@caelo-cms/provisioning 0.11.9 → 0.11.11

package/src/checkpoint-secrets.test.ts

@@ -32,14 +32,20 @@ import {
 import { databaseUrls } from "./stack-contract.js";
 
 const FAKE_PW = "fakePw0rdForTests123";
-const legacyAdminUrl = `postgresql://admin_role:${FAKE_PW}@10.1.2.3:5432/cms_admin?sslmode=require`;
-const legacyPublicUrl = `postgresql://public_role:${FAKE_PW}@10.1.2.3:5432/cms_public?sslmode=require`;
+const legacyAdminUrl = `postgresql://admin_role:${FAKE_PW}@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem`;
+const legacyPublicUrl = `postgresql://public_role:${FAKE_PW}@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem`;
 const setupLink = "https://admin.acme.test/setup?token=fakeSetupToken0123456789";
 
 /** What `pulumi up` returns on the current stacks, secret flags included. */
 const stackOutputs = {
-  adminDatabaseUrlOut: { value: databaseUrls("10.1.2.3").admin, secret: false },
-  publicDatabaseUrlOut: { value: databaseUrls("10.1.2.3").public, secret: false },
+  adminDatabaseUrlOut: {
+    value: databaseUrls("db1.p-label.europe-west1.sql-psa.goog").admin,
+    secret: false,
+  },
+  publicDatabaseUrlOut: {
+    value: databaseUrls("db1.p-label.europe-west1.sql-psa.goog").public,
+    secret: false,
+  },
   bootstrapUrlOut: { value: setupLink, secret: false },
   bootstrapTokenExpiresAtOut: { value: "2026-10-13T00:00:00.000Z", secret: false },
   providerOut: { value: "gcp", secret: false },
@@ -97,7 +103,7 @@ describe("findSecrets", () => {
   });
 
   it("does not flag the password-less database URLs the stacks export today", () => {
-    expect(findSecrets(databaseUrls("10.1.2.3"))).toEqual([]);
+    expect(findSecrets(databaseUrls("db1.p-label.europe-west1.sql-psa.goog"))).toEqual([]);
   });
 
   it("flags secret-named keys holding a value, not markers or look-alikes", () => {
@@ -314,7 +320,9 @@ describe("redactCredentials", () => {
   it("masks URL passwords and leaves the rest readable", () => {
     const out = redactCredentials(`connect failed: ${legacyAdminUrl} (timeout)`);
     expect(out).not.toContain(FAKE_PW);
-    expect(out).toContain("postgresql://admin_role:***@10.1.2.3:5432/cms_admin");
+    expect(out).toContain(
+      "postgresql://admin_role:***@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin",
+    );
     expect(redactCredentials("https://admin.acme.test/x")).toBe("https://admin.acme.test/x");
   });
 });

package/src/cli-routing.test.ts

@@ -61,7 +61,7 @@ describe("initDelegatesToWizard", () => {
 describe("CLI_COMMANDS / cliUsage", () => {
   it("prints the usage line operators already know, built from the catalogue", () => {
     expect(cliUsage().split("\n")[0]).toBe(
-      "Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] [--local|--install-job] | <init|up|migrate|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|staging-domain|owner-reset|state migrate|attach|pulumi-output-sync|version> [options]",
+      "Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r> [--scheduler-interval-minutes 1-15]] [--local|--install-job] | <init|up|migrate|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|staging-domain|owner-reset|state migrate|attach|pulumi-output-sync|version> [options]",
     );
   });
 

package/src/cli-routing.ts

@@ -174,7 +174,7 @@ export const CLI_COMMANDS: readonly CliCommandDoc[] = [
 /** The text `cms-provision --help` prints, built from {@link CLI_COMMANDS}. */
 export function cliUsage(): string {
   return (
-    `Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] [--local|--install-job] | <${CLI_COMMANDS.map((c) => c.name).join("|")}> [options]\n` +
+    `Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r> [--scheduler-interval-minutes 1-15]] [--local|--install-job] | <${CLI_COMMANDS.map((c) => c.name).join("|")}> [options]\n` +
     "With several installs on this machine, pick one with --install <install-id or domain> (status, upgrade and backup also take --install all); in a terminal you are asked otherwise.\n" +
     "Pass --no-wizard with no sub-command to print this usage instead of the wizard."
   );

