@caelo-cms/provisioning 0.2.83 → 0.2.84
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/stacks/gcp/index.ts +4 -28
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@caelo-cms/provisioning",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.84",
|
|
4
4
|
"private": false,
|
|
5
5
|
"license": "MPL-2.0",
|
|
6
6
|
"description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
"prepublishOnly": "tsc -b --force"
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
|
-
"@caelo-cms/shared": "^0.2.
|
|
41
|
+
"@caelo-cms/shared": "^0.2.84",
|
|
42
42
|
"@clack/prompts": "1.3.0",
|
|
43
43
|
"@pulumi/aws": "^7",
|
|
44
44
|
"@pulumi/awsx": "^3",
|
package/stacks/gcp/index.ts
CHANGED
|
@@ -152,38 +152,14 @@ const cookieSecretBytes = new random.RandomBytes(`${namePrefix}-cookie-secret-by
|
|
|
152
152
|
});
|
|
153
153
|
const kekBytes = new random.RandomBytes(`${namePrefix}-secret-kek-bytes`, { length: 32 });
|
|
154
154
|
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
// program changed from `randomHex(32)` to RandomBytes and treats
|
|
159
|
-
// the SecretVersion's secretData as having changed → creates v6).
|
|
160
|
-
// To preserve the live KEK across that transition the operator can:
|
|
161
|
-
//
|
|
162
|
-
// gcloud secrets versions access latest \
|
|
163
|
-
// --secret=caelo-production-secret-kek \
|
|
164
|
-
// | pulumi config set --secret caelo-gcp:secret-kek-hex --stdin
|
|
165
|
-
// pulumi up
|
|
166
|
-
//
|
|
167
|
-
// With the config set, Pulumi sees the SecretVersion's secretData
|
|
168
|
-
// equals the live value → no diff → no rotation. The same shape
|
|
169
|
-
// works for the three other auto-rotated secrets if an operator
|
|
170
|
-
// wants to preserve them (csrf-secret rotation only invalidates
|
|
171
|
-
// open sessions; cookie-secret same; postgres-password is generally
|
|
172
|
-
// harmless because Cloud SQL accepts whatever the latest version
|
|
173
|
-
// says).
|
|
174
|
-
const kekHexOverride = cfg.getSecret("secret-kek-hex");
|
|
175
|
-
const csrfSecretOverride = cfg.getSecret("csrf-secret-hex");
|
|
176
|
-
const cookieSecretOverride = cfg.getSecret("cookie-secret-hex");
|
|
177
|
-
const pgPasswordOverride = cfg.getSecret("postgres-password-hex");
|
|
178
|
-
|
|
179
|
-
const postgresPassword = pgPasswordOverride ?? pulumi.secret(pgPasswordBytes.hex);
|
|
180
|
-
const csrfSecret = csrfSecretOverride ?? pulumi.secret(csrfSecretBytes.hex);
|
|
181
|
-
const cookieSecret = cookieSecretOverride ?? pulumi.secret(cookieSecretBytes.hex);
|
|
155
|
+
const postgresPassword = pulumi.secret(pgPasswordBytes.hex);
|
|
156
|
+
const csrfSecret = pulumi.secret(csrfSecretBytes.hex);
|
|
157
|
+
const cookieSecret = pulumi.secret(cookieSecretBytes.hex);
|
|
182
158
|
// P18 — project KEK (32 bytes hex) encrypts AI provider API keys
|
|
183
159
|
// + future at-rest secrets in cms_admin. Stable across `pulumi up`
|
|
184
160
|
// (see comment above). Cloud Run binds it as CAELO_SECRET_KEK env
|
|
185
161
|
// via `valueSource.secretKeyRef` below.
|
|
186
|
-
const caeloSecretKek =
|
|
162
|
+
const caeloSecretKek = pulumi.secret(kekBytes.hex);
|
|
187
163
|
// anthropicApiKey is now OPTIONAL — operators configure the key via
|
|
188
164
|
// /security/ai (encrypted into ai_providers) after first login. Setting
|
|
189
165
|
// it via Pulumi config is supported as a backwards-compat path for
|