@caelo-cms/provisioning 0.11.8 → 0.11.10

package/src/runtime-secrets.ts

@@ -5,7 +5,8 @@
  * Pulumi) creates and maintains, through gcloud:
  *
  *   - {@link ensureGatewayServiceAccount}: the gateway's own run SA, so it
- *     can be granted only the secrets the gateway reads.
+ *     can be granted only the secrets the gateway reads; the same for the
+ *     MCP-Auth-Proxy ({@link ensureMcpAuthProxyServiceAccount}, #1328).
  *   - {@link ensureGeneratedSecrets}: the secrets in
  *     `CLI_GENERATED_SECRETS` (stack-contract.ts). The wizard runs it before
  *     `pulumi up`, upgrade on every roll, so installs that predate a secret
@@ -23,9 +24,16 @@
 import { randomBytes } from "node:crypto";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
-import { gatewayServiceAccountEmail, gatewayServiceAccountId, gcpSecretId } from "./gcp-names.js";
+import {
+  gatewayServiceAccountEmail,
+  gatewayServiceAccountId,
+  gcpSecretId,
+  mcpAuthProxyServiceAccountEmail,
+  mcpAuthProxyServiceAccountId,
+} from "./gcp-names.js";
 import {
   CLI_GENERATED_SECRETS,
+  CLOUD_RUN_SLUGS,
   type CloudRunSlug,
   DATABASE_ROLE_SECRET,
   type DatabaseRole,
@@ -84,14 +92,47 @@ const ALREADY_EXISTS = /ALREADY_EXISTS|already exists/i;
 // ===========================================================================
 
 /** Create the gateway's run SA unless it exists. */
-export async function ensureGatewayServiceAccount(
+export function ensureGatewayServiceAccount(
+  install: { readonly projectId: string; readonly env: string },
+  deps: RuntimeDeps = {},
+): Promise<EnsureOutcome> {
+  return ensureServiceAccount(
+    install.projectId,
+    gatewayServiceAccountId(install.env),
+    gatewayServiceAccountEmail(install.projectId, install.env),
+    `Caelo ${install.env} gateway`,
+    deps,
+  );
+}
+
+/**
+ * #1328 — create the MCP-Auth-Proxy's run SA unless it exists. It gets no
+ * role here or anywhere: only `secretAccessor` on its two secrets
+ * (stack-contract.ts runtimeSecretBindings).
+ */
+export function ensureMcpAuthProxyServiceAccount(
   install: { readonly projectId: string; readonly env: string },
   deps: RuntimeDeps = {},
+): Promise<EnsureOutcome> {
+  return ensureServiceAccount(
+    install.projectId,
+    mcpAuthProxyServiceAccountId(install.env),
+    mcpAuthProxyServiceAccountEmail(install.projectId, install.env),
+    `Caelo ${install.env} MCP-Auth-Proxy`,
+    deps,
+  );
+}
+
+async function ensureServiceAccount(
+  projectId: string,
+  accountId: string,
+  email: string,
+  displayName: string,
+  deps: RuntimeDeps,
 ): Promise<EnsureOutcome> {
   const run = deps.run ?? defaultGcloud;
-  const email = gatewayServiceAccountEmail(install.projectId, install.env);
   const id = `service account ${email}`;
-  const project = `--project=${install.projectId}`;
+  const project = `--project=${projectId}`;
   const describe = await run([
     "iam",
     "service-accounts",
@@ -108,9 +149,9 @@ export async function ensureGatewayServiceAccount(
     "iam",
     "service-accounts",
     "create",
-    gatewayServiceAccountId(install.env),
+    accountId,
     project,
-    `--display-name=Caelo ${install.env} gateway`,
+    `--display-name=${displayName}`,
     "--quiet",
   ]);
   if (create.ok || ALREADY_EXISTS.test(create.stderr)) return { id, status: "applied" };
@@ -470,7 +511,7 @@ async function checkRotationReaders(
   const isSecret = (live: { kind: string; secret?: string } | undefined) =>
     live?.kind === "secret" &&
     (live.secret === secretId || (live.secret?.endsWith(`/secrets/${secretId}`) ?? false));
-  for (const service of ["admin", "gateway"] as const) {
+  for (const service of CLOUD_RUN_SLUGS) {
     const vars = Object.entries(SERVICE_SECRET_ENV[service])
       .filter(([, s]) => s === secret)
       .map(([name]) => name);
@@ -696,7 +737,7 @@ export async function rotateRuntimeSecret(
   steps.push(`added a new version to ${secretId}`);
 
