@caelo-cms/provisioning 0.10.61 → 0.10.62

package/src/wizards/gcp.ts

@@ -59,6 +59,7 @@ import {
   linkBilling,
   listBillingAccounts,
   PROVISIONER_ROLE_LIST,
+  projectDisplayName,
   projectExists,
   REQUIRED_API_LIST,
   serviceAccountExists,
@@ -95,6 +96,7 @@ import {
   resolveOperatorAccessTarget,
 } from "../operator-access.js";
 import { ensureOpsBackend } from "../ops-backend.js";
+import { formatPlan, type PlannedStep, planGate, writePlanFile } from "../preview-plan.js";
 import {
   convergeKeylessProvisioner,
   PROVISIONER_ACCOUNT_ID,
@@ -117,7 +119,7 @@ import {
   resolveBackend,
 } from "../state-backend.js";
 import { acquireStateLock, GcsStateStore } from "../state-store.js";
-import { resolveGcpResourceName } from "../upgrade/gcp-lookup.js";
+import { lookupFailure, resolveGcpResourceName } from "../upgrade/gcp-lookup.js";
 import {
   releaseVersionForDigest,
   resolveOpsImageRef,
@@ -127,7 +129,12 @@ import { ensureUpgraderJob, resolveUpgraderTarget } from "../upgrader-setup.js";
 import { ensureUrlMapRedirectsAccess } from "../url-map-redirects-access.js";
 import { estimateGcpCost } from "./gcp-cost.js";
 import { promptProjectId } from "./gcp-prompts.js";
-import { GCP_STACK_KNOB_DEFAULTS, pulumiUpGcp, readStackOutput } from "./gcp-pulumi.js";
+import {
+  GCP_STACK_KNOB_DEFAULTS,
+  PulumiUpDeclinedError,
+  pulumiUpGcp,
+  readStackOutput,
+} from "./gcp-pulumi.js";
 
 export interface GcpWizardOpts {
   installId: string;
@@ -177,7 +184,7 @@ export async function runGcpWizard(opts: GcpWizardOpts): Promise<void> {
   if (meta) writeMetadata(installId, { ...meta, projectId, region });
 
   // === 3. Project create ===
-  await stepProjectCreate(installId, projectId);
+  await stepProjectCreate(installId, projectId, opts.domain);
 
   // === 4. Billing link ===
   await stepBillingLink(installId, projectId, opts.nonInteractive);
@@ -396,6 +403,7 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     // v0.3.1 — route pulumi up at the right stack folder + use the
     // matching config namespace.
     provider,
+    nonInteractive: opts.nonInteractive,
   });
   recordImageDigests(installId, imageDigests);
 
