@caelo-cms/provisioning 0.11.10 → 0.11.12

package/src/self-hosted-roles.ts

@@ -13,8 +13,10 @@
  * as the Postgres superuser BEFORE it writes the new Compose file: it
  * creates missing roles and databases and sets each role's password to the
  * configured one. It also drops the former `gateway_role` (#635: the
- * gateway has no cms_admin login), with whatever it still holds. Every
- * statement is idempotent.
+ * gateway has no cms_admin login), with whatever it still holds, and
+ * (#1329) creates the staging database `cms_public_staging` with the
+ * staging gateway's login `public_staging_role` on an install from before
+ * it. Every statement is idempotent.
  *
  * Passwords travel on psql's stdin, never on argv.
  */
@@ -35,7 +37,10 @@ function literal(s: string): string {
 export const AGENT_DB_ROLE = "caelo_agent";
 
 /** The application roles bootstrap.sh and the convergence create. */
-const APP_ROLES = ["admin_role", "public_role"] as const;
+const APP_ROLES = ["admin_role", "public_role", "public_staging_role"] as const;
+
+/** #1329 — the gateway logins that carry {@link PUBLIC_ROLE_LIMITS}: the live and the staging one. */
+const GATEWAY_LOGINS = ["public_role", "public_staging_role"] as const;
 type AppRole = (typeof APP_ROLES)[number];
 
 /**
@@ -47,7 +52,8 @@ type AppRole = (typeof APP_ROLES)[number];
  * (packages/migrations role-audit.ts) refuses an install without them.
  * Self-hosted admin_role has no CREATEROLE, so the superuser applies them
  * here — on the volume's first start (bootstrap.sh), on every `up`, and
- * before the migrations of every upgrade ({@link publicRoleLimitsScript}).
+ * before the migrations of every upgrade ({@link preMigrationRolesScript}).
+ * Since #1329 the staging gateway's public_staging_role carries the same.
  */
 export const PUBLIC_ROLE_LIMITS = {
   connectionLimit: 30,
@@ -56,31 +62,57 @@ export const PUBLIC_ROLE_LIMITS = {
   workMem: "1MB",
 } as const;
 
-/** The statements that apply {@link PUBLIC_ROLE_LIMITS} (idempotent). */
+/** The statements that apply {@link PUBLIC_ROLE_LIMITS} to both gateway logins (idempotent). */
 function publicRoleLimitsSql(): string[] {
   const l = PUBLIC_ROLE_LIMITS;
+  return GATEWAY_LOGINS.flatMap((role) => [
+    `ALTER ROLE ${role} CONNECTION LIMIT ${l.connectionLimit};`,
+    `ALTER ROLE ${role} SET statement_timeout = '${l.statementTimeout}';`,
+    `ALTER ROLE ${role} SET idle_in_transaction_session_timeout = '${l.idleInTransactionSessionTimeout}';`,
+    `ALTER ROLE ${role} SET work_mem = '${l.workMem}';`,
+  ]);
+}
+
+/** How a role's password appears in the SQL: a literal, or a psql variable. */
+type PasswordSql = (role: AppRole | typeof AGENT_DB_ROLE) => string;
+
+/**
+ * #1329 — the staging database and its gateway login, with each gateway
+ * login on its own database only (the same as bootstrap.sh and cms_admin
+ * migration 0530). Idempotent: an install from before #1329 gets both, an
+ * install that has them gets the password re-applied.
+ */
+function stagingDatabaseSql(password: PasswordSql): string[] {
   return [
-    `ALTER ROLE public_role CONNECTION LIMIT ${l.connectionLimit};`,
-    `ALTER ROLE public_role SET statement_timeout = '${l.statementTimeout}';`,
-    `ALTER ROLE public_role SET idle_in_transaction_session_timeout = '${l.idleInTransactionSessionTimeout}';`,
-    `ALTER ROLE public_role SET work_mem = '${l.workMem}';`,
+    "SELECT 'CREATE ROLE public_staging_role NOINHERIT LOGIN' WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'public_staging_role') \\gexec",
+    `ALTER ROLE public_staging_role WITH LOGIN PASSWORD ${password("public_staging_role")};`,
+    "SELECT 'CREATE DATABASE cms_public_staging OWNER admin_role' WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'cms_public_staging') \\gexec",
+    "REVOKE ALL ON DATABASE cms_public_staging FROM PUBLIC;",
+    "GRANT CONNECT ON DATABASE cms_public_staging TO public_staging_role, admin_role;",
+    "REVOKE ALL ON DATABASE cms_public_staging FROM public_role;",
+    "REVOKE ALL ON DATABASE cms_public FROM public_staging_role;",
+    "REVOKE ALL ON DATABASE cms_admin FROM public_staging_role;",
   ];
 }
 
