@wtfalch/foundry 0.38.0 → 0.39.1

package/dist/bootstrap/versions.d.ts

@@ -2,8 +2,7 @@
  * The estate's pinned third-party image/release refs for the platform
  * services foundry provisions (#247). One JSON file, so Renovate can read
  * and later propose bumps against it, instead of four separate string
- * constants it cannot see. `postgres` has no entry here: no planner step
- * pins a postgres image tag today, so there is no ref to record yet.
+ * constants it cannot see.
  */
 export interface PinnedVersions {
     zitadel: string;
@@ -17,6 +16,8 @@ export interface PinnedVersions {
     alpine: string;
     /** A static busybox, copied into the MAS image so its health check has an HTTP client. */
     busybox: string;
+    /** The sign-in database's image (#746). Its major version is the data directory's format: a bump past 16 needs a dump and restore, not an image change. */
+    postgres: string;
 }
 export declare function loadVersions(): PinnedVersions;
 export declare const VERSIONS: PinnedVersions;

package/dist/plan/backup-gate.d.ts

@@ -28,6 +28,15 @@ export declare class NetworkMoveBackupMissingError extends Error {
     readonly reason: 'no-gate' | 'no-backup' | 'by-hand';
     constructor(reason: 'no-gate' | 'no-backup' | 'by-hand');
 }
+/**
+ * The move of a company's sign-in database to the TLS image (#746) is refused before any step runs when
+ * the old database has no finished backup from the last {@link BACKUP_MAX_AGE_HOURS} hours, or the host
+ * has no backup gate. The message names no database, uuid or URL. There is no override.
+ */
+export declare class SigninDbMoveBackupMissingError extends Error {
+    readonly reason: 'no-gate' | 'no-backup';
+    constructor(reason: 'no-gate' | 'no-backup');
+}
 export interface BackupGatePorts {
     /** The company's recorded ids (`AppliedState.serviceIds`): database uuids and `backup_<db>` schedule uuids. */
     recordedIds: Readonly<Record<string, string>>;
@@ -67,6 +76,13 @@ export declare function requireFreshBackupsForUpgrades(plan: {
 }, confirmed: readonly string[] | undefined, ports: BackupGatePorts): Promise<{
     backupId: string | null;
 }>;
+/**
+ * The sign-in database move's gate (#746): the company's recorded `auth` database needs a schedule and a
+ * `success` execution not older than {@link BACKUP_MAX_AGE_HOURS} hours, read from Coolify's executions.
+ * A schedule alone proves no dump ran, so a Coolify with no executions route refuses too. Returns the
+ * uuid of the execution that passed.
+ */
+export declare function requireFreshBackupForSigninMove(ports: BackupGatePorts): Promise<string>;
 export interface MoveGatePorts {
     /** The company's Coolify project (`coolify_project`). */
     projectUuid: string | undefined;

package/dist/plan/backup-gate.js

@@ -44,6 +44,21 @@ export class NetworkMoveBackupMissingError extends Error {
         this.name = 'NetworkMoveBackupMissingError';
     }
 }
+/**
+ * The move of a company's sign-in database to the TLS image (#746) is refused before any step runs when
+ * the old database has no finished backup from the last {@link BACKUP_MAX_AGE_HOURS} hours, or the host
+ * has no backup gate. The message names no database, uuid or URL. There is no override.
+ */
+export class SigninDbMoveBackupMissingError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason === 'no-gate'
+            ? 'sign-in database move refused: this host has no backup gate, so a fresh backup cannot be checked'
+            : `sign-in database move refused: the old sign-in database has no finished backup from the last ${BACKUP_MAX_AGE_HOURS} hours, checked in Coolify; take one now and apply again`);
+        this.reason = reason;
+        this.name = 'SigninDbMoveBackupMissingError';
+    }
+}
 async function withinTimeout(call) {
     let timer;
     try {
@@ -184,6 +199,31 @@ export async function requireFreshBackupsForUpgrades(plan, confirmed, ports) {
     }
     return { backupId };
 }
+/**
+ * The sign-in database move's gate (#746): the company's recorded `auth` database needs a schedule and a
+ * `success` execution not older than {@link BACKUP_MAX_AGE_HOURS} hours, read from Coolify's executions.
+ * A schedule alone proves no dump ran, so a Coolify with no executions route refuses too. Returns the
+ * uuid of the execution that passed.
+ */
+export async function requireFreshBackupForSigninMove(ports) {
+    const now = (ports.now ?? Date.now)();
+    const databaseUuid = ports.recordedIds[companyDatabaseKeys({ id: ports.orgId }).auth];
+    const backupUuid = ports.recordedIds[backupScopeKey('auth')];
+    if (!databaseUuid || !backupUuid)
+        throw new SigninDbMoveBackupMissingError('no-backup');
+    let executions;
+    try {
+        executions = await readExecutions(ports.coolify, databaseUuid, backupUuid);
+    }
+    catch {
+        // An unreadable list is not a fresh backup. The cause stays out: it can carry a response body.
+        throw new SigninDbMoveBackupMissingError('no-backup');
+    }
+    const fresh = executions ? freshSuccess(executions, now) : null;
+    if (!fresh)
+        throw new SigninDbMoveBackupMissingError('no-backup');
+    return fresh.uuid;
+}
 /**
  * The gate for a move to the company's own network, which deletes every database of the project. It
  * fails closed and is stricter than the upgrade gate: it reads the project itself, not foundry's records.

