@caelo-cms/provisioning 0.11.9 → 0.11.10

package/stacks/aws/index.ts

@@ -27,7 +27,11 @@
  * is to wire those env vars to AWS-native resources.
  */
 
-import { cloudFrontRedirectFunctionCode } from "@caelo-cms/shared";
+import {
+  AWS_RDS_CA_BUNDLE,
+  cloudFrontRedirectFunctionCode,
+  verifyFullQuery,
+} from "@caelo-cms/shared";
 import * as aws from "@pulumi/aws";
 import * as awsx from "@pulumi/awsx";
 import * as pulumi from "@pulumi/pulumi";
@@ -171,9 +175,15 @@ const dbParameters = new aws.rds.ParameterGroup(`${namePrefix}-pg-params`, {
   family: "postgres16",
   parameters: [
     { name: "max_connections", value: String(maxConnections), applyMethod: "pending-reboot" },
+    // #1338 — refuse plaintext; every client connects with verify-full.
+    { name: "rds.force_ssl", value: "1", applyMethod: "pending-reboot" },
   ],
 });
 
+// #1338 — verify-full against Amazon's RDS CA bundle (shipped in every image,
+// shared database-tls.ts); the RDS certificate names the endpoint host.
+const RDS_TLS = verifyFullQuery(AWS_RDS_CA_BUNDLE);
+
 const db = new aws.rds.Instance(`${namePrefix}-pg`, {
   engine: "postgres",
   engineVersion: "16.4",
@@ -196,14 +206,12 @@ const db = new aws.rds.Instance(`${namePrefix}-pg`, {
 const adminDatabaseUrl = pulumi
   .all([db.address, db.port, postgresPassword])
   .apply(
-    ([host, port, pw]) =>
-      `postgresql://caelo_admin:${pw}@${host}:${port}/cms_admin?sslmode=require`,
+    ([host, port, pw]) => `postgresql://caelo_admin:${pw}@${host}:${port}/cms_admin?${RDS_TLS}`,
   );
 const publicDatabaseUrl = pulumi
   .all([db.address, db.port, publicRolePassword])
   .apply(
-    ([host, port, pw]) =>
-      `postgresql://public_role:${pw}@${host}:${port}/cms_public?sslmode=require`,
+    ([host, port, pw]) => `postgresql://public_role:${pw}@${host}:${port}/cms_public?${RDS_TLS}`,
   );
 
 // === 4. S3 buckets ===
@@ -450,9 +458,12 @@ const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
   settings: [{ name: "containerInsights", value: "enabled" }],
 });
 
-// #806 — no remote MCP on AWS: it rides Google IAP (gcp stacks only). The
-// gateway task definition, once it exists, sets none of its env, so /api/mcp/*
-// answers 503 remote_mcp_not_configured and the admin reports it unavailable.
+// #1328 — the MCP-Auth-Proxy (remote MCP's sign-in service) is a service of
+// its own on every provider, with its own task role that may read NO secret.
+// Remote MCP rides Google IAP (gcp stacks only), so on AWS it would run with
+// CAELO_REMOTE_MCP=unavailable and answer a fixed 404. Like the admin and
+// gateway it has no task definition yet: the service lands with #749, in the
+// same shape (own origin, zero minimum tasks, no database env).
 //
 // One task role per service (#635): the gateway's may read only the
 // public_role password, never a secret that unlocks a cms_admin login
@@ -482,18 +493,23 @@ function taskRole(service: AwsTaskService): aws.iam.Role {
       ],
     }),
   });
-  new aws.iam.RolePolicy(`${prefix}-task-secrets`, {
-    role: role.id,
-    policy: pulumi
-      .all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))
-      .apply(secretsReadPolicy),
-  });
+  // A service that reads no secret gets no secrets policy at all (an empty
+  // policy is malformed, see secretsReadPolicy).
+  if (AWS_SERVICE_SECRETS[service].length > 0) {
+    new aws.iam.RolePolicy(`${prefix}-task-secrets`, {
+      role: role.id,
+      policy: pulumi
+        .all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))
+        .apply(secretsReadPolicy),
+    });
+  }
   return role;
 }
 
 const taskRoles: Record<AwsTaskService, aws.iam.Role> = {
   admin: taskRole("admin"),
   gateway: taskRole("gateway"),
+  "mcp-auth-proxy": taskRole("mcp-auth-proxy"),
 };
 
