@caelo-cms/provisioning 0.11.9 → 0.11.11

package/src/index.test.ts

@@ -22,6 +22,7 @@ describe("Caddyfile generator", () => {
       tls: "acme",
       adminUpstream: "caelo-admin:5173",
       gatewayUpstream: "caelo-gateway:8090",
+      mcpAuthProxyUpstream: "caelo-mcp-auth-proxy:8095",
       domains: [
         { hostname: "example.com", kind: "public", env: "production" },
         { hostname: "staging.example.com", kind: "public", env: "staging" },
@@ -49,6 +50,7 @@ describe("Caddyfile generator", () => {
       tls: "acme",
       adminUpstream: "caelo-admin:5173",
       gatewayUpstream: "caelo-gateway:8090",
+      mcpAuthProxyUpstream: "caelo-mcp-auth-proxy:8095",
       domains: [],
     });
     expect(out).toContain(":8081 {");
@@ -64,6 +66,7 @@ describe("Caddy cache policy for content-hashed assets", () => {
     tls: "acme",
     adminUpstream: "caelo-admin:5173",
     gatewayUpstream: "caelo-gateway:8090",
+    mcpAuthProxyUpstream: "caelo-mcp-auth-proxy:8095",
     domains: [
       { hostname: "example.com", kind: "public", env: "production" },
       { hostname: "admin.example.com", kind: "admin", env: "production" },
@@ -149,8 +152,9 @@ describe("docker-compose generator", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "supersecret",
-      rolePasswords: { admin: "adminpw", public: "publicpw" },
+      rolePasswords: { admin: "adminpw", public: "publicpw", publicStaging: "ps" },
       caeloSecretKek: "0".repeat(64),
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
       anthropicApiKey: "sk-ant-…",
       diskSize: "20Gi",
@@ -171,8 +175,9 @@ describe("docker-compose generator", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "supersecret",
-      rolePasswords: { admin: "adminpw", public: "publicpw" },
+      rolePasswords: { admin: "adminpw", public: "publicpw", publicStaging: "ps" },
       caeloSecretKek: "0".repeat(64),
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
       diskSize: "20Gi",
       images: RELEASE_IMAGES,
@@ -181,7 +186,7 @@ describe("docker-compose generator", () => {
     });
     const gateway = out.slice(out.indexOf("caelo-gateway:"), out.indexOf("\nvolumes:"));
     expect(gateway).toContain(
-      'PUBLIC_DATABASE_URL: "postgres://public_role:publicpw@postgres:5432/cms_public"',
+      'PUBLIC_DATABASE_URL: "postgres://public_role:publicpw@postgres:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/self-hosted-ca.pem"',
     );
     expect(gateway).not.toMatch(
       /ADMIN_DATABASE|GATEWAY_DATABASE|cms_admin|admin_role|gateway_role|adminpw|gatewaypw|supersecret|CAELO_SECRET_KEK/,
@@ -196,8 +201,9 @@ describe("docker-compose generator", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: 'pa"ss',
-      rolePasswords: { admin: "a", public: "b" },
+      rolePasswords: { admin: "a", public: "b", publicStaging: "ps" },
       caeloSecretKek: "0".repeat(64),
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
       diskSize: "1Gi",
       images: RELEASE_IMAGES,

package/src/index.ts

@@ -46,12 +46,18 @@ export {
   selfHostedCdnCopy,
 } from "./cdn-copy.js";
 export { type ComposeSpec, generateDockerCompose, type RolePasswords } from "./compose.js";
+export {
+  type ConvergeDatabaseTarget,
+  convergeDatabaseTarget,
+  serverIdentityProblem,
+} from "./converge-db-trust.js";
 export {
   type ConvergeClaim,
   type ConvergeJobDeps,
   type ConvergeQueue,
   type ConvergeUpgradeOutcome,
   runConvergeJob,
+  type SecureDatabaseResult,
 } from "./converge-job.js";
 export { convergeExecutionNameError, gcpConvergeDeps } from "./converge-job-gcp.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
@@ -96,6 +102,7 @@ export {
   type RequestDecision,
 } from "./upgrader-assess.js";
 export {
+  convergeDatabaseHost,
   gcpUpgraderDeps,
   type UpgraderPlacement,
   upgraderDatabaseHost,

package/src/infra-contract.test.ts

@@ -20,8 +20,8 @@ describe("infrastructure contract steps", () => {
     );
   });
 
