@caelo-cms/provisioning 0.10.43 → 0.10.46

package/stacks/gcp/README.md

@@ -50,7 +50,7 @@ done
 pulumi up
 
 # Sync outputs into cms_admin.provisioning_outputs so the admin's
-# /security/dns page surfaces the required DNS records.
+# /settings/dns page surfaces the required DNS records.
 CAELO_INTERNAL_SECRET=$(gcloud secrets versions access latest \
     --secret=caelo-production-internal-secret --project=$PROJECT) \
   CAELO_ADMIN_URL=https://admin.example.com \

package/stacks/gcp/index.ts

@@ -199,7 +199,7 @@ const postgresPassword = pulumi.secret(pgPasswordBytes.hex);
 // via `valueSource.secretKeyRef` below.
 const caeloSecretKek = pulumi.secret(kekBytes.hex);
 // v0.3.2 — anthropic-api-key Secret + Pulumi config dropped. The
-// runtime AI provider configuration lives at /security/ai (key
+// runtime AI provider configuration lives at /settings/ai (key
 // encrypted under the project KEK + stored in ai_providers).
 // Pre-v0.3.2 the wizard prompted for a key + Pulumi provisioned a
 // Secret + SecretVersion, but the Cloud Run service never read it

package/stacks/gcp-firebase/Pulumi.yaml

@@ -31,7 +31,7 @@ config:
     type: string
     description: GCP project id (also the Firebase project — Firebase Hosting requires the Firebase Management API to be enabled on the same project).
   # v0.3.2 — anthropicApiKey config dropped. Runtime path is
-  # /security/ai → ai_providers (KEK-encrypted).
+  # /settings/ai → ai_providers (KEK-encrypted).
   # The 7 cross-provider knobs (subset of gcp's 8 — no Cloud Armor adaptive protection here)
   caelo-gcp-firebase:region:
     type: string

package/stacks/gcp-firebase/index.ts

@@ -172,14 +172,14 @@ const kekBytes = new random.RandomBytes(`${namePrefix}-secret-kek-bytes`, { leng
 const postgresPassword = pulumi.secret(pgPasswordBytes.hex);
 const caeloSecretKek = pulumi.secret(kekBytes.hex);
 // v0.3.2 — anthropic-api-key Secret + Pulumi config dropped. The
-// runtime AI provider configuration lives at /security/ai (key
+// runtime AI provider configuration lives at /settings/ai (key
 // encrypted under the project KEK + stored in ai_providers).
 // Pre-v0.3.2 the wizard prompted for a key + Pulumi provisioned a
 // Secret + SecretVersion, but the Cloud Run service never read it
 // (no env-var mount existed). Dead code path removed.
 // v0.6.6 — resend-api-key secret + IAM binding removed. The Resend
 // API key now lives in the email_config DB row (set via the Owner UI
-// /security/email/pending flow per email_config_pending.ts), not in
+// /settings/email/pending flow per email_config_pending.ts), not in
 // Secret Manager. The Pulumi-managed secret + binding were scaffolded
 // in v0.3.0 but never wired to runtime (transport.ts reads from
 // cfg.config.apiKey, never from Secret Manager). Drop to reduce

package/stacks/self-hosted/README.md

@@ -16,6 +16,10 @@ cd packages/provisioning/stacks/self-hosted
 pulumi stack init prod
 pulumi config set caelo-self-hosted:domain example.com
 pulumi config set caelo-self-hosted:ownerEmail me@example.com
+# The signed release images, pinned by digest — the values `cms-provision init`
+# verified and recorded in .caelo/release.json:
+pulumi config set caelo-self-hosted:adminImage ghcr.io/caelo-cms/admin@sha256:<digest>
+pulumi config set caelo-self-hosted:gatewayImage ghcr.io/caelo-cms/gateway@sha256:<digest>
 pulumi up
 ```
 

package/stacks/self-hosted/index.ts

@@ -35,10 +35,17 @@ const ownerEmail = cfg.require("ownerEmail");
 const caeloDir = cfg.get("caeloDir") ?? "./.caelo";
 // #553 — same knob as every adapter; undefined = stack-contract default.
 const adminMemory = cfg.get("adminMemory");
+// #696 — the prebuilt, cosign-verified release images, pinned by digest
+// (`ghcr.io/caelo-cms/<svc>@sha256:…`; the generator refuses anything else).
+// `cms-provision init` resolves + verifies them and records them in
+// .caelo/release.json; copy those values here.
+const adminImage = cfg.require("adminImage");
+const gatewayImage = cfg.require("gatewayImage");
 
 const composePath = resolve(caeloDir, "docker-compose.yml");
 const caddyPath = resolve(caeloDir, "Caddyfile");
-const tokenPath = resolve(caeloDir, "pending-token.json");
+// The admin container mounts only `<caeloDir>/bootstrap/` (compose.ts).
+const tokenPath = resolve(caeloDir, "bootstrap", "pending-token.json");
 
 // Mint secrets at preview time. Pulumi's secret-handling encrypts these
 // in the state file; `pulumi stack output --show-secrets postgresPassword`
@@ -71,6 +78,7 @@ const composeYaml = pulumi
       resendApiKey: process.env.RESEND_API_KEY,
       diskSize: "20Gi",
       ...(adminMemory ? { adminMemory } : {}),
+      images: { mode: "release", admin: adminImage, gateway: gatewayImage },
     }),
   );
 
@@ -94,7 +102,7 @@ const tokenInfo = generateBootstrapToken();
 // Stage all three files via a single local.Command so a destroy
 // removes them transactionally.
 const writeFiles = new local.Command("caeloConfigFile", {
-  create: pulumi.interpolate`mkdir -p ${caeloDir} && cat > ${composePath} <<'EOF'
+  create: pulumi.interpolate`mkdir -p ${caeloDir}/bootstrap && cat > ${composePath} <<'EOF'
 ${composeYaml}
 EOF
 cat > ${caddyPath} <<'EOF'