@@ -692,7 +700,11 @@ async function stepRegion(
   return choice as string;
 }
 
-async function stepProjectCreate(installId: string, projectId: string): Promise<void> {
+async function stepProjectCreate(
+  installId: string,
+  projectId: string,
+  domain: string,
+): Promise<void> {
   const stepName = `project-create-${projectId}`;
   if (isStepDone(installId, stepName)) {
     log.success(`Project ${bold(projectId)} ${dim("(already created)")}`);
@@ -705,7 +717,7 @@ async function stepProjectCreate(installId: string, projectId: string): Promise<
   }
   const s = spinner();
   s.start(`Creating GCP project ${projectId}...`);
-  const r = await createProject(projectId, "Caelo CMS");
+  const r = await createProject(projectId, projectDisplayName(domain));
   if (!r.ok) {
     s.stop(red(`Failed: ${r.stderr.trim()}`));
     log.error(
@@ -917,7 +929,11 @@ async function stepGrantBaseRoles(
 async function stepPublicRoleIsolation(projectId: string): Promise<void> {
   const s = spinner();
   s.start("Removing public_role from the Cloud SQL superuser group...");
-  const r = await revokePublicRoleMemberships({ projectId, env: GCP_STACK_ENV });
+  const r = await revokePublicRoleMemberships({
+    projectId,
+    env: GCP_STACK_ENV,
+    credentials: "operator",
+  });
   if (r.status === "failed") {
     s.stop(red(`Failed: ${r.error ?? ""}`));
     log.error("Re-run the wizard once the cause is fixed (this step is idempotent).");
@@ -1161,7 +1177,7 @@ async function stepRemoteMcp(
       projectId,
       region,
     );
-  const [admin, gateway] = [await name("admin"), await name("gateway")];
+  const [adminLookup, gatewayLookup] = [await name("admin"), await name("gateway")];
   const failed = (error: string) => {
     s.stop(yellow(`Remote MCP not prepared: ${error}`));
     log.warn(
@@ -1169,7 +1185,17 @@ async function stepRemoteMcp(
     );
     return false;
   };
-  if (!admin || !gateway) return failed("the admin or gateway Cloud Run service was not found");
+  if (adminLookup.status !== "found") {
+    return failed(
+      lookupFailure(adminLookup, `caelo-${GCP_STACK_ENV}-admin* Cloud Run service`, "operator"),
+    );
+  }
+  if (gatewayLookup.status !== "found") {
+    return failed(
+      lookupFailure(gatewayLookup, `caelo-${GCP_STACK_ENV}-gateway* Cloud Run service`, "operator"),
+    );
+  }
+  const [admin, gateway] = [adminLookup.name, gatewayLookup.name];
   const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
   if (!edge.ok) return failed(edge.error);
   const env = await ensureRemoteMcpIdentityEnv({
@@ -1436,6 +1462,50 @@ interface PulumiUpOpts {
   imageDigests: ImageDigests;
   /** v0.3.1 — provider variant; routes pulumi up at the right stack. */
   provider?: "gcp" | "gcp-firebase";
+  /** No terminal to ask (the install job, `--non-interactive`): see planGate. */
+  nonInteractive: boolean;
+}
+
+/**
+ * The installer's review of a deployed stack's plan before `pulumi up`
+ * (#737): the grouped list, the full diff in the install dir, and a y/N
+ * for any replace or delete. A data-bearing one is asked about by name and
+ * defaults to No; without a terminal it is refused (planGate).
+ *
+ * @returns whether `pulumi up` may apply the plan
+ */
+async function reviewPulumiPlan(
+  installId: string,
+  steps: readonly PlannedStep[],
+  nonInteractive: boolean,
+): Promise<boolean> {
+  const gate = planGate(steps, { interactive: !nonInteractive && process.stdin.isTTY === true });
+  if (steps.length === 0) {
+    log.info(dim("Preview: no changes planned."));
+    return true;
+  }
+  const file = writePlanFile(installRoot(installId), "installer", steps);
+  note([...formatPlan(steps), "", `Full diff: ${file}`].join("\n"), "pulumi up will change");
+  if (gate.kind === "proceed") return true;
+  if (gate.kind === "refuse") {
+    log.error(
+      red(
+        `Nothing was applied: this plan replaces or deletes resources that hold the site's data, and an unattended run cannot confirm that. Read ${file}; if the change is intended, re-run the installer in a terminal and confirm it there.`,
+      ),
+    );
+    return false;
+  }
+  const answer = await confirm({
+    message: gate.losesData
+      ? red("This plan DESTROYS the data named above. Apply it anyway?")
+      : "This plan replaces or deletes the resources listed above. Apply it?",
+    initialValue: false,
+  });
+  if (isCancel(answer) || answer !== true) {
+    log.warn(`Nothing was applied. The plan is in ${file}.`);
+    return false;
+  }
+  return true;
 }
 
 async function stepPulumiUp(installId: string, opts: PulumiUpOpts): Promise<void> {
@@ -1488,7 +1558,8 @@ async function stepPulumiUp(installId: string, opts: PulumiUpOpts): Promise<void
   log.info(`Pulumi up — wall-clock 8–15 min (Cloud SQL is the long pole). Streaming progress...`);
 
   let resourceCount = 0;
-  let result: Awaited<ReturnType<typeof pulumiUpGcp>>;
+  let result: Awaited<ReturnType<typeof pulumiUpGcp>> | undefined;
+  let declined = "";
   try {
     result = await pulumiUpGcp(
       {
@@ -1514,10 +1585,18 @@ async function stepPulumiUp(installId: string, opts: PulumiUpOpts): Promise<void
         // logs: silent — too noisy for a live progress UI; pulumi
         // diagnostics will print on failure via the SDK's onOutput.
       },
+      (steps) => reviewPulumiPlan(installId, steps, opts.nonInteractive),
     );
+  } catch (e) {
+    if (!(e instanceof PulumiUpDeclinedError)) throw e;
+    declined = e.message;
   } finally {
     releaseLock();
   }
+  if (result === undefined) {
+    cancel(declined);
+    process.exit(1);
+  }
   process.stdout.write("\n");
   log.success(
     green(
@@ -1915,6 +1994,7 @@ async function readBootstrapUrl(installId: string, provider: string): Promise<st
   const meta = readMetadata(installId);
   if (!meta) throw new Error(`No install.json for install '${installId}'.`);
   const value = await readStackOutput({
+    installRoot: installRoot(installId),
     backend: resolveBackend(meta, {
       installRoot: installRoot(installId),
       readPassphrase: () => readSecret(installId, "pulumi-passphrase"),

