@caelo-cms/provisioning 0.11.9 → 0.11.10

package/src/self-hosted-start.test.ts

@@ -7,14 +7,18 @@ import { startSelfHosted } from "./self-hosted-start.js";
 const DIR = "/srv/install/.caelo";
 
 /** A runner that records every command (minus the `docker compose -f <file>` prefix). */
-function fakeRunner(fail?: (cmd: string) => boolean): HostRunner & { calls: string[] } {
+function fakeRunner(
+  fail?: (cmd: string) => boolean,
+  services = "postgres\ncaddy\ncaelo-admin\ncaelo-gateway\n",
+): HostRunner & { calls: string[] } {
   const calls: string[] = [];
   return {
     calls,
     async run(argv): Promise<CommandResult> {
       const cmd = argv.join(" ").replace(`docker compose -f ${DIR}/docker-compose.yml `, "");
       calls.push(cmd);
-      return { exitCode: fail?.(cmd) ? 1 : 0, stdout: "", stderr: fail?.(cmd) ? "boom" : "" };
+      const stdout = cmd === "config --services" ? services : "";
+      return { exitCode: fail?.(cmd) ? 1 : 0, stdout, stderr: fail?.(cmd) ? "boom" : "" };
     },
   };
 }
@@ -33,12 +37,40 @@ describe("startSelfHosted (#707 — one command ends with a serving install)", (
       `${MIGRATE} admin`,
       `${MIGRATE} public`,
       "up -d --remove-orphans",
+      "config --services",
       "exec -T caelo-admin bun -e <probe>",
       "exec -T caelo-gateway bun -e <probe>",
       "exec -T caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile",
     ]);
   });
 
+  it("#1328 — health-checks the MCP-Auth-Proxy too when the release runs one", async () => {
+    const runner = fakeRunner(undefined, "caelo-admin\ncaelo-gateway\ncaelo-mcp-auth-proxy\n");
+    const r = await startSelfHosted({ caeloDir: DIR, runner, log: () => {} });
+    expect(r).toEqual({ ok: true });
+    const probe = runner.calls.find((c) => c.startsWith("exec -T caelo-mcp-auth-proxy bun -e "));
+    expect(probe).toContain("/api/mcp/health");
+  });
+
+  it("#1328 — reports an unhealthy MCP-Auth-Proxy with where to look", async () => {
+    const runner = fakeRunner(
+      (c) => c.startsWith("exec -T caelo-mcp-auth-proxy"),
+      "caelo-admin\ncaelo-gateway\ncaelo-mcp-auth-proxy\n",
+    );
+    const r = await startSelfHosted({
+      caeloDir: DIR,
+      runner,
+      log: () => {},
+      healthAttempts: 1,
+      sleep: async () => {},
+    });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.stage).toBe("health");
+      expect(r.error).toContain("logs caelo-mcp-auth-proxy");
+    }
+  });
+
   it("stops at a failed migration — nothing else is started", async () => {
     const runner = fakeRunner((c) => c.endsWith("migrate.ts admin"));
     const r = await startSelfHosted({ caeloDir: DIR, runner, log: () => {} });

package/src/self-hosted-start.ts

@@ -14,7 +14,8 @@
  *   4. start everything (`--remove-orphans` drops services an older Compose
  *      file had, e.g. the pgBackRest sidecar);
  *   5. health-check the admin (`/_caelo/health` proves the DB pool and its
- *      role) and the gateway;
+ *      role), the gateway and — when the release has one — the
+ *      MCP-Auth-Proxy (#1328);
  *   6. reload Caddy — Compose does not restart a running Caddy when only
  *      its bind-mounted Caddyfile changed, so a re-run `up` would otherwise
  *      keep serving the old vhosts.
@@ -22,8 +23,10 @@
  * stopped.
  */
 
