@caelo-cms/provisioning 0.11.9 → 0.11.11

package/stacks/gcp-firebase/index.ts

@@ -7,8 +7,10 @@
  *   - Static site:  Firebase Hosting site (no LB, no BackendBucket)
  *   - Admin:        Cloud Run + custom domain mapping (admin.<domain>)
  *                   + IAP-on-Cloud-Run (no LB IAP)
- *   - Gateway:      Cloud Run + Firebase Hosting `rewrites` (no LB,
- *                   no Cloud Armor)
+ *   - Gateway:      Cloud Run `caelo-<env>-data-gateway` + Firebase
+ *                   Hosting `rewrites` (no LB, no Cloud Armor)
+ *   - MCP-Auth-Proxy: Cloud Run on its own run.app URL (#1328; the
+ *                   service that was the gateway, E13 a of #763)
  *   - Database:     Cloud SQL Postgres on private VPC IP only (same
  *                   as `gcp/`)
  *   - Workers:      share admin Cloud Run (same as `gcp/`)
@@ -35,11 +37,14 @@ import {
   gcpBucketName,
   gcpSecretId,
   MCP_IAP_SERVICE_ACCOUNT_ID,
+  mcpAuthProxyServiceAccountId,
   runServiceAccountId,
 } from "../../dist/gcp-names.js";
 import {
+  DEFAULT_ADMIN_MAX_INSTANCES,
   DEFAULT_GATEWAY_MAX_INSTANCES,
   DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
   stackPoolBudget,
 } from "../../dist/pool-budget-stack.js";
 import {
@@ -48,17 +53,27 @@ import {
   adminMediaVolume,
   adminMediaVolumeTemplate,
   CLOUD_RUN_IGNORE_CHANGES,
+  CLOUD_SQL_PSA_CONNECTION_TYPE,
+  CLOUD_SQL_SERVER_CA_MODE,
+  CLOUD_SQL_SSL_MODE,
   type CloudRunEnvVar,
   type CloudRunSlug,
+  cloudSqlDnsZoneName,
+  cloudSqlPrivateDnsName,
+  DEFAULT_MCP_AUTH_PROXY_MAX_INSTANCES,
   databaseUrls,
   defaultStagingHost,
-  GATEWAY_TIMEOUT_SECONDS,
+  fixedCloudRunServiceName,
   gatewayEnvContract,
+  INTERIM_FORWARD_ORIGIN_ENV,
+  MCP_AUTH_PROXY_TIMEOUT_SECONDS,
+  mcpAuthProxyEnvContract,
   REMOTE_MCP_IDENTITY_CONFIG,
   type RuntimeSecret,
   remoteMcpIdentityStackEnv,
   runtimeSecretBindings,
   SERVICE_CPU_IDLE,
+  SERVICE_VPC_EGRESS,
   secretFileVolumesTemplate,
 } from "../../dist/stack-contract.js";
 
@@ -96,7 +111,10 @@ const adminMinInstances = Number.parseInt(cfg.get("adminMinInstances") ?? "0", 1
 // #553 — the admin also runs the Lighthouse quality audit; same knob and
 // default on every adapter (stack-contract.ts ADMIN_MEMORY_DEFAULT).
 const adminMemory = cfg.get("adminMemory") ?? ADMIN_MEMORY_DEFAULT;
-const adminMaxInstances = Number.parseInt(cfg.get("adminMaxInstances") ?? "5", 10);
+const adminMaxInstances = Number.parseInt(
+  cfg.get("adminMaxInstances") ?? String(DEFAULT_ADMIN_MAX_INSTANCES),
+  10,
+);
 const gatewayMinInstances = Number.parseInt(cfg.get("gatewayMinInstances") ?? "0", 10);
 // #1254 — part of the connection budget (stacks/gcp has the long comment).
 const gatewayMaxInstances = Number.parseInt(
@@ -112,6 +130,8 @@ const poolBudget = stackPoolBudget("gcp-firebase", {
   maxConnections,
   adminMaxInstances,
   gatewayMaxInstances,
+  // #1329 — the staging gateway (P3b-2) is budgeted from this release on.
+  stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
 });
 const backupRetentionDays = Number.parseInt(cfg.get("backupRetentionDays") ?? "7", 10);
 const iapAllowlistRaw = cfg.get("iapAllowlist");
@@ -249,6 +269,8 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
+  // #1329 — the staging gateway's login, never the live one's.
+  "public-staging-role-password": gcpSecretId(env, "public-staging-role-password"),
   // #914 / #806 — the Owner-set Google sign-in client (a placeholder until
   // then; IAP login, IAP programmatic access and the remote-MCP broker) and
   // the broker's seal key, both CLI-generated.
@@ -265,6 +287,14 @@ const publicRolePassword = pulumi.secret(
     { provider: gcpProvider },
   ).secretData,
 );
+// #1329 — public_staging_role's own password (CLI-generated like the one
+// above): the staging gateway's only login, on cms_public_staging only.
+const publicStagingRolePassword = pulumi.secret(
+  gcp.secretmanager.getSecretVersionOutput(
+    { project, secret: gcpSecretId(env, "public-staging-role-password") },
+    { provider: gcpProvider },
+  ).secretData,
+);
 
