@caelo-cms/provisioning 0.10.61 → 0.10.62

package/src/public-role-isolation.ts

@@ -34,6 +34,7 @@ import { findSqlInstance } from "./gateway-credentials.js";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
 import type { EnsureOutcome } from "./runtime-secrets.js";
+import { type GcloudCredentials, lookupFailure } from "./upgrade/gcp-lookup.js";
 
 /** The gcloud call that leaves `public_role` with no database roles. */
 export function revokePublicRoleMembershipsArgs(target: {
@@ -58,15 +59,24 @@ export function revokePublicRoleMembershipsArgs(target: {
  * instead of throwing; `failed` names the next step.
  */
 export async function revokePublicRoleMemberships(
-  install: { readonly projectId: string; readonly env: string },
+  install: {
+    readonly projectId: string;
+    readonly env: string;
+    readonly credentials: GcloudCredentials;
+  },
   deps: { readonly run?: GcloudRunner; readonly sleep?: Sleep } = {},
 ): Promise<EnsureOutcome> {
   const run = deps.run ?? defaultGcloud;
   const id = "public_role database role memberships";
-  const sqlInstance = await findSqlInstance(install, { run });
-  if (!sqlInstance) {
-    return { id, status: "failed", error: "the Cloud SQL instance was not found" };
+  const lookup = await findSqlInstance(install, { run });
+  if (lookup.status !== "found") {
+    return {
+      id,
+      status: "failed",
+      error: lookupFailure(lookup, "Cloud SQL instance", install.credentials),
+    };
   }
+  const sqlInstance = lookup.name;
   const r = await runWithRetry(
     run,
     deps.sleep ?? realSleep,

package/src/release-contract.ts

@@ -55,6 +55,10 @@ export const INFRA_CONTRACT_PATHS: readonly string[] = [
   "packages/provisioning/src/audit-job-setup.ts",
   // #819 — the converge job, its database login and the admin's grant on it.
   "packages/provisioning/src/converge-job-setup.ts",
+  // #891 — the edge security headers the stacks attach, and the converge's
+  // SVG backfill + CDN purge on `gcp`.
+  "packages/provisioning/src/static-security-headers.ts",
+  "packages/provisioning/src/static-svg-gcp.ts",
 ];
 
 /**

package/src/self-hosted-compose.test.ts

@@ -21,6 +21,7 @@ const base: Omit<ComposeSpec, "images"> = {
   postgresPassword: "pgpw",
   rolePasswords: { admin: "adminpw", public: "publicpw" },
   caeloSecretKek: "0".repeat(64),
+  internalSecret: "i".repeat(48),
   anthropicApiKey: "sk-ant-x",
   diskSize: "20Gi",
   ports: { http: 80, https: 443 },
@@ -34,6 +35,30 @@ function service(yaml: string, name: string): string {
   return yaml.slice(start, end === -1 ? undefined : end);
 }
 
+describe("self-hosted Compose — internal secret (#770)", () => {
+  const yaml = generateDockerCompose({
+    ...base,
+    images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+  });
+
+  it("gives the admin CAELO_INTERNAL_SECRET and the gateway nothing of it", () => {
+    expect(service(yaml, "caelo-admin")).toContain(
+      `      CAELO_INTERNAL_SECRET: "${"i".repeat(48)}"`,
+    );
+    expect(service(yaml, "caelo-gateway")).not.toContain("CAELO_INTERNAL_SECRET");
+  });
+
+  it("refuses a secret the admin would reject", () => {
+    expect(() =>
+      generateDockerCompose({
+        ...base,
+        internalSecret: "short",
+        images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+      }),
+    ).toThrow("internalSecret");
+  });
+});
+
 describe("self-hosted Compose — release images (#696)", () => {
   const yaml = generateDockerCompose({
     ...base,