 /**
- * The psql script (superuser) that applies only {@link PUBLIC_ROLE_LIMITS}.
- * The self-hosted upgrade runs it BEFORE the migrations: their role audit
- * refuses public_role without the limits, and the full convergence must
+ * The psql script (superuser) the self-hosted upgrade runs BEFORE the
+ * migrations: the gateway logins' {@link PUBLIC_ROLE_LIMITS} (#1338) and
+ * (#1329) the staging database with its login. The migrations' role audit
+ * refuses either gateway login without its limits, and the
+ * cms_public_staging run needs the database; the full convergence must
  * wait until after them (it drops roles a migration retired). Fails when
  * public_role does not exist — the install's roles were never created.
  */
-export function publicRoleLimitsScript(): string {
-  return ["\\set ON_ERROR_STOP on", ...publicRoleLimitsSql(), ""].join("\n");
+export function preMigrationRolesScript(stagingPassword: string): string {
+  return [
+    "\\set ON_ERROR_STOP on",
+    ...stagingDatabaseSql(() => literal(stagingPassword)),
+    ...publicRoleLimitsSql(),
+    "",
+  ].join("\n");
 }
 
-/** How a role's password appears in the SQL: a literal, or a psql variable. */
-type PasswordSql = (role: AppRole | typeof AGENT_DB_ROLE) => string;
-
 /**
  * The convergence SQL (psql, as the superuser, connected to any database).
  * `password` renders each role's password; `agent` adds the agent's login.
@@ -111,11 +143,15 @@ function convergenceSql(password: PasswordSql, agent: boolean): string {
     "REVOKE ALL ON DATABASE cms_public FROM PUBLIC;",
     "GRANT CONNECT ON DATABASE cms_admin TO admin_role;",
     "GRANT CONNECT ON DATABASE cms_public TO public_role, admin_role;",
+    // #1329 — after the other two databases exist: its revokes name them.
+    ...stagingDatabaseSql(password),
     // #635 — the gateway's former cms_admin login goes, with whatever it
     // still holds in either database (the superuser may drop what
     // migration 0285 could only revoke).
     "\\connect cms_public",
     "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
+    "\\connect cms_public_staging",
+    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
     "\\connect cms_admin",
     "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
     "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP ROLE gateway_role; END IF; END $$;",
@@ -136,6 +172,7 @@ export function roleConvergenceScript(passwords: RolePasswords, agentPassword?:
   const byRole: Record<AppRole, string> = {
     admin_role: passwords.admin,
     public_role: passwords.public,
+    public_staging_role: passwords.publicStaging,
   };
   return convergenceSql(
     (role) => literal(role === AGENT_DB_ROLE ? (agentPassword ?? "") : byRole[role]),
@@ -147,6 +184,7 @@ export function roleConvergenceScript(passwords: RolePasswords, agentPassword?:
 const PASSWORD_ENV: Record<AppRole | typeof AGENT_DB_ROLE, string> = {
   admin_role: "ADMIN_ROLE_PASSWORD",
   public_role: "PUBLIC_ROLE_PASSWORD",
+  public_staging_role: "PUBLIC_STAGING_ROLE_PASSWORD",
   [AGENT_DB_ROLE]: "AGENT_ROLE_PASSWORD",
 };
 
@@ -185,18 +223,20 @@ ${convergenceSql((role) => `:'${role}_pw'`, opts.agent)}CAELO_SQL
 export type SuperuserPsql = (script: string) => Promise<{ exitCode: number; stderr: string }>;
 
