@caelo-cms/provisioning 0.11.9 → 0.11.11

package/src/adopt-existing.ts

@@ -25,7 +25,9 @@
  *   4. A second preview: what the review shows and `up` applies. An adopted
  *      resource that is still planned as a create stops the run.
  *
- * Why only service accounts ({@link ADOPTABLE_KINDS}). A kind is adopted
+ * Why service accounts, since #1338 the Cloud SQL private DNS zone and its
+ * record (cloudsql-tls.ts creates both on upgrade), and since #1328
+ * explicitly named Cloud Run services — {@link ADOPTABLE_KINDS}. A kind is adopted
  * when the stack declares it AND the CLI also creates it through gcloud, and
  * its name is unique in the project. Checked per kind against both stacks:
  *
@@ -34,6 +36,9 @@
  *     (stack-contract.ts CLI_GENERATED_SECRETS) the stack only references by
  *     id. Adopting a secret without its value resource would also make `up`
  *     add a version with a freshly generated value — a new KEK.
+ *   - Cloud Run services: only the ones the stack names explicitly (#1328:
+ *     the gcp-firebase data gateway, which the converge creates on older
+ *     installs); the auto-named admin and proxy are Pulumi's alone.
  *   - Buckets, Cloud Run jobs, custom roles: the stack's buckets are made by
  *     Pulumi alone; the CLI's own (ops, audit results, the upgrader, converge,
  *     audit and operator-access jobs, their custom roles) are not declared.
@@ -44,12 +49,17 @@
  *     Their create is a read-modify-write that merges the member into the
  *     policy and succeeds when it is there already, so a planned create of
  *     one is an adoption already.
- *   - Cloud SQL users: the CLI's are IAM users named after service accounts,
- *     the stack's are the built-in `admin_role` / `public_role`.
+ *   - Cloud SQL databases and users: only the staging database
+ *     `cms_public_staging` and its login `public_staging_role` (#1329), which
+ *     the converge creates on installs from before them (staging-database.ts).
+ *     Every other one is Pulumi's alone: the CLI's other users are IAM users
+ *     named after service accounts, the stack's the built-in `admin_role` /
+ *     `public_role`.
  */
 
 import type { GcloudRunner } from "./gcloud-retry.js";
 import type { PlannedStep } from "./preview-plan.js";
+import { STAGING_DATABASE, STAGING_DATABASE_ROLE } from "./staging-database.js";
 
 /** The cloud identity of a resource a planned create would make. */
 export interface AdoptionTarget {
@@ -72,6 +82,9 @@ export interface AdoptableKind {
   target(inputs: Readonly<Record<string, unknown>>, projectId: string): AdoptionTarget | null;
 }
 
