@caelo-cms/provisioning 0.10.49 → 0.10.51

package/src/compose.ts

@@ -3,8 +3,8 @@
 /**
  * P14 — production docker-compose.yml generator.
  *
- * Emits the production stack: Postgres + pgBackRest sidecar + Caddy +
- * MinIO + the two Caelo services (admin, gateway). Idempotent: same input →
+ * Emits the production stack: Postgres + Caddy + the two Caelo services
+ * (admin, gateway). Idempotent: same input →
  * byte-identical output. The CLI's `init` / `up` / `upgrade` sub-commands
  * write this to `.caelo/docker-compose.yml`.
  *
@@ -15,8 +15,20 @@
  * `docker compose pull` change the running release behind the operator's
  * back. Contributors who want their working tree in the containers ask for
  * {@link DevImages} explicitly (`init --dev`) — never the default.
+ *
+ * #707 — no `container_name`: Compose names containers per project, so an
+ * install can share a host with other stacks (a fixed `caelo-postgres`
+ * collides with the contributor dev stack's container of that name). Every
+ * CLI command addresses containers by service name (`docker compose exec`).
+ * Backups are `pg_dump`s plus the media and site files (self-hosted-backup.ts);
+ * there is no pgBackRest sidecar — it never had access to the data volume.
+ * No MinIO either: nothing in Caelo used it (media live in `.caelo/media/`),
+ * and its `minio/minio` image is no longer published, so the service made
+ * every fresh `docker compose up` fail.
  */
 
+import { CADDY_REDIRECTS_FILE } from "@caelo-cms/shared";
+import { caddyRedirectReloadCommand } from "./caddy-redirects.js";
 import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB, publicSiteUrl } from "./stack-contract.js";
 import { ghcrRepository, isImageDigest, type ReleaseService } from "./upgrade/release-images.js";
 
@@ -51,6 +63,13 @@ export const BOOTSTRAP_DIR = "bootstrap";
  */
 export const SITE_OUTPUT_ROOT = "/srv/caelo";
 
+/**
+ * #587 — every site's redirect snippet as Caddy sees it (one per deploy
+ * target below {@link SITE_OUTPUT_ROOT}); the Caddy container reloads when
+ * any of them changes (caddy-redirects.ts).
+ */
+export const COMPOSE_REDIRECT_SNIPPETS = `${SITE_OUTPUT_ROOT}/output/*/current/${CADDY_REDIRECTS_FILE}`;
+
 /** `.caelo/<this>/` holds the uploaded media (the admin's local media adapter root). */
 export const MEDIA_DIR = "media";
 /** Where {@link MEDIA_DIR} appears in the admin container (its `MEDIA_ROOT_DIR`). */
@@ -59,6 +78,66 @@ export const MEDIA_ROOT = "/data/media";
 /** The gateway's HTTP port inside the Compose network. */
 export const COMPOSE_GATEWAY_PORT = 8090;
 