 // =========================================================================
 // Tier 4 — Cloud SQL Postgres (private IP only; HA configurable)
@@ -293,6 +323,11 @@ const sqlInstance = new gcp.sql.DatabaseInstance(
         ipv4Enabled: false,
         privateNetwork: network.id,
         enablePrivatePathForGoogleCloudServices: true,
+        // #1338 — the shared CA names the instance's DNS name in its server
+        // certificate, so every client verifies it (sslmode=verify-full);
+        // unencrypted connections are refused outright.
+        serverCaMode: CLOUD_SQL_SERVER_CA_MODE,
+        sslMode: CLOUD_SQL_SSL_MODE,
       },
       databaseFlags: [
         { name: "max_connections", value: maxConnections.toString() },
@@ -316,6 +351,13 @@ const cmsPublicDb = new gcp.sql.Database(
   { instance: sqlInstance.name, name: "cms_public" },
   opts,
 );
+// #1329 — staging's own data: the twin of cms_public on the same instance
+// (no extra cost), reached by the staging gateway only.
+const cmsPublicStagingDb = new gcp.sql.Database(
+  `${namePrefix}-cms-public-staging`,
+  { instance: sqlInstance.name, name: "cms_public_staging" },
+  opts,
+);
 
 const pgAdminUser = new gcp.sql.User(
   `${namePrefix}-admin-user`,
@@ -334,10 +376,58 @@ new gcp.sql.User(
   { instance: sqlInstance.name, name: "public_role", password: publicRolePassword },
   opts,
 );
+// #1329 — the staging gateway's login: an Admin API user like public_role,
+// so the same membership revoke (public-role-isolation.ts) and the same
+// audit apply; migration 0530 gives it CONNECT on cms_public_staging only.
+new gcp.sql.User(
+  `${namePrefix}-public-staging-user`,
+  { instance: sqlInstance.name, name: "public_staging_role", password: publicStagingRolePassword },
+  opts,
+);
+
+// #1338 — the instance's DNS name, resolved to its private IP by a private
+// zone in the VPC (Cloud SQL assigns the name, it does not resolve it).
+// Every client dials this name with sslmode=verify-full; the certificate
+// names no IP. `cms-provision upgrade` converges the same zone and record
+// through gcloud (cloudsql-tls.ts); the installer adopts them (#1079).
+const sqlDnsName = sqlInstance.dnsNames.apply((names) => {
+  const name = cloudSqlPrivateDnsName(names);
+  if (!name) {
+    throw new Error(
+      `Cloud SQL instance has no ${CLOUD_SQL_PSA_CONNECTION_TYPE} DNS name; it needs the shared server CA (${CLOUD_SQL_SERVER_CA_MODE}) for verify-full connections (#1338)`,
+    );
+  }
+  return name;
+});
+const sqlDnsZone = new gcp.dns.ManagedZone(
+  `${namePrefix}-pg-dns`,
+  {
+    name: cloudSqlDnsZoneName(env),
+    dnsName: pulumi.interpolate`${sqlDnsName}.`,
+    visibility: "private",
+    privateVisibilityConfig: { networks: [{ networkUrl: network.id }] },
+    description: `Caelo ${env}: the Cloud SQL instance's DNS name inside the VPC (#1338)`,
+  },
+  opts,
+);
+const sqlDnsRecord = new gcp.dns.RecordSet(
+  `${namePrefix}-pg-dns-a`,
+  {
+    // Literal names, not the zone's outputs: the installer can then adopt
+    // a record an upgrade created (adopt-existing.ts) from the preview.
+    managedZone: cloudSqlDnsZoneName(env),
+    name: pulumi.interpolate`${sqlDnsName}.`,
+    type: "A",
+    ttl: 300,
+    rrdatas: [sqlInstance.privateIpAddress],
+  },
+  { ...opts, dependsOn: [sqlDnsZone] },
+);
 