+/** The Cloud SQL objects the converge creates that the stack declares too (#1329). */
+const CONVERGE_CREATED_SQL = { database: STAGING_DATABASE, user: STAGING_DATABASE_ROLE } as const;
+
 /** Kinds adopted before `up`, by Pulumi type token. See the file comment for the rest. */
 export const ADOPTABLE_KINDS: Readonly<Record<string, AdoptableKind>> = {
   "gcp:serviceaccount/account:Account": {
@@ -102,6 +115,131 @@ export const ADOPTABLE_KINDS: Readonly<Record<string, AdoptableKind>> = {
       };
     },
   },
+  // #1338 — the private zone + A record that resolve the Cloud SQL
+  // instance's DNS name in the VPC. `cms-provision upgrade` creates both
+  // through gcloud (cloudsql-tls.ts) on installs that predate them; the
+  // stacks declare them with literal names so the preview pins them down.
+  "gcp:dns/managedZone:ManagedZone": {
+    label: "private DNS zone",
+    target(inputs, projectId) {
+      const name = inputs.name;
+      if (typeof name !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(name)) return null;
+      if ((inputs.project ?? projectId) !== projectId) return null;
+      return {
+        display: name,
+        describeArgs: [
+          "dns",
+          "managed-zones",
+          "describe",
+          name,
+          `--project=${projectId}`,
+          "--format=value(name)",
+        ],
+        importId: `projects/${projectId}/managedZones/${name}`,
+      };
+    },
+  },
+  "gcp:dns/recordSet:RecordSet": {
+    label: "DNS record",
+    target(inputs, projectId) {
+      const { managedZone: zone, name, type } = inputs;
+      if (typeof zone !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(zone)) return null;
+      if (typeof name !== "string" || !/^[a-z0-9.-]{1,253}\.$/.test(name)) return null;
+      if (typeof type !== "string" || !/^[A-Z]{1,10}$/.test(type)) return null;
+      if ((inputs.project ?? projectId) !== projectId) return null;
+      return {
+        display: `${name} ${type}`,
+        describeArgs: [
+          "dns",
+          "record-sets",
+          "describe",
+          name,
+          `--zone=${zone}`,
+          `--type=${type}`,
+          `--project=${projectId}`,
+          "--format=value(name)",
+        ],
+        importId: `projects/${projectId}/managedZones/${zone}/rrsets/${name}/${type}`,
+      };
+    },
+  },
+  // #1328 — the gcp-firebase data gateway: the stack declares it under a
+  // fixed name (stack-contract.ts fixedCloudRunServiceName), and the converge
+  // creates the same service on installs whose stack predates it. Only a
+  // service the stack names explicitly is a candidate: an auto-named one has
+  // no name until Pulumi picks it.
+  "gcp:cloudrunv2/service:Service": {
+    label: "Cloud Run service",
+    target(inputs, projectId) {
+      const name = inputs.name;
+      const location = inputs.location;
+      if (typeof name !== "string" || !/^[a-z][a-z0-9-]{0,47}[a-z0-9]$/.test(name)) return null;
+      if (typeof location !== "string" || !/^[a-z]+-[a-z]+\d+$/.test(location)) return null;
+      const project = inputs.project ?? projectId;
+      if (project !== projectId) return null;
+      return {
+        display: `${name} (${location})`,
+        describeArgs: [
+          "run",
+          "services",
+          "describe",
+          name,
+          `--region=${location}`,
+          `--project=${projectId}`,
+          "--format=value(metadata.name)",
+        ],
+        importId: `projects/${projectId}/locations/${location}/services/${name}`,
+      };
+    },
+  },
+  // #1329 — the staging database and its login: created by the converge on
+  // an install whose stack predates them (staging-database.ts), declared by
+  // the stack with literal names. Only those two names are candidates.
+  "gcp:sql/database:Database": {
+    label: "Cloud SQL database",
+    target(inputs, projectId) {
+      const { instance, name } = inputs;
+      if (name !== CONVERGE_CREATED_SQL.database) return null;
+      if (typeof instance !== "string" || !/^[a-z][a-z0-9-]{0,97}$/.test(instance)) return null;
+      if ((inputs.project ?? projectId) !== projectId) return null;
+      return {
+        display: `${name} (${instance})`,
+        describeArgs: [
+          "sql",
+          "databases",
+          "describe",
+          name,
+          `--instance=${instance}`,
+          `--project=${projectId}`,
+          "--format=value(name)",
+        ],
+        importId: `projects/${projectId}/instances/${instance}/databases/${name}`,
+      };
+    },
+  },
+  "gcp:sql/user:User": {
+    label: "Cloud SQL user",
+    target(inputs, projectId) {
+      const { instance, name } = inputs;
+      if (name !== CONVERGE_CREATED_SQL.user) return null;
+      if (typeof instance !== "string" || !/^[a-z][a-z0-9-]{0,97}$/.test(instance)) return null;
+      if ((inputs.project ?? projectId) !== projectId) return null;
+      return {
+        display: `${name} (${instance})`,
+        describeArgs: [
+          "sql",
+          "users",
+          "describe",
+          name,
+          `--instance=${instance}`,
+          `--project=${projectId}`,
+          "--format=value(name)",
+        ],
+        // The provider's import id for a Postgres built-in user.
+        importId: `${projectId}/${instance}/${name}`,
+      };
+    },
+  },
 };
 