package/src/self-hosted-internal-secret.test.ts

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #770 — the self-hosted internal secret the Compose file hands the admin:
+ * an existing one is kept as it is, a missing one is created once (and
+ * reported), a malformed one fails loudly instead of being replaced.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  ensureInternalSecret,
+  internalSecretPath,
+  readInternalSecret,
+  writeInternalSecret,
+} from "./self-hosted-internal-secret.js";
+
+let dir: string;
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "caelo-internal-secret-"));
+});
+afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+describe("ensureInternalSecret", () => {
+  it("keeps the secret `init` wrote and reports nothing", () => {
+    writeInternalSecret(dir, "a".repeat(96));
+    const reported: string[] = [];
+    const secret = ensureInternalSecret(dir, {
+      randomSecret: () => "b".repeat(96),
+      report: (l) => reported.push(l),
+    });
+    expect(secret).toBe("a".repeat(96));
+    expect(reported).toEqual([]);
+  });
+
+  it("creates a missing one once, private to the owner, and says so", () => {
+    const reported: string[] = [];
+    const deps = { randomSecret: () => "c".repeat(96), report: (l: string) => reported.push(l) };
+    expect(ensureInternalSecret(dir, deps)).toBe("c".repeat(96));
+    expect(ensureInternalSecret(dir, { ...deps, randomSecret: () => "d".repeat(96) })).toBe(
+      "c".repeat(96),
+    );
+    expect(reported).toHaveLength(1);
+    expect(reported[0]).toContain(internalSecretPath(dir));
+    expect(statSync(internalSecretPath(dir)).mode & 0o077).toBe(0);
+    expect(JSON.parse(readFileSync(internalSecretPath(dir), "utf8"))).toEqual({
+      secret: "c".repeat(96),
+    });
+  });
+
+  it("refuses a malformed or short file rather than replacing it", () => {
+    writeFileSync(internalSecretPath(dir), "{not json");
+    expect(() => readInternalSecret(dir)).toThrow("not valid JSON");
+    writeFileSync(internalSecretPath(dir), JSON.stringify({ secret: "short" }));
+    expect(() =>
+      ensureInternalSecret(dir, { randomSecret: () => "e".repeat(96), report: () => {} }),
+    ).toThrow("at least 32");
+  });
+});

package/src/self-hosted-internal-secret.ts

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #770 — the self-hosted install's `/api/internal/*` secret,
+ * `.caelo/internal-secret.json` (`{ "secret": "<hex>" }`).
+ *
+ * `init` has written it since P15.1, but until #770 nothing handed it to the
+ * admin container, so the admin's internal endpoints answered "not set" on
+ * every self-hosted install. The Compose file now carries it as the admin's
+ * `CAELO_INTERNAL_SECRET`, and the host-side commands that call those
+ * endpoints (`owner-reset`) sign their tokens with the same file.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writePrivateFile } from "./private-file.js";
+
+/** The admin refuses shorter secrets (apps/admin internal-jwt.ts). */
+const MIN_LENGTH = 32;
+
+/** `<caeloDir>/internal-secret.json`. */
+export function internalSecretPath(caeloDir: string): string {
+  return join(caeloDir, "internal-secret.json");
+}
+
+/**
+ * The install's internal secret, or null when the file does not exist.
+ * Throws on a malformed file rather than guessing a value: a wrong secret
+ * would only surface later as every internal call failing its signature.
+ */
+export function readInternalSecret(caeloDir: string): string | null {
+  const path = internalSecretPath(caeloDir);
+  if (!existsSync(path)) return null;
+  let secret: unknown;
+  try {
+    secret = (JSON.parse(readFileSync(path, "utf8")) as { secret?: unknown }).secret;
+  } catch (e) {
+    throw new Error(
+      `${path} is not valid JSON (${String(e)}); fix it or delete it and run \`cms-provision up\`.`,
+    );
+  }
+  if (typeof secret !== "string" || secret.length < MIN_LENGTH) {
+    throw new Error(
+      `${path} has no "secret" of at least ${MIN_LENGTH} characters; fix it or delete it and run \`cms-provision up\`.`,
+    );
+  }
+  return secret;
+}
+
+/** Write a new internal secret (`init`, or {@link ensureInternalSecret}). */
+export function writeInternalSecret(caeloDir: string, secret: string): void {
+  if (secret.length < MIN_LENGTH) throw new Error(`internal secret shorter than ${MIN_LENGTH}`);
+  writePrivateFile(internalSecretPath(caeloDir), JSON.stringify({ secret }, null, 2));
+}
+
+/**
+ * The secret the Compose file gives the admin. An install whose directory
+ * has none (made by a CLI that did not write the file, or with it deleted)
+ * gets one created here, and `report` says so.
+ *
+ * This is creation of a missing secret, not a fallback (CLAUDE.md §2): no
+ * stored state depends on a previous value — before #770 the admin never
+ * received the secret, so no token was ever signed with it — and the value
+ * is written to disk before the Compose file that uses it, so every later
+ * render and every host-side command read the same one. Same pattern as
+ * the `caeloSecretKek` back-fill in the CLI's `emitConfig`.
+ */
+export function ensureInternalSecret(
+  caeloDir: string,
+  deps: { readonly randomSecret: () => string; readonly report: (line: string) => void },
+): string {
+  const existing = readInternalSecret(caeloDir);
+  if (existing !== null) return existing;
+  const secret = deps.randomSecret();
+  writeInternalSecret(caeloDir, secret);
+  deps.report(
+    `Created ${internalSecretPath(caeloDir)} — this install had no internal secret; the admin now gets it as CAELO_INTERNAL_SECRET (needed by \`cms-provision owner-reset\`).`,
+  );
+  return secret;
+}