+/**
+ * The Compose services that run Caelo code — what `restore` stops while it
+ * rewrites the databases, and what the health checks probe. Workers run
+ * inside the admin (CLAUDE.md §11.B Tier 5); there is no orchestrator or
+ * runner service.
+ */
+export const COMPOSE_APP_SERVICES = ["caelo-admin", "caelo-gateway"] as const;
+
+/**
+ * Where Caddy reaches the admin and the gateway: their Compose service
+ * names. Caddy runs in its own container, so `localhost` there is Caddy
+ * itself (issue #707).
+ */
+export const COMPOSE_ADMIN_UPSTREAM = `caelo-admin:${COMPOSE_ADMIN_PORT}`;
+export const COMPOSE_GATEWAY_UPSTREAM = `caelo-gateway:${COMPOSE_GATEWAY_PORT}`;
+
+/**
+ * The Caddy image, pinned to the release the generated Caddyfile is
+ * validated against (caddy-validate.test.ts runs `caddy validate` on this
+ * exact image in CI). A floating `caddy:2-alpine` could pick up a Caddy
+ * that rejects the config on the next `docker compose pull`.
+ */
+export const CADDY_IMAGE = "caddy:2.11.7-alpine";
+
+/** The host ports Caddy publishes for HTTP and HTTPS. */
+export interface PublishedPorts {
+  readonly http: number;
+  readonly https: number;
+}
+
+/**
+ * The Compose project an install's containers, network and volumes belong
+ * to, emitted as the file's top-level `name`. Without it Compose names the
+ * project after the directory holding the file — `.caelo` → `caelo` for
+ * every install, so two installs on one host would share containers and
+ * the database volume. New installs get one per domain; installs from
+ * before this was stored keep `caelo`, the name their volumes carry.
+ */
+export function composeProjectName(domain: string): string {
+  return `caelo-${domain
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")}`;
+}
+
+/** Whether `name` is a Compose project name (lowercase, digits, `-`, `_`; leading letter or digit). */
+export function isComposeProjectName(name: string): boolean {
+  return /^[a-z0-9][a-z0-9_-]*$/.test(name);
+}
+
+/** `https://<domain>`, with the published HTTPS port when it is not 443. */
+export function selfHostedSiteUrl(domain: string, httpsPort: number): string {
+  return httpsPort === 443 ? publicSiteUrl(domain) : `${publicSiteUrl(domain)}:${httpsPort}`;
+}
+
+/** Whether `port` can be published on the host (any TCP port). */
+export function isPublishablePort(port: number): boolean {
+  return Number.isInteger(port) && port >= 1 && port <= 65535;
+}
+
 /**
  * `ghcr.io/caelo-cms/<service>@<digest>` — the only image reference shape a
  * release-mode Compose file accepts.
@@ -95,8 +174,6 @@ export interface ComposeSpec {
   /** The Postgres superuser's; only the database container uses it. */
   readonly postgresPassword: string; // generated by cms-provision; persisted in .caelo/secrets
   readonly rolePasswords: RolePasswords;
-  readonly minioRootUser: string;
-  readonly minioRootPassword: string;
   /**
    * P18 — project KEK (32 bytes hex) for at-rest encryption of AI provider
    * keys + future secrets. Generated per install by cms-provision; persisted
@@ -116,6 +193,13 @@ export interface ComposeSpec {
   readonly adminMemory?: string;
   /** Which admin + gateway images run (see {@link ComposeImages}). */
   readonly images: ComposeImages;
+  /**
+   * The host ports Caddy listens on (`80` / `443` for a public install —
+   * ACME's HTTP and TLS-ALPN challenges need exactly those).
+   */
+  readonly ports: PublishedPorts;
+  /** The Compose project ({@link composeProjectName}). */
+  readonly project: string;
   /**
    * #696 Phase 4c — the host update agent's database login, when the agent
    * is set up: Postgres is then also published on `127.0.0.1:<dbPort>` (never
@@ -142,6 +226,15 @@ export function generateDockerCompose(spec: ComposeSpec): string {
   }
   const env = (k: string, v: string | undefined): string =>
     v ? `      ${k}: "${escapeYaml(v)}"` : "";
+  for (const port of [spec.ports.http, spec.ports.https]) {
+    if (!isPublishablePort(port)) throw new Error(`port ${port} is not a TCP port`);
+  }
+  if (!isComposeProjectName(spec.project)) {
+    throw new Error(`${JSON.stringify(spec.project)} is not a Compose project name`);
+  }
+  if (spec.ports.http === spec.ports.https) {
+    throw new Error(`HTTP and HTTPS cannot share port ${spec.ports.http}`);
+  }
   if (spec.agent && !isAgentDbPort(spec.agent.dbPort)) {
     throw new Error(`agent dbPort ${spec.agent.dbPort} is not a TCP port between 1024 and 65535`);
   }
@@ -149,10 +242,11 @@ export function generateDockerCompose(spec: ComposeSpec): string {
 # Generated by cms-provision — do not edit; re-run \`bunx cms-provision up\`.
 # Domain: ${spec.domain}
 
+name: ${spec.project}
+
 services:
   postgres:
     image: postgres:16-alpine
-    container_name: caelo-postgres
     restart: unless-stopped
     environment:
       POSTGRES_PASSWORD: "${escapeYaml(spec.postgresPassword)}"
@@ -170,31 +264,13 @@ ${postgresAgent(spec.agent)}    volumes:
       timeout: 5s
       retries: 5
 
