@caelo-cms/provisioning 0.11.9 → 0.11.11

package/stacks/gcp/index.ts

@@ -27,27 +27,33 @@ import {
   gcpBucketName,
   gcpSecretId,
   MCP_IAP_SERVICE_ACCOUNT_ID,
+  mcpAuthProxyServiceAccountId,
   runServiceAccountId,
   staticPublisherServiceAccountId,
 } from "../../dist/gcp-names.js";
 import { createSiteUrlMap } from "../../dist/gcp-url-map.js";
 import {
+  DEFAULT_ADMIN_MAX_INSTANCES,
   DEFAULT_GATEWAY_MAX_INSTANCES,
   DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
   stackPoolBudget,
 } from "../../dist/pool-budget-stack.js";
-import { mcpArmorRuleArgs } from "../../dist/remote-mcp-edge.js";
 import {
   ADMIN_MEMORY_DEFAULT,
   adminEnvContract,
   adminMediaVolume,
   adminMediaVolumeTemplate,
   CLOUD_RUN_IGNORE_CHANGES,
+  CLOUD_SQL_PSA_CONNECTION_TYPE,
+  CLOUD_SQL_SERVER_CA_MODE,
+  CLOUD_SQL_SSL_MODE,
   type CloudRunEnvVar,
   type CloudRunSlug,
+  cloudSqlDnsZoneName,
+  cloudSqlPrivateDnsName,
   databaseUrls,
   defaultStagingHost,
-  GATEWAY_TIMEOUT_SECONDS,
   gatewayEnvContract,
   REMOTE_MCP_IDENTITY_CONFIG,
   type RuntimeSecret,
@@ -115,7 +121,10 @@ const adminMemory = cfg.get("adminMemory") ?? ADMIN_MEMORY_DEFAULT;
 // against the original 25-slot Postgres default — connection exhaustion
 // took the admin offline. v0.2.49 bakes the post-incident shape so fresh
 // installs don't trip the same wall.
-const adminMaxInstances = Number.parseInt(cfg.get("adminMaxInstances") ?? "5", 10);
+const adminMaxInstances = Number.parseInt(
+  cfg.get("adminMaxInstances") ?? String(DEFAULT_ADMIN_MAX_INSTANCES),
+  10,
+);
 const gatewayMinInstances = Number.parseInt(cfg.get("gatewayMinInstances") ?? "0", 10);
 // #1254 — the gateway's scale-out is part of the connection budget: each
 // instance holds a cms_public pool.
@@ -133,6 +142,8 @@ const poolBudget = stackPoolBudget("gcp", {
   maxConnections,
   adminMaxInstances,
   gatewayMaxInstances,
+  // #1329 — the staging gateway (P3b-2) is budgeted from this release on.
+  stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
 });
 const wafAdaptiveProtection = cfg.getBoolean("wafAdaptiveProtection") ?? false;
 const backupRetentionDays = Number.parseInt(cfg.get("backupRetentionDays") ?? "7", 10);
@@ -277,6 +288,8 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
+  // #1329 — the staging gateway's login, never the live one's.
+  "public-staging-role-password": gcpSecretId(env, "public-staging-role-password"),
   // #914 / #806 — the Owner-set Google sign-in client (a placeholder until
   // then; IAP login, IAP programmatic access and the remote-MCP broker) and
   // the broker's seal key, both CLI-generated.
@@ -293,6 +306,14 @@ const publicRolePassword = pulumi.secret(
     { provider: gcpProvider },
   ).secretData,
 );
+// #1329 — public_staging_role's own password (CLI-generated like the one
+// above): the staging gateway's only login, on cms_public_staging only.
+const publicStagingRolePassword = pulumi.secret(
+  gcp.secretmanager.getSecretVersionOutput(
+    { project, secret: gcpSecretId(env, "public-staging-role-password") },
+    { provider: gcpProvider },
+  ).secretData,
+);
 
