@caelo-cms/provisioning 0.11.9 → 0.11.10

package/src/database-tls-builders.test.ts

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1338 — every database URL a provider adapter builds asks for
+ * `sslmode=verify-full`, and no adapter still builds a weaker one
+ * (CLAUDE.md §2 no fallbacks: a downgrade is never silent).
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { databaseTlsProblem } from "@caelo-cms/shared";
+import { generateDockerCompose } from "./compose.js";
+import { databaseUrls } from "./stack-contract.js";
+
+const DNS = "abc123.p-label.europe-west1.sql-psa.goog";
+
+describe("database URL builders (#1338)", () => {
+  it("Cloud SQL: verify-full on the instance's DNS name, never on its IP", () => {
+    for (const url of Object.values(databaseUrls(DNS))) {
+      expect(databaseTlsProblem(url)).toBeNull();
+      expect(new URL(url).hostname).toBe(DNS);
+    }
+    expect(() => databaseUrls("10.20.0.3")).toThrow(/DNS name/);
+  });
+
+  it("self-hosted Compose: every service URL is verify-full against the install's CA", () => {
+    const yaml = generateDockerCompose({
+      domain: "example.com",
+      postgresPassword: "superpw",
+      rolePasswords: { admin: "adminpw", public: "publicpw" },
+      caeloSecretKek: "0".repeat(64),
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
+      internalSecret: "i".repeat(48),
+      diskSize: "20Gi",
+      images: {
+        mode: "release",
+        admin: `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`,
+        gateway: `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`,
+      },
+      ports: { http: 80, https: 443 },
+      project: "caelo-example-com",
+    });
+    const urls = [...yaml.matchAll(/_DATABASE_URL: "([^"]+)"/g)].map((m) => m[1] as string);
+    expect(urls).toHaveLength(3);
+    for (const url of urls) expect(databaseTlsProblem(url)).toBeNull();
+  });
+
+  for (const stack of ["gcp", "gcp-firebase", "aws", "azure"]) {
+    it(`stacks/${stack} builds no URL weaker than verify-full`, () => {
+      const src = readFileSync(resolve(import.meta.dir, `../stacks/${stack}/index.ts`), "utf8");
+      expect(src).not.toMatch(/sslmode=(disable|allow|prefer|require|verify-ca)\b/);
+    });
+  }
+});

package/src/deployed-release.test.ts

@@ -29,6 +29,17 @@ function fakeGcloud(answers: Record<string, GcloudResult[]>) {
   return { run, calls };
 }
 
+/**
+ * A gcp-firebase install since #1328: the admin, the data gateway and the
+ * MCP-Auth-Proxy — the service that was the gateway (E13 a).
+ */
+const FIREBASE = { provider: "gcp-firebase" as const, projectId: "p", region: "europe-west1" };
+const firebaseLists = () => ({
+  "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
+  "metadata.name~^caelo-production-data-gateway": [ok("caelo-production-data-gateway\n")],
+  "metadata.name~^caelo-production-gateway": [ok("caelo-production-gateway-def\n")],
+});
+
 describe("digestFromImageRef", () => {
   it("extracts the pinned digest", () => {
     expect(digestFromImageRef(`${REG}/admin@${A}\n`)).toBe(A);
@@ -39,16 +50,43 @@ describe("digestFromImageRef", () => {
 });
 