+import { COMPOSE_MCP_AUTH_PROXY_SERVICE } from "./compose.js";
 import type { HostRunner } from "./self-hosted-release.js";
 import { compose, runMigrations, waitHealthy } from "./self-hosted-upgrade.js";
+import type { ReleaseService } from "./upgrade/release-images.js";
 
 export interface StartDeps {
   readonly caeloDir: string;
@@ -71,7 +74,22 @@ export async function startSelfHosted(deps: StartDeps): Promise<StartResult> {
   });
   if (up.exitCode !== 0) return fail("start", "docker compose up failed (see above).");
 
-  for (const service of ["admin", "gateway"] as const) {
+  // #1328 — the MCP-Auth-Proxy too, when the release this file runs has one
+  // (a release from before it has none; Compose knows which).
+  const listed = await runner.run(compose(caeloDir, "config", "--services"));
+  if (listed.exitCode !== 0) {
+    return fail("start", `docker compose config --services failed: ${listed.stderr.trim()}`);
+  }
+  const runsProxy = listed.stdout
+    .split("\n")
+    .map((s) => s.trim())
+    .includes(COMPOSE_MCP_AUTH_PROXY_SERVICE);
+  const services: ReleaseService[] = [
+    "admin",
+    "gateway",
+    ...(runsProxy ? (["mcp-auth-proxy"] as const) : []),
+  ];
+  for (const service of services) {
     log(`Waiting for the ${service} to answer its health check …`);
     const healthy = await waitHealthy(service, caeloDir, {
       runner,

package/src/self-hosted-upgrade.test.ts

@@ -27,24 +27,34 @@ import {
   upgradeSelfHosted,
 } from "./self-hosted-upgrade.js";
 
+// OLD is a release from before #1328: it has no MCP-Auth-Proxy image.
 const OLD_DIGEST = { admin: `sha256:${"1".repeat(64)}`, gateway: `sha256:${"2".repeat(64)}` };
 const OLD: ReleaseImages = {
   mode: "release",
   admin: `ghcr.io/caelo-cms/admin@${OLD_DIGEST.admin}`,
   gateway: `ghcr.io/caelo-cms/gateway@${OLD_DIGEST.gateway}`,
 };
-const NEW_DIGEST = { admin: `sha256:${"a".repeat(64)}`, gateway: `sha256:${"b".repeat(64)}` };
+const NEW_DIGEST = {
+  admin: `sha256:${"a".repeat(64)}`,
+  gateway: `sha256:${"b".repeat(64)}`,
+  "mcp-auth-proxy": `sha256:${"c".repeat(64)}`,
+};
 const NEW: ReleaseImages = {
   mode: "release",
   admin: `ghcr.io/caelo-cms/admin@${NEW_DIGEST.admin}`,
   gateway: `ghcr.io/caelo-cms/gateway@${NEW_DIGEST.gateway}`,
+  "mcp-auth-proxy": `ghcr.io/caelo-cms/mcp-auth-proxy@${NEW_DIGEST["mcp-auth-proxy"]}`,
 };
 
 /** A stand-in for generateDockerCompose: just the two image lines. */
 const render = (images: ReleaseImages) => `admin: ${images.admin}\ngateway: ${images.gateway}\n`;
 
