@caelo-cms/provisioning 0.11.9 → 0.11.10

package/src/admin-domain.test.ts

@@ -170,9 +170,9 @@ describe("enableStagingDomain (#650)", () => {
     },
   });
 
-  it("opens the gateway's ingress, maps staging.<domain> to the gateway and prints the record", async () => {
+  it("#1328 — maps staging.<domain> to the data gateway (it runs the gate), opening its ingress", async () => {
     const { run, calls } = fakeGcloud({
-      "run services list": [ok("caelo-production-gateway-xyz\n")],
+      "run services list": [ok("caelo-production-data-gateway\n")],
       "run services describe": [ok("internal-and-cloud-load-balancing\n")],
       "beta run domain-mappings describe": [fail("NOT_FOUND"), ok(STAGING_MAPPING)],
       "domains list-user-verified": [ok("example.com\n")],
@@ -189,21 +189,22 @@ describe("enableStagingDomain (#650)", () => {
       "run",
       "services",
       "update",
-      "caelo-production-gateway-xyz",
+      "caelo-production-data-gateway",
       "--region=europe-west1",
       "--project=p",
       "--ingress=all",
       "--quiet",
     ]);
     expect(calls.find((c) => c.includes("create"))).toContain(
-      "--service=caelo-production-gateway-xyz",
+      "--service=caelo-production-data-gateway",
     );
-    expect(calls[0]).toContain("--filter=metadata.name~^caelo-production-gateway");
+    // Never the old gateway service, which is the MCP-Auth-Proxy now.
+    expect(calls[0]).toContain("--filter=metadata.name~^caelo-production-data-gateway");
   });
 
   it("is idempotent: ingress already open and mapping present ⇒ no update, no create", async () => {
     const { run, calls } = fakeGcloud({
-      "run services list": [ok("caelo-production-gateway-xyz\n")],
+      "run services list": [ok("caelo-production-data-gateway\n")],
       "run services describe": [ok("all\n")],
       "beta run domain-mappings describe": [ok(STAGING_MAPPING)],
     });
@@ -215,7 +216,7 @@ describe("enableStagingDomain (#650)", () => {
 
   it("maps a host the operator chose on another domain, verifying that host itself", async () => {
     const { run, calls } = fakeGcloud({
-      "run services list": [ok("caelo-production-gateway-xyz\n")],
+      "run services list": [ok("caelo-production-data-gateway\n")],
       "run services describe": [ok("all\n")],
       "beta run domain-mappings describe": [fail("NOT_FOUND")],
       "domains list-user-verified": [ok("example.com\n")],
@@ -240,7 +241,7 @@ describe("enableStagingDomain (#650)", () => {
   it("installs the missing beta component before its first beta command", async () => {
     const { run, calls } = fakeGcloud({
       "components list": [ok("")],
-      "run services list": [ok("caelo-production-gateway-xyz\n")],
+      "run services list": [ok("caelo-production-data-gateway\n")],
       "run services describe": [ok("all\n")],
       "beta run domain-mappings describe": [ok(STAGING_MAPPING)],
     });

package/src/admin-domain.ts

@@ -31,7 +31,8 @@
 
 import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
 import { ensureGcloudComponent } from "./gcloud-components.js";
-import { STAGING_HOST_ENV } from "./stack-contract.js";
+import { GCP_STACK_ENV } from "./gcp-names.js";
+import { cloudRunServicePrefix, STAGING_HOST_ENV } from "./stack-contract.js";
 import { liveContainerEnv } from "./stack-converge.js";
 
 type Run = (args: string[]) => Promise<GcloudResult>;
@@ -76,13 +77,17 @@ function logOf(opts: DomainOpts): (message: string) => void {
   return opts.log ?? ((message: string) => console.log(message));
 }
 
