@caelo-cms/provisioning 0.11.10 → 0.11.11

package/src/self-hosted-compose.test.ts

@@ -9,6 +9,8 @@ import {
   COMPOSE_MCP_AUTH_PROXY_SERVICE,
   COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   COMPOSE_POOL_BUDGET,
+  COMPOSE_SCHEDULER_SERVICE,
+  COMPOSE_SCHEDULER_TICK_URL,
   type ComposeSpec,
   composeProjectName,
   generateDockerCompose,
@@ -22,7 +24,7 @@ const GATEWAY = `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`;
 const base: Omit<ComposeSpec, "images"> = {
   domain: "example.com",
   postgresPassword: "pgpw",
-  rolePasswords: { admin: "adminpw", public: "publicpw" },
+  rolePasswords: { admin: "adminpw", public: "publicpw", publicStaging: "ps" },
   caeloSecretKek: "0".repeat(64),
   dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
   internalSecret: "i".repeat(48),
@@ -410,3 +412,72 @@ describe("self-hosted Compose — the MCP-Auth-Proxy (#1328)", () => {
     ).toThrow(/mcp-auth-proxy image/);
   });
 });
+
+describe("self-hosted Compose — the scheduler tick (#1140)", () => {
+  const yaml = generateDockerCompose({
+    ...base,
+    images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+  });
+  const scheduler = service(yaml, COMPOSE_SCHEDULER_SERVICE);
+
+  it("runs the admin image's clock against the admin's tick endpoint", () => {
+    expect(scheduler).toContain(`image: ${ADMIN}`);
+    expect(scheduler).toContain(
+      'command: ["bun", "--bun", "/app/packages/admin-core/src/scheduler/clock.ts"]',
+    );
+    expect(COMPOSE_SCHEDULER_TICK_URL).toBe("http://caelo-admin:5173/api/internal/scheduler/tick");
+    expect(scheduler).toContain(`CAELO_SCHEDULER_TICK_URL: "${COMPOSE_SCHEDULER_TICK_URL}"`);
+    expect(scheduler).toContain("depends_on: [caelo-admin]");
+  });
+
+  it("ticks every 5 minutes by default and follows the knob", () => {
+    expect(scheduler).toContain('CAELO_SCHEDULER_INTERVAL_MINUTES: "5"');
+    const fast = generateDockerCompose({
+      ...base,
+      schedulerIntervalMinutes: 1,
+      images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+    });
+    expect(service(fast, COMPOSE_SCHEDULER_SERVICE)).toContain(
+      'CAELO_SCHEDULER_INTERVAL_MINUTES: "1"',
+    );
+  });
+
+  it("refuses an interval outside 1-15 minutes", () => {
+    for (const bad of [0, 16, 2.5]) {
+      expect(() =>
+        generateDockerCompose({
+          ...base,
+          schedulerIntervalMinutes: bad,
+          images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+        }),
+      ).toThrow("schedulerIntervalMinutes");
+    }
+  });
+
+  it("holds only the internal secret it signs with: no database, no KEK, no mount", () => {
+    expect(scheduler).toContain(`CAELO_INTERNAL_SECRET: "${"i".repeat(48)}"`);
+    expect(scheduler).not.toMatch(/DATABASE|PASSWORD|KEK|postgres:\/\/|volumes:/);
+    expect(scheduler).not.toContain("adminpw");
+    expect(scheduler).not.toContain("0".repeat(64));
+  });
+
+  it("runs locked down: read-only root, no capabilities, no privilege escalation", () => {
+    expect(scheduler).toContain("read_only: true");
+    expect(scheduler).toContain('cap_drop: ["ALL"]');
+    expect(scheduler).toContain('security_opt: ["no-new-privileges:true"]');
+  });
+
+  it("runs the checkout's clock in dev mode", () => {
+    const dev = generateDockerCompose({ ...base, images: { mode: "dev" } });
+    expect(service(dev, COMPOSE_SCHEDULER_SERVICE)).toContain(
+      "command: bun run packages/admin-core/src/scheduler/clock.ts",
+    );
+  });
+
+  it("is part of every rendered Compose file, so an upgrade of an older install adds it", () => {
+    // self-hosted-upgrade.ts rolls onto renderCompose(<new images>), which is
+    // this generator: the next upgrade of an install without the service
+    // writes a Compose file that has it, and `docker compose up -d` starts it.
+    expect(yaml).toContain(`\n  ${COMPOSE_SCHEDULER_SERVICE}:\n`);
+  });
+});

