@caelo-cms/provisioning 0.2.82 → 0.2.83
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/stacks/gcp/index.ts +28 -4
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@caelo-cms/provisioning",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.83",
|
|
4
4
|
"private": false,
|
|
5
5
|
"license": "MPL-2.0",
|
|
6
6
|
"description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
"prepublishOnly": "tsc -b --force"
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
|
-
"@caelo-cms/shared": "^0.2.
|
|
41
|
+
"@caelo-cms/shared": "^0.2.83",
|
|
42
42
|
"@clack/prompts": "1.3.0",
|
|
43
43
|
"@pulumi/aws": "^7",
|
|
44
44
|
"@pulumi/awsx": "^3",
|
package/stacks/gcp/index.ts
CHANGED
|
@@ -152,14 +152,38 @@ const cookieSecretBytes = new random.RandomBytes(`${namePrefix}-cookie-secret-by
|
|
|
152
152
|
});
|
|
153
153
|
const kekBytes = new random.RandomBytes(`${namePrefix}-secret-kek-bytes`, { length: 32 });
|
|
154
154
|
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
155
|
+
// v0.2.83 — config-pinned override for operators upgrading from a
|
|
156
|
+
// pre-v0.2.81 install. The FIRST `pulumi up` after v0.2.81 lands
|
|
157
|
+
// would otherwise rotate the KEK one more time (Pulumi sees the
|
|
158
|
+
// program changed from `randomHex(32)` to RandomBytes and treats
|
|
159
|
+
// the SecretVersion's secretData as having changed → creates v6).
|
|
160
|
+
// To preserve the live KEK across that transition the operator can:
|
|
161
|
+
//
|
|
162
|
+
// gcloud secrets versions access latest \
|
|
163
|
+
// --secret=caelo-production-secret-kek \
|
|
164
|
+
// | pulumi config set --secret caelo-gcp:secret-kek-hex --stdin
|
|
165
|
+
// pulumi up
|
|
166
|
+
//
|
|
167
|
+
// With the config set, Pulumi sees the SecretVersion's secretData
|
|
168
|
+
// equals the live value → no diff → no rotation. The same shape
|
|
169
|
+
// works for the three other auto-rotated secrets if an operator
|
|
170
|
+
// wants to preserve them (csrf-secret rotation only invalidates
|
|
171
|
+
// open sessions; cookie-secret same; postgres-password is generally
|
|
172
|
+
// harmless because Cloud SQL accepts whatever the latest version
|
|
173
|
+
// says).
|
|
174
|
+
const kekHexOverride = cfg.getSecret("secret-kek-hex");
|
|
175
|
+
const csrfSecretOverride = cfg.getSecret("csrf-secret-hex");
|
|
176
|
+
const cookieSecretOverride = cfg.getSecret("cookie-secret-hex");
|
|
177
|
+
const pgPasswordOverride = cfg.getSecret("postgres-password-hex");
|
|
178
|
+
|
|
179
|
+
const postgresPassword = pgPasswordOverride ?? pulumi.secret(pgPasswordBytes.hex);
|
|
180
|
+
const csrfSecret = csrfSecretOverride ?? pulumi.secret(csrfSecretBytes.hex);
|
|
181
|
+
const cookieSecret = cookieSecretOverride ?? pulumi.secret(cookieSecretBytes.hex);
|
|
158
182
|
// P18 — project KEK (32 bytes hex) encrypts AI provider API keys
|
|
159
183
|
// + future at-rest secrets in cms_admin. Stable across `pulumi up`
|
|
160
184
|
// (see comment above). Cloud Run binds it as CAELO_SECRET_KEK env
|
|
161
185
|
// via `valueSource.secretKeyRef` below.
|
|
162
|
-
const caeloSecretKek = pulumi.secret(kekBytes.hex);
|
|
186
|
+
const caeloSecretKek = kekHexOverride ?? pulumi.secret(kekBytes.hex);
|
|
163
187
|
// anthropicApiKey is now OPTIONAL — operators configure the key via
|
|
164
188
|
// /security/ai (encrypted into ai_providers) after first login. Setting
|
|
165
189
|
// it via Pulumi config is supported as a backwards-compat path for
|