 /** GHCR fake: the anonymous token dance, then `digests` per repository. */
-function registryServing(digests: { admin: string; gateway: string }): typeof fetch {
+function registryServing(digests: {
+  admin: string;
+  gateway: string;
+  "mcp-auth-proxy"?: string;
+}): typeof fetch {
   return (async (input: string | URL | Request, init?: RequestInit) => {
     const url = String(input);
     if (url.startsWith("https://api.github.com/")) return Response.json({ tag_name: "v0.11.0" });
@@ -55,11 +65,14 @@ function registryServing(digests: { admin: string; gateway: string }): typeof fe
         headers: { "www-authenticate": 'Bearer realm="https://ghcr.io/token",service="ghcr.io"' },
       });
     }
-    const service = url.includes("/caelo-cms/admin/") ? "admin" : "gateway";
-    return new Response(null, {
-      status: 200,
-      headers: { "docker-content-digest": digests[service] },
-    });
+    const service = url.includes("/caelo-cms/admin/")
+      ? "admin"
+      : url.includes("/caelo-cms/mcp-auth-proxy/")
+        ? "mcp-auth-proxy"
+        : "gateway";
+    const digest = digests[service];
+    if (!digest) return new Response(null, { status: 404, statusText: "Not Found" });
+    return new Response(null, { status: 200, headers: { "docker-content-digest": digest } });
   }) as typeof fetch;
 }
 const registry = registryServing(NEW_DIGEST);
@@ -86,17 +99,20 @@ function fakeRunner(rules: Rule[] = []): HostRunner & { calls: string[] } {
 function steps(calls: readonly string[]): string[] {
   return calls.map((c) => {
     if (c.startsWith("cosign verify"))
-      return `verify ${c.includes("/admin@") ? "admin" : "gateway"}`;
+      return `verify ${c.includes("/admin@") ? "admin" : c.includes("/mcp-auth-proxy@") ? "mcp-auth-proxy" : "gateway"}`;
     if (c.startsWith("cosign")) return "cosign-probe";
     if (c.includes("pg_isready")) return "pg_isready";
     if (c.includes("pg_dumpall")) return "dump globals";
     if (c.includes("pg_dump ")) return `dump ${c.split(" ").at(-1)}`;
     if (c.includes(" pull ")) return "pull";
     if (c.includes("migrate.ts")) return `migrate ${c.split(" ").at(-1)}`;
+    if (c.includes(" up -d --no-deps caelo-admin caelo-gateway caelo-mcp-auth-proxy"))
+      return "up all";
     if (c.includes(" up -d --no-deps caelo-admin caelo-gateway")) return "up both";
     if (c.includes(" up -d --no-deps ")) return `up ${c.split(" ").at(-1)}`;
     if (c.includes("/_caelo/health")) return "health admin";
     if (c.includes("/healthz")) return "health gateway";
+    if (c.includes("/api/mcp/health")) return "health mcp-auth-proxy";
     return c;
   });
 }
@@ -135,6 +151,10 @@ function deps(
       runner.calls.push("converge roles");
       return roles;
     },
+    applyPublicRoleLimits: async () => {
+      runner.calls.push("public role limits");
+      return { ok: true } as const;
+    },
     refreshCaddy: async () => {
       runner.calls.push("refresh caddy");
       return caddy;
@@ -157,11 +177,14 @@ describe("upgradeSelfHosted", () => {
       "cosign-probe",
       "verify admin",
       "verify gateway",
+      "verify mcp-auth-proxy",
       "pg_isready",
       "dump globals",
       "dump cms_admin",
       "dump cms_public",
       "pull",
+      "up postgres",
+      "public role limits",
       "migrate admin",
       "migrate public",
       "converge roles",
@@ -169,13 +192,20 @@ describe("upgradeSelfHosted", () => {
       "health admin",
       "up caelo-gateway",
       "health gateway",
+      // #1328 — the upgrade from a release without the proxy creates it.
+      "up caelo-mcp-auth-proxy",
+      "health mcp-auth-proxy",
       "refresh caddy",
     ]);
     // The migrations run the NEW admin image: the Compose file already names it.
     expect(readFileSync(composePath(dir), "utf8")).toBe(render(NEW));
     const release = readRelease(dir);
     expect(release?.version).toBe("0.11.0");
-    expect(release?.images).toEqual({ admin: NEW.admin, gateway: NEW.gateway });
+    expect(release?.images).toEqual({
+      admin: NEW.admin,
+      gateway: NEW.gateway,
+      "mcp-auth-proxy": NEW["mcp-auth-proxy"],
+    });
     expect(release?.history.at(-1)).toMatchObject({
       from: "0.10.0",
       to: "0.11.0",
@@ -206,9 +236,11 @@ describe("upgradeSelfHosted", () => {
       "cosign-probe",
       "verify admin",
       "verify gateway",
-      "up both",
+      "verify mcp-auth-proxy",
+      "up all",
       "health admin",
       "health gateway",
+      "health mcp-auth-proxy",
       "refresh caddy",
     ]);
   });
@@ -257,7 +289,13 @@ describe("upgradeSelfHosted", () => {
       { version: "0.10.0" },
       {
         ...deps(runner),
-        fetchImpl: registryServing({ admin: OLD_DIGEST.admin, gateway: OLD_DIGEST.gateway }),
+        // The target release ships a proxy image; the fake render prints
+        // only admin + gateway, so the file still reads as OLD.
+        fetchImpl: registryServing({
+          admin: OLD_DIGEST.admin,
+          gateway: OLD_DIGEST.gateway,
+          "mcp-auth-proxy": NEW_DIGEST["mcp-auth-proxy"],
+        }),
       },
     );
     expect(r).toEqual({ ok: true, status: "upgraded", version: "0.10.0" });
@@ -305,7 +343,9 @@ describe("upgradeSelfHosted", () => {
     ]);
     const r = await upgradeSelfHosted({ version: "0.11.0" }, deps(runner));
     expect(r).toMatchObject({ ok: false, stage: "migrate", previousRunning: true });
-    expect(steps(runner.calls).some((s) => s.startsWith("up "))).toBe(false);
+    // Postgres moved onto this release's TLS config before the migrations
+    // (it serves the previous release too); no Caelo service restarted.
+    expect(steps(runner.calls).some((s) => s.startsWith("up caelo"))).toBe(false);
     expect(readFileSync(composePath(dir), "utf8")).toBe(render(OLD));
   });
 