 // =========================================================================
 // Tier 4 — Cloud SQL Postgres (private IP only; HA + retention configurable)
@@ -331,6 +352,11 @@ const sqlInstance = new gcp.sql.DatabaseInstance(
       ipConfiguration: {
         ipv4Enabled: false,
         privateNetwork: network.id,
+        // #1338 — the shared CA names the instance's DNS name in its server
+        // certificate, so every client verifies it (sslmode=verify-full);
+        // unencrypted connections are refused outright.
+        serverCaMode: CLOUD_SQL_SERVER_CA_MODE,
+        sslMode: CLOUD_SQL_SSL_MODE,
       },
       deletionProtectionEnabled: deletionProtection,
     },
@@ -362,6 +388,14 @@ const pgPublicUser = new gcp.sql.User(
   { instance: sqlInstance.name, name: "public_role", password: publicRolePassword },
   opts,
 );
+// #1329 — the staging gateway's login: an Admin API user like public_role,
+// so the same membership revoke (public-role-isolation.ts) and the same
+// audit apply; migration 0530 gives it CONNECT on cms_public_staging only.
+new gcp.sql.User(
+  `${namePrefix}-pg-public-staging`,
+  { instance: sqlInstance.name, name: "public_staging_role", password: publicStagingRolePassword },
+  opts,
+);
 
 const cmsAdminDb = new gcp.sql.Database(
   `${namePrefix}-cms-admin-db`,
@@ -373,11 +407,58 @@ const cmsPublicDb = new gcp.sql.Database(
   { instance: sqlInstance.name, name: "cms_public" },
   opts,
 );
+// #1329 — staging's own data: the twin of cms_public on the same instance
+// (no extra cost), reached by the staging gateway only.
+const cmsPublicStagingDb = new gcp.sql.Database(
+  `${namePrefix}-cms-public-staging-db`,
+  { instance: sqlInstance.name, name: "cms_public_staging" },
+  opts,
+);
+
+// #1338 — the instance's DNS name, resolved to its private IP by a private
+// zone in the VPC (Cloud SQL assigns the name, it does not resolve it).
+// Every client dials this name with sslmode=verify-full; the certificate
+// names no IP. `cms-provision upgrade` converges the same zone and record
+// through gcloud (cloudsql-tls.ts); the installer adopts them (#1079).
+const sqlDnsName = sqlInstance.dnsNames.apply((names) => {
+  const name = cloudSqlPrivateDnsName(names);
+  if (!name) {
+    throw new Error(
+      `Cloud SQL instance has no ${CLOUD_SQL_PSA_CONNECTION_TYPE} DNS name; it needs the shared server CA (${CLOUD_SQL_SERVER_CA_MODE}) for verify-full connections (#1338)`,
+    );
+  }
+  return name;
+});
+const sqlDnsZone = new gcp.dns.ManagedZone(
+  `${namePrefix}-pg-dns`,
+  {
+    name: cloudSqlDnsZoneName(env),
+    dnsName: pulumi.interpolate`${sqlDnsName}.`,
+    visibility: "private",
+    privateVisibilityConfig: { networks: [{ networkUrl: network.id }] },
+    description: `Caelo ${env}: the Cloud SQL instance's DNS name inside the VPC (#1338)`,
+  },
+  opts,
+);
+const sqlDnsRecord = new gcp.dns.RecordSet(
+  `${namePrefix}-pg-dns-a`,
+  {
+    // Literal names, not the zone's outputs: the installer can then adopt
+    // a record an upgrade created (adopt-existing.ts) from the preview.
+    managedZone: cloudSqlDnsZoneName(env),
+    name: pulumi.interpolate`${sqlDnsName}.`,
+    type: "A",
+    ttl: 300,
+    rrdatas: [sqlInstance.privateIpAddress],
+  },
+  { ...opts, dependsOn: [sqlDnsZone] },
+);
 
