@wtfalch/foundry 0.51.5 → 0.52.0

package/dist/plan/diff.d.ts

@@ -95,6 +95,10 @@ export interface PlanOrgOptions {
     customersDirectory?: boolean;
     /** C3: the executor can mint Boule's Archon credential (`FoundryStepExecutorPorts.mintBouleArchonCredential`). */
     bouleArchonCredential?: boolean;
+    /** The executor can store a Worker app database's CA and certificate (`FoundryStepExecutor.workerAppDbKeysPuttable`). Absent: true. */
+    workerAppDbKeysPuttable?: boolean;
+    /** The host supplies the backup bucket a Worker app database dumps into (`FoundryStepExecutor.workerAppDbBackupConfigured`). Absent: true. */
+    workerAppDbBackupConfigured?: boolean;
     /** The executor can store the sign-in database's CA and certificate (`FoundryStepExecutor.ownSigninDbKeysPuttable`). Absent: true. */
     ownSigninDbKeysPuttable?: boolean;
     /** The host supplies the backup bucket the sign-in database dumps into (`FoundryStepExecutor.ownSigninDbBackupConfigured`). Absent: true. */

package/dist/plan/diff.js

@@ -37,6 +37,7 @@ import { planRemoteDatabase } from './remote-database.js';
 import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, signInDomainBlockedText, signInOrgDomain, } from './sign-in-org.js';
 import { SIGN_IN_BASE_PATH, SIGN_IN_IMAGE_TAG_SUFFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_LOGIN_INTERNAL_NAME, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, inAppSignIn, inAppStatePairs, inAppTargets, } from './sign-in.js';
 import { withStepSystem } from './step-system.js';
+import { WORKER_APP_DB_BLOCKED_KEY, WORKER_APP_DB_LEGACY_NOTE_KEY, WORKER_APP_DB_SCOPE_KEYS, planWorkerAppDb, } from './worker-app-db.js';
 import { brokerKeyDelivered, planWorkerApps } from './worker-app.js';
 import { planWorkers } from './worker.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
@@ -465,6 +466,16 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const database = planDatabase(org, byKey, claimed, recordedIds);
     if (database)
         plannedSteps.push(database);
+    // A Worker app's own TLS database, also before the Worker app that connects to it.
+    const workerAppDb = planWorkerAppDb({
+        org,
+        recordedIds,
+        now: (options.now ?? Date.now)(),
+        keysPuttable: options.workerAppDbKeysPuttable ?? true,
+        backupConfigured: options.workerAppDbBackupConfigured ?? true,
+    });
+    if (workerAppDb.step)
+        plannedSteps.push(workerAppDb.step);
     const authIssuer = 'error' in agoraHost ? null : agoraHost.issuer;
     const app = planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, platformReadiness);
     plannedSteps.push(...app.steps);
@@ -659,8 +670,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         ...(options.workerAppDatabase
             ? {
                 database: {
-                    databaseReady: Boolean(recordedIds[`coolify:database:${org.id}`]) ||
-                        plannedSteps.some((s) => s.action.system === 'coolify' && s.action.kind === 'database'),
+                    databaseReady: Boolean(recordedIds[WORKER_APP_DB_SCOPE_KEYS.app] &&
+                        recordedIds[WORKER_APP_DB_SCOPE_KEYS.tls]) ||
+                        plannedSteps.some((s) => s.action.system === 'coolify' && s.action.kind === 'worker-app-db'),
                     tunnelReady: Boolean(recordedIds[`cloudflare:tunnel:${org.id}`]) ||
                         plannedSteps.some((s) => s.action.system === 'cloudflare' && s.action.kind === 'tunnel'),
                     accessReady: edgeNeeded(platformReadiness, ['access', 'tunnels', 'dns', 'zones']) === null,
@@ -777,6 +789,12 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...entryAiKeys.blocked);
     unmanaged.push(...edgeWorkers.blocked);
     unmanaged.push(...workerApps.blocked);
+    if (workerAppDb.blocked) {
+        unmanaged.push({ description: workerAppDb.blocked, key: WORKER_APP_DB_BLOCKED_KEY });
+    }
+    if (workerAppDb.note) {
+        unmanaged.push({ description: workerAppDb.note, key: WORKER_APP_DB_LEGACY_NOTE_KEY });
+    }
     unmanaged.push(...mcp.blocked);
     unmanaged.push(...customers.blocked);
     unmanaged.push(...entryEdgeKeys.blocked);
@@ -3635,13 +3653,16 @@ function planDatabase(org, byKey, claimed, recordedIds) {
     // #444: only a company whose app database is still its own Coolify database
     // plans one. A new company, and one that has moved, has it on its Postgres
     // server: recorded, or provisioned by a step earlier in this plan.
-    // A Worker app's database is reached through the Coolify database's id (its Hyperdrive route
-    // and tunnel), so a Worker app entry with a database always plans that database.
-    const workerAppDatabase = org.hosting.entries.some((entry) => entry.workerApp?.database);
+    // A Worker app's database is foundry's own TLS Postgres (`worker-app-db.ts`), never this one:
+    // an org whose entries use a database only through Worker apps plans no Coolify database, and
+    // a recorded one is left as it is.
+    if (org.hosting.entries.some((entry) => entry.workerApp?.database) &&
+        !org.hosting.entries.some((entry) => entry.database)) {
+        return null;
+    }
     const appHome = ORG_SERVICE_SCHEMAS.find((home) => home.schema === 'app');
     const legacy = appHome?.legacyKey(org);
-    if (!workerAppDatabase &&
-        (!appHome || !legacy || !recordedIds[legacy] || serviceOnServer(org, appHome, recordedIds))) {
+    if (!appHome || !legacy || !recordedIds[legacy] || serviceOnServer(org, appHome, recordedIds)) {
         return null;
     }
     return planHostingToggle('coolify', 'database', org.hosting.entries.some(entryHasDatabase), org, byKey, claimed, () => `provision a database for ${org.slug}'s app`, () => `park ${org.slug}'s database (data is retained, not deleted -- #7 corrections 1)`);

