@caelo-cms/provisioning 0.10.29 → 0.10.31

package/stacks/gcp-firebase/index.ts

@@ -30,12 +30,32 @@ import * as pulumi from "@pulumi/pulumi";
 import * as random from "@pulumi/random";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
+import {
+  gatewayServiceAccountId,
+  gcpBucketName,
+  gcpSecretId,
+  MCP_IAP_SERVICE_ACCOUNT_ID,
+  runServiceAccountId,
+} from "../../dist/gcp-names.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  adminEnvContract,
+  type CloudRunEnvVar,
+  type CloudRunSlug,
+  databaseUrls,
+  gatewayEnvContract,
+  type RuntimeSecret,
+  runtimeSecretBindings,
+} from "../../dist/stack-contract.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
 const ownerEmail = cfg.require("ownerEmail");
 const project = cfg.require("project");
-const region = cfg.get("region") ?? "us-central1";
+// #607 — chosen by the operator in the wizard and fixed after install; no
+// default, so a stack run without it fails instead of landing in a region
+// nobody picked.
+const region = cfg.require("region");
 
 // Where Secret Manager keeps the secret payloads. Fixed at create time —
 // changing it replaces every secret — so the wizard pins it per stack:
@@ -57,6 +77,9 @@ const cloudSqlHa = cfg.getBoolean("cloudSqlHa") ?? false;
 const cloudSqlEdition = cfg.get("cloudSqlEdition") ?? "ENTERPRISE";
 const deletionProtection = cfg.getBoolean("deletionProtection") ?? false;
 const adminMinInstances = Number.parseInt(cfg.get("adminMinInstances") ?? "0", 10);
+// #553 — the admin also runs the Lighthouse quality audit; same knob and
+// default on every adapter (stack-contract.ts ADMIN_MEMORY_DEFAULT).
+const adminMemory = cfg.get("adminMemory") ?? ADMIN_MEMORY_DEFAULT;
 const adminMaxInstances = Number.parseInt(cfg.get("adminMaxInstances") ?? "5", 10);
 const gatewayMinInstances = Number.parseInt(cfg.get("gatewayMinInstances") ?? "0", 10);
 const maxConnections = Number.parseInt(cfg.get("maxConnections") ?? "100", 10);
@@ -139,15 +162,9 @@ const sqlPeering = new gcp.servicenetworking.Connection(
 // =========================================================================
 
 const pgPasswordBytes = new random.RandomBytes(`${namePrefix}-pg-password-bytes`, { length: 32 });
-const csrfSecretBytes = new random.RandomBytes(`${namePrefix}-csrf-secret-bytes`, { length: 32 });
-const cookieSecretBytes = new random.RandomBytes(`${namePrefix}-cookie-secret-bytes`, {
-  length: 32,
-});
 const kekBytes = new random.RandomBytes(`${namePrefix}-secret-kek-bytes`, { length: 32 });
 
 const postgresPassword = pulumi.secret(pgPasswordBytes.hex);
-const csrfSecret = pulumi.secret(csrfSecretBytes.hex);
-const cookieSecret = pulumi.secret(cookieSecretBytes.hex);
 const caeloSecretKek = pulumi.secret(kekBytes.hex);
 // v0.3.2 — anthropic-api-key Secret + Pulumi config dropped. The
 // runtime AI provider configuration lives at /security/ai (key
@@ -162,19 +179,26 @@ const caeloSecretKek = pulumi.secret(kekBytes.hex);
 // in v0.3.0 but never wired to runtime (transport.ts reads from
 // cfg.config.apiKey, never from Secret Manager). Drop to reduce
 // surface area + monthly cost.
+// csrf-secret + cookie-secret were dropped for the same reason: CSRF
+// secrets are per session (in cms_admin) and the gateway's cookie secret
+// lives in site_settings — nothing read the Secret Manager copies.
+// `pulumi up` deletes them; `cms-provision upgrade` leaves them in place.
+//
+// internal-secret (CAELO_INTERNAL_SECRET) and tool-approval-secret
+// (CAELO_TOOL_APPROVAL_SECRET) are generated by the CLI, not here (see the
+// same note in stacks/gcp/index.ts); this program references them by id.
 