 const execRole = new aws.iam.Role(`${namePrefix}-exec-role`, {
@@ -563,6 +579,8 @@ export const rdsAddressOut = db.address;
 // The task roles the admin-side and gateway task definitions run as.
 export const adminTaskRoleArnOut = taskRoles.admin.arn;
 export const gatewayTaskRoleArnOut = taskRoles.gateway.arn;
+// #1328 — the role the MCP-Auth-Proxy task definition will run as (#749).
+export const mcpAuthProxyTaskRoleArnOut = taskRoles["mcp-auth-proxy"].arn;
 // #1254 — the pool env the admin and gateway task definitions set.
 export const poolBudgetEnvOut = poolBudget.env;
 

package/stacks/azure/index.ts

@@ -13,7 +13,8 @@
  *  4. Azure Front Door Standard serving the static website on the primary
  *     domain with a managed certificate — files served as files, no compute
  *     on the request path (CLAUDE.md §11.B Tier 1).
- *  5. Azure Container Apps (admin/gateway/orchestrator/runner),
+ *  5. Azure Container Apps (admin/gateway/orchestrator/runner, and the
+ *     MCP-Auth-Proxy without any secret, #1328),
  *     mounted with Key Vault secrets via managed identity.
  *  6. Key Vault entries (postgres-password, csrf-secret, cookie-secret,
  *     anthropic-api-key, resend-api-key).
@@ -34,6 +35,7 @@
  * env vars wired by this stack.
  */
 
+import { verifyFullQuery } from "@caelo-cms/shared";
 import * as azure from "@pulumi/azure-native";
 import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
@@ -44,6 +46,9 @@ import {
   ADMIN_MEMORY_DEFAULT,
   azureContainerAppResources,
   GATEWAY_TRUSTED_PROXY_HOPS,
+  MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS,
+  REMOTE_MCP_MODE,
+  REMOTE_MCP_MODE_ENV,
   TRUSTED_PROXY_HOPS_ENV,
 } from "../../dist/stack-contract.js";
 import {
@@ -191,18 +196,23 @@ const _pgPublic = new azure.dbforpostgresql.Database(`${namePrefix}-cms-public-d
   charset: "UTF8",
 });
 
+// #1338 — verify-full to the server's FQDN. Flexible Server's certificate chains
+// to public roots (DigiCert Global Root G2, Microsoft RSA Root CA 2017) that
+// Bun trusts out of the box, so no sslrootcert (shared database-tls.ts).
+const AZURE_TLS = verifyFullQuery();
+
 const adminDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, postgresPassword])
-  .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_admin?sslmode=require`);
+  .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_admin?${AZURE_TLS}`);
 // What the admin connects to cms_public with (DDL, migrations, moderation).
 const publicAdminDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, postgresPassword])
-  .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public?sslmode=require`);
+  .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public?${AZURE_TLS}`);
 // The gateway's only login (#613, #635): public_role on cms_public. It has
 // no cms_admin login at all (CLAUDE.md §2).
 const publicDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, publicRolePassword])
-  .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?sslmode=require`);
+  .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?${AZURE_TLS}`);
 
 // === 4. Storage account + containers ===
 const storage = new azure.storage.StorageAccount(`${namePrefix}-st`, {
@@ -437,6 +447,12 @@ interface ContainerAppArgs {
   readonly extraEnv?: ReadonlyArray<{ name: string; value: pulumi.Input<string> }>;
   /** Defaults to 0.5 vCPU / 1 GiB. */
   readonly resources?: { readonly cpu: number; readonly memory: string };
+  /**
+   * #1328 — a service that reads nothing of the install: no CAELO_ENV, no
+   * media URL, only `CAELO_PROVIDER` plus {@link extraEnv}, and zero
+   * minimum replicas in every environment (E14 a of #763).
+   */
+  readonly isolated?: true;
 }
 