 /** A planned create the installer may adopt instead. */

package/src/agent/command.test.ts

@@ -8,7 +8,12 @@
 
 import { describe, expect, it } from "bun:test";
 import type { CommandResult, HostRunner } from "../self-hosted-release.js";
-import { applyDatabaseSide, POSTGRES_RESTART_NOTICE } from "./command.js";
+import {
+  applyArgv,
+  applyDatabaseSide,
+  POSTGRES_RESTART_NOTICE,
+  parseApplyArgs,
+} from "./command.js";
 
 function runner(published: string | null): HostRunner & { calls: string[] } {
   const calls: string[] = [];
@@ -75,3 +80,46 @@ describe("applyDatabaseSide", () => {
     expect(r.calls).toEqual([]);
   });
 });
+
+describe("agent apply argv (#1328)", () => {
+  const D = (c: string) => `sha256:${c.repeat(64)}`;
+  const request = {
+    requestId: "11111111-1111-4111-8111-111111111111",
+    targetVersion: "0.12.0",
+    trigger: "manual" as const,
+    cliPath: "/srv/.caelo/agent/cli/caelo-0.12.0/node_modules/@caelo-cms/provisioning/dist/cli.js",
+  };
+
+  it("passes the MCP-Auth-Proxy digest when the manifest names one, and the apply reads it back", () => {
+    const argv = applyArgv("/usr/bin/bun", {
+      ...request,
+      digests: { admin: D("a"), gateway: D("b"), "mcp-auth-proxy": D("d") },
+    });
+    expect(argv.slice(argv.indexOf("--mcp-auth-proxy-digest"))).toEqual([
+      "--mcp-auth-proxy-digest",
+      D("d"),
+    ]);
+    const parsed = parseApplyArgs(argv);
+    expect(parsed.success && parsed.data.mcpAuthProxyDigest).toBe(D("d"));
+  });
+
+  it("an agent of a release from before the proxy starts the apply without it", () => {
+    const argv = applyArgv("/usr/bin/bun", {
+      ...request,
+      digests: { admin: D("a"), gateway: D("b") },
+    });
+    expect(argv).not.toContain("--mcp-auth-proxy-digest");
+    const parsed = parseApplyArgs(argv);
+    expect(parsed.success).toBe(true);
+    expect(parsed.success && parsed.data.mcpAuthProxyDigest).toBeUndefined();
+  });
+
+  it("refuses a malformed proxy digest", () => {
+    const argv = [
+      ...applyArgv("/usr/bin/bun", { ...request, digests: { admin: D("a"), gateway: D("b") } }),
+      "--mcp-auth-proxy-digest",
+      "latest",
+    ];
+    expect(parseApplyArgs(argv).success).toBe(false);
+  });
+});

package/src/agent/command.ts

@@ -57,6 +57,11 @@ export interface AgentCliContext {
   emitConfig(): void;
   /** The role convergence as the superuser, including the agent's login. */
   convergeRoles(): Promise<ConvergeOutcome>;
+  /**
+   * #1338 / #1329 — as the superuser, before an upgrade's migrations: the
+   * staging database with its gateway login, and both gateway logins' limits.
+   */
+  applyPreMigrationRoles(): Promise<ConvergeOutcome>;
   /** The Compose file for `images` from config.json. */
   renderCompose(images: ReleaseImages): string;
   /** Re-write the Caddyfile (config + domains table) and reload Caddy (#891). */
@@ -417,12 +422,15 @@ function pruneVerifiedClis(caeloDir: string, keep: readonly (string | undefined)
   }
 }
 