package/src/self-hosted-release.ts

@@ -45,7 +45,8 @@ export interface HostRunner {
   /**
    * Run `argv` to completion. With `stdoutPath`, stdout streams into that
    * file (mode 600) instead of being captured — used for database dumps.
-   * With `stdinPath`, that file is the process's stdin (restores). With
+   * With `stdinPath`, that file is the process's stdin (restores); with
+   * `stdinText`, that text is (secrets that must not appear in argv). With
    * `inherit`, stdout + stderr go to the terminal (long pulls and starts
    * the operator should watch) and come back empty.
    */
@@ -58,6 +59,7 @@ export interface HostRunOptions {
   readonly env?: Readonly<Record<string, string>>;
   readonly stdoutPath?: string;
   readonly stdinPath?: string;
+  readonly stdinText?: string;
   readonly inherit?: boolean;
 }
 
@@ -67,7 +69,12 @@ export const bunHostRunner: HostRunner = {
     try {
       const proc = Bun.spawn([...argv], {
         ...(opts?.env ? { env: { ...process.env, ...opts.env } } : {}),
-        stdin: opts?.stdinPath ? Bun.file(opts.stdinPath) : "ignore",
+        stdin:
+          opts?.stdinText !== undefined
+            ? Buffer.from(opts.stdinText)
+            : opts?.stdinPath
+              ? Bun.file(opts.stdinPath)
+              : "ignore",
         stdout: opts?.stdoutPath ? Bun.file(opts.stdoutPath) : opts?.inherit ? "inherit" : "pipe",
         stderr: opts?.inherit ? "inherit" : "pipe",
       });
@@ -235,7 +242,7 @@ export async function resolveVerifiedRelease(
       error:
         "cosign is required to verify the Caelo release image signatures and was not found on PATH.\n" +
         "Install it (https://docs.sigstore.dev/cosign/system_config/installation/ — e.g. `brew install cosign`,\n" +
-        "or the release binary for Linux), then re-run. --skip-verify skips the check (NOT for production).",
+        "or the signed release binary for Linux), then re-run.",
     };
   }
   for (const service of RELEASE_SERVICES) {

package/src/self-hosted-upgrade.test.ts

@@ -122,7 +122,11 @@ beforeEach(() => {
 });
 afterEach(() => rmSync(dir, { recursive: true, force: true }));
 