package/dist/plan/company-backups.js

@@ -1,6 +1,8 @@
 import { BOULE_DATABASE_SCOPE_KEY } from './boule.js';
 import { CHAT_REKEY_MAS_DB_SCOPE_KEY, CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY } from './executor.js';
 import { MAIL_DATABASE_NAME, MAIL_DATABASE_SCOPE_KEY } from './mail-store.js';
+import { signinDbBackupMissing } from './signin-db-backup.js';
+import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db-tls.js';
 /**
  * F6: the Postgres databases of a company that get a nightly backup, and the
  * recorded id each one's uuid sits under. The keys are second, documented
@@ -101,5 +103,18 @@ export function planCompanyBackups(org, recordedIds, storageUuid) {
             },
         });
     }
+    const oldDatabase = recordedIds[companyDatabaseKeys(org).auth];
+    if (recordedIds[SIGNIN_DB_TLS_SCOPE_KEY] && oldDatabase) {
+        blocked.push({
+            description: `${org.slug}'s old Coolify sign-in database (${oldDatabase}) is no longer used; delete it by hand in Coolify when you no longer want it as a fallback, foundry never deletes it`,
+            key: 'signin-db-old-database',
+        });
+    }
+    if (signinDbBackupMissing(recordedIds)) {
+        blocked.push({
+            description: `${org.slug}'s sign-in database runs as foundry's own image, which Coolify's database backups do not cover: its nightly dump is not scheduled yet, so no backup covers it`,
+            key: 'backup-not-covered:signin-db',
+        });
+    }
     return { steps, blocked };
 }

package/dist/plan/diff.d.ts

@@ -69,6 +69,10 @@ export interface PlanOrgOptions {
     ownMailKeyHeld?: boolean;
     /** The executor can mint an own org's Lettermint key (`FoundryStepExecutor.ownMailKeyMintable`). */
     ownMailKeyMintable?: boolean;
+    /** The executor can store the sign-in database's CA and certificate (`FoundryStepExecutor.ownSigninDbKeysPuttable`). Absent: true. */
+    ownSigninDbKeysPuttable?: boolean;
+    /** The host supplies the backup bucket the sign-in database dumps into (`FoundryStepExecutor.ownSigninDbBackupConfigured`). Absent: true. */
+    ownSigninDbBackupConfigured?: boolean;
     /** The own jobs admin token's held-key ref holds a value. */
     ownJobsTokenHeld?: boolean;
     /** The own media server's key pair ref holds a value. */