package/src/wizards/stack-work-dir.test.ts

@@ -0,0 +1,175 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #736 — every install runs Pulumi in its own work dir, so two CLI runs for
+ * different installs of one provider never read each other's stack config.
+ * The last test drives the real `pulumi` CLI (skipped where it is not
+ * installed, as in CI): two installs set their config and run `up` at the
+ * same time, and each sees only its own.
+ */
+
+import { afterAll, describe, expect, it } from "bun:test";
+import {
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import * as pulumi from "@pulumi/pulumi/automation";
+import { stackWorkDir } from "../install-state.js";
+import {
+  assertStackProject,
+  packageStackDir,
+  prepareStackWorkDir,
+  workDirProjectFile,
+} from "./gcp-pulumi.js";
+
+const STACKS = resolve(import.meta.dir, "../../stacks");
+const scratch = mkdtempSync(join(tmpdir(), "caelo-stack-work-dir-"));
+afterAll(() => rmSync(scratch, { recursive: true, force: true }));
+
+/** Every file under the package's stacks/ dir with its mtime. */
+function packageStacksSnapshot(): Record<string, number> {
+  return Object.fromEntries(
+    readdirSync(STACKS, { recursive: true, withFileTypes: true })
+      .filter((e) => e.isFile())
+      .map((e) => {
+        const path = join(e.parentPath, e.name);
+        return [path, statSync(path).mtimeMs];
+      }),
+  );
+}
+
+describe("workDirProjectFile", () => {
+  it("points main from the work dir at the package's program, keeping the rest", () => {
+    const yaml = "name: caelo-gcp\nruntime:\n  name: nodejs\nmain: ./index.ts\ndescription: x\n";
+    expect(workDirProjectFile(yaml, "/pkg/stacks/gcp", "/home/o/.caelo-a/stack/gcp")).toBe(
+      "name: caelo-gcp\nruntime:\n  name: nodejs\nmain: ../../../../../pkg/stacks/gcp/index.ts\ndescription: x\n",
+    );
+  });
+
+  it("refuses a project file without exactly one main line", () => {
+    expect(() => workDirProjectFile("name: x\n", "/pkg", "/w")).toThrow(/exactly one/);
+    expect(() => workDirProjectFile("main: a.ts\nmain: b.ts\n", "/pkg", "/w")).toThrow(/found 2/);
+  });
+});
+
+describe("prepareStackWorkDir", () => {
+  for (const provider of ["gcp", "gcp-firebase"] as const) {
+    it(`gives two ${provider} installs separate work dirs and never writes into the package`, () => {
+      const before = packageStacksSnapshot();
+      const a = prepareStackWorkDir(join(scratch, "a"), provider);
+      const b = prepareStackWorkDir(join(scratch, "b"), provider);
+      expect(a).toBe(stackWorkDir(join(scratch, "a"), provider));
+      expect(a).not.toBe(b);
+
+      // Each install keeps its own settings file; preparing again (a new
+      // CLI version) leaves it alone.
+      writeFileSync(join(a, "Pulumi.production.yaml"), "config:\n  x:project: a\n");
+      writeFileSync(join(b, "Pulumi.production.yaml"), "config:\n  x:project: b\n");
+      prepareStackWorkDir(join(scratch, "a"), provider);
+      expect(readFileSync(join(a, "Pulumi.production.yaml"), "utf8")).toContain("project: a");
+      expect(readFileSync(join(b, "Pulumi.production.yaml"), "utf8")).toContain("project: b");
+
+      const project = readFileSync(join(a, "Pulumi.yaml"), "utf8");
+      const main = /^main: (\S+)$/m.exec(project)?.[1] ?? "";
+      expect(resolve(realpathSync(a), main)).toBe(
+        join(realpathSync(packageStackDir(provider)), "index.ts"),
+      );
+      expect(packageStacksSnapshot()).toEqual(before);
+    });
+  }
+
+  it("the package ships no stack settings file (nothing for installs to share)", () => {
+    const settings = Object.keys(packageStacksSnapshot()).filter((p) =>
