@caelo-cms/provisioning 0.11.9 → 0.11.11

package/stacks/aws/index.ts

@@ -27,7 +27,11 @@
  * is to wire those env vars to AWS-native resources.
  */
 
-import { cloudFrontRedirectFunctionCode } from "@caelo-cms/shared";
+import {
+  AWS_RDS_CA_BUNDLE,
+  cloudFrontRedirectFunctionCode,
+  verifyFullQuery,
+} from "@caelo-cms/shared";
 import * as aws from "@pulumi/aws";
 import * as awsx from "@pulumi/awsx";
 import * as pulumi from "@pulumi/pulumi";
@@ -40,8 +44,10 @@ import {
 } from "../../dist/aws-task-roles.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 import {
+  DEFAULT_ADMIN_MAX_INSTANCES,
   DEFAULT_GATEWAY_MAX_INSTANCES,
   DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
   stackPoolBudget,
 } from "../../dist/pool-budget-stack.js";
 import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../../dist/stack-contract.js";
@@ -82,7 +88,10 @@ const maxConnections = Number.parseInt(
   cfg.get("maxConnections") ?? String(DEFAULT_MAX_CONNECTIONS.aws),
   10,
 );
-const adminMaxInstances = Number.parseInt(cfg.get("adminMaxInstances") ?? "5", 10);
+const adminMaxInstances = Number.parseInt(
+  cfg.get("adminMaxInstances") ?? String(DEFAULT_ADMIN_MAX_INSTANCES),
+  10,
+);
 const gatewayMaxInstances = Number.parseInt(
   cfg.get("gatewayMaxInstances") ?? String(DEFAULT_GATEWAY_MAX_INSTANCES),
   10,
@@ -91,6 +100,8 @@ const poolBudget = stackPoolBudget("aws", {
   maxConnections,
   adminMaxInstances,
   gatewayMaxInstances,
+  // #1329 — the staging gateway joins the budget with the staging database.
+  stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
 });
 if (_adminMemoryMiB === null) {
   throw new Error(`caelo-aws:adminMemory "${adminMemory}" is not a memory quantity (e.g. 2Gi)`);
@@ -127,6 +138,9 @@ const postgresPassword = pulumi.secret(randomHex(32));
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
 // (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
+// #1329 — the staging gateway's own login on cms_public_staging (created
+// with the database by bootstrap.sh, PUBLIC_STAGING_ROLE_PASSWORD).
+const publicStagingRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -147,6 +161,8 @@ function secret(name: string, value: pulumi.Output<string>): aws.secretsmanager.
 
 const pgSecret = secret("postgres-password", postgresPassword);
 const publicRoleSecret = secret("public-role-password", publicRolePassword);
+// #1329 — read by nothing yet: the staging gateway's task (#749) will.
+const _publicStagingRoleSecret = secret("public-staging-role-password", publicStagingRolePassword);
 const csrfSecretRes = secret("csrf-secret", csrfSecret);
 const cookieSecretRes = secret("cookie-secret", cookieSecret);
 const anthropicSecretRes = secret("anthropic-api-key", anthropicApiKey);
@@ -171,9 +187,15 @@ const dbParameters = new aws.rds.ParameterGroup(`${namePrefix}-pg-params`, {
   family: "postgres16",
   parameters: [
     { name: "max_connections", value: String(maxConnections), applyMethod: "pending-reboot" },
+    // #1338 — refuse plaintext; every client connects with verify-full.
+    { name: "rds.force_ssl", value: "1", applyMethod: "pending-reboot" },
   ],
 });
 