@@ -325,7 +365,9 @@ describe("upgradeSelfHosted", () => {
     );
     expect(r).toMatchObject({ ok: false, stage: "roles", previousRunning: true });
     if (!r.ok) expect(r.error).toContain("role is busy");
-    expect(steps(runner.calls).some((x) => x.startsWith("up "))).toBe(false);
+    // Postgres moved onto this release's TLS config before the migrations
+    // (it serves the previous release too); no Caelo service restarted.
+    expect(steps(runner.calls).some((x) => x.startsWith("up caelo"))).toBe(false);
     expect(readFileSync(composePath(dir), "utf8")).toBe(render(OLD));
     expect(readRelease(dir)?.version).toBe("0.10.0");
   });
@@ -359,6 +401,23 @@ describe("upgradeSelfHosted", () => {
     expect(release?.history.at(-1)).toMatchObject({ to: "0.11.0", outcome: "rolled-back" });
   });
 
+  it("rolls back to a release without the proxy when the new MCP-Auth-Proxy is unhealthy (#1328)", async () => {
+    const runner = fakeRunner([
+      (c) => (c.includes("/api/mcp/health") ? { exitCode: 1 } : undefined),
+    ]);
+    const r = await upgradeSelfHosted({ version: "0.11.0" }, deps(runner));
+    expect(r).toMatchObject({ ok: false, stage: "roll-mcp-auth-proxy", previousRunning: true });
+    const s = steps(runner.calls);
+    // OLD predates the proxy: the rollback starts and checks only admin + gateway.
+    expect(s.slice(s.lastIndexOf("up both"))).toEqual([
+      "up both",
+      "health admin",
+      "health gateway",
+    ]);
+    expect(readFileSync(composePath(dir), "utf8")).toBe(render(OLD));
+    expect(readRelease(dir)?.images["mcp-auth-proxy"]).toBeUndefined();
+  });
+
   it("reports a failed rollback loudly", async () => {
     const runner = fakeRunner([
       (c) => (c.includes("/_caelo/health") ? { exitCode: 1 } : undefined),
@@ -429,10 +488,38 @@ describe("upgradeSelfHosted — driven by the host agent (#696 Phase 4c)", () =>
     );
     expect(r).toMatchObject({ ok: false, stage: "verify", previousRunning: true });
     expect(r.ok ? "" : r.error).toContain("gateway");
-    expect(steps(runner.calls)).toEqual(["cosign-probe", "verify admin", "verify gateway"]);
+    expect(steps(runner.calls)).toEqual([
+      "cosign-probe",
+      "verify admin",
+      "verify gateway",
+      "verify mcp-auth-proxy",
+    ]);
     expect(readFileSync(composePath(dir), "utf8")).toBe(render(OLD));
   });
 