 // Password-less connection URLs (stack-contract.ts databaseUrls); the
-// services get the password as a Secret Manager reference.
-const dbUrls = sqlInstance.privateIpAddress.apply(databaseUrls);
+// services get the password as a Secret Manager reference. Tied to the
+// record so no revision boots before its database host resolves.
+const dbUrls = pulumi.all([sqlDnsName, sqlDnsRecord.id]).apply(([host]) => databaseUrls(host));
 
 // =========================================================================
 // Media bucket — private, signed-URL access only (same as `gcp` stack)
@@ -380,9 +470,22 @@ const gatewaySa = new gcp.serviceaccount.Account(
   },
   opts,
 );
+// #1328 — the MCP-Auth-Proxy's own SA: secretAccessor on its two secrets
+// below and nothing else — no project role, not even the log writer (Cloud
+// Run ships a container's stdout to Cloud Logging without one).
+const mcpAuthProxySa = new gcp.serviceaccount.Account(
+  `${namePrefix}-mcp-auth-proxy-sa`,
+  {
+    accountId: mcpAuthProxyServiceAccountId(env),
+    displayName: `Caelo ${env} MCP-Auth-Proxy`,
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
 const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
   admin: runSa,
   gateway: gatewaySa,
+  "mcp-auth-proxy": mcpAuthProxySa,
 };
 
 // secretAccessor for each service's SA on exactly the secrets its env reads.
@@ -391,6 +494,7 @@ const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
 const secretBindings: Record<CloudRunSlug, gcp.secretmanager.SecretIamMember[]> = {
   admin: [],
   gateway: [],
+  "mcp-auth-proxy": [],
 };
 for (const binding of runtimeSecretBindings()) {
   secretBindings[binding.service].push(
@@ -533,11 +637,19 @@ const firebaseCustomDomain = new gcp.firebase.HostingCustomDomain(
 );
 
 // =========================================================================
-// Cloud Run services — admin + gateway
+// Cloud Run services — admin, data gateway, MCP-Auth-Proxy
 // =========================================================================
 
 interface CloudRunArgs {
-  readonly serviceName: "admin" | "gateway";
+  readonly serviceName: CloudRunSlug;
+  /**
+   * The Pulumi resource name, when it is not `${namePrefix}-<serviceName>`.
+   * #1328 E13 a: the proxy keeps the logical name the gateway had, so Pulumi
+   * keeps the same resource and its auto-generated service name — an alias
+   * under a new name would let the provider pick a new name, and a new
+   * service means a new run.app URL.
+   */
+  readonly resourceName?: string;
   readonly minInstances: number;
   readonly maxInstances: number;
   readonly memory: string;
@@ -582,9 +694,13 @@ function imageRef(service: string): string {
 const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));
 