-/** The one deployed Cloud Run service of `slug` (Pulumi-suffixed name); also used by staging-admin.ts. */
+/**
+ * The one deployed Cloud Run service playing `slug` on a gcp-firebase
+ * install (stack-contract.ts cloudRunServicePrefix: since #1328 the visitor
+ * gateway is `caelo-production-data-gateway`); also used by staging-admin.ts.
+ */
 export async function findService(
   run: Run,
   scope: string[],
   slug: "admin" | "gateway",
 ): Promise<{ ok: true; service: string } | { ok: false; error: string }> {
-  const prefix = `caelo-production-${slug}`;
+  const prefix = cloudRunServicePrefix("gcp-firebase", GCP_STACK_ENV, slug);
   const services = await run([
     "run",
     "services",
@@ -128,6 +133,11 @@ export async function enableAdminDomain(opts: DomainOpts): Promise<AdminDomainRe
  * ingress is internal-only, so the gateway's ingress is opened first (the
  * stack declares the same since #650; installs from before keep the old
  * value until this runs). Idempotent like the admin mapping.
+ *
+ * #1328 — a new mapping goes to the data gateway, which runs the gate. A
+ * mapping made before stays on the service that was the gateway (now the
+ * MCP-Auth-Proxy, which forwards it there) until the staging cutover moves
+ * it (#1330, #1331); an existing mapping is only reported here.
  */
 export async function enableStagingDomain(
   opts: DomainOpts & { stagingHost: string },

package/src/admin-memory.test.ts

@@ -76,6 +76,7 @@ describe("self-hosted compose", () => {
     postgresPassword: "pw",
     rolePasswords: { admin: "a", public: "b" },
     caeloSecretKek: "0".repeat(64),
+    dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
     internalSecret: "i".repeat(48),
     diskSize: "20Gi",
     ports: { http: 80, https: 443 },

package/src/adopt-existing.test.ts

@@ -341,6 +341,45 @@ describe("adoptionCandidates — only declared creates of an adoptable kind", ()
     );
     expect(c?.label).toBe("service account");
   });
+
+  it("#1328 — names an explicitly named Cloud Run service (the data gateway) and only such", () => {
+    const SERVICE = "gcp:cloudrunv2/service:Service";
+    const [c, ...rest] = adoptionCandidates(
+      [
+        step({
+          type: SERVICE,
+          name: "caelo-production-data-gateway",
+          inputs: { name: "caelo-production-data-gateway", location: "europe-west1" },
+        }),
+        // Auto-named services (the admin, the proxy) have no name to look up.
+        step({
+          type: SERVICE,
+          name: "caelo-production-admin",
+          inputs: { location: "europe-west1" },
+        }),
+        step({
+          type: SERVICE,
+          name: "elsewhere",
+          inputs: { name: "x-svc", location: "europe-west1", project: "other-project" },
+        }),
+      ],
+      PROJECT,
+    );
+    expect(rest).toEqual([]);
+    expect(c?.label).toBe("Cloud Run service");
+    expect(c?.importId).toBe(
+      `projects/${PROJECT}/locations/europe-west1/services/caelo-production-data-gateway`,
+    );
+    expect(c?.describeArgs).toEqual([
+      "run",
+      "services",
+      "describe",
+      "caelo-production-data-gateway",
+      "--region=europe-west1",
+      `--project=${PROJECT}`,
+      "--format=value(metadata.name)",
+    ]);
+  });
 });
 