+  it("refuses a registry that serves another MCP-Auth-Proxy than the manifest names (#1328)", async () => {
+    const r = await upgradeSelfHosted(
+      {
+        version: "0.11.0",
+        expectedDigests: { ...NEW_DIGEST, "mcp-auth-proxy": `sha256:${"d".repeat(64)}` },
+      },
+      deps(fakeRunner()),
+    );
+    expect(r).toMatchObject({ ok: false, stage: "verify", previousRunning: true });
+    expect(r.ok ? "" : r.error).toContain("mcp-auth-proxy");
+  });
+
+  it("checks only admin + gateway for an agent that names no proxy digest", async () => {
+    const r = await upgradeSelfHosted(
+      {
+        version: "0.11.0",
+        expectedDigests: { admin: NEW_DIGEST.admin, gateway: NEW_DIGEST.gateway },
+      },
+      deps(fakeRunner()),
+    );
+    expect(r.ok).toBe(true);
+  });
+
   it("names its stages for the admin's timeline, in order", async () => {
     const phases: string[] = [];
     const r = await upgradeSelfHosted(
@@ -449,6 +536,8 @@ describe("upgradeSelfHosted — driven by the host agent (#696 Phase 4c)", () =>
       "health",
       "roll",
       "health",
+      "roll",
+      "health",
       "record",
     ]);
   });

package/src/self-hosted-upgrade.ts

@@ -9,6 +9,12 @@
  *   2. back up both databases (pg_dump, hard-fail) — the last moment the
  *      schema is guaranteed to match the running images;
  *   3. write the new digests into the Compose file, `docker compose pull`;
+ *   3b. #1338 — recreate Postgres when the Compose file changed it (TLS with
+ *      the install's own certificate, self-hosted-db-tls.ts: the new images
+ *      connect with verify-full only; the old containers keep connecting,
+ *      Postgres still accepts them) and apply public_role's limits as the
+ *      superuser (the migrations' role audit refuses public_role without
+ *      them, and the self-hosted admin_role cannot set them);
  *   4. run the migrations from the NEW admin image (`docker compose run`,
  *      the same `migrate.ts` entrypoint the GCP migrate job runs) while the
  *      old containers keep serving — migrations are expand-only, so the
@@ -20,7 +26,9 @@
  *      refuses an install that skipped the release the old role's last user
  *      was retired in (run-order.ts): past it, nothing running uses it;
  *   6. recreate the admin, health-check it (`/_caelo/health`, which proves
- *      the DB pool and roles); then the gateway (`/healthz`);
+ *      the DB pool and roles); then the gateway (`/healthz`); then the
+ *      MCP-Auth-Proxy (`/api/mcp/health`, #1328) — on the upgrade that first
+ *      brings it, this creates its container;
  *   7. re-write the Caddyfile and reload Caddy — the edge headers live there
  *      (#891), and only the new release's generator knows them;
  *   8. record the release in `.caelo/release.json`.
@@ -50,7 +58,13 @@ import {
 } from "node:fs";
 import { join } from "node:path";
 import type { PlatformUpdatePhase } from "@caelo-cms/shared";
-import { ghcrImageDigest, MEDIA_DIR, type ReleaseImages } from "./compose.js";
+import {
+  COMPOSE_MCP_AUTH_PROXY_PORT,
+  COMPOSE_MCP_AUTH_PROXY_SERVICE,
+  ghcrImageDigest,
+  MEDIA_DIR,
+  type ReleaseImages,
+} from "./compose.js";
 import { selfCommand } from "./self-command.js";
 import {
   type HostRunner,
@@ -61,10 +75,28 @@ import {
   resolveVerifiedRelease,
 } from "./self-hosted-release.js";
 import type { ConvergeOutcome } from "./self-hosted-roles.js";
-import { fetchLatestReleaseTag, RELEASE_SERVICES, releaseTag } from "./upgrade/release-images.js";
+import {
+  fetchLatestReleaseTag,
+  RELEASE_SERVICES,
+  type ReleaseService,
+  releaseTag,
+} from "./upgrade/release-images.js";
+
+/** The Compose service names of the Caelo services. */
+const COMPOSE_SERVICE: Readonly<Record<ReleaseService, string>> = {
+  admin: "caelo-admin",
+  gateway: "caelo-gateway",
+  "mcp-auth-proxy": COMPOSE_MCP_AUTH_PROXY_SERVICE,
+};
 