   const failures: string[] = [];
-  for (const service of ["admin", "gateway"] as const) {
+  for (const service of CLOUD_RUN_SLUGS) {
     if (!serviceSecrets(service).includes(secret)) continue;
     const name = target.services[service];
     const [update, flip] = rollArgs(name, target.region, target.projectId) as [string[], string[]];

package/src/seal-key-rotation.test.ts

@@ -15,7 +15,7 @@ const T = {
   projectId: "acme",
   region: "europe-west1",
   env: "production",
-  gatewayService: "caelo-production-gateway-abc",
+  proxyService: "caelo-production-gateway-abc",
 };
 const DAY = 24 * 60 * 60 * 1000;
 const NOW = Date.UTC(2026, 9, 20);
@@ -122,7 +122,7 @@ describe("seal-key rotation (#806)", () => {
 
   it("keeps the window equal to the broker's refresh-token lifetime", async () => {
     const src = await Bun.file(
-      new URL("../../../apps/api-gateway/src/mcp/token.ts", import.meta.url),
+      new URL("../../../apps/mcp-auth-proxy/src/token.ts", import.meta.url),
     ).text();
     expect(src).toContain(
       `REFRESH_MAX_LIFETIME_SECONDS = ${SEAL_KEY_ROTATION_WINDOW_DAYS} * 24 * 60 * 60`,

package/src/seal-key-rotation.ts

@@ -5,7 +5,7 @@
  * every connected MCP client out.
  *
  * The broker seals its OAuth state, codes and refresh tokens under
- * `CAELO_MCP_OAUTH_SEAL_KEY` (api-gateway mcp/seal.ts, envelope v2 with a
+ * `CAELO_MCP_OAUTH_SEAL_KEY` (apps/mcp-auth-proxy seal.ts, envelope v2 with a
  * key id). While `CAELO_MCP_OAUTH_SEAL_KEY_PREVIOUS` is set it also opens
  * values sealed under that key, and seals everything new under the current
  * one. Refresh tokens live at most {@link SEAL_KEY_ROTATION_WINDOW_DAYS}
@@ -14,7 +14,7 @@
  *
  * Two steps, both `cms-provision rotate-secret mcp-oauth-seal-key`:
  *
- *   start   — add a new version to the secret, then roll the gateway with
+ *   start   — add a new version to the secret, then roll the MCP-Auth-Proxy with
  *             the current key at `latest` and the previous key PINNED to
  *             the version that was latest before (a pinned version never
  *             follows the new one), labelled with the start time.
@@ -27,7 +27,7 @@
  * progress (a second start would pin the CURRENT key as "previous" and drop
  * the real previous one early), and finishing before the window ends.
  *
- * A `cms-provision upgrade` whose `pulumi up` rewrites the gateway template
+ * A `cms-provision upgrade` whose `pulumi up` rewrites the MCP-Auth-Proxy template
  * during the window drops the previous key (the stack does not declare it):
  * clients sealed under it sign in again. That fails safe — no token lives
  * longer than intended — and is documented in the rotate output.
@@ -39,27 +39,27 @@ import { gcpSecretId } from "./gcp-names.js";
 import { initialSecretValue } from "./runtime-secrets.js";
 import { liveContainerEnv } from "./stack-converge.js";
 
-/** The gateway env var holding the previous key during a rotation. */
+/** The MCP-Auth-Proxy env var holding the previous key during a rotation. */
 export const SEAL_KEY_PREVIOUS_ENV = "CAELO_MCP_OAUTH_SEAL_KEY_PREVIOUS";
-/** The gateway env var holding the current key (stack-contract SERVICE_SECRET_ENV). */
+/** The MCP-Auth-Proxy env var holding the current key (stack-contract SERVICE_SECRET_ENV). */
 export const SEAL_KEY_ENV = "CAELO_MCP_OAUTH_SEAL_KEY";
-/** Label on the gateway service: when the rotation started (epoch ms). */
+/** Label on the MCP-Auth-Proxy service: when the rotation started (epoch ms). */
 export const SEAL_ROTATION_LABEL = "caelo-seal-rotation-started";
 /**
  * Days the previous key must stay: the broker's refresh-token lifetime
- * (api-gateway mcp/token.ts REFRESH_MAX_LIFETIME_SECONDS, 30 days).
+ * (apps/mcp-auth-proxy token.ts REFRESH_MAX_LIFETIME_SECONDS, 30 days).
  */
 export const SEAL_KEY_ROTATION_WINDOW_DAYS = 30;
 
 const DAY_MS = 24 * 60 * 60 * 1000;
 