 describe("preview steps carry a create's inputs for adoption", () => {

package/src/adopt-existing.ts

@@ -25,7 +25,9 @@
  *   4. A second preview: what the review shows and `up` applies. An adopted
  *      resource that is still planned as a create stops the run.
  *
- * Why only service accounts ({@link ADOPTABLE_KINDS}). A kind is adopted
+ * Why service accounts, since #1338 the Cloud SQL private DNS zone and its
+ * record (cloudsql-tls.ts creates both on upgrade), and since #1328
+ * explicitly named Cloud Run services — {@link ADOPTABLE_KINDS}. A kind is adopted
  * when the stack declares it AND the CLI also creates it through gcloud, and
  * its name is unique in the project. Checked per kind against both stacks:
  *
@@ -34,6 +36,9 @@
  *     (stack-contract.ts CLI_GENERATED_SECRETS) the stack only references by
  *     id. Adopting a secret without its value resource would also make `up`
  *     add a version with a freshly generated value — a new KEK.
+ *   - Cloud Run services: only the ones the stack names explicitly (#1328:
+ *     the gcp-firebase data gateway, which the converge creates on older
+ *     installs); the auto-named admin and proxy are Pulumi's alone.
  *   - Buckets, Cloud Run jobs, custom roles: the stack's buckets are made by
  *     Pulumi alone; the CLI's own (ops, audit results, the upgrader, converge,
  *     audit and operator-access jobs, their custom roles) are not declared.
@@ -102,6 +107,83 @@ export const ADOPTABLE_KINDS: Readonly<Record<string, AdoptableKind>> = {
       };
     },
   },
+  // #1338 — the private zone + A record that resolve the Cloud SQL
+  // instance's DNS name in the VPC. `cms-provision upgrade` creates both
+  // through gcloud (cloudsql-tls.ts) on installs that predate them; the
+  // stacks declare them with literal names so the preview pins them down.
+  "gcp:dns/managedZone:ManagedZone": {
+    label: "private DNS zone",
+    target(inputs, projectId) {
+      const name = inputs.name;
+      if (typeof name !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(name)) return null;
+      if ((inputs.project ?? projectId) !== projectId) return null;
+      return {
+        display: name,
+        describeArgs: [
+          "dns",
+          "managed-zones",
+          "describe",
+          name,
+          `--project=${projectId}`,
+          "--format=value(name)",
+        ],
+        importId: `projects/${projectId}/managedZones/${name}`,
+      };
+    },
+  },
+  "gcp:dns/recordSet:RecordSet": {
+    label: "DNS record",
+    target(inputs, projectId) {
+      const { managedZone: zone, name, type } = inputs;
+      if (typeof zone !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(zone)) return null;
+      if (typeof name !== "string" || !/^[a-z0-9.-]{1,253}\.$/.test(name)) return null;
+      if (typeof type !== "string" || !/^[A-Z]{1,10}$/.test(type)) return null;
+      if ((inputs.project ?? projectId) !== projectId) return null;
+      return {
+        display: `${name} ${type}`,
+        describeArgs: [
+          "dns",
+          "record-sets",
+          "describe",
+          name,
+          `--zone=${zone}`,
+          `--type=${type}`,
+          `--project=${projectId}`,
+          "--format=value(name)",
+        ],
+        importId: `projects/${projectId}/managedZones/${zone}/rrsets/${name}/${type}`,
+      };
+    },
+  },
+  // #1328 — the gcp-firebase data gateway: the stack declares it under a
+  // fixed name (stack-contract.ts fixedCloudRunServiceName), and the converge
+  // creates the same service on installs whose stack predates it. Only a
+  // service the stack names explicitly is a candidate: an auto-named one has
+  // no name until Pulumi picks it.
+  "gcp:cloudrunv2/service:Service": {
+    label: "Cloud Run service",
+    target(inputs, projectId) {
+      const name = inputs.name;
+      const location = inputs.location;
+      if (typeof name !== "string" || !/^[a-z][a-z0-9-]{0,47}[a-z0-9]$/.test(name)) return null;
+      if (typeof location !== "string" || !/^[a-z]+-[a-z]+\d+$/.test(location)) return null;
+      const project = inputs.project ?? projectId;
+      if (project !== projectId) return null;
+      return {
+        display: `${name} (${location})`,
+        describeArgs: [
+          "run",
+          "services",
+          "describe",
+          name,
+          `--region=${location}`,
+          `--project=${projectId}`,
+          "--format=value(metadata.name)",
+        ],
+        importId: `projects/${projectId}/locations/${location}/services/${name}`,
+      };
+    },
+  },
 };
 