-function deps(runner: HostRunner & { calls: string[] }, roles: ConvergeOutcome = { ok: true }) {
+function deps(
+  runner: HostRunner & { calls: string[] },
+  roles: ConvergeOutcome = { ok: true },
+  caddy: { ok: true } | { ok: false; error: string } = { ok: true },
+) {
   return {
     caeloDir: dir,
     runner,
@@ -131,6 +135,10 @@ function deps(runner: HostRunner & { calls: string[] }, roles: ConvergeOutcome =
       runner.calls.push("converge roles");
       return roles;
     },
+    refreshCaddy: async () => {
+      runner.calls.push("refresh caddy");
+      return caddy;
+    },
     log,
     fetchImpl: registry,
     sleep: async () => {},
@@ -161,6 +169,7 @@ describe("upgradeSelfHosted", () => {
       "health admin",
       "up caelo-gateway",
       "health gateway",
+      "refresh caddy",
     ]);
     // The migrations run the NEW admin image: the Compose file already names it.
     expect(readFileSync(composePath(dir), "utf8")).toBe(render(NEW));
@@ -200,9 +209,34 @@ describe("upgradeSelfHosted", () => {
       "up both",
       "health admin",
       "health gateway",
+      "refresh caddy",
     ]);
   });
 
+  // #891 — the SVG CSP + nosniff live in the Caddyfile the release's own
+  // generator writes; an upgrade that only rolled the containers left every
+  // existing install serving SVGs without them.
+  it("re-writes the Caddyfile after the roll, before recording the release", async () => {
+    const runner = fakeRunner();
+    expect((await upgradeSelfHosted({ version: "0.11.0" }, deps(runner))).ok).toBe(true);
+    const s = steps(runner.calls);
+    expect(s.indexOf("refresh caddy")).toBeGreaterThan(s.indexOf("health gateway"));
+  });
+
+  it("fails at the caddy stage (release not recorded, so a re-run retries) when Caddy cannot reload", async () => {
+    const runner = fakeRunner();
+    const r = await upgradeSelfHosted(
+      { version: "0.11.0" },
+      deps(runner, { ok: true }, { ok: false, error: "caddy reload failed: bad config" }),
+    );
+    expect(r).toMatchObject({ ok: false, stage: "caddy", previousRunning: false });
+    if (!r.ok) {
+      expect(r.error).toContain("bad config");
+      expect(r.error).toContain("regenerate-caddy");
+    }
+    expect(readRelease(dir)?.version).toBe("0.10.0");
+  });
+
   it("reports an unhealthy install that is already on the target", async () => {
     recordRelease(
       dir,

package/src/self-hosted-upgrade.ts

@@ -21,7 +21,9 @@
  *      was retired in (run-order.ts): past it, nothing running uses it;
  *   6. recreate the admin, health-check it (`/_caelo/health`, which proves
  *      the DB pool and roles); then the gateway (`/healthz`);
- *   7. record the release in `.caelo/release.json`.
+ *   7. re-write the Caddyfile and reload Caddy — the edge headers live there
+ *      (#891), and only the new release's generator knows them;
+ *   8. record the release in `.caelo/release.json`.
  * Any failure after step 3 puts the previous Compose file back; once a
  * container was recreated the previous images are started again and
  * health-checked (rollback). The database is never restored automatically:
@@ -90,6 +92,13 @@ export interface SelfHostedUpgradeDeps {
    * (`convergeSelfHostedRoles`); drops roles a release retired (#635).
    */
   readonly convergeRoles: () => Promise<ConvergeOutcome>;
+  /**
+   * Re-writes the Caddyfile from the install's config + domains table and
+   * reloads Caddy (#891): the edge headers (the SVG CSP, nosniff) live in
+   * the Caddyfile this release's generator writes, so an upgrade that only
+   * rolled the containers would leave the install on the old edge config.
+   */
+  readonly refreshCaddy: () => Promise<{ ok: true } | { ok: false; error: string }>;
   readonly fetchImpl?: typeof fetch;
   readonly sleep?: (ms: number) => Promise<void>;
   readonly now?: () => Date;
@@ -130,7 +139,8 @@ type UpgradeStage =
   | "migrate"
   | "roles"
   | "roll-admin"
-  | "roll-gateway";
+  | "roll-gateway"
+  | "caddy";
 