 function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
+  // #1328 — the data gateway has a fixed name: the converge creates it on
+  // installs whose stack predates it, and the installer adopts that one.
+  const fixedName = fixedCloudRunServiceName("gcp-firebase", env, args.serviceName);
   return new gcp.cloudrunv2.Service(
-    `${namePrefix}-${args.serviceName}`,
+    args.resourceName ?? `${namePrefix}-${args.serviceName}`,
     {
+      ...(fixedName ? { name: fixedName } : {}),
       location: region,
       ingress: args.ingress,
       // v0.3.1 — Cloud Run native IAP. With this on, every request
@@ -604,8 +720,8 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
           ? { executionEnvironment: args.mediaVolume.executionEnvironment }
           : {}),
         // The admin's media bucket, plus each service's secret files (#806:
-        // the gateway's remote-MCP OAuth client) — both from the contract
-        // upgrade applies to existing installs.
+        // the MCP-Auth-Proxy's remote-MCP OAuth client) — both from the
+        // contract upgrade applies to existing installs.
         volumes: [
           ...(args.mediaVolume?.volumes ?? []),
           ...secretFileVolumesTemplate(args.serviceName, env).volumes,
@@ -625,10 +741,16 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
             },
           },
         ],
-        vpcAccess: {
-          networkInterfaces: [{ network: network.name, subnetwork: subnet.name }],
-          egress: "PRIVATE_RANGES_ONLY",
-        },
+        // #1328 — the MCP-Auth-Proxy gets no route into the VPC (and so
+        // none to Cloud SQL's private IP): SERVICE_VPC_EGRESS.
+        ...(SERVICE_VPC_EGRESS[args.serviceName]
+          ? {
+              vpcAccess: {
+                networkInterfaces: [{ network: network.name, subnetwork: subnet.name }],
+                egress: "PRIVATE_RANGES_ONLY",
+              },
+            }
+          : {}),
       },
     },
     {
@@ -639,6 +761,7 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
         pgAdminUser,
         cmsAdminDb,
         cmsPublicDb,
+        cmsPublicStagingDb,
         // The env contract names the media bucket as a string; keep it
         // ordered before the services that use it.
         mediaBucket,
@@ -666,33 +789,58 @@ const envContractInputs = {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
     public: dbUrls.public,
+    publicStagingAdmin: dbUrls.publicStagingAdmin,
+    publicStaging: dbUrls.publicStaging,
   },
 } as const;
 
-// Gateway provisioned first so we can pass its name/region into the
-// admin's env (the Firebase publisher needs them to wire rewrites).
+// The data gateway is provisioned first so its name/region can go into the
+// admin's env (the Firebase publisher wires the /api/** rewrite to it).
+// #1328 — a service of its own (`caelo-<env>-data-gateway`); before, the
+// gateway was also the remote-MCP broker.
 const gatewaySvc = cloudRunService({
   serviceName: "gateway",
   minInstances: gatewayMinInstances,
   maxInstances: gatewayMaxInstances,
   memory: "512Mi",
-  // #806 — remote MCP: chat turns stream through the gateway for minutes
-  // (stack-contract.ts GATEWAY_TIMEOUT_SECONDS). The Firebase Hosting
-  // rewrite keeps its own 60 s cut; MCP clients use the gateway's Cloud Run
-  // URL directly.
-  timeout: `${GATEWAY_TIMEOUT_SECONDS}s`,
-  // #650 — all traffic: the gateway also serves staging.<domain> through
-  // a Cloud Run domain mapping (`cms-provision staging-domain enable`),
-  // and Cloud Run refuses domain-mapped requests under an internal-only
-  // ingress. Exposure is unchanged in substance: the service was already
-  // invokable by allUsers (gateway-public-invoker below) and every /api
-  // request passes its rate limits, captcha and honeypot; staging requests
-  // pass the staging access gate.
+  // Firebase Hosting cuts a rewritten request at 60 s anyway.
+  timeout: "300s",
+  // #650 — all traffic: `cms-provision staging-domain enable` maps the
+  // staging host onto the data gateway (Cloud Run refuses domain-mapped
+  // requests under an internal-only ingress), and it is invokable by
+  // allUsers anyway (data-gateway-public-invoker below): every /api request
+  // passes its rate limits, captcha and honeypot; staging requests pass the
+  // staging access gate.
+  ingress: "INGRESS_TRAFFIC_ALL",
+  contractEnv: [...gatewayEnvContract(envContractInputs), ...poolBudget.env.gateway],
+});
+
+// #1328 — the MCP-Auth-Proxy: remote MCP's sign-in broker and its stream to
+// the IAP-protected admin, with no database, no VPC route and an account
+// that reads two secrets. E13 (a) of #763: it is the resource that was the
+// gateway (same logical name), so its service and run.app URL — the address every
+// connector in claude.ai / ChatGPT holds, and the Google sign-in client's
+// registered redirect URI — stay as they were. Always deployed at minimum
+// zero; while remote MCP is not set up it answers a fixed 404 (E14 a).
+const mcpAuthProxySvc = cloudRunService({
+  serviceName: "mcp-auth-proxy",
+  resourceName: `${namePrefix}-gateway`,
+  minInstances: 0,
+  maxInstances: DEFAULT_MCP_AUTH_PROXY_MAX_INSTANCES,
+  memory: "512Mi",
+  // #806 — chat turns stream for minutes (MCP_AUTH_PROXY_TIMEOUT_SECONDS);
+  // MCP clients call its run.app URL, never the Firebase rewrite (which
+  // buffers streams and cuts at 60 s).
+  timeout: `${MCP_AUTH_PROXY_TIMEOUT_SECONDS}s`,
+  // Public: MCP clients reach it directly; until #1331 the staging host's
+  // domain mapping (#650) still points at this service too, and the proxy
+  // forwards that traffic to the data gateway (INTERIM_FORWARD_ORIGIN_ENV).
   ingress: "INGRESS_TRAFFIC_ALL",
   contractEnv: [
-    ...gatewayEnvContract(envContractInputs),
-    ...remoteMcpEnv.gateway,
-    ...poolBudget.env.gateway,
+    ...mcpAuthProxyEnvContract({ provider: "gcp-firebase", env }),
+    ...remoteMcpEnv["mcp-auth-proxy"],
+    // FIXME(issue #1331): goes with the staging cutover.
+    { name: INTERIM_FORWARD_ORIGIN_ENV, value: gatewaySvc.uri },
   ],
 });
 