-  it("is at 14: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7), quality-audit job (8), converge job (9), remote MCP (10), Google sign-in (11), project-level sign-in client (12), edge security headers (13), capture job (14)", () => {
-    expect(INFRA_CONTRACT_VERSION).toBe(14);
+  it("is at 18: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7), quality-audit job (8), converge job (9), remote MCP (10), Google sign-in (11), project-level sign-in client (12), edge security headers (13), capture job (14), database verify-full TLS (15), MCP-Auth-Proxy (16), staging database (17), scheduler tick (18)", () => {
+    expect(INFRA_CONTRACT_VERSION).toBe(18);
     expect(INFRA_CONTRACT_STEPS[3]).toContain("#633");
     expect(INFRA_CONTRACT_STEPS[4]).toContain("#587");
     expect(INFRA_CONTRACT_STEPS[5]).toContain("#635");
@@ -34,6 +34,10 @@ describe("infrastructure contract steps", () => {
     expect(INFRA_CONTRACT_STEPS[12]).toContain("project's IAP settings");
     expect(INFRA_CONTRACT_STEPS[13]).toContain("#891");
     expect(INFRA_CONTRACT_STEPS[14]).toContain("#1217");
+    expect(INFRA_CONTRACT_STEPS[15]).toContain("#1338");
+    expect(INFRA_CONTRACT_STEPS[16]).toContain("#1328");
+    expect(INFRA_CONTRACT_STEPS[17]).toContain("#1329");
+    expect(INFRA_CONTRACT_STEPS[18]).toContain("#1140");
   });
 
   it("lists the pending steps oldest first", () => {
@@ -44,6 +48,6 @@ describe("infrastructure contract steps", () => {
   });
 
   it("names a version a newer release added by number", () => {
-    expect(infraStepsText(14, 15)).toBe("infrastructure step 15 (see that release's notes)");
+    expect(infraStepsText(18, 19)).toBe("infrastructure step 19 (see that release's notes)");
   });
 });

package/src/infra-contract.ts

@@ -22,7 +22,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 14;
+export const INFRA_CONTRACT_VERSION = 18;
 
