@wtfalch/foundry 0.41.2 → 0.43.0

package/dist/plan/platform-providers.js

@@ -3,17 +3,21 @@ import { isIPv4 } from 'node:net';
 import { applyObjects, openInstance, platformMailSettingsObjects } from '@wtfalch/email/postmaster';
 import { VERSIONS, coolifyImageFor, floatingTagBlocked, pinnedRef } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
-import { ownerMailboxes } from '../org.js';
+import { ownerMailboxes, sharedSecretRef, } from '../org.js';
+import { applyArchonBlueGreen } from './archon-blue-green.js';
+import { ARCHON_REPO, archonSubject, healthTokenName, tunnelOriginFor, } from './blue-green.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
 import { recordBuiltCommit } from './build-record.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { previewsOn } from './coolify-previews.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { placedOnPlatform } from './destinations.js';
-import { ACCESS_POLICY_NAME, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
+import { ACCESS_POLICY_NAME, LOG_DIR, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, tcpProbe, } from './health-check-settings.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { LIMITS, limited } from './own-limits.js';
+import { createReleaseHost } from './release-host.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
 import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
@@ -22,7 +26,10 @@ import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied,
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
 import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { PLATFORM_ARCHON_IN_APP_SCOPE_KEY, archonInAppBack, archonInAppBind, archonInAppHost, archonInAppPoint, archonInAppUnbind, } from './sign-in-archon.js';
+import { LOGIN_HOST_BINDINGS_ENV } from './sign-in-bindings.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
+import { SIGN_IN_BASE_PATH, SIGN_IN_BUILD_ARG_ENV, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppOnSharedLogin, signInLoginNames, signInUpstream, } from './sign-in.js';
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
 import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
@@ -169,6 +176,86 @@ export class FoundryPlatformStepExecutor {
     limitedOnPlatform(deps, profile) {
         return { ...deps, coolify: limited(this.onPlatform(deps.coolify), profile) };
     }
+    /** Every Coolify server and why platform-archon's blue/green cannot run here, for the planner. */
+    async archonBlueGreen() {
+        const archon = this.archon;
+        if (!archon)
+            return { blocked: 'the host built the platform executor without archon dependencies' };
+        if (typeof archon.heldKeys?.put !== 'function') {
+            return { blocked: 'the host cannot hold the health token (its held keys cannot put)' };
+        }
+        const servers = await archon.coolify.listServers();
+        return {
+            servers: servers.map((s) => ({
+                uuid: s.uuid,
+                usable: s.is_usable,
+                reachable: s.is_reachable,
+            })),
+        };
+    }
+    /** The release runner's outside calls for platform-archon (`plan/release-host.ts`). The token is only read. */
+    releaseHost(platform, subject, context, renew) {
+        const archon = this.archon;
+        const recorded = context.recordedIds();
+        const primaryBlueAppId = recorded[`coolify:app:${PLATFORM_ARCHON_KEY}`];
+        const primaryUuid = recorded.coolify_server;
+        if (!archon || !primaryBlueAppId || !primaryUuid)
+            return null;
+        return createReleaseHost({
+            subject,
+            context,
+            coolify: archon.coolify,
+            healthToken: async () => (await archon.heldKeys?.resolve(sharedSecretRef(platform.ownerOrgId, healthTokenName(subject.id)))) ?? null,