-  pgbackrest:
-    image: pgbackrest/pgbackrest:latest
-    container_name: caelo-pgbackrest
-    restart: unless-stopped
-    depends_on: [postgres]
-    volumes:
-      - caelo-pg-backups:/var/lib/pgbackrest
-      - ./pgbackrest.conf:/etc/pgbackrest.conf:ro
-
-  minio:
-    image: minio/minio:latest
-    container_name: caelo-minio
-    restart: unless-stopped
-    command: server /data --console-address ":9001"
-    environment:
-      MINIO_ROOT_USER: "${escapeYaml(spec.minioRootUser)}"
-      MINIO_ROOT_PASSWORD: "${escapeYaml(spec.minioRootPassword)}"
-    volumes:
-      - caelo-minio:/data
-
   caddy:
-    image: caddy:2-alpine
-    container_name: caelo-caddy
+    image: ${CADDY_IMAGE}
+    # #587 — Caddy plus a loop that reloads it when a deploy changes a
+    # site's _redirects.caddy import (caddy-redirects.ts).
+    ${caddyRedirectReloadCommand(COMPOSE_REDIRECT_SNIPPETS)}
     restart: unless-stopped
-    ports: ["80:80", "443:443"]
+    ports: ["${spec.ports.http}:80", "${spec.ports.https}:443"]
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - caelo-caddy-data:/data
@@ -207,8 +283,6 @@ ${gatewayService(spec)}
 
 volumes:
   caelo-pg:
-  caelo-pg-backups:
-  caelo-minio:
   caelo-caddy-data:
   caelo-caddy-config:
 `;
@@ -278,7 +352,7 @@ ${serviceRuntime(
   // `.caelo/bootstrap/pending-token.json`; the admin reads (and deletes) it
   // from `/app/.caelo/` on first boot (hooks.server.ts). Only that dir is
   // mounted — never `.caelo/` itself, which holds config.json's superuser
-  // and MinIO passwords. Without the token /setup accepts any first Owner.
+  // password. Without the token /setup accepts any first Owner.
   // The static site: the admin builds into it (CAELO_OUTPUT_ROOT below),
   // Caddy serves it read-only from the same host dir. On the host, so a
   // recreated admin (upgrade) keeps the published site.
@@ -289,7 +363,6 @@ ${serviceRuntime(
     `./${MEDIA_DIR}:${MEDIA_ROOT}`,
   ],
 )}
-    container_name: caelo-admin
     restart: unless-stopped
     depends_on:
       postgres: { condition: service_healthy }
@@ -298,7 +371,7 @@ ${serviceRuntime(
       ADMIN_DATABASE_URL: "${dbUrl("admin_role", spec.rolePasswords.admin, "cms_admin")}"
       PUBLIC_ADMIN_DATABASE_URL: "${dbUrl("admin_role", spec.rolePasswords.admin, "cms_public")}"
       CAELO_SECRET_KEK: "${escapeYaml(spec.caeloSecretKek)}"
-      CAELO_SITE_URL: "${escapeYaml(publicSiteUrl(spec.domain))}"
+      CAELO_SITE_URL: "${escapeYaml(selfHostedSiteUrl(spec.domain, spec.ports.https))}"
       PORT: "${COMPOSE_ADMIN_PORT}"
       CAELO_OUTPUT_ROOT: "${SITE_OUTPUT_ROOT}"
       MEDIA_ROOT_DIR: "${MEDIA_ROOT}"
@@ -311,13 +384,12 @@ ${env("RESEND_API_KEY", spec.resendApiKey)}`;
 function gatewayService(spec: ComposeSpec): string {
   return `  caelo-gateway:
 ${serviceRuntime(spec.images, "gateway", "bun run apps/api-gateway/src/server.ts")}
-    container_name: caelo-gateway
     restart: unless-stopped
     depends_on:
       postgres: { condition: service_healthy }
     environment:
-      # Its own two logins only — no authoring credential (#613, CLAUDE.md §2).
-      GATEWAY_DATABASE_URL: "${dbUrl("gateway_role", spec.rolePasswords.gateway, "cms_admin")}"
+      # public_role on cms_public is its only database login (#613, #635,
+      # CLAUDE.md §2: the public side has no path to the authoring database).
       PUBLIC_DATABASE_URL: "${dbUrl("public_role", spec.rolePasswords.public, "cms_public")}"
       GATEWAY_PORT: "${COMPOSE_GATEWAY_PORT}"
       NODE_ENV: production`;

package/src/deployed-release.test.ts

@@ -93,6 +93,21 @@ describe("checkDeployedRuntimeEnv", () => {
   });
 
