@caelo-cms/provisioning 0.11.9 → 0.11.10

package/src/caddy.ts

@@ -11,6 +11,8 @@
  * Per-vhost shape:
  *   <hostname> {
  *     # admin   → reverse_proxy <adminUpstream>
+ *     # mcp     → reverse_proxy <mcpAuthProxyUpstream> (#1328: the
+ *     #           MCP-Auth-Proxy on its own host, never the site's origin)
  *     # public  → /api/* → <gatewayUpstream>; everything else is the
  *     #           static site (try_files + file_server, 404 → /404.html)
  *   }
@@ -68,7 +70,12 @@ import {
 
 export interface CaddyDomainSpec {
   readonly hostname: string;
-  readonly kind: "admin" | "public";
+  /**
+   * `mcp` (#1328) is the MCP-Auth-Proxy's own host: remote MCP's sign-in
+   * pages and its forwarder must never share an origin with the site, whose
+   * module JS could otherwise read them same-origin or toss their cookies.
+   */
+  readonly kind: "admin" | "public" | "mcp";
   readonly env: "production" | "staging";
 }
 
@@ -89,6 +96,8 @@ export interface CaddyfileSpec {
   readonly adminUpstream: string;
   /** `host:port` of the API gateway as Caddy reaches it (Compose: `caelo-gateway:8090`). */
   readonly gatewayUpstream: string;
+  /** `host:port` of the MCP-Auth-Proxy as Caddy reaches it (Compose: `caelo-mcp-auth-proxy:8095`). */
+  readonly mcpAuthProxyUpstream: string;
   readonly domains: ReadonlyArray<CaddyDomainSpec>;
 }
 
@@ -97,12 +106,25 @@ export function selfHostedAdminHost(domain: string): string {
   return `admin.${domain}`;
 }
 
+/** #1328 — the host the MCP-Auth-Proxy of a self-hosted install answers on. */
+export function selfHostedMcpHost(domain: string): string {
+  return `mcp.${domain}`;
+}
+
 /**
  * The vhosts every self-hosted install serves before an Owner adds domains
  * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
- * the staging site on its own host. The admin needs its own host — it
- * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
- * public site, and Caddy refuses two site blocks for the same address.
+ * the staging site on its own host. The admin needs its own host — it routes
+ * from `/` (`/setup`, `/login`, …), so it cannot share one with the public
+ * site, and Caddy refuses two site blocks for the same address.
+ *
+ * #1328 — the MCP-Auth-Proxy's vhost (`mcp.<domain>`, kind `mcp`) is not
+ * seeded: remote MCP needs an identity proxy in front of the admin (§11.B),
+ * which a self-hosted install does not have yet, so the proxy runs
+ * unexposed on the Compose network (E14 a: provisioned, fixed 404) — the
+ * same honest refusal as on aws and azure. Seeding it would make Caddy
+ * fetch and retry an ACME certificate for a host nobody has a DNS record
+ * for. The vhost comes with remote MCP on self-hosted.
  */
 export function selfHostedSeedDomains(domain: string, stagingDomain: string): CaddyDomainSpec[] {
   return [
@@ -154,6 +176,7 @@ export function generateCaddyfile(spec: CaddyfileSpec): string {
   assertSafeCaddyToken("stagingSiteRoot", spec.stagingSiteRoot, "token");
   assertSafeCaddyToken("adminUpstream", spec.adminUpstream, "token");
   assertSafeCaddyToken("gatewayUpstream", spec.gatewayUpstream, "token");
+  assertSafeCaddyToken("mcpAuthProxyUpstream", spec.mcpAuthProxyUpstream, "token");
 
   const hostnames = new Set<string>();
   for (const d of spec.domains) {
@@ -200,6 +223,15 @@ function vhost(d: CaddyDomainSpec, spec: CaddyfileSpec): string {
     return `${d.hostname} {${noindex}
   reverse_proxy ${spec.adminUpstream}
 }
+`;
+  }
+  if (d.kind === "mcp") {
+    // Everything on this host goes to the proxy: it answers its own 404s.
+    return `${d.hostname} {
+  header X-Robots-Tag "noindex"
+  header X-Content-Type-Options "${NOSNIFF}"
+  reverse_proxy ${spec.mcpAuthProxyUpstream}
+}
 `;
   }
   // public — API routes go to the gateway, the rest is the static site.