package/dist/plan/diff.js

@@ -16,7 +16,7 @@ import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, lo
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { mailStoreSwitchChange } from './mail-store.js';
 import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
-import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, } from './own-diff.js';
+import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, OWN_SIGNIN_DB_MOVE_BLOCKED_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, planSigninDbMove, } from './own-diff.js';
 import { ownDnsHostnames } from './own-dns.js';
 import { ownHostnames } from './own-hostnames.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
@@ -197,9 +197,20 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         oikosZoneReady: options.oikosZoneReady ?? false,
         mailKeyHeld: options.ownMailKeyHeld ?? false,
         mailKeyMintable: options.ownMailKeyMintable ?? false,
+        now: (options.now ?? Date.now)(),
+        signinDbKeysPuttable: options.ownSigninDbKeysPuttable ?? true,
+        signinDbBackupConfigured: options.ownSigninDbBackupConfigured ?? true,
     });
     if (ownAuth.step)
         plannedSteps.push(ownAuth.step);
+    const signinDbMove = planSigninDbMove({
+        org,
+        recordedIds,
+        signinDbKeysPuttable: options.ownSigninDbKeysPuttable ?? true,
+        signinDbBackupConfigured: options.ownSigninDbBackupConfigured ?? true,
+    });
+    if (signinDbMove.step)
+        plannedSteps.push(signinDbMove.step);
     // An own org's ZITADEL is the company's own instance: nothing that needs it plans before it exists.
     const ownSignInPending = ownsServices(org) && !ownAuthApplied(org, recordedIds);
     const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady);
@@ -610,6 +621,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...edgeReservedLabels.blocked);
     if (ownAuth.blocked)
         unmanaged.push({ description: ownAuth.blocked, key: OWN_AUTH_BLOCKED_KEY });
+    if (signinDbMove.blocked) {
+        unmanaged.push({ description: signinDbMove.blocked, key: OWN_SIGNIN_DB_MOVE_BLOCKED_KEY });
+    }
     if (ownJobs.blocked)
         unmanaged.push({ description: ownJobs.blocked, key: OWN_JOBS_BLOCKED_KEY });
     if (ownMail.blocked)

package/dist/plan/executor.d.ts

@@ -325,6 +325,8 @@ export interface CoolifyPort {
         description?: string;
         instant_deploy?: boolean;
         custom_docker_run_options?: string;
+        /** `false`: no domain is made for the app. Coolify makes one by default, which would route to the app's port. */
+        autogenerate_domain?: boolean;
     }): Promise<{
         uuid: string;
     }>;
@@ -1828,6 +1830,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private executeScoped;
     /** Whether `ensureOwnAuthMailToken` can mint: the same two inputs it blocks on. */
     ownMailKeyMintable(): boolean;
+    /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
+    ownSigninDbKeysPuttable(): boolean;
+    /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). */
+    ownSigninDbBackupConfigured(): boolean;
     /** What the executor's own files dependencies supply, for the planner's blocked lines. */
     ownFilesDeps(): {
         keys: boolean;
@@ -2927,6 +2933,13 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * declared auth ref patches both git apps' branch and redeploys them; the
      * applied marker comes last, so a run that died halfway is planned again.
      */
+    /**
+     * The sign-in ports of one company's steps: its own network and limits, a SMTP target without the
+     * platform's password, and every secret the step reads registered for redaction.
+     */
+    private ownAuthDeps;
+    /** `plan/signin-db-move.ts`: copies a company's sign-in data from its Coolify database to the TLS database. */
+    private ownAuthDbMove;
     private ownAuth;
     /**
      * `plan/own-diff.ts`'s `planOwnMail`: the org's own Stalwart in the org's own