 /** Where an install from before #696 keeps its original Compose file during the move. */
 export function legacyComposePath(caeloDir: string): string {
@@ -287,6 +297,10 @@ export async function upgradeSelfHosted(
         false,
       );
     }
+    // A run that stopped after the roll (or an install upgraded before the
+    // Caddyfile was part of the upgrade) gets this release's edge config.
+    const caddy = await refreshCaddy(deps);
+    if (!caddy.ok) return caddy.failure;
     log.info(`Already on ${current.version} (${shortDigest(images.admin)}); nothing to do.`);
     return { ok: true, status: "already-current", version: current.version };
   }
@@ -378,7 +392,13 @@ export async function upgradeSelfHosted(
     log.info(`${service} healthy ✓`);
   }
 
-  // 7. Record.
+  // 7. The Caddyfile this release generates (edge headers, #891). The new
+  // containers already serve; a failure is reported before the release is
+  // recorded, so a re-run (the already-current path above) retries it.
+  const caddy = await refreshCaddy(deps);
+  if (!caddy.ok) return caddy.failure;
+
+  // 8. Record.
   log.phase?.("record");
   recordRelease(
     caeloDir,
@@ -390,6 +410,23 @@ export async function upgradeSelfHosted(
   return { ok: true, status: "upgraded", version: target.version };
 }
 
+/** Step 7: re-write + reload the Caddyfile; on failure, the result to return. */
+async function refreshCaddy(
+  deps: SelfHostedUpgradeDeps,
+): Promise<{ ok: true } | { ok: false; failure: SelfHostedUpgradeResult }> {
+  deps.log.step("Re-writing the Caddyfile and reloading Caddy");
+  const r = await deps.refreshCaddy();
+  if (r.ok) return { ok: true };
+  return {
+    ok: false,
+    failure: fail(
+      "caddy",
+      `${r.error}\nThe new release is running, but Caddy may still serve the previous Caddyfile (without this release's security headers). Fix the cause, then run \`${selfCommand("regenerate-caddy")}\` or re-run the upgrade.`,
+      false,
+    ),
+  };
+}
+
 function fail(
   stage: UpgradeStage,
   error: string,

package/src/stack-contract.test.ts

@@ -340,6 +340,7 @@ describe("self-hosted compose", () => {
       postgresPassword: "p",
       rolePasswords: { admin: "a", public: "b" },
       caeloSecretKek: "k",
+      internalSecret: "i".repeat(48),
       diskSize: "10G",
       ports: { http: 80, https: 443 },
       project: "caelo-example-com",

package/src/stack-converge.test.ts

@@ -21,6 +21,7 @@ import {
   rollService,
   serviceRollArgs,
 } from "./stack-converge.js";
+import { GCP_STATIC_RESPONSE_HEADERS } from "./static-security-headers.js";
 
 const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
 const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
@@ -44,6 +45,12 @@ function fakeGcloud(answers: Record<string, GcloudResult[]>, fallback: GcloudRes
   return { run, calls };
 }
 
+/** A static backend bucket already at the stack's CDN policy + headers. */
+const IN_SHAPE_BACKEND = {
+  cdnPolicy: STATIC_CDN_POLICY,
+  customResponseHeaders: GCP_STATIC_RESPONSE_HEADERS,
+};
+
 const policy = (bindings: { role: string; members: string[]; condition?: unknown }[]) =>
   ok(JSON.stringify({ bindings }));
 
@@ -64,6 +71,9 @@ const firebase: InstallTarget = {
 };
 const gcp: InstallTarget = { ...firebase, provider: "gcp" };
 
+const ingressJson = (ingress: string) =>
+  JSON.stringify({ metadata: { annotations: { "run.googleapis.com/ingress": ingress } } });
+
 const serviceJson = (env: unknown[]) =>
   JSON.stringify({ spec: { template: { spec: { containers: [{ env }] } } } });
 
