@wtfalch/foundry 0.38.0 → 0.39.1

package/dist/plan/platform-providers.d.ts

@@ -17,6 +17,7 @@ import { type FilesKeysMinted, type ProjectSource, type ServiceNetwork, type Ser
 import type { PlatformDriftedSteps, PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
 import { type BrokerDeployRecord, PLATFORM_ZITADEL_ORG_SCOPE_KEY } from './platform-diff.js';
 import type { PlatformOwnerInput } from './platform-org.js';
+import type { SigninDbBackupPort } from './signin-db-backup.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
 import { type PlatformUptimeDeps } from './uptime-worker.js';
@@ -132,7 +133,9 @@ export interface PlatformAuthSmtp {
 export interface PlatformAuthDeps {
     /** Overrides the Lettermint SMTP relay ZITADEL is given. Absent, Lettermint exactly as before. */
     smtp?: PlatformAuthSmtp;
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'raw'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'raw'> & 
+    /** An own org's sign-in database needs a volume and the CA file mount (#746); the platform's does not. */
+    Partial<Pick<CoolifyPort, 'listStorages' | 'createPersistentStorage' | 'createFileStorage'>>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -172,7 +175,16 @@ export interface PlatformAuthDeps {
      */
     heldKeys?: {
         resolve(ref: string): Promise<string | null>;
+        /** An own org's sign-in database CA and certificate are stored through this (#746). Without it a new company's sign-in step is blocked. */
+        put?(ref: string, value: string): Promise<void>;
     };
+    /**
+     * The bucket and storage key ports a company's sign-in database backup uses (#746): its own bucket and
+     * a key scoped to it. For an own org the executor fills this from the files host's `r2Buckets` and
+     * `r2Keys`; the platform's backup key is never used. Without it a company's sign-in database is not
+     * created and an existing one is not moved.
+     */
+    signinDbBackup?: SigninDbBackupPort;
     /** Clock, sleep and fetch for the readiness wait and delivery retries; real ones by default. */
     runtime?: PlatformAuthRuntime;
 }
@@ -190,6 +202,14 @@ export interface PlatformAuthRuntime {
     readyRequestTimeoutMs?: number;
     /** Told of every secret the sign-in step reads or mints, so the host can scrub it from logs and audit rows. */
     onSecret?: (value: string) => void;
+    /** How long a new or redeployed sign-in database may take to report healthy (default 5 minutes). */
+    signinDbTimeoutMs?: number;
+    /** How long ZITADEL may take to report stopped before a sign-in database move copies (default 2 minutes). */
+    signinDbStopTimeoutMs?: number;
+    /** How long the copy job of a sign-in database move may run (default 30 minutes). */
+    signinDbMoveTimeoutMs?: number;
+    /** Pause between polls of the copy job (default 10 seconds). */
+    signinDbMovePollMs?: number;
 }
 /**
  * An own org's scheduler only: the app's uuid, recorded and persisted before
@@ -458,6 +478,7 @@ export declare const AUTH_LOGIN_PORT = "3000";
  * everything else, including the root).
  */
 export declare const AUTH_ZITADEL_PATH_PATTERN = "^/(oidc|oauth|saml|management|admin|system|auth|assets|debug/healthz|ui/console|\\.well-known|v2|v2beta|zitadel\\.[A-Za-z0-9.]+)(/|$)";
+export declare const PLATFORM_AUTH_DB_SCOPE_KEY = "coolify_platform_auth_database";
 export declare const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = "coolify_platform_auth_zitadel_app";
 export declare const PLATFORM_AUTH_LOGIN_SCOPE_KEY = "coolify_platform_auth_login_app";
 /**
@@ -1172,6 +1193,25 @@ export declare function createAiManagementKeyMinter(options: {
     fetchImpl?: typeof fetch;
     now?: () => number;
 }): AiManagementKeyMinter;
+export declare function resolvePlatformServer(coolify: Pick<CoolifyPort, 'listServers'>): Promise<{
+    uuid: string;
+    ip?: string;
+}>;
+/**
+ * `executor.ts`'s `coolifyCalls`/`findOrCreateCallsApp`, restated here rather
+ * than imported: that method is private to `FoundryStepExecutor`, and this
+ * file holds no instance of that class to call it on. `running` says whether
+ * the app was already running or starting; the caller deploys it when not.
