@caelo-cms/provisioning 0.11.12 → 0.11.14

package/src/upgrader-job.ts

@@ -63,14 +63,17 @@ import {
   type ReleaseManifest,
   type ReleaseManifestResult,
 } from "./release-manifest.js";
-import { cloudRunServicePrefix } from "./stack-contract.js";
+import {
+  cloudRunServicePrefix,
+  SERVICE_IMAGE_NAMES,
+  type ServiceImageName,
+} from "./stack-contract.js";
 import { StateLockHeldError } from "./state-store.js";
 import {
   type AppRollPlan,
   executeAppRoll,
   planAppRoll,
   type ReleaseImage,
-  ROLL_ORDER,
   type RollSlug,
 } from "./upgrade/app-roll.js";
 import { restoreCommand, takeSqlBackup } from "./upgrade/backup.js";
@@ -699,7 +702,7 @@ export async function recordUpdateEnd(
   return false;
 }
 
-/** Every digest the revisions serving traffic are known by, per service. */
+/** Every digest the revisions serving traffic are known by, per release image. */
 async function servingDigests(
   deps: UpgraderJobDeps,
   provider: InstallMetadata["provider"],
@@ -708,16 +711,18 @@ async function servingDigests(
       ok: true;
       digests: ServingDigests;
       /** The services' deployed names, for the template hints. */
-      services: Readonly<Record<RollSlug, string>>;
+      services: Readonly<Record<ServiceImageName, string>>;
     }
   | { ok: false; error: string }
 > {
-  const digests: Partial<Record<RollSlug, readonly string[]>> = {};
-  const services: Partial<Record<RollSlug, string>> = {};
+  const digests: Partial<Record<ServiceImageName, readonly string[]>> = {};
+  const services: Partial<Record<ServiceImageName, string>> = {};
   if (provider !== "gcp" && provider !== "gcp-firebase") {
     return { ok: false, error: `the upgrader runs on Google Cloud installs only, not ${provider}` };
   }
-  for (const slug of ROLL_ORDER) {
+  // The staging gateway (#1330) runs the gateway's image and rolls with
+  // it; the images, one service each, name the release.
+  for (const slug of SERVICE_IMAGE_NAMES) {
     // #1328 — which service plays which role differs per provider.
     const prefix = cloudRunServicePrefix(provider, deps.env, slug);
     const service = await resolveGcpResourceName(
@@ -735,10 +740,39 @@ async function servingDigests(
     digests[slug] = servingImageDigests(image);
     services[slug] = service.name;
   }
+  // #1330 — the staging gateway must serve the very image the gateway
+  // serves: it rolls with it, and an install whose staging gateway runs
+  // another release is not on one release (the upgrader runs only on
+  // installs converged to contract 20, which have it).
+  const stagingPrefix = cloudRunServicePrefix(provider, deps.env, "staging-gateway");
+  const staging = await resolveGcpResourceName(
+    deps.run,
+    "run-service",
+    stagingPrefix,
+    deps.projectId,
+    deps.region,
+  );
+  if (staging.status !== "found") {
+    return {
+      ok: false,
+      error: lookupFailure(staging, `${stagingPrefix}* Cloud Run service`, "job"),
+    };
+  }
+  const stagingImage = await findServingImage(deps.run, deps.projectId, deps.region, staging.name);
+  if (!stagingImage) {
+    return { ok: false, error: "could not read which image the staging gateway serves" };
+  }
+  const stagingDigests = servingImageDigests(stagingImage);
+  if (!stagingDigests.some((d) => (digests.gateway ?? []).includes(d))) {
+    return {
+      ok: false,
+      error: `the staging gateway (${staging.name}) serves ${stagingDigests[0] ?? "an unknown image"}, but the gateway serves ${digests.gateway?.[0] ?? "an unknown image"}: the install does not run one release. Nothing was changed; an upgrade from Cloud Shell rolls both onto one release.`,
+    };
+  }
   return {
     ok: true,
     digests: digests as ServingDigests,
-    services: services as Record<RollSlug, string>,
+    services: services as Record<ServiceImageName, string>,
   };
 }
 
