@caelo-cms/provisioning 0.2.79 → 0.2.81

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/provisioning",
-  "version": "0.2.79",
+  "version": "0.2.81",
   "private": false,
   "license": "MPL-2.0",
   "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -38,7 +38,7 @@
     "prepublishOnly": "tsc -b --force"
   },
   "dependencies": {
-    "@caelo-cms/shared": "^0.2.79",
+    "@caelo-cms/shared": "^0.2.81",
     "@clack/prompts": "1.3.0",
     "@pulumi/aws": "^7",
     "@pulumi/awsx": "^3",
@@ -46,6 +46,7 @@
     "@pulumi/command": "^1",
     "@pulumi/gcp": "^9",
     "@pulumi/pulumi": "^3",
+    "@pulumi/random": "^4.19.2",
     "kleur": "4.1.5"
   },
   "publishConfig": {

package/stacks/gcp/Pulumi.production.yaml

@@ -2,7 +2,7 @@ encryptionsalt: v1:mEv+SGjVDdU=:v1:1Tmd1g2Yh0KXxhp5:fGsA3LiAPntjAGUMORKO+B1gxQgI
 config:
   caelo-gcp:adminMinInstances: "0"
   caelo-gcp:anthropicApiKey:
-    secure: v1:ph6Zq48OzILq6xjh:jsEB22xYWF6SNL7e1GADWVljfl6Kd2Iqv4TYdoMABkYgOovvp5lPnFtTTZ61tEjDplnEcxjx5kWXHsYixMHpJzcIIxscT1zcneY44zJDUbvN7fSdsLehbJHMVsHj/o1oLiNqjgn5BXk/jI1mIIOIZjEQNsq9THYsWIDdAA==
+    secure: v1:/RCE2zS+Y8ZrTdcj:gIXucRKkT1vX+qg0yE8Uq3oIL+lHa23wLOheAKeR762d97ydAo332XwfteqJOgDg/scAtD2dict1NoNxNgxXpJnw1jltUi8fsF9vMt9elh2aV71eFB2oRGBlxIWbAgYdXqs/gfMxRtZ8r0dhYADuSCrtTQcI7GAFWg5EhA==
   caelo-gcp:cloudSqlHa: "false"
   caelo-gcp:cloudSqlTier: db-f1-micro
   caelo-gcp:domain: caelo-cms.com
@@ -12,5 +12,5 @@ config:
   caelo-gcp:project: caelo-website
   caelo-gcp:region: europe-west1
   caelo-gcp:wafAdaptiveProtection: "false"
-  caelo-gcp:image-digest-admin: sha256:4ba672e8445900d8d2525f8a36a3446a6d0282b32690c989fb7a09ffbc2e3b6e
-  caelo-gcp:image-digest-gateway: sha256:3cad91141f4224af50f251c176aeca13cce32708f7a3fdc82336fd1a3587615b
+  caelo-gcp:image-digest-admin: sha256:92fb8ee1267de781f37c664e34d299b2f29c6051a113fa1bdbd6fddb753ef81e
+  caelo-gcp:image-digest-gateway: sha256:b4ceac2fd371be2850f7fc9549700fcd9e595eae6144f4a87b27192adf0cd9eb

package/stacks/gcp/index.ts

@@ -19,6 +19,7 @@
 
 import * as gcp from "@pulumi/gcp";
 import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 
@@ -128,22 +129,37 @@ const sqlPeering = new gcp.servicenetworking.Connection(
 // Secret Manager — never env-var literal; runtime mounts via secret_environment_variables
 // =========================================================================
 
-function randomHex(bytes: number): string {
-  const buf = new Uint8Array(bytes);
-  crypto.getRandomValues(buf);
-  return [...buf].map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-
-const postgresPassword = pulumi.secret(randomHex(32));
-const csrfSecret = pulumi.secret(randomHex(32));
-const cookieSecret = pulumi.secret(randomHex(32));
-// P18 — project KEK (32 bytes hex) encrypts AI provider API keys + future
-// at-rest secrets in cms_admin. Auto-generated per stack so the operator
-// never types it; Cloud Run binds it as CAELO_SECRET_KEK env via
-// `valueSource.secretKeyRef` below. Rotating it requires a re-encrypt
-// CLI (deferred — the api_key_kek_fp column lets a future tool find rows
-// under the old KEK and refuse to silently return garbage).
-const caeloSecretKek = pulumi.secret(randomHex(32));
+// v0.2.81 — secrets MUST be generated by a Pulumi resource that
+// persists in stack state, NOT by `randomHex(32)` at program-eval
+// time. Pulumi re-evaluates the program on every `pulumi up`, so
+// any plain-JS random() call produces a new value each run, and
+// the matching SecretVersion gets re-created with the new value.
+// Symptom: after a re-up, all secrets encrypted under the old KEK
+// (AI provider API keys in ai_providers) became permanently
+// unreadable — and Secret Manager destroyed the prior versions
+// after their soft-delete window so recovery was impossible.
+//
+// `random.RandomBytes` materialises ONCE, persists the bytes in
+// state, reuses on subsequent runs. This is the canonical fix for
+// "auto-generated but stable" secret values in Pulumi.
+// random.RandomBytes uses the @pulumi/random provider, not the gcp
+// one — don't pass `opts` (which carries gcpProvider). Pulumi
+// auto-loads the random provider on first reference.
+const pgPasswordBytes = new random.RandomBytes(`${namePrefix}-pg-password-bytes`, { length: 32 });
+const csrfSecretBytes = new random.RandomBytes(`${namePrefix}-csrf-secret-bytes`, { length: 32 });
+const cookieSecretBytes = new random.RandomBytes(`${namePrefix}-cookie-secret-bytes`, {
+  length: 32,
+});
+const kekBytes = new random.RandomBytes(`${namePrefix}-secret-kek-bytes`, { length: 32 });
+
+const postgresPassword = pulumi.secret(pgPasswordBytes.hex);
+const csrfSecret = pulumi.secret(csrfSecretBytes.hex);
+const cookieSecret = pulumi.secret(cookieSecretBytes.hex);
+// P18 — project KEK (32 bytes hex) encrypts AI provider API keys
+// + future at-rest secrets in cms_admin. Stable across `pulumi up`
+// (see comment above). Cloud Run binds it as CAELO_SECRET_KEK env
+// via `valueSource.secretKeyRef` below.
+const caeloSecretKek = pulumi.secret(kekBytes.hex);
 // anthropicApiKey is now OPTIONAL — operators configure the key via
 // /security/ai (encrypted into ai_providers) after first login. Setting
 // it via Pulumi config is supported as a backwards-compat path for