@caelo-cms/provisioning 0.2.48 → 0.2.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/provisioning",
-  "version": "0.2.48",
+  "version": "0.2.50",
   "private": false,
   "license": "MPL-2.0",
   "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -38,7 +38,7 @@
     "prepublishOnly": "tsc -b --force"
   },
   "dependencies": {
-    "@caelo-cms/shared": "^0.2.48",
+    "@caelo-cms/shared": "^0.2.50",
     "@clack/prompts": "1.3.0",
     "@pulumi/aws": "^7",
     "@pulumi/awsx": "^3",

package/stacks/gcp/Pulumi.yaml

@@ -54,6 +54,22 @@ config:
     type: string
     default: "0"
     description: Admin Cloud Run min instances. 0 = scale to zero. 1 = no cold start (+~$15/mo).
+  caelo-gcp:adminMaxInstances:
+    type: string
+    default: "5"
+    description: |
+      Admin Cloud Run max instances. Default 5 caps the connection-pool
+      footprint at ~100 Postgres conns (Bun SQL pool max=10, two pools per
+      admin instance). Bump alongside maxConnections + cloudSqlTier when
+      sizing for heavy editorial traffic.
+  caelo-gcp:maxConnections:
+    type: string
+    default: "100"
+    description: |
+      Postgres max_connections database flag. Default 100 matches the safe
+      ceiling for adminMaxInstances=5 + light gateway traffic. Cloud SQL's
+      db-f1-micro defaults to 25 — too low for any sustained admin load.
+      Tune up alongside cloudSqlTier when scaling out.
   caelo-gcp:gatewayMinInstances:
     type: string
     default: "0"

package/stacks/gcp/README.md

@@ -26,6 +26,12 @@ pulumi config set caelo-gcp:ownerEmail me@example.com
 pulumi config set caelo-gcp:project my-gcp-project
 pulumi config set caelo-gcp:region us-central1
 
+# Optional: scale up beyond the safe-by-default ceiling. The defaults
+# size for a small editorial install (admin maxScale 5 × Bun SQL pool
+# max 10 × 2 pools = 100 conns, matching Postgres max_connections=100).
+# pulumi config set caelo-gcp:adminMaxInstances 10
+# pulumi config set caelo-gcp:maxConnections 200
+
 # Build + push images. Operator does this once + on every release.
 gcloud auth configure-docker us-central1-docker.pkg.dev
 gcloud builds submit ... --tag us-central1-docker.pkg.dev/$PROJECT/caelo/admin:latest

package/stacks/gcp/index.ts

@@ -42,7 +42,26 @@ const cloudSqlEdition = cfg.get("cloudSqlEdition") ?? "ENTERPRISE";
 // wants to `caelo-cms destroy` shouldn't hit a wall).
 const deletionProtection = cfg.getBoolean("deletionProtection") ?? false;
 const adminMinInstances = Number.parseInt(cfg.get("adminMinInstances") ?? "0", 10);
+// adminMaxInstances default is intentionally low. Each admin process holds
+// TWO Bun SQL pools (admin_role on cms_admin + admin_role on cms_public),
+// each with default pool-max=10 → up to ~20 connections per instance under
+// sustained load. With db-f1-micro's tunable max_connections, even 5 admin
+// instances saturate the pool (5 × 20 = 100 = our default ceiling below).
+// Operators on larger SQL tiers should bump maxConnections AND
+// adminMaxInstances together.
+//
+// Why 5, not 10 (Cloud Run's default)? An incident on production showed
+// admin scaling to 10 under bursty editor traffic, demanding 200 slots
+// against the original 25-slot Postgres default — connection exhaustion
+// took the admin offline. v0.2.49 bakes the post-incident shape so fresh
+// installs don't trip the same wall.
+const adminMaxInstances = Number.parseInt(cfg.get("adminMaxInstances") ?? "5", 10);
 const gatewayMinInstances = Number.parseInt(cfg.get("gatewayMinInstances") ?? "0", 10);
+// Postgres connection slot ceiling. Cloud SQL's db-f1-micro defaults to 25,
+// which 1 admin pool exhausts under load (Bun SQL pool-max=10, two pools per
+// admin instance, plus gateway + migrations + backup-agent overhead). 100 is
+// the safe floor for a small editorial install — tune up alongside SQL tier.
+const maxConnections = Number.parseInt(cfg.get("maxConnections") ?? "100", 10);
 const wafAdaptiveProtection = cfg.getBoolean("wafAdaptiveProtection") ?? false;
 const backupRetentionDays = Number.parseInt(cfg.get("backupRetentionDays") ?? "7", 10);
 // IAP allowlist: comma-list of "user:<email>" or "group:<group@domain>".
@@ -188,6 +207,12 @@ const sqlInstance = new gcp.sql.DatabaseInstance(
       diskSize: 20,
       diskType: "PD_SSD",
       diskAutoresize: true,
+      // db-f1-micro defaults max_connections=25, which a single
+      // admin Cloud Run instance can exhaust under load (Bun SQL
+      // pool-max=10, two pools per admin process). Override at
+      // instance level so the cap matches the Cloud Run scale-out
+      // headroom defined by adminMaxInstances + gatewayMaxInstances.
+      databaseFlags: [{ name: "max_connections", value: maxConnections.toString() }],
       backupConfiguration: {
         enabled: true,
         pointInTimeRecoveryEnabled: cloudSqlHa,
@@ -490,7 +515,7 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
 const adminSvc = cloudRunService({
   serviceName: "admin",
   minInstances: adminMinInstances,
-  maxInstances: 10,
+  maxInstances: adminMaxInstances,
   memory: "1Gi",
   // Admin's second pool: admin_role on cms_public for cross-DB reads
   // + DDL + migrations. NOT public_role (write-limited).