@@ -749,10 +783,10 @@ async function servingDigests(
  */
 async function templateDigests(
   deps: UpgraderJobDeps,
-  services: Readonly<Record<RollSlug, string>>,
+  services: Readonly<Record<ServiceImageName, string>>,
 ): Promise<ServingDigests> {
-  const out: Partial<Record<RollSlug, readonly string[]>> = {};
-  for (const slug of ROLL_ORDER) {
+  const out: Partial<Record<ServiceImageName, readonly string[]>> = {};
+  for (const slug of SERVICE_IMAGE_NAMES) {
     const d = await findTemplateImageDigest(deps.run, deps.projectId, deps.region, services[slug]);
     out[slug] = d ? [d] : [];
   }

package/src/upgrader-records.ts

@@ -30,16 +30,16 @@
 import type { GcloudRunner } from "./gcloud-retry.js";
 import type { ImageDigests, InstallMetadata } from "./install-state.js";
 import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
-import { ROLL_ORDER, type RollSlug } from "./upgrade/app-roll.js";
+import { SERVICE_IMAGE_NAMES, type ServiceImageName } from "./stack-contract.js";
 import type { ReleaseImageForms } from "./upgrade/image-forms.js";
 import { releaseVersionForDigest } from "./upgrade/release-images.js";
 
 /** Every digest each serving image is known by (gcp-lookup.ts servingImageDigests). */
-export type ServingDigests = Readonly<Record<RollSlug, readonly string[]>>;
+export type ServingDigests = Readonly<Record<ServiceImageName, readonly string[]>>;
 
 // #1328 — the MCP-Auth-Proxy serves on every install this code runs on (the
 // upgrader runs only on installs converged to its contract).
-const SLUGS: readonly RollSlug[] = ROLL_ORDER;
+const SLUGS: readonly ServiceImageName[] = SERVICE_IMAGE_NAMES;
 
 /**
  * Whether install.json names the images that serve: per service, the
@@ -176,7 +176,7 @@ export async function findServingRelease(
 type ReleaseJudgement =
   | {
       readonly kind: "judged";
-      readonly matching: readonly RollSlug[];
+      readonly matching: readonly ServiceImageName[];
       readonly platformDigests: ImageDigests | null;
     }
   | { readonly kind: "unreadable"; readonly transient: boolean; readonly message: string };
@@ -191,8 +191,8 @@ async function judgeRelease(
   serving: ServingDigests,
   imageForms: ReleaseImageForms,
 ): Promise<ReleaseJudgement> {
-  const matching: RollSlug[] = [];
-  const platform: Partial<Record<RollSlug, string>> = {};
+  const matching: ServiceImageName[] = [];
+  const platform: Partial<Record<ServiceImageName, string>> = {};
   for (const slug of SLUGS) {
     const index = m.digests[slug];
     // #1328 — a release from before the proxy cannot be what serves here.
@@ -257,7 +257,7 @@ function capitalize(s: string): string {
 }
 
 /** `the admin`, `the gateway and the MCP-Auth-Proxy`, … for the refusal text. */
-function serviceList(slugs: readonly RollSlug[]): string {
+function serviceList(slugs: readonly ServiceImageName[]): string {
   const names = slugs.map((s) => (s === "mcp-auth-proxy" ? "the MCP-Auth-Proxy" : `the ${s}`));
   if (names.length <= 1) return names[0] ?? "";
   return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;

package/src/wizard.ts

@@ -154,7 +154,7 @@ export async function runWizard(opts: WizardOptions = {}): Promise<void> {
   } else {
     provider = jobModeProvider ?? opts.provider ?? (await pickProvider());
     domain = opts.domain ?? (await promptDomain());
-    const stagingDomain = await resolveStagingDomain(domain, provider, opts);
+    const stagingDomain = await resolveStagingDomain(domain, opts);
     ownerEmail = opts.ownerEmail ?? (await promptOwnerEmail());
     projectIdHint = jobModeProjectId ?? opts.projectId ?? null;
     installId = deriveInstallId(provider, projectIdHint ?? domain);
@@ -389,11 +389,10 @@ async function promptDomain(): Promise<string> {
  */
 async function resolveStagingDomain(
   domain: string,
-  provider: Provider,
   opts: Pick<WizardOptions, "stagingDomain" | "nonInteractive">,
 ): Promise<string> {
   const reserved = { liveHosts: [domain, `www.${domain}`], adminHosts: [`admin.${domain}`] };
-  const problemOf = (host: string) => stagingHostProblem(host, reserved, { provider });
+  const problemOf = (host: string) => stagingHostProblem(host, reserved);
   if (opts.stagingDomain) {
     const problem = problemOf(opts.stagingDomain);
     if (problem) {

package/src/wizards/gcp.ts

@@ -129,6 +129,10 @@ import {
   type RemoteMcpIdentity,
   sameRemoteMcpIdentity,
 } from "../stack-contract.js";
+import {
+  ensureStagingGatewayEdge,
+  ensureStagingGatewayFromLiveGateway,
+} from "../staging-gateway-setup.js";
 import {
   chooseInstallBackend,
   describeBackend,
@@ -521,6 +525,18 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
 
   phase("Finishing: operator access, welcome page");
 