+ */
+export declare function findOrCreatePlatformApp(coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication'>, name: string, environment: {
+    id: number;
+}, create: () => Promise<{
+    uuid: string;
+}>): Promise<{
+    appId: string;
+    justCreated: boolean;
+    running: boolean;
+}>;
 /**
  * #211: names of the envs the platform's sign-in broker (`wtfalch/auth`'s
  * `broker/server.ts`) refuses to start without -- `ZITADEL_SERVICE_USER_TOKEN`/
@@ -1218,6 +1258,11 @@ export declare function brokerDeployNeeded(missingInputs: readonly string[], bro
  * wrote there. Paired with {@link brokerDeployNeeded}, which reads it back.
  */
 export declare function brokerDeployRecordValue(brokerAppId: string, authAppsRaw: string | undefined): string;
+/** Whether any desired env is missing from the app, or set to another value. */
+export declare function envsDiffer(coolify: Pick<CoolifyPort, 'listEnvs'>, appId: string, desired: Array<{
+    key: string;
+    value: string;
+}>): Promise<boolean>;
 /**
  * #171: everything {@link provisionPlatformFiles} needs beyond
  * {@link PlatformStepExecutionContext}, bundled for the same reason as

package/dist/plan/platform-providers.js

@@ -23,6 +23,8 @@ import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
 import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
+import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
+import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
@@ -1094,7 +1096,7 @@ export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|sy
  */
 const AUTH_BROKER_PATH_PATTERN = '^/api(/|$)';
 const PLATFORM_AUTH_PROJECT_SCOPE_KEY = 'coolify_project_platform_auth';
-const PLATFORM_AUTH_DB_SCOPE_KEY = 'coolify_platform_auth_database';
+export const PLATFORM_AUTH_DB_SCOPE_KEY = 'coolify_platform_auth_database';
 export const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = 'coolify_platform_auth_zitadel_app';
 export const PLATFORM_AUTH_LOGIN_SCOPE_KEY = 'coolify_platform_auth_login_app';
 const PLATFORM_AUTH_TUNNEL_SCOPE_KEY = 'cloudflare_platform_auth_tunnel';
@@ -1429,33 +1431,70 @@ export async function provisionAuthStack(scope, deps, target, input) {
     const projectUuid = await input.project.ensure(deps.coolify, scope);
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
     // ---- database ----------------------------------------------------------
-    let dbId = recorded[PLATFORM_AUTH_DB_SCOPE_KEY];
+    // A company's sign-in database is foundry's own TLS image (#746). A company still on the Coolify
+    // database keeps it until its move step has run (`signin-db-move.ts`); the platform's stays on it.
+    const legacyDbId = recorded[PLATFORM_AUTH_DB_SCOPE_KEY];
+    const tlsDatabase = target.kind === 'org' && Boolean(recorded[SIGNIN_DB_TLS_SCOPE_KEY] || !legacyDbId);
+    let dbId = legacyDbId;
     // A database ZITADEL has already run against may hold data encrypted with a
     // masterkey this run cannot see (see `ensureMasterkey`). A database that
     // exists but was never deployed against (a throw between its create and the
     // first deploy) is still empty, so a retry may generate the key.
