@caelo-cms/provisioning 0.10.38 → 0.10.39

package/stacks/gcp/index.ts

@@ -38,6 +38,7 @@ import {
   type CloudRunEnvVar,
   type CloudRunSlug,
   databaseUrls,
+  defaultStagingHost,
   gatewayEnvContract,
   type RuntimeSecret,
   runtimeSecretBindings,
@@ -46,6 +47,8 @@ import {
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
+// #650 — the protected staging site's host (wizard / `--staging-domain`).
+const stagingHost = cfg.get("stagingDomain") ?? defaultStagingHost(domain);
 const ownerEmail = cfg.require("ownerEmail");
 const project = cfg.require("project");
 // #607 — chosen by the operator in the wizard and fixed after install; no
@@ -245,6 +248,7 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "secret-kek": kekSecret.resource.secretId,
   "internal-secret": gcpSecretId(env, "internal-secret"),
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
+  "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
   "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
@@ -645,6 +649,7 @@ const envContractInputs = {
   env,
   domain,
   region,
+  stagingHost,
   databaseUrls: {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
@@ -1015,17 +1020,29 @@ const urlMap = new gcp.compute.URLMap(
   opts,
 );
 
-// Managed TLS cert covering both hostnames. Single cert resource;
-// the certificate's SAN list grows by one entry vs the prior version.
+// Managed TLS cert covering both hostnames.
 const managedCert = new gcp.compute.ManagedSslCertificate(
   `${namePrefix}-cert`,
   { managed: { domains: [domain, adminDomain] } },
   opts,
 );
 
+// The admin's own certificate. A multi-domain managed certificate is only
+// served once EVERY domain on it validates, and the main domain validates
+// only after its A record points here — which an operator with a live site
+// does at go-live, not during the install. With this one the admin gets
+// HTTPS as soon as admin.<domain> resolves. The combined certificate above
+// stays (replacing it would re-issue the live site's certificate); the load
+// balancer picks whichever ACTIVE certificate matches the requested host.
+const adminCert = new gcp.compute.ManagedSslCertificate(
+  `${namePrefix}-admin-cert`,
+  { managed: { domains: [adminDomain] } },
+  opts,
+);
+
 const httpsProxy = new gcp.compute.TargetHttpsProxy(
   `${namePrefix}-https-proxy`,
-  { urlMap: urlMap.id, sslCertificates: [managedCert.id] },
+  { urlMap: urlMap.id, sslCertificates: [adminCert.id, managedCert.id] },
   opts,
 );
 

package/stacks/gcp-firebase/index.ts

@@ -45,6 +45,7 @@ import {
   type CloudRunEnvVar,
   type CloudRunSlug,
   databaseUrls,
+  defaultStagingHost,
   gatewayEnvContract,
   type RuntimeSecret,
   runtimeSecretBindings,
@@ -52,6 +53,8 @@ import {
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
+// #650 — the protected staging site's host (wizard / `--staging-domain`).
+const stagingHost = cfg.get("stagingDomain") ?? defaultStagingHost(domain);
 const ownerEmail = cfg.require("ownerEmail");
 const project = cfg.require("project");
 // #607 — chosen by the operator in the wizard and fixed after install; no
@@ -219,6 +222,7 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "secret-kek": kekSecret.resource.secretId,
   "internal-secret": gcpSecretId(env, "internal-secret"),
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
+  "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
   "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
@@ -590,6 +594,7 @@ const envContractInputs = {
   env,
   domain,
   region,
+  stagingHost,
   databaseUrls: {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
@@ -606,10 +611,14 @@ const gatewaySvc = cloudRunService({
   maxInstances: 100,
   memory: "512Mi",
   timeout: "60s",
-  // v0.3.1 — gateway is reachable ONLY via Firebase Hosting
-  // rewrites or any caller holding roles/run.invoker on the
-  // service. Anonymous internet traffic gets a Cloud Run 403.
-  ingress: "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER",
+  // #650 — all traffic: the gateway also serves staging.<domain> through
+  // a Cloud Run domain mapping (`cms-provision staging-domain enable`),
+  // and Cloud Run refuses domain-mapped requests under an internal-only
+  // ingress. Exposure is unchanged in substance: the service was already
+  // invokable by allUsers (gateway-public-invoker below) and every /api
+  // request passes its rate limits, captcha and honeypot; staging requests
+  // pass the staging access gate.
+  ingress: "INGRESS_TRAFFIC_ALL",
   contractEnv: gatewayEnvContract(envContractInputs),
 });
 
@@ -940,12 +949,18 @@ const dnsRecords: pulumi.Output<DnsRecord[]> = pulumi
     // groups; each group has a list of `desired` records the operator
     // creates and `discovered` records currently in DNS. We surface the
     // `desired` set so the operator knows what to put in the registrar.
+    // Each record carries its own name: besides the apex A records Firebase
+    // asks for TXT records, some on `_acme-challenge.<domain>`, which let it
+    // issue the certificate before the apex moves. Records Firebase wants
+    // REMOVED (the old site's A records) are not records to add; replacing
+    // the apex records at go-live drops them.
     const apex = firebaseUpdates?.[0];
     if (apex) {
       for (const desired of apex.desireds ?? []) {
         for (const v of desired.records ?? []) {
+          if (v.requiredAction === "REMOVE") continue;
           out.push({
-            hostname: domain,
+            hostname: (v.domainName ?? desired.domainName ?? domain).replace(/\.$/, ""),
             type: (v.type ?? "A") as DnsRecord["type"],
             value: v.rdata ?? "",
             purpose: "Public site → Firebase Hosting CDN",

package/stacks/self-hosted/index.ts

@@ -29,6 +29,8 @@ import { generateDockerCompose } from "../../dist/compose.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
+// #650 — the staging site's host (install setting, default staging.<domain>).
+const stagingHost = cfg.get("stagingDomain") ?? `staging.${domain}`;
 const ownerEmail = cfg.require("ownerEmail");
 const caeloDir = cfg.get("caeloDir") ?? "./.caelo";
 // #553 — same knob as every adapter; undefined = stack-contract default.
@@ -81,7 +83,7 @@ const caddyConf = generateCaddyfile({
   domains: [
     { hostname: domain, kind: "admin", env: "production" as const },
     { hostname: domain, kind: "public", env: "production" as const },
-    { hostname: `staging.${domain}`, kind: "public", env: "staging" as const },
+    { hostname: stagingHost, kind: "public", env: "staging" as const },
   ],
 });