package/src/checkpoint-secrets.test.ts

@@ -32,14 +32,20 @@ import {
 import { databaseUrls } from "./stack-contract.js";
 
 const FAKE_PW = "fakePw0rdForTests123";
-const legacyAdminUrl = `postgresql://admin_role:${FAKE_PW}@10.1.2.3:5432/cms_admin?sslmode=require`;
-const legacyPublicUrl = `postgresql://public_role:${FAKE_PW}@10.1.2.3:5432/cms_public?sslmode=require`;
+const legacyAdminUrl = `postgresql://admin_role:${FAKE_PW}@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem`;
+const legacyPublicUrl = `postgresql://public_role:${FAKE_PW}@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem`;
 const setupLink = "https://admin.acme.test/setup?token=fakeSetupToken0123456789";
 
 /** What `pulumi up` returns on the current stacks, secret flags included. */
 const stackOutputs = {
-  adminDatabaseUrlOut: { value: databaseUrls("10.1.2.3").admin, secret: false },
-  publicDatabaseUrlOut: { value: databaseUrls("10.1.2.3").public, secret: false },
+  adminDatabaseUrlOut: {
+    value: databaseUrls("db1.p-label.europe-west1.sql-psa.goog").admin,
+    secret: false,
+  },
+  publicDatabaseUrlOut: {
+    value: databaseUrls("db1.p-label.europe-west1.sql-psa.goog").public,
+    secret: false,
+  },
   bootstrapUrlOut: { value: setupLink, secret: false },
   bootstrapTokenExpiresAtOut: { value: "2026-10-13T00:00:00.000Z", secret: false },
   providerOut: { value: "gcp", secret: false },
@@ -97,7 +103,7 @@ describe("findSecrets", () => {
   });
 
   it("does not flag the password-less database URLs the stacks export today", () => {
-    expect(findSecrets(databaseUrls("10.1.2.3"))).toEqual([]);
+    expect(findSecrets(databaseUrls("db1.p-label.europe-west1.sql-psa.goog"))).toEqual([]);
   });
 
   it("flags secret-named keys holding a value, not markers or look-alikes", () => {
@@ -314,7 +320,9 @@ describe("redactCredentials", () => {
   it("masks URL passwords and leaves the rest readable", () => {
     const out = redactCredentials(`connect failed: ${legacyAdminUrl} (timeout)`);
     expect(out).not.toContain(FAKE_PW);
-    expect(out).toContain("postgresql://admin_role:***@10.1.2.3:5432/cms_admin");
+    expect(out).toContain(
+      "postgresql://admin_role:***@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin",
+    );
     expect(redactCredentials("https://admin.acme.test/x")).toBe("https://admin.acme.test/x");
   });
 });