 function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
@@ -454,7 +470,10 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
       },
     },
     template: {
-      scale: { minReplicas: env === "production" ? 1 : 0, maxReplicas: MAX_REPLICAS },
+      scale: {
+        minReplicas: args.isolated || env !== "production" ? 0 : 1,
+        maxReplicas: MAX_REPLICAS,
+      },
       containers: [
         {
           name: args.serviceName,
@@ -462,16 +481,18 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
           image:
             cfg.get(`image-${args.serviceName}`) ??
             `${namePrefix}.azurecr.io/${args.serviceName}:latest`,
-          env: [
-            { name: "CAELO_PROVIDER", value: "azure" },
-            { name: "CAELO_ENV", value: env },
-            ...args.databaseEnv,
-            {
-              name: "MEDIA_STORAGE_URL",
-              value: pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media`,
-            },
-            ...(args.extraEnv ?? []),
-          ],
+          env: args.isolated
+            ? [{ name: "CAELO_PROVIDER", value: "azure" }, ...(args.extraEnv ?? [])]
+            : [
+                { name: "CAELO_PROVIDER", value: "azure" },
+                { name: "CAELO_ENV", value: env },
+                ...args.databaseEnv,
+                {
+                  name: "MEDIA_STORAGE_URL",
+                  value: pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media`,
+                },
+                ...(args.extraEnv ?? []),
+              ],
           resources: args.resources ?? { cpu: 0.5, memory: "1.0Gi" },
         },
       ],
@@ -499,11 +520,29 @@ const _gatewayApp = containerApp({
     ...poolBudget.env.gateway,
   ],
   // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts).
-  // #806 — no remote-MCP env: remote MCP rides Google IAP (gcp stacks
-  // only); unset, the gateway answers /api/mcp/* with 503
-  // remote_mcp_not_configured and the admin reports it unavailable.
   extraEnv: [{ name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) }],
 });
+// #1328 — the MCP-Auth-Proxy, its own Container App and so its own FQDN:
+// remote MCP's sign-in pages never share an origin with the site's module
+// JS. Remote MCP needs the admin behind Google IAP, which Azure does not
+// have, so it runs with CAELO_REMOTE_MCP=unavailable and answers everything
+// but its health check (`/api/mcp/health`) with one fixed 404; the admin
+// reports remote MCP as not available here. No database URL, no secret
+// and no managed identity, because there is nothing it may read. Same
+// shape as on every provider (E11 of #763), at zero replicas until a
+// request comes.
+const _mcpAuthProxyApp = containerApp({
+  serviceName: "mcp-auth-proxy",
+  databaseEnv: [],
+  isolated: true,
+  resources: { cpu: 0.25, memory: "0.5Gi" },
+  extraEnv: [
+    { name: REMOTE_MCP_MODE_ENV, value: REMOTE_MCP_MODE.azure },
+    { name: TRUSTED_PROXY_HOPS_ENV, value: String(MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS.azure) },
+    // The app's ingress targets 8080 (containerApp above).
+    { name: "PORT", value: "8080" },
+  ],
+});
 const _orchestratorApp = containerApp({
   serviceName: "orchestrator",
   databaseEnv: adminDatabaseEnv,

package/stacks/gcp/index.ts

@@ -27,6 +27,7 @@ import {
   gcpBucketName,
   gcpSecretId,
   MCP_IAP_SERVICE_ACCOUNT_ID,
+  mcpAuthProxyServiceAccountId,
   runServiceAccountId,
   staticPublisherServiceAccountId,
 } from "../../dist/gcp-names.js";
@@ -36,18 +37,21 @@ import {
   DEFAULT_MAX_CONNECTIONS,
   stackPoolBudget,
 } from "../../dist/pool-budget-stack.js";
-import { mcpArmorRuleArgs } from "../../dist/remote-mcp-edge.js";
 import {
   ADMIN_MEMORY_DEFAULT,
   adminEnvContract,
   adminMediaVolume,
   adminMediaVolumeTemplate,
   CLOUD_RUN_IGNORE_CHANGES,
+  CLOUD_SQL_PSA_CONNECTION_TYPE,
+  CLOUD_SQL_SERVER_CA_MODE,
+  CLOUD_SQL_SSL_MODE,
   type CloudRunEnvVar,
   type CloudRunSlug,
+  cloudSqlDnsZoneName,
+  cloudSqlPrivateDnsName,
   databaseUrls,
   defaultStagingHost,
-  GATEWAY_TIMEOUT_SECONDS,
   gatewayEnvContract,
   REMOTE_MCP_IDENTITY_CONFIG,
   type RuntimeSecret,
@@ -331,6 +335,11 @@ const sqlInstance = new gcp.sql.DatabaseInstance(
       ipConfiguration: {
         ipv4Enabled: false,
         privateNetwork: network.id,
+        // #1338 — the shared CA names the instance's DNS name in its server
+        // certificate, so every client verifies it (sslmode=verify-full);
+        // unencrypted connections are refused outright.
+        serverCaMode: CLOUD_SQL_SERVER_CA_MODE,
+        sslMode: CLOUD_SQL_SSL_MODE,
       },
       deletionProtectionEnabled: deletionProtection,
     },
@@ -374,10 +383,50 @@ const cmsPublicDb = new gcp.sql.Database(
   opts,
 );
 