 // Password-less connection URLs (stack-contract.ts databaseUrls); the
 // services get the password as a Secret Manager reference
-// (SERVICE_SECRET_ENV), so no revision ever carries it.
-const dbUrls = sqlInstance.privateIpAddress.apply(databaseUrls);
+// (SERVICE_SECRET_ENV), so no revision ever carries it. Tied to the record
+// so no revision boots before its database host resolves.
+const dbUrls = pulumi.all([sqlDnsName, sqlDnsRecord.id]).apply(([host]) => databaseUrls(host));
 
 // Reference pgPublicUser so Pulumi knows it's part of the dependency
 // graph (Cloud Run env-var deps don't see this directly).
@@ -475,9 +556,24 @@ const gatewaySa = new gcp.serviceaccount.Account(
   },
   opts,
 );
+// #1328 — the MCP-Auth-Proxy's own SA and (below) its secretAccessor on its
+// two secrets, nothing else. The proxy's service, NEG, backend and Cloud
+// Armor policy are the CLI's (remote-mcp.ts ensureRemoteMcpEdge, after the
+// first `up`), like the jobs: the converge creates the same on existing
+// installs, and the URL map's path rules are the CLI's already.
+const mcpAuthProxySa = new gcp.serviceaccount.Account(
+  `${namePrefix}-mcp-auth-proxy-sa`,
+  {
+    accountId: mcpAuthProxyServiceAccountId(env),
+    displayName: `Caelo ${env} MCP-Auth-Proxy`,
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
 const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
   admin: runSa,
   gateway: gatewaySa,
+  "mcp-auth-proxy": mcpAuthProxySa,
 };
 
 // secretAccessor for each service's SA on exactly the secrets its env reads.
@@ -486,6 +582,7 @@ const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
 const secretBindings: Record<CloudRunSlug, gcp.secretmanager.SecretIamMember[]> = {
   admin: [],
   gateway: [],
+  "mcp-auth-proxy": [],
 };
 for (const binding of runtimeSecretBindings()) {
   secretBindings[binding.service].push(
@@ -662,7 +759,8 @@ function imageTag(service: string): pulumi.Output<string> {
 }
 
 interface CloudRunArgs {
-  readonly serviceName: "admin" | "gateway";
+  /** The MCP-Auth-Proxy is CLI-owned on this stack (see mcpAuthProxySa). */
+  readonly serviceName: Exclude<CloudRunSlug, "mcp-auth-proxy">;
   readonly minInstances: number;
   readonly maxInstances: number;
   readonly memory: string;
@@ -670,8 +768,7 @@ interface CloudRunArgs {
    * Per-request timeout. Cloud Run's default is 300s (5min), which is too
    * short for the admin's SSE chat-stream — a multi-tool compose-page session
    * regularly runs 5–15 min. Pass an explicit "<n>s" Pulumi-style duration
-   * string. The gateway gets the same (#806): it proxies remote-MCP chat
-   * streams to the admin.
+   * string.
    */
   readonly timeout?: string;
   /**
@@ -702,6 +799,8 @@ const envContractInputs = {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
     public: dbUrls.public,
+    publicStagingAdmin: dbUrls.publicStagingAdmin,
+    publicStaging: dbUrls.publicStaging,
   },
 } as const;
 
@@ -776,6 +875,7 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
         pgAdminUser,
         cmsAdminDb,
         cmsPublicDb,
+        cmsPublicStagingDb,
         // The env contract names the buckets as strings; keep them ordered
         // before the services that use them.
         mediaBucket,
@@ -816,18 +916,12 @@ const gatewaySvc = cloudRunService({
   minInstances: gatewayMinInstances,
   maxInstances: gatewayMaxInstances,
   memory: "512Mi",
-  // #806 — remote MCP: chat turns stream through the gateway for minutes,
-  // so it gets the admin's 3600 s instead of Cloud Run's 300 s default
-  // (stack-contract.ts GATEWAY_TIMEOUT_SECONDS). The LB in front imposes no
-  // shorter limit on serverless NEG backends.
-  timeout: `${GATEWAY_TIMEOUT_SECONDS}s`,
+  // Visitor requests only (#1328 moved remote MCP's long streams to the
+  // MCP-Auth-Proxy): Cloud Run's default.
+  timeout: "300s",
   // public_role on cms_public only: no cms_admin login of any role
   // (#613, #635, CLAUDE.md §2).
-  contractEnv: [
-    ...gatewayEnvContract(envContractInputs),
-    ...remoteMcpEnv.gateway,
-    ...poolBudget.env.gateway,
-  ],
+  contractEnv: [...gatewayEnvContract(envContractInputs), ...poolBudget.env.gateway],
 });
 