+      /Pulumi\.(?!yaml$)[^/]+\.ya?ml$/.test(p),
+    );
+    expect(settings).toEqual([]);
+  });
+});
+
+/** A stack whose config holds `project` (or nothing), for the guard. */
+function stackWithProject(project: string | undefined): pulumi.Stack {
+  const fake: Pick<pulumi.Stack, "getConfig"> & { workspace: Pick<pulumi.Workspace, "workDir"> } = {
+    workspace: { workDir: "/home/o/.caelo-a/stack/gcp-firebase" },
+    getConfig: async (key) => {
+      if (project === undefined) throw new Error(`configuration key '${key}' not found`);
+      return { value: project, secret: false };
+    },
+  };
+  return fake as unknown as pulumi.Stack;
+}
+
+describe("assertStackProject", () => {
+  it("passes when the stack config names the install's project", async () => {
+    await assertStackProject(stackWithProject("acme"), "gcp-firebase", "acme");
+  });
+
+  it("refuses another install's project, naming both", async () => {
+    await expect(
+      assertStackProject(stackWithProject("searchviu-website"), "gcp-firebase", "caelo-site"),
+    ).rejects.toThrow(/names project searchviu-website, but this install is caelo-site/);
+  });
+
+  it("refuses a stack config without a project", async () => {
+    await expect(assertStackProject(stackWithProject(undefined), "gcp", "acme")).rejects.toThrow(
+      /names project \(none\)/,
+    );
+  });
+});
+
+describe.skipIf(!Bun.which("pulumi"))("two installs at once, real pulumi CLI", () => {
+  it("each install's up reads only its own config", async () => {
+    // A stand-in for the package's stack program; under the package so node
+    // resolves @pulumi/pulumi from it, as the real stacks do.
+    const pkg = mkdtempSync(join(import.meta.dir, "../../.stack-work-dir-test-"));
+    try {
+      const programDir = join(pkg, "stacks", "gcp-firebase");
+      mkdirSync(programDir, { recursive: true });
+      writeFileSync(
+        join(programDir, "Pulumi.yaml"),
+        "name: caelo-gcp-firebase\nruntime:\n  name: nodejs\n  options:\n    typescript: true\nmain: ./index.ts\n",
+      );
+      writeFileSync(
+        join(programDir, "index.ts"),
+        'import * as pulumi from "@pulumi/pulumi";\nexport const project = new pulumi.Config("caelo-gcp-firebase").require("project");\n',
+      );
+      writeFileSync(
+        join(programDir, "tsconfig.json"),
+        readFileSync(join(STACKS, "gcp-firebase", "tsconfig.json")),
+      );
+
+      const run = async (install: string, project: string) => {
+        const workDir = prepareStackWorkDir(join(scratch, install), "gcp-firebase", programDir);
+        const state = join(scratch, install, "state");
+        mkdirSync(state, { recursive: true });
+        const stack = await pulumi.LocalWorkspace.createOrSelectStack(
+          { stackName: "production", workDir },
+          {
+            envVars: {
+              PULUMI_BACKEND_URL: `file://${state}`,
+              PULUMI_CONFIG_PASSPHRASE: "test",
+              PULUMI_SKIP_UPDATE_CHECK: "true",
+            },
+          },
+        );
+        await stack.setConfig("caelo-gcp-firebase:project", { value: project });
+        await assertStackProject(stack, "gcp-firebase", project);
+        const up = await stack.up();
+        return up.outputs.project?.value;
+      };
+
+      const [a, b] = await Promise.all([run("real-a", "project-a"), run("real-b", "project-b")]);
+      expect([a, b]).toEqual(["project-a", "project-b"]);
+      expect(readdirSync(programDir).sort()).toEqual(["Pulumi.yaml", "index.ts", "tsconfig.json"]);
+    } finally {
+      rmSync(pkg, { recursive: true, force: true });
+    }
+  }, 180_000);
+});