+// #1338 — the instance's DNS name, resolved to its private IP by a private
+// zone in the VPC (Cloud SQL assigns the name, it does not resolve it).
+// Every client dials this name with sslmode=verify-full; the certificate
+// names no IP. `cms-provision upgrade` converges the same zone and record
+// through gcloud (cloudsql-tls.ts); the installer adopts them (#1079).
+const sqlDnsName = sqlInstance.dnsNames.apply((names) => {
+  const name = cloudSqlPrivateDnsName(names);
+  if (!name) {
+    throw new Error(
+      `Cloud SQL instance has no ${CLOUD_SQL_PSA_CONNECTION_TYPE} DNS name; it needs the shared server CA (${CLOUD_SQL_SERVER_CA_MODE}) for verify-full connections (#1338)`,
+    );
+  }
+  return name;
+});
+const sqlDnsZone = new gcp.dns.ManagedZone(
+  `${namePrefix}-pg-dns`,
+  {
+    name: cloudSqlDnsZoneName(env),
+    dnsName: pulumi.interpolate`${sqlDnsName}.`,
+    visibility: "private",
+    privateVisibilityConfig: { networks: [{ networkUrl: network.id }] },
+    description: `Caelo ${env}: the Cloud SQL instance's DNS name inside the VPC (#1338)`,
+  },
+  opts,
+);
+const sqlDnsRecord = new gcp.dns.RecordSet(
+  `${namePrefix}-pg-dns-a`,
+  {
+    // Literal names, not the zone's outputs: the installer can then adopt
+    // a record an upgrade created (adopt-existing.ts) from the preview.
+    managedZone: cloudSqlDnsZoneName(env),
+    name: pulumi.interpolate`${sqlDnsName}.`,
+    type: "A",
+    ttl: 300,
+    rrdatas: [sqlInstance.privateIpAddress],
+  },
+  { ...opts, dependsOn: [sqlDnsZone] },
+);
+
 // Password-less connection URLs (stack-contract.ts databaseUrls); the
 // services get the password as a Secret Manager reference
-// (SERVICE_SECRET_ENV), so no revision ever carries it.
-const dbUrls = sqlInstance.privateIpAddress.apply(databaseUrls);
+// (SERVICE_SECRET_ENV), so no revision ever carries it. Tied to the record
+// so no revision boots before its database host resolves.
+const dbUrls = pulumi.all([sqlDnsName, sqlDnsRecord.id]).apply(([host]) => databaseUrls(host));
 
 // Reference pgPublicUser so Pulumi knows it's part of the dependency
 // graph (Cloud Run env-var deps don't see this directly).
@@ -475,9 +524,24 @@ const gatewaySa = new gcp.serviceaccount.Account(
   },
   opts,
 );
+// #1328 — the MCP-Auth-Proxy's own SA and (below) its secretAccessor on its
+// two secrets, nothing else. The proxy's service, NEG, backend and Cloud
+// Armor policy are the CLI's (remote-mcp.ts ensureRemoteMcpEdge, after the
+// first `up`), like the jobs: the converge creates the same on existing
+// installs, and the URL map's path rules are the CLI's already.
+const mcpAuthProxySa = new gcp.serviceaccount.Account(
+  `${namePrefix}-mcp-auth-proxy-sa`,
+  {
+    accountId: mcpAuthProxyServiceAccountId(env),
+    displayName: `Caelo ${env} MCP-Auth-Proxy`,
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
 const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
   admin: runSa,
   gateway: gatewaySa,
+  "mcp-auth-proxy": mcpAuthProxySa,
 };
 