 // =========================================================================
@@ -838,6 +932,9 @@ const gatewaySvc = cloudRunService({
 // admin.caelo-cms.com. Three backends routed by Host header / path:
 //   - host=caelo-cms.com, default          → static bucket (Cloud CDN)
 //   - host=caelo-cms.com, path=/api/*      → gateway Cloud Run (Cloud Armor)
+//   - host=caelo-cms.com, path=/api/mcp/*, /.well-known/oauth-*
+//                                          → MCP-Auth-Proxy Cloud Run (its own
+//                                            Cloud Armor; CLI-owned, #1328)
 //   - host=admin.caelo-cms.com, default    → admin Cloud Run (IAP-gated)
 //
 // CLAUDE.md §11.B Tier 2: admin behind cloud-native identity proxy. IAP
@@ -860,12 +957,10 @@ const wafPolicy = new gcp.compute.SecurityPolicy(
   {
     description: `Caelo ${env} Cloud Armor — rate limit + OWASP`,
     rules: [
-      // #806 — remote MCP (/api/mcp/*): a per-IP throttle sized for agent
-      // traffic behind shared connector IPs, evaluated first; below it the
-      // rule allows, so the OWASP packs (MCP bodies carry HTML) and the
-      // general ban below do not apply there. src/remote-mcp-edge.ts says
-      // why; `cms-provision upgrade` adds the same rule to existing installs.
-      mcpArmorRuleArgs(),
+      // #1328 — no remote-MCP rule here any more: the URL map sends
+      // /api/mcp/* to the MCP-Auth-Proxy's backend, whose own policy carries
+      // it (remote-mcp-edge.ts, created by the CLI; `upgrade` drops the old
+      // rule from this policy).
       // Rate limit per source IP — 100 req / min sliding window.
       {
         action: "rate_based_ban",
@@ -1095,6 +1190,18 @@ new gcp.iap.WebBackendServiceIamMember(
 // (packages/provisioning/src/capture-job-setup.ts), for the same reason as
 // the audit job above.
 
+// =========================================================================
+// Scheduler tick — deliberately NOT here
+// =========================================================================
+//
+// #1140 — one Cloud Scheduler job starts a Cloud Workflows execution every
+// `schedulerIntervalMinutes` (1–15, default 5); the workflow signs an IAP
+// credential as the scheduler's own service account and POSTs the admin's
+// /api/internal/scheduler/tick, where the admin runs its periodic work and
+// plugin workers from its due-table. The CLI owns the account, its grants,
+// the workflow and the job (packages/provisioning/src/scheduler-setup.ts),
+// for the same reason as the audit job above.
+
 // =========================================================================
 // Operator access — deliberately NOT here
 // =========================================================================
@@ -1265,6 +1372,7 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
+  publicStagingDatabaseUrl: dbUrls.publicStaging as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
   bootstrapUrl:
@@ -1278,6 +1386,7 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const publicStagingDatabaseUrlOut = out.publicStagingDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp-firebase/Pulumi.yaml

@@ -58,7 +58,7 @@ config:
     description: Admin Cloud Run memory. 2Gi leaves room for the Lighthouse quality audit next to editor requests; billed only while an instance runs.
   caelo-gcp-firebase:adminMaxInstances:
     type: string
-    default: "5"
+    default: "4"
     description: Admin Cloud Run max instances.
   caelo-gcp-firebase:maxConnections:
     type: string