package/dist/plan/executor.js

@@ -44,6 +44,7 @@ import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
+import { moveSigninDatabase } from './signin-db-move.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * The real {@link StepExecutor} (#20 "provision Company Factory end to
@@ -940,6 +941,15 @@ export class FoundryStepExecutor {
     ownMailKeyMintable() {
         return Boolean(this.ports.lettermint && this.ports.ownServices?.provision.auth.heldKeys);
     }
+    /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
+    ownSigninDbKeysPuttable() {
+        return Boolean(this.ports.ownServices?.provision.auth.heldKeys?.put);
+    }
+    /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). */
+    ownSigninDbBackupConfigured() {
+        const files = this.ports.ownServices?.provision.files;
+        return Boolean(files?.r2Buckets && files.r2Keys);
+    }
     /** What the executor's own files dependencies supply, for the planner's blocked lines. */
     ownFilesDeps() {
         const files = this.ports.ownServices?.provision.files;
@@ -1132,6 +1142,8 @@ export class FoundryStepExecutor {
                 return this.jobsRegistration(action, org, context);
             case 'coolify:own-auth':
                 return this.ownAuth(action, org, context);
+            case 'coolify:own-auth-db-move':
+                return this.ownAuthDbMove(org, context);
             case 'coolify:own-jobs':
                 return this.ownJobs(action, org, context);
             case 'coolify:own-mail':
@@ -5709,30 +5721,55 @@ export class FoundryStepExecutor {
      * declared auth ref patches both git apps' branch and redeploys them; the
      * applied marker comes last, so a run that died halfway is planned again.
      */
-    async ownAuth(action, org, context) {
-        const own = this.ports.ownServices;
-        if (!own)
-            throw new Error(OWN_SERVICES_PORT_ABSENT);
-        const hostname = action.desired.hostname;
-        const gitRef = action.desired.gitRef;
-        const hn = ownHostnames(org);
-        const scope = scopeFromOrg(context, {});
+    /**
+     * The sign-in ports of one company's steps: its own network and limits, a SMTP target without the
+     * platform's password, and every secret the step reads registered for redaction.
+     */
+    ownAuthDeps(auth, org, context) {
         // The target (host, port, tls, user) is not secret; the platform's SMTP
         // password is, so the company's own token is the password instead.
-        const { smtp, ...authDeps } = own.provision.auth;
-        const deps = {
+        const { smtp, signinDbBackup: _platformBackup, ...authDeps } = auth;
+        const files = this.ports.ownServices?.provision.files;
+        return {
             ...authDeps,
+            // The company's own bucket and key, through the files host's ports; never a platform-wide backup key.
+            signinDbBackup: files?.r2Buckets && files.r2Keys
+                ? { r2Buckets: files.r2Buckets, r2Keys: files.r2Keys }
+                : undefined,
             ...(smtp
                 ? { smtp: { host: smtp.host, port: smtp.port, tls: smtp.tls, user: smtp.user } }
                 : {}),
-            coolify: limited(this.placedForCompany(own.provision.auth.coolify, org, context), LIMITS.ownAuth),
+            coolify: limited(this.placedForCompany(auth.coolify, org, context), LIMITS.ownAuth),
             runtime: {
-                ...own.provision.auth.runtime,
+                ...auth.runtime,
                 onSecret: (value) => {
                     this.handledSecrets.add(value);
                 },
             },
         };
+    }
+    /** `plan/signin-db-move.ts`: copies a company's sign-in data from its Coolify database to the TLS database. */
+    async ownAuthDbMove(org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const deps = this.ownAuthDeps(own.provision.auth, org, context);
+        const placed = this.placedForCompany(own.provision.auth.coolify, org, context);
+        await moveSigninDatabase(scopeFromOrg(context, {}), { ...deps, readOldDatabase: (uuid) => placed.getDatabase(uuid) }, orgTarget(org), {
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            label: `${org.slug}:auth`,
+        });
+        return {};
+    }
+    async ownAuth(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const hostname = action.desired.hostname;
+        const gitRef = action.desired.gitRef;
+        const hn = ownHostnames(org);
+        const scope = scopeFromOrg(context, {});
+        const deps = this.ownAuthDeps(own.provision.auth, org, context);
         const before = scope.recordedIds();
         const refChanged = before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== undefined &&
             before[OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;

package/dist/plan/own-diff.d.ts

@@ -45,6 +45,12 @@ export interface PlanOwnAuthOptions {
     mailKeyHeld: boolean;
     /** The host can mint that key itself (a Lettermint port and a held-key reader): the step plans without it. */
     mailKeyMintable?: boolean;
+    /** The clock for the sign-in database certificate's renewal window (#746). Default `Date.now`. */
+    now?: number;
+    /** The held keys can store the sign-in database's CA and certificate. Default true. */
+    signinDbKeysPuttable?: boolean;
+    /** The host supplies the backup bucket the sign-in database dumps into. Default true. */
+    signinDbBackupConfigured?: boolean;
 }
 /**
  * An own org (`services.own`) runs its own sign-in: ZITADEL, the login app
@@ -59,6 +65,26 @@ export declare function planOwnAuth(options: PlanOwnAuthOptions): {
     step: DraftStep | null;
     blocked: string | null;
 };
+/** `unmanaged` key of the one line `planSigninDbMove` reports. */
+export declare const OWN_SIGNIN_DB_MOVE_BLOCKED_KEY = "own-signin-db-move";
+export interface PlanSigninDbMoveOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    /** The held keys can store the sign-in database's CA and certificate. Default true. */
+    signinDbKeysPuttable?: boolean;
+    /** The host supplies the backup bucket the sign-in database dumps into. Default true. */
+    signinDbBackupConfigured?: boolean;
+}
+/**
+ * One step for an own org whose sign-in is applied and whose ZITADEL still uses the Coolify database
+ * (#746): `signin-db-move.ts` copies it to foundry's TLS image. Never planned for a company on the TLS
+ * database, a new one, or one whose sign-in is not applied. The apply refuses it without a fresh
+ * backup of the old database (`backup-gate.ts`).
+ */
+export declare function planSigninDbMove(options: PlanSigninDbMoveOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+};
 /** `unmanaged` key of the one line `planOwnMail` reports. */
 export declare const OWN_MAIL_BLOCKED_KEY = "own-mail";
 export interface PlanOwnMailOptions {