+            secret: (value) => archon.runtime?.onSecret?.(value),
+            primaryUuid,
+            primaryBlueAppId,
+            runtime: this.runtime,
+            ...(archon.runtime?.fetch ? { fetch: archon.runtime.fetch } : {}),
+            renew,
+            label: `coolify:release:${subject.id}`,
+        });
+    }
+    async archonBlueGreenStep(action, context) {
+        if (!this.archon) {
+            throw new Error('platform:archon needs FoundryPlatformStepExecutor to be constructed with its archon dependencies (#175)');
+        }
+        const deps = this.limitedOnPlatform(this.archon, LIMITS.platformArchon);
+        const platform = context.platform;
+        const subject = archonSubject(platform, ARCHON_REPO);
+        const recorded = context.recordedIds();
+        const blueAppId = recorded[`coolify:app:${PLATFORM_ARCHON_KEY}`];
+        const projectUuid = recorded[PLATFORM_ARCHON_PROJECT_SCOPE_KEY];
+        const tunnelId = recorded[PLATFORM_ARCHON_TUNNEL_SCOPE_KEY];
+        if (!subject || !blueAppId || !projectUuid || !tunnelId) {
+            throw new Error('coolify:archon-bluegreen: platform-archon is not applied yet');
+        }
+        if (typeof deps.heldKeys?.put !== 'function') {
+            throw new Error('coolify:archon-bluegreen: the host cannot hold the health token');
+        }
+        await applyArchonBlueGreen({
+            subject,
+            ownerOrgId: platform.ownerOrgId,
+            desired: { primary: String(action.desired.primary ?? '') },
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: async () => {
+                await context.persist?.();
+            },
+            coolify: deps.coolify,
+            heldKeys: { resolve: deps.heldKeys.resolve, put: deps.heldKeys.put },
+            secret: (value) => deps.runtime?.onSecret?.(value),
+            projectUuid,
+            blueAppId,
+            tunnelId,
+            hostname: platform.archon.hostname,
+            tunnels: await platformTunnels(deps, context.recordedIds(), 'coolify:archon-bluegreen'),
+            runtime: deps.runtime ?? {},
+            sleep: deps.runtime?.sleep ?? defaultSleep,
+            logDir: LOG_DIR,
+            isRunning: isRunningOrStarting,
+        });
+        return undefined;
+    }
     async blockedSteps(platform, recordedIds = {}, owner = {}) {
         const blocked = {};
         if (platform.auth.enabled && !this.auth) {
@@ -594,8 +681,9 @@ export class FoundryPlatformStepExecutor {
         }
         if (platform.auth.enabled && this.auth) {
             const loginClientDrifted = await authLoginClientDrifted(platform, this.auth, recordedIds);
-            if (loginClientDrifted)
+            if (loginClientDrifted || (await this.signInLoginDrifted(this.auth, recordedIds))) {
                 result.auth = true;
+            }
         }
         // #380: once the runner app is recorded, re-check its live env against
         // every setting `ensureStarted()` requires -- the gap that left the
@@ -653,13 +741,45 @@ export class FoundryPlatformStepExecutor {
         await coolify.deploy(runnerAppId);
         return { [PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY]: normalHosts(wanted).join(',') };
     }
+    /** True while a company signs in on its apps' own addresses through the platform's login. */
+    async signInLoginWanted() {
+        return (await this.declaredOrgStore.list()).some(inAppOnSharedLogin);
+    }
+    /**
+     * In-app sign-in: the login app that serves `/sign-in` is wanted and either not recorded, gone from
+     * Coolify, or holding a host table other than the login's. The step then plans again and repairs it.
+     * A Coolify read that fails counts as not drifted, with one fixed log line (the error can carry values).
