Add hyperi-devbox: always-on 1GB CH + Redpanda dev daemons

[catinspace-au]

Proposal

Promote a small shell helper to a standard system-level command:
hyperi-devbox. It brings up two always-on, 1GB-capped docker daemons for
fast local DFE integration testing - ClickHouse and Redpanda (Kafka) - with
one command, no VPN to devex.

(Name alternatives: hyperi-labs, hyperi-dev-services. hyperi-devbox
reads best as a hyperi-branded command and matches the existing
hyperi-ai / hyperi-ci / hyperi-infra family.)

What it does

• Runs ClickHouse (HTTP 18123, native 19000) and Redpanda (Kafka 9092,
  admin 9644) as local docker daemons, --restart unless-stopped, each
  capped at --memory=1g.
• Self-contained: writes its own ClickHouse config (custom-settings prefix +
  a default user) under $HOME/.local/share/dfe-dev/clickhouse/config/, so
  there are no sidecar files to ship. Digest-pinned images, verified working.
• ClickHouse comes up with the DFE_ custom-settings prefix enabled, so the
  tenant-isolation model (SET DFE_current_tenant_id) works out of the box.
• Redpanda is PLAINTEXT dev mode (no SASL) - fine for local testing.

Why it belongs as a standard command

• Every DFE dev wants local ClickHouse + Kafka without standing up the full
  stack or VPN'ing to devex to borrow its backing services. Today that is
  copy-pasted docker run lines per person, which drift.
• It matches the pre-built-helpers pattern: one allow-listed command, single
  actions, no compound shell to babysit.
• The 1GB cap keeps it always-on friendly - it can sit in the background on
  a laptop without eating the machine.
• hyperi-developer already ships tools/ helper scripts and an installer
  that could drop this on PATH, so the home is a natural fit.

Subcommand UX

hyperi-devbox up      create/start both daemons (idempotent - skips if running)
hyperi-devbox down    stop + remove both containers (data volume kept)
hyperi-devbox status  docker ps + docker stats --no-stream for both
hyperi-devbox purge   down + remove the ClickHouse data volume

up prints the connection endpoints (CH HTTP/native + creds, Redpanda
Kafka/admin). Works on Linux and macOS (bash 3.2+, POSIX-ish, no GNU-only
flags).

Exact daemon spec (verified working, digest-pinned)

ClickHouse container dfe-dev-clickhouse:

• image clickhouse/clickhouse-server:24.8@sha256:1ffa82edee000a42c09313bd9f1293d94c570aee74babc1b3ca9983a35fa597b

• run:

  docker run -d --name dfe-dev-clickhouse --restart unless-stopped --memory=1g \
    -p 18123:8123 -p 19000:9000 \
    --ulimit nofile=262144:262144 \
    -v $HOME/.local/share/dfe-dev/clickhouse/config/custom_settings.xml:/etc/clickhouse-server/config.d/custom_settings.xml \
    -v $HOME/.local/share/dfe-dev/clickhouse/config/access.xml:/etc/clickhouse-server/users.d/access.xml \
    -v dfe-dev-ch-data:/var/lib/clickhouse \
    <image>
  

• custom_settings.xml (enables the DFE_ custom-settings prefix):

  <clickhouse><custom_settings_prefixes>DFE_</custom_settings_prefixes></clickhouse>
  

• access.xml (default user, password proofadmin, SQL access control on):

  <clickhouse><users><default><password>proofadmin</password><networks><ip>::/0</ip></networks><profile>default</profile><quota>default</quota><access_management>1</access_management><named_collection_control>1</named_collection_control></default></users></clickhouse>
  

• endpoints: HTTP localhost:18123, native localhost:19000, user default / pw proofadmin

Redpanda container dfe-dev-redpanda:

• image redpandadata/redpanda:v24.2.7@sha256:82a69763bef8d8b55ea5a520fa1b38f993908ef68946819ca1aed43541824c48

• run:

  docker run -d --name dfe-dev-redpanda --restart unless-stopped --memory=1g \
    -p 9092:9092 -p 9644:9644 \
    <image> \
    redpanda start --mode dev-container --smp 1 --memory 700M \
    --default-log-level=warn --kafka-addr 0.0.0.0:9092 \
    --advertise-kafka-addr localhost:9092
  

• endpoints: Kafka localhost:9092, admin localhost:9644 (PLAINTEXT dev, no SASL)

Suggested next steps

• Land the script under tools/ (or wherever the installer sources helper
  commands from) and symlink/drop it on PATH as hyperi-devbox.
• Keep the image digests on the standard SHA-pin + cooldown refresh cadence.
• Optional later: a logs subcommand and a health/wait gate on up.