package/src/self-hosted-roles.integration.test.ts

@@ -26,6 +26,7 @@ const required = [
   "POSTGRES_PORT",
   "ADMIN_ROLE_PASSWORD",
   "PUBLIC_ROLE_PASSWORD",
+  "PUBLIC_STAGING_ROLE_PASSWORD",
   "ADMIN_DATABASE_URL",
   "PUBLIC_DATABASE_URL",
 ] as const;
@@ -63,6 +64,7 @@ const psql: SuperuserPsql = async (script) => {
 const passwords = {
   admin: env.ADMIN_ROLE_PASSWORD as string,
   public: env.PUBLIC_ROLE_PASSWORD as string,
+  publicStaging: env.PUBLIC_STAGING_ROLE_PASSWORD as string,
 };
 
 describe("self-hosted role convergence against Postgres (#613 review, #635)", () => {

package/src/self-hosted-roles.test.ts

@@ -4,16 +4,16 @@ import { describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import {
-  applyPublicRoleLimits,
+  applyPreMigrationRoles,
   convergeSelfHostedRoles,
   decideUp,
   PUBLIC_ROLE_LIMITS,
-  publicRoleLimitsScript,
+  preMigrationRolesScript,
   roleConvergenceScript,
   selfHostedBootstrapScript,
 } from "./self-hosted-roles.js";
 
-const PASSWORDS = { admin: "a'pw", public: "p-pw" };
+const PASSWORDS = { admin: "a'pw", public: "p-pw", publicStaging: "s'pw" };
 
 describe("roleConvergenceScript (#613 review)", () => {
   const script = roleConvergenceScript(PASSWORDS);
@@ -28,13 +28,13 @@ describe("roleConvergenceScript (#613 review)", () => {
     expect(script).not.toContain("CREATE ROLE gateway_role");
   });
 
-  it("drops the former gateway_role with what it holds in both databases, and stops on the first error (#635)", () => {
+  it("drops the former gateway_role with what it holds in every database, and stops on the first error (#635, #1329)", () => {
     expect(script.startsWith("\\set ON_ERROR_STOP on")).toBe(true);
     const publicDrop = script.indexOf("\\connect cms_public");
     const adminDrop = script.indexOf("\\connect cms_admin");
     expect(publicDrop).toBeGreaterThan(-1);
     expect(adminDrop).toBeGreaterThan(publicDrop);
-    expect(script.match(/DROP OWNED BY gateway_role/g)).toHaveLength(2);
+    expect(script.match(/DROP OWNED BY gateway_role/g)).toHaveLength(3);
     expect(script.indexOf("THEN DROP ROLE gateway_role;")).toBeGreaterThan(adminDrop);
     expect(script).not.toContain("caelo_grant_gateway_role");
   });
@@ -132,27 +132,56 @@ describe("decideUp — `cms-provision up` never switches URLs onto unapplied pas
   });
 });
 
-describe("public_role's limits (#1338, H3)", () => {
-  const statements = [
-    `ALTER ROLE public_role CONNECTION LIMIT ${PUBLIC_ROLE_LIMITS.connectionLimit};`,
-    `ALTER ROLE public_role SET statement_timeout = '${PUBLIC_ROLE_LIMITS.statementTimeout}';`,
-    `ALTER ROLE public_role SET idle_in_transaction_session_timeout = '${PUBLIC_ROLE_LIMITS.idleInTransactionSessionTimeout}';`,
-    `ALTER ROLE public_role SET work_mem = '${PUBLIC_ROLE_LIMITS.workMem}';`,
+describe("the staging database and its login (#1329)", () => {
+  const staging = [
+    "SELECT 'CREATE ROLE public_staging_role NOINHERIT LOGIN' WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'public_staging_role') \\gexec",
+    "SELECT 'CREATE DATABASE cms_public_staging OWNER admin_role' WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'cms_public_staging') \\gexec",
+    "REVOKE ALL ON DATABASE cms_public_staging FROM PUBLIC;",
+    "GRANT CONNECT ON DATABASE cms_public_staging TO public_staging_role, admin_role;",
+    "REVOKE ALL ON DATABASE cms_public_staging FROM public_role;",
+    "REVOKE ALL ON DATABASE cms_public FROM public_staging_role;",
   ];
 
