@wtfalch/foundry 0.37.0 → 0.39.0

package/dist/bootstrap/versions.d.ts

@@ -2,8 +2,7 @@
  * The estate's pinned third-party image/release refs for the platform
  * services foundry provisions (#247). One JSON file, so Renovate can read
  * and later propose bumps against it, instead of four separate string
- * constants it cannot see. `postgres` has no entry here: no planner step
- * pins a postgres image tag today, so there is no ref to record yet.
+ * constants it cannot see.
  */
 export interface PinnedVersions {
     zitadel: string;
@@ -17,6 +16,8 @@ export interface PinnedVersions {
     alpine: string;
     /** A static busybox, copied into the MAS image so its health check has an HTTP client. */
     busybox: string;
+    /** The sign-in database's image (#746). Its major version is the data directory's format: a bump past 16 needs a dump and restore, not an image change. */
+    postgres: string;
 }
 export declare function loadVersions(): PinnedVersions;
 export declare const VERSIONS: PinnedVersions;

package/dist/index.d.ts

@@ -54,7 +54,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/plan/backup-gate.d.ts

@@ -28,6 +28,15 @@ export declare class NetworkMoveBackupMissingError extends Error {
     readonly reason: 'no-gate' | 'no-backup' | 'by-hand';
     constructor(reason: 'no-gate' | 'no-backup' | 'by-hand');
 }
+/**
+ * The move of a company's sign-in database to the TLS image (#746) is refused before any step runs when
+ * the old database has no finished backup from the last {@link BACKUP_MAX_AGE_HOURS} hours, or the host
+ * has no backup gate. The message names no database, uuid or URL. There is no override.
+ */
+export declare class SigninDbMoveBackupMissingError extends Error {
+    readonly reason: 'no-gate' | 'no-backup';
+    constructor(reason: 'no-gate' | 'no-backup');
+}
 export interface BackupGatePorts {
     /** The company's recorded ids (`AppliedState.serviceIds`): database uuids and `backup_<db>` schedule uuids. */
     recordedIds: Readonly<Record<string, string>>;
@@ -52,8 +61,8 @@ export interface BackupGatePorts {
  * `unconfirmedUpgrades` and before any step. A service whose database the
  * company does not have passes (there is nothing to migrate); a database that
  * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
- * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
- * not covered here (plan note `backup-not-covered:mail`).
+ * old dump, or an unreadable list all refuse. `mail` is covered like the rest:
+ * Stalwart's data store is a Postgres database.
  *
  * Where this Coolify has no executions route, the fallback is that the
  * schedule exists, is enabled and saves to S3; that proves a dump is
@@ -67,6 +76,13 @@ export declare function requireFreshBackupsForUpgrades(plan: {
 }, confirmed: readonly string[] | undefined, ports: BackupGatePorts): Promise<{
     backupId: string | null;
 }>;
+/**
+ * The sign-in database move's gate (#746): the company's recorded `auth` database needs a schedule and a
+ * `success` execution not older than {@link BACKUP_MAX_AGE_HOURS} hours, read from Coolify's executions.
+ * A schedule alone proves no dump ran, so a Coolify with no executions route refuses too. Returns the
+ * uuid of the execution that passed.
+ */
+export declare function requireFreshBackupForSigninMove(ports: BackupGatePorts): Promise<string>;
 export interface MoveGatePorts {
     /** The company's Coolify project (`coolify_project`). */
     projectUuid: string | undefined;
@@ -88,6 +104,6 @@ export declare function requireFreshBackupsForMove(ports: MoveGatePorts): Promis
 /**
  * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
  * integrations each migrate their own database when the new container starts. The owner company runs its own
- * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ * sign-in, files and jobs, so the platform has no database for them; edge and hc have no Postgres.
  */
 export declare function platformDatabasesForService(service: string): readonly string[] | 'all';

