs/postgraphile-jwt-public-key.pub
 services:
   postgraphile:
     # You can access the GraphQL API for the PostgreSQL database at [postgraphile.app.localhost](https://postgraphile.app.localhost/).
@@ -49,16 +53,22 @@ services:
         target: /run/environment-variables/SENTRY_DSN
       - source: vibetype-turnstile-key
         target: /run/environment-variables/TURNSTILE_SECRET_KEY
+    configs:
+      - source: postgraphile-jwt-public-key
+        target: /run/environment-variables/POSTGRAPHILE_JWT_PUBLIC_KEY
     volumes:
       - ~~~/postgraphile/:/srv/app/ # dargstack:dev-only
-      - ./configurations/jwtES256.key.pub:/run/environment-variables/POSTGRAPHILE_JWT_PUBLIC_KEY:ro
       - pnpm-data:/srv/.pnpm-store/ # dargstack:dev-only
       - postgraphile-data:/srv/app/node_modules # dargstack:dev-only
 volumes:
   postgraphile-data:
     # The GraphQL API's data.
     {}
 x-dargstack:
+  configs:
+    postgraphile-jwt-public-key:
+      type: public_key
+      source: postgraphile-jwt-secret
   secrets:
     postgraphile-connection:
       type: template

src/development/reccoom/compose.yaml

@@ -58,9 +58,11 @@ services:
         target: /run/environment-variables/SENTRY_DSN
       - source: reccoom-service-api-key
         target: /run/environment-variables/SERVICE_API_KEY
+    configs:
+      - source: postgraphile-jwt-public-key
+        target: /run/configurations/jwtES256.key.pub
     volumes:
       - ~~~/reccoom/:/srv/app/ # dargstack:dev-only
-      - ../postgraphile/configurations/jwtES256.key.pub:/run/configurations/jwtES256.key.pub:ro
       - reccoom-data:/home/python/.cache/ # dargstack:dev-only
   reccoom-consumer:
     # You can track the recommender's event streaming consumer using `redpanda-console`.

src/development/vibetype/compose.yaml

@@ -72,12 +72,14 @@ services:
         target: /run/environment-variables/PGPASSWORD
       - source: postgres-role-service-vibetype-username
         target: /run/environment-variables/PGUSER
+    configs:
+      - source: postgraphile-jwt-public-key
+        target: /run/environment-variables/NUXT_PUBLIC_VIO_AUTH_JWT_PUBLIC_KEY
     volumes:
       - pnpm-data:/srv/.pnpm-store/ # dargstack:dev-only
       - ~~/artifacts/certificates/:/srv/certificates/ # dargstack:dev-only
       - ~~~/vibetype/:/srv/app/ # dargstack:dev-only
       - vibetype-data:/srv/app/node_modules # dargstack:dev-only
-      - ../postgraphile/configurations/jwtES256.key.pub:/run/environment-variables/NUXT_PUBLIC_VIO_AUTH_JWT_PUBLIC_KEY:ro
 volumes:
   vibetype-data:
     # The frontend's data.