package/src/cli.ts

@@ -63,6 +63,7 @@ import {
   BOOTSTRAP_DIR,
   COMPOSE_ADMIN_UPSTREAM,
   COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   type ComposeImages,
   composeProjectName,
   generateDockerCompose,
@@ -75,6 +76,7 @@ import {
 } from "./compose.js";
 import { tightenPrivateTree, writePrivateFile } from "./private-file.js";
 import { selfCommand } from "./self-command.js";
+import { ensureSelfHostedDbTls, selfHostedDbTlsServerCertSha256 } from "./self-hosted-db-tls.js";
 import { ensureInternalSecret, writeInternalSecret } from "./self-hosted-internal-secret.js";
 import {
   bunHostRunner,
@@ -84,6 +86,7 @@ import {
   resolveVerifiedRelease,
 } from "./self-hosted-release.js";
 import {
+  applyPublicRoleLimits,
   convergeSelfHostedRoles,
   decideUp,
   selfHostedBootstrapScript,
@@ -305,6 +308,7 @@ function writeCaddyfile(cfg: CaeloConfig, extraDomains: CaddyDomainSpec[]): void
     // localhost (#707).
     adminUpstream: COMPOSE_ADMIN_UPSTREAM,
     gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+    mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
     domains: dedupeDomains([
       ...selfHostedSeedDomains(cfg.domain, cfg.stagingDomain),
       ...extraDomains,
@@ -344,6 +348,9 @@ function renderCompose(cfg: CaeloConfig, images: ComposeImages): string {
       "config has no ports / composeProject — they are back-filled on load; this is a bug",
     );
   }
+  // #1338 — the install's database CA + server certificate the Compose file
+  // mounts (created once, the server certificate renewed when due).
+  for (const line of ensureSelfHostedDbTls(CAELO_DIR)) console.log(`  database TLS: ${line}`);
   return generateDockerCompose({
     domain: cfg.domain,
     postgresPassword: cfg.postgresPassword,
@@ -351,6 +358,7 @@ function renderCompose(cfg: CaeloConfig, images: ComposeImages): string {
     caeloSecretKek: cfg.caeloSecretKek,
     // #770 — every render (up, upgrade, agent apply) hands the admin the
     // secret host-side commands sign their /api/internal/* tokens with.
+    dbTlsServerCertSha256: selfHostedDbTlsServerCertSha256(CAELO_DIR),
     internalSecret: ensureInternalSecret(CAELO_DIR, {
       randomSecret: () => randomSecret(48),
       report: (line) => console.log(line),
@@ -397,6 +405,8 @@ function agentContext(cfg: CaeloConfig): AgentCliContext {
         ...(activeAgent(cfg) ? { agentPassword: activeAgent(cfg)?.dbPassword } : {}),
       });
     },
+    applyPublicRoleLimits: () =>
+      applyPublicRoleLimits({ probe: postgresIsUp, psql: superuserPsql }),
     renderCompose: (images) => renderCompose(cfg, images),
     refreshCaddy: () => refreshCaddyfile(cfg),
     randomSecret: () => randomSecret(32),
@@ -1019,7 +1029,7 @@ async function upgradeSelfHostedCommand(opts: {
     console.error(
       "This is a DEV MODE install: the admin + gateway run your Caelo checkout, so there are\n" +
         "no images to upgrade. Update the checkout (git pull), then `bun packages/provisioning/src/cli.ts migrate` and\n" +
-        `\`docker compose -f ${COMPOSE_PATH} restart caelo-admin caelo-gateway\`.`,
+        `\`docker compose -f ${COMPOSE_PATH} restart caelo-admin caelo-gateway caelo-mcp-auth-proxy\`.`,
     );
     process.exit(2);
   }
@@ -1047,6 +1057,7 @@ async function upgradeSelfHostedCommand(opts: {
       runner: bunHostRunner,
       renderCompose: (images) => renderCompose(cfg, images),
       convergeRoles: agentContext(cfg).convergeRoles,
+      applyPublicRoleLimits: agentContext(cfg).applyPublicRoleLimits,
       refreshCaddy: () => refreshCaddyfile(cfg),
       log: {
         step: (m) => console.log(`\n==> ${m}`),