+     */
+    async signInLoginDrifted(auth, recordedIds) {
+        if (!(await this.signInLoginWanted()))
+            return false;
+        const signInId = recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY];
+        const loginId = recordedIds[PLATFORM_AUTH_LOGIN_SCOPE_KEY];
+        if (!signInId)
+            return true;
+        if (!loginId)
+            return false;
+        try {
+            const [login, signIn] = await Promise.all([
+                currentEnvValue(auth.coolify, loginId, LOGIN_HOST_BINDINGS_ENV),
+                currentEnvValue(auth.coolify, signInId, LOGIN_HOST_BINDINGS_ENV),
+            ]);
+            return (login ?? '') !== (signIn ?? '');
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return true;
+            console.error('platform:auth: could not read the login apps to compare their host tables; treating the in-app login as in step');
+            return false;
+        }
+    }
     async execute(action, context) {
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_AUTH_KEY) {
             if (!this.auth) {
                 throw new Error('platform:auth needs FoundryPlatformStepExecutor to be constructed with its auth dependencies (#168)');
             }
             const company = await this.declaredOrgStore.get(context.platform.ownerOrgId);
-            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), company);
+            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), company, await this.signInLoginWanted());
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_FILES_KEY) {
             if (!this.files) {
@@ -687,6 +807,9 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformEdge(context, this.limitedOnPlatform(this.edge, LIMITS.platformEdge));
         }
+        if (action.system === 'coolify' && action.kind === 'archon-bluegreen') {
+            return this.archonBlueGreenStep(action, context);
+        }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
             action.key === PLATFORM_ARCHON_KEY) {
@@ -919,6 +1042,7 @@ export async function provisionJobsHost(scope, deps, target, input) {
         const server = await resolvePlatformServer(coolify);
         const githubApp = await coolify.requireGithubApp();
         const created = await coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -1552,6 +1676,7 @@ export async function provisionAuthStack(scope, deps, target, input) {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -1571,11 +1696,46 @@ export async function provisionAuthStack(scope, deps, target, input) {
         custom_internal_name: target.internal.authLogin,
         ...IMAGE_HEALTHCHECK_SETTINGS,
     });
+    // ---- the in-app login app (`/sign-in`) ------------------------------------
+    // A Next.js base path is fixed at build, so the login that serves `/sign-in` is a second app built from
+    // the same Dockerfile with the base path as a build-time env. It is recorded as applied only at the end,
+    // once it is deployed and holds the login token.
+    const signInNames = input.signInLogin ? signInLoginNames(target) : null;
+    const signInApp = signInNames
+        ? await findOrCreateSignInLoginApp(deps.coolify, {
+            name: signInNames.name,
+            environment,
+            label,
+            create: async () => {
+                const server = await resolvePlatformServer(deps.coolify);
+                const githubApp = await deps.coolify.requireGithubApp();
+                return deps.coolify.createGithubAppApplication({
+                    project_uuid: projectUuid,
+                    server_uuid: server.uuid,
+                    environment_name: environment.name,
+                    environment_uuid: environment.uuid,
+                    github_app_uuid: githubApp.uuid,
+                    git_repository: AUTH_REPO,
+                    git_branch: gitRef,
+                    build_pack: 'dockerfile',
+                    name: signInNames.name,
+                    dockerfile_location: AUTH_LOGIN_DOCKERFILE,
+                });
+            },
+        })
+        : null;
+    if (signInApp && signInNames) {
+        await deps.coolify.updateApplication(signInApp.appId, {
+            custom_internal_name: signInNames.internal,
+            ...IMAGE_HEALTHCHECK_SETTINGS,
+        });
+    }
     // ---- the broker app (#204) -------------------------------------------------
     const brokerApp = await findOrCreatePlatformApp(deps.coolify, target.names.authBroker, environment, async () => {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -1709,6 +1869,19 @@ export async function provisionAuthStack(scope, deps, target, input) {
     await deps.coolify.bulkUpsertEnvs(zitadelAppId, zitadelEnvs);
     await deps.coolify.bulkUpsertEnvs(loginAppId, loginEnvs);
     await deps.coolify.bulkUpsertEnvs(brokerAppId, brokerEnvs);
+    // The in-app login: the login's env, the base path as a build argument, and the host table.
+    let signInEnvsChanged = false;
+    if (signInApp && input.signInLogin) {
+        const bindings = input.signInLogin.bindings ??
+            (await currentEnvValue(deps.coolify, loginAppId, LOGIN_HOST_BINDINGS_ENV));
+        const signInEnvs = [
+            ...loginEnvs,
+            { key: SIGN_IN_BUILD_ARG_ENV, value: SIGN_IN_BASE_PATH, buildTime: true },
+            ...(bindings ? [{ key: LOGIN_HOST_BINDINGS_ENV, value: bindings }] : []),
+        ];
+        signInEnvsChanged = await envsDiffer(deps.coolify, signInApp.appId, signInEnvs);
+        await deps.coolify.bulkUpsertEnvs(signInApp.appId, signInEnvs);
+    }
     // Deploy an app that was just created, is not running (a throw after the
     // create left it never deployed, or it stopped), or whose envs changed.