package/src/cli.ts

@@ -63,6 +63,7 @@ import {
   BOOTSTRAP_DIR,
   COMPOSE_ADMIN_UPSTREAM,
   COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   type ComposeImages,
   composeProjectName,
   generateDockerCompose,
@@ -75,6 +76,7 @@ import {
 } from "./compose.js";
 import { tightenPrivateTree, writePrivateFile } from "./private-file.js";
 import { selfCommand } from "./self-command.js";
+import { ensureSelfHostedDbTls, selfHostedDbTlsServerCertSha256 } from "./self-hosted-db-tls.js";
 import { ensureInternalSecret, writeInternalSecret } from "./self-hosted-internal-secret.js";
 import {
   bunHostRunner,
@@ -84,10 +86,12 @@ import {
   resolveVerifiedRelease,
 } from "./self-hosted-release.js";
 import {
+  applyPreMigrationRoles,
   convergeSelfHostedRoles,
   decideUp,
   selfHostedBootstrapScript,
 } from "./self-hosted-roles.js";
+import { parseSchedulerIntervalMinutes } from "./stack-contract.js";
 
 interface CaeloConfig {
   domain: string;
@@ -150,6 +154,12 @@ interface CaeloConfig {
    * carry it).
    */
   composeProject?: string;
+  /**
+   * #1140 — the `schedulerIntervalMinutes` knob (`init
+   * --scheduler-interval-minutes`, 1–15): how often the scheduler container
+   * calls the admin's tick. Absent: the default (5).
+   */
+  schedulerIntervalMinutes?: number;
 }
 
 const REPO_ROOT = resolve(import.meta.dir, "../../..");
@@ -252,6 +262,15 @@ function loadConfig(): CaeloConfig | null {
     cfg.composeProject ??= "caelo";
     saveConfig(cfg);
   }
+  // #1329 — the staging gateway's login came with the staging database. An
+  // install from before gets its own password now; the next `up` or
+  // upgrade creates the role with it (self-hosted-roles.ts) before anything
+  // uses it, so the roles count as not converged until then.
+  if (cfg.rolePasswords && !cfg.rolePasswords.publicStaging) {
+    cfg.rolePasswords = { ...cfg.rolePasswords, publicStaging: randomSecret(32) };
+    cfg.rolesConverged = false;
+    saveConfig(cfg);
+  }
   return cfg;
 }
 
@@ -266,9 +285,9 @@ function arg(name: string): string | undefined {
   return process.argv[idx + 1];
 }
 
-/** Fresh passwords for the two application roles. */
+/** Fresh passwords for the application roles. */
 function newRolePasswords(): RolePasswords {
-  return { admin: randomSecret(32), public: randomSecret(32) };
+  return { admin: randomSecret(32), public: randomSecret(32), publicStaging: randomSecret(32) };
 }
 
