@caelo-cms/provisioning 0.10.52 → 0.10.55

package/stacks/azure/index.ts

@@ -39,7 +39,12 @@ import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { azureFrontDoorDnsRecords } from "../../dist/azure-front-door.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
-import { ADMIN_MEMORY_DEFAULT, azureContainerAppResources } from "../../dist/stack-contract.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  azureContainerAppResources,
+  GATEWAY_TRUSTED_PROXY_HOPS,
+  TRUSTED_PROXY_HOPS_ENV,
+} from "../../dist/stack-contract.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -83,11 +88,8 @@ function randomHex(bytes: number): string {
 const postgresPassword = pulumi.secret(randomHex(32));
 // #613 — one password per database role, so the gateway (public_role only,
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
-// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
-// any service's login; its password stays until the contract release that
-// drops the role (#635).
+// (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
-const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -117,7 +119,6 @@ function keyVaultSecret(shortName: string, value: pulumi.Output<string>): azure.
 
 const _pgSecret = keyVaultSecret("pg-password", postgresPassword);
 keyVaultSecret("public-role-password", publicRolePassword);
-keyVaultSecret("gateway-role-password", gatewayRolePassword);
 keyVaultSecret("csrf-secret", csrfSecret);
 keyVaultSecret("cookie-secret", cookieSecret);
 keyVaultSecret("anthropic-api-key", anthropicApiKey);
@@ -329,6 +330,15 @@ const logWorkspace = new azure.operationalinsights.Workspace(`${namePrefix}-logs
 });
 
 // === 6. Container Apps environment + apps ===
+//
+// FIXME(issue #750): no quality-audit Container Apps job yet. On GCP every
+// Lighthouse run of a Stage audit runs in its own container (#875,
+// src/audit-job-setup.ts); the Azure equivalent is a Container Apps job
+// with one replica per run (admin-core quality/parallel-runner.ts
+// `AuditTaskLauncher`). Until it exists the admin records every Lighthouse
+// audit as failed with that gap (quality/lighthouse-runner-select.ts)
+// instead of measuring on its own shared CPU. Nothing is staged on Azure
+// before #750 either.
 const cappEnv = new azure.app.ManagedEnvironment(`${namePrefix}-capp-env`, {
   resourceGroupName: rg.name,
   environmentName: `${namePrefix}-capp-env`,
@@ -419,6 +429,8 @@ const adminApp = containerApp({
 const _gatewayApp = containerApp({
   serviceName: "gateway",
   databaseEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
+  // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts).
+  extraEnv: [{ name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) }],
 });
 const _orchestratorApp = containerApp({
   serviceName: "orchestrator",

package/stacks/gcp/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | Blob storage | Two GCS buckets (`<project>-caelo-<env>-media`, `<project>-caelo-<env>-static`) with uniform bucket-level access |
 | CDN | Global HTTPS load balancer + Cloud CDN backend bucket: `<domain>` serves the static bucket as files, `/api/*` goes to the gateway, `admin.<domain>` to the IAP-gated admin |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
-| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login); `gateway_role`, created by migration 0248, is no service's login any more. |
+| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret and public-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login). |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.

package/stacks/gcp/index.ts

@@ -251,14 +251,11 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
-  "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
 
 // #613 — public_role's own password (CLI-generated, stack-contract.ts
 // DATABASE_ROLE_SECRET), so the gateway, which reads it, never holds
-// admin_role's. gateway_role is not declared here: migration 0248 creates
-// it in SQL (an API-created user would join cloudsqlsuperuser) and the CLI
-// sets its password after migrations.
+// admin_role's. The gateway has no other database login (#635).
 const publicRolePassword = pulumi.secret(
   gcp.secretmanager.getSecretVersionOutput(
     { project, secret: gcpSecretId(env, "public-role-password") },
@@ -987,6 +984,19 @@ new gcp.iap.WebBackendServiceIamMember(
   opts,
 );
 