     // A move that started ZITADEL on the TLS database and never saw it healthy there (#746): start it
@@ -1732,6 +1905,9 @@ export async function provisionAuthStack(scope, deps, target, input) {
     if (loginApp.justCreated || !loginApp.running || loginEnvsChanged) {
         await deps.coolify.deploy(loginAppId);
     }
+    if (signInApp && (signInApp.justCreated || !signInApp.running || signInEnvsChanged)) {
+        await deps.coolify.deploy(signInApp.appId);
+    }
     // #211: the broker's own `server.ts` refuses to start without
     // `ZITADEL_SERVICE_USER_TOKEN`/`_FILE` and `LETTERMINT_API_TOKEN` --
     // deploying it without them only produces a container that crash-loops
@@ -2010,8 +2186,33 @@ export async function provisionAuthStack(scope, deps, target, input) {
     const loginClientOtherInputsMissing = brokerMissingInputs.filter((m) => m !== 'ZITADEL_SERVICE_USER_TOKEN');
     const freshRecordedIds = scope.recordedIds();
     const freshLoginClientRecord = parseLoginClientRecord(freshRecordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]);
-    const loginClientNeedsMint = !freshLoginClientRecord ||
+    let loginClientNeedsMint = !freshLoginClientRecord ||
         (await authLoginClientDriftedAt({ hostname, bearerRef: target.refs.instanceBearer }, deps, freshRecordedIds));
+    // The in-app login app needs the same token. When the login already holds a live one, it is copied
+    // (no new mint, so the login is not restarted) if the in-app login holds none or another one -- a re-mint
+    // while the app was not delivered to leaves it a revoked token. When the login's cannot be read, the mint
+    // below delivers it. The tokens are compared, never logged.
+    if (signInApp && !loginClientNeedsMint) {
+        const signInHeld = await currentEnvValue(deps.coolify, signInApp.appId, SERVICE_USER_TOKEN_ENV);
+        const held = await currentEnvValue(deps.coolify, loginAppId, SERVICE_USER_TOKEN_ENV);
+        if (held && held !== signInHeld) {
+            runtime.onSecret?.(held);
+            const attempts = runtime.deliverAttempts ?? 3;
+            try {
+                await retryPlatformAuthCall(attempts, sleep, () => deps.coolify.bulkUpsertEnvs(signInApp.appId, [
+                    { key: SERVICE_USER_TOKEN_ENV, value: held },
+                ]));
+                await retryPlatformAuthCall(attempts, sleep, () => deps.coolify.deploy(signInApp.appId, true));
+            }
+            catch {
+                // Never echo the cause: Coolify's validation error can include the rejected value (the token).
+                throw new Error(`${label}: the login token could not be copied to ${signInNames?.name} after ${attempts} tries`);
+            }
+        }
+        else if (!held && !signInHeld) {
+            loginClientNeedsMint = true;
+        }
+    }
     if (loginClientNeedsMint && loginClientOtherInputsMissing.length === 0) {
         // An own org never mints a second time on top of a token that may be live:
         // the platform's re-mint revokes the old one, which would take the org's
@@ -2040,6 +2241,9 @@ export async function provisionAuthStack(scope, deps, target, input) {
         // comment above gives.
         await record(PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, loginClientUserId);
         const deliverAttempts = runtime.deliverAttempts ?? 3;
+        const receivers = signInApp
+            ? `the login app, the in-app login app (${signInNames?.name}) and broker`
+            : 'the login app and broker';
         try {
             await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.bulkUpsertEnvs(loginAppId, [
                 { key: 'ZITADEL_SERVICE_USER_TOKEN', value: loginClientToken },
@@ -2047,6 +2251,11 @@ export async function provisionAuthStack(scope, deps, target, input) {
             await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.bulkUpsertEnvs(brokerAppId, [
                 { key: 'ZITADEL_SERVICE_USER_TOKEN', value: loginClientToken },
             ]));
+            if (signInApp) {
+                await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.bulkUpsertEnvs(signInApp.appId, [
+                    { key: SERVICE_USER_TOKEN_ENV, value: loginClientToken },
+                ]));
+            }
             // Forced: an unforced deploy answers 200 "skipped" when one for the
             // same commit is already queued -- likely here, since this function's
             // own deploys above may just have queued one for either app. An
@@ -2055,6 +2264,9 @@ export async function provisionAuthStack(scope, deps, target, input) {
             // (#216 follow-up review, item 2).