+// #1338 — verify-full against Amazon's RDS CA bundle (shipped in every image,
+// shared database-tls.ts); the RDS certificate names the endpoint host.
+const RDS_TLS = verifyFullQuery(AWS_RDS_CA_BUNDLE);
+
 const db = new aws.rds.Instance(`${namePrefix}-pg`, {
   engine: "postgres",
   engineVersion: "16.4",
@@ -196,14 +218,26 @@ const db = new aws.rds.Instance(`${namePrefix}-pg`, {
 const adminDatabaseUrl = pulumi
   .all([db.address, db.port, postgresPassword])
   .apply(
-    ([host, port, pw]) =>
-      `postgresql://caelo_admin:${pw}@${host}:${port}/cms_admin?sslmode=require`,
+    ([host, port, pw]) => `postgresql://caelo_admin:${pw}@${host}:${port}/cms_admin?${RDS_TLS}`,
   );
 const publicDatabaseUrl = pulumi
   .all([db.address, db.port, publicRolePassword])
+  .apply(
+    ([host, port, pw]) => `postgresql://public_role:${pw}@${host}:${port}/cms_public?${RDS_TLS}`,
+  );
+// #1329 — the admin's pool on the staging database, and the staging
+// gateway's only login (no task definition reads them before #749).
+const publicStagingAdminDatabaseUrl = pulumi
+  .all([db.address, db.port, postgresPassword])
+  .apply(
+    ([host, port, pw]) =>
+      `postgresql://caelo_admin:${pw}@${host}:${port}/cms_public_staging?${RDS_TLS}`,
+  );
+const publicStagingDatabaseUrl = pulumi
+  .all([db.address, db.port, publicStagingRolePassword])
   .apply(
     ([host, port, pw]) =>
-      `postgresql://public_role:${pw}@${host}:${port}/cms_public?sslmode=require`,
+      `postgresql://public_staging_role:${pw}@${host}:${port}/cms_public_staging?${RDS_TLS}`,
   );
 
 // === 4. S3 buckets ===
@@ -441,6 +475,16 @@ new aws.cloudwatch.LogDelivery(
 // refuses every server-side render with that gap
 // (capture/capture-backend.ts) instead of running a browser in its own task.
 //
+// FIXME(issue #749): no scheduler tick yet (#1140). On GCP one Cloud
+// Scheduler job calls the admin's /api/internal/scheduler/tick every
+// `schedulerIntervalMinutes` (src/scheduler-setup.ts), and the admin runs
+// its periodic work and plugin workers only on that tick; self-hosted has a
+// scheduler container. The AWS equivalent is one EventBridge Scheduler
+// schedule that runs a small Fargate task (or Lambda) POSTing the same
+// endpoint through the ALB's Cognito gate, with the same 1–15 minute knob.
+// Nothing calls the tick here because no admin task exists on AWS yet; it
+// lands with the admin task in #749.
+//
 // FIXME(issue #696): no in-cloud upgrader or converge job (#819) yet. On
 // GCP Settings → Updates hands app-roll releases to the upgrader job and
 // cloud-setup releases to the converge job; on AWS the admin refuses a
@@ -450,9 +494,12 @@ const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
   settings: [{ name: "containerInsights", value: "enabled" }],
 });
 
-// #806 — no remote MCP on AWS: it rides Google IAP (gcp stacks only). The
-// gateway task definition, once it exists, sets none of its env, so /api/mcp/*
-// answers 503 remote_mcp_not_configured and the admin reports it unavailable.
+// #1328 — the MCP-Auth-Proxy (remote MCP's sign-in service) is a service of
+// its own on every provider, with its own task role that may read NO secret.
+// Remote MCP rides Google IAP (gcp stacks only), so on AWS it would run with
+// CAELO_REMOTE_MCP=unavailable and answer a fixed 404. Like the admin and
+// gateway it has no task definition yet: the service lands with #749, in the
+// same shape (own origin, zero minimum tasks, no database env).
 //
 // One task role per service (#635): the gateway's may read only the
 // public_role password, never a secret that unlocks a cms_admin login
@@ -482,18 +529,23 @@ function taskRole(service: AwsTaskService): aws.iam.Role {
       ],
     }),
   });
-  new aws.iam.RolePolicy(`${prefix}-task-secrets`, {
-    role: role.id,
-    policy: pulumi
-      .all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))
-      .apply(secretsReadPolicy),
-  });
+  // A service that reads no secret gets no secrets policy at all (an empty
+  // policy is malformed, see secretsReadPolicy).
+  if (AWS_SERVICE_SECRETS[service].length > 0) {
+    new aws.iam.RolePolicy(`${prefix}-task-secrets`, {
+      role: role.id,
+      policy: pulumi
+        .all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))
+        .apply(secretsReadPolicy),
+    });
+  }
   return role;
 }
 
 const taskRoles: Record<AwsTaskService, aws.iam.Role> = {
   admin: taskRole("admin"),
   gateway: taskRole("gateway"),
+  "mcp-auth-proxy": taskRole("mcp-auth-proxy"),
 };
 