 // secretAccessor for each service's SA on exactly the secrets its env reads.
@@ -486,6 +550,7 @@ const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
 const secretBindings: Record<CloudRunSlug, gcp.secretmanager.SecretIamMember[]> = {
   admin: [],
   gateway: [],
+  "mcp-auth-proxy": [],
 };
 for (const binding of runtimeSecretBindings()) {
   secretBindings[binding.service].push(
@@ -662,7 +727,8 @@ function imageTag(service: string): pulumi.Output<string> {
 }
 
 interface CloudRunArgs {
-  readonly serviceName: "admin" | "gateway";
+  /** The MCP-Auth-Proxy is CLI-owned on this stack (see mcpAuthProxySa). */
+  readonly serviceName: Exclude<CloudRunSlug, "mcp-auth-proxy">;
   readonly minInstances: number;
   readonly maxInstances: number;
   readonly memory: string;
@@ -670,8 +736,7 @@ interface CloudRunArgs {
    * Per-request timeout. Cloud Run's default is 300s (5min), which is too
    * short for the admin's SSE chat-stream — a multi-tool compose-page session
    * regularly runs 5–15 min. Pass an explicit "<n>s" Pulumi-style duration
-   * string. The gateway gets the same (#806): it proxies remote-MCP chat
-   * streams to the admin.
+   * string.
    */
   readonly timeout?: string;
   /**
@@ -816,18 +881,12 @@ const gatewaySvc = cloudRunService({
   minInstances: gatewayMinInstances,
   maxInstances: gatewayMaxInstances,
   memory: "512Mi",
-  // #806 — remote MCP: chat turns stream through the gateway for minutes,
-  // so it gets the admin's 3600 s instead of Cloud Run's 300 s default
-  // (stack-contract.ts GATEWAY_TIMEOUT_SECONDS). The LB in front imposes no
-  // shorter limit on serverless NEG backends.
-  timeout: `${GATEWAY_TIMEOUT_SECONDS}s`,
+  // Visitor requests only (#1328 moved remote MCP's long streams to the
+  // MCP-Auth-Proxy): Cloud Run's default.
+  timeout: "300s",
   // public_role on cms_public only: no cms_admin login of any role
   // (#613, #635, CLAUDE.md §2).
-  contractEnv: [
-    ...gatewayEnvContract(envContractInputs),
-    ...remoteMcpEnv.gateway,
-    ...poolBudget.env.gateway,
-  ],
+  contractEnv: [...gatewayEnvContract(envContractInputs), ...poolBudget.env.gateway],
 });
 
 // =========================================================================
@@ -838,6 +897,9 @@ const gatewaySvc = cloudRunService({
 // admin.caelo-cms.com. Three backends routed by Host header / path:
 //   - host=caelo-cms.com, default          → static bucket (Cloud CDN)
 //   - host=caelo-cms.com, path=/api/*      → gateway Cloud Run (Cloud Armor)
+//   - host=caelo-cms.com, path=/api/mcp/*, /.well-known/oauth-*
+//                                          → MCP-Auth-Proxy Cloud Run (its own
+//                                            Cloud Armor; CLI-owned, #1328)
 //   - host=admin.caelo-cms.com, default    → admin Cloud Run (IAP-gated)
 //
 // CLAUDE.md §11.B Tier 2: admin behind cloud-native identity proxy. IAP
@@ -860,12 +922,10 @@ const wafPolicy = new gcp.compute.SecurityPolicy(
   {
     description: `Caelo ${env} Cloud Armor — rate limit + OWASP`,
     rules: [
-      // #806 — remote MCP (/api/mcp/*): a per-IP throttle sized for agent
-      // traffic behind shared connector IPs, evaluated first; below it the
-      // rule allows, so the OWASP packs (MCP bodies carry HTML) and the
-      // general ban below do not apply there. src/remote-mcp-edge.ts says
-      // why; `cms-provision upgrade` adds the same rule to existing installs.
-      mcpArmorRuleArgs(),
+      // #1328 — no remote-MCP rule here any more: the URL map sends
+      // /api/mcp/* to the MCP-Auth-Proxy's backend, whose own policy carries
+      // it (remote-mcp-edge.ts, created by the CLI; `upgrade` drops the old
+      // rule from this policy).
       // Rate limit per source IP — 100 req / min sliding window.
       {
         action: "rate_based_ban",