 /** A planned create the installer may adopt instead. */

package/src/agent/command.test.ts

@@ -8,7 +8,12 @@
 
 import { describe, expect, it } from "bun:test";
 import type { CommandResult, HostRunner } from "../self-hosted-release.js";
-import { applyDatabaseSide, POSTGRES_RESTART_NOTICE } from "./command.js";
+import {
+  applyArgv,
+  applyDatabaseSide,
+  POSTGRES_RESTART_NOTICE,
+  parseApplyArgs,
+} from "./command.js";
 
 function runner(published: string | null): HostRunner & { calls: string[] } {
   const calls: string[] = [];
@@ -75,3 +80,46 @@ describe("applyDatabaseSide", () => {
     expect(r.calls).toEqual([]);
   });
 });
+
+describe("agent apply argv (#1328)", () => {
+  const D = (c: string) => `sha256:${c.repeat(64)}`;
+  const request = {
+    requestId: "11111111-1111-4111-8111-111111111111",
+    targetVersion: "0.12.0",
+    trigger: "manual" as const,
+    cliPath: "/srv/.caelo/agent/cli/caelo-0.12.0/node_modules/@caelo-cms/provisioning/dist/cli.js",
+  };
+
+  it("passes the MCP-Auth-Proxy digest when the manifest names one, and the apply reads it back", () => {
+    const argv = applyArgv("/usr/bin/bun", {
+      ...request,
+      digests: { admin: D("a"), gateway: D("b"), "mcp-auth-proxy": D("d") },
+    });
+    expect(argv.slice(argv.indexOf("--mcp-auth-proxy-digest"))).toEqual([
+      "--mcp-auth-proxy-digest",
+      D("d"),
+    ]);
+    const parsed = parseApplyArgs(argv);
+    expect(parsed.success && parsed.data.mcpAuthProxyDigest).toBe(D("d"));
+  });
+
+  it("an agent of a release from before the proxy starts the apply without it", () => {
+    const argv = applyArgv("/usr/bin/bun", {
+      ...request,
+      digests: { admin: D("a"), gateway: D("b") },
+    });
+    expect(argv).not.toContain("--mcp-auth-proxy-digest");
+    const parsed = parseApplyArgs(argv);
+    expect(parsed.success).toBe(true);
+    expect(parsed.success && parsed.data.mcpAuthProxyDigest).toBeUndefined();
+  });
+
+  it("refuses a malformed proxy digest", () => {
+    const argv = [
+      ...applyArgv("/usr/bin/bun", { ...request, digests: { admin: D("a"), gateway: D("b") } }),
+      "--mcp-auth-proxy-digest",
+      "latest",
+    ];
+    expect(parseApplyArgs(argv).success).toBe(false);
+  });
+});

package/src/agent/command.ts

@@ -57,6 +57,8 @@ export interface AgentCliContext {
   emitConfig(): void;
   /** The role convergence as the superuser, including the agent's login. */
   convergeRoles(): Promise<ConvergeOutcome>;
+  /** #1338 — public_role's limits as the superuser, before an upgrade's migrations. */
+  applyPublicRoleLimits(): Promise<ConvergeOutcome>;
   /** The Compose file for `images` from config.json. */
   renderCompose(images: ReleaseImages): string;
   /** Re-write the Caddyfile (config + domains table) and reload Caddy (#891). */
@@ -417,12 +419,15 @@ function pruneVerifiedClis(caeloDir: string, keep: readonly (string | undefined)
   }
 }
 