-/** The Compose service names of the two Caelo services. */
-const COMPOSE_SERVICE = { admin: "caelo-admin", gateway: "caelo-gateway" } as const;
+/**
+ * The release services a Compose file for `images` runs, in roll order: all
+ * of them, except the MCP-Auth-Proxy for a release recorded before it
+ * shipped (#1328, compose.ts ReleaseImages).
+ */
+function servicesOf(images: ReleaseImages): ReleaseService[] {
+  return RELEASE_SERVICES.filter((s) => images[s] !== undefined);
+}
 
 /** Progress output; the CLI wires it to the terminal, tests to an array. */
 export interface UpgradeLog {
@@ -92,6 +124,12 @@ export interface SelfHostedUpgradeDeps {
    * (`convergeSelfHostedRoles`); drops roles a release retired (#635).
    */
   readonly convergeRoles: () => Promise<ConvergeOutcome>;
+  /**
+   * #1338 — applies public_role's limits as the Postgres superuser
+   * (`applyPublicRoleLimits`), before the migrations whose role audit
+   * checks them.
+   */
+  readonly applyPublicRoleLimits: () => Promise<ConvergeOutcome>;
   /**
    * Re-writes the Caddyfile from the install's config + domains table and
    * reloads Caddy (#891): the edge headers (the SVG CSP, nosniff) live in
@@ -112,12 +150,17 @@ export interface SelfHostedUpgradeOpts {
   readonly channel?: "stable" | "rc" | "beta";
   readonly skipVerify?: boolean;
   /**
-   * The admin + gateway digests the release's signed manifest names (the
-   * host agent passes them). The digests GHCR serves for the tag must match,
-   * or nothing changes — a registry cannot swap in another signed image of
-   * an older release under the new tag.
+   * The digests the release's signed manifest names (the host agent passes
+   * them). The digests GHCR serves for the tag must match, or nothing
+   * changes — a registry cannot swap in another signed image of an older
+   * release under the new tag. The MCP-Auth-Proxy's is compared whenever it
+   * is given (#1328; an agent from before it passes only admin + gateway).
    */
-  readonly expectedDigests?: { readonly admin: string; readonly gateway: string };
+  readonly expectedDigests?: {
+    readonly admin: string;
+    readonly gateway: string;
+    readonly "mcp-auth-proxy"?: string;
+  };
 }
 
 export type SelfHostedUpgradeResult =
@@ -140,6 +183,7 @@ type UpgradeStage =
   | "roles"
   | "roll-admin"
   | "roll-gateway"
+  | "roll-mcp-auth-proxy"
   | "caddy";
 
 /** Where an install from before #696 keeps its original Compose file during the move. */
@@ -247,6 +291,10 @@ export async function upgradeSelfHosted(
   const previousCompose = current
     ? deps.renderCompose(releaseImages(current))
     : legacyComposeCheckpoint(caeloDir, live);
+  // The legacy (repo-mounted) file predates the MCP-Auth-Proxy.
+  const previousServices: readonly ReleaseService[] = current
+    ? servicesOf(releaseImages(current))
+    : ["admin", "gateway"];
 