-    const databaseInUse = Boolean(dbId && recorded[PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY]);
-    if (!dbId) {
-        const server = await resolvePlatformServer(deps.coolify);
-        const created = await deps.coolify.createPostgresDatabase({
-            project_uuid: projectUuid,
-            server_uuid: server.uuid,
-            environment_name: environment.name,
-            environment_uuid: environment.uuid,
-            name: target.names.authDb,
-            postgres_db: 'zitadel',
-            postgres_user: 'zitadel',
+    const databaseInUse = Boolean((tlsDatabase ? recorded[SIGNIN_DB_APP_SCOPE_KEY] : dbId) &&
+        recorded[PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY]);
+    let databaseUrl;
+    let signinDbCa;
+    if (tlsDatabase) {
+        const provisioned = await provisionSigninDb({
+            coolify: deps.coolify,
+            keys: deps.heldKeys,
+            runtime,
+            name: target.names.signinDb,
+            internalHost: target.internal.signinDb,
+            volumeName: `${target.names.signinDb}-data`,
+            serverCertRef: target.refs.signinDbServer,
+            slug: target.id,
+            backup: deps.signinDbBackup,
+            backupBucket: target.names.signinBackupBucket,
+            recorded,
+            label,
+            environment,
+            record,
+            create: dockerfileAppCreator(deps.coolify, {
+                projectUuid,
+                environment,
+                name: target.names.signinDb,
+                description: `${target.id}'s sign-in database with TLS (#746)`,
+            }),
         });
-        dbId = created.uuid;
-        await record(PLATFORM_AUTH_DB_SCOPE_KEY, dbId);
+        databaseUrl = provisioned.dsn;
+        signinDbCa = provisioned.ca;
+        await record(SIGNIN_DB_TLS_SCOPE_KEY, provisioned.appId);
     }
-    const db = await getDatabaseStarted(deps.coolify, dbId);
-    if (!db.internal_db_url) {
-        // Static config check before either app is touched (`diff.ts`'s
-        // `coolifyCalls` follows the same rule for its own databases): Coolify
-        // can take a moment to report a freshly created database's
-        // `internal_db_url`, so the next apply retries from a clean state.
-        throw new Error(`coolify:app for ${subject} (auth): the database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+    else {
+        if (!dbId) {
+            const server = await resolvePlatformServer(deps.coolify);
+            const created = await deps.coolify.createPostgresDatabase({
+                project_uuid: projectUuid,
+                server_uuid: server.uuid,
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                name: target.names.authDb,
+                postgres_db: 'zitadel',
+                postgres_user: 'zitadel',
+            });
+            dbId = created.uuid;
+            await record(PLATFORM_AUTH_DB_SCOPE_KEY, dbId);
+        }
+        const db = await getDatabaseStarted(deps.coolify, dbId);
+        if (!db.internal_db_url) {
+            // Static config check before either app is touched (`diff.ts`'s
+            // `coolifyCalls` follows the same rule for its own databases): Coolify
+            // can take a moment to report a freshly created database's
+            // `internal_db_url`, so the next apply retries from a clean state.
+            throw new Error(`coolify:app for ${subject} (auth): the database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+        }
+        databaseUrl = db.internal_db_url;
     }
     // ---- the ZITADEL app itself ---------------------------------------------
     const zitadelApp = await findOrCreatePlatformApp(deps.coolify, target.names.authZitadel, environment, async () => {
@@ -1473,6 +1512,8 @@ export async function provisionAuthStack(scope, deps, target, input) {
     });
     const zitadelAppId = zitadelApp.appId;
     await record(PLATFORM_AUTH_ZITADEL_SCOPE_KEY, zitadelAppId);
+    if (signinDbCa)
+        await ensureSigninDbCaFile(deps.coolify, zitadelAppId, signinDbCa, label);
     // Set on every run, not only after a create: a throw right after the
     // create must not leave the app unnamed for good, and the tunnel addresses
     // the app by this name. (The port cannot read the current name back, and
@@ -1575,7 +1616,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
         { key: 'ZITADEL_EXTERNALPORT', value: '443' },
         { key: 'ZITADEL_EXTERNALSECURE', value: 'true' },
         { key: 'ZITADEL_TLS_ENABLED', value: 'false' },
-        { key: 'ZITADEL_DATABASE_POSTGRES_DSN', value: db.internal_db_url },
+        { key: 'ZITADEL_DATABASE_POSTGRES_DSN', value: databaseUrl },
         { key: 'ZITADEL_FIRSTINSTANCE_SKIP', value: 'true' },
         { key: 'ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED', value: 'true' },
         // A username is unique per organisation, and the login name is `name@<org domain>`. Without it a
@@ -1665,13 +1706,24 @@ export async function provisionAuthStack(scope, deps, target, input) {
     await deps.coolify.bulkUpsertEnvs(brokerAppId, brokerEnvs);
     // Deploy an app that was just created, is not running (a throw after the
     // create left it never deployed, or it stopped), or whose envs changed.