             await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.deploy(loginAppId, true));
             await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.deploy(brokerAppId, true));
+            if (signInApp) {
+                await retryPlatformAuthCall(deliverAttempts, sleep, () => deps.coolify.deploy(signInApp.appId, true));
+            }
         }
         catch {
             // Never echo the underlying error: Coolify's validation error can
@@ -2074,8 +2286,8 @@ export async function provisionAuthStack(scope, deps, target, input) {
             // saying "its prior token was already revoked" there would describe a
             // revoke that never happened, so the message only says so when it did.
             throw new Error(revokedPriorPat
-                ? `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; its prior token was already revoked, so the login app and broker are down until a later apply mints and delivers a fresh one`
-                : `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; this is its first token, so the login app and broker still have none until a later apply mints and delivers one`);
+                ? `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; its prior token was already revoked, so ${receivers} are down until a later apply mints and delivers a fresh one`
+                : `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; this is its first token, so ${receivers} still have none until a later apply mints and delivers one`);
         }
         // #216 round 4/5: records what was actually delivered -- the user id,
         // the exact PAT id, and (round 5) a hash of the exact token -- so the
@@ -2085,6 +2297,11 @@ export async function provisionAuthStack(scope, deps, target, input) {
         // own doc comment, and `authLoginClientDrifted`'s, for why.
         await record(PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, loginClientRecordValue(loginClientUserId, loginClientPatId, loginClientToken));
     }
+    // The in-app login app is ready once it is created, deployed (above) and holds the token: only then is
+    // it recorded, so the login-host step plans no app host for a login that cannot serve it yet.
+    if (signInApp && (await currentEnvValue(deps.coolify, signInApp.appId, SERVICE_USER_TOKEN_ENV))) {
+        await record(SIGN_IN_LOGIN_APP_SCOPE_KEY, signInApp.appId);
+    }
     // ---- the owner company's own sign-in org ----------------------------------
     // Archon signs people in from this org; the `foundry` org holds none. The
     // company executor finds the same org by name (its slug) and makes no second.
@@ -2206,7 +2423,7 @@ const platformAuthProject = {
     },
 };
 /** The platform's sign-in: {@link provisionAuthStack} with {@link platformTarget} and the platform's own inputs. */
-async function provisionPlatformAuth(context, deps, ownerCompany = null) {
+async function provisionPlatformAuth(context, deps, ownerCompany = null, signInLogin = false) {
     const { platform } = context;
     const scope = scopeFromPlatform(context);
     return provisionAuthStack(scope, deps, platformTarget(), {
@@ -2218,6 +2435,8 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         smtpSender: `noreply@${platform.apex}`,
         defaultRedirectUri: platform.archon.enabled ? `https://${platform.archon.hostname}` : null,
         ownerCompany,
+        // In-app sign-in: the second login app copies the login's host table (the host's port writes that).
+        ...(signInLogin ? { signInLogin: { bindings: null } } : {}),
     });
 }
 /**
@@ -3469,8 +3688,6 @@ const PLATFORM_ARCHON_INTERNAL_NAME = 'platform-archon';
 const PLATFORM_ARCHON_TUNNEL_NAME = 'platform-archon-tunnel';
 /** #197: the one Coolify app that runs `cloudflared` for {@link PLATFORM_ARCHON_TUNNEL_NAME}. */
 const PLATFORM_ARCHON_CLOUDFLARED_APP_NAME = 'platform-archon-cloudflared';
-/** https://github.com/wtfalch/archon: one Dockerfile at its root, `runner` stage on port 3000. */
-const ARCHON_REPO = 'wtfalch/archon';
 const ARCHON_PORT = '3000';
 /**
  * #480: Archon's own health route (`@wtfalch/reporting`'s `healthHandler`,
@@ -3814,6 +4031,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -3850,6 +4068,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     await deps.coolify.updateApplication(appId, {
         custom_network_aliases: PLATFORM_ARCHON_INTERNAL_NAME,
         is_consistent_container_name_enabled: false,
+        // #788: previews off; `archonRollingUpdateDrifted` plans the step again if they come back on.