-  it("are set on the first start, on every `up`, and alone before an upgrade's migrations", () => {
+  it("are created on the first start, on every `up`, and before an upgrade's migrations", () => {
+    for (const script of [roleConvergenceScript(PASSWORDS), preMigrationRolesScript("s'pw")]) {
+      for (const st of staging) expect(script).toContain(st);
+      expect(script).toContain("ALTER ROLE public_staging_role WITH LOGIN PASSWORD 's''pw';");
+    }
+    const bootstrap = selfHostedBootstrapScript({ agent: false });
+    for (const st of staging) expect(bootstrap).toContain(st);
+    expect(bootstrap).toContain(
+      "ALTER ROLE public_staging_role WITH LOGIN PASSWORD :'public_staging_role_pw';",
+    );
+    expect(bootstrap).toContain('-v public_staging_role_pw="$PUBLIC_STAGING_ROLE_PASSWORD"');
+  });
+
+  it("drops the former gateway_role's leftovers in the staging database too", () => {
+    expect(roleConvergenceScript(PASSWORDS)).toContain("\\connect cms_public_staging");
+  });
+});
+
+describe("the gateway logins' limits (#1338, H3; #1329)", () => {
+  const statements = ["public_role", "public_staging_role"].flatMap((role) => [
+    `ALTER ROLE ${role} CONNECTION LIMIT ${PUBLIC_ROLE_LIMITS.connectionLimit};`,
+    `ALTER ROLE ${role} SET statement_timeout = '${PUBLIC_ROLE_LIMITS.statementTimeout}';`,
+    `ALTER ROLE ${role} SET idle_in_transaction_session_timeout = '${PUBLIC_ROLE_LIMITS.idleInTransactionSessionTimeout}';`,
+    `ALTER ROLE ${role} SET work_mem = '${PUBLIC_ROLE_LIMITS.workMem}';`,
+  ]);
+
+  it("are set on the first start, on every `up`, and before an upgrade's migrations", () => {
     for (const script of [
       selfHostedBootstrapScript({ agent: false }),
       roleConvergenceScript(PASSWORDS),
-      publicRoleLimitsScript(),
+      preMigrationRolesScript("s'pw"),
     ]) {
       for (const st of statements) expect(script).toContain(st);
     }
-    // The pre-migration script touches nothing else (no role drop, no grant).
-    expect(publicRoleLimitsScript().split("\n").filter(Boolean)).toEqual([
-      "\\set ON_ERROR_STOP on",
-      ...statements,
-    ]);
+    // The pre-migration script drops no role and touches no other database:
+    // only the staging database with its login, then the limits.
+    const lines = preMigrationRolesScript("s'pw").split("\n").filter(Boolean);
+    expect(lines[0]).toBe("\\set ON_ERROR_STOP on");
+    expect(lines.slice(-statements.length)).toEqual(statements);
+    expect(lines.some((l) => /DROP|\\connect/.test(l))).toBe(false);
   });
 
   it("match the values packages/migrations/src/bootstrap.sh sets (dev, CI, Cloud SQL bootstrap)", () => {
@@ -165,7 +194,8 @@ describe("public_role's limits (#1338, H3)", () => {
 
   it("refuse to run against a stopped database", async () => {
     let ran = false;
-    const r = await applyPublicRoleLimits({
+    const r = await applyPreMigrationRoles({
+      stagingPassword: "s",
       probe: async () => false,
       psql: async () => {
         ran = true;