-    if (zitadelApp.justCreated || !zitadelApp.running || zitadelEnvsChanged || zitadelRunOptionsNew) {
+    // A move that started ZITADEL on the TLS database and never saw it healthy there (#746): start it
+    // again and wait, so sign-in is not left down by a plan that finds nothing to do.
+    const zitadelUnconfirmed = Boolean(recorded[SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY]);
+    if (zitadelApp.justCreated ||
+        !zitadelApp.running ||
+        zitadelEnvsChanged ||
+        zitadelRunOptionsNew ||
+        zitadelUnconfirmed) {
         await deps.coolify.deploy(zitadelAppId);
         await record(PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY, zitadelAppId);
         // Only now: the options are live once the deploy went out. A throw between
         // the PATCH and here leaves the marker unset, so the next run deploys.
         await record(PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, AUTH_ZITADEL_RUN_OPTIONS);
     }
+    if (zitadelUnconfirmed) {
+        await waitHealthy(withCallTimeout(deps.coolify), zitadelAppId, runtime, label, 'ZITADEL');
+        await record(SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, '');
+    }
     if (loginApp.justCreated || !loginApp.running || loginEnvsChanged) {
         await deps.coolify.deploy(loginAppId);
     }
@@ -6229,7 +6281,7 @@ async function waitForInstance(url, runtime, sleep, label = 'platform:auth') {
         await sleep(interval);
     }
 }
-async function resolvePlatformServer(coolify) {
+export async function resolvePlatformServer(coolify) {
     const servers = await coolify.listServers();
     const server = servers.find((s) => s.is_usable && s.is_reachable) ?? servers[0];
     if (!server)
@@ -6242,7 +6294,7 @@ async function resolvePlatformServer(coolify) {
  * file holds no instance of that class to call it on. `running` says whether
  * the app was already running or starting; the caller deploys it when not.
  */
-async function findOrCreatePlatformApp(coolify, name, environment, create) {
+export async function findOrCreatePlatformApp(coolify, name, environment, create) {
     const existing = await coolify.findApplicationByName(name, {
         environmentIds: [environment.id],
     });
@@ -6397,7 +6449,7 @@ export function brokerDeployRecordValue(brokerAppId, authAppsRaw) {
     return JSON.stringify(record);
 }
 /** Whether any desired env is missing from the app, or set to another value. */
-async function envsDiffer(coolify, appId, desired) {
+export async function envsDiffer(coolify, appId, desired) {
     const live = new Map((await coolify.listEnvs(appId)).filter((e) => !e.is_preview).map((e) => [e.key, e.value]));
     return desired.some((e) => live.get(e.key) !== e.value);
 }
@@ -7498,7 +7550,9 @@ async function provisionPlatformHc(context, deps) {
         { key: 'DB_USER', value: dbUser },
         { key: 'DB_PASSWORD', value: dbPassword },
         { key: 'SITE_ROOT', value: `https://${hostname}` },
-        { key: 'ALLOWED_HOSTS', value: hostname },
+        // Django answers 400 to any other Host: foundry's readiness poll comes in as
+        // `platform-hc:8000` and Coolify's own health check as `localhost`.
+        { key: 'ALLOWED_HOSTS', value: `${hostname},${HC_INTERNAL_NAME},localhost` },
         // Healthchecks defaults this to `true` -- see this function's own doc
         // comment. `hostname` is public and Cloudflare-proxied, so sign-up stays
         // closed until a real invite mechanism exists.

