@caelo-cms/provisioning 0.10.35 → 0.10.37

package/stacks/azure/index.ts

@@ -82,6 +82,11 @@ function randomHex(bytes: number): string {
 }
 
 const postgresPassword = pulumi.secret(randomHex(32));
+// #613 — one password per database role, so the gateway (public_role +
+// gateway_role) never holds admin_role's. bootstrap.sh creates the roles
+// with these (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD).
+const publicRolePassword = pulumi.secret(randomHex(32));
+const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -110,6 +115,8 @@ function keyVaultSecret(shortName: string, value: pulumi.Output<string>): azure.
 }
 
 const _pgSecret = keyVaultSecret("pg-password", postgresPassword);
+keyVaultSecret("public-role-password", publicRolePassword);
+keyVaultSecret("gateway-role-password", gatewayRolePassword);
 keyVaultSecret("csrf-secret", csrfSecret);
 keyVaultSecret("cookie-secret", cookieSecret);
 keyVaultSecret("anthropic-api-key", anthropicApiKey);
@@ -152,9 +159,18 @@ const _pgPublic = new azure.dbforpostgresql.Database(`${namePrefix}-cms-public-d
 const adminDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, postgresPassword])
   .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_admin?sslmode=require`);
-const publicDatabaseUrl = pulumi
+// What the admin connects to cms_public with (DDL, migrations, moderation).
+const publicAdminDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, postgresPassword])
-  .apply(([host, pw]) => `postgresql://caelo_public:${pw}@${host}:5432/cms_public?sslmode=require`);
+  .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public?sslmode=require`);
+// The gateway's two logins (#613): public_role on cms_public and
+// gateway_role on cms_admin, each with its own password.
+const publicDatabaseUrl = pulumi
+  .all([pgServer.fullyQualifiedDomainName, publicRolePassword])
+  .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?sslmode=require`);
+const gatewayDatabaseUrl = pulumi
+  .all([pgServer.fullyQualifiedDomainName, gatewayRolePassword])
+  .apply(([host, pw]) => `postgresql://gateway_role:${pw}@${host}:5432/cms_admin?sslmode=require`);
 
 // === 4. Storage account + containers ===
 const storage = new azure.storage.StorageAccount(`${namePrefix}-st`, {
@@ -215,6 +231,12 @@ const cappEnv = new azure.app.ManagedEnvironment(`${namePrefix}-capp-env`, {
 
 interface ContainerAppArgs {
   readonly serviceName: string;
+  /**
+   * The service's database connection env. The admin-side services get
+   * admin_role's URLs; the gateway gets only its own two logins (#613,
+   * CLAUDE.md §2 — never an admin_role credential).
+   */
+  readonly databaseEnv: ReadonlyArray<{ name: string; value: pulumi.Input<string> }>;
   readonly extraEnv?: ReadonlyArray<{ name: string; value: pulumi.Input<string> }>;
   /** Defaults to 0.5 vCPU / 1 GiB. */
   readonly resources?: { readonly cpu: number; readonly memory: string };
@@ -246,8 +268,7 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
           env: [
             { name: "CAELO_PROVIDER", value: "azure" },
             { name: "CAELO_ENV", value: env },
-            { name: "ADMIN_DATABASE_URL", value: adminDatabaseUrl },
-            { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicDatabaseUrl },
+            ...args.databaseEnv,
             {
               name: "MEDIA_STORAGE_URL",
               value: pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media`,
@@ -261,18 +282,34 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
   });
 }
 