@@ -751,7 +899,7 @@ const adminSvc = cloudRunService({
 // authentication remain the real security boundary, exactly as
 // designed.
 new gcp.cloudrunv2.ServiceIamMember(
-  `${namePrefix}-gateway-public-invoker`,
+  `${namePrefix}-data-gateway-public-invoker`,
   {
     project,
     location: region,
@@ -762,6 +910,21 @@ new gcp.cloudrunv2.ServiceIamMember(
   opts,
 );
 
+// #1328 — the MCP-Auth-Proxy: MCP clients sign in and call it without a
+// Google identity of their own. The binding the service had as the gateway,
+// under its old logical name, so it never lapses.
+new gcp.cloudrunv2.ServiceIamMember(
+  `${namePrefix}-gateway-public-invoker`,
+  {
+    project,
+    location: region,
+    name: mcpAuthProxySvc.name,
+    role: "roles/run.invoker",
+    member: "allUsers",
+  },
+  opts,
+);
+
 // v0.6.5 — `run.services.get` on the gateway for the admin runtime
 // SA. Required at DEPLOY TIME (not runtime): when the static
 // publisher creates a Firebase Hosting version with a Cloud Run
@@ -781,7 +944,7 @@ new gcp.cloudrunv2.ServiceIamMember(
 // explicit cross-service grant because the admin's runSa is a
 // DIFFERENT-resource caller from the gateway's perspective.
 new gcp.cloudrunv2.ServiceIamMember(
-  `${namePrefix}-gateway-viewer-for-admin-sa`,
+  `${namePrefix}-data-gateway-viewer-for-admin-sa`,
   {
     project,
     location: region,
@@ -1001,6 +1164,18 @@ new gcp.iap.WebCloudRunServiceIamMember(
 // (packages/provisioning/src/capture-job-setup.ts), for the same reason as
 // the audit job above.
 
+// =========================================================================
+// Scheduler tick — deliberately NOT here
+// =========================================================================
+//
+// #1140 — one Cloud Scheduler job starts a Cloud Workflows execution every
+// `schedulerIntervalMinutes` (1–15, default 5); the workflow signs an IAP
+// credential as the scheduler's own service account and POSTs the admin's
+// /api/internal/scheduler/tick, where the admin runs its periodic work and
+// plugin workers from its due-table. The CLI owns the account, its grants,
+// the workflow and the job (packages/provisioning/src/scheduler-setup.ts),
+// for the same reason as the audit job above.
+
 // =========================================================================
 // Operator access — deliberately NOT here
 // =========================================================================
@@ -1085,6 +1260,7 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
+  publicStagingDatabaseUrl: dbUrls.publicStaging as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   // Firebase Hosting serves media via its own CDN; we proxy through
   // the Firebase site's apex domain for canonical URLs.
@@ -1101,6 +1277,7 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const publicStagingDatabaseUrlOut = out.publicStagingDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;
@@ -1110,6 +1287,7 @@ export const providerOut = out.provider;
 export const environmentOut = out.environment;
 export const adminCloudRunUrlOut = adminSvc.uri;
 export const gatewayCloudRunUrlOut = gatewaySvc.uri;
+export const mcpAuthProxyCloudRunUrlOut = mcpAuthProxySvc.uri;
 export const adminDomainOut = adminDomain;
 export const firebaseSiteIdOut = firebaseSiteId;
 export const bootstrapTokenExpiresAtOut = tokenInfo.expiresAt;

package/stacks/self-hosted/Pulumi.yaml

@@ -29,3 +29,6 @@ config:
     type: string
     default: "2Gi"
     description: Memory reserved for the admin container (it runs the Lighthouse quality audit).
+  caelo-self-hosted:schedulerIntervalMinutes:
+    type: integer
+    description: Minutes between scheduler ticks (1-15, default 5; #1140). On an install `cms-provision init` set up, `.caelo/config.json` records it and this key must match.