+        is_preview_deployments_enabled: false,
         // #543: the quartet below is the shared `healthCheckSettings` helper
         // every other app foundry creates now also goes through -- Archon's own
         // fields, unchanged in value, just no longer hand-rolled here.
@@ -3920,6 +4140,60 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         await record(PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY, created.clientId);
         clientId = created.clientId;
     }
+    // ---- in-app sign-in -----------------------------------------------------------
+    // Archon signs people in on its own address, through the owner company's in-app login app. Wanted when
+    // the company has the switch on and that login app is applied. In this order: trusted and bound, then
+    // the env (`SIGNIN_UPSTREAM`) written and deployed, then the client's base URI, so the proxy is never
+    // on for an address the login cannot serve and the base URI never points at an app that does not proxy.
+    // Given up in the reverse order: the base URI back first, then the env, then the binding and the domain.
+    const inAppWanted = Boolean(ownerSignIn.signInInApp && ownerSignIn.signInLoginAppId && ownerCompany);
+    const archonAppZitadelId = context.recordedIds()[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    const inAppOwed = archonInAppHost(context.recordedIds()) !== '';
+    const inAppCalls = () => {
+        const { ensureTrustedDomain, deleteTrustedDomain, updateOidcAppLoginBaseUri, allowPerAppLoginBaseUri, } = zitadel;
+        if (!ensureTrustedDomain || !deleteTrustedDomain || !updateOidcAppLoginBaseUri) {
+            throw new Error("platform:archon: the owner company's ZITADEL port lacks ensureTrustedDomain, deleteTrustedDomain or updateOidcAppLoginBaseUri, so Archon cannot sign in on its own address");
+        }
+        return {
+            ensureTrustedDomain: ensureTrustedDomain.bind(zitadel),
+            deleteTrustedDomain: deleteTrustedDomain.bind(zitadel),
+            updateOidcAppLoginBaseUri: updateOidcAppLoginBaseUri.bind(zitadel),
+            ...(allowPerAppLoginBaseUri
+                ? { allowPerAppLoginBaseUri: allowPerAppLoginBaseUri.bind(zitadel) }
+                : {}),
+        };
+    };
+    const inAppTarget = {
+        coolify: deps.coolify,
+        loginHost: ownerSignIn.hostname,
+        host: hostname,
+        organisationId: authOrgId,
+        projectId: project.id,
+        appId: archonAppZitadelId ?? '',
+    };
+    if (inAppWanted && ownerSignIn.signInLoginAppId) {
+        if (!archonAppZitadelId) {
+            throw new Error("platform:archon: Archon's sign-in client is not recorded yet");
+        }
+        // A port that cannot allow a per-app base URI stops the step before anything is written.
+        if (!zitadel.allowPerAppLoginBaseUri) {
+            throw new Error("platform:archon: the owner company's ZITADEL port cannot allow a per-app login base URI, so Archon cannot sign in on its own address");
+        }
+        await archonInAppBind({
+            ...inAppTarget,
+            zitadel: inAppCalls(),
+            loginAppId: ownerSignIn.signInLoginAppId,
+            clientId,
+        });
+    }
+    else if (inAppOwed) {
+        // Given up: the client goes back to the company's login host before the app stops proxying.