+  // === 11.2. The staging gateway and its edge (#1330) ===
+  // Before the audit job, which reads the staging bucket this step creates
+  // on gcp-firebase.
+  const stagingReady = await stepStagingGateway(
+    projectId,
+    region,
+    provider,
+    domain,
+    installStagingHost(meta),
+    imageDigests,
+  );
+
   // === 11.3. The quality-audit job: parallel Lighthouse runs (#875) ===
   // Before the upgrader, which gets actAs on the job's service account.
   await stepAuditJob(projectId, region, provider);
@@ -573,10 +589,10 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // A fresh install ran every converge step above, so it is at this CLI's
   // infrastructure contract — recorded only when the upgrader and the
   // converge job are in place (the steps contract bumps 2 and 9 added) and
-  // remote MCP's steps (#806, bump 10) and the scheduler tick (#1140, bump
-  // 18) succeeded. With the release version, the admin can install the next
+  // remote MCP's steps (#806, bump 10), the scheduler tick (#1140, bump 18)
+  // and the staging gateway (#1330, bump 20) succeeded. With the release version, the admin can install the next
   // update itself.
-  if (upgraderReady && convergeReady && remoteMcpReady && schedulerReady) {
+  if (upgraderReady && convergeReady && remoteMcpReady && schedulerReady && stagingReady) {
     const version = releaseVersion;
     // #1025 — the linux/amd64 forms Cloud Run reports, next to the indexes,
     // so the upgrader recognises what serves without a registry lookup.
@@ -1465,6 +1481,49 @@ async function stepRemoteMcp(
   return true;
 }
 
+/**
+ * #1330 — the staging gateway (the live gateway's image, gate on, serving the
+ * staged build from the staging bucket) and the route of the staging host to
+ * it (staging-gateway-setup.ts). The site works without it, so a failure
+ * warns and `upgrade` retries. Prints the DNS records the staging host needs.
+ *
+ * @returns whether both parts are in place
+ */
+async function stepStagingGateway(
+  projectId: string,
+  region: string,
+  provider: "gcp" | "gcp-firebase",
+  domain: string,
+  stagingHost: string,
+  imageDigests: ImageDigests,
+): Promise<boolean> {
+  const s = spinner();
+  s.start(`Setting up the staging gateway behind the staging gate (${stagingHost})...`);
+  const failed = (error: string) => {
+    s.stop(yellow(`Staging gateway not set up: ${error}`));
+    log.warn(
+      `The site works; ${stagingHost} answers nothing until ${bold(selfCommand("upgrade"))} sets it up.`,
+    );
+    return false;
+  };
+  const target = { provider, projectId, region, env: GCP_STACK_ENV, domain, stagingHost };
+  const service = await ensureStagingGatewayFromLiveGateway({
+    ...target,
+    gatewayImageRef: releaseImageRef("gateway", imageDigests.gateway),
+  });
+  const broken = service.find((o) => o.status === "failed");
+  if (broken) return failed(`${broken.id}: ${broken.error ?? ""}`);
+  const edge = await ensureStagingGatewayEdge(target);
+  if (!edge.ok) return failed(edge.error);
+  s.stop(green(`Staging gateway ready: ${stagingHost} is served behind the staging gate`));
+  for (const line of edge.done) log.info(`  ${line}`);
+  if (edge.dnsRecords.length > 0) {
+    log.info(`  DNS for ${stagingHost} (Settings → Updates shows the same):`);
+    for (const d of edge.dnsRecords) log.info(`    ${d.name}  ${d.type}  ${d.value}`);
+  }
+  return true;
+}
+
 /**
  * Delete the firewall rules GCP pre-populates on the `default` network
  * (SSH, RDP, ICMP, internal; default-firewall.ts). A customised rule of the
@@ -2436,14 +2495,19 @@ async function stepFinalize(installId: string, setupLink: "print" | "secret"): P
           `  To bind ${cyan(`admin.${meta.domain}`)}, run`,
           `  ${dim(selfCommand("admin-domain", "enable"))}`,
           `  (it walks you through the one-time Search Console verification, prints the DNS record and waits for the certificate).`,
-          "",
-          bold("Protected staging site:"),
-          `  Stage builds render ${cyan(installStagingHost(meta))}; to serve it, run`,
-          `  ${dim(selfCommand("staging-domain", "enable"))}`,
-          `  It maps the host, turns on password protection and prints the staging login once;`,
-          `  add the DNS record it prints. The host serves pages after the first Stage.`,
         ]
       : [];
+  // #1330 — staging is served by its own gateway on every GCP install; the
+  // records it needs were printed by the staging gateway step above.
+  adminNote.push(
+    "",
+    bold("Protected staging site:"),
+    `  ${cyan(installStagingHost(meta))} is served by the staging gateway behind the staging gate,`,
+    "  once the DNS records printed above (also under Settings → Updates) point at it.",
+    `  To turn on password protection and print the staging login once, run`,
+    `  ${dim(selfCommand("staging-domain", "enable"))}`,
+    "  The host serves pages after the first Stage.",
+  );
 