package/stacks/self-hosted/README.md

@@ -20,10 +20,11 @@ pulumi config set caelo-self-hosted:ownerEmail me@example.com
 # verified and recorded in .caelo/release.json:
 pulumi config set caelo-self-hosted:adminImage ghcr.io/caelo-cms/admin@sha256:<digest>
 pulumi config set caelo-self-hosted:gatewayImage ghcr.io/caelo-cms/gateway@sha256:<digest>
+pulumi config set caelo-self-hosted:mcpAuthProxyImage ghcr.io/caelo-cms/mcp-auth-proxy@sha256:<digest>
 pulumi up
 ```
 
-Pulumi mints the postgres and role passwords and the KEK, generates `docker-compose.yml` + `Caddyfile` + `bootstrap.sh` + `pending-token.json` under `.caelo/`, starts Postgres, runs the migrations and runs `docker compose up -d`. Point DNS for `<domain>`, `admin.<domain>` and `staging.<domain>` at the host. After the run:
+Pulumi mints the postgres and role passwords and the KEK, generates `docker-compose.yml` + `Caddyfile` + `bootstrap.sh` + `pending-token.json` under `.caelo/`, starts Postgres, runs the migrations and runs `docker compose up -d`. Point DNS for `<domain>`, `admin.<domain>` and `staging.<domain>` at the host. The MCP sign-in service (`caelo-mcp-auth-proxy`) runs without a public host: remote MCP needs an identity proxy in front of the admin, which self-hosted installs do not have yet, so it only answers 404 and Caddy does not expose it. After the run:
 
 ```bash
 pulumi stack output bootstrapUrl
@@ -32,6 +33,10 @@ pulumi stack output bootstrapUrl
 
 Open that URL once Caddy has issued the cert (~30 s).
 
+## Scheduler tick
+
+The Compose file runs a `caelo-scheduler` container (the admin image, no database access, only the internal secret it signs with) that POSTs the admin's `/api/internal/scheduler/tick` every `schedulerIntervalMinutes` (#1140; 1–15, default 5). The admin runs its periodic work and plugin workers on that tick. Set the interval with `cms-provision init --scheduler-interval-minutes 2` (recorded in `.caelo/config.json`, which every CLI render reads) or, on an install without a `config.json`, with `pulumi config set caelo-self-hosted:schedulerIntervalMinutes 2`. The stack reads `.caelo/config.json` too, so a `pulumi up` keeps the recorded interval; a Pulumi key that disagrees with it is refused. An install from before the scheduler gets the container on its next `upgrade`, which rewrites the Compose file.
+
 ## Connection budget
 
 The generated Compose file starts Postgres with `max_connections=100` and sizes every pool from it (#1254, docs/dev/connection-budget.md): the admin gets a cms_admin pool of 77 and a cms_public pool of 4, the gateway a pool of 2, and static builds 2 per pool.