package/dist/plan/backup-gate.js

@@ -44,6 +44,21 @@ export class NetworkMoveBackupMissingError extends Error {
         this.name = 'NetworkMoveBackupMissingError';
     }
 }
+/**
+ * The move of a company's sign-in database to the TLS image (#746) is refused before any step runs when
+ * the old database has no finished backup from the last {@link BACKUP_MAX_AGE_HOURS} hours, or the host
+ * has no backup gate. The message names no database, uuid or URL. There is no override.
+ */
+export class SigninDbMoveBackupMissingError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason === 'no-gate'
+            ? 'sign-in database move refused: this host has no backup gate, so a fresh backup cannot be checked'
+            : `sign-in database move refused: the old sign-in database has no finished backup from the last ${BACKUP_MAX_AGE_HOURS} hours, checked in Coolify; take one now and apply again`);
+        this.reason = reason;
+        this.name = 'SigninDbMoveBackupMissingError';
+    }
+}
 async function withinTimeout(call) {
     let timer;
     try {
@@ -123,8 +138,8 @@ function freshSuccess(executions, now, maxAgeMs = BACKUP_MAX_AGE_HOURS * 3_600_0
  * `unconfirmedUpgrades` and before any step. A service whose database the
  * company does not have passes (there is nothing to migrate); a database that
  * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
- * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
- * not covered here (plan note `backup-not-covered:mail`).
+ * old dump, or an unreadable list all refuse. `mail` is covered like the rest:
+ * Stalwart's data store is a Postgres database.
  *
  * Where this Coolify has no executions route, the fallback is that the
  * schedule exists, is enabled and saves to S3; that proves a dump is
@@ -184,6 +199,31 @@ export async function requireFreshBackupsForUpgrades(plan, confirmed, ports) {
     }
     return { backupId };
 }
+/**
+ * The sign-in database move's gate (#746): the company's recorded `auth` database needs a schedule and a
+ * `success` execution not older than {@link BACKUP_MAX_AGE_HOURS} hours, read from Coolify's executions.
+ * A schedule alone proves no dump ran, so a Coolify with no executions route refuses too. Returns the
+ * uuid of the execution that passed.
+ */
+export async function requireFreshBackupForSigninMove(ports) {
+    const now = (ports.now ?? Date.now)();
+    const databaseUuid = ports.recordedIds[companyDatabaseKeys({ id: ports.orgId }).auth];
+    const backupUuid = ports.recordedIds[backupScopeKey('auth')];
+    if (!databaseUuid || !backupUuid)
+        throw new SigninDbMoveBackupMissingError('no-backup');
+    let executions;
+    try {
+        executions = await readExecutions(ports.coolify, databaseUuid, backupUuid);
+    }
+    catch {
+        // An unreadable list is not a fresh backup. The cause stays out: it can carry a response body.
+        throw new SigninDbMoveBackupMissingError('no-backup');
+    }
+    const fresh = executions ? freshSuccess(executions, now) : null;
+    if (!fresh)
+        throw new SigninDbMoveBackupMissingError('no-backup');
+    return fresh.uuid;
+}
 /**
  * The gate for a move to the company's own network, which deletes every database of the project. It
  * fails closed and is stricter than the upgrade gate: it reads the project itself, not foundry's records.
@@ -252,10 +292,15 @@ export async function requireFreshBackupsForMove(ports) {
 /**
  * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
  * integrations each migrate their own database when the new container starts. The owner company runs its own
- * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ * sign-in, files and jobs, so the platform has no database for them; edge and hc have no Postgres.
  */
 export function platformDatabasesForService(service) {
     if (service === 'postgres')
         return 'all';
-    return service === 'archon' || service === 'ai' || service === 'integrations' ? [service] : [];
+    return service === 'archon' ||
+        service === 'ai' ||
+        service === 'integrations' ||
+        service === 'mail'
+        ? [service]
+        : [];
 }

package/dist/plan/company-backups.d.ts

@@ -11,6 +11,11 @@ import type { DraftStep } from './diff.js';
  * `app` is the hosting entry's database, recorded as a resource id.
  */
 export declare function companyDatabaseKeys(org: Pick<DeclaredOrg, 'id'>): Readonly<Record<string, string>>;
+/**
+ * The database a company backup schedule must name when the Coolify resource
+ * is not left to pick its first database. Absent: the resource's first database.
+ */
+export declare const COMPANY_BACKUP_DATABASE_NAMES: Readonly<Record<string, string>>;
 /** What every recorded-id key of a company database's backup schedule starts with. */
 export declare const BACKUP_SCOPE_PREFIX = "backup_";
 /** The recorded-id key a company database's backup schedule uuid is stored under. */
@@ -22,8 +27,8 @@ export declare function databasesForService(service: string): readonly string[]
  * recorded uuid and no recorded backup yet. `storageUuid` undefined means the
  * host did not wire backups, so nothing is planned and nothing is said; null
  * means the platform's backup storage is not registered, so each database is
- * reported as blocked instead (rule 2). A company that runs its own mail
- * server carries a note that the Stalwart volume has no Postgres to dump.
+ * reported as blocked instead (rule 2). A company's mail server is one of
+ * these databases (Stalwart's data store), dumped like the rest.
  */
 export declare function planCompanyBackups(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, storageUuid: string | null | undefined): {
     steps: DraftStep[];