package/src/self-hosted-roles.ts

@@ -13,8 +13,10 @@
  * as the Postgres superuser BEFORE it writes the new Compose file: it
  * creates missing roles and databases and sets each role's password to the
  * configured one. It also drops the former `gateway_role` (#635: the
- * gateway has no cms_admin login), with whatever it still holds. Every
- * statement is idempotent.
+ * gateway has no cms_admin login), with whatever it still holds, and
+ * (#1329) creates the staging database `cms_public_staging` with the
+ * staging gateway's login `public_staging_role` on an install from before
+ * it. Every statement is idempotent.
  *
  * Passwords travel on psql's stdin, never on argv.
  */
@@ -35,7 +37,10 @@ function literal(s: string): string {
 export const AGENT_DB_ROLE = "caelo_agent";
 
 /** The application roles bootstrap.sh and the convergence create. */
-const APP_ROLES = ["admin_role", "public_role"] as const;
+const APP_ROLES = ["admin_role", "public_role", "public_staging_role"] as const;
+
+/** #1329 — the gateway logins that carry {@link PUBLIC_ROLE_LIMITS}: the live and the staging one. */
+const GATEWAY_LOGINS = ["public_role", "public_staging_role"] as const;
 type AppRole = (typeof APP_ROLES)[number];
 
 /**
@@ -47,7 +52,8 @@ type AppRole = (typeof APP_ROLES)[number];
  * (packages/migrations role-audit.ts) refuses an install without them.
  * Self-hosted admin_role has no CREATEROLE, so the superuser applies them
  * here — on the volume's first start (bootstrap.sh), on every `up`, and
- * before the migrations of every upgrade ({@link publicRoleLimitsScript}).
+ * before the migrations of every upgrade ({@link preMigrationRolesScript}).
+ * Since #1329 the staging gateway's public_staging_role carries the same.
  */
 export const PUBLIC_ROLE_LIMITS = {
   connectionLimit: 30,
@@ -56,31 +62,57 @@ export const PUBLIC_ROLE_LIMITS = {
   workMem: "1MB",
 } as const;
 
-/** The statements that apply {@link PUBLIC_ROLE_LIMITS} (idempotent). */
+/** The statements that apply {@link PUBLIC_ROLE_LIMITS} to both gateway logins (idempotent). */
 function publicRoleLimitsSql(): string[] {
   const l = PUBLIC_ROLE_LIMITS;
+  return GATEWAY_LOGINS.flatMap((role) => [
+    `ALTER ROLE ${role} CONNECTION LIMIT ${l.connectionLimit};`,
+    `ALTER ROLE ${role} SET statement_timeout = '${l.statementTimeout}';`,
+    `ALTER ROLE ${role} SET idle_in_transaction_session_timeout = '${l.idleInTransactionSessionTimeout}';`,
+    `ALTER ROLE ${role} SET work_mem = '${l.workMem}';`,
+  ]);
+}
+
+/** How a role's password appears in the SQL: a literal, or a psql variable. */
+type PasswordSql = (role: AppRole | typeof AGENT_DB_ROLE) => string;
+
+/**
+ * #1329 — the staging database and its gateway login, with each gateway
+ * login on its own database only (the same as bootstrap.sh and cms_admin
+ * migration 0530). Idempotent: an install from before #1329 gets both, an
+ * install that has them gets the password re-applied.
+ */
+function stagingDatabaseSql(password: PasswordSql): string[] {
   return [
-    `ALTER ROLE public_role CONNECTION LIMIT ${l.connectionLimit};`,
-    `ALTER ROLE public_role SET statement_timeout = '${l.statementTimeout}';`,
-    `ALTER ROLE public_role SET idle_in_transaction_session_timeout = '${l.idleInTransactionSessionTimeout}';`,
-    `ALTER ROLE public_role SET work_mem = '${l.workMem}';`,
+    "SELECT 'CREATE ROLE public_staging_role NOINHERIT LOGIN' WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'public_staging_role') \\gexec",
+    `ALTER ROLE public_staging_role WITH LOGIN PASSWORD ${password("public_staging_role")};`,
+    "SELECT 'CREATE DATABASE cms_public_staging OWNER admin_role' WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'cms_public_staging') \\gexec",
+    "REVOKE ALL ON DATABASE cms_public_staging FROM PUBLIC;",
+    "GRANT CONNECT ON DATABASE cms_public_staging TO public_staging_role, admin_role;",
+    "REVOKE ALL ON DATABASE cms_public_staging FROM public_role;",
+    "REVOKE ALL ON DATABASE cms_public FROM public_staging_role;",
+    "REVOKE ALL ON DATABASE cms_admin FROM public_staging_role;",
   ];
 }
 