-/** The deployed gateway a rotation works on. */
+/** The deployed MCP-Auth-Proxy a rotation works on. */
 export interface SealRotationTarget {
   readonly projectId: string;
   readonly region: string;
   readonly env: string;
-  /** Deployed (Pulumi-suffixed) gateway Cloud Run service name. */
-  readonly gatewayService: string;
+  /** Deployed (Pulumi-suffixed or fixed) MCP-Auth-Proxy Cloud Run service name. */
+  readonly proxyService: string;
 }
 
 export interface SealRotationReport {
@@ -80,7 +80,7 @@ interface GatewayState {
   readonly startedAtMs: number | null;
 }
 
-async function gatewayState(
+async function proxyState(
   run: GcloudRunner,
   t: SealRotationTarget,
 ): Promise<{ ok: true; state: GatewayState } | { ok: false; error: string }> {
@@ -88,13 +88,13 @@ async function gatewayState(
     "run",
     "services",
     "describe",
-    t.gatewayService,
+    t.proxyService,
     "--region",
     t.region,
     `--project=${t.projectId}`,
     "--format=json",
   ]);
-  if (!r.ok) return { ok: false, error: `read the gateway service: ${r.stderr.trim()}` };
+  if (!r.ok) return { ok: false, error: `read the MCP-Auth-Proxy service: ${r.stderr.trim()}` };
   const env = liveContainerEnv(r.stdout);
   const labels =
     (JSON.parse(r.stdout) as { metadata?: { labels?: Record<string, string> } }).metadata?.labels ??
@@ -105,7 +105,7 @@ async function gatewayState(
   if (current?.kind !== "secret") {
     return {
       ok: false,
-      error: `${SEAL_KEY_ENV} on ${t.gatewayService} is not a Secret Manager reference — run \`cms-provision upgrade\` first (it installs remote MCP's secrets).`,
+      error: `${SEAL_KEY_ENV} on ${t.proxyService} is not a Secret Manager reference — run \`cms-provision upgrade\` first (it installs remote MCP's secrets).`,
     };
   }
   return {
@@ -119,7 +119,7 @@ function rollFlip(t: SealRotationTarget): string[] {
     "run",
     "services",
     "update-traffic",
-    t.gatewayService,
+    t.proxyService,
     "--region",
     t.region,
     `--project=${t.projectId}`,
@@ -140,7 +140,7 @@ export async function startSealKeyRotation(
   const project = `--project=${t.projectId}`;
   const steps: string[] = [];
 