 /**
- * Apply {@link publicRoleLimitsScript} through the running Postgres
+ * Apply {@link preMigrationRolesScript} through the running Postgres
  * container. Unlike {@link convergeSelfHostedRoles} a stopped database is a
  * failure: the upgrade runs it right before migrations that need it.
  */
-export async function applyPublicRoleLimits(deps: {
+export async function applyPreMigrationRoles(deps: {
   readonly probe: () => Promise<boolean>;
   readonly psql: SuperuserPsql;
+  /** #1329 — public_staging_role's password from `.caelo/config.json`. */
+  readonly stagingPassword: string;
 }): Promise<ConvergeOutcome> {
   if (!(await deps.probe())) {
     return { ok: false, reachable: false, error: "the Postgres container is not running" };
   }
-  const r = await deps.psql(publicRoleLimitsScript());
+  const r = await deps.psql(preMigrationRolesScript(deps.stagingPassword));
   if (r.exitCode === 0) return { ok: true };
   return { ok: false, reachable: true, error: r.stderr.trim() || `psql exited ${r.exitCode}` };
 }

package/src/self-hosted-scheduler-interval.test.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1140 — the self-hosted Pulumi stack and the CLI render the same Compose
+ * file, so the scheduler interval `init` recorded survives a `pulumi up`,
+ * and a disagreeing Pulumi key is refused instead of winning silently.
+ */
+
+import { afterAll, describe, expect, it } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  recordedSchedulerIntervalMinutes,
+  selfHostedSchedulerIntervalMinutes,
+} from "./self-hosted-scheduler-interval.js";
+
+const dir = mkdtempSync(join(tmpdir(), "caelo-scheduler-interval-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+function config(name: string, body: string): string {
+  const path = join(dir, name);
+  writeFileSync(path, body);
+  return path;
+}
+
+describe("recordedSchedulerIntervalMinutes", () => {
+  it("reads what init recorded", () => {
+    expect(
+      recordedSchedulerIntervalMinutes(config("a.json", '{"schedulerIntervalMinutes":2}')),
+    ).toBe(2);
+  });
+
+  it("is undefined without a config.json or without the key", () => {
+    expect(recordedSchedulerIntervalMinutes(join(dir, "missing.json"))).toBeUndefined();
+    expect(recordedSchedulerIntervalMinutes(config("b.json", '{"domain":"x"}'))).toBeUndefined();
+  });
+
+  it("refuses a broken file or an out-of-range value", () => {
+    expect(() => recordedSchedulerIntervalMinutes(config("c.json", "{"))).toThrow("not valid JSON");
+    expect(() =>
+      recordedSchedulerIntervalMinutes(config("d.json", '{"schedulerIntervalMinutes":30}')),
+    ).toThrow("between 1 and 15");
+    expect(() =>
+      recordedSchedulerIntervalMinutes(config("e.json", '{"schedulerIntervalMinutes":"2"}')),
+    ).toThrow("not a number");
+  });
+});
+
+describe("selfHostedSchedulerIntervalMinutes", () => {
+  it("keeps the recorded interval when the Pulumi key is unset", () => {
+    expect(selfHostedSchedulerIntervalMinutes(undefined, 2, "config.json")).toBe(2);
+    expect(selfHostedSchedulerIntervalMinutes(undefined, undefined, "config.json")).toBeUndefined();
+  });
+
+  it("takes the Pulumi key on a Pulumi-only install, or when both agree", () => {
+    expect(selfHostedSchedulerIntervalMinutes(3, undefined, "config.json")).toBe(3);
+    expect(selfHostedSchedulerIntervalMinutes(2, 2, "config.json")).toBe(2);
+  });
+
+  it("refuses a Pulumi key that disagrees with the record", () => {
+    expect(() => selfHostedSchedulerIntervalMinutes(5, 2, "config.json")).toThrow(
+      "config.json records 2",
+    );
+  });
+});