 interface MadeSecret {
   resource: gcp.secretmanager.Secret;
-  version: gcp.secretmanager.SecretVersion | null;
+  version: gcp.secretmanager.SecretVersion;
 }
 
-function makeSecret(name: string, value: pulumi.Output<string> | null): MadeSecret {
+function makeSecret(name: string, value: pulumi.Output<string>): MadeSecret {
   const resource = new gcp.secretmanager.Secret(
     `${namePrefix}-${name}`,
-    { secretId: `${namePrefix}-${name}`, replication: secretReplication },
+    { secretId: gcpSecretId(env, name), replication: secretReplication },
     opts,
   );
-  if (value === null) return { resource, version: null };
   const version = new gcp.secretmanager.SecretVersion(
     `${namePrefix}-${name}-v1`,
     { secret: resource.name, secretData: value },
@@ -184,10 +208,17 @@ function makeSecret(name: string, value: pulumi.Output<string> | null): MadeSecr
 }
 
 const pgSecret = makeSecret("postgres-password", postgresPassword);
-const csrfSecretRes = makeSecret("csrf-secret", csrfSecret);
-const cookieSecretRes = makeSecret("cookie-secret", cookieSecret);
 const kekSecret = makeSecret("secret-kek", caeloSecretKek);
 
+// The id each runtime secret is bound by: the Pulumi resource where this
+// program owns the secret, the CLI-generated id otherwise.
+const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
+  "postgres-password": pgSecret.resource.secretId,
+  "secret-kek": kekSecret.resource.secretId,
+  "internal-secret": gcpSecretId(env, "internal-secret"),
+  "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
+};
+
 // =========================================================================
 // Tier 4 — Cloud SQL Postgres (private IP only; HA configurable)
 // =========================================================================
@@ -216,7 +247,12 @@ const sqlInstance = new gcp.sql.DatabaseInstance(
         privateNetwork: network.id,
         enablePrivatePathForGoogleCloudServices: true,
       },
-      databaseFlags: [{ name: "max_connections", value: maxConnections.toString() }],
+      databaseFlags: [
+        { name: "max_connections", value: maxConnections.toString() },
+        // The operator-access sync job logs in as its service account (Cloud
+        // SQL IAM database authentication, no password). No restart needed.
+        { name: "cloudsql.iam_authentication", value: "on" },
+      ],
     },
     deletionProtection,
   },
@@ -245,9 +281,9 @@ new gcp.sql.User(
   opts,
 );
 
-const adminDatabaseUrl = pulumi.interpolate`postgres://admin_role:${postgresPassword}@${sqlInstance.privateIpAddress}:5432/cms_admin?sslmode=require`;
-const publicAdminDatabaseUrl = pulumi.interpolate`postgres://admin_role:${postgresPassword}@${sqlInstance.privateIpAddress}:5432/cms_public?sslmode=require`;
-const publicDatabaseUrl = pulumi.interpolate`postgres://public_role:${postgresPassword}@${sqlInstance.privateIpAddress}:5432/cms_public?sslmode=require`;
+// Password-less connection URLs (stack-contract.ts databaseUrls); the
+// services get the password as a Secret Manager reference.
+const dbUrls = sqlInstance.privateIpAddress.apply(databaseUrls);
 
 // =========================================================================
 // Media bucket — private, signed-URL access only (same as `gcp` stack)
@@ -256,7 +292,7 @@ const publicDatabaseUrl = pulumi.interpolate`postgres://public_role:${postgresPa
 const mediaBucket = new gcp.storage.Bucket(
   `${namePrefix}-media`,
   {
-    name: `${project}-${namePrefix}-media`,
+    name: gcpBucketName(project, env, "media"),
     location: region.toUpperCase(),
     uniformBucketLevelAccess: true,
     forceDestroy: env !== "production",
@@ -272,26 +308,47 @@ const mediaBucket = new gcp.storage.Bucket(
 const runSa = new gcp.serviceaccount.Account(
   `${namePrefix}-run-sa`,
   {
-    accountId: `${namePrefix}-run-sa`,
+    accountId: runServiceAccountId(env),
     displayName: `Caelo ${env} Cloud Run service account`,
   },
   opts,
 );
 