 describe("readDeployedImageDigests", () => {
-  it("reads both services' digests", async () => {
+  it("reads the three services' digests, each from the service playing its role", async () => {
     const { run, calls } = fakeGcloud({
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [ok(`${REG}/admin@${A}`)],
+      "describe caelo-production-data-gateway": [ok(`${REG}/gateway@${B}`)],
+      "describe caelo-production-gateway-def": [ok(`${REG}/mcp-auth-proxy@${C}`)],
+    });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
+    expect(r).toEqual({ ok: true, digests: { admin: A, gateway: B, "mcp-auth-proxy": C } });
+    expect(calls.every((c) => c.includes("--project=p"))).toBe(true);
+  });
+
+  it("finds the gcp proxy under its own name", async () => {
+    const { run } = fakeGcloud({
       "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
       "metadata.name~^caelo-production-gateway": [ok("caelo-production-gateway-def\n")],
+      "metadata.name~^caelo-production-mcp-auth-proxy": [ok("caelo-production-mcp-auth-proxy\n")],
       "describe caelo-production-admin-abc": [ok(`${REG}/admin@${A}`)],
       "describe caelo-production-gateway-def": [ok(`${REG}/gateway@${B}`)],
+      "describe caelo-production-mcp-auth-proxy": [ok(`${REG}/mcp-auth-proxy@${C}`)],
     });
-    const r = await readDeployedImageDigests({ projectId: "p", region: "europe-west1", run });
-    expect(r).toEqual({ ok: true, digests: { admin: A, gateway: B } });
-    expect(calls.every((c) => c.includes("--project=p"))).toBe(true);
+    const r = await readDeployedImageDigests({ ...FIREBASE, provider: "gcp", run });
+    expect(r).toEqual({ ok: true, digests: { admin: A, gateway: B, "mcp-auth-proxy": C } });
+  });
+
+  it("sends an install without its #1328 services to upgrade", async () => {
+    const { run } = fakeGcloud({
+      "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
+      "metadata.name~^caelo-production-data-gateway": [ok("")],
+      "describe caelo-production-admin-abc": [ok(`${REG}/admin@${A}`)],
+    });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.error).toContain("no caelo-production-data-gateway* Cloud Run service");
+      expect(r.error).toContain("Run `upgrade` first");
+    }
   });
 
   it("refuses an ambiguous service match", async () => {
@@ -57,7 +95,7 @@ describe("readDeployedImageDigests", () => {
         ok("caelo-production-admin-a\ncaelo-production-admin-b\n"),
       ],
     });
-    const r = await readDeployedImageDigests({ projectId: "p", region: "r", run });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok)
       expect(r.error).toContain("found caelo-production-admin-a, caelo-production-admin-b");
@@ -68,14 +106,14 @@ describe("readDeployedImageDigests", () => {
       "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
       "describe caelo-production-admin-abc": [ok(`${REG}/admin:latest`)],
     });
-    const r = await readDeployedImageDigests({ projectId: "p", region: "r", run });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok) expect(r.error).toContain("not pinned to a digest");
   });
 
   it("surfaces a gcloud failure", async () => {
     const { run } = fakeGcloud({ "services list": [fail("PERMISSION_DENIED")] });
-    const r = await readDeployedImageDigests({ projectId: "p", region: "r", run });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
     expect(r).toEqual({ ok: false, error: "list Cloud Run services: PERMISSION_DENIED" });
   });
 });
@@ -87,40 +125,50 @@ describe("checkDeployedRuntimeEnv", () => {
     name,
     valueFrom: { secretKeyRef: { name: `caelo-production-${id}`, key: "latest" } },
   });
-  const lists = () => ({
-    "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
-    "metadata.name~^caelo-production-gateway": [ok("caelo-production-gateway-def\n")],
-  });
+  const adminOk = svc([
+    secret("ADMIN_DATABASE_PASSWORD"),
+    secret("PUBLIC_ADMIN_DATABASE_PASSWORD"),
+  ]);
+  const gatewayOk = svc([secret("PUBLIC_DATABASE_PASSWORD", "public-role-password")]);
+  const proxyOk = svc([secret("CAELO_MCP_OAUTH_SEAL_KEY", "mcp-oauth-seal-key")]);
 
-  it("passes once both services read the password from Secret Manager", async () => {
+  it("passes once every service runs the current env", async () => {
     const { run } = fakeGcloud({
-      ...lists(),
-      "describe caelo-production-admin-abc": [
-        svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_ADMIN_DATABASE_PASSWORD")]),
-      ],
-      "describe caelo-production-gateway-def": [
-        svc([secret("PUBLIC_DATABASE_PASSWORD", "public-role-password")]),
-      ],
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [adminOk],
+      "describe caelo-production-data-gateway": [gatewayOk],
+      "describe caelo-production-gateway-def": [proxyOk],
     });
-    expect(await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run })).toEqual({
-      ok: true,
+    expect(await checkDeployedRuntimeEnv({ ...FIREBASE, run })).toEqual({ ok: true });
+  });
+
+  it("#1328 — stops a wizard re-run while the proxy is still the old gateway (database env)", async () => {
+    const { run } = fakeGcloud({
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [adminOk],
+      "describe caelo-production-data-gateway": [gatewayOk],
+      "describe caelo-production-gateway-def": [gatewayOk],
     });
+    const r = await checkDeployedRuntimeEnv({ ...FIREBASE, run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.error).toContain("PUBLIC_DATABASE_PASSWORD");
+      expect(r.error).toContain("Run `upgrade` first");
+    }
   });
 