package/stacks/self-hosted/index.ts

@@ -29,11 +29,17 @@ import { generateCaddyfile, selfHostedAdminHost, selfHostedSeedDomains } from ".
 import {
   COMPOSE_ADMIN_UPSTREAM,
   COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   composeProjectName,
   generateDockerCompose,
   SITE_OUTPUT_ROOT,
 } from "../../dist/compose.js";
+import { MIGRATION_TARGETS } from "../../dist/migration-targets.js";
 import { selfHostedBootstrapScript } from "../../dist/self-hosted-roles.js";
+import {
+  recordedSchedulerIntervalMinutes,
+  selfHostedSchedulerIntervalMinutes,
+} from "../../dist/self-hosted-scheduler-interval.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -43,12 +49,26 @@ const ownerEmail = cfg.require("ownerEmail");
 const caeloDir = cfg.get("caeloDir") ?? "./.caelo";
 // #553 — same knob as every adapter; undefined = stack-contract default.
 const adminMemory = cfg.get("adminMemory");
+// #1140 — how often the scheduler container calls the admin's tick (1–15
+// minutes, default 5). `init --scheduler-interval-minutes` records it in
+// <caeloDir>/config.json, which the CLI renders from; the stack reads the
+// same record so a `pulumi up` does not put it back to the default, and
+// refuses a Pulumi key that disagrees with it.
+const caeloConfigPath = resolve(caeloDir, "config.json");
+const schedulerIntervalMinutes = selfHostedSchedulerIntervalMinutes(
+  cfg.getNumber("schedulerIntervalMinutes"),
+  recordedSchedulerIntervalMinutes(caeloConfigPath),
+  caeloConfigPath,
+);
 // #696 — the prebuilt, cosign-verified release images, pinned by digest
 // (`ghcr.io/caelo-cms/<svc>@sha256:…`; the generator refuses anything else).
 // `cms-provision init` resolves + verifies them and records them in
 // .caelo/release.json; copy those values here.
 const adminImage = cfg.require("adminImage");
 const gatewayImage = cfg.require("gatewayImage");
+// #1328 — the MCP-Auth-Proxy (remote MCP's sign-in service, its own
+// container and its own host `mcp.<domain>`).
+const mcpAuthProxyImage = cfg.require("mcpAuthProxyImage");
 
 const composePath = resolve(caeloDir, "docker-compose.yml");
 const caddyPath = resolve(caeloDir, "Caddyfile");
@@ -65,22 +85,36 @@ const postgresPassword = pulumi.secret(randomHex(32));
 // public_role one (#635: no cms_admin login).
 const adminRolePassword = pulumi.secret(randomHex(32));
 const publicRolePassword = pulumi.secret(randomHex(32));
+// #1329 — the staging gateway's own login on cms_public_staging.
+const publicStagingRolePassword = pulumi.secret(randomHex(32));
 // P18 — the KEK that encrypts stored provider keys.
 const caeloSecretKek = pulumi.secret(randomHex(32));
 
 const composeYaml = pulumi
-  .all([postgresPassword, adminRolePassword, publicRolePassword, caeloSecretKek])
-  .apply(([pgPw, adminPw, publicPw, kek]) =>
+  .all([
+    postgresPassword,
+    adminRolePassword,
+    publicRolePassword,
+    publicStagingRolePassword,
+    caeloSecretKek,
+  ])
+  .apply(([pgPw, adminPw, publicPw, publicStagingPw, kek]) =>
     generateDockerCompose({
       domain,
       postgresPassword: pgPw,
-      rolePasswords: { admin: adminPw, public: publicPw },
+      rolePasswords: { admin: adminPw, public: publicPw, publicStaging: publicStagingPw },
       caeloSecretKek: kek,
       anthropicApiKey: process.env.ANTHROPIC_API_KEY,
       resendApiKey: process.env.RESEND_API_KEY,
       diskSize: "20Gi",
       ...(adminMemory ? { adminMemory } : {}),
-      images: { mode: "release", admin: adminImage, gateway: gatewayImage },
+      ...(schedulerIntervalMinutes !== undefined ? { schedulerIntervalMinutes } : {}),
+      images: {
+        mode: "release",
+        admin: adminImage,
+        gateway: gatewayImage,
+        "mcp-auth-proxy": mcpAuthProxyImage,
+      },
       ports: { http: 80, https: 443 },
       project: composeProjectName(domain),
     }),
@@ -95,6 +129,7 @@ const caddyConf = generateCaddyfile({
   stagingSiteRoot: `${SITE_OUTPUT_ROOT}/output/staging/current`,
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   domains: selfHostedSeedDomains(domain, stagingHost),
 });
 const bootstrapScript = selfHostedBootstrapScript({ agent: false });
@@ -134,7 +169,7 @@ const composeUp = new local.Command(
     // install's admin image, then everything else.
     create: pulumi.interpolate`set -e
 docker compose -f ${composePath} up -d --wait postgres
-for target in admin public; do
+for target in ${MIGRATION_TARGETS.join(" ")}; do
   docker compose -f ${composePath} run --rm --no-deps -T caelo-admin bun --bun /app/packages/migrations/src/migrate.ts "$target"
 done
 docker compose -f ${composePath} up -d --remove-orphans`,