 /**
- * The psql script (superuser) that applies only {@link PUBLIC_ROLE_LIMITS}.
- * The self-hosted upgrade runs it BEFORE the migrations: their role audit
- * refuses public_role without the limits, and the full convergence must
+ * The psql script (superuser) the self-hosted upgrade runs BEFORE the
+ * migrations: the gateway logins' {@link PUBLIC_ROLE_LIMITS} (#1338) and
+ * (#1329) the staging database with its login. The migrations' role audit
+ * refuses either gateway login without its limits, and the
+ * cms_public_staging run needs the database; the full convergence must
  * wait until after them (it drops roles a migration retired). Fails when
  * public_role does not exist — the install's roles were never created.
  */
-export function publicRoleLimitsScript(): string {
-  return ["\\set ON_ERROR_STOP on", ...publicRoleLimitsSql(), ""].join("\n");
+export function preMigrationRolesScript(stagingPassword: string): string {
+  return [
+    "\\set ON_ERROR_STOP on",
+    ...stagingDatabaseSql(() => literal(stagingPassword)),
+    ...publicRoleLimitsSql(),
+    "",
+  ].join("\n");
 }
 
-/** How a role's password appears in the SQL: a literal, or a psql variable. */
-type PasswordSql = (role: AppRole | typeof AGENT_DB_ROLE) => string;
-
 /**
  * The convergence SQL (psql, as the superuser, connected to any database).
  * `password` renders each role's password; `agent` adds the agent's login.
@@ -111,11 +143,15 @@ function convergenceSql(password: PasswordSql, agent: boolean): string {
     "REVOKE ALL ON DATABASE cms_public FROM PUBLIC;",
     "GRANT CONNECT ON DATABASE cms_admin TO admin_role;",
     "GRANT CONNECT ON DATABASE cms_public TO public_role, admin_role;",
+    // #1329 — after the other two databases exist: its revokes name them.
+    ...stagingDatabaseSql(password),
     // #635 — the gateway's former cms_admin login goes, with whatever it
     // still holds in either database (the superuser may drop what
     // migration 0285 could only revoke).
     "\\connect cms_public",
     "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
+    "\\connect cms_public_staging",
+    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
     "\\connect cms_admin",
     "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
     "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP ROLE gateway_role; END IF; END $$;",
@@ -136,6 +172,7 @@ export function roleConvergenceScript(passwords: RolePasswords, agentPassword?:
   const byRole: Record<AppRole, string> = {
     admin_role: passwords.admin,
     public_role: passwords.public,
+    public_staging_role: passwords.publicStaging,
   };
   return convergenceSql(
     (role) => literal(role === AGENT_DB_ROLE ? (agentPassword ?? "") : byRole[role]),
@@ -147,6 +184,7 @@ export function roleConvergenceScript(passwords: RolePasswords, agentPassword?:
 const PASSWORD_ENV: Record<AppRole | typeof AGENT_DB_ROLE, string> = {
   admin_role: "ADMIN_ROLE_PASSWORD",
   public_role: "PUBLIC_ROLE_PASSWORD",
+  public_staging_role: "PUBLIC_STAGING_ROLE_PASSWORD",
   [AGENT_DB_ROLE]: "AGENT_ROLE_PASSWORD",
 };
 