package/dist/plan/signin-db-backup.d.ts

@@ -0,0 +1,105 @@
+import type { CoolifyPort } from './executor.js';
+import type { OwnFilesR2Keys } from './own-services.js';
+/**
+ * The nightly backup of a company's sign-in database (#746). Coolify's database backups cover Coolify
+ * databases only, and the TLS database is an application, so the schedule is a Coolify scheduled task of
+ * that application (`POST /applications/{uuid}/scheduled-tasks`, read from Coolify 4.4.2's
+ * `ScheduledTasksController`). Coolify runs the task's command with `docker exec` in the database's
+ * container at the task's frequency. The command dumps with `pg_dump` and puts the file in the company's
+ * own backup bucket, with a storage key that reaches that bucket alone (minted through the same host
+ * ports as the company's files bucket key, `ensureSigninDbBackupTarget`). The platform's backup key never
+ * reaches a company's container. It keeps nothing: Coolify's default of keeping every dump applies.
+ */
+/** Recorded id of the scheduled task (set only after Coolify lists it back as enabled). */
+export declare const SIGNIN_DB_BACKUP_TASK_SCOPE_KEY = "signin_db_backup_task";
+export declare const SIGNIN_DB_BACKUP_TASK_NAME = "signin-db-backup";
+/** Coolify's own name for "once a day", the frequency the platform's database backups use. */
+export declare const SIGNIN_DB_BACKUP_FREQUENCY = "daily";
+/** How long Coolify lets one run take, in seconds. */
+export declare const SIGNIN_DB_BACKUP_TIMEOUT_SECONDS = 3600;
+/** The company's own backup bucket and the storage key scoped to it. The key is a secret. */
+export interface SigninDbBackupTarget {
+    endpoint: string;
+    bucket: string;
+    /** R2 takes `auto`. */
+    region?: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+/** The host's bucket and storage key ports, the same ones the company's files bucket uses. */
+export interface SigninDbBackupPort {
+    r2Buckets: {
+        ensureBucket(name: string): Promise<{
+            bucket: string;
+            endpoint: string;
+        }>;
+    };
+    r2Keys: OwnFilesR2Keys;
+}
+/** The token id of the company's sign-in backup key, recorded once it is in the database app's env. */
+export declare const SIGNIN_DB_BACKUP_KEY_SCOPE_KEY = "signin_db_backup_key";
+/** The token id minted and not yet in the env: deleted before any new mint. */
+export declare const SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY = "signin_db_backup_key_undelivered";
+/** How long one call to the bucket or key port may take. */
+export declare const SIGNIN_DB_BACKUP_PORT_TIMEOUT_MS = 30000;
+/**
+ * The company's own bucket and a storage key that names that bucket alone. A key already in the
+ * database app's env whose token id is recorded is kept. Otherwise any earlier token of this company
+ * (recorded, or minted and never confirmed) is deleted first, so there are never two live tokens, then
+ * one is minted, registered as a secret and recorded as undelivered; the caller writes it to the env and
+ * then records it as delivered. A failed bucket or mint throws before the database is deployed or the
+ * move stops anything. Errors name the label only.
+ */
+export declare function ensureSigninDbBackupTarget(port: SigninDbBackupPort, input: {
+    bucketName: string;
+    label: string;
+    recorded: Readonly<Record<string, string>>;
+    /** What the database app's env holds now. */
+    held: {
+        keyId?: string;
+        secret?: string;
+    };
+    record(key: string, id: string): Promise<void>;
+    onSecret?(value: string): void;
+}): Promise<{
+    target: SigninDbBackupTarget;
+    tokenId: string;
+    fresh: boolean;
+}>;
+/** The env of the database app that the backup command reads. The command itself holds no value. */
+export declare const SIGNIN_DB_BACKUP_ENV: {
+    readonly endpoint: "BACKUP_S3_ENDPOINT";
+    readonly bucket: "BACKUP_S3_BUCKET";
+    readonly region: "BACKUP_S3_REGION";
+    readonly keyId: "BACKUP_S3_KEY_ID";
+    readonly secret: "BACKUP_S3_SECRET";
+    readonly prefix: "BACKUP_S3_PREFIX";
+};
+/** Where in the bucket a company's dumps go: `signin-db/<slug>/signin-db-<UTC time>.dump`. */
+export declare function signinDbBackupPrefix(slug: string): string;
+/** The env entries the backup command needs, for the database app. */
+export declare function signinDbBackupEnvs(target: SigninDbBackupTarget, slug: string): Array<{
+    key: string;
+    value: string;
+}>;
+/**
+ * The command Coolify runs in the container. A custom-format dump goes to a temporary file (an upload
+ * needs a length), is signed with SigV4 and put with curl, and the file is removed on every exit. The
+ * credentials reach curl on its standard input as a config, never in an argument. Every failure ends the
+ * run non-zero, and curl's error text names the HTTP status only. No single quote: Coolify wraps the
+ * command in single quotes.