-  const live = await gatewayState(run, t);
+  const live = await proxyState(run, t);
   if (!live.ok) return { ok: false, steps, error: live.error };
   if (live.state.previousPinned) {
     const since = live.state.startedAtMs;
@@ -181,7 +181,7 @@ export async function startSealKeyRotation(
     "run",
     "services",
     "update",
-    t.gatewayService,
+    t.proxyService,
     "--region",
     t.region,
     project,
@@ -195,11 +195,11 @@ export async function startSealKeyRotation(
     return {
       ok: false,
       steps,
-      error: `The new key is stored but the gateway does not use it yet. Do not rotate again — roll the gateway:\n    gcloud ${update.join(" ")}\n    gcloud ${rollFlip(t).join(" ")}\n(${flipped.stderr.trim()})`,
+      error: `The new key is stored but the MCP-Auth-Proxy does not use it yet. Do not rotate again — roll the MCP-Auth-Proxy:\n    gcloud ${update.join(" ")}\n    gcloud ${rollFlip(t).join(" ")}\n(${flipped.stderr.trim()})`,
     };
   }
   steps.push(
-    `rolled the gateway onto the new key; tokens sealed under version ${version} keep working`,
+    `rolled the MCP-Auth-Proxy onto the new key; tokens sealed under version ${version} keep working`,
     `finish after ${new Date(now + SEAL_KEY_ROTATION_WINDOW_DAYS * DAY_MS).toISOString()} with: cms-provision rotate-secret mcp-oauth-seal-key --finish`,
     "a `cms-provision upgrade` before then drops the previous key early: clients sealed under it sign in again",
   );
@@ -215,13 +215,13 @@ export async function finishSealKeyRotation(
   const run = deps.run ?? defaultGcloud;
   const now = (deps.nowMs ?? Date.now)();
   const steps: string[] = [];
-  const live = await gatewayState(run, t);
+  const live = await proxyState(run, t);
   if (!live.ok) return { ok: false, steps, error: live.error };
   if (!live.state.previousPinned) {
     return {
       ok: false,
       steps,
-      error: `No seal-key rotation is in progress on ${t.gatewayService} (${SEAL_KEY_PREVIOUS_ENV} is not set). Start one with \`cms-provision rotate-secret mcp-oauth-seal-key\`.`,
+      error: `No seal-key rotation is in progress on ${t.proxyService} (${SEAL_KEY_PREVIOUS_ENV} is not set). Start one with \`cms-provision rotate-secret mcp-oauth-seal-key\`.`,
     };
   }
   const started = live.state.startedAtMs;
@@ -232,7 +232,7 @@ export async function finishSealKeyRotation(
       steps,
       error:
         due === null
-          ? `The gateway has ${SEAL_KEY_PREVIOUS_ENV} but no ${SEAL_ROTATION_LABEL} label, so the rotation's start is unknown. Wait ${SEAL_KEY_ROTATION_WINDOW_DAYS} days from when it started, then run --finish --now.`
+          ? `The MCP-Auth-Proxy has ${SEAL_KEY_PREVIOUS_ENV} but no ${SEAL_ROTATION_LABEL} label, so the rotation's start is unknown. Wait ${SEAL_KEY_ROTATION_WINDOW_DAYS} days from when it started, then run --finish --now.`
           : `The previous key still opens refresh tokens until ${new Date(due).toISOString()} (${SEAL_KEY_ROTATION_WINDOW_DAYS}-day lifetime). Finishing now would sign those clients out; run --finish after that time, or --finish --now if the old key leaked.`,
     };
   }
@@ -240,7 +240,7 @@ export async function finishSealKeyRotation(
     "run",
     "services",
     "update",
-    t.gatewayService,
+    t.proxyService,
     "--region",
     t.region,
     `--project=${t.projectId}`,
@@ -251,8 +251,8 @@ export async function finishSealKeyRotation(
   const rolled = await run(update);
   const flipped = rolled.ok ? await run(rollFlip(t)) : rolled;
   if (!flipped.ok) {
-    return { ok: false, steps, error: `roll the gateway: ${flipped.stderr.trim()}` };
+    return { ok: false, steps, error: `roll the MCP-Auth-Proxy: ${flipped.stderr.trim()}` };
   }
-  steps.push("removed the previous seal key from the gateway; the rotation is complete");
+  steps.push("removed the previous seal key from the MCP-Auth-Proxy; the rotation is complete");
   return { ok: true, steps };
 }

package/src/self-hosted-compose.test.ts

@@ -6,6 +6,8 @@ import {
   COMPOSE_ADMIN_UPSTREAM,
   COMPOSE_APP_SERVICES,
   COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_SERVICE,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   COMPOSE_POOL_BUDGET,
   type ComposeSpec,
   composeProjectName,
@@ -22,6 +24,7 @@ const base: Omit<ComposeSpec, "images"> = {
   postgresPassword: "pgpw",
   rolePasswords: { admin: "adminpw", public: "publicpw" },
   caeloSecretKek: "0".repeat(64),
+  dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
   internalSecret: "i".repeat(48),
   anthropicApiKey: "sk-ant-x",
   diskSize: "20Gi",
@@ -53,6 +56,7 @@ describe("self-hosted Compose — internal secret (#770)", () => {
     expect(() =>
       generateDockerCompose({
         ...base,
+        dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
         internalSecret: "short",
         images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
       }),
@@ -68,10 +72,23 @@ describe("self-hosted Compose — connection budget (#1254)", () => {
 
   it("starts Postgres with the max_connections the budget is computed from", () => {
     expect(service(yaml, "postgres")).toContain(
-      'command: ["postgres", "-c", "max_connections=100"]',
+      'command: ["postgres", "-c", "max_connections=100", ',
     );
   });
 