 function emitConfig(cfg: CaeloConfig, extraDomains: CaddyDomainSpec[] = []): void {
@@ -305,6 +324,7 @@ function writeCaddyfile(cfg: CaeloConfig, extraDomains: CaddyDomainSpec[]): void
     // localhost (#707).
     adminUpstream: COMPOSE_ADMIN_UPSTREAM,
     gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+    mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
     domains: dedupeDomains([
       ...selfHostedSeedDomains(cfg.domain, cfg.stagingDomain),
       ...extraDomains,
@@ -344,6 +364,9 @@ function renderCompose(cfg: CaeloConfig, images: ComposeImages): string {
       "config has no ports / composeProject — they are back-filled on load; this is a bug",
     );
   }
+  // #1338 — the install's database CA + server certificate the Compose file
+  // mounts (created once, the server certificate renewed when due).
+  for (const line of ensureSelfHostedDbTls(CAELO_DIR)) console.log(`  database TLS: ${line}`);
   return generateDockerCompose({
     domain: cfg.domain,
     postgresPassword: cfg.postgresPassword,
@@ -351,6 +374,7 @@ function renderCompose(cfg: CaeloConfig, images: ComposeImages): string {
     caeloSecretKek: cfg.caeloSecretKek,
     // #770 — every render (up, upgrade, agent apply) hands the admin the
     // secret host-side commands sign their /api/internal/* tokens with.
+    dbTlsServerCertSha256: selfHostedDbTlsServerCertSha256(CAELO_DIR),
     internalSecret: ensureInternalSecret(CAELO_DIR, {
       randomSecret: () => randomSecret(48),
       report: (line) => console.log(line),
@@ -361,6 +385,9 @@ function renderCompose(cfg: CaeloConfig, images: ComposeImages): string {
     images,
     ports: cfg.ports,
     project: cfg.composeProject,
+    ...(cfg.schedulerIntervalMinutes !== undefined
+      ? { schedulerIntervalMinutes: cfg.schedulerIntervalMinutes }
+      : {}),
     ...(activeAgent(cfg) ? { agent: activeAgent(cfg) } : {}),
   });
 }
@@ -397,6 +424,20 @@ function agentContext(cfg: CaeloConfig): AgentCliContext {
         ...(activeAgent(cfg) ? { agentPassword: activeAgent(cfg)?.dbPassword } : {}),
       });
     },
+    applyPreMigrationRoles: () => {
+      if (!cfg.rolePasswords) {
+        return Promise.resolve({
+          ok: false as const,
+          reachable: true,
+          error: "config.json has no role passwords — run `cms-provision up` first",
+        });
+      }
+      return applyPreMigrationRoles({
+        probe: postgresIsUp,
+        psql: superuserPsql,
+        stagingPassword: cfg.rolePasswords.publicStaging,
+      });
+    },
     renderCompose: (images) => renderCompose(cfg, images),
     refreshCaddy: () => refreshCaddyfile(cfg),
     randomSecret: () => randomSecret(32),
@@ -552,7 +593,7 @@ async function init(): Promise<void> {
   }
   if (!domain || !ownerEmail) {
     console.error(
-      "Usage: cms-provision init [--provider self-hosted] --domain example.com [--staging-domain staging.example.com] --owner-email me@example.com [--version x.y.z] [--skip-verify] [--dev] [--tls acme|internal] [--http-port 80] [--https-port 443]\n" +
+      "Usage: cms-provision init [--provider self-hosted] --domain example.com [--staging-domain staging.example.com] --owner-email me@example.com [--version x.y.z] [--skip-verify] [--dev] [--tls acme|internal] [--http-port 80] [--https-port 443] [--scheduler-interval-minutes 5]\n" +