package/stacks/aws/index.ts

@@ -40,6 +40,10 @@ import {
 } from "../../dist/aws-task-roles.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../../dist/stack-contract.js";
+import {
+  CLOUDFRONT_SVG_BEHAVIORS,
+  cloudFrontHeadersPolicy,
+} from "../../dist/static-security-headers.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -245,6 +249,19 @@ const redirectFunction = new aws.cloudfront.Function(`${namePrefix}-redirects`,
   keyValueStoreAssociations: [redirectKvs.arn],
 });
 
+// === 6c. Security response headers (#891) ===
+// nosniff on every response; the sandboxing CSP on every SVG, so an
+// uploaded SVG opened directly runs no script on the site's origin
+// (src/static-security-headers.ts).
+const siteHeadersPolicy = new aws.cloudfront.ResponseHeadersPolicy(`${namePrefix}-site-headers`, {
+  name: `${namePrefix}-site-headers`,
+  ...cloudFrontHeadersPolicy("site"),
+});
+const svgHeadersPolicy = new aws.cloudfront.ResponseHeadersPolicy(`${namePrefix}-svg-headers`, {
+  name: `${namePrefix}-svg-headers`,
+  ...cloudFrontHeadersPolicy("svg"),
+});
+
 // === 7. CloudFront distribution ===
 const distribution = new aws.cloudfront.Distribution(`${namePrefix}-cdn`, {
   enabled: true,
@@ -273,8 +290,30 @@ const distribution = new aws.cloudfront.Distribution(`${namePrefix}-cdn`, {
     defaultTtl: 60,
     maxTtl: 86400,
     functionAssociations: [{ eventType: "viewer-request", functionArn: redirectFunction.arn }],
+    responseHeadersPolicyId: siteHeadersPolicy.id,
   },
   orderedCacheBehaviors: [
+    // #891 — SVGs first (first match wins), each like the behavior it
+    // shadows except for the CSP policy.
+    ...CLOUDFRONT_SVG_BEHAVIORS.map(({ pathPattern, targetOriginId }) => ({
+      pathPattern,
+      targetOriginId,
+      viewerProtocolPolicy: "redirect-to-https",
+      allowedMethods: ["GET", "HEAD"],
+      cachedMethods: ["GET", "HEAD"],
+      forwardedValues: { queryString: false, cookies: { forward: "none" } },
+      minTtl: 0,
+      ...(targetOriginId === "media"
+        ? { defaultTtl: 31536000, maxTtl: 31536000 }
+        : {
+            defaultTtl: 60,
+            maxTtl: 86400,
+            functionAssociations: [
+              { eventType: "viewer-request", functionArn: redirectFunction.arn },
+            ],
+          }),
+      responseHeadersPolicyId: svgHeadersPolicy.id,
+    })),
     {
       pathPattern: "/media/*",
       targetOriginId: "media",
@@ -285,6 +324,7 @@ const distribution = new aws.cloudfront.Distribution(`${namePrefix}-cdn`, {
       minTtl: 0,
       defaultTtl: 31536000,
       maxTtl: 31536000,
+      responseHeadersPolicyId: siteHeadersPolicy.id,
     },
   ],
   viewerCertificate: {

package/stacks/azure/index.ts

@@ -45,6 +45,10 @@ import {
   GATEWAY_TRUSTED_PROXY_HOPS,
   TRUSTED_PROXY_HOPS_ENV,
 } from "../../dist/stack-contract.js";
+import {
+  FRONT_DOOR_SECURITY_RULE_SET,
+  frontDoorSecurityRules,
+} from "../../dist/static-security-headers.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -281,6 +285,23 @@ const redirectRuleSet = new azure.cdn.RuleSet(`${namePrefix}-fd-redirects`, {
   ruleSetName: "caeloRedirects",
 });
 
+// #891 — the security response headers: nosniff on every response, the
+// sandboxing CSP on every SVG (src/static-security-headers.ts). A set of
+// its own: the deploy replaces the redirects set's rules wholesale.
+const securityRuleSet = new azure.cdn.RuleSet(`${namePrefix}-fd-security`, {
+  resourceGroupName: rg.name,
+  profileName: frontDoor.name,
+  ruleSetName: FRONT_DOOR_SECURITY_RULE_SET,
+});
+for (const rule of frontDoorSecurityRules()) {
+  new azure.cdn.Rule(`${namePrefix}-fd-security-${rule.ruleName}`, {
+    resourceGroupName: rg.name,
+    profileName: frontDoor.name,
+    ruleSetName: securityRuleSet.name,
+    ...rule,
+  });
+}
+
 new azure.cdn.Route(
   `${namePrefix}-fd-route`,
   {
@@ -290,7 +311,7 @@ new azure.cdn.Route(
     routeName: "static",
     originGroup: { id: staticOriginGroup.id },
     customDomains: [{ id: siteDomain.id }],
-    ruleSets: [{ id: redirectRuleSet.id }],
+    ruleSets: [{ id: redirectRuleSet.id }, { id: securityRuleSet.id }],
     patternsToMatch: ["/*"],
     // Without a cache configuration Front Door does not cache the route at
     // all; static files are edge-cached per their Cache-Control (§11.B

package/stacks/gcp/README.md

@@ -66,6 +66,10 @@ pulumi stack output bootstrapUrlOut
 
 Open after the domain's and the admin's DNS A records point at the load balancer IP and the managed certificate is active.
 