   it("passes once both services read the password from Secret Manager", async () => {
+    const { run } = fakeGcloud({
+      ...lists(),
+      "describe caelo-production-admin-abc": [
+        svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_ADMIN_DATABASE_PASSWORD")]),
+      ],
+      "describe caelo-production-gateway-def": [
+        svc([secret("PUBLIC_DATABASE_PASSWORD", "public-role-password")]),
+      ],
+    });
+    expect(await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run })).toEqual({
+      ok: true,
+    });
+  });
+
+  it("stops a wizard re-run on a gateway from before #635 (it needs its gateway_role pool)", async () => {
     const { run } = fakeGcloud({
       ...lists(),
       "describe caelo-production-admin-abc": [
@@ -105,9 +120,12 @@ describe("checkDeployedRuntimeEnv", () => {
         ]),
       ],
     });
-    expect(await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run })).toEqual({
-      ok: true,
-    });
+    const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.error).toContain("GATEWAY_DATABASE_PASSWORD");
+      expect(r.error).toContain("Run `upgrade` first");
+    }
   });
 
   it("stops a wizard re-run on a gateway from before #613 (it needs the admin_role pool)", async () => {
@@ -123,7 +141,7 @@ describe("checkDeployedRuntimeEnv", () => {
     const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
     expect(r.ok).toBe(false);
     if (!r.ok) {
-      expect(r.error).toContain("GATEWAY_DATABASE_PASSWORD");
+      expect(r.error).toContain("ADMIN_DATABASE_PASSWORD");
       expect(r.error).toContain("Run `upgrade` first");
     }
   });

package/src/deployed-release.ts

@@ -15,7 +15,7 @@ import { gcloud as defaultGcloud } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import { GCP_STACK_ENV, gcpNamePrefix } from "./gcp-names.js";
 import type { ImageDigests } from "./install-state.js";
-import { type CloudRunSlug, SERVICE_SECRET_ENV } from "./stack-contract.js";
+import { type CloudRunSlug, RETIRED_SERVICE_ENV, SERVICE_SECRET_ENV } from "./stack-contract.js";
 import { liveContainerEnv } from "./stack-converge.js";
 
 /** The `sha256:…` digest an image reference pins, or null for a tag reference. */
@@ -61,8 +61,9 @@ async function findDeployedService(
  * reads the password from the URL). The wizard keeps the release an install
  * runs, so re-running it on an install `upgrade` hasn't moved over yet would
  * pair the old release with env it can't connect with. The same holds for a
- * gateway from before #613: its release needs the admin_role pool the
- * current contract no longer gives it (no GATEWAY_DATABASE_PASSWORD yet).
+ * gateway from before #613 or #635: its release needs a cms_admin pool
+ * (admin_role, then gateway_role) the current contract no longer gives it —
+ * it still carries the retired database vars.
  * Such an install has to go through `upgrade` first, which moves the image
  * and the env in one revision.
  */
@@ -88,13 +89,19 @@ export async function checkDeployedRuntimeEnv(opts: {
       return { ok: false, error: `describe ${found.name}: ${describe.stderr.trim()}` };
     }
     const env = liveContainerEnv(describe.stdout);
-    const missing = Object.keys(SERVICE_SECRET_ENV[slug]).filter(
-      (name) => name.endsWith("_PASSWORD") && env.get(name)?.kind !== "secret",
-    );
+    const missing = [
+      ...Object.keys(SERVICE_SECRET_ENV[slug]).filter(
+        (name) => name.endsWith("_PASSWORD") && env.get(name)?.kind !== "secret",
+      ),
+      // A database var the contract retired (the gateway's ADMIN_* before
+      // #613, its GATEWAY_* before #635) means the running release still
+      // needs that login.
+      ...RETIRED_SERVICE_ENV[slug].filter((name) => /DATABASE/.test(name) && env.has(name)),
+    ];
     if (missing.length > 0) {
       return {
         ok: false,
-        error: `${found.name} does not read ${missing.join(", ")} from Secret Manager — its release predates the current database env (Secret Manager runtime secrets; for the gateway, its own database logins, #613). Run \`upgrade\` first: it moves the release and its env over together. Re-running the installer now would give the running release a database env it can't connect with.`,
+        error: `${found.name} does not match the current database env (${missing.join(", ")}) — its release predates it (Secret Manager runtime secrets; for the gateway, its own database login, #613/#635). Run \`upgrade\` first: it moves the release and its env over together. Re-running the installer now would give the running release a database env it can't connect with.`,
       };
     }
   }