@@ -494,6 +504,7 @@ describe("ensureStackInvariants", () => {
       policy([{ role: "roles/run.invoker", members: [IAP_AGENT] }]),
     ],
     "compute firewall-rules list": [ok("[]")],
+    "run services describe caelo-production-gateway-bbb": [ok(ingressJson("all"))],
   });
 
   it("is a read-only no-op on an install that is already in shape", async () => {
@@ -502,10 +513,59 @@ describe("ensureStackInvariants", () => {
     expect(report.mustAbort).toBe(false);
     expect(report.outcomes.every((o) => o.status === "present")).toBe(true);
     expect(report.outcomes).toHaveLength(
-      stackIamInvariants("gcp-firebase").length + ABSENT_DEFAULT_FIREWALL_RULES.length,
+      stackIamInvariants("gcp-firebase").length + ABSENT_DEFAULT_FIREWALL_RULES.length + 1,
     );
     expect(calls.some((c) => c.startsWith("compute firewall-rules delete"))).toBe(false);
     expect(calls.some((c) => c.includes("add-iam-policy-binding"))).toBe(false);
+    expect(calls.some((c) => c.startsWith("run services update"))).toBe(false);
+  });
+
+  describe("gcp-firebase gateway ingress (#732)", () => {
+    it("opens a load-balancer-only gateway to all traffic, and a re-run is a no-op", async () => {
+      const answers = fullFirebase();
+      answers["run services describe caelo-production-gateway-bbb"] = [
+        ok(ingressJson("internal-and-cloud-load-balancing")),
+      ];
+      const { run, calls } = fakeGcloud(answers);
+      const report = await ensureStackInvariants(firebase, { run, sleep: async () => {} });
+      expect(report.mustAbort).toBe(false);
+      expect(calls).toContain(
+        "run services update caelo-production-gateway-bbb --region=europe-west1 --project=acme --ingress=all --quiet",
+      );
+      expect(report.outcomes.filter((o) => o.status === "applied").map((o) => o.id)).toEqual([
+        "ingress internal-and-cloud-load-balancing → all on caelo-production-gateway-bbb",
+      ]);
+
+      const again = fakeGcloud(fullFirebase());
+      const rerun = await ensureStackInvariants(firebase, {
+        run: again.run,
+        sleep: async () => {},
+      });
+      expect(rerun.outcomes.every((o) => o.status === "present")).toBe(true);
+      expect(again.calls.some((c) => c.includes("--ingress"))).toBe(false);
+    });
+
+    it("aborts the upgrade when the ingress can't be changed", async () => {
+      const { run } = fakeGcloud({
+        ...fullFirebase(),
+        "run services describe caelo-production-gateway-bbb": [
+          ok(ingressJson("internal-and-cloud-load-balancing")),
+        ],
+        "run services update": [fail("PERMISSION_DENIED: run.services.update")],
+      });
+      const report = await ensureStackInvariants(firebase, { run, sleep: async () => {} });
+      expect(report.mustAbort).toBe(true);
+      expect(report.outcomes.find((o) => o.status === "failed")?.error).toBe(
+        "PERMISSION_DENIED: run.services.update",
+      );
+    });
+
+    it("never reads or changes the gcp gateway's ingress (its stack declares load-balancer-only)", async () => {
+      const { run, calls } = fakeGcloud({ "projects describe": [ok("42")] });
+      await ensureStackInvariants(gcp, { run, sleep: async () => {} });
+      expect(calls.some((c) => c.startsWith("run services describe"))).toBe(false);
+      expect(calls.some((c) => c.includes("--ingress"))).toBe(false);
+    });
   });
 
   it("upgrade deletes GCP's pre-populated default-network firewall rules without aborting", async () => {
@@ -697,6 +757,17 @@ describe("ensureStackInvariants", () => {
       ],
       "compute backend-buckets list": [ok("caelo-production-static-backend-9f8e7d6\n")],
       "compute firewall-rules list": [ok("[]")],
+      // #891 — every live SVG already served as a download.
+      "storage objects list": [
+        ok(
+          JSON.stringify([
+            {
+              storage_url: "gs://acme-caelo-production-static/_assets/a.0123456789abcdef.svg",
+              content_disposition: "attachment",
+            },
+          ]),
+        ),
+      ],
     });
 
