@caelo-cms/provisioning 0.10.29 → 0.10.30

package/stacks/aws/index.ts

@@ -32,6 +32,7 @@ import * as awsx from "@pulumi/awsx";
 import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
+import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../../dist/stack-contract.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -40,6 +41,16 @@ const _region = cfg.get("region") ?? "us-east-1";
 const rdsInstanceClass = cfg.get("rdsInstanceClass") ?? "db.t4g.small";
 const _fargateCpu = cfg.get("fargateCpu") ?? "512";
 const _fargateMemoryMb = cfg.get("fargateMemoryMb") ?? "1024";
+// #553 — the admin's memory, same knob + default as every adapter
+// (stack-contract.ts). This stack does not define ECS task definitions for
+// any Caelo service yet (see `fargateCpu` / `fargateMemoryMb`); the value
+// is validated now so a config set today fails loudly instead of being
+// ignored, and the admin task definition sizes itself from it.
+const adminMemory = cfg.get("adminMemory") ?? ADMIN_MEMORY_DEFAULT;
+const _adminMemoryMiB = memoryQuantityMiB(adminMemory);
+if (_adminMemoryMiB === null) {
+  throw new Error(`caelo-aws:adminMemory "${adminMemory}" is not a memory quantity (e.g. 2Gi)`);
+}
 
 // Pulumi stack name doubles as the environment label so a single
 // project supports `pulumi stack init dev|staging|production`.

package/stacks/azure/Pulumi.yaml

@@ -31,6 +31,10 @@ config:
     type: string
     default: westeurope
     description: Azure region. Container Apps regional availability is checked at preview.
+  caelo-azure:adminMemory:
+    type: string
+    default: "2Gi"
+    description: Admin container memory (CPU follows at 2 GiB per vCPU). 2Gi leaves room for the Lighthouse quality audit.
   caelo-azure:flexibleServerSku:
     type: string
     default: Standard_B2s

package/stacks/azure/index.ts

@@ -40,6 +40,7 @@ import * as azure from "@pulumi/azure-native";
 import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
+import { ADMIN_MEMORY_DEFAULT, azureContainerAppResources } from "../../dist/stack-contract.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -48,6 +49,11 @@ const subscription = cfg.require("subscription");
 const rgName = cfg.get("resourceGroup") ?? "caelo-rg";
 const location = cfg.get("location") ?? "westeurope";
 const flexibleServerSku = cfg.get("flexibleServerSku") ?? "Standard_B2s";
+// #553 — the admin runs the Lighthouse quality audit; same knob + default
+// as every adapter (stack-contract.ts). Container Apps only accepts fixed
+// CPU/memory pairs (2 GiB per vCPU), so the admin's CPU follows its memory
+// and an unsupported size is refused here.
+const adminResources = azureContainerAppResources(cfg.get("adminMemory") ?? ADMIN_MEMORY_DEFAULT);
 
 const env = pulumi.getStack() as "dev" | "staging" | "production";
 const namePrefix = `caelo${env}`; // Azure resource names disallow hyphens in some types.
@@ -200,6 +206,8 @@ const cappEnv = new azure.app.ManagedEnvironment(`${namePrefix}-capp-env`, {
 interface ContainerAppArgs {
   readonly serviceName: string;
   readonly extraEnv?: ReadonlyArray<{ name: string; value: pulumi.Input<string> }>;
+  /** Defaults to 0.5 vCPU / 1 GiB. */
+  readonly resources?: { readonly cpu: number; readonly memory: string };
 }
 
 function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
@@ -236,7 +244,7 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
             },
             ...(args.extraEnv ?? []),
           ],
-          resources: { cpu: 0.5, memory: "1.0Gi" },
+          resources: args.resources ?? { cpu: 0.5, memory: "1.0Gi" },
         },
       ],
     },
@@ -245,6 +253,7 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
 
 const adminApp = containerApp({
   serviceName: "admin",
+  resources: adminResources,
   // #551 — the public site URL; the admin seeds site_defaults.site_base_url
   // from it (canonical, og:url, sitemap) when it is not configured yet.
   extraEnv: [{ name: "CAELO_SITE_URL", value: `https://${domain}` }],

package/stacks/gcp/Pulumi.yaml

@@ -50,6 +50,10 @@ config:
     type: string
     default: "0"
     description: Admin Cloud Run min instances. 0 = scale to zero. 1 = no cold start (+~$15/mo).
+  caelo-gcp:adminMemory:
+    type: string
+    default: "2Gi"
+    description: Admin Cloud Run memory. 2Gi leaves room for the Lighthouse quality audit next to editor requests; billed only while an instance runs.
   caelo-gcp:adminMaxInstances:
     type: string
     default: "5"
@@ -87,8 +91,5 @@ config:
     default: false
     description: Block `pulumi destroy` on Cloud SQL + Cloud Run. Defaults off for operator-friendly teardown; flip true for production deploys you never want to accidentally destroy.
 # Optional config NOT declared above:
-#   caelo-gcp:resendApiKey  (secret) — Resend API key for newsletter / auth
-#     plugin email transport. Set via `cat key | pulumi config set --secret`.
-#     Omit to ship without email transport (plugins log to stderr until wired).
 #   caelo-gcp:image-admin / image-gateway — image tags for Cloud Run services.
 #     Default `<region>-docker.pkg.dev/<project>/caelo/<service>:latest`.

package/stacks/gcp/README.md

@@ -11,7 +11,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | CDN | Cloud CDN backend bucket (operator wires the URL map + load balancer for v1; full LB in P15 review-pass) |
 | Edge compute (A/B + redirects) | Cloud Run service `<env>-edge-router` running `edge-handler.ts` with `@caelo-cms/edge-router` |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
-| Secret store | Secret Manager (postgres-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key) |
+| Secret store | Secret Manager: postgres-password + secret-kek (Pulumi), internal-secret + tool-approval-secret (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.
@@ -37,12 +37,23 @@ gcloud auth configure-docker us-central1-docker.pkg.dev
 gcloud builds submit ... --tag us-central1-docker.pkg.dev/$PROJECT/caelo/admin:latest
 # Repeat for gateway, orchestrator, runner, edge-router.
 
+# The stack references two secrets it does not create (the CLI wizard and
+# `upgrade` create them; a direct `pulumi up` needs them first). Values go
+# on stdin, never argv. Match --replication-policy to the stack's
+# secretReplication config (`automatic` or `user-managed --locations=<region>`).
+for s in internal-secret tool-approval-secret; do
+  openssl rand -hex 32 | tr -d '\n' | gcloud secrets create "caelo-production-$s" \
+    --project=$PROJECT --replication-policy=automatic --data-file=-
+done
+
 # Bring the stack up.
 pulumi up
 
 # Sync outputs into cms_admin.provisioning_outputs so the admin's
 # /security/dns page surfaces the required DNS records.
-ADMIN_DATABASE_URL=$(pulumi stack output adminDatabaseUrlOut --show-secrets) \
+CAELO_INTERNAL_SECRET=$(gcloud secrets versions access latest \
+    --secret=caelo-production-internal-secret --project=$PROJECT) \
+  CAELO_ADMIN_URL=https://admin.example.com \
   bunx cms-provision pulumi-output-sync --environment production
 ```