package/dist/plan/company-backups.js

@@ -1,6 +1,8 @@
-import { ownsServices } from '../org.js';
 import { BOULE_DATABASE_SCOPE_KEY } from './boule.js';
 import { CHAT_REKEY_MAS_DB_SCOPE_KEY, CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY } from './executor.js';
+import { MAIL_DATABASE_NAME, MAIL_DATABASE_SCOPE_KEY } from './mail-store.js';
+import { signinDbBackupMissing } from './signin-db-backup.js';
+import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db-tls.js';
 /**
  * F6: the Postgres databases of a company that get a nightly backup, and the
  * recorded id each one's uuid sits under. The keys are second, documented
@@ -14,6 +16,7 @@ export function companyDatabaseKeys(org) {
     return {
         app: `coolify:database:${org.id}`,
         cms: 'coolify_cms_database',
+        mail: MAIL_DATABASE_SCOPE_KEY,
         auth: 'coolify_platform_auth_database',
         files: 'coolify_platform_files_database',
         jobs: 'coolify_jobs_database',
@@ -28,6 +31,13 @@ export function companyDatabaseKeys(org) {
         chat_rekey_mas: CHAT_REKEY_MAS_DB_SCOPE_KEY,
     };
 }
+/**
+ * The database a company backup schedule must name when the Coolify resource
+ * is not left to pick its first database. Absent: the resource's first database.
+ */
+export const COMPANY_BACKUP_DATABASE_NAMES = {
+    mail: MAIL_DATABASE_NAME,
+};
 /** What every recorded-id key of a company database's backup schedule starts with. */
 export const BACKUP_SCOPE_PREFIX = 'backup_';
 /** The recorded-id key a company database's backup schedule uuid is stored under. */
@@ -43,6 +53,8 @@ export function databasesForService(service) {
             return ['files'];
         case 'jobs':
             return ['jobs'];
+        case 'mail':
+            return ['mail'];
         case 'synapse':
             return ['synapse', 'chat_synapse'];
         case 'mas':
@@ -58,8 +70,8 @@ export function databasesForService(service) {
  * recorded uuid and no recorded backup yet. `storageUuid` undefined means the
  * host did not wire backups, so nothing is planned and nothing is said; null
  * means the platform's backup storage is not registered, so each database is
- * reported as blocked instead (rule 2). A company that runs its own mail
- * server carries a note that the Stalwart volume has no Postgres to dump.
+ * reported as blocked instead (rule 2). A company's mail server is one of
+ * these databases (Stalwart's data store), dumped like the rest.
  */
 export function planCompanyBackups(org, recordedIds, storageUuid) {
     const steps = [];
@@ -91,10 +103,17 @@ export function planCompanyBackups(org, recordedIds, storageUuid) {
             },
         });
     }
-    if (ownsServices(org)) {
+    const oldDatabase = recordedIds[companyDatabaseKeys(org).auth];
+    if (recordedIds[SIGNIN_DB_TLS_SCOPE_KEY] && oldDatabase) {
+        blocked.push({
+            description: `${org.slug}'s old Coolify sign-in database (${oldDatabase}) is no longer used; delete it by hand in Coolify when you no longer want it as a fallback, foundry never deletes it`,
+            key: 'signin-db-old-database',
+        });
+    }
+    if (signinDbBackupMissing(recordedIds)) {
         blocked.push({
-            description: `${org.slug}'s mail server keeps its data on a volume, not in Postgres: no backup covers it yet`,
-            key: 'backup-not-covered:mail',
+            description: `${org.slug}'s sign-in database runs as foundry's own image, which Coolify's database backups do not cover: its nightly dump is not scheduled yet, so no backup covers it`,
+            key: 'backup-not-covered:signin-db',
         });
     }
     return { steps, blocked };