package/src/gateway-credentials.ts

@@ -2,9 +2,12 @@
 
 /**
  * Moving an existing install's API gateway off admin_role (issue #613),
- * as `cms-provision upgrade` does it. The env side — GATEWAY_DATABASE_URL
- * and the per-role password secrets in, ADMIN_DATABASE_* out — rides the
- * gateway's roll (stack-contract.ts). The database side is ordered around
+ * as `cms-provision upgrade` does it. The env side — the per-role password
+ * secrets in, ADMIN_DATABASE_* out (and, since #635, GATEWAY_DATABASE_* out
+ * too: the gateway has no cms_admin login at all) — rides the gateway's
+ * roll (stack-contract.ts). gateway_role keeps getting its password until
+ * the contract release drops the role, because the previous release's
+ * gateway logs in with it until it is rolled. The database side is ordered around
  * that roll so /api/* keeps working:
  *
  *   1. after migrations (which create `gateway_role` without a password):

package/src/gateway-env-isolation.test.ts

@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Issue #635 guardrail (c): on EVERY adapter, the API gateway's service
+ * env holds no cms_admin credential of any role, AND its identity cannot
+ * read a secret that unlocks one (CLAUDE.md §2: the public side has no path
+ * to cms_admin). Env strings alone are not enough: a role that may read
+ * admin_role's password is a path even when no env var names it.
+ *
+ *   gcp, gcp-firebase  the env contract (stack-contract.ts), every IAM
+ *                      binding the gateway SA gets (contract + stack source)
+ *   aws                the gateway's own ECS task role and the secrets its
+ *                      policy covers (aws-task-roles.ts + stack source)
+ *   azure              the gateway container app's env, and no identity or
+ *                      Key Vault access for any container app
+ *   self-hosted        the generated compose gateway service: env, secrets,
+ *                      mounts
+ *
+ * The gateway itself refuses to boot on such an env
+ * (apps/api-gateway `adminDatabaseAccessInEnv`); this catches it at review
+ * time, before a release can ship it.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { AWS_SERVICE_SECRETS, secretsReadPolicy } from "./aws-task-roles.js";
+import { generateDockerCompose } from "./compose.js";
+import {
+  databaseUrls,
+  gatewayEnvContract,
+  RETIRED_IAM_BINDINGS,
+  RETIRED_SERVICE_ENV,
+  runtimeSecretBindings,
+  SERVICE_SECRET_ENV,
+  stackIamInvariants,
+} from "./stack-contract.js";
+
+/** Anything in a gateway env value or name that reaches the authoring database. */
+const ADMIN_ACCESS = /cms_admin|admin_role|gateway_role|ADMIN_DATABASE|GATEWAY_DATABASE/;
+
+/** Secrets that unlock a cms_admin login. */
+const ADMIN_SECRETS = ["postgres-password", "gateway-role-password"];
+
+/** The secrets the gateway reads on GCP: its own login and the staging gate key. */
+const GCP_GATEWAY_SECRETS = ["public-role-password", "staging-gate-secret"];
+
+/** The source of a stack program. */
+function stack(provider: "aws" | "azure" | "gcp" | "gcp-firebase"): string {
+  return readFileSync(resolve(import.meta.dir, "..", "stacks", provider, "index.ts"), "utf8");
+}
+
+describe("gcp + gcp-firebase: the gateway env contract (#635)", () => {
+  const env = gatewayEnvContract({
+    provider: "gcp",
+    projectId: "acme",
+    env: "production",
+    domain: "example.com",
+    region: "europe-west1",
+    stagingHost: "staging.example.com",
+    databaseUrls: databaseUrls("10.20.0.3"),
+  });
+
+  it("carries no cms_admin URL, role or credential name", () => {
+    for (const v of env) {
+      expect(v.name).not.toMatch(ADMIN_ACCESS);
+      if ("value" in v && typeof v.value === "string") expect(v.value).not.toMatch(ADMIN_ACCESS);
+    }
+    expect(env.find((v) => v.name === "PUBLIC_DATABASE_URL")).toEqual({
+      name: "PUBLIC_DATABASE_URL",
+      value: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
+    });
+  });
+
+  it("references no secret that unlocks a cms_admin login", () => {
+    for (const secret of Object.values(SERVICE_SECRET_ENV.gateway)) {
+      expect(ADMIN_SECRETS).not.toContain(secret);
+    }
+    const gatewayBindings = runtimeSecretBindings().filter((b) => b.service === "gateway");
+    for (const b of gatewayBindings) expect(ADMIN_SECRETS).not.toContain(b.secret);
+  });
+
+  for (const provider of ["gcp", "gcp-firebase"] as const) {
+    it(`${provider}: the gateway SA's IAM bindings reach no cms_admin secret (review finding)`, () => {
+      const gateway = stackIamInvariants(provider).filter((b) => b.member === "gateway-sa");
+      for (const b of gateway) {
+        if (b.role === "roles/secretmanager.secretAccessor") {
+          // Per secret, never project-wide (that would cover every secret).
+          expect(b.target.kind).toBe("secret");
+          if (b.target.kind === "secret") expect(GCP_GATEWAY_SECRETS).toContain(b.target.name);
+        } else {
+          expect(["roles/logging.logWriter", "roles/monitoring.metricWriter"]).toContain(b.role);
+        }
+      }
+      // The stack declares no other binding for the gateway SA: the secret