   note(
     [

package/stacks/gcp/index.ts

@@ -29,6 +29,7 @@ import {
   MCP_IAP_SERVICE_ACCOUNT_ID,
   mcpAuthProxyServiceAccountId,
   runServiceAccountId,
+  stagingGatewayServiceAccountId,
   staticPublisherServiceAccountId,
 } from "../../dist/gcp-names.js";
 import { createSiteUrlMap } from "../../dist/gcp-url-map.js";
@@ -513,9 +514,10 @@ new gcp.storage.BucketIAMMember(
 
 // v0.2.78 — private staging bucket. Stage uploads here; Confirm-publish
 // server-side copies to the public static bucket. Never has allUsers
-// binding so the staged HTML is reachable ONLY through the admin's
-// IAP-gated /_staging-preview/<runId>/ proxy route. The public CDN
-// never serves from this bucket.
+// binding: since #1330 the staged build is reachable ONLY through the
+// staging gateway (the staging host, behind the staging gate), whose
+// account may read this bucket and nothing else. The public CDN never
+// serves from it.
 const stagingBucket = new gcp.storage.Bucket(
   `${namePrefix}-staging`,
   {
@@ -570,9 +572,24 @@ const mcpAuthProxySa = new gcp.serviceaccount.Account(
   },
   opts,
 );
+// #1330 — the staging gateway's own SA and (below) its secretAccessor on
+// its one login password, plus the telemetry roles. Its service, its read
+// access to the staging bucket and its edge (gcp: NEG, backend, host rule,
+// certificate; gcp-firebase: the second Hosting site) are the CLI's
+// (staging-gateway-setup.ts, after the first `up` and in every converge).
+const stagingGatewaySa = new gcp.serviceaccount.Account(
+  `${namePrefix}-staging-gateway-sa`,
+  {
+    accountId: stagingGatewayServiceAccountId(env),
+    displayName: `Caelo ${env} staging gateway`,
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
 const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
   admin: runSa,
   gateway: gatewaySa,
+  "staging-gateway": stagingGatewaySa,
   "mcp-auth-proxy": mcpAuthProxySa,
 };
 
@@ -582,6 +599,7 @@ const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
 const secretBindings: Record<CloudRunSlug, gcp.secretmanager.SecretIamMember[]> = {
   admin: [],
   gateway: [],
+  "staging-gateway": [],
   "mcp-auth-proxy": [],
 };
 for (const binding of runtimeSecretBindings()) {
@@ -696,6 +714,24 @@ new gcp.projects.IAMMember(
   },
   opts,
 );
+new gcp.projects.IAMMember(
+  `${namePrefix}-staging-gateway-log-writer`,
+  {
+    project,
+    role: "roles/logging.logWriter",
+    member: pulumi.interpolate`serviceAccount:${stagingGatewaySa.email}`,
+  },
+  opts,
+);
+new gcp.projects.IAMMember(
+  `${namePrefix}-staging-gateway-metric-writer`,
+  {
+    project,
+    role: "roles/monitoring.metricWriter",
+    member: pulumi.interpolate`serviceAccount:${stagingGatewaySa.email}`,
+  },
+  opts,
+);
 