package/dist/plan/own-diff.js

@@ -12,7 +12,10 @@ import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } fr
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
 import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
-import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+import { signinDbBackupMissing } from './signin-db-backup.js';
+import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, signinDbCertDue } from './signin-db-tls.js';
+import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db.js';
 /** `unmanaged` key of the one line `planOwnJobs` reports. */
 export const OWN_JOBS_BLOCKED_KEY = 'own-jobs';
 /**
@@ -130,6 +133,15 @@ export function planOwnAuth(options) {
     if (!options.mailKeyHeld && !options.mailKeyMintable) {
         return blocked(`the held key ${orgTarget(org).refs.brokerMailKey} is not held yet`);
     }
+    // A company still on the Coolify database keeps running without the keys until it moves.
+    if (!recordedIds[PLATFORM_AUTH_DB_SCOPE_KEY]) {
+        if (options.signinDbKeysPuttable === false && !recordedIds[SIGNIN_DB_TLS_SCOPE_KEY]) {
+            return blocked('the host cannot store the sign-in database certificate (held keys have no put)');
+        }
+        if (options.signinDbBackupConfigured === false) {
+            return blocked('the host supplies no backup bucket for the sign-in database');
+        }
+    }
     const hostname = names.auth;
     // The broker starts only on a valid `AUTH_APPS`, and the login client is minted only once it does:
     // the first broker entry is what lets this step finish, as the platform's first registration does.
@@ -149,7 +161,11 @@ export function planOwnAuth(options) {
         recordedIds[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY] &&
         recordedIds[PLATFORM_AUTH_SMTP_SCOPE_KEY] &&
         recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
-        (Boolean(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) || !brokerHoldsAnEntry)) {
+        (Boolean(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) || !brokerHoldsAnEntry) &&
+        !signinDbCertDue(recordedIds, options.now ?? Date.now()) &&
+        !signinDbBackupMissing(recordedIds) &&
+        // ZITADEL was started on the TLS database and never seen healthy there: the step starts it again.
+        !recordedIds[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY]) {
         return { step: null, blocked: null };
     }
     return {
@@ -169,6 +185,47 @@ export function planOwnAuth(options) {
         },
     };
 }
+/** `unmanaged` key of the one line `planSigninDbMove` reports. */
+export const OWN_SIGNIN_DB_MOVE_BLOCKED_KEY = 'own-signin-db-move';
+/**
+ * One step for an own org whose sign-in is applied and whose ZITADEL still uses the Coolify database
+ * (#746): `signin-db-move.ts` copies it to foundry's TLS image. Never planned for a company on the TLS
+ * database, a new one, or one whose sign-in is not applied. The apply refuses it without a fresh
+ * backup of the old database (`backup-gate.ts`).
+ */
+export function planSigninDbMove(options) {
+    const { org, recordedIds } = options;
+    if (!ownsServices(org) ||
+        !ownAuthApplied(org, recordedIds) ||
+        !recordedIds[PLATFORM_AUTH_DB_SCOPE_KEY] ||
+        !recordedIds[PLATFORM_AUTH_ZITADEL_SCOPE_KEY] ||
+        recordedIds[SIGNIN_DB_TLS_SCOPE_KEY]) {
+        return { step: null, blocked: null };
+    }
+    if (options.signinDbKeysPuttable === false) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s sign-in database move is blocked, not planned: the host cannot store the sign-in database certificate (held keys have no put)`,
+        };
+    }
+    if (options.signinDbBackupConfigured === false) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s sign-in database move is blocked, not planned: the host supplies no backup bucket for the sign-in database`,
+        };
+    }
+    return {
+        blocked: null,
+        step: {
+            action: { system: 'coolify', kind: 'own-auth-db-move', key: org.id, desired: {} },
+            step: {
+                description: `move ${org.slug}'s sign-in database to foundry's TLS image: ZITADEL is stopped while the data is copied, the old database is kept`,
+                destroys: false,
+                migrates: true,
+            },
+        },
+    };
+}
 /** `unmanaged` key of the one line `planOwnMail` reports. */
 export const OWN_MAIL_BLOCKED_KEY = 'own-mail';
 /**