package/dist/plan/executor.d.ts

@@ -2021,6 +2021,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     bouleArchonCredentialAvailable(): boolean;
     /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
     ownSigninDbKeysPuttable(): boolean;
+    /** Whether the held keys can store a Worker app database's CA and certificate. */
+    workerAppDbKeysPuttable(): boolean;
+    /** Whether the host supplies the backup bucket a Worker app database dumps into (the files host's bucket and key ports). */
+    workerAppDbBackupConfigured(): boolean;
     /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). */
     ownSigninDbBackupConfigured(): boolean;
     /** What the executor's own files dependencies supply, for the planner's blocked lines. */
@@ -3318,6 +3322,8 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * platform's password, and every secret the step reads registered for redaction.
      */
     private ownAuthDeps;
+    /** `plan/worker-app-db.ts`: the org's Worker app database as a TLS Postgres, and its server certificate's renewal. */
+    private workerAppDb;
     /** `plan/signin-db-move.ts`: copies a company's sign-in data from its Coolify database to the TLS database. */
     private ownAuthDbMove;
     private ownAuth;

package/dist/plan/executor.js

@@ -61,6 +61,7 @@ import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY
 import { SIGN_IN_BASE_PATH, SIGN_IN_ENV_LIVE_SCOPE_PREFIX, SIGN_IN_IN_APP_SCOPE_KEY, SIGN_IN_LOGIN_APP_SCOPE_KEY, SIGN_IN_RATE_LIMIT_DESCRIPTION, SIGN_IN_RATE_LIMIT_EXPRESSION, SIGN_IN_RATE_LIMIT_SCOPE_KEY, SIGN_IN_TRUSTED_SCOPE_KEY, SIGN_IN_UPSTREAM_ENV, inAppBindingFor, inAppSignIn, inAppStateHosts, inAppStatePairs, inAppTargets, signInEnvLiveHosts, } from './sign-in.js';
 import { moveSigninDatabase } from './signin-db-move.js';
 import { stageGateKey, stageHostname, } from './stage-guards.js';
+import { WORKER_APP_DB_SCOPE_KEYS, provisionWorkerAppDb, workerAppDbCaPem, workerAppDbOwnerUrl, } from './worker-app-db.js';
 import { WORKER_APP_CALL_TIMEOUT_MS, applyWorkerApp, heldBrokerKey, teardownWorkerApp, withCallTimeout, } from './worker-app.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
@@ -1012,6 +1013,14 @@ export class FoundryStepExecutor {
     ownSigninDbKeysPuttable() {
         return Boolean(this.ports.ownServices?.provision.auth.heldKeys?.put);
     }
+    /** Whether the held keys can store a Worker app database's CA and certificate. */
+    workerAppDbKeysPuttable() {
+        return typeof this.ports.heldKeys?.put === 'function';
+    }
+    /** Whether the host supplies the backup bucket a Worker app database dumps into (the files host's bucket and key ports). */
+    workerAppDbBackupConfigured() {
+        return this.ownSigninDbBackupConfigured();
+    }
     /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). */
     ownSigninDbBackupConfigured() {
         const files = this.ports.ownServices?.provision.files;
@@ -1196,7 +1205,7 @@ export class FoundryStepExecutor {
                 if (!workers) {
                     throw new Error(`cloudflare:worker-app for ${org.slug}: this executor was built without a WorkerAppPort`);
                 }
-                return applyWorkerApp(this.workerAppDeps(workers), org, action, context);
+                return applyWorkerApp(this.workerAppDeps(workers, org, () => context.recordedIds()), org, action, context);
             }
             case 'files:organisation':
                 return this.filesOrganisation(action, org, context);
@@ -1244,6 +1253,8 @@ export class FoundryStepExecutor {
                 return this.ownAuth(action, org, context);