     it("raises the pre-#555 1h/24h TTLs to a year", async () => {
@@ -719,7 +790,7 @@ describe("ensureStackInvariants", () => {
       const report = await ensureStackInvariants(gcp, { run, sleep: async () => {} });
       expect(report.mustAbort).toBe(false);
       expect(calls).toContain(
-        `compute backend-buckets update caelo-production-static-backend-9f8e7d6 --project=acme --cache-mode=CACHE_ALL_STATIC --default-ttl=3600 --max-ttl=${STATIC_CDN_POLICY.maxTtl} --client-ttl=${STATIC_CDN_POLICY.clientTtl} --quiet`,
+        `compute backend-buckets update caelo-production-static-backend-9f8e7d6 --project=acme --cache-mode=CACHE_ALL_STATIC --default-ttl=3600 --max-ttl=${STATIC_CDN_POLICY.maxTtl} --client-ttl=${STATIC_CDN_POLICY.clientTtl} --custom-response-header=X-Content-Type-Options: nosniff --quiet`,
       );
       expect(report.outcomes.find((o) => o.id.startsWith("Cloud CDN"))?.status).toBe("applied");
       // Every IAM invariant was already present.
@@ -729,7 +800,7 @@ describe("ensureStackInvariants", () => {
     it("leaves a backend bucket already at the stack's policy alone", async () => {
       const answers = {
         ...fullGcp(),
-        "compute backend-buckets describe": [ok(JSON.stringify({ cdnPolicy: STATIC_CDN_POLICY }))],
+        "compute backend-buckets describe": [ok(JSON.stringify(IN_SHAPE_BACKEND))],
       };
       const { run, calls } = fakeGcloud(answers);
       const report = await ensureStackInvariants(gcp, { run, sleep: async () => {} });
@@ -737,6 +808,19 @@ describe("ensureStackInvariants", () => {
       expect(report.outcomes.every((o) => o.status === "present")).toBe(true);
     });
 
+    // #891 regression: the backend bucket served every file without nosniff.
+    it("adds the nosniff response header to a bucket already at the CDN policy", async () => {
+      const answers = {
+        ...fullGcp(),
+        "compute backend-buckets describe": [ok(JSON.stringify({ cdnPolicy: STATIC_CDN_POLICY }))],
+      };
+      const { run, calls } = fakeGcloud(answers);
+      const report = await ensureStackInvariants(gcp, { run, sleep: async () => {} });
+      const update = calls.find((c) => c.startsWith("compute backend-buckets update"));
+      expect(update).toContain("--custom-response-header=X-Content-Type-Options: nosniff");
+      expect(report.outcomes.find((o) => o.id.startsWith("Cloud CDN"))?.status).toBe("applied");
+    });
+
     it("warns (no abort) when the CDN update fails", async () => {
       const answers = {
         ...fullGcp(),
@@ -754,7 +838,7 @@ describe("ensureStackInvariants", () => {
         ...fullGcp(),
         "storage buckets get-iam-policy": [policy([])],
         "secrets get-iam-policy": [policy([])],
-        "compute backend-buckets describe": [ok(JSON.stringify({ cdnPolicy: STATIC_CDN_POLICY }))],
+        "compute backend-buckets describe": [ok(JSON.stringify(IN_SHAPE_BACKEND))],
       };
       const { run, calls } = fakeGcloud(answers);
       await ensureStackInvariants(gcp, { run, sleep: async () => {} });
@@ -774,7 +858,7 @@ describe("ensureStackInvariants", () => {
       const answers = {
         ...fullGcp(),
         "secrets get-iam-policy": [policy([])],
-        "compute backend-buckets describe": [ok(JSON.stringify({ cdnPolicy: STATIC_CDN_POLICY }))],
+        "compute backend-buckets describe": [ok(JSON.stringify(IN_SHAPE_BACKEND))],
       };
       const { run, calls } = fakeGcloud(answers);
       await ensureStackInvariants(gcp, { run, sleep: async () => {} });