   // 1. Target release → verified digests.
   log.phase?.("verify");
@@ -265,8 +313,9 @@ export async function upgradeSelfHosted(
   if (opts.skipVerify) log.warn("--skip-verify set — image signatures NOT verified.");
   const images = resolved.images;
   if (opts.expectedDigests) {
+    const expected = opts.expectedDigests;
     const mismatch = RELEASE_SERVICES.filter(
-      (s) => ghcrImageDigest(s, images[s]) !== opts.expectedDigests?.[s],
+      (s) => expected[s] !== undefined && ghcrImageDigest(s, images[s] ?? "") !== expected[s],
     );
     if (mismatch.length > 0) {
       return fail(
@@ -278,8 +327,7 @@ export async function upgradeSelfHosted(
   }
   if (
     current &&
-    current.images.admin === images.admin &&
-    current.images.gateway === images.gateway &&
+    RELEASE_SERVICES.every((s) => current.images[s] === images[s]) &&
     live === previousCompose
   ) {
     // Recorded, and the Compose file agrees. `up` converges containers a
@@ -289,7 +337,7 @@ export async function upgradeSelfHosted(
     log.info(
       `Already on ${current.version}; checking the running containers match and are healthy.`,
     );
-    const converged = await startBoth(deps);
+    const converged = await startAll(deps, servicesOf(images));
     if (!converged.ok) {
       return fail(
         "converge",
@@ -328,13 +376,41 @@ export async function upgradeSelfHosted(
   log.phase?.("roll");
   log.step("Pulling the new images");
   const pull = await runner.run(
-    compose(caeloDir, "pull", COMPOSE_SERVICE.admin, COMPOSE_SERVICE.gateway),
+    compose(caeloDir, "pull", ...servicesOf(images).map((s) => COMPOSE_SERVICE[s])),
   );
   if (pull.exitCode !== 0) {
     restoreCompose(file, previousCompose);
     return fail("pull", `docker compose pull failed: ${tail(pull.stderr)}`, true);
   }
 
+  // 3b. Postgres on this release's config (TLS, #1338). `up -d` recreates
+  // it only when its definition changed; `--wait` returns once it is
+  // healthy. The data volume stays; the old admin and gateway reconnect.
+  log.step("Bringing Postgres onto this release's configuration (TLS)");
+  const pg = await runner.run(compose(caeloDir, "up", "-d", "--no-deps", "--wait", "postgres"));
+  if (pg.exitCode !== 0) {
+    restoreCompose(file, previousCompose);
+    const back = await runner.run(compose(caeloDir, "up", "-d", "--no-deps", "--wait", "postgres"));
+    return fail(
+      "pull",
+      `Postgres did not come up on the new configuration: ${tail(pg.stderr)}\n${
+        back.exitCode === 0
+          ? "Postgres runs on the previous configuration again; nothing else changed."
+          : `Postgres did not come back on the previous configuration either: ${tail(back.stderr)}. Check \`docker compose ps\` / \`docker compose logs postgres\`.`
+      }`,
+      back.exitCode === 0,
+    );
+  }
+  const limits = await deps.applyPublicRoleLimits();
+  if (!limits.ok) {
+    restoreCompose(file, previousCompose);
+    return fail(
+      "roles",
+      `Could not apply public_role's connection and statement limits: ${limits.error}\nThe previous release keeps running; no migration ran. Database backup: ${backup.dir}`,
+      true,
+    );
+  }
+
   // 4. Migrations from the new admin image; the old containers keep serving.
   log.phase?.("migrations");
   log.step("Running database migrations with the new admin image");
@@ -360,11 +436,11 @@ export async function upgradeSelfHosted(
     );
   }
 