 const execRole = new aws.iam.Role(`${namePrefix}-exec-role`, {
@@ -535,6 +587,7 @@ const dnsRecordsRequired: DnsRecord[] = [
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  publicStagingDatabaseUrl: publicStagingDatabaseUrl as unknown as string,
   mediaStorageUrl: pulumi.interpolate`s3://${mediaBucket.bucket}` as unknown as string,
   mediaCdnBaseUrl:
     pulumi.interpolate`https://${distribution.domainName}/media` as unknown as string,
@@ -549,6 +602,9 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const publicStagingDatabaseUrlOut = out.publicStagingDatabaseUrl;
+// #1329 — what the admin task definition (#749) sets as PUBLIC_STAGING_ADMIN_DATABASE_URL.
+export const publicStagingAdminDatabaseUrlOut = publicStagingAdminDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;
@@ -563,6 +619,8 @@ export const rdsAddressOut = db.address;
 // The task roles the admin-side and gateway task definitions run as.
 export const adminTaskRoleArnOut = taskRoles.admin.arn;
 export const gatewayTaskRoleArnOut = taskRoles.gateway.arn;
+// #1328 — the role the MCP-Auth-Proxy task definition will run as (#749).
+export const mcpAuthProxyTaskRoleArnOut = taskRoles["mcp-auth-proxy"].arn;
 // #1254 — the pool env the admin and gateway task definitions set.
 export const poolBudgetEnvOut = poolBudget.env;
 

package/stacks/azure/index.ts

@@ -13,7 +13,8 @@
  *  4. Azure Front Door Standard serving the static website on the primary
  *     domain with a managed certificate — files served as files, no compute
  *     on the request path (CLAUDE.md §11.B Tier 1).
- *  5. Azure Container Apps (admin/gateway/orchestrator/runner),
+ *  5. Azure Container Apps (admin/gateway/orchestrator/runner, and the
+ *     MCP-Auth-Proxy without any secret, #1328),
  *     mounted with Key Vault secrets via managed identity.
  *  6. Key Vault entries (postgres-password, csrf-secret, cookie-secret,
  *     anthropic-api-key, resend-api-key).
@@ -34,16 +35,25 @@
  * env vars wired by this stack.
  */
 
+import { verifyFullQuery } from "@caelo-cms/shared";
 import * as azure from "@pulumi/azure-native";
 import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { azureFrontDoorDnsRecords } from "../../dist/azure-front-door.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
-import { DEFAULT_MAX_CONNECTIONS, stackPoolBudget } from "../../dist/pool-budget-stack.js";
+import {
+  DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
+  stackPoolBudget,
+} from "../../dist/pool-budget-stack.js";
 import {
   ADMIN_MEMORY_DEFAULT,
   azureContainerAppResources,
+  GATEWAY_ENVIRONMENT_ENV,
   GATEWAY_TRUSTED_PROXY_HOPS,
+  MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS,
+  REMOTE_MCP_MODE,
+  REMOTE_MCP_MODE_ENV,
   TRUSTED_PROXY_HOPS_ENV,
 } from "../../dist/stack-contract.js";
 import {
@@ -83,6 +93,8 @@ const poolBudget = stackPoolBudget("azure", {
   maxConnections,
   adminMaxInstances: ADMIN_SIDE_APPS * MAX_REPLICAS,
   gatewayMaxInstances: MAX_REPLICAS,
+  // #1329 — the staging gateway joins the budget with the staging database.
+  stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
 });
 // #553 — the admin runs the Lighthouse quality audit; same knob + default
 // as every adapter (stack-contract.ts). Container Apps only accepts fixed
@@ -111,6 +123,9 @@ const postgresPassword = pulumi.secret(randomHex(32));
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
 // (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
+// #1329 — the staging gateway's own login on cms_public_staging (created
+// with the database by bootstrap.sh, PUBLIC_STAGING_ROLE_PASSWORD).
+const publicStagingRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -140,6 +155,8 @@ function keyVaultSecret(shortName: string, value: pulumi.Output<string>): azure.
 
 const _pgSecret = keyVaultSecret("pg-password", postgresPassword);
 keyVaultSecret("public-role-password", publicRolePassword);
+// #1329 — read by nothing yet: the staging gateway's app (#750) will.
+keyVaultSecret("public-staging-role-password", publicStagingRolePassword);
 keyVaultSecret("csrf-secret", csrfSecret);
 keyVaultSecret("cookie-secret", cookieSecret);
 keyVaultSecret("anthropic-api-key", anthropicApiKey);
@@ -190,19 +207,44 @@ const _pgPublic = new azure.dbforpostgresql.Database(`${namePrefix}-cms-public-d
   databaseName: "cms_public",
   charset: "UTF8",
 });
+// #1329 — staging's own data, the twin of cms_public on the same server.
+const _pgPublicStaging = new azure.dbforpostgresql.Database(`${namePrefix}-cms-public-staging-db`, {
+  resourceGroupName: rg.name,
+  serverName: pgServer.name,
+  databaseName: "cms_public_staging",
+  charset: "UTF8",
+});
+
+// #1338 — verify-full to the server's FQDN. Flexible Server's certificate chains
+// to public roots (DigiCert Global Root G2, Microsoft RSA Root CA 2017) that
+// Bun trusts out of the box, so no sslrootcert (shared database-tls.ts).
+const AZURE_TLS = verifyFullQuery();
 