-for (const made of [
-  { name: "postgres-password", made: pgSecret },
-  { name: "csrf-secret", made: csrfSecretRes },
-  { name: "cookie-secret", made: cookieSecretRes },
-  { name: "secret-kek", made: kekSecret },
-]) {
-  new gcp.secretmanager.SecretIamMember(
-    `${namePrefix}-${made.name}-binding`,
-    {
-      secretId: made.made.resource.secretId,
-      role: "roles/secretmanager.secretAccessor",
-      member: pulumi.interpolate`serviceAccount:${runSa.email}`,
-    },
-    { ...opts, dependsOn: [made.made.resource] },
+// The gateway runs as its own SA so it can read only the secrets it needs
+// (stack-contract.ts SERVICE_SECRET_ENV). `cms-provision upgrade` creates it
+// on older installs, hence createIgnoreAlreadyExists.
+const gatewaySa = new gcp.serviceaccount.Account(
+  `${namePrefix}-gateway-sa`,
+  {
+    accountId: gatewayServiceAccountId(env),
+    displayName: `Caelo ${env} gateway`,
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
+const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
+  admin: runSa,
+  gateway: gatewaySa,
+};
+
+// secretAccessor for each service's SA on exactly the secrets its env reads.
+// Cloud Run refuses to deploy a revision whose SA can't read a referenced
+// secret, so each service waits for its bindings.
+const secretBindings: Record<CloudRunSlug, gcp.secretmanager.SecretIamMember[]> = {
+  admin: [],
+  gateway: [],
+};
+for (const binding of runtimeSecretBindings()) {
+  secretBindings[binding.service].push(
+    new gcp.secretmanager.SecretIamMember(
+      `${namePrefix}-${binding.stackResource}`,
+      {
+        secretId: runtimeSecretIds[binding.secret],
+        role: "roles/secretmanager.secretAccessor",
+        member: pulumi.interpolate`serviceAccount:${serviceSa[binding.service].email}`,
+      },
+      opts,
+    ),
   );
 }
 
@@ -346,6 +403,24 @@ new gcp.projects.IAMMember(
   },
   opts,
 );
+new gcp.projects.IAMMember(
+  `${namePrefix}-gateway-log-writer`,
+  {
+    project,
+    role: "roles/logging.logWriter",
+    member: pulumi.interpolate`serviceAccount:${gatewaySa.email}`,
+  },
+  opts,
+);
+new gcp.projects.IAMMember(
+  `${namePrefix}-gateway-metric-writer`,
+  {
+    project,
+    role: "roles/monitoring.metricWriter",
+    member: pulumi.interpolate`serviceAccount:${gatewaySa.email}`,
+  },
+  opts,
+);
 
 // =========================================================================
 // Tier 1 — Firebase Hosting site
@@ -394,12 +469,16 @@ const firebaseCustomDomain = new gcp.firebase.HostingCustomDomain(
 // =========================================================================
 
 interface CloudRunArgs {
-  readonly serviceName: string;
+  readonly serviceName: "admin" | "gateway";
   readonly minInstances: number;
   readonly maxInstances: number;
   readonly memory: string;
   readonly timeout: string;
-  readonly extraEnv?: ReadonlyArray<{ name: string; value: pulumi.Input<string> }>;
+  /**
+   * The service's complete env — plain values and Secret Manager
+   * references: its env contract (src/stack-contract.ts).
+   */
+  readonly contractEnv: ReadonlyArray<CloudRunEnvVar<pulumi.Input<string>>>;
   /** v0.3.1 — admin: ALL (so IAP gates internet traffic). gateway:
    *  INTERNAL_LOAD_BALANCER (locked down; only Firebase Hosting
    *  rewrites + run.invoker-authorised callers can reach it). */
@@ -434,7 +513,7 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
       iapEnabled: args.iapEnabled ?? false,
       deletionProtection,
       template: {
-        serviceAccount: runSa.email,
+        serviceAccount: serviceSa[args.serviceName].email,
         scaling: {
           minInstanceCount: args.minInstances,
           maxInstanceCount: args.maxInstances,
@@ -443,19 +522,7 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
         containers: [
           {
             image: imageRef(args.serviceName),
-            envs: [
-              { name: "CAELO_PROVIDER", value: "gcp-firebase" },
-              { name: "CAELO_ENV", value: env },
-              { name: "ADMIN_DATABASE_URL", value: adminDatabaseUrl },
-              { name: "MEDIA_STORAGE_URL", value: pulumi.interpolate`gs://${mediaBucket.name}` },
-              {
-                name: "CAELO_SECRET_KEK",
-                valueSource: {
-                  secretKeyRef: { secret: kekSecret.resource.secretId, version: "latest" },
-                },
-              },
-              ...(args.extraEnv ?? []),
-            ],
+            envs: [...args.contractEnv],
             resources: { limits: { cpu: "1", memory: args.memory } },
           },
         ],
@@ -471,13 +538,31 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
         pgAdminUser,
         cmsAdminDb,
         cmsPublicDb,
-        ...(pgSecret.version ? [pgSecret.version] : []),
-        ...(kekSecret.version ? [kekSecret.version] : []),
+        // The env contract names the media bucket as a string; keep it
+        // ordered before the services that use it.
+        mediaBucket,
+        // Referenced secrets must have a version, and the service's SA
+        // must be able to read them, before Cloud Run deploys a revision.
+        pgSecret.version,
+        kekSecret.version,
+        ...secretBindings[args.serviceName],
       ],
     },
   );
 }
 