package/src/self-hosted-scheduler-interval.ts

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1140 — the self-hosted scheduler interval has two places it can be set:
+ * `cms-provision init --scheduler-interval-minutes` records it in
+ * `.caelo/config.json` (which every CLI render — `up`, `upgrade`, agent
+ * apply — reads), and the Pulumi stack has the config key
+ * `caelo-self-hosted:schedulerIntervalMinutes`. Both rewrite the same
+ * `docker-compose.yml`, so if each read only its own source a `pulumi up`
+ * over a CLI install would silently put the interval back to the default,
+ * and the next CLI `upgrade` would undo a Pulumi-only value the same way.
+ *
+ * The recorded `.caelo/config.json` is the install's one record (the CLI
+ * renders from nothing else), so the stack takes the interval from it; the
+ * Pulumi key may restate it but a different value is refused rather than
+ * one side winning silently (CLAUDE.md §2: no fallbacks).
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { parseSchedulerIntervalMinutes } from "./stack-contract.js";
+
+/**
+ * Read the interval `init` recorded in a `.caelo/config.json`.
+ *
+ * @param configPath - the install's `config.json`.
+ * @returns the recorded minutes, or undefined when there is no config.json
+ *   (a Pulumi-only install) or it records no interval (the default).
+ * @throws when the file is not JSON or the recorded value is out of bounds.
+ */
+export function recordedSchedulerIntervalMinutes(configPath: string): number | undefined {
+  if (!existsSync(configPath)) return undefined;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(configPath, "utf8"));
+  } catch (e) {
+    throw new Error(`${configPath} is not valid JSON: ${(e as Error).message}`);
+  }
+  const raw =
+    parsed !== null && typeof parsed === "object"
+      ? (parsed as { schedulerIntervalMinutes?: unknown }).schedulerIntervalMinutes
+      : undefined;
+  if (raw === undefined) return undefined;
+  if (typeof raw !== "number") {
+    throw new Error(
+      `${configPath}: schedulerIntervalMinutes ${JSON.stringify(raw)} is not a number of minutes`,
+    );
+  }
+  return parseSchedulerIntervalMinutes(raw, `${configPath}: schedulerIntervalMinutes`);
+}
+
+/**
+ * The interval the self-hosted Pulumi stack renders into the Compose file.
+ *
+ * @param pulumiValue - `caelo-self-hosted:schedulerIntervalMinutes`, if set.
+ * @param recorded - what {@link recordedSchedulerIntervalMinutes} read.
+ * @param configPath - named in the refusal.
+ * @returns the minutes to render; undefined means neither source sets one
+ *   (the generator's default).
+ * @throws when both are set and differ.
+ */
+export function selfHostedSchedulerIntervalMinutes(
+  pulumiValue: number | undefined,
+  recorded: number | undefined,
+  configPath: string,
+): number | undefined {
+  if (pulumiValue === undefined) return recorded;
+  const minutes = parseSchedulerIntervalMinutes(
+    pulumiValue,
+    "caelo-self-hosted:schedulerIntervalMinutes",
+  );
+  if (recorded !== undefined && recorded !== minutes) {
+    throw new Error(
+      `caelo-self-hosted:schedulerIntervalMinutes is ${minutes} but ${configPath} records ${recorded}; ` +
+        "the CLI renders the Compose file from config.json, so the two must agree. " +
+        `Set the Pulumi key to ${recorded}, or remove it (\`pulumi config rm caelo-self-hosted:schedulerIntervalMinutes\`) to use the recorded value.`,
+    );
+  }
+  return minutes;
+}

package/src/self-hosted-start.test.ts

@@ -36,6 +36,7 @@ describe("startSelfHosted (#707 — one command ends with a serving install)", (
       "up -d --wait postgres",
       `${MIGRATE} admin`,
       `${MIGRATE} public`,
+      `${MIGRATE} public-staging`,
       "up -d --remove-orphans",
       "config --services",
       "exec -T caelo-admin bun -e <probe>",

package/src/self-hosted-upgrade.test.ts

@@ -151,7 +151,7 @@ function deps(
       runner.calls.push("converge roles");
       return roles;
     },
-    applyPublicRoleLimits: async () => {
+    applyPreMigrationRoles: async () => {
       runner.calls.push("public role limits");
       return { ok: true } as const;
     },
@@ -187,6 +187,7 @@ describe("upgradeSelfHosted", () => {
       "public role limits",
       "migrate admin",
       "migrate public",
+      "migrate public-staging",
       "converge roles",
       "up caelo-admin",
       "health admin",