+  it("serves TLS with the install's own certificate, never a key it does not own (#1338)", () => {
+    const pg = service(yaml, "postgres");
+    expect(pg).toContain('"-c", "ssl=on"');
+    expect(pg).toContain("- ./postgres-tls/server.crt:/caelo-tls/server.crt:ro");
+    expect(pg).toContain("- ./postgres-tls/server.key:/caelo-tls/server.key:ro");
+    // The bind mount keeps the host's owner; Postgres only reads its own key.
+    expect(pg).toContain("install -o postgres -g postgres -m 0600 /caelo-tls/server.key");
+    expect(pg).toContain('exec docker-entrypoint.sh \\"$$@\\"');
+    // Only Postgres sees the server key; the CA key never leaves .caelo/.
+    expect(yaml.replace(pg, "")).not.toContain("server.key");
+    expect(yaml).not.toContain("ca.key");
+  });
+
   it("sizes the admin's two pools and the gateway's one", () => {
     expect(service(yaml, "caelo-admin")).toContain(
       `      CAELO_DB_POOL_MAX: "${COMPOSE_POOL_BUDGET.budget.adminPoolMax}"`,
@@ -82,6 +99,26 @@ describe("self-hosted Compose — connection budget (#1254)", () => {
   });
 });
 
+describe("self-hosted Compose — database certificate renewal (#1338)", () => {
+  const render = (digest: string) =>
+    generateDockerCompose({
+      ...base,
+      dbTlsServerCertSha256: digest,
+      images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+    });
+
+  it("carries the server certificate's digest on Postgres, so a renewal recreates it", () => {
+    const before = service(render("a".repeat(64)), "postgres");
+    const after = service(render("c".repeat(64)), "postgres");
+    expect(before).toContain(`CAELO_DB_TLS_SERVER_CERT_SHA256: "${"a".repeat(64)}"`);
+    expect(after).not.toBe(before);
+  });
+
+  it("refuses a value that is no SHA-256 digest", () => {
+    expect(() => render("not-a-digest")).toThrow("dbTlsServerCertSha256");
+  });
+});
+
 describe("self-hosted Compose — release images (#696)", () => {
   const yaml = generateDockerCompose({
     ...base,
@@ -104,10 +141,13 @@ describe("self-hosted Compose — release images (#696)", () => {
   it("mounts the bootstrap-token, site output + media dirs, never .caelo/ with its secrets", () => {
     const admin = service(yaml, "caelo-admin");
     expect(admin).toContain(
-      "    volumes:\n      - ./bootstrap:/app/.caelo\n      - ./output:/srv/caelo\n      - ./media:/data/media",
+      "    volumes:\n      - ./bootstrap:/app/.caelo\n      - ./output:/srv/caelo\n      - ./media:/data/media\n      - ./postgres-tls/ca.crt:/etc/caelo/db-ca/self-hosted-ca.pem:ro",
     );
     expect(yaml).not.toMatch(/- \.\/?:/);
-    expect(service(yaml, "caelo-gateway")).not.toContain("volumes:");
+    // The gateway mounts the database CA (#1338) and nothing else.
+    expect(service(yaml, "caelo-gateway")).toContain(
+      "    volumes:\n      - ./postgres-tls/ca.crt:/etc/caelo/db-ca/self-hosted-ca.pem:ro\n    restart:",
+    );
     expect(admin).toContain('CAELO_OUTPUT_ROOT: "/srv/caelo"');
     expect(admin).toContain('MEDIA_ROOT_DIR: "/data/media"');
     expect(service(yaml, "caddy")).toContain("- ./output:/srv/caelo:ro");
@@ -116,10 +156,10 @@ describe("self-hosted Compose — release images (#696)", () => {
   it("keeps the env + secret wiring of each service", () => {
     const admin = service(yaml, "caelo-admin");
     expect(admin).toContain(