package/src/cloudsql-tls.test.ts

@@ -0,0 +1,225 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import {
+  dialsIpAddress,
+  ensureCloudSqlVerifyFull,
+  moveServicesToDnsHost,
+  urlOnDnsHost,
+} from "./cloudsql-tls.js";
+import type { GcloudResult } from "./gcloud.js";
+import type { HttpFetch } from "./runtime-secrets.js";
+
+const DNS = "abc123.p-label.europe-west1.sql-psa.goog";
+const TARGET = { projectId: "p", env: "production", sqlInstance: "caelo-production-pg-1" };
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const notFound = (): GcloudResult => ({
+  ok: false,
+  stdout: "",
+  stderr: "ERROR: (gcloud) NOT_FOUND",
+  exitCode: 1,
+});
+
+/** An instance as `gcloud sql instances describe --format=json` prints it. */
+function instance(opts: { caMode: string; sslMode: string; dns: boolean }): string {
+  return JSON.stringify({
+    settings: {
+      ipConfiguration: {
+        serverCaMode: opts.caMode,
+        sslMode: opts.sslMode,
+        privateNetwork: "projects/p/global/networks/caelo-production-vpc-1",
+      },
+    },
+    ipAddresses: [{ type: "PRIVATE", ipAddress: "10.20.0.3" }],
+    dnsNames: opts.dns
+      ? [{ name: `${DNS}.`, connectionType: "PRIVATE_SERVICES_ACCESS", dnsScope: "INSTANCE" }]
+      : [],
+  });
+}
+
+/** A fake gcloud: `answer` per call, every call recorded. */
+function fake(answer: (args: string[]) => GcloudResult) {
+  const calls: string[] = [];
+  return {
+    calls,
+    run: async (args: string[]) => {
+      calls.push(args.join(" "));
+      return answer(args);
+    },
+  };
+}
+
+/** The Cloud SQL Admin API listServerCertificates answer. */
+function certs(body: object): HttpFetch {
+  return async () => ({ ok: true, status: 200, text: async () => JSON.stringify(body) });
+}
+
+describe("ensureCloudSqlVerifyFull", () => {
+  it("moves a per-instance-CA instance to the shared CA, rotates, and makes its name resolve", async () => {
+    let described = 0;
+    const g = fake((a) => {
+      const line = a.join(" ");
+      if (line.startsWith("sql instances describe")) {
+        described += 1;
+        return ok(
+          instance(
+            described === 1
+              ? {
+                  caMode: "GOOGLE_MANAGED_INTERNAL_CA",
+                  sslMode: "ALLOW_UNENCRYPTED_AND_ENCRYPTED",
+                  dns: false,
+                }
+              : { caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: true },
+          ),
+        );
+      }
+      if (line.startsWith("auth print-access-token")) return ok("token");
+      if (line.includes(" describe ")) return notFound();
+      return ok();
+    });
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({ serverCerts: [] }),
+      sleep: async () => {},
+    });
+    expect(r).toMatchObject({ ok: true, host: DNS });
+    const writes = g.calls.filter((c) => !c.includes(" describe ") && !c.startsWith("auth"));
+    expect(writes).toEqual([
+      "sql instances patch caelo-production-pg-1 --project=p --server-ca-mode=GOOGLE_MANAGED_CAS_CA --ssl-mode=ENCRYPTED_ONLY --quiet",
+      "sql ssl server-certs create --instance=caelo-production-pg-1 --project=p",
+      "sql ssl server-certs rotate --instance=caelo-production-pg-1 --project=p --quiet",
+      `dns managed-zones create caelo-production-pg-dns --project=p --dns-name=${DNS}. --visibility=private --networks=caelo-production-vpc-1 --description=Caelo production: the Cloud SQL instance's DNS name inside the VPC (#1338)`,
+      `dns record-sets create ${DNS}. --zone=caelo-production-pg-dns --type=A --project=p --ttl=300 --rrdatas=10.20.0.3`,
+    ]);
+  });
+
+  it("changes nothing on an instance already in shape", async () => {
+    const g = fake((a) => {
+      const line = a.join(" ");
+      if (line.startsWith("sql instances describe")) {
+        return ok(
+          instance({ caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: true }),
+        );
+      }
+      if (line.startsWith("auth")) return ok("token");
+      if (line.startsWith("dns managed-zones describe"))
+        return ok(JSON.stringify({ dnsName: `${DNS}.` }));
+      if (line.startsWith("dns record-sets describe"))
+        return ok(JSON.stringify({ rrdatas: ["10.20.0.3"] }));
+      return ok();
+    });
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({ activeVersion: "f1", serverCerts: [{ sha1Fingerprint: "f1" }] }),
+    });