+        await archonInAppBack({
+            ...inAppTarget,
+            host: archonInAppHost(context.recordedIds()),
+            zitadel: inAppCalls(),
+        });
+    }
     // ---- env ------------------------------------------------------------------
     const envs = [
         { key: 'APP_URL', value: `https://${hostname}` },
@@ -3929,6 +4203,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         { key: 'AUTH_CLIENT_ID', value: clientId },
         ...(firstOwnerLink ? [{ key: 'ARCHON_FIRST_OWNER_LINK', value: firstOwnerLink }] : []),
     ];
+    if (inAppWanted)
+        envs.push({ key: SIGN_IN_UPSTREAM_ENV, value: signInUpstream(ownerCompany ?? undefined) });
     // #265: an owner URL or reporting site already on the app is kept as it is.
     // The owner URL must name the adopted database's host, or the app's two
     // database URLs would point at different databases.
@@ -4103,7 +4379,13 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         const staleOperator = stale.key === 'AUTHZ_BOOTSTRAP_OPERATOR';
         // The link is written only while both ids are known; one that is no longer wanted goes.
         const staleLink = !firstOwnerLink && stale.key === 'ARCHON_FIRST_OWNER_LINK';
-        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime || staleOperator || staleLink) &&
+        // In-app sign-in switched off: the proxy to the login goes.
+        const staleSignIn = !inAppWanted && stale.key === SIGN_IN_UPSTREAM_ENV;
+        if ((stale.key === 'FILES_MANAGEMENT_KEY' ||
+            staleUptime ||
+            staleOperator ||
+            staleLink ||
+            staleSignIn) &&
             stale.uuid) {
             await deps.coolify.deleteEnv(appId, stale.uuid);
             staleKeyDeleted = true;
@@ -4308,7 +4590,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         ingress: [
             {
                 hostname,
-                service: `http://${PLATFORM_ARCHON_INTERNAL_NAME}:${ARCHON_PORT}`,
+                // Through the balancer once platform-archon runs blue/green and its balancer is written.
+                service: tunnelOriginFor(archonSubject(platform, ARCHON_REPO), recorded, recorded.coolify_server, `http://${PLATFORM_ARCHON_INTERNAL_NAME}:${ARCHON_PORT}`),
             },
             { service: 'http_status:404' },
         ],
@@ -4363,6 +4646,25 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     if (archonDeployedNow && !selfRedeploy) {
         await waitForHealthyVersion(appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
     }
+    // In-app sign-in, last half. The env is deployed and Archon answers health, or no deploy was owed (the
+    // running env is the one written), so Archon now proxies `/sign-in/*` (on) or no longer does (off).
+    // A host that deploys itself has not confirmed that yet: the next run does the rest, and until then the
+    // marker stays as it was, so the step is planned again. Recorded last of its own calls.
+    if (!archonDeployedNow || !selfRedeploy) {
+        if (inAppWanted) {
+            await archonInAppPoint({ ...inAppTarget, zitadel: inAppCalls() });
+            await record(PLATFORM_ARCHON_IN_APP_SCOPE_KEY, `${hostname}=${clientId}`);
+        }
+        else if (inAppOwed) {
+            await archonInAppUnbind({
+                ...inAppTarget,
+                host: archonInAppHost(context.recordedIds()),
+                zitadel: inAppCalls(),
+                ...(ownerSignIn.signInLoginAppId ? { loginAppId: ownerSignIn.signInLoginAppId } : {}),
+            });
+            await record(PLATFORM_ARCHON_IN_APP_SCOPE_KEY, '');
+        }
+    }
     // #398: the deployment finished and answers health, so Archon now runs with
     // the key id its env carries. `provisionPlatformIntegrations` drops the
     // previous public key only on this marker.
@@ -5158,7 +5460,8 @@ async function archonRollingUpdateDrifted(coolify, appId) {
         const app = await coolify.getApplication(appId);
         return (app.settings?.is_consistent_container_name_enabled === true ||
             app.custom_network_aliases !== PLATFORM_ARCHON_INTERNAL_NAME ||
-            app.health_check_enabled !== true);
+            app.health_check_enabled !== true ||
+            previewsOn(app));
     }
     catch {
         return false;
@@ -5770,6 +6073,7 @@ async function provisionPlatformAi(context, deps) {
             const server = await resolvePlatformServer(coolify);
             const githubApp = await coolify.requireGithubApp();
             return coolify.createGithubAppApplication({
+                is_preview_deployments_enabled: false,
                 project_uuid: projectUuid,
                 server_uuid: server.uuid,
                 environment_name: environment.name,
@@ -6314,6 +6618,31 @@ export async function findOrCreatePlatformApp(coolify, name, environment, create
     const created = await create();
     return { appId: created.uuid, justCreated: true, running: false };
 }
+const SERVICE_USER_TOKEN_ENV = 'ZITADEL_SERVICE_USER_TOKEN';
+/**
+ * {@link findOrCreatePlatformApp} for the in-app login app, which adopts only an app that is its own: one
+ * of that name outside this environment, or built from another repository, is refused and left as it is.
