@wtfalch/foundry 0.39.1 → 0.39.2

package/dist/plan/executor.js

@@ -4431,18 +4431,27 @@ export class FoundryStepExecutor {
             ecKeyPem: secrets.value.masEcKeyPem,
         }));
         const introspection = await this.ensureChatIntrospection(org, zitadelOrgId, project.id, service.appId, context);
-        await this.ports.coolify.bulkUpsertEnvs(service.appId, chatServiceEnvs({
-            orgSlug: org.slug,
-            companyName: org.displayName,
-            issuer,
-            audience: project.id,
-            zitadelOrgId,
-            agoraHost,
-            masClientId: secrets.value.masClientId,
-            masClientSecret: secrets.value.masClientSecret,
-            introspectionClientId: introspection.clientId,
-            introspectionClientSecret: introspection.clientSecret,
-        }));
+        // The internal token mounts chat-service's `/_chat/internal/*` routes, which the platform uptime
+        // step calls whether or not calls are on. A usable one (also the one calls-chat shares) is kept;
+        // otherwise one is made. Its value never reaches a log, a scope id or an error.
+        const heldInternalToken = (await this.ports.coolify.listEnvs(service.appId)).find((e) => e.key === 'CHAT_INTERNAL_TOKEN' && !e.is_preview)?.value;
+        const internalTokenUsable = typeof heldInternalToken === 'string' && /^\S{32,}$/.test(heldInternalToken);
+        const internalToken = internalTokenUsable ? heldInternalToken : randomBytes(32).toString('hex');
+        await this.ports.coolify.bulkUpsertEnvs(service.appId, [
+            ...chatServiceEnvs({
+                orgSlug: org.slug,
+                companyName: org.displayName,
+                issuer,
+                audience: project.id,
+                zitadelOrgId,
+                agoraHost,
+                masClientId: secrets.value.masClientId,
+                masClientSecret: secrets.value.masClientSecret,
+                introspectionClientId: introspection.clientId,
+                introspectionClientSecret: introspection.clientSecret,
+            }),
+            { key: 'CHAT_INTERNAL_TOKEN', value: internalToken },
+        ]);
         // Split the same way `coolifyApp`'s and `cmsSite`'s own databases are
         // (#239, #456): `DATABASE_URL_OWNER` is the superuser string,
         // `DATABASE_URL` is a minted `chat_rt` role -- `chat` is the literal
@@ -4459,7 +4468,8 @@ export class FoundryStepExecutor {
         for (const app of [mas, synapse, service]) {
             if (!app.existed ||
                 secrets.changed ||
-                (app === service && (serviceDbPush.changed || introspection.changed)) ||
+                (app === service &&
+                    (serviceDbPush.changed || introspection.changed || !internalTokenUsable)) ||
                 !isRunningOrStarting((await this.ports.coolify.getApplication(app.appId)).status)) {
                 // #543: `'ready'` for the service (it has a real route, probed
                 // through Agora); `'deployment-only'` for Synapse/MAS, same as this

package/dist/plan/platform-diff.d.ts

@@ -884,6 +884,8 @@ export declare const PLATFORM_HC_KEY = "platform:hc";
  * read back, never regenerated -- see `ensureGeneratedEnv`).
  */
 export declare const PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY = "hc_applied_hostname";
+/** The id of the Cloudflare Access app in front of hc. Unrecorded (or empty) plans the hc step, so an already-applied hc gets the gate. */
+export declare const PLATFORM_HC_ACCESS_SCOPE_KEY = "cloudflare_platform_hc_access_app";
 export declare const PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY = "hc_applied_git_ref";
 /**
  * #540 round 2: the held-key ref a human puts hc's first project API key

package/dist/plan/platform-diff.js

@@ -987,6 +987,8 @@ export const PLATFORM_HC_KEY = 'platform:hc';
  * read back, never regenerated -- see `ensureGeneratedEnv`).
  */
 export const PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY = 'hc_applied_hostname';
+/** The id of the Cloudflare Access app in front of hc. Unrecorded (or empty) plans the hc step, so an already-applied hc gets the gate. */
+export const PLATFORM_HC_ACCESS_SCOPE_KEY = 'cloudflare_platform_hc_access_app';
 export const PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY = 'hc_applied_git_ref';
 /**
  * #540 round 2: the held-key ref a human puts hc's first project API key
@@ -2595,7 +2597,8 @@ function planHc(platform, recordedIds, executorBlocked) {
     const { hostname, gitRef } = platform.hc;
     const applied = Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_HC_KEY)]) &&
         recordedIds[PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
-        recordedIds[PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY] === gitRef;
+        recordedIds[PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY] === gitRef &&
+        Boolean(recordedIds[PLATFORM_HC_ACCESS_SCOPE_KEY]);
     if (applied)
         return { step: null, blocked: null };
     if (executorBlocked)