+// =========================================================================
+// Quality-audit job — deliberately NOT here
+// =========================================================================
+//
+// #875 — every Stage audit's Lighthouse runs execute in parallel in a Cloud
+// Run job, one task per run, under its own service account (results bucket
+// create-only, staged build read-only, no secrets, no VPC). The CLI owns the
+// job, its account, the results bucket and the grants
+// (packages/provisioning/src/audit-job-setup.ts, run by the wizard after
+// `pulumi up` and by `upgrade`), because `upgrade` never runs Pulumi: a
+// bucket or job both this program and `upgrade` created would collide on
+// the next wizard run. The app-roll moves the job's image with the admin's.
+
 // =========================================================================
 // Operator access — deliberately NOT here
 // =========================================================================

package/stacks/gcp-firebase/index.ts

@@ -224,14 +224,11 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
-  "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
 
 // #613 — public_role's own password (CLI-generated, stack-contract.ts
 // DATABASE_ROLE_SECRET), so the gateway, which reads it, never holds
-// admin_role's. gateway_role is not declared here: migration 0248 creates
-// it in SQL (an API-created user would join cloudsqlsuperuser) and the CLI
-// sets its password after migrations.
+// admin_role's. The gateway has no other database login (#635).
 const publicRolePassword = pulumi.secret(
   gcp.secretmanager.getSecretVersionOutput(
     { project, secret: gcpSecretId(env, "public-role-password") },
@@ -903,6 +900,19 @@ new gcp.iap.WebCloudRunServiceIamMember(
   opts,
 );
 
+// =========================================================================
+// Quality-audit job — deliberately NOT here
+// =========================================================================
+//
+// #875 — every Stage audit's Lighthouse runs execute in parallel in a Cloud
+// Run job, one task per run, under its own service account (results bucket
+// create-only, staged build read-only, no secrets, no VPC). The CLI owns the
+// job, its account, the results bucket and the grants
+// (packages/provisioning/src/audit-job-setup.ts, run by the wizard after
+// `pulumi up` and by `upgrade`), because `upgrade` never runs Pulumi: a
+// bucket or job both this program and `upgrade` created would collide on
+// the next wizard run. The app-roll moves the job's image with the admin's.
+
 // =========================================================================
 // Operator access — deliberately NOT here
 // =========================================================================

package/stacks/self-hosted/index.ts

@@ -62,26 +62,19 @@ const tokenPath = resolve(caeloDir, "bootstrap", "pending-token.json");
 // is the operator's recovery path.
 const postgresPassword = pulumi.secret(randomHex(32));
 // #613 — one password per application role; the gateway gets only the
-// public_role and gateway_role ones.
+// public_role one (#635: no cms_admin login).
 const adminRolePassword = pulumi.secret(randomHex(32));
 const publicRolePassword = pulumi.secret(randomHex(32));
-const gatewayRolePassword = pulumi.secret(randomHex(32));
 // P18 — the KEK that encrypts stored provider keys.
 const caeloSecretKek = pulumi.secret(randomHex(32));
 
 const composeYaml = pulumi
-  .all([
-    postgresPassword,
-    adminRolePassword,
-    publicRolePassword,
-    gatewayRolePassword,
-    caeloSecretKek,
-  ])
-  .apply(([pgPw, adminPw, publicPw, gatewayPw, kek]) =>
+  .all([postgresPassword, adminRolePassword, publicRolePassword, caeloSecretKek])
+  .apply(([pgPw, adminPw, publicPw, kek]) =>
     generateDockerCompose({
       domain,
       postgresPassword: pgPw,
-      rolePasswords: { admin: adminPw, public: publicPw, gateway: gatewayPw },
+      rolePasswords: { admin: adminPw, public: publicPw },
       caeloSecretKek: kek,
       anthropicApiKey: process.env.ANTHROPIC_API_KEY,
       resendApiKey: process.env.RESEND_API_KEY,