-/** Start the target release's `agent apply` and wait for it. */
-async function spawnApply(request: AgentApplyRequest): Promise<AgentApplyOutcome> {
-  // The verified install (agent/cli-provenance.ts) — never `bun x`, which
-  // would fetch an unverified copy.
-  const argv = [
-    process.execPath,
+/**
+ * The argv that starts the target release's `agent apply` with `bun` at
+ * `execPath`: the verified install (agent/cli-provenance.ts) — never
+ * `bun x`, which would fetch an unverified copy — and the digests the signed
+ * manifest names, the MCP-Auth-Proxy's only when it names one (#1328).
+ */
+export function applyArgv(execPath: string, request: AgentApplyRequest): string[] {
+  return [
+    execPath,
     request.cliPath,
     "agent",
     "apply",
@@ -436,7 +444,15 @@ async function spawnApply(request: AgentApplyRequest): Promise<AgentApplyOutcome
     request.digests.admin,
     "--gateway-digest",
     request.digests.gateway,
+    ...(request.digests["mcp-auth-proxy"]
+      ? ["--mcp-auth-proxy-digest", request.digests["mcp-auth-proxy"]]
+      : []),
   ];
+}
+
+/** Start the target release's `agent apply` and wait for it. */
+async function spawnApply(request: AgentApplyRequest): Promise<AgentApplyOutcome> {
+  const argv = applyArgv(process.execPath, request);
   try {
     const proc = Bun.spawn(argv, {
       stdout: "pipe",
@@ -504,16 +520,25 @@ const applyArgs = z.object({
   trigger: z.enum(PLATFORM_UPDATE_TRIGGERS),
   adminDigest: digest,
   gatewayDigest: digest,
+  // #1328 — an agent of a release before the MCP-Auth-Proxy starts this
+  // without it; the signed manifest the apply reads names it anyway.
+  mcpAuthProxyDigest: digest.optional(),
 });
 
-async function agentApply(argv: readonly string[], ctx: AgentCliContext): Promise<number> {
-  const parsed = applyArgs.safeParse({
+/** The `agent apply` flags {@link applyArgv} writes, validated. */
+export function parseApplyArgs(argv: readonly string[]) {
+  return applyArgs.safeParse({
     request: flag(argv, "request"),
     version: flag(argv, "version"),
     trigger: flag(argv, "trigger"),
     adminDigest: flag(argv, "admin-digest"),
     gatewayDigest: flag(argv, "gateway-digest"),
+    mcpAuthProxyDigest: flag(argv, "mcp-auth-proxy-digest"),
   });
+}
+
+async function agentApply(argv: readonly string[], ctx: AgentCliContext): Promise<number> {
+  const parsed = parseApplyArgs(argv);
   if (!parsed.success) {
     console.error(
       `agent apply is started by the update agent, not by hand (${parsed.error.issues.map((i) => i.path.join(".")).join(", ")}).`,
@@ -539,13 +564,18 @@ async function agentApply(argv: readonly string[], ctx: AgentCliContext): Promis
         upgradeSelfHosted(
           {
             version: args.version,
-            expectedDigests: { admin: args.adminDigest, gateway: args.gatewayDigest },
+            expectedDigests: {
+              admin: args.adminDigest,
+              gateway: args.gatewayDigest,
+              ...(args.mcpAuthProxyDigest ? { "mcp-auth-proxy": args.mcpAuthProxyDigest } : {}),
+            },
           },
           {
             caeloDir: ctx.caeloDir,
             runner: bunHostRunner,
             renderCompose: (images) => ctx.renderCompose(images),
             convergeRoles: () => ctx.convergeRoles(),
+            applyPreMigrationRoles: () => ctx.applyPreMigrationRoles(),
             refreshCaddy: () => ctx.refreshCaddy(),
             log,
           },

package/src/agent/run.test.ts

@@ -198,6 +198,25 @@ describe("runAgentOnce", () => {
     expect(locks).toEqual({ taken: 1, released: 1 });
   });
 
+  it("#1328: hands over the MCP-Auth-Proxy digest the signed manifest names", async () => {
+    const withProxy: ReleaseManifest = {
+      ...MANIFEST,
+      digests: { ...MANIFEST.digests, "mcp-auth-proxy": D("d") },
+    };
+    const { deps, applied } = setup({
+      fetchManifest: async (): Promise<ReleaseManifestResult> => ({
+        ok: true,
+        manifest: withProxy,
+      }),
+    });
+    await runAgentOnce(deps);
+    expect(applied[0]?.digests).toEqual({
+      admin: D("a"),
+      gateway: D("b"),
+      "mcp-auth-proxy": D("d"),
+    });
+  });
+
   interface RefusalRow {
     readonly name: string;
     readonly over: Partial<AgentRunDeps>;