+      // bindings go through runtimeSecretBindings, the two telemetry ones
+      // name it directly.
+      const direct = stack(provider).match(/serviceAccount:\$\{gatewaySa\.email\}/g) ?? [];
+      expect(direct).toHaveLength(2);
+      expect(stack(provider)).toContain("for (const binding of runtimeSecretBindings())");
+    });
+  }
+
+  it("upgrade strips the old credentials and the gateway SA's access to them", () => {
+    for (const name of [
+      "ADMIN_DATABASE_URL",
+      "ADMIN_DATABASE_PASSWORD",
+      "GATEWAY_DATABASE_URL",
+      "GATEWAY_DATABASE_PASSWORD",
+    ]) {
+      expect(RETIRED_SERVICE_ENV.gateway).toContain(name);
+    }
+    for (const secret of ADMIN_SECRETS) {
+      expect(
+        RETIRED_IAM_BINDINGS.some(
+          (b) =>
+            b.member === "gateway-sa" && b.target.kind === "secret" && b.target.name === secret,
+        ),
+      ).toBe(true);
+    }
+  });
+});
+
+describe("self-hosted: the generated compose gateway service (#635)", () => {
+  it("holds public_role on cms_public and nothing else", () => {
+    const out = generateDockerCompose({
+      domain: "example.com",
+      postgresPassword: "superpw",
+      rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+      caeloSecretKek: "0".repeat(64),
+      diskSize: "20Gi",
+      images: {
+        mode: "release" as const,
+        admin: `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`,
+        gateway: `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`,
+      },
+      ports: { http: 80, https: 443 },
+      project: "caelo-example-com",
+    });
+    const start = out.indexOf("  caelo-gateway:");
+    const end = out.indexOf("\n  caelo-", start + 1);
+    const gateway = out.slice(start, end === -1 ? undefined : end);
+    expect(gateway).toContain("PUBLIC_DATABASE_URL:");
+    expect(gateway).not.toMatch(ADMIN_ACCESS);
+    expect(gateway).not.toMatch(/superpw|adminpw|gatewaypw/);
+    // No other way in: no Compose secrets, no env file, no mounts (a
+    // mounted file is read by no env check), and exactly its own env.
+    expect(gateway).not.toMatch(/^ {4}(secrets|env_file|volumes):/m);
+    const env = gateway.slice(gateway.indexOf("    environment:"));
+    const keys = [...env.matchAll(/^ {6}([A-Z_][A-Z0-9_]*):/gm)].map((m) => m[1]);
+    expect(keys.sort()).toEqual(["GATEWAY_PORT", "NODE_ENV", "PUBLIC_DATABASE_URL"]);
+    expect(out).not.toMatch(/^secrets:/m);
+  });
+});
+
+describe("azure: the gateway container app (#635)", () => {
+  it("gets PUBLIC_DATABASE_URL only", () => {
+    const src = stack("azure");
+    const start = src.indexOf('serviceName: "gateway"');
+    expect(start).toBeGreaterThan(-1);
+    const block = src.slice(start, src.indexOf("});", start));
+    expect(block).toContain('{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }');
+    expect(block).not.toMatch(/adminDatabase|gatewayDatabase|ADMIN_DATABASE|GATEWAY_DATABASE/);
+  });
+
+  it("builds no cms_admin URL for any role but the admin's", () => {
+    expect(stack("azure")).not.toMatch(/gateway_role:\$\{/);
+  });
+
+  it("gives no container app an identity or Key Vault access (review finding)", () => {
+    // The vault uses RBAC authorisation: without a role assignment or a
+    // managed identity no container app can read any vault secret, so the
+    // gateway's only credential is the public_role URL in its env.
+    const src = stack("azure");
+    expect(src).toContain("enableRbacAuthorization: true");
+    expect(src).not.toMatch(/RoleAssignment|accessPolicies|identity\s*:|keyVaultUrl|secretRef/);
+  });
+});
+
+describe("aws: the stack (#635)", () => {
+  it("builds no gateway_role URL and exports no gateway cms_admin DSN", () => {
+    const src = stack("aws");
+    expect(src).not.toMatch(/gateway_role:\$\{/);
+    expect(src).not.toMatch(/gatewayDatabaseUrl/);
+  });
+
+  it("the gateway's task role reads only the public_role password (review finding)", () => {
+    expect(AWS_SERVICE_SECRETS.gateway).toEqual(["public-role-password"]);
+    for (const secret of ADMIN_SECRETS) expect(AWS_SERVICE_SECRETS.gateway).not.toContain(secret);
+  });
+
+  it("each service gets its own task role whose policy is built from that table", () => {
+    const src = stack("aws");
+    expect(src).toContain('gateway: taskRole("gateway")');
+    expect(src).toContain('admin: taskRole("admin")');
+    // One RolePolicy, inside taskRole, scoped by AWS_SERVICE_SECRETS[service]:
+    // no policy anywhere lists secret ARNs by hand.
+    expect(src.match(/new aws\.iam\.RolePolicy\(/g)).toHaveLength(1);
+    expect(src).toContain(".all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))");
+    expect(src).not.toMatch(/GetSecretValue/);
+  });
+
+  it("secretsReadPolicy grants GetSecretValue on exactly the given ARNs", () => {
+    expect(JSON.parse(secretsReadPolicy(["arn:a", "arn:b"]))).toEqual({
+      Version: "2012-10-17",
+      Statement: [
+        { Effect: "Allow", Action: "secretsmanager:GetSecretValue", Resource: ["arn:a", "arn:b"] },
+      ],
+    });
+    expect(() => secretsReadPolicy([])).toThrow();
+  });
+});