package/dist/plan/own-services.d.ts

@@ -20,6 +20,10 @@ export interface ServiceTarget {
     readonly kind: 'platform' | 'org';
     readonly names: {
         authDb: string;
+        /** The sign-in database as foundry's own TLS image (#746). Only an org uses it; the platform's value is never read. */
+        signinDb: string;
+        /** The one-shot job that copies the old database into it (#746). */
+        signinDbMove: string;
         authZitadel: string;
         authLogin: string;
         authBroker: string;
@@ -34,6 +38,8 @@ export interface ServiceTarget {
         filesRunner: string;
         /** An own org's R2 bucket. The platform's is host-supplied (`PlatformFilesDeps.r2`), so its value here is never read. */
         filesBucket: string;
+        /** An own org's sign-in database backup bucket (#746): its own bucket, never the files bucket. */
+        signinBackupBucket: string;
         jobsApp: string;
         jobsDb: string;
         sfuApp: string;
@@ -41,6 +47,8 @@ export interface ServiceTarget {
         sfuCloudflared: string;
     };
     readonly internal: {
+        /** The hostname ZITADEL connects to, and the one name the database's certificate carries. */
+        signinDb: string;
         authZitadel: string;
         authLogin: string;
         authBroker: string;
@@ -62,6 +70,8 @@ export interface ServiceTarget {
         keysCredential: string;
         /** The public half the host verifies with (`KEYS_VERIFY_KEYS`). */
         keysVerifyKeys: string;
+        /** The sign-in database's server certificate and key, held as JSON `{ cert, key }` (#746). */
+        signinDbServer: string;
     };
 }
 /** The platform's shared services, with the literals the platform steps use today. */

package/dist/plan/own-services.js

@@ -11,6 +11,8 @@ export function platformTarget() {
         kind: 'platform',
         names: {
             authDb: 'platform-auth-db',
+            signinDb: 'platform-signin-db',
+            signinDbMove: 'platform-signin-db-move',
             authZitadel: 'platform-auth-zitadel',
             authLogin: 'platform-auth-login',
             authBroker: 'platform-auth-broker',
@@ -24,6 +26,7 @@ export function platformTarget() {
             filesMigrate: 'files-migrate',
             filesRunner: 'files',
             filesBucket: 'platform-files',
+            signinBackupBucket: 'platform-signin-backups',
             jobsApp: 'jobs',
             jobsDb: 'jobs-scheduler-db',
             sfuApp: 'platform-sfu',
@@ -31,6 +34,7 @@ export function platformTarget() {
             sfuCloudflared: 'platform-sfu-cloudflared',
         },
         internal: {
+            signinDb: 'platform-signin-db',
             authZitadel: 'platform-auth-zitadel',
             authLogin: 'platform-auth-login',
             authBroker: 'platform-auth-broker',
@@ -50,6 +54,7 @@ export function platformTarget() {
             livekitKeys: 'livekit:platform:keys',
             keysCredential: 'keys:platform:credential',
             keysVerifyKeys: 'keys:platform:verifyKeys',
+            signinDbServer: 'signin-db:platform:server',
         },
     };
 }
@@ -61,6 +66,8 @@ export function orgTarget(org) {
         kind: 'org',
         names: {
             authDb: `${s}-auth-db`,
+            signinDb: `${s}-signin-db`,
+            signinDbMove: `${s}-signin-db-move`,
             authZitadel: `${s}-auth-zitadel`,
             authLogin: `${s}-auth-login`,
             authBroker: `${s}-auth-broker`,
@@ -74,6 +81,7 @@ export function orgTarget(org) {
             filesMigrate: `${s}-files-migrate`,
             filesRunner: `${s}-files`,
             filesBucket: `${s}-files`,
+            signinBackupBucket: `${s}-signin-backups`,
             jobsApp: `${s}-jobs`,
             jobsDb: `${s}-jobs-db`,
             sfuApp: `${s}-sfu`,
@@ -81,6 +89,7 @@ export function orgTarget(org) {
             sfuCloudflared: `${s}-sfu-cloudflared`,
         },
         internal: {
+            signinDb: `${s}-signin-db`,
             authZitadel: `${s}-auth-zitadel`,
             authLogin: `${s}-auth-login`,
             authBroker: `${s}-auth-broker`,
@@ -100,6 +109,7 @@ export function orgTarget(org) {
             livekitKeys: `livekit:org:${s}:keys`,
             keysCredential: `keys:org:${s}:credential`,
             keysVerifyKeys: `keys:org:${s}:verifyKeys`,
+            signinDbServer: `signin-db:org:${s}:server`,
         },
     };
 }