         "Cloud providers (gcp | gcp-firebase | aws | azure) run the wizard: cms-provision --provider <name>",
     );
     process.exit(2);
@@ -567,6 +608,17 @@ async function init(): Promise<void> {
     console.error("--http-port and --https-port must differ");
     process.exit(2);
   }
+  const schedulerArg = arg("scheduler-interval-minutes");
+  let schedulerIntervalMinutes: number | undefined;
+  try {
+    schedulerIntervalMinutes =
+      schedulerArg === undefined
+        ? undefined
+        : parseSchedulerIntervalMinutes(schedulerArg, "--scheduler-interval-minutes");
+  } catch (e) {
+    console.error((e as Error).message);
+    process.exit(2);
+  }
   const stagingArg = arg("staging-domain");
   const stagingProblem = stagingArg
     ? stagingHostProblem(stagingArg, {
@@ -635,6 +687,7 @@ async function init(): Promise<void> {
     tls,
     ports,
     composeProject: composeProjectName(domain),
+    ...(schedulerIntervalMinutes !== undefined ? { schedulerIntervalMinutes } : {}),
   };
   saveConfig(cfg);
   // P15.1 — the shared HMAC secret for /api/internal/* endpoints, read by
@@ -1019,7 +1072,7 @@ async function upgradeSelfHostedCommand(opts: {
     console.error(
       "This is a DEV MODE install: the admin + gateway run your Caelo checkout, so there are\n" +
         "no images to upgrade. Update the checkout (git pull), then `bun packages/provisioning/src/cli.ts migrate` and\n" +
-        `\`docker compose -f ${COMPOSE_PATH} restart caelo-admin caelo-gateway\`.`,
+        `\`docker compose -f ${COMPOSE_PATH} restart caelo-admin caelo-gateway caelo-mcp-auth-proxy\`.`,
     );
     process.exit(2);
   }
@@ -1047,6 +1100,7 @@ async function upgradeSelfHostedCommand(opts: {
       runner: bunHostRunner,
       renderCompose: (images) => renderCompose(cfg, images),
       convergeRoles: agentContext(cfg).convergeRoles,
+      applyPreMigrationRoles: agentContext(cfg).applyPreMigrationRoles,
       refreshCaddy: () => refreshCaddyfile(cfg),
       log: {
         step: (m) => console.log(`\n==> ${m}`),
@@ -1614,13 +1668,25 @@ async function waitForDomainMappingCert(target: {
  * §11.C — interactive wizard. Loaded lazily so the bare-CLI startup
  * cost stays small (clack + kleur are pulled in only when needed).
  * Reads `--provider`, `--domain`, `--owner-email`, `--project-id`, `--region`,
- * `--non-interactive` and the run mode (`--local` / `--install-job`, default:
+ * `--scheduler-interval-minutes` (#1140), `--non-interactive` and the run mode (`--local` / `--install-job`, default:
  * the install job in Cloud Shell, local elsewhere — run-mode.ts) from argv.
  */
 async function wizardCommand(): Promise<void> {
   const { runWizard } = await import("./wizard.js");
   const { chooseRunMode } = await import("./run-mode.js");
+  const schedulerArg = arg("scheduler-interval-minutes");
+  let schedulerIntervalMinutes: number | undefined;
+  try {
+    schedulerIntervalMinutes =
+      schedulerArg === undefined
+        ? undefined
+        : parseSchedulerIntervalMinutes(schedulerArg, "--scheduler-interval-minutes");
+  } catch (e) {
+    console.error((e as Error).message);
+    process.exit(2);
+  }
   await runWizard({
+    ...(schedulerIntervalMinutes !== undefined ? { schedulerIntervalMinutes } : {}),
     runMode: chooseRunMode(process.argv, process.env),
     nonInteractive: process.argv.includes("--non-interactive"),
     provider: arg("provider") as Provider | undefined,