package/dist/plan/diff.d.ts

@@ -69,6 +69,10 @@ export interface PlanOrgOptions {
     ownMailKeyHeld?: boolean;
     /** The executor can mint an own org's Lettermint key (`FoundryStepExecutor.ownMailKeyMintable`). */
     ownMailKeyMintable?: boolean;
+    /** The executor can store the sign-in database's CA and certificate (`FoundryStepExecutor.ownSigninDbKeysPuttable`). Absent: true. */
+    ownSigninDbKeysPuttable?: boolean;
+    /** The host supplies the backup bucket the sign-in database dumps into (`FoundryStepExecutor.ownSigninDbBackupConfigured`). Absent: true. */
+    ownSigninDbBackupConfigured?: boolean;
     /** The own jobs admin token's held-key ref holds a value. */
     ownJobsTokenHeld?: boolean;
     /** The own media server's key pair ref holds a value. */

package/dist/plan/diff.js

@@ -14,8 +14,9 @@ import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
+import { mailStoreSwitchChange } from './mail-store.js';
 import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
-import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, } from './own-diff.js';
+import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, OWN_SIGNIN_DB_MOVE_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, planSigninDbMove, } from './own-diff.js';
 import { ownDnsHostnames } from './own-dns.js';
 import { ownHostnames } from './own-hostnames.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
@@ -196,9 +197,20 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         oikosZoneReady: options.oikosZoneReady ?? false,
         mailKeyHeld: options.ownMailKeyHeld ?? false,
         mailKeyMintable: options.ownMailKeyMintable ?? false,
+        now: (options.now ?? Date.now)(),
+        signinDbKeysPuttable: options.ownSigninDbKeysPuttable ?? true,
+        signinDbBackupConfigured: options.ownSigninDbBackupConfigured ?? true,
     });
     if (ownAuth.step)
         plannedSteps.push(ownAuth.step);
+    const signinDbMove = planSigninDbMove({
+        org,
+        recordedIds,
+        signinDbKeysPuttable: options.ownSigninDbKeysPuttable ?? true,
+        signinDbBackupConfigured: options.ownSigninDbBackupConfigured ?? true,
+    });
+    if (signinDbMove.step)
+        plannedSteps.push(signinDbMove.step);
     // An own org's ZITADEL is the company's own instance: nothing that needs it plans before it exists.
     const ownSignInPending = ownsServices(org) && !ownAuthApplied(org, recordedIds);
     const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady);
@@ -319,6 +331,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // uses, never `versionChangeLine`'s "X -> Y (redeploy)" -- nothing here
     // ever performs that redeploy.
     const versionChanges = [];
+    if (ownMail.step?.action.desired.switchMailStore) {
+        versionChanges.push(mailStoreSwitchChange(org.slug));
+    }
     if (org.calls.enabled && !calls.blocked) {
         const callsAppLive = Boolean(byKey.get(resourceKey('coolify', 'calls', org.id)));
         const synapseChange = versionNotAppliedLine('synapse', callsAppLive, recordedIds[CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY], versionPin?.calls ?? VERSIONS.synapse);
@@ -606,6 +621,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...edgeReservedLabels.blocked);
     if (ownAuth.blocked)
         unmanaged.push({ description: ownAuth.blocked, key: OWN_AUTH_BLOCKED_KEY });
+    if (signinDbMove.blocked) {
+        unmanaged.push({ description: signinDbMove.blocked, key: OWN_SIGNIN_DB_MOVE_BLOCKED_KEY });
+    }
     if (ownJobs.blocked)
         unmanaged.push({ description: ownJobs.blocked, key: OWN_JOBS_BLOCKED_KEY });
     if (ownMail.blocked)