 const adminDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, postgresPassword])
-  .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_admin?sslmode=require`);
+  .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_admin?${AZURE_TLS}`);
 // What the admin connects to cms_public with (DDL, migrations, moderation).
 const publicAdminDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, postgresPassword])
-  .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public?sslmode=require`);
+  .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public?${AZURE_TLS}`);
 // The gateway's only login (#613, #635): public_role on cms_public. It has
 // no cms_admin login at all (CLAUDE.md §2).
 const publicDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, publicRolePassword])
-  .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?sslmode=require`);
+  .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?${AZURE_TLS}`);
+// #1329 — the admin's pool on the staging database (plugin schemas, the
+// staging half of the projection), and the staging gateway's only login.
+const publicStagingAdminDatabaseUrl = pulumi
+  .all([pgServer.fullyQualifiedDomainName, postgresPassword])
+  .apply(
+    ([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public_staging?${AZURE_TLS}`,
+  );
+const publicStagingDatabaseUrl = pulumi
+  .all([pgServer.fullyQualifiedDomainName, publicStagingRolePassword])
+  .apply(
+    ([host, pw]) =>
+      `postgresql://public_staging_role:${pw}@${host}:5432/cms_public_staging?${AZURE_TLS}`,
+  );
 
 // === 4. Storage account + containers ===
 const storage = new azure.storage.StorageAccount(`${namePrefix}-st`, {
@@ -399,6 +441,15 @@ const logWorkspace = new azure.operationalinsights.Workspace(`${namePrefix}-logs
 // refuses every server-side render with that gap
 // (capture/capture-backend.ts) instead of running a browser in its own app.
 //
+// FIXME(issue #750): no scheduler tick yet (#1140). On GCP one Cloud
+// Scheduler job calls the admin's /api/internal/scheduler/tick every
+// `schedulerIntervalMinutes` (src/scheduler-setup.ts), and the admin runs
+// its periodic work and plugin workers only on that tick; self-hosted has a
+// scheduler container. The Azure equivalent is a scheduled Container Apps
+// job (or Logic App recurrence) POSTing the same endpoint behind Easy Auth,
+// with the same 1–15 minute knob. Nothing calls the tick here because no
+// admin app exists on Azure yet; it lands with the admin in #750.
+//
 // FIXME(issue #696): no in-cloud upgrader or converge job (#819) yet. On
 // GCP Settings → Updates hands app-roll releases to the upgrader job and
 // cloud-setup releases to the converge job; on Azure the admin refuses a
@@ -437,6 +488,12 @@ interface ContainerAppArgs {
   readonly extraEnv?: ReadonlyArray<{ name: string; value: pulumi.Input<string> }>;
   /** Defaults to 0.5 vCPU / 1 GiB. */
   readonly resources?: { readonly cpu: number; readonly memory: string };
+  /**
+   * #1328 — a service that reads nothing of the install: no CAELO_ENV, no
+   * media URL, only `CAELO_PROVIDER` plus {@link extraEnv}, and zero
+   * minimum replicas in every environment (E14 a of #763).
+   */
+  readonly isolated?: true;
 }
 