package/src/gcloud.ts

@@ -75,10 +75,12 @@ export async function gcloud(
 
 /**
  * Active gcloud account. Returns `null` when no account is logged in
- * — caller prompts `gcloud auth login`.
+ * — caller prompts `gcloud auth login`. `run` is injectable for tests.
  */
-export async function activeAccount(): Promise<string | null> {
-  const r = await gcloud(["auth", "list", "--format=value(account)", "--filter=status:ACTIVE"]);
+export async function activeAccount(
+  run: (args: string[]) => Promise<GcloudResult> = gcloud,
+): Promise<string | null> {
+  const r = await run(["auth", "list", "--format=value(account)", "--filter=status:ACTIVE"]);
   if (!r.ok) return null;
   const value = r.stdout.trim();
   return value.length > 0 ? value : null;

package/src/gcp-names.ts

@@ -133,3 +133,26 @@ export function upgraderServiceAccountId(env: string): string {
 export function upgraderServiceAccountEmail(projectId: string, env: string): string {
   return `${upgraderServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
 }
+
+/**
+ * #587 — id of the project custom role that lets the admin write the
+ * redirect rules into the `gcp` stack's URL map (url-map-redirects.ts).
+ * Role ids allow letters, digits, `_` and `.`.
+ */
+export function urlMapRedirectsRoleId(env: string): string {
+  return `caelo_${env.replace(/[^A-Za-z0-9]/g, "_")}_urlMapRedirects`;
+}
+
+/**
+ * #587 — permissions of {@link urlMapRedirectsRoleId}: read-modify-write of
+ * the URL map and waiting for the operation. A URL-map update must be
+ * allowed to "use" every backend the map references, hence the `.use` pair.
+ */
+export const URL_MAP_REDIRECTS_PERMISSIONS: readonly string[] = [
+  "compute.urlMaps.list",
+  "compute.urlMaps.get",
+  "compute.urlMaps.update",
+  "compute.backendBuckets.use",
+  "compute.backendServices.use",
+  "compute.globalOperations.get",
+];