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
@@ -110,6 +110,46 @@ export const INFRA_CONTRACT_VERSION = 14;
 //       CAELO_CAPTURE_BUCKET / CAELO_MEDIA_BUCKET on the admin. The new admin
 //       runs no browser itself on GCP and the app-roll moves the job's image,
 //       so it must exist before an in-cloud upgrader rolls onto it.
+//  15 — #1338: verify-full TLS to Cloud SQL. The instance moves to the
+//       shared server CA (a patch plus a server-certificate rotation) and
+//       refuses plaintext, a private Cloud DNS zone resolves its DNS name in
+//       the VPC, and the services dial that name (cloudsql-tls.ts). The new
+//       images refuse any database URL weaker than verify-full, and the
+//       in-cloud upgrader may neither patch the instance nor create a DNS
+//       zone, so it must not roll an install onto them first.
+//  16 — #1328: the MCP-Auth-Proxy, remote MCP's broker as a service of its
+//       own (no database, its own image). Its service account with
+//       secretAccessor on exactly the Google sign-in client and the seal
+//       key, and the upgrader's actAs on it. On `gcp-firebase` the visitor
+//       gateway moves to a new Cloud Run service (`caelo-<env>-data-gateway`,
+//       public invoker, the admin's run.viewer for the Firebase rewrite) and
+//       the old `gateway` service, whose run.app URL every connector holds
+//       (E13 a), becomes the proxy: new image, new account, no VPC, no
+//       database env. On `gcp` the proxy is a new service behind its own
+//       serverless NEG, backend service and Cloud Armor policy (the MCP rule
+//       moves there) and the URL map sends the MCP paths to it. New
+//       services, accounts, IAM and load-balancer resources — none of which
+//       the in-cloud upgrader may create, and the app-roll rolls three
+//       services from now on.
+//  17 — #1329: staging's own database. The Cloud SQL database
+//       `cms_public_staging`, the Admin API user `public_staging_role` (its
+//       password the new CLI-generated secret `public-staging-role-password`)
+//       and its membership revoke; the admin's PUBLIC_STAGING_ADMIN_DATABASE_URL
+//       and the gateway's CAELO_GATEWAY_ENVIRONMENT. The in-cloud upgrader
+//       may create no database, user or secret, and the new admin and
+//       gateway refuse to start without them. Additive only (converge
+//       release 1 of the gateway hardening): nothing is served from the
+//       staging database yet, so rolling back stays harmless.
+//  18 — #1140: the scheduler tick (scheduler-setup.ts). Its service account
+//       (token creator on itself, workflows.invoker, logWriter, IAP access to
+//       the admin), the Cloud Workflows workflow that signs its IAP JWT and
+//       calls the admin's /api/internal/scheduler/tick, the one Cloud
+//       Scheduler job that starts it every schedulerIntervalMinutes, the
+//       operator-access job's CAELO_OPERATOR_ACCESS_IAP_SERVICE_ACCOUNTS (so
+//       its sync keeps the account on IAP) and CAELO_SCHEDULER_SERVICE_ACCOUNT
+//       on the admin. The new admin runs its periodic work and plugin workers
+//       only on that tick, so an in-cloud upgrader must not roll an install
+//       onto it before the tick exists.
 
 /**
  * What each contract version adds, in operator terms — the upgrader's
@@ -131,6 +171,10 @@ export const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>> = {
   12: "Google sign-in at project level: the operator-access job's permission to set the sign-in client in the project's IAP settings (#914)",
   13: "the public site's security headers at the edge: nosniff on every file, uploaded SVGs no longer run as documents on the site's origin, and a one-time CDN purge (#891)",
   14: "the capture job that takes server-side screenshots outside the admin, its service account, bucket and grants (#1217)",
+  15: "verified TLS to the database: Cloud SQL's shared server CA, encrypted connections only, and a private DNS name the services dial (#1338)",
+  16: "the MCP sign-in service as its own Cloud Run service with its own account (no database access), the visitor gateway as its own service on Firebase installs, and on Google Cloud load-balancer installs the sign-in service's backend and Cloud Armor rule (#1328)",
+  17: "the staging site's own database and its gateway login, kept apart from the live data (#1329)",
+  18: "the scheduler tick that runs the admin's periodic work and plugin workers every few minutes: its service account, workflow and Cloud Scheduler job, and its IAP access (#1140)",
 };
 
 /**

package/src/install-job.ts

@@ -65,13 +65,16 @@ export const OPS_IMAGE_REPOSITORY =
  * Roles the provisioner needs on top of {@link PROVISIONER_ROLE_LIST} when it
  * runs the install job instead of the operator: the operator-access sync job
  * creates a project custom role and a Cloud Scheduler job (operator-access.ts),
- * and the job's own output has to reach Cloud Logging so the terminal can
+ * the scheduler tick deploys a Cloud Workflows workflow (scheduler-setup.ts,
+ * #1140; the converge job gets the same roles, converge-job-setup.ts), and
+ * the job's own output has to reach Cloud Logging so the terminal can
  * tail it. Granted only to installs that use the job. Not an escalation: the
  * provisioner already holds `resourcemanager.projectIamAdmin`.
  */
 export const INSTALL_JOB_ROLES = [
   "roles/iam.roleAdmin",
   "roles/cloudscheduler.admin",
+  "roles/workflows.editor",
   "roles/logging.logWriter",
 ] as const;
 