+ */
+export declare function signinDbBackupCommand(user: string, database: string): string;
+/**
+ * Makes sure the database app has its backup task, and returns its uuid. The task is found by name
+ * before it is created, and updated to the full wanted body every time (Coolify hides the stored
+ * command from a token without the sensitive-read ability, so it cannot be compared). The task is then
+ * read back and must be listed enabled with the wanted frequency and timeout, or this throws: a
+ * schedule that cannot be seen is not a backup. The caller records the uuid. Errors name the label only.
+ */
+export declare function ensureSigninDbBackupTask(coolify: Pick<CoolifyPort, 'raw'>, appId: string, label: string, db: {
+    user: string;
+    database: string;
+}): Promise<string>;
+/** A company on the TLS database whose nightly dump is not scheduled yet: the sign-in step plans again to schedule it. */
+export declare function signinDbBackupMissing(recordedIds: Readonly<Record<string, string>>): boolean;

package/dist/plan/signin-db-backup.js

@@ -0,0 +1,193 @@
+import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db-tls.js';
+/**
+ * The nightly backup of a company's sign-in database (#746). Coolify's database backups cover Coolify
+ * databases only, and the TLS database is an application, so the schedule is a Coolify scheduled task of
+ * that application (`POST /applications/{uuid}/scheduled-tasks`, read from Coolify 4.4.2's
+ * `ScheduledTasksController`). Coolify runs the task's command with `docker exec` in the database's
+ * container at the task's frequency. The command dumps with `pg_dump` and puts the file in the company's
+ * own backup bucket, with a storage key that reaches that bucket alone (minted through the same host
+ * ports as the company's files bucket key, `ensureSigninDbBackupTarget`). The platform's backup key never
+ * reaches a company's container. It keeps nothing: Coolify's default of keeping every dump applies.
+ */
+/** Recorded id of the scheduled task (set only after Coolify lists it back as enabled). */
+export const SIGNIN_DB_BACKUP_TASK_SCOPE_KEY = 'signin_db_backup_task';
+export const SIGNIN_DB_BACKUP_TASK_NAME = 'signin-db-backup';
+/** Coolify's own name for "once a day", the frequency the platform's database backups use. */
+export const SIGNIN_DB_BACKUP_FREQUENCY = 'daily';
+/** How long Coolify lets one run take, in seconds. */
+export const SIGNIN_DB_BACKUP_TIMEOUT_SECONDS = 3600;
+/** How long the upload may take, in seconds: the dump has to leave time inside the task's own limit. */
+const UPLOAD_MAX_SECONDS = 1800;
+/** The token id of the company's sign-in backup key, recorded once it is in the database app's env. */
+export const SIGNIN_DB_BACKUP_KEY_SCOPE_KEY = 'signin_db_backup_key';
+/** The token id minted and not yet in the env: deleted before any new mint. */
+export const SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY = 'signin_db_backup_key_undelivered';
+/** How long one call to the bucket or key port may take. */
+export const SIGNIN_DB_BACKUP_PORT_TIMEOUT_MS = 30_000;
+async function portCall(work, label, what) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), SIGNIN_DB_BACKUP_PORT_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    catch (error) {
+        // The cause is dropped: a port's message is not ours to repeat, and may hold the secret.