+const adminDatabaseEnv = [
+  { name: "ADMIN_DATABASE_URL", value: adminDatabaseUrl },
+  { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicAdminDatabaseUrl },
+];
 const adminApp = containerApp({
   serviceName: "admin",
+  databaseEnv: adminDatabaseEnv,
   resources: adminResources,
   // #551 — the public site URL; the admin seeds site_defaults.site_base_url
   // from it (canonical, og:url, sitemap) when it is not configured yet.
   extraEnv: [{ name: "CAELO_SITE_URL", value: `https://${domain}` }],
 });
-const _gatewayApp = containerApp({ serviceName: "gateway" });
-const _orchestratorApp = containerApp({ serviceName: "orchestrator" });
-const _runnerApp = containerApp({ serviceName: "runner" });
+const _gatewayApp = containerApp({
+  serviceName: "gateway",
+  databaseEnv: [
+    { name: "GATEWAY_DATABASE_URL", value: gatewayDatabaseUrl },
+    { name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl },
+  ],
+});
+const _orchestratorApp = containerApp({
+  serviceName: "orchestrator",
+  databaseEnv: adminDatabaseEnv,
+});
+const _runnerApp = containerApp({ serviceName: "runner", databaseEnv: adminDatabaseEnv });
 const edgeRouterApp = containerApp({
   serviceName: "edge-router",
+  // Serves the static site and the A/B routing manifest; no database.
+  databaseEnv: [],
   extraEnv: [
     {
       name: "STATIC_BUCKET_URL",
@@ -304,6 +341,7 @@ const dnsRecordsRequired: DnsRecord[] = [
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  gatewayDatabaseUrl: gatewayDatabaseUrl as unknown as string,
   mediaStorageUrl:
     pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
@@ -317,6 +355,7 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp/README.md

@@ -11,7 +11,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | CDN | Cloud CDN backend bucket (operator wires the URL map + load balancer for v1; full LB in P15 review-pass) |
 | Edge compute (A/B + redirects) | Cloud Run service `<env>-edge-router` running `edge-handler.ts` with `@caelo-cms/edge-router` |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
-| Secret store | Secret Manager: postgres-password + secret-kek (Pulumi), internal-secret + tool-approval-secret (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. |
+| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only the two gateway role passwords (#613); `gateway_role` itself is created by migration 0248 and gets its password from the CLI after migrations. |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.

package/stacks/gcp/index.ts

@@ -245,8 +245,22 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "secret-kek": kekSecret.resource.secretId,
   "internal-secret": gcpSecretId(env, "internal-secret"),
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
+  "public-role-password": gcpSecretId(env, "public-role-password"),
+  "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
 
+// #613 — public_role's own password (CLI-generated, stack-contract.ts
+// DATABASE_ROLE_SECRET), so the gateway, which reads it, never holds
+// admin_role's. gateway_role is not declared here: migration 0248 creates
+// it in SQL (an API-created user would join cloudsqlsuperuser) and the CLI
+// sets its password after migrations.
+const publicRolePassword = pulumi.secret(
+  gcp.secretmanager.getSecretVersionOutput(
+    { project, secret: gcpSecretId(env, "public-role-password") },
+    { provider: gcpProvider },
+  ).secretData,
+);
+
 // =========================================================================
 // Tier 4 — Cloud SQL Postgres (private IP only; HA + retention configurable)
 // =========================================================================
@@ -307,7 +321,7 @@ const pgAdminUser = new gcp.sql.User(
 
 const pgPublicUser = new gcp.sql.User(
   `${namePrefix}-pg-public`,
-  { instance: sqlInstance.name, name: "public_role", password: postgresPassword },
+  { instance: sqlInstance.name, name: "public_role", password: publicRolePassword },
   opts,
 );
 
@@ -631,7 +645,12 @@ const envContractInputs = {
   env,
   domain,
   region,
-  databaseUrls: { admin: dbUrls.admin, publicAdmin: dbUrls.publicAdmin, public: dbUrls.public },
+  databaseUrls: {
+    admin: dbUrls.admin,
+    publicAdmin: dbUrls.publicAdmin,
+    public: dbUrls.public,
+    gateway: dbUrls.gateway,
+  },
 } as const;
 
 function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
@@ -721,9 +740,8 @@ const gatewaySvc = cloudRunService({
   minInstances: gatewayMinInstances,
   maxInstances: 100,
   memory: "512Mi",
-  // public_role on cms_public for visitor writes — plus, for now, an
-  // admin_role pool (see the known gap on stack-contract.ts
-  // SERVICE_SECRET_ENV.gateway).
+  // public_role on cms_public + gateway_role on cms_admin, each with its
+  // own password; never admin_role (#613, CLAUDE.md §2).
   contractEnv: gatewayEnvContract(envContractInputs),
 });
 
@@ -1116,6 +1134,7 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
+  gatewayDatabaseUrl: dbUrls.gateway as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
   bootstrapUrl:
@@ -1129,6 +1148,7 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp-firebase/index.ts