+// Inputs of the admin + gateway env contracts. The contracts are shared with
+// `cms-provision upgrade`, which applies them to installs it rolls — add new
+// env vars and secrets there, not here.
+const envContractInputs = {
+  provider: "gcp-firebase",
+  projectId: project,
+  env,
+  domain,
+  region,
+  databaseUrls: { admin: dbUrls.admin, publicAdmin: dbUrls.publicAdmin, public: dbUrls.public },
+} as const;
+
 // Gateway provisioned first so we can pass its name/region into the
 // admin's env (the Firebase publisher needs them to wire rewrites).
 const gatewaySvc = cloudRunService({
@@ -490,39 +575,27 @@ const gatewaySvc = cloudRunService({
   // rewrites or any caller holding roles/run.invoker on the
   // service. Anonymous internet traffic gets a Cloud Run 403.
   ingress: "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER",
-  extraEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
+  contractEnv: gatewayEnvContract(envContractInputs),
 });
 
-// Issue #37 — deterministic, so the admin env can carry it as a plain string.
-const mcpServiceAccountEmail = `caelo-mcp@${project}.iam.gserviceaccount.com`;
-
 const adminSvc = cloudRunService({
   serviceName: "admin",
   minInstances: adminMinInstances,
   maxInstances: adminMaxInstances,
-  memory: "1Gi",
+  memory: adminMemory,
   timeout: "3600s",
   // v0.3.1 — admin is internet-reachable but gated by Cloud Run
   // native IAP. iapEnabled flips the IAP integration on the service.
   ingress: "INGRESS_TRAFFIC_ALL",
   iapEnabled: true,
-  extraEnv: [
-    { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicAdminDatabaseUrl },
-    // Use the input string (known at config time) — resource output
-    // is Output<string | undefined> which Input<string> rejects.
-    // #551 — the public site URL; the admin seeds site_defaults.site_base_url
-    // from it (canonical, og:url, sitemap) when it is not configured yet.
-    { name: "CAELO_SITE_URL", value: `https://${domain}` },
-    { name: "CAELO_FIREBASE_SITE", value: firebaseSiteId },
-    { name: "CAELO_GENERATOR_CLI", value: "/app/apps/static-generator/src/cli.ts" },
-    // v0.3.1 — Firebase publisher needs the gateway service name +
-    // region to declare the /api/** rewrite when creating each
-    // version.
-    { name: "CAELO_GATEWAY_SERVICE", value: gatewaySvc.name },
-    { name: "CAELO_GATEWAY_REGION", value: region },
-    // Issue #37 — shown in the /security/mcp `claude mcp add` command.
-    { name: "CAELO_MCP_IAP_SERVICE_ACCOUNT", value: mcpServiceAccountEmail },
-  ],
+  // Use the input string (known at config time) for the site — the
+  // resource output is Output<string | undefined>, which Input<string>
+  // rejects.
+  contractEnv: adminEnvContract({
+    ...envContractInputs,
+    firebaseSiteId,
+    gatewayService: gatewaySvc.name,
+  }),
 });
 