package/src/cloudsql-tls.test.ts

@@ -0,0 +1,255 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import {
+  dialsIpAddress,
+  ensureCloudSqlVerifyFull,
+  moveServicesToDnsHost,
+  urlOnDnsHost,
+} from "./cloudsql-tls.js";
+import type { GcloudResult } from "./gcloud.js";
+import type { HttpFetch } from "./runtime-secrets.js";
+
+const DNS = "abc123.p-label.europe-west1.sql-psa.goog";
+const TARGET = { projectId: "p", env: "production", sqlInstance: "caelo-production-pg-1" };
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const notFound = (): GcloudResult => ({
+  ok: false,
+  stdout: "",
+  stderr: "ERROR: (gcloud) NOT_FOUND",
+  exitCode: 1,
+});
+
+/** An instance as `gcloud sql instances describe --format=json` prints it. */
+function instance(opts: { caMode: string; sslMode: string; dns: boolean }): string {
+  return JSON.stringify({
+    settings: {
+      ipConfiguration: {
+        serverCaMode: opts.caMode,
+        sslMode: opts.sslMode,
+        privateNetwork: "projects/p/global/networks/caelo-production-vpc-1",
+      },
+    },
+    ipAddresses: [{ type: "PRIVATE", ipAddress: "10.20.0.3" }],
+    dnsNames: opts.dns
+      ? [{ name: `${DNS}.`, connectionType: "PRIVATE_SERVICES_ACCESS", dnsScope: "INSTANCE" }]
+      : [],
+  });
+}
+
+/** A fake gcloud: `answer` per call, every call recorded. */
+function fake(answer: (args: string[]) => GcloudResult) {
+  const calls: string[] = [];
+  return {
+    calls,
+    run: async (args: string[]) => {
+      calls.push(args.join(" "));
+      return answer(args);
+    },
+  };
+}
+
+/** The Cloud SQL Admin API listServerCertificates answer. */
+function certs(body: object): HttpFetch {
+  return async () => ({ ok: true, status: 200, text: async () => JSON.stringify(body) });
+}
+
+describe("ensureCloudSqlVerifyFull", () => {
+  it("moves a per-instance-CA instance to the shared CA, rotates, and makes its name resolve", async () => {
+    let described = 0;
+    const g = fake((a) => {
+      const line = a.join(" ");
+      if (line.startsWith("sql instances describe")) {
+        described += 1;
+        return ok(
+          instance(
+            described === 1
+              ? {
+                  caMode: "GOOGLE_MANAGED_INTERNAL_CA",
+                  sslMode: "ALLOW_UNENCRYPTED_AND_ENCRYPTED",
+                  dns: false,
+                }
+              : { caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: true },
+          ),
+        );
+      }
+      if (line.startsWith("auth print-access-token")) return ok("token");
+      if (line.includes(" describe ")) return notFound();
+      return ok();
+    });
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({ serverCerts: [] }),
+      sleep: async () => {},
+    });
+    expect(r).toMatchObject({ ok: true, host: DNS });
+    const writes = g.calls.filter((c) => !c.includes(" describe ") && !c.startsWith("auth"));
+    expect(writes).toEqual([
+      "sql instances patch caelo-production-pg-1 --project=p --server-ca-mode=GOOGLE_MANAGED_CAS_CA --ssl-mode=ENCRYPTED_ONLY --quiet",
+      "sql ssl server-certs create --instance=caelo-production-pg-1 --project=p",
+      "sql ssl server-certs rotate --instance=caelo-production-pg-1 --project=p --quiet",
+      `dns managed-zones create caelo-production-pg-dns --project=p --dns-name=${DNS}. --visibility=private --networks=caelo-production-vpc-1 --description=Caelo production: the Cloud SQL instance's DNS name inside the VPC (#1338)`,
+      `dns record-sets create ${DNS}. --zone=caelo-production-pg-dns --type=A --project=p --ttl=300 --rrdatas=10.20.0.3`,
+    ]);
+  });
+
+  it("reads the DNS name after the move when the shared CA's certificate is active at once", async () => {
+    // searchviu-website, v0.11.10: the patch made the shared CA's certificate
+    // the active one, so no rotation re-read the instance, and the
+    // description from before the patch named no DNS host.
+    let described = 0;
+    const g = fake((a) => {
+      const line = a.join(" ");
+      if (line.startsWith("sql instances describe")) {
+        described += 1;
+        return ok(
+          instance(
+            described === 1
+              ? { caMode: "GOOGLE_MANAGED_INTERNAL_CA", sslMode: "ENCRYPTED_ONLY", dns: false }
+              : { caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: true },
+          ),
+        );
+      }
+      if (line.startsWith("auth print-access-token")) return ok("token");
+      if (line.includes(" describe ")) return notFound();
+      return ok();
+    });
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({ activeVersion: "f1", serverCerts: [{ sha1Fingerprint: "f1" }] }),
+      sleep: async () => {},
+    });
+    expect(r).toMatchObject({ ok: true, host: DNS });
+    expect(g.calls.filter((c) => c.startsWith("sql ssl"))).toEqual([]);
+  });
+
+  it("changes nothing on an instance already in shape", async () => {
+    const g = fake((a) => {
+      const line = a.join(" ");
+      if (line.startsWith("sql instances describe")) {