package/dist/plan/executor.d.ts

@@ -325,6 +325,8 @@ export interface CoolifyPort {
         description?: string;
         instant_deploy?: boolean;
         custom_docker_run_options?: string;
+        /** `false`: no domain is made for the app. Coolify makes one by default, which would route to the app's port. */
+        autogenerate_domain?: boolean;
     }): Promise<{
         uuid: string;
     }>;
@@ -1828,6 +1830,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private executeScoped;
     /** Whether `ensureOwnAuthMailToken` can mint: the same two inputs it blocks on. */
     ownMailKeyMintable(): boolean;
+    /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
+    ownSigninDbKeysPuttable(): boolean;
+    /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). */
+    ownSigninDbBackupConfigured(): boolean;
     /** What the executor's own files dependencies supply, for the planner's blocked lines. */
     ownFilesDeps(): {
         keys: boolean;
@@ -2927,6 +2933,13 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * declared auth ref patches both git apps' branch and redeploys them; the
      * applied marker comes last, so a run that died halfway is planned again.
      */
+    /**
+     * The sign-in ports of one company's steps: its own network and limits, a SMTP target without the
+     * platform's password, and every secret the step reads registered for redaction.
+     */
+    private ownAuthDeps;
+    /** `plan/signin-db-move.ts`: copies a company's sign-in data from its Coolify database to the TLS database. */
+    private ownAuthDbMove;
     private ownAuth;
     /**
      * `plan/own-diff.ts`'s `planOwnMail`: the org's own Stalwart in the org's own

package/dist/plan/executor.js

@@ -13,7 +13,7 @@ import { recordBuiltCommit } from './build-record.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
-import { BACKUP_SCOPE_PREFIX, backupScopeKey } from './company-backups.js';
+import { BACKUP_SCOPE_PREFIX, COMPANY_BACKUP_DATABASE_NAMES, backupScopeKey, } from './company-backups.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForNewDeployment, } from './deploy-health.js';
 import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
@@ -44,6 +44,7 @@ import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
+import { moveSigninDatabase } from './signin-db-move.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * The real {@link StepExecutor} (#20 "provision Company Factory end to
@@ -940,6 +941,15 @@ export class FoundryStepExecutor {
     ownMailKeyMintable() {
         return Boolean(this.ports.lettermint && this.ports.ownServices?.provision.auth.heldKeys);
     }
+    /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
+    ownSigninDbKeysPuttable() {
+        return Boolean(this.ports.ownServices?.provision.auth.heldKeys?.put);
+    }
+    /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). */
+    ownSigninDbBackupConfigured() {
+        const files = this.ports.ownServices?.provision.files;
+        return Boolean(files?.r2Buckets && files.r2Keys);
+    }
     /** What the executor's own files dependencies supply, for the planner's blocked lines. */
     ownFilesDeps() {
         const files = this.ports.ownServices?.provision.files;
@@ -1132,6 +1142,8 @@ export class FoundryStepExecutor {
                 return this.jobsRegistration(action, org, context);
             case 'coolify:own-auth':
                 return this.ownAuth(action, org, context);
+            case 'coolify:own-auth-db-move':
+                return this.ownAuthDbMove(org, context);
             case 'coolify:own-jobs':
                 return this.ownJobs(action, org, context);
             case 'coolify:own-mail':
@@ -2633,6 +2645,7 @@ export class FoundryStepExecutor {
             databaseUuid: databaseId,
             label: `${org.slug} ${database}`,
             storageUuid,
+            databaseName: COMPANY_BACKUP_DATABASE_NAMES[database],
         });
         context.recordScopeId(backupScopeKey(database), uuid);
         return undefined;