-/** Start the target release's `agent apply` and wait for it. */
-async function spawnApply(request: AgentApplyRequest): Promise<AgentApplyOutcome> {
-  // The verified install (agent/cli-provenance.ts) — never `bun x`, which
-  // would fetch an unverified copy.
-  const argv = [
-    process.execPath,
+/**
+ * The argv that starts the target release's `agent apply` with `bun` at
+ * `execPath`: the verified install (agent/cli-provenance.ts) — never
+ * `bun x`, which would fetch an unverified copy — and the digests the signed
+ * manifest names, the MCP-Auth-Proxy's only when it names one (#1328).
+ */
+export function applyArgv(execPath: string, request: AgentApplyRequest): string[] {
+  return [
+    execPath,
     request.cliPath,
     "agent",
     "apply",
@@ -436,7 +441,15 @@ async function spawnApply(request: AgentApplyRequest): Promise<AgentApplyOutcome
     request.digests.admin,
     "--gateway-digest",
     request.digests.gateway,
+    ...(request.digests["mcp-auth-proxy"]
+      ? ["--mcp-auth-proxy-digest", request.digests["mcp-auth-proxy"]]
+      : []),
   ];
+}
+
+/** Start the target release's `agent apply` and wait for it. */
+async function spawnApply(request: AgentApplyRequest): Promise<AgentApplyOutcome> {
+  const argv = applyArgv(process.execPath, request);
   try {
     const proc = Bun.spawn(argv, {
       stdout: "pipe",
@@ -504,16 +517,25 @@ const applyArgs = z.object({
   trigger: z.enum(PLATFORM_UPDATE_TRIGGERS),
   adminDigest: digest,
   gatewayDigest: digest,
+  // #1328 — an agent of a release before the MCP-Auth-Proxy starts this
+  // without it; the signed manifest the apply reads names it anyway.
+  mcpAuthProxyDigest: digest.optional(),
 });
 
-async function agentApply(argv: readonly string[], ctx: AgentCliContext): Promise<number> {
-  const parsed = applyArgs.safeParse({
+/** The `agent apply` flags {@link applyArgv} writes, validated. */
+export function parseApplyArgs(argv: readonly string[]) {
+  return applyArgs.safeParse({
     request: flag(argv, "request"),
     version: flag(argv, "version"),
     trigger: flag(argv, "trigger"),
     adminDigest: flag(argv, "admin-digest"),
     gatewayDigest: flag(argv, "gateway-digest"),
+    mcpAuthProxyDigest: flag(argv, "mcp-auth-proxy-digest"),
   });
+}
+
+async function agentApply(argv: readonly string[], ctx: AgentCliContext): Promise<number> {
+  const parsed = parseApplyArgs(argv);
   if (!parsed.success) {
     console.error(
       `agent apply is started by the update agent, not by hand (${parsed.error.issues.map((i) => i.path.join(".")).join(", ")}).`,
@@ -539,13 +561,18 @@ async function agentApply(argv: readonly string[], ctx: AgentCliContext): Promis
         upgradeSelfHosted(
           {
             version: args.version,
-            expectedDigests: { admin: args.adminDigest, gateway: args.gatewayDigest },
+            expectedDigests: {
+              admin: args.adminDigest,
+              gateway: args.gatewayDigest,
+              ...(args.mcpAuthProxyDigest ? { "mcp-auth-proxy": args.mcpAuthProxyDigest } : {}),
+            },
           },
           {
             caeloDir: ctx.caeloDir,
             runner: bunHostRunner,
             renderCompose: (images) => ctx.renderCompose(images),
             convergeRoles: () => ctx.convergeRoles(),
+            applyPublicRoleLimits: () => ctx.applyPublicRoleLimits(),
             refreshCaddy: () => ctx.refreshCaddy(),
             log,
           },

package/src/agent/run.test.ts

@@ -198,6 +198,25 @@ describe("runAgentOnce", () => {
     expect(locks).toEqual({ taken: 1, released: 1 });
   });
 
+  it("#1328: hands over the MCP-Auth-Proxy digest the signed manifest names", async () => {
+    const withProxy: ReleaseManifest = {
+      ...MANIFEST,
+      digests: { ...MANIFEST.digests, "mcp-auth-proxy": D("d") },
+    };
+    const { deps, applied } = setup({
+      fetchManifest: async (): Promise<ReleaseManifestResult> => ({
+        ok: true,
+        manifest: withProxy,
+      }),
+    });
+    await runAgentOnce(deps);
+    expect(applied[0]?.digests).toEqual({
+      admin: D("a"),
+      gateway: D("b"),
+      "mcp-auth-proxy": D("d"),
+    });
+  });
+
   interface RefusalRow {
     readonly name: string;
     readonly over: Partial<AgentRunDeps>;