 // `static-publisher` SA used by `bunx @caelo-cms/provisioning deploy` to
 // upload the static-generator output to the bucket. Pre-v0.2.78 this
@@ -759,8 +795,8 @@ function imageTag(service: string): pulumi.Output<string> {
 }
 
 interface CloudRunArgs {
-  /** The MCP-Auth-Proxy is CLI-owned on this stack (see mcpAuthProxySa). */
-  readonly serviceName: Exclude<CloudRunSlug, "mcp-auth-proxy">;
+  /** The MCP-Auth-Proxy and the staging gateway are CLI-owned on this stack (see their SAs). */
+  readonly serviceName: Exclude<CloudRunSlug, "mcp-auth-proxy" | "staging-gateway">;
   readonly minInstances: number;
   readonly maxInstances: number;
   readonly memory: string;
@@ -1227,6 +1263,7 @@ const urlMap = createSiteUrlMap(
   {
     domain,
     adminDomain,
+    stagingHost,
     staticBackend: staticBackendBucket.id,
     gatewayBackend: gatewayBackendService.id,
     adminBackend: adminBackendService.id,
@@ -1261,10 +1298,14 @@ const adminCert = new gcp.compute.ManagedSslCertificate(
   opts,
 );
 
+// #1330 — the staging host's own certificate is the CLI's
+// (staging-gateway-setup.ts, `caelo-<env>-staging-cert`), attached next to
+// these two after the first `up` and by every converge, so the proxy's
+// certificate list is left to it after creation.
 const httpsProxy = new gcp.compute.TargetHttpsProxy(
   `${namePrefix}-https-proxy`,
   { urlMap: urlMap.id, sslCertificates: [adminCert.id, managedCert.id] },
-  opts,
+  { ...opts, ignoreChanges: ["sslCertificates"] },
 );
 
 new gcp.compute.GlobalForwardingRule(

package/stacks/gcp-firebase/index.ts

@@ -33,12 +33,14 @@ import * as random from "@pulumi/random";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 import {
+  firebaseStagingSiteId,
   gatewayServiceAccountId,
   gcpBucketName,
   gcpSecretId,
   MCP_IAP_SERVICE_ACCOUNT_ID,
   mcpAuthProxyServiceAccountId,
   runServiceAccountId,
+  stagingGatewayServiceAccountId,
 } from "../../dist/gcp-names.js";
 import {
   DEFAULT_ADMIN_MAX_INSTANCES,
@@ -65,7 +67,6 @@ import {
   defaultStagingHost,
   fixedCloudRunServiceName,
   gatewayEnvContract,
-  INTERIM_FORWARD_ORIGIN_ENV,
   MCP_AUTH_PROXY_TIMEOUT_SECONDS,
   mcpAuthProxyEnvContract,
   REMOTE_MCP_IDENTITY_CONFIG,
@@ -482,9 +483,24 @@ const mcpAuthProxySa = new gcp.serviceaccount.Account(
   },
   opts,
 );
+// #1330 — the staging gateway's own SA and (below) its secretAccessor on
+// its one login password, plus the telemetry roles. Its service, its read
+// access to the staging bucket and its edge (gcp: NEG, backend, host rule,
+// certificate; gcp-firebase: the second Hosting site) are the CLI's
+// (staging-gateway-setup.ts, after the first `up` and in every converge).
+const stagingGatewaySa = new gcp.serviceaccount.Account(
+  `${namePrefix}-staging-gateway-sa`,
+  {
+    accountId: stagingGatewayServiceAccountId(env),
+    displayName: `Caelo ${env} staging gateway`,
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
 const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
   admin: runSa,
   gateway: gatewaySa,
+  "staging-gateway": stagingGatewaySa,
   "mcp-auth-proxy": mcpAuthProxySa,
 };
 
@@ -494,6 +510,7 @@ const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
 const secretBindings: Record<CloudRunSlug, gcp.secretmanager.SecretIamMember[]> = {
   admin: [],
   gateway: [],
+  "staging-gateway": [],
   "mcp-auth-proxy": [],
 };
 for (const binding of runtimeSecretBindings()) {
@@ -593,6 +610,24 @@ new gcp.projects.IAMMember(
   },
   opts,
 );
+new gcp.projects.IAMMember(
+  `${namePrefix}-staging-gateway-log-writer`,
+  {
+    project,
+    role: "roles/logging.logWriter",
+    member: pulumi.interpolate`serviceAccount:${stagingGatewaySa.email}`,
+  },
+  opts,
+);
+new gcp.projects.IAMMember(
+  `${namePrefix}-staging-gateway-metric-writer`,
+  {
+    project,
+    role: "roles/monitoring.metricWriter",
+    member: pulumi.interpolate`serviceAccount:${stagingGatewaySa.email}`,
+  },
+  opts,
+);
 