   it("stops a wizard re-run on a gateway from before #635 (it needs its gateway_role pool)", async () => {
     const { run } = fakeGcloud({
-      ...lists(),
-      "describe caelo-production-admin-abc": [
-        svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_ADMIN_DATABASE_PASSWORD")]),
-      ],
-      "describe caelo-production-gateway-def": [
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [adminOk],
+      "describe caelo-production-data-gateway": [
         svc([
           secret("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
           secret("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
         ]),
       ],
     });
-    const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
+    const r = await checkDeployedRuntimeEnv({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok) {
       expect(r.error).toContain("GATEWAY_DATABASE_PASSWORD");
@@ -130,15 +178,13 @@ describe("checkDeployedRuntimeEnv", () => {
 
   it("stops a wizard re-run on a gateway from before #613 (it needs the admin_role pool)", async () => {
     const { run } = fakeGcloud({
-      ...lists(),
-      "describe caelo-production-admin-abc": [
-        svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_ADMIN_DATABASE_PASSWORD")]),
-      ],
-      "describe caelo-production-gateway-def": [
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [adminOk],
+      "describe caelo-production-data-gateway": [
         svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_DATABASE_PASSWORD")]),
       ],
     });
-    const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
+    const r = await checkDeployedRuntimeEnv({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok) {
       expect(r.error).toContain("ADMIN_DATABASE_PASSWORD");
@@ -148,14 +194,17 @@ describe("checkDeployedRuntimeEnv", () => {
 
   it("stops a wizard re-run on an install upgrade hasn't moved over (password in the URL)", async () => {
     const { run } = fakeGcloud({
-      ...lists(),
+      ...firebaseLists(),
       "describe caelo-production-admin-abc": [
         svc([
-          { name: "ADMIN_DATABASE_URL", value: "postgres://admin_role:pw@10.0.0.3:5432/cms_admin" },
+          {
+            name: "ADMIN_DATABASE_URL",
+            value: "postgres://admin_role:pw@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin",
+          },
         ]),
       ],
     });
-    const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
+    const r = await checkDeployedRuntimeEnv({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok) {
       expect(r.error).toContain("Run `upgrade` first");
@@ -165,29 +214,44 @@ describe("checkDeployedRuntimeEnv", () => {
 });
 
 describe("chooseImageDigests", () => {
-  const latest = { admin: C, gateway: C };
+  const latest = { admin: C, gateway: C, "mcp-auth-proxy": C };
+  const recorded = { admin: A, gateway: B, "mcp-auth-proxy": C };
   const never = () => {
     throw new Error("must not be called");
   };
 
   it("keeps the recorded release", async () => {
+    const r = await chooseImageDigests({
+      recorded,
+      deployed: true,
+      readLive: never,
+      resolveLatest: never,
+    });
+    expect(r).toEqual({ ok: true, source: "recorded", digests: recorded });
+  });
+
+  it("#1328 — sends a record from before the MCP-Auth-Proxy to upgrade instead of mixing releases", async () => {
     const r = await chooseImageDigests({
       recorded: { admin: A, gateway: B },
       deployed: true,
       readLive: never,
       resolveLatest: never,
     });
-    expect(r).toEqual({ ok: true, source: "recorded", digests: { admin: A, gateway: B } });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.error).toContain("records no mcp-auth-proxy image");
+      expect(r.error).toContain("Run `upgrade` first");
+    }
   });
 
   it("keeps what a provisioned install without a record runs (no :latest roll)", async () => {
     const r = await chooseImageDigests({
       recorded: null,
       deployed: true,
-      readLive: async () => ({ ok: true, digests: { admin: A, gateway: B } }),
+      readLive: async () => ({ ok: true, digests: recorded }),
       resolveLatest: never,
     });
-    expect(r).toEqual({ ok: true, source: "live", digests: { admin: A, gateway: B } });
+    expect(r).toEqual({ ok: true, source: "live", digests: recorded });
   });
 
   it("stops and points at upgrade when the running release can't be read", async () => {

package/src/deployed-release.ts

@@ -15,7 +15,14 @@ import { gcloud as defaultGcloud } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import { GCP_STACK_ENV, gcpNamePrefix } from "./gcp-names.js";
 import type { ImageDigests } from "./install-state.js";
-import { type CloudRunSlug, RETIRED_SERVICE_ENV, SERVICE_SECRET_ENV } from "./stack-contract.js";
+import {
+  CLOUD_RUN_SLUGS,
+  type CloudRunSlug,
+  cloudRunServicePrefix,
+  type GcpProvider,
+  RETIRED_SERVICE_ENV,
+  SERVICE_SECRET_ENV,
+} from "./stack-contract.js";
 import { liveContainerEnv } from "./stack-converge.js";
 