package/dist/plan/platform-providers.d.ts

@@ -1501,6 +1501,12 @@ export interface PlatformAccessProviderDeps {
         deliverAttempts?: number;
     };
 }
+/**
+ * Healthchecks' own status route (`hc/api/urls.py`, `views.status`): 200 `OK` once
+ * the database answers. `/` redirects an anonymous visitor to the login page (302),
+ * which Coolify's health check, wanting 200, counts as unhealthy.
+ */
+export declare const HC_HEALTH_CHECK_PATH = "/api/v3/status/";
 /**
  * The only paths the AI host's public route serves; everything else answers 404 at the tunnel. A company entry's key
  * holds `ai.runs:create` and `ai.offerings:invoke` (`AI_ENTRY_PERMISSIONS`), and `@wtfalch/ai`'s client reaches them
@@ -1530,9 +1536,15 @@ export interface PlatformHcDeps {
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
     tunnels: PlatformTunnelsFactory;
+    /** F4.access: every Access app call, through edge at its recorded address (see {@link PlatformAccessFactory}). */
+    access: PlatformAccessFactory;
+    /** The emails the Access app in front of the web UI lets through ({@link PlatformArchonDeps.accessEmails}). */
+    accessEmails: readonly string[];
     /** Clock, sleep and fetch for the readiness wait; real ones by default. */
     runtime?: PlatformHcRuntime;
 }
+export declare const PLATFORM_HC_ACCESS_APP_NAME = "foundry:hc";
+export declare const hcPublicAccessScopeKey: (name: string) => string;
 export declare function filesKeys(deps: PlatformFilesDeps | undefined): {
     workerUrl: string;
     credential: string;