@@ -185,18 +223,20 @@ ${convergenceSql((role) => `:'${role}_pw'`, opts.agent)}CAELO_SQL
 export type SuperuserPsql = (script: string) => Promise<{ exitCode: number; stderr: string }>;
 
 /**
- * Apply {@link publicRoleLimitsScript} through the running Postgres
+ * Apply {@link preMigrationRolesScript} through the running Postgres
  * container. Unlike {@link convergeSelfHostedRoles} a stopped database is a
  * failure: the upgrade runs it right before migrations that need it.
  */
-export async function applyPublicRoleLimits(deps: {
+export async function applyPreMigrationRoles(deps: {
   readonly probe: () => Promise<boolean>;
   readonly psql: SuperuserPsql;
+  /** #1329 — public_staging_role's password from `.caelo/config.json`. */
+  readonly stagingPassword: string;
 }): Promise<ConvergeOutcome> {
   if (!(await deps.probe())) {
     return { ok: false, reachable: false, error: "the Postgres container is not running" };
   }
-  const r = await deps.psql(publicRoleLimitsScript());
+  const r = await deps.psql(preMigrationRolesScript(deps.stagingPassword));
   if (r.exitCode === 0) return { ok: true };
   return { ok: false, reachable: true, error: r.stderr.trim() || `psql exited ${r.exitCode}` };
 }

package/src/self-hosted-scheduler-interval.test.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1140 — the self-hosted Pulumi stack and the CLI render the same Compose
+ * file, so the scheduler interval `init` recorded survives a `pulumi up`,
+ * and a disagreeing Pulumi key is refused instead of winning silently.
+ */
+
+import { afterAll, describe, expect, it } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  recordedSchedulerIntervalMinutes,
+  selfHostedSchedulerIntervalMinutes,
+} from "./self-hosted-scheduler-interval.js";
+
+const dir = mkdtempSync(join(tmpdir(), "caelo-scheduler-interval-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+function config(name: string, body: string): string {
+  const path = join(dir, name);
+  writeFileSync(path, body);
+  return path;
+}
+
+describe("recordedSchedulerIntervalMinutes", () => {
+  it("reads what init recorded", () => {
+    expect(
+      recordedSchedulerIntervalMinutes(config("a.json", '{"schedulerIntervalMinutes":2}')),
+    ).toBe(2);
+  });
+
+  it("is undefined without a config.json or without the key", () => {
+    expect(recordedSchedulerIntervalMinutes(join(dir, "missing.json"))).toBeUndefined();
+    expect(recordedSchedulerIntervalMinutes(config("b.json", '{"domain":"x"}'))).toBeUndefined();
+  });
+
+  it("refuses a broken file or an out-of-range value", () => {
+    expect(() => recordedSchedulerIntervalMinutes(config("c.json", "{"))).toThrow("not valid JSON");
+    expect(() =>
+      recordedSchedulerIntervalMinutes(config("d.json", '{"schedulerIntervalMinutes":30}')),
+    ).toThrow("between 1 and 15");
+    expect(() =>
+      recordedSchedulerIntervalMinutes(config("e.json", '{"schedulerIntervalMinutes":"2"}')),
+    ).toThrow("not a number");
+  });
+});
+
+describe("selfHostedSchedulerIntervalMinutes", () => {
+  it("keeps the recorded interval when the Pulumi key is unset", () => {
+    expect(selfHostedSchedulerIntervalMinutes(undefined, 2, "config.json")).toBe(2);
+    expect(selfHostedSchedulerIntervalMinutes(undefined, undefined, "config.json")).toBeUndefined();
+  });
+
+  it("takes the Pulumi key on a Pulumi-only install, or when both agree", () => {
+    expect(selfHostedSchedulerIntervalMinutes(3, undefined, "config.json")).toBe(3);
+    expect(selfHostedSchedulerIntervalMinutes(2, 2, "config.json")).toBe(2);
+  });
+
+  it("refuses a Pulumi key that disagrees with the record", () => {
+    expect(() => selfHostedSchedulerIntervalMinutes(5, 2, "config.json")).toThrow(
+      "config.json records 2",
+    );
+  });
+});