@@ -219,8 +219,22 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "secret-kek": kekSecret.resource.secretId,
   "internal-secret": gcpSecretId(env, "internal-secret"),
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
+  "public-role-password": gcpSecretId(env, "public-role-password"),
+  "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
 
+// #613 — public_role's own password (CLI-generated, stack-contract.ts
+// DATABASE_ROLE_SECRET), so the gateway, which reads it, never holds
+// admin_role's. gateway_role is not declared here: migration 0248 creates
+// it in SQL (an API-created user would join cloudsqlsuperuser) and the CLI
+// sets its password after migrations.
+const publicRolePassword = pulumi.secret(
+  gcp.secretmanager.getSecretVersionOutput(
+    { project, secret: gcpSecretId(env, "public-role-password") },
+    { provider: gcpProvider },
+  ).secretData,
+);
+
 // =========================================================================
 // Tier 4 — Cloud SQL Postgres (private IP only; HA configurable)
 // =========================================================================
@@ -279,7 +293,7 @@ const pgAdminUser = new gcp.sql.User(
 );
 new gcp.sql.User(
   `${namePrefix}-public-user`,
-  { instance: sqlInstance.name, name: "public_role", password: postgresPassword },
+  { instance: sqlInstance.name, name: "public_role", password: publicRolePassword },
   opts,
 );
 
@@ -576,7 +590,12 @@ const envContractInputs = {
   env,
   domain,
   region,
-  databaseUrls: { admin: dbUrls.admin, publicAdmin: dbUrls.publicAdmin, public: dbUrls.public },
+  databaseUrls: {
+    admin: dbUrls.admin,
+    publicAdmin: dbUrls.publicAdmin,
+    public: dbUrls.public,
+    gateway: dbUrls.gateway,
+  },
 } as const;
 
 // Gateway provisioned first so we can pass its name/region into the
@@ -947,6 +966,7 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
+  gatewayDatabaseUrl: dbUrls.gateway as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   // Firebase Hosting serves media via its own CDN; we proxy through
   // the Firebase site's apex domain for canonical URLs.
@@ -963,6 +983,7 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/self-hosted/index.ts

@@ -42,21 +42,35 @@ const tokenPath = resolve(caeloDir, "pending-token.json");
 // in the state file; `pulumi stack output --show-secrets postgresPassword`
 // is the operator's recovery path.
 const postgresPassword = pulumi.secret(randomHex(32));
+// #613 — one password per application role; the gateway gets only the
+// public_role and gateway_role ones.
+const adminRolePassword = pulumi.secret(randomHex(32));
+const publicRolePassword = pulumi.secret(randomHex(32));
+const gatewayRolePassword = pulumi.secret(randomHex(32));
 const minioRootUser = "caelo";
 const minioRootPassword = pulumi.secret(randomHex(32));
 
-const composeYaml = pulumi.all([postgresPassword, minioRootPassword]).apply(([pgPw, minioPw]) =>
-  generateDockerCompose({
-    domain,
-    postgresPassword: pgPw,
-    minioRootUser,
-    minioRootPassword: minioPw,
-    anthropicApiKey: process.env.ANTHROPIC_API_KEY,
-    resendApiKey: process.env.RESEND_API_KEY,
-    diskSize: "20Gi",
-    ...(adminMemory ? { adminMemory } : {}),
-  }),
-);
+const composeYaml = pulumi
+  .all([
+    postgresPassword,
+    minioRootPassword,
+    adminRolePassword,
+    publicRolePassword,
+    gatewayRolePassword,
+  ])
+  .apply(([pgPw, minioPw, adminPw, publicPw, gatewayPw]) =>
+    generateDockerCompose({
+      domain,
+      postgresPassword: pgPw,
+      rolePasswords: { admin: adminPw, public: publicPw, gateway: gatewayPw },
+      minioRootUser,
+      minioRootPassword: minioPw,
+      anthropicApiKey: process.env.ANTHROPIC_API_KEY,
+      resendApiKey: process.env.RESEND_API_KEY,
+      diskSize: "20Gi",
+      ...(adminMemory ? { adminMemory } : {}),
+    }),
+  );
 
 const caddyConf = generateCaddyfile({
   ownerEmail,