package/src/install-state.ts

@@ -115,6 +115,13 @@ export interface InstallMetadata {
    * run while it is lower than the release's (upgrade/converge.ts).
    */
   infraContractVersion?: number;
+  /**
+   * #1140 — the `schedulerIntervalMinutes` knob: how often the one Cloud
+   * Scheduler job calls the admin's tick (1–15 minutes; `--scheduler-
+   * interval-minutes` on the wizard). Absent: the default (5,
+   * stack-contract.ts SCHEDULER_INTERVAL_MINUTES).
+   */
+  schedulerIntervalMinutes?: number;
 }
 
 /** The install's staging host: its recorded setting, else the default. */
@@ -155,10 +162,25 @@ export function recordableStagingHost(host: string): string | null {
 export interface ImageDigests {
   readonly admin: string;
   readonly gateway: string;
+  /**
+   * #1328 — the MCP-Auth-Proxy's. Absent on installs recorded before it
+   * existed: their first upgrade to a release with it records it, and a
+   * stack run without it deploys the release tag's proxy image.
+   */
+  readonly "mcp-auth-proxy"?: string;
 }
 
 const DIGEST = /^sha256:[0-9a-f]{64}$/;
 
+/** {@link ImageDigests} without the keys that are absent (a JSON-stable copy). */
+function imageDigestsRecord(d: ImageDigests): ImageDigests {
+  return {
+    admin: d.admin,
+    gateway: d.gateway,
+    ...(d["mcp-auth-proxy"] ? { "mcp-auth-proxy": d["mcp-auth-proxy"] } : {}),
+  };
+}
+
 /**
  * The image digests recorded for an install, or null when none are. Throws
  * on a malformed record rather than deploying a guess.
@@ -166,7 +188,12 @@ const DIGEST = /^sha256:[0-9a-f]{64}$/;
 export function recordedImageDigests(meta: InstallMetadata): ImageDigests | null {
   const d = meta.imageDigests;
   if (d === undefined) return null;
-  if (!DIGEST.test(d.admin ?? "") || !DIGEST.test(d.gateway ?? "")) {
+  const proxy = d["mcp-auth-proxy"];
+  if (
+    !DIGEST.test(d.admin ?? "") ||
+    !DIGEST.test(d.gateway ?? "") ||
+    (proxy !== undefined && !DIGEST.test(proxy))
+  ) {
     throw new Error(
       `install.json imageDigests is malformed (${JSON.stringify(d)}); fix or remove it, then re-run.`,
     );
@@ -211,15 +238,17 @@ export function recordImageDigests(
   // drop it — a stale one would be worse than none (the upgrader job
   // refuses on none and judges downgrades by it).
   const same =
-    meta.imageDigests?.admin === digests.admin && meta.imageDigests?.gateway === digests.gateway;
+    meta.imageDigests?.admin === digests.admin &&
+    meta.imageDigests?.gateway === digests.gateway &&
+    meta.imageDigests?.["mcp-auth-proxy"] === digests["mcp-auth-proxy"];
   const { releaseVersion: previous, platformDigests: previousPlatform, ...rest } = meta;
   const version = releaseVersion ?? (same ? previous : undefined);
   // The platform forms belong to their indexes just as the version does.
   const platform = platformDigests ?? (same ? previousPlatform : undefined);
   writeMetadata(installId, {
     ...rest,
-    imageDigests: { admin: digests.admin, gateway: digests.gateway },
-    ...(platform ? { platformDigests: { admin: platform.admin, gateway: platform.gateway } } : {}),
+    imageDigests: imageDigestsRecord(digests),
+    ...(platform ? { platformDigests: imageDigestsRecord(platform) } : {}),
     ...(version ? { releaseVersion: version } : {}),
   });
 }