package/src/agent/run.ts

@@ -48,7 +48,12 @@ export interface AgentApplyRequest {
   readonly targetVersion: string;
   readonly trigger: PlatformUpdateTrigger;
   /** From the verified manifest: the images the target must resolve to. */
-  readonly digests: { readonly admin: string; readonly gateway: string };
+  readonly digests: {
+    readonly admin: string;
+    readonly gateway: string;
+    /** #1328 — absent in manifests of releases from before the MCP-Auth-Proxy. */
+    readonly "mcp-auth-proxy"?: string;
+  };
   /** The target's CLI, installed and provenance-verified (agent/cli-provenance.ts). */
   readonly cliPath: string;
 }
@@ -254,7 +259,11 @@ export async function runAgentOnce(deps: AgentRunDeps): Promise<AgentRunResult>
         requestId: request.id,
         targetVersion: m.version,
         trigger: request.trigger,
-        digests: { admin: m.digests.admin, gateway: m.digests.gateway },
+        digests: {
+          admin: m.digests.admin,
+          gateway: m.digests.gateway,
+          ...(m.digests["mcp-auth-proxy"] ? { "mcp-auth-proxy": m.digests["mcp-auth-proxy"] } : {}),
+        },
         cliPath: cli.cliPath,
       });
     } finally {

package/src/aws-task-roles.ts

@@ -20,12 +20,14 @@ export type AwsSecret =
   | "resend-api-key";
 
 /** A service with its own ECS task role. */
-export type AwsTaskService = "admin" | "gateway";
+export type AwsTaskService = "admin" | "gateway" | "mcp-auth-proxy";
 
 /**
  * The secrets each service's task role may read. The admin side (admin and
  * its in-process workers) reads all of them; the gateway reads only
- * public_role's password — its one database login.
+ * public_role's password — its one database login; the MCP-Auth-Proxy
+ * (#1328) reads none: remote MCP is not available on AWS, so it holds
+ * neither a database login nor the broker's keys.
  */
 export const AWS_SERVICE_SECRETS: Readonly<Record<AwsTaskService, readonly AwsSecret[]>> = {
   admin: [
@@ -37,6 +39,7 @@ export const AWS_SERVICE_SECRETS: Readonly<Record<AwsTaskService, readonly AwsSe
     "resend-api-key",
   ],
   gateway: ["public-role-password"],
+  "mcp-auth-proxy": [],
 };
 
 /**

package/src/caddy-redirects.docker.test.ts

@@ -31,6 +31,7 @@ import {
   CADDY_IMAGE,
   COMPOSE_ADMIN_UPSTREAM,
   COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   COMPOSE_REDIRECT_SNIPPETS,
   SITE_OUTPUT_ROOT,
 } from "./compose.js";
@@ -149,6 +150,7 @@ describe.skipIf(!dockerUp)(`self-hosted redirects through ${CADDY_IMAGE}`, () =>
         stagingSiteRoot: `${SITE_OUTPUT_ROOT}/output/staging/current`,
         adminUpstream: COMPOSE_ADMIN_UPSTREAM,
         gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+        mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
         domains: selfHostedSeedDomains(LIVE, STAGING),
       }),
     );

package/src/caddy-redirects.test.ts

@@ -15,6 +15,7 @@ import { caddyRedirectReloadCommand, caddyRedirectReloadScript } from "./caddy-r
 import {
   COMPOSE_ADMIN_UPSTREAM,
   COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   COMPOSE_REDIRECT_SNIPPETS,
   generateDockerCompose,
 } from "./compose.js";
@@ -26,6 +27,7 @@ const caddyfile = generateCaddyfile({
   stagingSiteRoot: "/srv/caelo/output/staging/current",
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   domains: selfHostedSeedDomains("example.com", "staging.example.com"),
 });
 