package/src/agent/run.ts

@@ -48,7 +48,12 @@ export interface AgentApplyRequest {
   readonly targetVersion: string;
   readonly trigger: PlatformUpdateTrigger;
   /** From the verified manifest: the images the target must resolve to. */
-  readonly digests: { readonly admin: string; readonly gateway: string };
+  readonly digests: {
+    readonly admin: string;
+    readonly gateway: string;
+    /** #1328 — absent in manifests of releases from before the MCP-Auth-Proxy. */
+    readonly "mcp-auth-proxy"?: string;
+  };
   /** The target's CLI, installed and provenance-verified (agent/cli-provenance.ts). */
   readonly cliPath: string;
 }
@@ -254,7 +259,11 @@ export async function runAgentOnce(deps: AgentRunDeps): Promise<AgentRunResult>
         requestId: request.id,
         targetVersion: m.version,
         trigger: request.trigger,
-        digests: { admin: m.digests.admin, gateway: m.digests.gateway },
+        digests: {
+          admin: m.digests.admin,
+          gateway: m.digests.gateway,
+          ...(m.digests["mcp-auth-proxy"] ? { "mcp-auth-proxy": m.digests["mcp-auth-proxy"] } : {}),
+        },
         cliPath: cli.cliPath,
       });
     } finally {

package/src/aws-task-roles.ts

@@ -20,12 +20,14 @@ export type AwsSecret =
   | "resend-api-key";
 
 /** A service with its own ECS task role. */
-export type AwsTaskService = "admin" | "gateway";
+export type AwsTaskService = "admin" | "gateway" | "mcp-auth-proxy";
 
 /**
  * The secrets each service's task role may read. The admin side (admin and
  * its in-process workers) reads all of them; the gateway reads only
- * public_role's password — its one database login.
+ * public_role's password — its one database login; the MCP-Auth-Proxy
+ * (#1328) reads none: remote MCP is not available on AWS, so it holds
+ * neither a database login nor the broker's keys.
  */
 export const AWS_SERVICE_SECRETS: Readonly<Record<AwsTaskService, readonly AwsSecret[]>> = {
   admin: [
@@ -37,6 +39,7 @@ export const AWS_SERVICE_SECRETS: Readonly<Record<AwsTaskService, readonly AwsSe
     "resend-api-key",
   ],
   gateway: ["public-role-password"],
+  "mcp-auth-proxy": [],
 };
 
 /**

package/src/caddy-redirects.docker.test.ts

@@ -31,6 +31,7 @@ import {
   CADDY_IMAGE,
   COMPOSE_ADMIN_UPSTREAM,
   COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   COMPOSE_REDIRECT_SNIPPETS,
   SITE_OUTPUT_ROOT,
 } from "./compose.js";
@@ -149,6 +150,7 @@ describe.skipIf(!dockerUp)(`self-hosted redirects through ${CADDY_IMAGE}`, () =>
         stagingSiteRoot: `${SITE_OUTPUT_ROOT}/output/staging/current`,
         adminUpstream: COMPOSE_ADMIN_UPSTREAM,
         gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+        mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
         domains: selfHostedSeedDomains(LIVE, STAGING),
       }),
     );

package/src/caddy-redirects.test.ts

@@ -15,6 +15,7 @@ import { caddyRedirectReloadCommand, caddyRedirectReloadScript } from "./caddy-r
 import {
   COMPOSE_ADMIN_UPSTREAM,
   COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   COMPOSE_REDIRECT_SNIPPETS,
   generateDockerCompose,
 } from "./compose.js";
@@ -26,6 +27,7 @@ const caddyfile = generateCaddyfile({
   stagingSiteRoot: "/srv/caelo/output/staging/current",
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   domains: selfHostedSeedDomains("example.com", "staging.example.com"),
 });
 
