@caelo-cms/provisioning 0.10.29 → 0.10.31

package/stacks/azure/index.ts

@@ -26,7 +26,7 @@
  *
  * Constraints worth knowing:
  *   - Container Apps not in every region; the stack errors loudly at
- *     preview if `location` is unsupported.
+ *     preview if the `region` is unsupported.
  *   - Front Door cert auto-management requires the apex domain to point
  *     at Front Door; if the operator manages DNS elsewhere they must
  *     publish the CNAME validation TXT record themselves.
@@ -40,14 +40,30 @@ import * as azure from "@pulumi/azure-native";
 import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
+import { ADMIN_MEMORY_DEFAULT, azureContainerAppResources } from "../../dist/stack-contract.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
 const _ownerEmail = cfg.require("ownerEmail");
 const subscription = cfg.require("subscription");
 const rgName = cfg.get("resourceGroup") ?? "caelo-rg";
-const location = cfg.get("location") ?? "westeurope";
+// #607 — the region the operator chose (same key as every adapter, §11.B);
+// no default, so a stack run without it fails instead of picking one.
+// A stack configured with the pre-#607 key is told how to move, not
+// silently mapped (no fallbacks pre-1.0).
+const legacyLocation = cfg.get("location");
+if (legacyLocation !== undefined) {
+  throw new Error(
+    `caelo-azure:location was renamed to caelo-azure:region. Run \`pulumi config set caelo-azure:region ${legacyLocation}\` and \`pulumi config rm caelo-azure:location\`, then re-run (keep the same value: the region is fixed after install).`,
+  );
+}
+const location = cfg.require("region");
 const flexibleServerSku = cfg.get("flexibleServerSku") ?? "Standard_B2s";
+// #553 — the admin runs the Lighthouse quality audit; same knob + default
+// as every adapter (stack-contract.ts). Container Apps only accepts fixed
+// CPU/memory pairs (2 GiB per vCPU), so the admin's CPU follows its memory
+// and an unsupported size is refused here.
+const adminResources = azureContainerAppResources(cfg.get("adminMemory") ?? ADMIN_MEMORY_DEFAULT);
 
 const env = pulumi.getStack() as "dev" | "staging" | "production";
 const namePrefix = `caelo${env}`; // Azure resource names disallow hyphens in some types.
@@ -200,6 +216,8 @@ const cappEnv = new azure.app.ManagedEnvironment(`${namePrefix}-capp-env`, {
 interface ContainerAppArgs {
   readonly serviceName: string;
   readonly extraEnv?: ReadonlyArray<{ name: string; value: pulumi.Input<string> }>;
+  /** Defaults to 0.5 vCPU / 1 GiB. */
+  readonly resources?: { readonly cpu: number; readonly memory: string };
 }
 
 function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
@@ -236,7 +254,7 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
             },
             ...(args.extraEnv ?? []),
           ],
-          resources: { cpu: 0.5, memory: "1.0Gi" },
+          resources: args.resources ?? { cpu: 0.5, memory: "1.0Gi" },
         },
       ],
     },
@@ -245,6 +263,7 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
 
 const adminApp = containerApp({
   serviceName: "admin",
+  resources: adminResources,
   // #551 — the public site URL; the admin seeds site_defaults.site_base_url
   // from it (canonical, og:url, sitemap) when it is not configured yet.
   extraEnv: [{ name: "CAELO_SITE_URL", value: `https://${domain}` }],

package/stacks/gcp/Pulumi.yaml

@@ -32,8 +32,7 @@ config:
   # The 8 cross-provider knobs (CLAUDE.md §11.B)
   caelo-gcp:region:
     type: string
-    default: us-central1
-    description: Primary GCP region (Cloud SQL, Cloud Run, GCS).
+    description: Primary GCP region (Cloud SQL, Cloud Run, GCS). Required, no default; chosen in the wizard and fixed after install (#607).
   caelo-gcp:cloudSqlTier:
     type: string
     default: db-f1-micro
@@ -50,6 +49,10 @@ config:
     type: string
     default: "0"
     description: Admin Cloud Run min instances. 0 = scale to zero. 1 = no cold start (+~$15/mo).
+  caelo-gcp:adminMemory:
+    type: string
+    default: "2Gi"
+    description: Admin Cloud Run memory. 2Gi leaves room for the Lighthouse quality audit next to editor requests; billed only while an instance runs.
   caelo-gcp:adminMaxInstances:
     type: string
     default: "5"
@@ -87,8 +90,5 @@ config:
     default: false
     description: Block `pulumi destroy` on Cloud SQL + Cloud Run. Defaults off for operator-friendly teardown; flip true for production deploys you never want to accidentally destroy.
 # Optional config NOT declared above:
-#   caelo-gcp:resendApiKey  (secret) — Resend API key for newsletter / auth
-#     plugin email transport. Set via `cat key | pulumi config set --secret`.
-#     Omit to ship without email transport (plugins log to stderr until wired).
 #   caelo-gcp:image-admin / image-gateway — image tags for Cloud Run services.
 #     Default `<region>-docker.pkg.dev/<project>/caelo/<service>:latest`.

package/stacks/gcp/README.md

@@ -11,7 +11,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | CDN | Cloud CDN backend bucket (operator wires the URL map + load balancer for v1; full LB in P15 review-pass) |
 | Edge compute (A/B + redirects) | Cloud Run service `<env>-edge-router` running `edge-handler.ts` with `@caelo-cms/edge-router` |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
-| Secret store | Secret Manager (postgres-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key) |
+| Secret store | Secret Manager: postgres-password + secret-kek (Pulumi), internal-secret + tool-approval-secret (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.
@@ -24,7 +24,8 @@ pulumi stack init prod
 pulumi config set caelo-gcp:domain example.com
 pulumi config set caelo-gcp:ownerEmail me@example.com
 pulumi config set caelo-gcp:project my-gcp-project
-pulumi config set caelo-gcp:region us-central1
+# Required (#607): no default, fixed after install.
+pulumi config set caelo-gcp:region europe-west1
 
 # Optional: scale up beyond the safe-by-default ceiling. The defaults
 # size for a small editorial install (admin maxScale 5 × Bun SQL pool
@@ -37,12 +38,23 @@ gcloud auth configure-docker us-central1-docker.pkg.dev
 gcloud builds submit ... --tag us-central1-docker.pkg.dev/$PROJECT/caelo/admin:latest
 # Repeat for gateway, orchestrator, runner, edge-router.
 
+# The stack references two secrets it does not create (the CLI wizard and
+# `upgrade` create them; a direct `pulumi up` needs them first). Values go
+# on stdin, never argv. Match --replication-policy to the stack's
+# secretReplication config (`automatic` or `user-managed --locations=<region>`).
+for s in internal-secret tool-approval-secret; do
+  openssl rand -hex 32 | tr -d '\n' | gcloud secrets create "caelo-production-$s" \
+    --project=$PROJECT --replication-policy=automatic --data-file=-
+done
+
 # Bring the stack up.
 pulumi up
 
 # Sync outputs into cms_admin.provisioning_outputs so the admin's
 # /security/dns page surfaces the required DNS records.
-ADMIN_DATABASE_URL=$(pulumi stack output adminDatabaseUrlOut --show-secrets) \
+CAELO_INTERNAL_SECRET=$(gcloud secrets versions access latest \
+    --secret=caelo-production-internal-secret --project=$PROJECT) \
+  CAELO_ADMIN_URL=https://admin.example.com \
   bunx cms-provision pulumi-output-sync --environment production
 ```