package/src/self-hosted-upgrade.ts

@@ -12,7 +12,9 @@
  *   3b. #1338 — recreate Postgres when the Compose file changed it (TLS with
  *      the install's own certificate, self-hosted-db-tls.ts: the new images
  *      connect with verify-full only; the old containers keep connecting,
- *      Postgres still accepts them) and apply public_role's limits as the
+ *      Postgres still accepts them) and, as the superuser, create the
+ *      staging database with its gateway login (#1329) and apply both gateway
+ *      logins' limits as the
  *      superuser (the migrations' role audit refuses public_role without
  *      them, and the self-hosted admin_role cannot set them);
  *   4. run the migrations from the NEW admin image (`docker compose run`,
@@ -65,6 +67,7 @@ import {
   MEDIA_DIR,
   type ReleaseImages,
 } from "./compose.js";
+import { MIGRATION_TARGETS } from "./migration-targets.js";
 import { selfCommand } from "./self-command.js";
 import {
   type HostRunner,
@@ -125,11 +128,13 @@ export interface SelfHostedUpgradeDeps {
    */
   readonly convergeRoles: () => Promise<ConvergeOutcome>;
   /**
-   * #1338 — applies public_role's limits as the Postgres superuser
-   * (`applyPublicRoleLimits`), before the migrations whose role audit
+   * #1338 / #1329 — as the Postgres superuser (`applyPreMigrationRoles`):
+   * creates the staging database and its gateway login on an install from
+   * before them, and applies both gateway logins' limits, before the
+   * migrations that run on that database and whose role audit
    * checks them.
    */
-  readonly applyPublicRoleLimits: () => Promise<ConvergeOutcome>;
+  readonly applyPreMigrationRoles: () => Promise<ConvergeOutcome>;
   /**
    * Re-writes the Caddyfile from the install's config + domains table and
    * reloads Caddy (#891): the edge headers (the SVG CSP, nosniff) live in
@@ -401,12 +406,12 @@ export async function upgradeSelfHosted(
       back.exitCode === 0,
     );
   }
-  const limits = await deps.applyPublicRoleLimits();
+  const limits = await deps.applyPreMigrationRoles();
   if (!limits.ok) {
     restoreCompose(file, previousCompose);
     return fail(
       "roles",
-      `Could not apply public_role's connection and statement limits: ${limits.error}\nThe previous release keeps running; no migration ran. Database backup: ${backup.dir}`,
+      `Could not prepare the database roles for the migrations (the staging database cms_public_staging and the gateway logins' connection and statement limits): ${limits.error}\nThe previous release keeps running; no migration ran. Database backup: ${backup.dir}`,
       true,
     );
   }
@@ -600,7 +605,8 @@ export async function dumpDatabases(
 }
 
 /**
- * Apply the committed migrations (cms_admin, then cms_public) with the
+ * Apply the committed migrations (cms_admin, then cms_public and its staging
+ * twin cms_public_staging, #1329) with the
  * admin image the Compose file names, as a one-off container — the
  * self-hosted equivalent of the GCP `caelo-migrate-<target>` Cloud Run job.
  * drizzle's bookkeeping makes re-runs apply only new migrations.
@@ -609,7 +615,7 @@ export async function runMigrations(
   caeloDir: string,
   runner: HostRunner,
 ): Promise<{ ok: true } | { ok: false; error: string }> {
-  for (const target of ["admin", "public"] as const) {
+  for (const target of MIGRATION_TARGETS) {
     const r = await runner.run(
       compose(
         caeloDir,