@@ -61,8 +63,9 @@ describe("Compose — Caddy picks up new redirects (#587)", () => {
   const yaml = generateDockerCompose({
     domain: "example.com",
     postgresPassword: "pgpw",
-    rolePasswords: { admin: "a", public: "p" },
+    rolePasswords: { admin: "a", public: "p", publicStaging: "ps" },
     caeloSecretKek: "0".repeat(64),
+    dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
     internalSecret: "i".repeat(48),
     diskSize: "20Gi",
     ports: { http: 80, https: 443 },

package/src/caddy-validate.test.ts

@@ -16,7 +16,12 @@ import { describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { type CaddyfileSpec, generateCaddyfile, selfHostedSeedDomains } from "./caddy.js";
-import { CADDY_IMAGE, COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM } from "./compose.js";
+import {
+  CADDY_IMAGE,
+  COMPOSE_ADMIN_UPSTREAM,
+  COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
+} from "./compose.js";
 
 const REQUIRED = process.env.CAELO_CADDY_VALIDATE === "required";
 
@@ -62,6 +67,7 @@ const base: CaddyfileSpec = {
   stagingSiteRoot: "/srv/caelo/output/staging/current",
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   domains: selfHostedSeedDomains("example.com", "staging.example.com"),
 };
 

package/src/caddy.test.ts

@@ -6,9 +6,14 @@ import {
   caddyTokenProblem,
   generateCaddyfile,
   selfHostedAdminHost,
+  selfHostedMcpHost,
   selfHostedSeedDomains,
 } from "./caddy.js";
-import { COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM } from "./compose.js";
+import {
+  COMPOSE_ADMIN_UPSTREAM,
+  COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
+} from "./compose.js";
 
 /** The inputs `cms-provision init` passes for example.com. */
 const spec: CaddyfileSpec = {
@@ -18,6 +23,7 @@ const spec: CaddyfileSpec = {
   stagingSiteRoot: "/srv/caelo/output/staging/current",
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   domains: selfHostedSeedDomains("example.com", "staging.example.com"),
 };
 
@@ -35,7 +41,39 @@ describe("self-hosted seed vhosts", () => {
       { hostname: "example.com", kind: "public", env: "production" },
       { hostname: "staging.example.com", kind: "public", env: "staging" },
     ]);
+    // #1328 — no MCP vhost until remote MCP exists on self-hosted: Caddy would
+    // otherwise chase an ACME certificate for a host without a DNS record.
+    expect(
+      selfHostedSeedDomains("example.com", "staging.example.com").some((d) => d.kind === "mcp"),
+    ).toBe(false);
     expect(selfHostedAdminHost("example.com")).toBe("admin.example.com");
+    expect(selfHostedMcpHost("example.com")).toBe("mcp.example.com");
+  });
+
+  // #1328 — the MCP-Auth-Proxy never shares an origin with the site's module JS.
+  it("serves the MCP-Auth-Proxy on its own vhost, nothing else of the site", () => {
+    const out = generateCaddyfile({
+      ...spec,
+      domains: [
+        ...selfHostedSeedDomains("example.com", "staging.example.com"),
+        { hostname: selfHostedMcpHost("example.com"), kind: "mcp", env: "production" },
+      ],
+    });
+    const block = out.slice(out.indexOf("mcp.example.com {"));
+    const mcp = block.slice(0, block.indexOf("\n}\n") + 3);
+    expect(mcp).toContain(`reverse_proxy ${COMPOSE_MCP_AUTH_PROXY_UPSTREAM}`);
+    expect(mcp).toContain('X-Robots-Tag "noindex"');
+    expect(mcp).not.toContain("file_server");
+    expect(mcp).not.toContain(COMPOSE_GATEWAY_UPSTREAM);
+    // ... and the site's vhost does not route the proxy.
+    const site = out.slice(out.indexOf("\nexample.com {"));
+    expect(site.slice(0, site.indexOf("\n}\n"))).not.toContain(COMPOSE_MCP_AUTH_PROXY_UPSTREAM);
+  });
+
+  it("refuses an MCP-Auth-Proxy upstream that would break out of its token", () => {
+    expect(() => generateCaddyfile({ ...spec, mcpAuthProxyUpstream: "x }\nevil {" })).toThrow(
+      /mcpAuthProxyUpstream/,
+    );
   });
 
   it("refuses two vhosts for one host — Caddy would reject the whole file", () => {