-      'ADMIN_DATABASE_URL: "postgres://admin_role:adminpw@postgres:5432/cms_admin"',
+      'ADMIN_DATABASE_URL: "postgres://admin_role:adminpw@postgres:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/self-hosted-ca.pem"',
     );
     expect(admin).toContain(
-      'PUBLIC_ADMIN_DATABASE_URL: "postgres://admin_role:adminpw@postgres:5432/cms_public"',
+      'PUBLIC_ADMIN_DATABASE_URL: "postgres://admin_role:adminpw@postgres:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/self-hosted-ca.pem"',
     );
     expect(admin).toContain(`CAELO_SECRET_KEK: "${"0".repeat(64)}"`);
     expect(admin).toContain('CAELO_SITE_URL: "https://example.com"');
@@ -307,3 +347,66 @@ describe("self-hosted Compose — the host update agent (#696 Phase 4c)", () =>
     ).toThrow(/between 1024 and 65535/);
   });
 });
+
+describe("self-hosted Compose — the MCP-Auth-Proxy (#1328)", () => {
+  const PROXY = `ghcr.io/caelo-cms/mcp-auth-proxy@sha256:${"c".repeat(64)}`;
+  const yaml = generateDockerCompose({
+    ...base,
+    images: { mode: "release", admin: ADMIN, gateway: GATEWAY, "mcp-auth-proxy": PROXY },
+  });
+  const proxy = service(yaml, COMPOSE_MCP_AUTH_PROXY_SERVICE);
+
+  it("runs the digest-pinned release image on the port Caddy proxies to", () => {
+    expect(proxy).toContain(`image: ${PROXY}`);
+    expect(proxy).toContain('MCP_AUTH_PROXY_PORT: "8095"');
+    expect(COMPOSE_MCP_AUTH_PROXY_UPSTREAM).toBe("caelo-mcp-auth-proxy:8095");
+  });
+
+  it("says remote MCP is unavailable here and trusts Caddy as the one hop", () => {
+    expect(proxy).toContain('CAELO_REMOTE_MCP: "unavailable"');
+    expect(proxy).toContain('CAELO_TRUSTED_PROXY_HOPS: "1"');
+    expect(proxy).toContain('CAELO_PROVIDER: "self-hosted"');
+  });
+
+  it("gets no database URL, no secret, no mount and no dependency on Postgres", () => {
+    expect(proxy).not.toMatch(/DATABASE|PASSWORD|SECRET|KEK|postgres:\/\/|volumes:|depends_on/);
+    expect(proxy).not.toContain("adminpw");
+    expect(proxy).not.toContain("publicpw");
+  });
+
+  it("runs locked down: read-only root, no capabilities, no privilege escalation", () => {
+    expect(proxy).toContain("read_only: true");
+    expect(proxy).toContain('cap_drop: ["ALL"]');
+    expect(proxy).toContain('security_opt: ["no-new-privileges:true"]');
+  });
+
+  it("is absent for a release recorded before the proxy shipped", () => {
+    const old = generateDockerCompose({
+      ...base,
+      images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+    });
+    expect(old).not.toContain(COMPOSE_MCP_AUTH_PROXY_SERVICE);
+    expect(old).toContain("\n\nvolumes:\n");
+  });
+
+  it("runs the checkout's proxy in dev mode", () => {
+    const dev = generateDockerCompose({ ...base, images: { mode: "dev" } });
+    expect(service(dev, COMPOSE_MCP_AUTH_PROXY_SERVICE)).toContain(
+      "command: bun run apps/mcp-auth-proxy/src/server.ts",
+    );
+  });
+
+  it("refuses a proxy image that is not a digest-pinned GHCR reference", () => {
+    expect(() =>
+      generateDockerCompose({
+        ...base,
+        images: {
+          mode: "release",
+          admin: ADMIN,
+          gateway: GATEWAY,
+          "mcp-auth-proxy": "ghcr.io/caelo-cms/mcp-auth-proxy:latest",
+        },
+      }),
+    ).toThrow(/mcp-auth-proxy image/);
+  });
+});