@@ -5708,30 +5721,55 @@ export class FoundryStepExecutor {
      * declared auth ref patches both git apps' branch and redeploys them; the
      * applied marker comes last, so a run that died halfway is planned again.
      */
-    async ownAuth(action, org, context) {
-        const own = this.ports.ownServices;
-        if (!own)
-            throw new Error(OWN_SERVICES_PORT_ABSENT);
-        const hostname = action.desired.hostname;
-        const gitRef = action.desired.gitRef;
-        const hn = ownHostnames(org);
-        const scope = scopeFromOrg(context, {});
+    /**
+     * The sign-in ports of one company's steps: its own network and limits, a SMTP target without the
+     * platform's password, and every secret the step reads registered for redaction.
+     */
+    ownAuthDeps(auth, org, context) {
         // The target (host, port, tls, user) is not secret; the platform's SMTP
         // password is, so the company's own token is the password instead.
-        const { smtp, ...authDeps } = own.provision.auth;
-        const deps = {
+        const { smtp, signinDbBackup: _platformBackup, ...authDeps } = auth;
+        const files = this.ports.ownServices?.provision.files;
+        return {
             ...authDeps,
+            // The company's own bucket and key, through the files host's ports; never a platform-wide backup key.
+            signinDbBackup: files?.r2Buckets && files.r2Keys
+                ? { r2Buckets: files.r2Buckets, r2Keys: files.r2Keys }
+                : undefined,
             ...(smtp
                 ? { smtp: { host: smtp.host, port: smtp.port, tls: smtp.tls, user: smtp.user } }
                 : {}),
-            coolify: limited(this.placedForCompany(own.provision.auth.coolify, org, context), LIMITS.ownAuth),
+            coolify: limited(this.placedForCompany(auth.coolify, org, context), LIMITS.ownAuth),
             runtime: {
-                ...own.provision.auth.runtime,
+                ...auth.runtime,
                 onSecret: (value) => {
                     this.handledSecrets.add(value);
                 },
             },
         };
+    }
+    /** `plan/signin-db-move.ts`: copies a company's sign-in data from its Coolify database to the TLS database. */
+    async ownAuthDbMove(org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const deps = this.ownAuthDeps(own.provision.auth, org, context);
+        const placed = this.placedForCompany(own.provision.auth.coolify, org, context);
+        await moveSigninDatabase(scopeFromOrg(context, {}), { ...deps, readOldDatabase: (uuid) => placed.getDatabase(uuid) }, orgTarget(org), {
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            label: `${org.slug}:auth`,
+        });
+        return {};
+    }
+    async ownAuth(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const hostname = action.desired.hostname;
+        const gitRef = action.desired.gitRef;
+        const hn = ownHostnames(org);
+        const scope = scopeFromOrg(context, {});
+        const deps = this.ownAuthDeps(own.provision.auth, org, context);
         const before = scope.recordedIds();
         const refChanged = before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== undefined &&
             before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;
@@ -5813,12 +5851,17 @@ export class FoundryStepExecutor {
             },
             zitadel: own.zitadelFor({ issuerUrl, bearerRef: target.refs.instanceBearer }),
             zitadelForInstance: undefined,
+            runtime: {
+                ...own.provision.mail.runtime,
+                onSecret: (value) => this.handledSecrets.add(value),
+            },
         }, target, {
             hostname: action.desired.hostname,
             apex: hn.mailDomain,
             zone: hn.zone,
             mailHost: action.desired.mailHost,
             imageTag: action.desired.gitRef,
+            switchStore: action.desired.switchMailStore === true,
             hostPorts: bind ? `${bind}:${smtpPort}:25` : `${smtpPort}:25`,
             issuerUrl,
             mxRecord: null,