package/dist/plan/platform-providers.js

@@ -21,7 +21,7 @@ import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAI
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
 import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
@@ -347,6 +347,10 @@ export class FoundryPlatformStepExecutor {
             const hcTagBlocked = hcImageTagBlocked(platform.hc.gitRef);
             if (hcTagBlocked)
                 blocked.hc = hcTagBlocked;
+            else if (this.hc.accessEmails.length === 0) {
+                blocked.hc =
+                    'the heartbeat server is blocked, not planned: the host names no email the Cloudflare Access app in front of it may let through';
+            }
         }
         // foundry#544: `'hosted'` needs none of `hc`'s own applied state -- only
         // the self-hosted provider's standing note depends on `hc` being
@@ -710,7 +714,8 @@ export class FoundryPlatformStepExecutor {
             if (!this.hc) {
                 throw new Error('platform:hc needs FoundryPlatformStepExecutor to be constructed with its hc dependencies (#540)');
             }
-            return provisionPlatformHc(context, this.limitedOnPlatform(this.hc, LIMITS.platformHc));
+            const ownerCompany = await this.declaredOrgStore.get(context.platform.ownerOrgId);
+            return provisionPlatformHc(context, this.limitedOnPlatform(this.hc, LIMITS.platformHc), ownerCompany);
         }
         if (action.system === 'zitadel' &&
             action.kind === 'archon-org' &&
@@ -7393,12 +7398,11 @@ const HC_INTERNAL_NAME = 'platform-hc';
 /** Healthchecks' own default uWSGI/gunicorn port inside the container. */
 const HC_PORT = '8000';
 /**
- * Healthchecks ships no dedicated readiness route (confirmed against its
- * `hc/front/urls.py`: the closest is `checks/<uuid>/status/`, which needs a
- * check's own id) -- `/` (`views.index`) is the documented fallback, a
- * public page for an anonymous visitor.
+ * Healthchecks' own status route (`hc/api/urls.py`, `views.status`): 200 `OK` once
+ * the database answers. `/` redirects an anonymous visitor to the login page (302),
+ * which Coolify's health check, wanting 200, counts as unhealthy.
  */
-const HC_HEALTH_CHECK_PATH = '/';
+export const HC_HEALTH_CHECK_PATH = '/api/v3/status/';
 const PLATFORM_HC_DB = 'hc';
 const PLATFORM_HC_DB_USER = 'hc';
 /** The tunnel that carries the AI host's public hostname, and the app that runs its connector. */
@@ -7450,13 +7454,17 @@ function hcImageTagBlocked(tag) {
  * (`platform-diff.ts`'s `planHc`) is what stops this running on every
  * apply, not a live comparison in here.
  */
-async function provisionPlatformHc(context, deps) {
+async function provisionPlatformHc(context, deps, ownerCompany = null) {
     const { platform } = context;
     const hostname = platform.hc.hostname;
     const gitRef = platform.hc.gitRef;
     const tagBlocked = hcImageTagBlocked(gitRef);
     if (tagBlocked)
         throw new Error(tagBlocked);
+    if (deps.accessEmails.length === 0) {
+        throw new Error('platform:hc: no Access emails given; refusing to put the heartbeat server behind an Access app nobody can pass');
+    }
+    const accessEmails = archonAccessEmails(deps.accessEmails, ownerCompany);
     const recorded = context.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
@@ -7557,6 +7565,8 @@ async function provisionPlatformHc(context, deps) {
         // comment. `hostname` is public and Cloudflare-proxied, so sign-up stays
         // closed until a real invite mechanism exists.
         { key: 'REGISTRATION_OPEN', value: 'False' },
+        // Healthchecks turns Django's debug mode on unless told otherwise: error pages would show settings.
+        { key: 'DEBUG', value: 'False' },
     ];
     if (secretKey)
         envs.push({ key: 'SECRET_KEY', value: secretKey });
@@ -7569,8 +7579,22 @@ async function provisionPlatformHc(context, deps) {
         await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `${internalUrl}${HC_HEALTH_CHECK_PATH}` }, runtime, sleep, 'platform:hc', `hc stays at ${recorded[PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
     }
     await record(PLATFORM_HC_INTERNAL_URL_SCOPE_KEY, internalUrl);
-    // ---- tunnel and DNS ---------------------------------------------------------
+    // ---- Cloudflare Access, before the hostname resolves ------------------------
     const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:hc');
+    const access = await platformAccess(deps, context.recordedIds(), 'platform:hc');
+    const accessAppId = await ensureHcAccess(access, hostname, accessEmails, async () => {
+        // The app is about to be rebuilt: the step is planned again until it is recorded
+        // again, and the hostname answers 404 meanwhile, so it is never served without the gate.
+        await record(PLATFORM_HC_ACCESS_SCOPE_KEY, '');
+        const open = await tunnels.findTunnelByName(HC_TUNNEL_NAME);
+        if (open)
+            await tunnels.putTunnelConfig(open.id, { ingress: [{ service: 'http_status:404' }] });
+    });
+    await ensureHcPublicAccess(access, hostname, record);
+    if (recorded[PLATFORM_HC_ACCESS_SCOPE_KEY] !== accessAppId) {
+        await record(PLATFORM_HC_ACCESS_SCOPE_KEY, accessAppId);
+    }
+    // ---- tunnel and DNS ---------------------------------------------------------
     const existingTunnel = await tunnels.findTunnelByName(HC_TUNNEL_NAME);
     const tunnel = existingTunnel ?? (await tunnels.createTunnel(HC_TUNNEL_NAME));
     await record(PLATFORM_HC_TUNNEL_SCOPE_KEY, tunnel.id);
@@ -7613,6 +7637,82 @@ async function provisionPlatformHc(context, deps) {
     await record(PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: appId };
 }
+/**
+ * Paths a machine calls on hc, each its own Access app with one bypass policy:
+ * `/api` (Archon's heartbeats client, behind Healthchecks' `X-Api-Key`) and
+ * `/ping` (the uptime Worker and the backups, by the check's secret ping URL).
+ */
+const PLATFORM_HC_PUBLIC_PATHS = [
+    { name: 'api', path: '/api' },
+    { name: 'ping', path: '/ping' },
+];
+export const PLATFORM_HC_ACCESS_APP_NAME = 'foundry:hc';
+const hcPublicAppName = (name) => `${PLATFORM_HC_ACCESS_APP_NAME}:public:${name}`;
+export const hcPublicAccessScopeKey = (name) => `cloudflare_platform_hc_access_public_${name}`;
+/**
+ * The Access app in front of hc's web UI: the one-time PIN to the declared
+ * emails only. Adopts only an app of its own name on the hostname; one with
+ * other policies, another provider or other emails is rebuilt after
+ * `closeGate`.
+ */
+async function ensureHcAccess(cf, domain, emails, closeGate) {
+    const { id: pinId } = await cf.ensureOneTimePinProvider();
+    const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
+    const foreign = onDomain.find((a) => a.name !== PLATFORM_HC_ACCESS_APP_NAME);
+    if (foreign) {
+        throw new Error(`platform:hc: Access app '${foreign.name}' already holds ${domain}; foundry does not adopt it`);
+    }
+    const create = async () => {
+        const created = await cf.createAccessApp({
+            name: PLATFORM_HC_ACCESS_APP_NAME,
+            domain,
+            type: 'self_hosted',
+            allowedIdps: [pinId],
+            autoRedirectToIdentity: true,
+        });
+        await cf.createAccessPolicy(created.id, archonAccessPolicy(emails));
+        return created.id;
+    };
+    const existing = onDomain[0];
+    if (!existing)
+        return create();
+    const policies = await cf.listAccessPolicies(existing.id);
+    if (policies.length === 1 &&
+        policies[0]?.name === ACCESS_POLICY_NAME &&
+        sameEmails(policies[0].include, emails) &&
+        accessAppPinned(existing, pinId)) {
+        return existing.id;
+    }
+    await closeGate();
+    await cf.deleteAccessApp(existing.id);
+    return create();
+}
+/** {@link ensureArchonPublicAccess} for hc's {@link PLATFORM_HC_PUBLIC_PATHS}. */
+async function ensureHcPublicAccess(cf, hostname, record) {
+    for (const { name, path } of PLATFORM_HC_PUBLIC_PATHS) {
+        const domain = `${hostname}${path}`;
+        const appName = hcPublicAppName(name);
+        const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
+        const foreign = onDomain.find((a) => a.name !== appName);
+        if (foreign) {
+            throw new Error(`platform:hc: Access app '${foreign.name}' already holds ${domain}; foundry does not adopt it`);
+        }
+        let id = onDomain[0]?.id;
+        if (id && !onlyBypassEveryone(await cf.listAccessPolicies(id))) {
+            await cf.deleteAccessApp(id);
+            id = undefined;
+        }
+        if (!id) {
+            id = (await cf.createAccessApp({ name: appName, domain, type: 'self_hosted' })).id;
+            await cf.createAccessPolicy(id, {
+                name: PLATFORM_ARCHON_PUBLIC_POLICY_NAME,
+                decision: 'bypass',
+                include: [{ everyone: {} }],
+            });
+        }
+        await record(hcPublicAccessScopeKey(name), id);
+    }
+}
 /**
  * The runtime `DATABASE_URL` the names app gets: the value already set on
  * it, else a new `names_rt` credential on the database's host, the