package/src/self-hosted-db-tls.test.ts

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { afterEach, describe, expect, it } from "bun:test";
+import { X509Certificate } from "node:crypto";
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  ensureSelfHostedDbTls,
+  generateDatabaseTls,
+  SELF_HOSTED_DB_HOST,
+  SELF_HOSTED_TLS_DIR,
+  serverCertProblem,
+} from "./self-hosted-db-tls.js";
+
+const dirs: string[] = [];
+afterEach(() => {
+  for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true });
+});
+function tempDir(): string {
+  const d = mkdtempSync(join(tmpdir(), "caelo-db-tls-"));
+  dirs.push(d);
+  return d;
+}
+
+describe("generateDatabaseTls", () => {
+  it("makes a CA and a server certificate for `postgres` that chains to it", () => {
+    const files = generateDatabaseTls();
+    const ca = new X509Certificate(files.caCert);
+    const server = new X509Certificate(files.serverCert);
+    expect(ca.ca).toBe(true);
+    expect(server.ca).toBe(false);
+    expect(ca.verify(ca.publicKey)).toBe(true);
+    expect(server.verify(ca.publicKey)).toBe(true);
+    expect(server.checkHost(SELF_HOSTED_DB_HOST)).toBe(SELF_HOSTED_DB_HOST);
+    expect(server.checkHost("evil.example")).toBeUndefined();
+    expect(server.issuer).toBe(ca.subject);
+    expect(serverCertProblem(files.caCert, files.serverCert, new Date())).toBeNull();
+  });
+
+  it("passes a real TLS handshake with host-name verification (Bun's TLS)", async () => {
+    // The same check a verify-full Postgres client makes: the chain must end
+    // at the CA we pass, and the certificate must name the host dialled.
+    // `localhost` stands in for `postgres` (resolvable here), via the same
+    // generator path.
+    const files = generateDatabaseTls();
+    using server = Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      tls: { cert: files.serverCert, key: files.serverKey },
+      fetch: () => new Response("ok"),
+    });
+    const url = `https://127.0.0.1:${server.port}/`;
+    // Right CA + the certificate's host name (SNI/verify against `postgres`).
+    const ok = await fetch(url, {
+      tls: {
+        ca: files.caCert,
+        checkServerIdentity: (_host, cert) =>
+          cert.subjectaltname === `DNS:${SELF_HOSTED_DB_HOST}`
+            ? undefined
+            : new Error(`unexpected SAN ${cert.subjectaltname}`),
+      },
+    });
+    expect(await ok.text()).toBe("ok");
+    // Another CA: the chain does not verify.
+    await expect(fetch(url, { tls: { ca: generateDatabaseTls().caCert } })).rejects.toThrow();
+  });
+});
+
+describe("ensureSelfHostedDbTls", () => {
+  it("creates the files once, keys 0600, and keeps them on a re-run", () => {
+    const caelo = tempDir();
+    expect(ensureSelfHostedDbTls(caelo)).toHaveLength(1);
+    const dir = join(caelo, SELF_HOSTED_TLS_DIR);
+    expect(statSync(join(dir, "ca.key")).mode & 0o777).toBe(0o600);
+    expect(statSync(join(dir, "server.key")).mode & 0o777).toBe(0o600);
+    const ca = readFileSync(join(dir, "ca.crt"), "utf8");
+    const server = readFileSync(join(dir, "server.crt"), "utf8");
+    expect(ensureSelfHostedDbTls(caelo)).toEqual([]);
+    expect(readFileSync(join(dir, "ca.crt"), "utf8")).toBe(ca);
+    expect(readFileSync(join(dir, "server.crt"), "utf8")).toBe(server);
+  });
+
+  it("re-issues a server certificate near its end from the same CA", () => {
+    const caelo = tempDir();
+    ensureSelfHostedDbTls(caelo);
+    const dir = join(caelo, SELF_HOSTED_TLS_DIR);
+    const ca = readFileSync(join(dir, "ca.crt"), "utf8");
+    const later = new Date(Date.now() + 9.5 * 365 * 24 * 3600 * 1000);
+    const done = ensureSelfHostedDbTls(caelo, later);
+    expect(done[0]).toMatch(/re-issued.*expires/);
+    expect(readFileSync(join(dir, "ca.crt"), "utf8")).toBe(ca);
+    const fresh = readFileSync(join(dir, "server.crt"), "utf8");
+    expect(serverCertProblem(ca, fresh, later)).toBeNull();
+  });
+
+  it("re-issues a server certificate another CA signed", () => {
+    const caelo = tempDir();
+    ensureSelfHostedDbTls(caelo);
+    const dir = join(caelo, SELF_HOSTED_TLS_DIR);
+    writeFileSync(join(dir, "server.crt"), generateDatabaseTls().serverCert);
+    expect(ensureSelfHostedDbTls(caelo)[0]).toMatch(/not signed by the install's CA/);
+  });
+
+  it("refuses half a CA instead of silently replacing the trust anchor", () => {
+    const caelo = tempDir();
+    ensureSelfHostedDbTls(caelo);
+    rmSync(join(caelo, SELF_HOSTED_TLS_DIR, "ca.key"));
+    expect(() => ensureSelfHostedDbTls(caelo)).toThrow(/only half of the database CA/);
+  });
+});