-  // 6. Roll admin, then gateway, each health-checked.
-  for (const service of RELEASE_SERVICES) {
-    const stage = service === "admin" ? "roll-admin" : "roll-gateway";
+  // 6. Roll admin, then gateway, then the MCP-Auth-Proxy, each health-checked.
+  for (const service of servicesOf(images)) {
+    const stage: UpgradeStage = `roll-${service}`;
     log.phase?.("roll");
-    log.step(`Restarting ${service} on ${shortDigest(images[service])}`);
+    log.step(`Restarting ${service} on ${shortDigest(images[service] ?? "")}`);
     const up = await runner.run(
       compose(caeloDir, "up", "-d", "--no-deps", COMPOSE_SERVICE[service]),
     );
@@ -375,7 +451,7 @@ export async function upgradeSelfHosted(
         : { ok: false as const, error: `docker compose up failed: ${tail(up.stderr)}` };
     if (!healthy.ok) {
       log.error(`${service} is not healthy on ${target.version}: ${healthy.error}`);
-      const restored = await rollback(file, previousCompose, deps);
+      const restored = await rollback(file, previousCompose, previousServices, deps);
       if (current) {
         recordRollback(caeloDir, current, target.version, `${stage}: ${healthy.error}`, now());
       }
@@ -559,13 +635,16 @@ export async function runMigrations(
  * In-container probe scripts (`bun -e`): the containers publish no host
  * ports, so the probe runs where the service listens. The admin's
  * `/_caelo/health` checks the DB pool + roles; the gateway's `/healthz` is
- * its liveness endpoint.
+ * its liveness endpoint; the MCP-Auth-Proxy's `/api/mcp/health` answers
+ * even while remote MCP is unavailable (#1328). Its image has no shell, so
+ * the probe is `bun -e`, never `sh -c`.
  */
-const HEALTH_PROBE: Record<"admin" | "gateway", string> = {
+const HEALTH_PROBE: Record<ReleaseService, string> = {
   admin:
     'const r=await fetch("http://127.0.0.1:"+(process.env.PORT||"3000")+"/_caelo/health").catch(()=>null);process.exit(r&&r.ok?0:1)',
   gateway:
     'const r=await fetch("http://127.0.0.1:"+(process.env.PORT||process.env.GATEWAY_PORT||"8090")+"/healthz").catch(()=>null);process.exit(r&&r.ok?0:1)',
+  "mcp-auth-proxy": `const r=await fetch("http://127.0.0.1:"+(process.env.MCP_AUTH_PROXY_PORT||"${COMPOSE_MCP_AUTH_PROXY_PORT}")+"/api/mcp/health").catch(()=>null);process.exit(r&&r.ok?0:1)`,
 };
 
 /**
@@ -573,7 +652,7 @@ const HEALTH_PROBE: Record<"admin" | "gateway", string> = {
  * after `healthAttempts` tries (default 45, 2 s apart).
  */
 export async function waitHealthy(
-  service: "admin" | "gateway",
+  service: ReleaseService,
   caeloDir: string,
   deps: Pick<SelfHostedUpgradeDeps, "runner" | "sleep" | "healthAttempts" | "healthIntervalMs">,
 ): Promise<{ ok: true } | { ok: false; error: string }> {
@@ -595,28 +674,35 @@ export async function waitHealthy(
   };
 }
 
-/** Put the previous Compose file back, restart both services on it, health-check them. */
+/**
+ * Put the previous Compose file back, restart its services on it,
+ * health-check them. `previousServices` are the services that file runs (a
+ * release from before #1328 has no MCP-Auth-Proxy; a proxy container the
+ * failed run created then keeps running unused until the next upgrade).
+ */
 async function rollback(
   file: string,
   previousCompose: string,
+  previousServices: readonly ReleaseService[],
   deps: SelfHostedUpgradeDeps,
 ): Promise<boolean> {
   deps.log.phase?.("rollback");
   deps.log.warn("Rolling back to the previous images");
   restoreCompose(file, previousCompose);
-  return (await startBoth(deps)).ok;
+  return (await startAll(deps, previousServices)).ok;
 }
 
-/** `up -d` both services on the current Compose file, then health-check each. */
-async function startBoth(
+/** `up -d` `services` on the current Compose file, then health-check each. */
+async function startAll(
   deps: SelfHostedUpgradeDeps,
+  services: readonly ReleaseService[],
 ): Promise<{ ok: true } | { ok: false; error: string }> {
   const up = await deps.runner.run(
-    compose(deps.caeloDir, "up", "-d", "--no-deps", COMPOSE_SERVICE.admin, COMPOSE_SERVICE.gateway),
+    compose(deps.caeloDir, "up", "-d", "--no-deps", ...services.map((s) => COMPOSE_SERVICE[s])),
   );
   if (up.exitCode !== 0)
     return { ok: false, error: `docker compose up failed: ${tail(up.stderr)}` };
-  for (const service of RELEASE_SERVICES) {
+  for (const service of services) {
     const healthy = await waitHealthy(service, deps.caeloDir, deps);
     if (!healthy.ok) return { ok: false, error: `${service}: ${healthy.error}` };
   }