 function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
@@ -454,7 +511,10 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
       },
     },
     template: {
-      scale: { minReplicas: env === "production" ? 1 : 0, maxReplicas: MAX_REPLICAS },
+      scale: {
+        minReplicas: args.isolated || env !== "production" ? 0 : 1,
+        maxReplicas: MAX_REPLICAS,
+      },
       containers: [
         {
           name: args.serviceName,
@@ -462,16 +522,18 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
           image:
             cfg.get(`image-${args.serviceName}`) ??
             `${namePrefix}.azurecr.io/${args.serviceName}:latest`,
-          env: [
-            { name: "CAELO_PROVIDER", value: "azure" },
-            { name: "CAELO_ENV", value: env },
-            ...args.databaseEnv,
-            {
-              name: "MEDIA_STORAGE_URL",
-              value: pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media`,
-            },
-            ...(args.extraEnv ?? []),
-          ],
+          env: args.isolated
+            ? [{ name: "CAELO_PROVIDER", value: "azure" }, ...(args.extraEnv ?? [])]
+            : [
+                { name: "CAELO_PROVIDER", value: "azure" },
+                { name: "CAELO_ENV", value: env },
+                ...args.databaseEnv,
+                {
+                  name: "MEDIA_STORAGE_URL",
+                  value: pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media`,
+                },
+                ...(args.extraEnv ?? []),
+              ],
           resources: args.resources ?? { cpu: 0.5, memory: "1.0Gi" },
         },
       ],
@@ -482,6 +544,7 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
 const adminDatabaseEnv = [
   { name: "ADMIN_DATABASE_URL", value: adminDatabaseUrl },
   { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicAdminDatabaseUrl },
+  { name: "PUBLIC_STAGING_ADMIN_DATABASE_URL", value: publicStagingAdminDatabaseUrl },
   ...poolBudget.env.admin,
 ];
 const adminApp = containerApp({
@@ -498,11 +561,33 @@ const _gatewayApp = containerApp({
     { name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl },
     ...poolBudget.env.gateway,
   ],
-  // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts).
-  // #806 — no remote-MCP env: remote MCP rides Google IAP (gcp stacks
-  // only); unset, the gateway answers /api/mcp/* with 503
-  // remote_mcp_not_configured and the admin reports it unavailable.
-  extraEnv: [{ name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) }],
+  // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts),
+  // and (#1329) that this is the live site's gateway.
+  extraEnv: [
+    { name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) },
+    { name: GATEWAY_ENVIRONMENT_ENV, value: "live" },
+  ],
+});
+// #1328 — the MCP-Auth-Proxy, its own Container App and so its own FQDN:
+// remote MCP's sign-in pages never share an origin with the site's module
+// JS. Remote MCP needs the admin behind Google IAP, which Azure does not
+// have, so it runs with CAELO_REMOTE_MCP=unavailable and answers everything
+// but its health check (`/api/mcp/health`) with one fixed 404; the admin
+// reports remote MCP as not available here. No database URL, no secret
+// and no managed identity, because there is nothing it may read. Same
+// shape as on every provider (E11 of #763), at zero replicas until a
+// request comes.
+const _mcpAuthProxyApp = containerApp({
+  serviceName: "mcp-auth-proxy",
+  databaseEnv: [],
+  isolated: true,
+  resources: { cpu: 0.25, memory: "0.5Gi" },
+  extraEnv: [
+    { name: REMOTE_MCP_MODE_ENV, value: REMOTE_MCP_MODE.azure },
+    { name: TRUSTED_PROXY_HOPS_ENV, value: String(MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS.azure) },
+    // The app's ingress targets 8080 (containerApp above).
+    { name: "PORT", value: "8080" },
+  ],
 });
 const _orchestratorApp = containerApp({
   serviceName: "orchestrator",
@@ -526,6 +611,7 @@ const dnsRecordsRequired = pulumi
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  publicStagingDatabaseUrl: publicStagingDatabaseUrl as unknown as string,
   mediaStorageUrl:
     pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
@@ -539,6 +625,7 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const publicStagingDatabaseUrlOut = out.publicStagingDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp/Pulumi.yaml

@@ -55,7 +55,7 @@ config:
     description: Admin Cloud Run memory. 2Gi leaves room for the Lighthouse quality audit next to editor requests; billed only while an instance runs.
   caelo-gcp:adminMaxInstances:
     type: string
-    default: "5"
+    default: "4"
     description: |
       Admin Cloud Run max instances. Each instance gets an equal share of
       the connection budget (docs/dev/connection-budget.md): at the

package/stacks/gcp/README.md

@@ -12,6 +12,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
 | Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret and public-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login). |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
+| Scheduler tick (CLI-owned, #1140) | One Cloud Scheduler job `caelo-<env>-scheduler-tick` starts the Workflows workflow of the same name every `schedulerIntervalMinutes` (1–15, default 5; `--scheduler-interval-minutes` on the installer, recorded in install.json). The workflow signs an IAP credential as `caelo-<env>-scheduler` and POSTs the admin's `/api/internal/scheduler/tick`, which runs the due periodic work and plugin workers. Set up by the installer and `upgrade` (`src/scheduler-setup.ts`), not by this stack. |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.