 /** The `sha256:…` digest an image reference pins, or null for a tag reference. */
@@ -23,13 +30,13 @@ export function digestFromImageRef(ref: string): string | null {
   return ref.trim().match(/@(sha256:[0-9a-f]{64})$/)?.[1] ?? null;
 }
 
-/** The single deployed (Pulumi-suffixed) Cloud Run service for `slug`. */
+/** The single deployed Cloud Run service playing `slug` (stack-contract.ts cloudRunServicePrefix). */
 async function findDeployedService(
   run: GcloudRunner,
-  opts: { projectId: string; region: string },
+  opts: { provider: GcpProvider; projectId: string; region: string },
   slug: CloudRunSlug,
 ): Promise<{ ok: true; name: string } | { ok: false; error: string }> {
-  const prefix = `${gcpNamePrefix(GCP_STACK_ENV)}-${slug}`;
+  const prefix = cloudRunServicePrefix(opts.provider, GCP_STACK_ENV, slug);
   const list = await run([
     "run",
     "services",
@@ -47,7 +54,10 @@ async function findDeployedService(
   if (names.length !== 1) {
     return {
       ok: false,
-      error: `expected one ${prefix}* Cloud Run service, found ${names.length === 0 ? "none" : names.join(", ")}`,
+      error:
+        names.length === 0
+          ? `no ${prefix}* Cloud Run service: the install runs a release from before it (the ${slug} became its own service in #1328). Run \`upgrade\` first: it creates the service and moves the release over.`
+          : `expected one ${prefix}* Cloud Run service, found ${names.join(", ")}`,
     };
   }
   return { ok: true, name: names[0] as string };
@@ -68,12 +78,13 @@ async function findDeployedService(
  * and the env in one revision.
  */
 export async function checkDeployedRuntimeEnv(opts: {
+  provider: GcpProvider;
   projectId: string;
   region: string;
   run?: GcloudRunner;
 }): Promise<{ ok: true } | { ok: false; error: string }> {
   const run = opts.run ?? defaultGcloud;
-  for (const slug of ["admin", "gateway"] as const) {
+  for (const slug of CLOUD_RUN_SLUGS) {
     const found = await findDeployedService(run, opts, slug);
     if (!found.ok) return found;
     const describe = await run([
@@ -109,18 +120,19 @@ export async function checkDeployedRuntimeEnv(opts: {
 }
 
 /**
- * Read the image digests the admin and gateway services run. Fails, naming
+ * Read the image digests the Cloud Run services run. Fails, naming
  * what is missing, when a service can't be found unambiguously or doesn't
  * run a digest-pinned image.
  */
 export async function readDeployedImageDigests(opts: {
+  provider: GcpProvider;
   projectId: string;
   region: string;
   run?: GcloudRunner;
 }): Promise<{ ok: true; digests: ImageDigests } | { ok: false; error: string }> {
   const run = opts.run ?? defaultGcloud;
-  const digests = { admin: "", gateway: "" };
-  for (const slug of ["admin", "gateway"] as const) {
+  const digests: Record<CloudRunSlug, string> = { admin: "", gateway: "", "mcp-auth-proxy": "" };
+  for (const slug of CLOUD_RUN_SLUGS) {
     const found = await findDeployedService(run, opts, slug);
     if (!found.ok) return found;
     const image = await run([
@@ -170,6 +182,15 @@ export async function chooseImageDigests(opts: {
   readonly readLive: () => ReturnType<typeof readDeployedImageDigests>;
   readonly resolveLatest: () => Promise<ImageDigests>;
 }): Promise<DigestChoice> {
+  if (opts.recorded && !opts.recorded["mcp-auth-proxy"]) {
+    // #1328 — the release it records predates the MCP-Auth-Proxy: this
+    // installer's stack would deploy a proxy image of another release.
+    return {
+      ok: false,
+      error:
+        "This install runs a release from before the MCP-Auth-Proxy (its install.json records no mcp-auth-proxy image). Run `upgrade` first — it sets the proxy up and records the release — then re-run the installer.",
+    };
+  }
   if (opts.recorded) return { ok: true, source: "recorded", digests: opts.recorded };
   if (!opts.deployed) return { ok: true, source: "latest", digests: await opts.resolveLatest() };
   const live = await opts.readLive();