+    expect(r).toEqual({ ok: true, host: DNS, done: [] });
+    expect(g.calls.every((c) => c.includes(" describe ") || c.startsWith("auth"))).toBe(true);
+  });
+
+  it("finishes an interrupted rotation without creating a second certificate", async () => {
+    const g = fake((a) => {
+      const line = a.join(" ");
+      if (line.startsWith("sql instances describe")) {
+        return ok(
+          instance({ caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: true }),
+        );
+      }
+      if (line.startsWith("auth")) return ok("token");
+      if (line.startsWith("dns managed-zones describe"))
+        return ok(JSON.stringify({ dnsName: `${DNS}.` }));
+      if (line.startsWith("dns record-sets describe"))
+        return ok(JSON.stringify({ rrdatas: ["10.9.9.9"] }));
+      return ok();
+    });
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({
+        activeVersion: "old-per-instance",
+        serverCerts: [{ sha1Fingerprint: "upcoming" }],
+      }),
+    });
+    expect(r.ok).toBe(true);
+    expect(g.calls.some((c) => c.startsWith("sql ssl server-certs create"))).toBe(false);
+    expect(g.calls.some((c) => c.startsWith("sql ssl server-certs rotate"))).toBe(true);
+    expect(
+      g.calls.some(
+        (c) => c.startsWith("dns record-sets update") && c.endsWith("--rrdatas=10.20.0.3"),
+      ),
+    ).toBe(true);
+  });
+
+  it("refuses a zone that serves another name instead of repointing it", async () => {
+    const g = fake((a) => {
+      const line = a.join(" ");
+      if (line.startsWith("sql instances describe")) {
+        return ok(
+          instance({ caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: true }),
+        );
+      }
+      if (line.startsWith("auth")) return ok("token");
+      if (line.startsWith("dns managed-zones describe")) {
+        return ok(JSON.stringify({ dnsName: "old.p-label.europe-west1.sql-psa.goog." }));
+      }
+      return ok();
+    });
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({ activeVersion: "f1", serverCerts: [{ sha1Fingerprint: "f1" }] }),
+    });
+    expect(r).toMatchObject({ ok: false });
+    if (!r.ok) expect(r.error).toContain("serves old.p-label");
+  });
+
+  it("fails loudly when the instance names no private DNS name", async () => {
+    const g = fake((a) =>
+      a.join(" ").startsWith("sql instances describe")
+        ? ok(instance({ caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: false }))
+        : ok("token"),
+    );
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({ activeVersion: "f1", serverCerts: [{ sha1Fingerprint: "f1" }] }),
+    });
+    expect(r).toMatchObject({ ok: false });
+    if (!r.ok) expect(r.error).toContain("PRIVATE_SERVICES_ACCESS DNS name");
+  });
+});
+
+describe("moveServicesToDnsHost", () => {
+  it("switches only the URLs that dial an IP, keeping their sslmode", async () => {
+    const g = fake(() => ok());
+    const r = await moveServicesToDnsHost(
+      { projectId: "p", region: "europe-west1" },
+      [
+        {
+          serviceName: "caelo-production-admin-1",
+          liveUrls: {
+            ADMIN_DATABASE_URL: "postgresql://admin_role@10.20.0.3:5432/cms_admin?sslmode=require",
+            PUBLIC_ADMIN_DATABASE_URL:
+              "postgresql://admin_role@10.20.0.3:5432/cms_public?sslmode=require",
+          },
+        },
+        {
+          serviceName: "caelo-production-gateway-1",
+          liveUrls: { PUBLIC_DATABASE_URL: `postgresql://public_role@${DNS}:5432/cms_public` },
+        },
+      ],
+      DNS,
+      { run: g.run, sleep: async () => {} },
+    );
+    expect(r.ok).toBe(true);
+    expect(g.calls).toEqual([
+      `run services update caelo-production-admin-1 --region europe-west1 --project=p --update-env-vars=^|^ADMIN_DATABASE_URL=postgresql://admin_role@${DNS}:5432/cms_admin?sslmode=require|PUBLIC_ADMIN_DATABASE_URL=postgresql://admin_role@${DNS}:5432/cms_public?sslmode=require --quiet`,
+    ]);
+  });
+});
+
+describe("urlOnDnsHost / dialsIpAddress", () => {
+  it("tells IP-dialling URLs apart and moves only those", () => {
+    expect(dialsIpAddress("postgresql://a@10.0.0.3:5432/d")).toBe(true);
+    expect(dialsIpAddress(`postgresql://a@${DNS}:5432/d`)).toBe(false);
+    expect(dialsIpAddress("not a url")).toBe(false);
+    expect(urlOnDnsHost(`postgresql://a@${DNS}:5432/d`, "x")).toBeNull();
+  });
+});