+        return ok(
+          instance({ caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: true }),
+        );
+      }
+      if (line.startsWith("auth")) return ok("token");
+      if (line.startsWith("dns managed-zones describe"))
+        return ok(JSON.stringify({ dnsName: `${DNS}.` }));
+      if (line.startsWith("dns record-sets describe"))
+        return ok(JSON.stringify({ rrdatas: ["10.20.0.3"] }));
+      return ok();
+    });
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({ activeVersion: "f1", serverCerts: [{ sha1Fingerprint: "f1" }] }),
+    });
+    expect(r).toEqual({ ok: true, host: DNS, done: [] });
+    expect(g.calls.every((c) => c.includes(" describe ") || c.startsWith("auth"))).toBe(true);
+  });
+
+  it("finishes an interrupted rotation without creating a second certificate", async () => {
+    const g = fake((a) => {
+      const line = a.join(" ");
+      if (line.startsWith("sql instances describe")) {
+        return ok(
+          instance({ caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: true }),
+        );
+      }
+      if (line.startsWith("auth")) return ok("token");
+      if (line.startsWith("dns managed-zones describe"))
+        return ok(JSON.stringify({ dnsName: `${DNS}.` }));
+      if (line.startsWith("dns record-sets describe"))
+        return ok(JSON.stringify({ rrdatas: ["10.9.9.9"] }));
+      return ok();
+    });
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({
+        activeVersion: "old-per-instance",
+        serverCerts: [{ sha1Fingerprint: "upcoming" }],
+      }),
+    });
+    expect(r.ok).toBe(true);
+    expect(g.calls.some((c) => c.startsWith("sql ssl server-certs create"))).toBe(false);
+    expect(g.calls.some((c) => c.startsWith("sql ssl server-certs rotate"))).toBe(true);
+    expect(
+      g.calls.some(
+        (c) => c.startsWith("dns record-sets update") && c.endsWith("--rrdatas=10.20.0.3"),
+      ),
+    ).toBe(true);
+  });
+
+  it("refuses a zone that serves another name instead of repointing it", async () => {
+    const g = fake((a) => {
+      const line = a.join(" ");
+      if (line.startsWith("sql instances describe")) {
+        return ok(
+          instance({ caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: true }),
+        );
+      }
+      if (line.startsWith("auth")) return ok("token");
+      if (line.startsWith("dns managed-zones describe")) {
+        return ok(JSON.stringify({ dnsName: "old.p-label.europe-west1.sql-psa.goog." }));
+      }
+      return ok();
+    });
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({ activeVersion: "f1", serverCerts: [{ sha1Fingerprint: "f1" }] }),
+    });
+    expect(r).toMatchObject({ ok: false });
+    if (!r.ok) expect(r.error).toContain("serves old.p-label");
+  });
+
+  it("fails loudly when the instance names no private DNS name", async () => {
+    const g = fake((a) =>
+      a.join(" ").startsWith("sql instances describe")
+        ? ok(instance({ caMode: "GOOGLE_MANAGED_CAS_CA", sslMode: "ENCRYPTED_ONLY", dns: false }))
+        : ok("token"),
+    );
+    const r = await ensureCloudSqlVerifyFull(TARGET, {
+      run: g.run,
+      http: certs({ activeVersion: "f1", serverCerts: [{ sha1Fingerprint: "f1" }] }),
+    });
+    expect(r).toMatchObject({ ok: false });
+    if (!r.ok) expect(r.error).toContain("PRIVATE_SERVICES_ACCESS DNS name");
+  });
+});
+
+describe("moveServicesToDnsHost", () => {
+  it("switches only the URLs that dial an IP, keeping their sslmode", async () => {
+    const g = fake(() => ok());
+    const r = await moveServicesToDnsHost(
+      { projectId: "p", region: "europe-west1" },
+      [
+        {
+          serviceName: "caelo-production-admin-1",
+          liveUrls: {
+            ADMIN_DATABASE_URL: "postgresql://admin_role@10.20.0.3:5432/cms_admin?sslmode=require",
+            PUBLIC_ADMIN_DATABASE_URL:
+              "postgresql://admin_role@10.20.0.3:5432/cms_public?sslmode=require",
+          },
+        },
+        {
+          serviceName: "caelo-production-gateway-1",
+          liveUrls: { PUBLIC_DATABASE_URL: `postgresql://public_role@${DNS}:5432/cms_public` },
+        },
+      ],
+      DNS,
+      { run: g.run, sleep: async () => {} },
+    );
+    expect(r.ok).toBe(true);
+    expect(g.calls).toEqual([
+      `run services update caelo-production-admin-1 --region europe-west1 --project=p --update-env-vars=^|^ADMIN_DATABASE_URL=postgresql://admin_role@${DNS}:5432/cms_admin?sslmode=require|PUBLIC_ADMIN_DATABASE_URL=postgresql://admin_role@${DNS}:5432/cms_public?sslmode=require --quiet`,
+    ]);
+  });
+});
+
+describe("urlOnDnsHost / dialsIpAddress", () => {
+  it("tells IP-dialling URLs apart and moves only those", () => {
+    expect(dialsIpAddress("postgresql://a@10.0.0.3:5432/d")).toBe(true);
+    expect(dialsIpAddress(`postgresql://a@${DNS}:5432/d`)).toBe(false);
+    expect(dialsIpAddress("not a url")).toBe(false);
+    expect(urlOnDnsHost(`postgresql://a@${DNS}:5432/d`, "x")).toBeNull();
+  });
+});