package/src/stack-contract.test.ts

@@ -23,6 +23,7 @@ import {
   RETIRED_SECRET_FILES,
   RETIRED_SERVICE_ENV,
   runtimeSecretBindings,
+  SECRETS_SET_UP_AHEAD_OF_THEIR_READER,
   SERVICE_SECRET_ENV,
   SERVICE_SECRET_FILES,
   SERVICE_VPC_EGRESS,
@@ -52,6 +53,7 @@ const asRecord = (vars: CloudRunEnvVar[]) =>
 const ADMIN_SECRETS = {
   ADMIN_DATABASE_PASSWORD: "secret:caelo-production-postgres-password:latest",
   PUBLIC_ADMIN_DATABASE_PASSWORD: "secret:caelo-production-postgres-password:latest",
+  PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD: "secret:caelo-production-postgres-password:latest",
   CAELO_SECRET_KEK: "secret:caelo-production-secret-kek:latest",
   CAELO_INTERNAL_SECRET: "secret:caelo-production-internal-secret:latest",
   CAELO_TOOL_APPROVAL_SECRET: "secret:caelo-production-tool-approval-secret:latest",
@@ -67,6 +69,10 @@ describe("databaseUrls", () => {
         "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       public:
         "postgresql://public_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      publicStagingAdmin:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      publicStaging:
+        "postgresql://public_staging_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
     });
   });
 });
@@ -81,11 +87,14 @@ describe("adminEnvContract", () => {
         "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       PUBLIC_ADMIN_DATABASE_URL:
         "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      PUBLIC_STAGING_ADMIN_DATABASE_URL:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       CAELO_SITE_URL: "https://acme.com",
       CAELO_GENERATOR_CLI: "/app/apps/static-generator/src/cli.ts",
       MEDIA_ROOT_DIR: "/app/apps/admin/data/media",
       CAELO_MCP_IAP_SERVICE_ACCOUNT: "caelo-mcp@acme.iam.gserviceaccount.com",
       CAELO_MEDIA_BUCKET: "acme-caelo-production-media",
+      CAELO_SCHEDULER_SERVICE_ACCOUNT: "caelo-production-scheduler@acme.iam.gserviceaccount.com",
       // #806 — where Settings → MCP → Remote writes the OAuth client.
       CAELO_OPERATOR_OAUTH_CLIENT_STORE:
         "projects/acme/secrets/caelo-production-operator-oauth-client",
@@ -121,11 +130,14 @@ describe("adminEnvContract", () => {
         "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       PUBLIC_ADMIN_DATABASE_URL:
         "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      PUBLIC_STAGING_ADMIN_DATABASE_URL:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       CAELO_SITE_URL: "https://acme.com",
       CAELO_GENERATOR_CLI: "/app/apps/static-generator/src/cli.ts",
       MEDIA_ROOT_DIR: "/app/apps/admin/data/media",
       CAELO_MCP_IAP_SERVICE_ACCOUNT: "caelo-mcp@acme.iam.gserviceaccount.com",
       CAELO_MEDIA_BUCKET: "acme-caelo-production-media",
+      CAELO_SCHEDULER_SERVICE_ACCOUNT: "caelo-production-scheduler@acme.iam.gserviceaccount.com",
       // #806 — where Settings → MCP → Remote writes the OAuth client.
       CAELO_OPERATOR_OAUTH_CLIENT_STORE:
         "projects/acme/secrets/caelo-production-operator-oauth-client",
@@ -191,6 +203,8 @@ describe("gatewayEnvContract", () => {
       CAELO_PROVIDER: "gcp",
       CAELO_ENV: "production",
       MEDIA_STORAGE_URL: "gs://acme-caelo-production-media",
+      // #1329 — the live site's gateway.
+      CAELO_GATEWAY_ENVIRONMENT: "live",
       // #845 — gcp: the LB appends <client>,<LB IP>.
       CAELO_TRUSTED_PROXY_HOPS: "2",
       PUBLIC_DATABASE_URL:
@@ -267,6 +281,7 @@ describe("database role secrets (#613)", () => {
     expect(DATABASE_ROLE_SECRET).toEqual({
       admin_role: "postgres-password",
       public_role: "public-role-password",
+      public_staging_role: "public-staging-role-password",
     });
   });
 
@@ -341,11 +356,24 @@ describe("runtime secrets", () => {
     ]);
   });
 
-  it("every CLI-generated secret is read by some service", () => {
+  it("every CLI-generated secret is read by some service, or says what reads it until one does", () => {
+    const read = CLOUD_RUN_SLUGS.flatMap((slug) => serviceSecrets(slug));
     for (const s of CLI_GENERATED_SECRETS) {
-      expect(CLOUD_RUN_SLUGS.flatMap((slug) => serviceSecrets(slug))).toContain(s);
+      if (SECRETS_SET_UP_AHEAD_OF_THEIR_READER[s]) {
+        // Set up ahead: no service may read it yet, or the entry is stale.
+        expect(read).not.toContain(s);
+        continue;
+      }
+      expect(read).toContain(s);
     }
   });
+
+  it("the two gateway logins share no password secret, and no service reads the staging one yet (#1329)", () => {
+    expect(DATABASE_ROLE_SECRET.public_staging_role).not.toBe(DATABASE_ROLE_SECRET.public_role);
+    expect(CLI_GENERATED_SECRETS).toContain("public-staging-role-password");
+    expect(serviceSecrets("gateway")).not.toContain("public-staging-role-password");
+    expect(serviceSecrets("admin")).not.toContain("public-staging-role-password");
+  });
 });
 
 describe("self-hosted compose", () => {
@@ -353,7 +381,7 @@ describe("self-hosted compose", () => {
     const yaml = generateDockerCompose({
       domain: "acme.com",
       postgresPassword: "p",
-      rolePasswords: { admin: "a", public: "b" },
+      rolePasswords: { admin: "a", public: "b", publicStaging: "ps" },
       caeloSecretKek: "k",
       dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),