 // =========================================================================
@@ -613,6 +686,11 @@ new gcp.cloudrunv2.ServiceIamMember(
 // (`https://<admin-svc>-<hash>-<region>.a.run.app`). They can flip
 // the knob + verify the domain at https://search.google.com/search-console
 // later and run `pulumi up` to bind admin.<domain> → Cloud Run.
+//
+// The supported path is `cms-provision admin-domain enable`
+// (src/admin-domain.ts): it creates the same mapping as the operator's own
+// gcloud identity — the verified domain owner — which the provisioner SA
+// running this stack never is. Leave this knob false after using it.
 const provisionAdminDomain = cfg.getBoolean("provisionAdminDomain") ?? false;
 const adminDomainMapping = provisionAdminDomain
   ? new gcp.cloudrun.DomainMapping(
@@ -737,7 +815,7 @@ const mcpServiceAccount = new gcp.serviceaccount.Account(
   `${namePrefix}-mcp-sa`,
   {
     project,
-    accountId: "caelo-mcp",
+    accountId: MCP_IAP_SERVICE_ACCOUNT_ID,
     displayName: "Caelo MCP (IAP ingress)",
     description:
       "Signs the IAP credential external MCP clients use to reach the admin (issue #37).",
@@ -774,6 +852,20 @@ new gcp.iap.WebCloudRunServiceIamMember(
   opts,
 );
 
+// =========================================================================
+// Operator access — deliberately NOT here
+// =========================================================================
+//
+// Who passes IAP beyond the allowlist above follows the Caelo user list. A
+// Cloud Run job with its own service account keeps the IAP binding and the
+// caelo-mcp token-creator binding in step (admin-core
+// security/operator-access/sync-job.ts); the admin's run SA holds no IAM
+// policy rights and may only start that job. The CLI owns the job, its
+// account, its grants and its schedule (packages/provisioning/src/
+// operator-access.ts, run by the wizard after migrations and by `upgrade`),
+// because the job's database user can only be assigned its role after the
+// migrations have created that role.
+
 // =========================================================================
 // Outputs — DNS records the operator wires manually
 // =========================================================================
@@ -835,8 +927,9 @@ const tokenInfo = generateBootstrapToken();
 // plain strings in stack outputs at runtime; the cast bridges the
 // build-time type. Same pattern as packages/provisioning/stacks/gcp/index.ts.
 const out: CloudAdapterOutputs = {
-  adminDatabaseUrl: adminDatabaseUrl as unknown as string,
-  publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  // Password-less — the password lives only in Secret Manager.
+  adminDatabaseUrl: dbUrls.admin as unknown as string,
+  publicDatabaseUrl: dbUrls.public as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   // Firebase Hosting serves media via its own CDN; we proxy through
   // the Firebase site's apex domain for canonical URLs.

package/stacks/self-hosted/Pulumi.yaml

@@ -25,3 +25,7 @@ config:
     type: string
     default: ./.caelo
     description: Where the generated docker-compose.yml + Caddyfile + secrets live.
+  caelo-self-hosted:adminMemory:
+    type: string
+    default: "2Gi"
+    description: Memory reserved for the admin container (it runs the Lighthouse quality audit).

package/stacks/self-hosted/index.ts

@@ -31,6 +31,8 @@ const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
 const ownerEmail = cfg.require("ownerEmail");
 const caeloDir = cfg.get("caeloDir") ?? "./.caelo";
+// #553 — same knob as every adapter; undefined = stack-contract default.
+const adminMemory = cfg.get("adminMemory");
 
 const composePath = resolve(caeloDir, "docker-compose.yml");
 const caddyPath = resolve(caeloDir, "Caddyfile");
@@ -52,6 +54,7 @@ const composeYaml = pulumi.all([postgresPassword, minioRootPassword]).apply(([pg
     anthropicApiKey: process.env.ANTHROPIC_API_KEY,
     resendApiKey: process.env.RESEND_API_KEY,
     diskSize: "20Gi",
+    ...(adminMemory ? { adminMemory } : {}),
   }),
 );