package/src/self-hosted-scheduler-interval.ts

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1140 — the self-hosted scheduler interval has two places it can be set:
+ * `cms-provision init --scheduler-interval-minutes` records it in
+ * `.caelo/config.json` (which every CLI render — `up`, `upgrade`, agent
+ * apply — reads), and the Pulumi stack has the config key
+ * `caelo-self-hosted:schedulerIntervalMinutes`. Both rewrite the same
+ * `docker-compose.yml`, so if each read only its own source a `pulumi up`
+ * over a CLI install would silently put the interval back to the default,
+ * and the next CLI `upgrade` would undo a Pulumi-only value the same way.
+ *
+ * The recorded `.caelo/config.json` is the install's one record (the CLI
+ * renders from nothing else), so the stack takes the interval from it; the
+ * Pulumi key may restate it but a different value is refused rather than
+ * one side winning silently (CLAUDE.md §2: no fallbacks).
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { parseSchedulerIntervalMinutes } from "./stack-contract.js";
+
+/**
+ * Read the interval `init` recorded in a `.caelo/config.json`.
+ *
+ * @param configPath - the install's `config.json`.
+ * @returns the recorded minutes, or undefined when there is no config.json
+ *   (a Pulumi-only install) or it records no interval (the default).
+ * @throws when the file is not JSON or the recorded value is out of bounds.
+ */
+export function recordedSchedulerIntervalMinutes(configPath: string): number | undefined {
+  if (!existsSync(configPath)) return undefined;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(configPath, "utf8"));
+  } catch (e) {
+    throw new Error(`${configPath} is not valid JSON: ${(e as Error).message}`);
+  }
+  const raw =
+    parsed !== null && typeof parsed === "object"
+      ? (parsed as { schedulerIntervalMinutes?: unknown }).schedulerIntervalMinutes
+      : undefined;
+  if (raw === undefined) return undefined;
+  if (typeof raw !== "number") {
+    throw new Error(
+      `${configPath}: schedulerIntervalMinutes ${JSON.stringify(raw)} is not a number of minutes`,
+    );
+  }
+  return parseSchedulerIntervalMinutes(raw, `${configPath}: schedulerIntervalMinutes`);
+}
+
+/**
+ * The interval the self-hosted Pulumi stack renders into the Compose file.
+ *
+ * @param pulumiValue - `caelo-self-hosted:schedulerIntervalMinutes`, if set.
+ * @param recorded - what {@link recordedSchedulerIntervalMinutes} read.
+ * @param configPath - named in the refusal.
+ * @returns the minutes to render; undefined means neither source sets one
+ *   (the generator's default).
+ * @throws when both are set and differ.
+ */
+export function selfHostedSchedulerIntervalMinutes(
+  pulumiValue: number | undefined,
+  recorded: number | undefined,
+  configPath: string,
+): number | undefined {
+  if (pulumiValue === undefined) return recorded;
+  const minutes = parseSchedulerIntervalMinutes(
+    pulumiValue,
+    "caelo-self-hosted:schedulerIntervalMinutes",
+  );
+  if (recorded !== undefined && recorded !== minutes) {
+    throw new Error(
+      `caelo-self-hosted:schedulerIntervalMinutes is ${minutes} but ${configPath} records ${recorded}; ` +
+        "the CLI renders the Compose file from config.json, so the two must agree. " +
+        `Set the Pulumi key to ${recorded}, or remove it (\`pulumi config rm caelo-self-hosted:schedulerIntervalMinutes\`) to use the recorded value.`,
+    );
+  }
+  return minutes;
+}

package/src/self-hosted-start.test.ts

@@ -36,6 +36,7 @@ describe("startSelfHosted (#707 — one command ends with a serving install)", (
       "up -d --wait postgres",
       `${MIGRATE} admin`,
       `${MIGRATE} public`,
+      `${MIGRATE} public-staging`,
       "up -d --remove-orphans",
       "config --services",
       "exec -T caelo-admin bun -e <probe>",