package/dist/plan/plan-apply.d.ts

@@ -199,6 +199,10 @@ export interface StepExecutor {
     }>;
     /** Whether the executor can mint an own org's Lettermint key: a Lettermint port and a reader for the held ref. */
     ownMailKeyMintable?(): boolean;
+    /** Whether the executor's held keys can store the sign-in database's CA and certificate (#746). Absent: true. */
+    ownSigninDbKeysPuttable?(): boolean;
+    /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). Absent: true. */
+    ownSigninDbBackupConfigured?(): boolean;
     /**
      * Whether the host's scoped ports for this own org include a files-organisation
      * port. The planner plans no `files:organisation` step for an own org while

package/dist/plan/plan-apply.js

@@ -7,7 +7,7 @@ import { AlreadyRunningError, StepFailedError } from '../runner/errors.js';
 import { StaleLeaseError, } from '../store.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
-import { NetworkMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
+import { NetworkMoveBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
 import { readLiveBuilds } from './build-record.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
@@ -443,6 +443,25 @@ export class FoundryPlanApply {
                     throw e;
                 }
             }
+            // The move of a sign-in database reads the old one, and the old one stays; a fresh dump is the way back.
+            if (detail.plannedSteps.some((s) => s.action.system === 'coolify' && s.action.kind === 'own-auth-db-move')) {
+                try {
+                    if (!this.backupGate)
+                        throw new SigninDbMoveBackupMissingError('no-gate');
+                    await requireFreshBackupForSigninMove({
+                        coolify: this.backupGate.coolify,
+                        orgId,
+                        recordedIds: (await this.store.getAppliedState(orgId))?.serviceIds ?? {},
+                        now: () => this.now().getTime(),
+                    });
+                }
+                catch (e) {
+                    if (e instanceof SigninDbMoveBackupMissingError) {
+                        await this.refuse(plan, 'sign-in database move without a fresh backup');
+                    }
+                    throw e;
+                }
+            }
             if (planNeedsConfirmation(plan.steps) &&
                 confirmedOrgName.trim() !== org.displayName.trim()) {
                 await this.refuse(plan, "destructive or migrating step without the org's name typed correctly");
@@ -1044,6 +1063,8 @@ export class FoundryPlanApply {
             oikosZoneReady: platformReadiness.oikosIngressApplied === true,
             ownMailKeyHeld: await this.ownMailKeyHeld(org),
             ownMailKeyMintable: this.executor.ownMailKeyMintable?.() ?? false,
+            ownSigninDbKeysPuttable: this.executor.ownSigninDbKeysPuttable?.() ?? true,
+            ownSigninDbBackupConfigured: this.executor.ownSigninDbBackupConfigured?.() ?? true,
             ...(this.backupGate
                 ? {
                     backupStorageUuid: (await this.platformDeps?.store.getServiceIds())?.[PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY] || null,
@@ -1690,6 +1711,7 @@ const STEP_FIELDS = {
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
     'coolify:own-auth': 'services.own',
+    'coolify:own-auth-db-move': 'services.own',
     'coolify:own-files': 'services.own',
     'coolify:own-files-r2': 'services.own',
     'coolify:own-jobs': 'services.own',