 // =========================================================================
 // Tier 1 — Firebase Hosting site
@@ -805,12 +840,10 @@ const gatewaySvc = cloudRunService({
   memory: "512Mi",
   // Firebase Hosting cuts a rewritten request at 60 s anyway.
   timeout: "300s",
-  // #650 — all traffic: `cms-provision staging-domain enable` maps the
-  // staging host onto the data gateway (Cloud Run refuses domain-mapped
-  // requests under an internal-only ingress), and it is invokable by
-  // allUsers anyway (data-gateway-public-invoker below): every /api request
-  // passes its rate limits, captcha and honeypot; staging requests pass the
-  // staging access gate.
+  // All traffic: the Firebase rewrite arrives from Google's edge, and it is
+  // invokable by allUsers anyway (data-gateway-public-invoker below): every
+  // /api request passes its rate limits, captcha and honeypot. Staging has a
+  // gateway of its own since #1330 (staging-gateway-setup.ts).
   ingress: "INGRESS_TRAFFIC_ALL",
   contractEnv: [...gatewayEnvContract(envContractInputs), ...poolBudget.env.gateway],
 });
@@ -832,15 +865,11 @@ const mcpAuthProxySvc = cloudRunService({
   // MCP clients call its run.app URL, never the Firebase rewrite (which
   // buffers streams and cuts at 60 s).
   timeout: `${MCP_AUTH_PROXY_TIMEOUT_SECONDS}s`,
-  // Public: MCP clients reach it directly; until #1331 the staging host's
-  // domain mapping (#650) still points at this service too, and the proxy
-  // forwards that traffic to the data gateway (INTERIM_FORWARD_ORIGIN_ENV).
+  // Public: MCP clients reach it directly.
   ingress: "INGRESS_TRAFFIC_ALL",
   contractEnv: [
     ...mcpAuthProxyEnvContract({ provider: "gcp-firebase", env }),
     ...remoteMcpEnv["mcp-auth-proxy"],
-    // FIXME(issue #1331): goes with the staging cutover.
-    { name: INTERIM_FORWARD_ORIGIN_ENV, value: gatewaySvc.uri },
   ],
 });
 
@@ -861,6 +890,9 @@ const adminSvc = cloudRunService({
     ...adminEnvContract({
       ...envContractInputs,
       firebaseSiteId,
+      firebaseStagingSiteId: pulumi
+        .output(firebaseSiteId)
+        .apply((id) => firebaseStagingSiteId(env, id)),
       gatewayService: gatewaySvc.name,
     }),
     ...remoteMcpEnv.admin,

package/stacks/self-hosted/index.ts

@@ -30,6 +30,7 @@ import {
   COMPOSE_ADMIN_UPSTREAM,
   COMPOSE_GATEWAY_UPSTREAM,
   COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
+  COMPOSE_STAGING_GATEWAY_UPSTREAM,
   composeProjectName,
   generateDockerCompose,
   SITE_OUTPUT_ROOT,
@@ -89,6 +90,9 @@ const publicRolePassword = pulumi.secret(randomHex(32));
 const publicStagingRolePassword = pulumi.secret(randomHex(32));
 // P18 — the KEK that encrypts stored provider keys.
 const caeloSecretKek = pulumi.secret(randomHex(32));
+// #650 / #1330 — the staging gate's key (admin only; the admin publishes it
+// to the staging gateway through the staging projection).
+const stagingGateSecret = pulumi.secret(randomHex(32));
 
 const composeYaml = pulumi
   .all([
@@ -97,10 +101,13 @@ const composeYaml = pulumi
     publicRolePassword,
     publicStagingRolePassword,
     caeloSecretKek,
+    stagingGateSecret,
   ])
-  .apply(([pgPw, adminPw, publicPw, publicStagingPw, kek]) =>
+  .apply(([pgPw, adminPw, publicPw, publicStagingPw, kek, gateSecret]) =>
     generateDockerCompose({
       domain,
+      stagingHost,
+      stagingGateSecret: gateSecret,
       postgresPassword: pgPw,
       rolePasswords: { admin: adminPw, public: publicPw, publicStaging: publicStagingPw },
       caeloSecretKek: kek,
@@ -126,7 +133,7 @@ const caddyConf = generateCaddyfile({
   ownerEmail,
   tls: "acme",
   publicSiteRoot: `${SITE_OUTPUT_ROOT}/output/production/current`,
-  stagingSiteRoot: `${SITE_OUTPUT_ROOT}/output/staging/current`,
+  stagingGatewayUpstream: COMPOSE_STAGING_GATEWAY_UPSTREAM,
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
   mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,