package/src/lifecycle.ts

@@ -60,6 +60,7 @@ import {
 } from "./runtime-secrets.js";
 import { finishSealKeyRotation, startSealKeyRotation } from "./seal-key-rotation.js";
 import { selfCommand } from "./self-command.js";
+import { CLOUD_RUN_SLUGS, type CloudRunSlug, cloudRunServicePrefix } from "./stack-contract.js";
 import {
   backendShellEnv,
   localStateNotice,
@@ -640,6 +641,9 @@ async function upgradeLockedInstall(
       domain: meta.domain,
       stagingHost,
       ownerEmail: meta.ownerEmail,
+      ...(meta.schedulerIntervalMinutes !== undefined
+        ? { schedulerIntervalMinutes: meta.schedulerIntervalMinutes }
+        : {}),
       targetTag,
       infraContractVersion: INFRA_CONTRACT_VERSION,
       skipVerify: opts.skipVerify === true,
@@ -720,6 +724,7 @@ async function gcpHealthProbe(
         domain: install.domain,
         adminServiceUrl: urls.admin as string,
         gatewayServiceUrl: urls.gateway as string,
+        mcpAuthProxyServiceUrl: urls["mcp-auth-proxy"] as string,
       },
       { run, http, sleep: realSleep, accessJustChanged: context.accessJustChanged },
     ),
@@ -880,23 +885,29 @@ export async function rotateSecretCommand(
   }
 
   if (name === SEAL_KEY_SECRET) {
-    const gateway = await resolveGcpResourceName(
+    // #1328 — the broker, and with it the seal key, lives in the MCP-Auth-Proxy.
+    const proxyPrefix = cloudRunServicePrefix(meta.provider, GCP_STACK_ENV, "mcp-auth-proxy");
+    const proxy = await resolveGcpResourceName(
       gcloud,
       "run-service",
-      "caelo-production-gateway",
+      proxyPrefix,
       meta.projectId,
       region,
     );
-    if (gateway.status !== "found") {
+    if (proxy.status !== "found") {
       log.error(
         red(
-          `${lookupFailure(gateway, "caelo-production-gateway* Cloud Run service", "operator")} — nothing rotated`,
+          `${lookupFailure(proxy, `${proxyPrefix}* Cloud Run service`, "operator")} — nothing rotated`,
         ),
       );
       return;
     }
-    const gatewayService = gateway.name;
-    const target = { projectId: meta.projectId, region, env: GCP_STACK_ENV, gatewayService };
+    const target = {
+      projectId: meta.projectId,
+      region,
+      env: GCP_STACK_ENV,
+      proxyService: proxy.name,
+    };
     const report = opts.finish
       ? await finishSealKeyRotation(target, {}, { now: opts.now === true })
       : await startSealKeyRotation(target);
@@ -910,19 +921,20 @@ export async function rotateSecretCommand(
 
   const s = spinner();
   s.start(`Rotating ${secret}...`);
-  const services: Partial<Record<"admin" | "gateway", string>> = {};
-  for (const slug of ["admin", "gateway"] as const) {
+  const services: Partial<Record<CloudRunSlug, string>> = {};
+  for (const slug of CLOUD_RUN_SLUGS) {
+    const prefix = cloudRunServicePrefix(meta.provider, GCP_STACK_ENV, slug);
     const service = await resolveGcpResourceName(
       gcloud,
       "run-service",
-      `caelo-production-${slug}`,
+      prefix,
       meta.projectId,
       region,
     );
     if (service.status !== "found") {
       s.stop(
         red(
-          `${lookupFailure(service, `caelo-production-${slug}* Cloud Run service`, "operator")} — nothing rotated`,
+          `${lookupFailure(service, `${prefix}* Cloud Run service`, "operator")} — nothing rotated`,
         ),
       );
       return;
@@ -952,7 +964,7 @@ export async function rotateSecretCommand(
       projectId: meta.projectId,
       region,
       env: GCP_STACK_ENV,
-      services: services as Record<"admin" | "gateway", string>,
+      services: services as Record<CloudRunSlug, string>,
       ...(sqlInstance ? { sqlInstance } : {}),
     },
     secret,