package/src/self-hosted-upgrade.test.ts

@@ -151,7 +151,7 @@ function deps(
       runner.calls.push("converge roles");
       return roles;
     },
-    applyPublicRoleLimits: async () => {
+    applyPreMigrationRoles: async () => {
       runner.calls.push("public role limits");
       return { ok: true } as const;
     },
@@ -187,6 +187,7 @@ describe("upgradeSelfHosted", () => {
       "public role limits",
       "migrate admin",
       "migrate public",
+      "migrate public-staging",
       "converge roles",
       "up caelo-admin",
       "health admin",

package/src/self-hosted-upgrade.ts

@@ -12,7 +12,9 @@
  *   3b. #1338 — recreate Postgres when the Compose file changed it (TLS with
  *      the install's own certificate, self-hosted-db-tls.ts: the new images
  *      connect with verify-full only; the old containers keep connecting,
- *      Postgres still accepts them) and apply public_role's limits as the
+ *      Postgres still accepts them) and, as the superuser, create the
+ *      staging database with its gateway login (#1329) and apply both gateway
+ *      logins' limits as the
  *      superuser (the migrations' role audit refuses public_role without
  *      them, and the self-hosted admin_role cannot set them);
  *   4. run the migrations from the NEW admin image (`docker compose run`,
@@ -65,6 +67,7 @@ import {
   MEDIA_DIR,
   type ReleaseImages,
 } from "./compose.js";
+import { MIGRATION_TARGETS } from "./migration-targets.js";
 import { selfCommand } from "./self-command.js";
 import {
   type HostRunner,
@@ -125,11 +128,13 @@ export interface SelfHostedUpgradeDeps {
    */
   readonly convergeRoles: () => Promise<ConvergeOutcome>;
   /**
-   * #1338 — applies public_role's limits as the Postgres superuser
-   * (`applyPublicRoleLimits`), before the migrations whose role audit
+   * #1338 / #1329 — as the Postgres superuser (`applyPreMigrationRoles`):
+   * creates the staging database and its gateway login on an install from
+   * before them, and applies both gateway logins' limits, before the
+   * migrations that run on that database and whose role audit
    * checks them.
    */
-  readonly applyPublicRoleLimits: () => Promise<ConvergeOutcome>;
+  readonly applyPreMigrationRoles: () => Promise<ConvergeOutcome>;
   /**
    * Re-writes the Caddyfile from the install's config + domains table and
    * reloads Caddy (#891): the edge headers (the SVG CSP, nosniff) live in
@@ -401,12 +406,12 @@ export async function upgradeSelfHosted(
       back.exitCode === 0,
     );
   }
-  const limits = await deps.applyPublicRoleLimits();
+  const limits = await deps.applyPreMigrationRoles();
   if (!limits.ok) {
     restoreCompose(file, previousCompose);
     return fail(
       "roles",
-      `Could not apply public_role's connection and statement limits: ${limits.error}\nThe previous release keeps running; no migration ran. Database backup: ${backup.dir}`,
+      `Could not prepare the database roles for the migrations (the staging database cms_public_staging and the gateway logins' connection and statement limits): ${limits.error}\nThe previous release keeps running; no migration ran. Database backup: ${backup.dir}`,
       true,
     );
   }
@@ -600,7 +605,8 @@ export async function dumpDatabases(
 }
 
 /**
- * Apply the committed migrations (cms_admin, then cms_public) with the
+ * Apply the committed migrations (cms_admin, then cms_public and its staging
+ * twin cms_public_staging, #1329) with the
  * admin image the Compose file names, as a one-off container — the
  * self-hosted equivalent of the GCP `caelo-migrate-<target>` Cloud Run job.
  * drizzle's bookkeeping makes re-runs apply only new migrations.
@@ -609,7 +615,7 @@ export async function runMigrations(
   caeloDir: string,
   runner: HostRunner,
 ): Promise<{ ok: true } | { ok: false; error: string }> {
-  for (const target of ["admin", "public"] as const) {
+  for (const target of MIGRATION_TARGETS) {
     const r = await runner.run(
       compose(
         caeloDir,