+        throw new Error(`${label}: ${what} ${error instanceof Error && error.message === 'timeout'
+            ? `did not answer within ${SIGNIN_DB_BACKUP_PORT_TIMEOUT_MS / 1000} seconds`
+            : 'failed'}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const usable = (value) => typeof value === 'string' && value.length > 0 && value.length <= 200;
+/**
+ * The company's own bucket and a storage key that names that bucket alone. A key already in the
+ * database app's env whose token id is recorded is kept. Otherwise any earlier token of this company
+ * (recorded, or minted and never confirmed) is deleted first, so there are never two live tokens, then
+ * one is minted, registered as a secret and recorded as undelivered; the caller writes it to the env and
+ * then records it as delivered. A failed bucket or mint throws before the database is deployed or the
+ * move stops anything. Errors name the label only.
+ */
+export async function ensureSigninDbBackupTarget(port, input) {
+    const { label, recorded } = input;
+    const bucket = await portCall(port.r2Buckets.ensureBucket(input.bucketName), label, `the sign-in backup bucket ${input.bucketName}`);
+    const kept = recorded[SIGNIN_DB_BACKUP_KEY_SCOPE_KEY];
+    if (kept && input.held.keyId && input.held.secret) {
+        input.onSecret?.(input.held.secret);
+        input.onSecret?.(input.held.keyId);
+        return {
+            target: {
+                endpoint: bucket.endpoint,
+                bucket: bucket.bucket,
+                accessKeyId: input.held.keyId,
+                secretAccessKey: input.held.secret,
+            },
+            tokenId: kept,
+            fresh: false,
+        };
+    }
+    for (const [scopeKey, tokenId] of [
+        [
+            SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY,
+            recorded[SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY],
+        ],
+        [SIGNIN_DB_BACKUP_KEY_SCOPE_KEY, kept],
+    ]) {
+        if (!tokenId)
+            continue;
+        await portCall(port.r2Keys.deleteBucketKey(tokenId), label, `deleting the earlier sign-in backup key ${tokenId}, so no new one was made:`);
+        await input.record(scopeKey, '');
+    }
+    const key = await portCall(port.r2Keys.mintBucketKey(bucket.bucket), label, 'the sign-in backup key mint');
+    if (usable(key?.secretAccessKey))
+        input.onSecret?.(key.secretAccessKey);
+    if (usable(key?.accessKeyId))
+        input.onSecret?.(key.accessKeyId);
+    // A token id we can read is recorded even when the rest of the answer is unusable, so it is deleted next run.
+    if (usable(key?.tokenId))
+        await input.record(SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY, key.tokenId);
+    if (!usable(key?.accessKeyId) || !usable(key?.secretAccessKey) || !usable(key?.tokenId)) {
+        throw new Error(`${label}: the sign-in backup key mint answered with an unusable key`);
+    }
+    return {
+        target: {
+            endpoint: bucket.endpoint,
+            bucket: bucket.bucket,
+            accessKeyId: key.accessKeyId,
+            secretAccessKey: key.secretAccessKey,
+        },
+        tokenId: key.tokenId,
+        fresh: true,
+    };
+}
+/** The env of the database app that the backup command reads. The command itself holds no value. */
+export const SIGNIN_DB_BACKUP_ENV = {
+    endpoint: 'BACKUP_S3_ENDPOINT',
+    bucket: 'BACKUP_S3_BUCKET',
+    region: 'BACKUP_S3_REGION',
+    keyId: 'BACKUP_S3_KEY_ID',
+    secret: 'BACKUP_S3_SECRET',
+    prefix: 'BACKUP_S3_PREFIX',
+};
+/** Where in the bucket a company's dumps go: `signin-db/<slug>/signin-db-<UTC time>.dump`. */
+export function signinDbBackupPrefix(slug) {
+    return `signin-db/${slug}`;
+}
+/** The env entries the backup command needs, for the database app. */
+export function signinDbBackupEnvs(target, slug) {
+    return [
+        { key: SIGNIN_DB_BACKUP_ENV.endpoint, value: target.endpoint.replace(/\/+$/, '') },
+        { key: SIGNIN_DB_BACKUP_ENV.bucket, value: target.bucket },
+        { key: SIGNIN_DB_BACKUP_ENV.region, value: target.region ?? 'auto' },
+        { key: SIGNIN_DB_BACKUP_ENV.keyId, value: target.accessKeyId },
+        { key: SIGNIN_DB_BACKUP_ENV.secret, value: target.secretAccessKey },
+        { key: SIGNIN_DB_BACKUP_ENV.prefix, value: signinDbBackupPrefix(slug) },
+    ];
+}
+/**
+ * The command Coolify runs in the container. A custom-format dump goes to a temporary file (an upload
+ * needs a length), is signed with SigV4 and put with curl, and the file is removed on every exit. The
+ * credentials reach curl on its standard input as a config, never in an argument. Every failure ends the
+ * run non-zero, and curl's error text names the HTTP status only. No single quote: Coolify wraps the
+ * command in single quotes.