package/src/gateway-env-isolation.test.ts

@@ -65,7 +65,7 @@ describe("gcp + gcp-firebase: the gateway env contract (#635)", () => {
     domain: "example.com",
     region: "europe-west1",
     stagingHost: "staging.example.com",
-    databaseUrls: databaseUrls("10.20.0.3"),
+    databaseUrls: databaseUrls("db1.p-label.europe-west1.sql-psa.goog"),
   });
 
   it("carries no cms_admin URL, role or credential name", () => {
@@ -75,7 +75,8 @@ describe("gcp + gcp-firebase: the gateway env contract (#635)", () => {
     }
     expect(env.find((v) => v.name === "PUBLIC_DATABASE_URL")).toEqual({
       name: "PUBLIC_DATABASE_URL",
-      value: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
+      value:
+        "postgresql://public_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
     });
   });
 
@@ -135,6 +136,7 @@ describe("self-hosted: the generated compose gateway service (#635)", () => {
       postgresPassword: "superpw",
       rolePasswords: { admin: "adminpw", public: "publicpw" },
       caeloSecretKek: "0".repeat(64),
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
       diskSize: "20Gi",
       images: {
@@ -151,9 +153,12 @@ describe("self-hosted: the generated compose gateway service (#635)", () => {
     expect(gateway).toContain("PUBLIC_DATABASE_URL:");
     expect(gateway).not.toMatch(ADMIN_ACCESS);
     expect(gateway).not.toMatch(/superpw|adminpw|gatewaypw/);
-    // No other way in: no Compose secrets, no env file, no mounts (a
-    // mounted file is read by no env check), and exactly its own env.
-    expect(gateway).not.toMatch(/^ {4}(secrets|env_file|volumes):/m);
+    // No other way in: no Compose secrets, no env file, and exactly one
+    // mount — the database CA certificate (#1338), public, no credential.
+    expect(gateway).not.toMatch(/^ {4}(secrets|env_file):/m);
+    expect(gateway).toContain(
+      "    volumes:\n      - ./postgres-tls/ca.crt:/etc/caelo/db-ca/self-hosted-ca.pem:ro\n    restart:",
+    );
     const env = gateway.slice(gateway.indexOf("    environment:"));
     const keys = [...env.matchAll(/^ {6}([A-Z_][A-Z0-9_]*):/gm)].map((m) => m[1]);
     expect(keys.sort()).toEqual([

package/src/gcp-names.ts

@@ -56,6 +56,37 @@ export function gatewayServiceAccountEmail(projectId: string, env: string): stri
   return `${gatewayServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
 }
 
+/**
+ * #1328 — account id of the service account the MCP-Auth-Proxy runs as. It
+ * may read the Google sign-in client and the broker's seal key and nothing
+ * else: no database password, no project role (stack-contract.ts
+ * `SERVICE_SECRET_ENV` / `SERVICE_SECRET_FILES`). Shortened from the
+ * service's name: account ids max out at 30 characters.
+ */
+export function mcpAuthProxyServiceAccountId(env: string): string {
+  return `${gcpNamePrefix(env)}-mcp-proxy-sa`;
+}
+
+/**
+ * #1328 — the `gcp` MCP-Auth-Proxy's load-balancer resources, CLI-owned
+ * (remote-mcp.ts ensureRemoteMcpEdge): its serverless NEG, its backend
+ * service and its own Cloud Armor policy. None matches a prefix the other
+ * lookups use (`…-waf`, `…-admin-backend`, `…-gateway-backend`).
+ */
+export function mcpAuthProxyEdgeNames(env: string): {
+  readonly neg: string;
+  readonly backend: string;
+  readonly policy: string;
+} {
+  const prefix = `${gcpNamePrefix(env)}-mcp-auth-proxy`;
+  return { neg: `${prefix}-neg`, backend: `${prefix}-backend`, policy: `${prefix}-armor` };
+}
+
+/** Email of the service account the MCP-Auth-Proxy runs as. */
+export function mcpAuthProxyServiceAccountEmail(projectId: string, env: string): string {
+  return `${mcpAuthProxyServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
+}
+
 /**
  * Account id of the `gcp` stack's static-publisher service account. Account
  * ids max out at 30 chars, so the env is shortened.