package/src/caddy.ts

@@ -11,6 +11,8 @@
  * Per-vhost shape:
  *   <hostname> {
  *     # admin   → reverse_proxy <adminUpstream>
+ *     # mcp     → reverse_proxy <mcpAuthProxyUpstream> (#1328: the
+ *     #           MCP-Auth-Proxy on its own host, never the site's origin)
  *     # public  → /api/* → <gatewayUpstream>; everything else is the
  *     #           static site (try_files + file_server, 404 → /404.html)
  *   }
@@ -68,7 +70,12 @@ import {
 
 export interface CaddyDomainSpec {
   readonly hostname: string;
-  readonly kind: "admin" | "public";
+  /**
+   * `mcp` (#1328) is the MCP-Auth-Proxy's own host: remote MCP's sign-in
+   * pages and its forwarder must never share an origin with the site, whose
+   * module JS could otherwise read them same-origin or toss their cookies.
+   */
+  readonly kind: "admin" | "public" | "mcp";
   readonly env: "production" | "staging";
 }
 
@@ -89,6 +96,8 @@ export interface CaddyfileSpec {
   readonly adminUpstream: string;
   /** `host:port` of the API gateway as Caddy reaches it (Compose: `caelo-gateway:8090`). */
   readonly gatewayUpstream: string;
+  /** `host:port` of the MCP-Auth-Proxy as Caddy reaches it (Compose: `caelo-mcp-auth-proxy:8095`). */
+  readonly mcpAuthProxyUpstream: string;
   readonly domains: ReadonlyArray<CaddyDomainSpec>;
 }
 
@@ -97,12 +106,25 @@ export function selfHostedAdminHost(domain: string): string {
   return `admin.${domain}`;
 }
 
+/** #1328 — the host the MCP-Auth-Proxy of a self-hosted install answers on. */
+export function selfHostedMcpHost(domain: string): string {
+  return `mcp.${domain}`;
+}
+
 /**
  * The vhosts every self-hosted install serves before an Owner adds domains
  * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
- * the staging site on its own host. The admin needs its own host — it
- * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
- * public site, and Caddy refuses two site blocks for the same address.
+ * the staging site on its own host. The admin needs its own host — it routes
+ * from `/` (`/setup`, `/login`, …), so it cannot share one with the public
+ * site, and Caddy refuses two site blocks for the same address.
+ *
+ * #1328 — the MCP-Auth-Proxy's vhost (`mcp.<domain>`, kind `mcp`) is not
+ * seeded: remote MCP needs an identity proxy in front of the admin (§11.B),
+ * which a self-hosted install does not have yet, so the proxy runs
+ * unexposed on the Compose network (E14 a: provisioned, fixed 404) — the
+ * same honest refusal as on aws and azure. Seeding it would make Caddy
+ * fetch and retry an ACME certificate for a host nobody has a DNS record
+ * for. The vhost comes with remote MCP on self-hosted.
  */
 export function selfHostedSeedDomains(domain: string, stagingDomain: string): CaddyDomainSpec[] {
   return [
@@ -154,6 +176,7 @@ export function generateCaddyfile(spec: CaddyfileSpec): string {
   assertSafeCaddyToken("stagingSiteRoot", spec.stagingSiteRoot, "token");
   assertSafeCaddyToken("adminUpstream", spec.adminUpstream, "token");
   assertSafeCaddyToken("gatewayUpstream", spec.gatewayUpstream, "token");
+  assertSafeCaddyToken("mcpAuthProxyUpstream", spec.mcpAuthProxyUpstream, "token");
 
   const hostnames = new Set<string>();
   for (const d of spec.domains) {
@@ -200,6 +223,15 @@ function vhost(d: CaddyDomainSpec, spec: CaddyfileSpec): string {
     return `${d.hostname} {${noindex}
   reverse_proxy ${spec.adminUpstream}
 }
+`;
+  }
+  if (d.kind === "mcp") {
+    // Everything on this host goes to the proxy: it answers its own 404s.
+    return `${d.hostname} {
+  header X-Robots-Tag "noindex"
+  header X-Content-Type-Options "${NOSNIFF}"
+  reverse_proxy ${spec.mcpAuthProxyUpstream}
+}
 `;
   }
   // public — API routes go to the gateway, the rest is the static site.