package/dist/plan/index.d.ts

@@ -23,6 +23,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export type { UnconfirmedUpgrade } from './confirm-upgrade.js';
+export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
 export type { BackupGatePorts, MoveGatePorts } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
@@ -63,7 +64,7 @@ export { createEdgeAccess } from './edge-access.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';
 export { createEdgeWorkers } from './edge-workers.js';
 export type { EdgePlatformWorkers, EdgeWorkersOptions, PlatformWorkersPort, } from './edge-workers.js';
-export type { PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, } from './uptime-worker.js';
+export type { PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformWorkersFactory, } from './uptime-worker.js';
 export { createEdgeRateLimits } from './edge-ratelimits.js';
 export type { EdgePlatformRateLimits, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, } from './edge-ratelimits.js';
 export { createEdgeZones } from './edge-zones.js';

package/dist/plan/index.js

@@ -10,6 +10,7 @@ export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICE
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
 // #171: how a host signs files management requests with the delivered key.

package/dist/plan/mail-store.d.ts

@@ -0,0 +1,34 @@
+import { type VersionChangeItem } from '../plan.js';
+/**
+ * Stalwart keeps its data (mail, accounts, settings, DKIM keys) in a Coolify
+ * Postgres, so the nightly dump of that database is the off-server backup.
+ * These keys are shared by the planners (which must not import
+ * `platform-providers.ts`) and by `provisionMailServer`.
+ */
+/** The recorded uuid of the mail Postgres, under the same name for the platform and every company. */
+export declare const MAIL_DATABASE_SCOPE_KEY = "coolify_mail_database";
+/** Recorded as {@link MAIL_STORE_POSTGRES} once the `Bootstrap` write has pointed Stalwart at the database. */
+export declare const MAIL_STORE_SCOPE_KEY = "mail_store";
+export declare const MAIL_STORE_POSTGRES = "postgres";
+/** The recorded uuid of the Stalwart app (`platform-providers.ts` re-exports it under its old name). */
+export declare const MAIL_APP_SCOPE_KEY = "coolify_platform_mail_app";
+/** The database and its owner, and the env var Stalwart reads the password from. */
+export declare const MAIL_DATABASE_NAME = "stalwart";
+export declare const MAIL_DATABASE_USER = "stalwart";
+export declare const MAIL_DATABASE_PASSWORD_ENV = "STALWART_DB_PASSWORD";
+/** The `confirmUpgrade` name that confirms the switch (`VersionChangeItem.service`). */
+export declare const MAIL_STORE_SWITCH_SERVICE = "mail-store";
+/**
+ * A Stalwart app is recorded and its data store was never moved to Postgres
+ * (no mail database recorded either: a fresh instance records that before it
+ * creates the app, so a crash halfway never reads as a volume-backed server).
+ */
+export declare function mailStoreIsLegacy(recorded: Readonly<Record<string, string>>): boolean;
+/** The one step description for the switch. `owner` is `the platform` or the company's slug. */
+export declare function mailStoreSwitchDescription(owner: string): string;
+/**
+ * The version-change line that makes `apply` refuse the plan until
+ * `confirmUpgrade` names `mail-store`. Fixed text: it is part of the
+ * stale-plan comparison.
+ */
+export declare function mailStoreSwitchChange(owner: string): VersionChangeItem;

package/dist/plan/mail-store.js

@@ -0,0 +1,49 @@
+import { VERSION_CHANGE_KIND } from '../plan.js';
+/**
+ * Stalwart keeps its data (mail, accounts, settings, DKIM keys) in a Coolify
+ * Postgres, so the nightly dump of that database is the off-server backup.
+ * These keys are shared by the planners (which must not import
+ * `platform-providers.ts`) and by `provisionMailServer`.
+ */
+/** The recorded uuid of the mail Postgres, under the same name for the platform and every company. */
+export const MAIL_DATABASE_SCOPE_KEY = 'coolify_mail_database';
+/** Recorded as {@link MAIL_STORE_POSTGRES} once the `Bootstrap` write has pointed Stalwart at the database. */
+export const MAIL_STORE_SCOPE_KEY = 'mail_store';
+export const MAIL_STORE_POSTGRES = 'postgres';
+/** The recorded uuid of the Stalwart app (`platform-providers.ts` re-exports it under its old name). */
+export const MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
+/** The database and its owner, and the env var Stalwart reads the password from. */
+export const MAIL_DATABASE_NAME = 'stalwart';
+export const MAIL_DATABASE_USER = 'stalwart';
+export const MAIL_DATABASE_PASSWORD_ENV = 'STALWART_DB_PASSWORD';
+/** The `confirmUpgrade` name that confirms the switch (`VersionChangeItem.service`). */
+export const MAIL_STORE_SWITCH_SERVICE = 'mail-store';
+/**
+ * A Stalwart app is recorded and its data store was never moved to Postgres
+ * (no mail database recorded either: a fresh instance records that before it
+ * creates the app, so a crash halfway never reads as a volume-backed server).
+ */
+export function mailStoreIsLegacy(recorded) {
+    return (Boolean(recorded[MAIL_APP_SCOPE_KEY]) &&
+        !recorded[MAIL_DATABASE_SCOPE_KEY] &&
+        recorded[MAIL_STORE_SCOPE_KEY] !== MAIL_STORE_POSTGRES);
+}
+/** The one step description for the switch. `owner` is `the platform` or the company's slug. */
+export function mailStoreSwitchDescription(owner) {
+    return `switch ${owner}'s mail store to Postgres (recreates the mail server; mail stored there is deleted)`;
+}
+/**
+ * The version-change line that makes `apply` refuse the plan until
+ * `confirmUpgrade` names `mail-store`. Fixed text: it is part of the
+ * stale-plan comparison.
+ */
+export function mailStoreSwitchChange(owner) {
+    return {
+        kind: VERSION_CHANGE_KIND,
+        service: MAIL_STORE_SWITCH_SERVICE,
+        description: `${owner}'s mail server still stores its data on a volume: moving it to Postgres recreates the server and deletes the mail stored there; confirm with confirmUpgrade "${MAIL_STORE_SWITCH_SERVICE}"`,
+        from: 'volume',
+        to: 'postgres',
+        needsConfirmation: true,
+    };
+}