@@ -63,6 +65,7 @@ describe("Compose — Caddy picks up new redirects (#587)", () => {
     postgresPassword: "pgpw",
     rolePasswords: { admin: "a", public: "p" },
     caeloSecretKek: "0".repeat(64),
+    dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
     internalSecret: "i".repeat(48),
     diskSize: "20Gi",
     ports: { http: 80, https: 443 },

package/src/caddy-validate.test.ts

@@ -16,7 +16,12 @@ import { describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { type CaddyfileSpec, generateCaddyfile, selfHostedSeedDomains } from "./caddy.js";
-import { CADDY_IMAGE, COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM } from "./compose.js";
+import {
+  CADDY_IMAGE,
+  COMPOSE_ADMIN_UPSTREAM,
+  COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
+} from "./compose.js";
 
 const REQUIRED = process.env.CAELO_CADDY_VALIDATE === "required";
 
@@ -62,6 +67,7 @@ const base: CaddyfileSpec = {
   stagingSiteRoot: "/srv/caelo/output/staging/current",
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   domains: selfHostedSeedDomains("example.com", "staging.example.com"),
 };
 

package/src/caddy.test.ts

@@ -6,9 +6,14 @@ import {
   caddyTokenProblem,
   generateCaddyfile,
   selfHostedAdminHost,
+  selfHostedMcpHost,
   selfHostedSeedDomains,
 } from "./caddy.js";
-import { COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM } from "./compose.js";
+import {
+  COMPOSE_ADMIN_UPSTREAM,
+  COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
+} from "./compose.js";
 
 /** The inputs `cms-provision init` passes for example.com. */
 const spec: CaddyfileSpec = {
@@ -18,6 +23,7 @@ const spec: CaddyfileSpec = {
   stagingSiteRoot: "/srv/caelo/output/staging/current",
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   domains: selfHostedSeedDomains("example.com", "staging.example.com"),
 };
 
@@ -35,7 +41,39 @@ describe("self-hosted seed vhosts", () => {
       { hostname: "example.com", kind: "public", env: "production" },
       { hostname: "staging.example.com", kind: "public", env: "staging" },
     ]);
+    // #1328 — no MCP vhost until remote MCP exists on self-hosted: Caddy would
+    // otherwise chase an ACME certificate for a host without a DNS record.
+    expect(
+      selfHostedSeedDomains("example.com", "staging.example.com").some((d) => d.kind === "mcp"),
+    ).toBe(false);
     expect(selfHostedAdminHost("example.com")).toBe("admin.example.com");
+    expect(selfHostedMcpHost("example.com")).toBe("mcp.example.com");
+  });
+
+  // #1328 — the MCP-Auth-Proxy never shares an origin with the site's module JS.
+  it("serves the MCP-Auth-Proxy on its own vhost, nothing else of the site", () => {
+    const out = generateCaddyfile({
+      ...spec,
+      domains: [
+        ...selfHostedSeedDomains("example.com", "staging.example.com"),
+        { hostname: selfHostedMcpHost("example.com"), kind: "mcp", env: "production" },
+      ],
+    });
+    const block = out.slice(out.indexOf("mcp.example.com {"));
+    const mcp = block.slice(0, block.indexOf("\n}\n") + 3);
+    expect(mcp).toContain(`reverse_proxy ${COMPOSE_MCP_AUTH_PROXY_UPSTREAM}`);
+    expect(mcp).toContain('X-Robots-Tag "noindex"');
+    expect(mcp).not.toContain("file_server");
+    expect(mcp).not.toContain(COMPOSE_GATEWAY_UPSTREAM);
+    // ... and the site's vhost does not route the proxy.
+    const site = out.slice(out.indexOf("\nexample.com {"));
+    expect(site.slice(0, site.indexOf("\n}\n"))).not.toContain(COMPOSE_MCP_AUTH_PROXY_UPSTREAM);
+  });
+
+  it("refuses an MCP-Auth-Proxy upstream that would break out of its token", () => {
+    expect(() => generateCaddyfile({ ...spec, mcpAuthProxyUpstream: "x }\nevil {" })).toThrow(
+      /mcpAuthProxyUpstream/,
+    );
   });
 
   it("refuses two vhosts for one host — Caddy would reject the whole file", () => {