+ * The check reads the application list directly: a lookup by name through the limits wrapper would patch
+ * the stranger's resource limits before this could refuse it.
+ */
+async function findOrCreateSignInLoginApp(coolify, input) {
+    const { name, environment, label } = input;
+    const listed = await coolify.raw('GET', '/applications');
+    if (!Array.isArray(listed)) {
+        throw new Error(`${label}: Coolify's application list could not be read, so ${name} is not touched`);
+    }
+    for (const app of listed) {
+        if (app.name !== name)
+            continue;
+        if (app.environment_id !== environment.id) {
+            throw new Error(`${label}: an application named ${name} exists outside the ${environment.name} environment of the sign-in project; foundry does not adopt it`);
+        }
+        if (app.git_repository !== undefined && !app.git_repository.endsWith(AUTH_REPO)) {
+            throw new Error(`${label}: the application ${name} is built from ${app.git_repository}, not ${AUTH_REPO}; foundry does not adopt it`);
+        }
+    }
+    return findOrCreatePlatformApp(coolify, name, environment, input.create);
+}
 /**
  * #211: names of the envs the platform's sign-in broker (`wtfalch/auth`'s
  * `broker/server.ts`) refuses to start without -- `ZITADEL_SERVICE_USER_TOKEN`/
@@ -6790,6 +7119,7 @@ export async function provisionFilesHost(scope, deps, target, input) {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -7183,6 +7513,7 @@ async function provisionPlatformEdge(context, deps) {
     const app = await findOrCreatePlatformApp(deps.coolify, EDGE_APP_NAME, environment, async () => {
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
@@ -8082,6 +8413,7 @@ async function provisionPlatformIntegrations(action, context, deps) {
         const server = await resolvePlatformServer(coolify);
         const githubApp = await coolify.requireGithubApp();
         return coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,

package/dist/plan/providers-readers.js

@@ -1,6 +1,8 @@
 import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { APP_ENTRY_KEY } from '../org.js';
 import { BOULE_MAIL_TOKEN_ENV, BOULE_MANAGED_ENV_KEYS } from './boule.js';
+import { previewsOn } from './coolify-previews.js';
+import { SIGN_IN_UPSTREAM_ENV } from './sign-in.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
  * — the one place foundry records a provider's own id for an org today,
@@ -169,9 +171,10 @@ async function withHealthCheckConfig(client, resource, recorded) {
         // above notes for `ports_exposes` -- `getApplication` returns the raw
         // Coolify API response regardless.
         const healthCheckEnabled = app.health_check_enabled;
+        // #788: the same read says whether pull-request previews are on.
         return {
             ...resource,
-            config: { ...resource.config, healthCheckEnabled },
+            config: { ...resource.config, healthCheckEnabled, previewsEnabled: previewsOn(app) },
         };
     }
     catch {
@@ -243,8 +246,9 @@ async function withAgoraEnvConfig(client, resource, recorded) {
     ]);
     const env = {};
     for (const e of envs) {
-        if (!e.is_preview && e.key.startsWith('AGORA_'))
+        if (!e.is_preview && (e.key.startsWith('AGORA_') || e.key === SIGN_IN_UPSTREAM_ENV)) {
             env[e.key] = e.value;
+        }
     }
     // `@wtfalch/providers`' `CoolifyApplication` type does not declare
     // `ports_exposes` (as of 0.7.3), but `getApplication` returns the raw