+## Uploaded SVGs download instead of opening
+
+Opening an SVG's URL on the live site (for example `https://<domain>/_assets/logo.<hash>.svg`) downloads the file. It still renders normally in pages. The other providers send a sandboxing CSP on SVG responses. This stack cannot: GCS serves only a fixed set of metadata headers, the backend bucket's custom headers apply to every file including pages, and the URL map's site path matcher holds the redirect rules, which cannot coexist with per-extension route rules. So the publisher stores SVGs with `Content-Disposition: attachment`, and the backend bucket adds `X-Content-Type-Options: nosniff` to every response (#891). `cms-provision upgrade` patches the SVGs already live and purges Cloud CDN once. If the upgrade warns that this step failed, the next Publish live rewrites every SVG. After that, purge the CDN with `gcloud compute url-maps invalidate-cdn-cache <url-map> --path="/*" --global`.
+
 ## v1 limitations (P15 review-pass items)
 
 - **Container image build pipeline** — operators push via `gcloud builds submit` for v1. A unified `cms-provision build-images --provider gcp` lands later.

package/stacks/gcp/index.ts

@@ -48,6 +48,7 @@ import {
   STATIC_CDN_POLICY,
   secretFileVolumesTemplate,
 } from "../../dist/stack-contract.js";
+import { GCP_STATIC_RESPONSE_HEADERS } from "../../dist/static-security-headers.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -870,14 +871,17 @@ const wafPolicy = new gcp.compute.SecurityPolicy(
 );
 
 // Tier 1 backend — static GCS bucket via Cloud CDN. The CDN policy (one-year
-// client/edge TTL so immutable assets stay immutable, #555) is shared with
-// `cms-provision upgrade`, which applies it to existing installs.
+// client/edge TTL so immutable assets stay immutable, #555) and the response
+// headers (#891: nosniff on every file; SVGs are stored as downloads by the
+// publisher, see static-security-headers.ts) are shared with
+// `cms-provision upgrade`, which applies them to existing installs.
 const staticBackendBucket = new gcp.compute.BackendBucket(
   `${namePrefix}-static-backend`,
   {
     bucketName: staticBucket.name,
     enableCdn: true,
     cdnPolicy: { ...STATIC_CDN_POLICY },
+    customResponseHeaders: [...GCP_STATIC_RESPONSE_HEADERS],
   },
   opts,
 );

package/stacks/gcp/Pulumi.production.yaml

@@ -1,16 +0,0 @@
-encryptionsalt: v1:mEv+SGjVDdU=:v1:1Tmd1g2Yh0KXxhp5:fGsA3LiAPntjAGUMORKO+B1gxQgIEg==
-config:
-  caelo-gcp:adminMinInstances: "0"
-  caelo-gcp:anthropicApiKey:
-    secure: v1:/RCE2zS+Y8ZrTdcj:gIXucRKkT1vX+qg0yE8Uq3oIL+lHa23wLOheAKeR762d97ydAo332XwfteqJOgDg/scAtD2dict1NoNxNgxXpJnw1jltUi8fsF9vMt9elh2aV71eFB2oRGBlxIWbAgYdXqs/gfMxRtZ8r0dhYADuSCrtTQcI7GAFWg5EhA==
-  caelo-gcp:cloudSqlHa: "false"
-  caelo-gcp:cloudSqlTier: db-f1-micro
-  caelo-gcp:domain: caelo-cms.com
-  caelo-gcp:gatewayMinInstances: "0"
-  caelo-gcp:iapAllowlist: user:michael@searchviu.com
-  caelo-gcp:ownerEmail: michael@searchviu.com
-  caelo-gcp:project: caelo-website
-  caelo-gcp:region: europe-west1
-  caelo-gcp:wafAdaptiveProtection: "false"
-  caelo-gcp:image-digest-admin: sha256:92fb8ee1267de781f37c664e34d299b2f29c6051a113fa1bdbd6fddb753ef81e
-  caelo-gcp:image-digest-gateway: sha256:b4ceac2fd371be2850f7fc9549700fcd9e595eae6144f4a87b27192adf0cd9eb