+ */
+export function signinDbBackupCommand(user, database) {
+    const e = SIGNIN_DB_BACKUP_ENV;
+    return [
+        'set -eu',
+        'f=/tmp/signin-db-$(date -u +%Y%m%dT%H%M%SZ).dump',
+        'trap "rm -f $f" EXIT',
+        `pg_dump -U ${user} -d ${database} -Fc -f "$f"`,
+        `printf "user = \\"%s:%s\\"\\n" "$${e.keyId}" "$${e.secret}" | curl -sS --fail --max-time ${UPLOAD_MAX_SECONDS} --aws-sigv4 "aws:amz:$${e.region}:s3" -K - -T "$f" "$${e.endpoint}/$${e.bucket}/$${e.prefix}/\${f##*/}"`,
+    ].join('; ');
+}
+function rows(body) {
+    if (!Array.isArray(body))
+        throw new Error('scheduled tasks list has an unexpected shape');
+    return body.map((row) => (row && typeof row === 'object' ? row : {}));
+}
+/**
+ * Makes sure the database app has its backup task, and returns its uuid. The task is found by name
+ * before it is created, and updated to the full wanted body every time (Coolify hides the stored
+ * command from a token without the sensitive-read ability, so it cannot be compared). The task is then
+ * read back and must be listed enabled with the wanted frequency and timeout, or this throws: a
+ * schedule that cannot be seen is not a backup. The caller records the uuid. Errors name the label only.
+ */
+export async function ensureSigninDbBackupTask(coolify, appId, label, db) {
+    const base = `/applications/${appId}/scheduled-tasks`;
+    const body = {
+        name: SIGNIN_DB_BACKUP_TASK_NAME,
+        command: signinDbBackupCommand(db.user, db.database),
+        frequency: SIGNIN_DB_BACKUP_FREQUENCY,
+        timeout: SIGNIN_DB_BACKUP_TIMEOUT_SECONDS,
+        enabled: true,
+    };
+    const found = rows(await coolify.raw('GET', base)).find((t) => t.name === SIGNIN_DB_BACKUP_TASK_NAME && typeof t.uuid === 'string');
+    let uuid = found?.uuid;
+    if (found) {
+        await coolify.raw('PATCH', `${base}/${found.uuid}`, body);
+    }
+    else {
+        uuid = (await coolify.raw('POST', base, body))?.uuid;
+    }
+    if (typeof uuid !== 'string' || !uuid) {
+        throw new Error(`${label}: Coolify did not return the sign-in database's backup schedule`);
+    }
+    const listed = rows(await coolify.raw('GET', base)).find((t) => t.uuid === uuid);
+    if (!listed ||
+        listed.enabled !== true ||
+        listed.frequency !== SIGNIN_DB_BACKUP_FREQUENCY ||
+        listed.timeout !== SIGNIN_DB_BACKUP_TIMEOUT_SECONDS) {
+        throw new Error(`${label}: the sign-in database's backup schedule is not listed as enabled in Coolify; nothing was moved`);
+    }
+    return uuid;
+}
+/** A company on the TLS database whose nightly dump is not scheduled yet: the sign-in step plans again to schedule it. */
+export function signinDbBackupMissing(recordedIds) {
+    return (Boolean(recordedIds[SIGNIN_DB_TLS_SCOPE_KEY]) && !recordedIds[SIGNIN_DB_BACKUP_TASK_SCOPE_KEY]);
+}