package/src/gcp-url-map.test.ts

@@ -9,7 +9,7 @@
 import { beforeAll, describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { GCP_PUBLIC_BASE_PATHS, isGcpRedirectRule, withGcpRedirects } from "@caelo-cms/shared";
+import { GCP_GATEWAY_PATHS, isGcpRedirectRule, withGcpRedirects } from "@caelo-cms/shared";
 import * as pulumi from "@pulumi/pulumi";
 import { URL_MAP_REDIRECTS_PERMISSIONS, urlMapRedirectsRoleId } from "./gcp-names.js";
 
@@ -66,7 +66,8 @@ describe("gcp stack URL map (Pulumi mocks)", () => {
       {
         name: PUBLIC_PATH_MATCHER,
         defaultService: "bucket-id",
-        pathRules: [{ paths: [...GCP_PUBLIC_BASE_PATHS], service: "gateway-id" }],
+        // #1328 — only /api/* here: the MCP-Auth-Proxy's rule is the CLI's.
+        pathRules: [{ paths: [...GCP_GATEWAY_PATHS], service: "gateway-id" }],
       },
       { name: "admin", defaultService: "admin-id" },
     ]);
@@ -102,12 +103,9 @@ describe("gcp stack URL map (Pulumi mocks)", () => {
     );
     expect(withRedirects.pathRules?.filter((r) => !isGcpRedirectRule(r))).toEqual([
       {
-        paths: [
-          "/api/*",
-          // #806 — the remote-MCP broker's discovery documents.
-          "/.well-known/oauth-protected-resource/*",
-          "/.well-known/oauth-authorization-server/*",
-        ],
+        // #1328 — the remote-MCP discovery paths go to the MCP-Auth-Proxy's
+        // own rule, which the CLI adds (remote-mcp.ts planUrlMapPaths).
+        paths: ["/api/*"],
         service: "gateway-id",
       },
     ]);

package/src/gcp-url-map.ts

@@ -19,7 +19,7 @@
  * Imported by the stack from `dist/`; keep it free of CLI dependencies.
  */
 
-import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
+import { GCP_GATEWAY_PATHS } from "@caelo-cms/shared";
 import * as gcp from "@pulumi/gcp";
 import type * as pulumi from "@pulumi/pulumi";
 
@@ -58,7 +58,11 @@ export function siteUrlMapArgs(i: SiteUrlMapInputs): gcp.compute.URLMapArgs {
       {
         name: PUBLIC_PATH_MATCHER,
         defaultService: i.staticBackend,
-        pathRules: [{ paths: [...GCP_PUBLIC_BASE_PATHS], service: i.gatewayBackend }],
+        // #1328 — the MCP-Auth-Proxy's rule (GCP_MCP_AUTH_PROXY_PATHS) is the
+        // CLI's: it creates the proxy's backend after the first `up`
+        // (remote-mcp.ts ensureRemoteMcpEdge), and the stack ignores
+        // `pathRules` after creation anyway.
+        pathRules: [{ paths: [...GCP_GATEWAY_PATHS], service: i.gatewayBackend }],
       },
       {
         name: "admin",