package/dist/plan/uptime-worker.js

@@ -187,8 +187,8 @@ export async function provisionPlatformUptime(context, deps) {
     const hostname = platform.archon.hostname;
     const held = await heldUptimeValues(deps);
     // The chat bot comes before the upload: its room is one of the Worker's variables. A call that fails
-    // stops the step here, and the next apply makes it again (the marker below says whether a token may
-    // already have been minted).
+    // is logged and the Worker deploys without it; the next apply makes the call again (the marker below
+    // says whether a token may already have been minted).
     const ownerChat = context.owner?.chat ?? null;
     let chatRoomId = recorded[PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY] || '';
     if (deps.chat && ownerChat && ownerChat.subjects.length > 0) {
@@ -207,20 +207,32 @@ export async function provisionPlatformUptime(context, deps) {
             }
             // A marker, or a room already made, means the bot exists and its token is not held: rotate.
             const rotate = Boolean(lost) || Boolean(chatRoomId);
-            let bot = await callChatBot(deps.chat, ownerChat, rotate);
-            if (!bot.accessToken && !rotate)
-                bot = await callChatBot(deps.chat, ownerChat, true);
-            const chatToken = bot.accessToken;
-            if (!chatToken) {
-                throw new Error('platform:uptime: chat-service returned no token for the bot, even when asked to rotate it');
+            // A chat call that fails never stops the Worker: it deploys without the chat variables, the
+            // marker above stays, and the next apply makes the call again (foundry#748).
+            let chatToken;
+            try {
+                let bot = await callChatBot(deps.chat, ownerChat, rotate);
+                if (!bot.accessToken && !rotate)
+                    bot = await callChatBot(deps.chat, ownerChat, true);
+                if (!bot.accessToken) {
+                    throw new Error('chat-service returned no token for the bot');
+                }
+                chatToken = bot.accessToken;
+                chatRoomId = bot.roomId;
+            }
+            catch {
+                // The cause is dropped: it can carry a response body. One fixed line says what happened.
+                console.error('platform:uptime: the chat bot could not be made; the Worker deploys without chat alerts and the next apply tries again');
+                chatRoomId = '';
+            }
+            if (chatToken) {
+                context.recordScopeId(PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, chatRoomId);
+                await context.persist?.();
+                await attempt('holding the chat bot token', () => deps.deliverSecret(PLATFORM_UPTIME_CHAT_TOKEN_REF, chatToken));
+                context.recordScopeId(PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, '');
+                await context.persist?.();
+                held.CHAT_ACCESS_TOKEN = chatToken;
             }
-            chatRoomId = bot.roomId;
-            context.recordScopeId(PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, chatRoomId);
-            await context.persist?.();
-            await attempt('holding the chat bot token', () => deps.deliverSecret(PLATFORM_UPTIME_CHAT_TOKEN_REF, chatToken));
-            context.recordScopeId(PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, '');
-            await context.persist?.();
-            held.CHAT_ACCESS_TOKEN = chatToken;
         }
     }
     const workerVars = uptimeEffectiveVars(deps.vars, deps.chat && ownerChat && chatRoomId

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.39.1",
+  "version": "0.39.2",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",