package/src/index.test.ts

@@ -22,6 +22,7 @@ describe("Caddyfile generator", () => {
       tls: "acme",
       adminUpstream: "caelo-admin:5173",
       gatewayUpstream: "caelo-gateway:8090",
+      mcpAuthProxyUpstream: "caelo-mcp-auth-proxy:8095",
       domains: [
         { hostname: "example.com", kind: "public", env: "production" },
         { hostname: "staging.example.com", kind: "public", env: "staging" },
@@ -49,6 +50,7 @@ describe("Caddyfile generator", () => {
       tls: "acme",
       adminUpstream: "caelo-admin:5173",
       gatewayUpstream: "caelo-gateway:8090",
+      mcpAuthProxyUpstream: "caelo-mcp-auth-proxy:8095",
       domains: [],
     });
     expect(out).toContain(":8081 {");
@@ -64,6 +66,7 @@ describe("Caddy cache policy for content-hashed assets", () => {
     tls: "acme",
     adminUpstream: "caelo-admin:5173",
     gatewayUpstream: "caelo-gateway:8090",
+    mcpAuthProxyUpstream: "caelo-mcp-auth-proxy:8095",
     domains: [
       { hostname: "example.com", kind: "public", env: "production" },
       { hostname: "admin.example.com", kind: "admin", env: "production" },
@@ -151,6 +154,7 @@ describe("docker-compose generator", () => {
       postgresPassword: "supersecret",
       rolePasswords: { admin: "adminpw", public: "publicpw" },
       caeloSecretKek: "0".repeat(64),
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
       anthropicApiKey: "sk-ant-…",
       diskSize: "20Gi",
@@ -173,6 +177,7 @@ describe("docker-compose generator", () => {
       postgresPassword: "supersecret",
       rolePasswords: { admin: "adminpw", public: "publicpw" },
       caeloSecretKek: "0".repeat(64),
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
       diskSize: "20Gi",
       images: RELEASE_IMAGES,
@@ -181,7 +186,7 @@ describe("docker-compose generator", () => {
     });
     const gateway = out.slice(out.indexOf("caelo-gateway:"), out.indexOf("\nvolumes:"));
     expect(gateway).toContain(
-      'PUBLIC_DATABASE_URL: "postgres://public_role:publicpw@postgres:5432/cms_public"',
+      'PUBLIC_DATABASE_URL: "postgres://public_role:publicpw@postgres:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/self-hosted-ca.pem"',
     );
     expect(gateway).not.toMatch(
       /ADMIN_DATABASE|GATEWAY_DATABASE|cms_admin|admin_role|gateway_role|adminpw|gatewaypw|supersecret|CAELO_SECRET_KEK/,
@@ -198,6 +203,7 @@ describe("docker-compose generator", () => {
       postgresPassword: 'pa"ss',
       rolePasswords: { admin: "a", public: "b" },
       caeloSecretKek: "0".repeat(64),
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
       diskSize: "1Gi",
       images: RELEASE_IMAGES,

package/src/index.ts

@@ -96,6 +96,7 @@ export {
   type RequestDecision,
 } from "./upgrader-assess.js";
 export {
+  convergeDatabaseHost,
   gcpUpgraderDeps,
   type UpgraderPlacement,
   upgraderDatabaseHost,

package/src/infra-contract.test.ts

@@ -20,8 +20,8 @@ describe("infrastructure contract steps", () => {
     );
   });
 
-  it("is at 14: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7), quality-audit job (8), converge job (9), remote MCP (10), Google sign-in (11), project-level sign-in client (12), edge security headers (13), capture job (14)", () => {
-    expect(INFRA_CONTRACT_VERSION).toBe(14);
+  it("is at 16: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7), quality-audit job (8), converge job (9), remote MCP (10), Google sign-in (11), project-level sign-in client (12), edge security headers (13), capture job (14), database verify-full TLS (15), MCP-Auth-Proxy (16)", () => {
+    expect(INFRA_CONTRACT_VERSION).toBe(16);
     expect(INFRA_CONTRACT_STEPS[3]).toContain("#633");
     expect(INFRA_CONTRACT_STEPS[4]).toContain("#587");
     expect(INFRA_CONTRACT_STEPS[5]).toContain("#635");
@@ -34,6 +34,8 @@ describe("infrastructure contract steps", () => {
     expect(INFRA_CONTRACT_STEPS[12]).toContain("project's IAP settings");
     expect(INFRA_CONTRACT_STEPS[13]).toContain("#891");
     expect(INFRA_CONTRACT_STEPS[14]).toContain("#1217");
+    expect(INFRA_CONTRACT_STEPS[15]).toContain("#1338");
+    expect(INFRA_CONTRACT_STEPS[16]).toContain("#1328");
   });
 
   it("lists the pending steps oldest first", () => {
@@ -44,6 +46,6 @@ describe("infrastructure contract steps", () => {
   });
 
   it("names a version a newer release added by number", () => {
-    expect(infraStepsText(14, 15)).toBe("infrastructure step 15 (see that release's notes)");
+    expect(infraStepsText(16, 17)).toBe("infrastructure step 17 (see that release's notes)");
   });
 });