             case 'coolify:own-auth-db-move':
                 return this.ownAuthDbMove(org, context);
+            case 'coolify:worker-app-db':
+                return this.workerAppDb(org, context);
             case 'coolify:own-jobs':
                 return this.ownJobs(action, org, context);
             case 'coolify:own-mail':
@@ -1487,7 +1498,7 @@ export class FoundryStepExecutor {
      * "Declared changes apply" nothing is marked done until the
      * live state actually matches it.
      */
-    workerAppDeps(workers) {
+    workerAppDeps(workers, org, recorded) {
         return {
             workers,
             ...(this.ports.workerAppKeys ? { keys: this.ports.workerAppKeys } : {}),
@@ -1499,7 +1510,14 @@ export class FoundryStepExecutor {
                         access: this.accessPort(),
                         dns: this.dnsPort(),
                         zones: this.zonePort(),
+                        // The foundry-made TLS database when it is the recorded one; else the legacy Coolify database.
+                        ca: () => workerAppDbCaPem(this.ports.heldKeys, org.id),
                         ownerUrl: async (databaseId) => {
+                            if (databaseId === recorded()[WORKER_APP_DB_SCOPE_KEYS.app]) {
+                                const url = await workerAppDbOwnerUrl(this.ports.coolify, org, databaseId);
+                                this.handledSecrets.add(url);
+                                return url;
+                            }
                             const db = await getDatabaseStarted(this.ports.coolify, databaseId);
                             if (!db.internal_db_url) {
                                 throw new Error('the database reports no internal connection URL yet');
@@ -7194,6 +7212,26 @@ export class FoundryStepExecutor {
             },
         };
     }
+    /** `plan/worker-app-db.ts`: the org's Worker app database as a TLS Postgres, and its server certificate's renewal. */
+    async workerAppDb(org, context) {
+        const files = this.ports.ownServices?.provision.files;
+        await provisionWorkerAppDb(scopeFromOrg(context, {}), {
+            coolify: this.placedForCompany(this.ports.coolify, org, context),
+            heldKeys: this.ports.heldKeys,
+            signinDbBackup: files?.r2Buckets && files.r2Keys
+                ? { r2Buckets: files.r2Buckets, r2Keys: files.r2Keys }
+                : undefined,
+            runtime: {
+                ...(this.ports.runtime?.sleep ? { sleep: this.ports.runtime.sleep } : {}),
+                ...(this.ports.runtime?.now ? { now: this.ports.runtime.now } : {}),
+                onSecret: (value) => void this.handledSecrets.add(value),
+            },
+        }, org, {
+            project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            label: `${org.slug}:worker-app-db`,
+        });
+        return {};
+    }
     /** `plan/signin-db-move.ts`: copies a company's sign-in data from its Coolify database to the TLS database. */
     async ownAuthDbMove(org, context) {
         const own = this.ports.ownServices;
@@ -9287,7 +9325,7 @@ export class FoundryStepExecutor {
                     }
                     const entryKey = target.key.slice(org.id.length + 1);
                     const at = `cloudflare:worker-app '${target.key}' for ${org.slug}`;
-                    await teardownWorkerApp(this.workerAppDeps(workers), entryKey, target.id || undefined, recordedIds, (label, task) => withCallTimeout(WORKER_APP_CALL_TIMEOUT_MS, `${at}: ${label}`, task), org.id);
+                    await teardownWorkerApp(this.workerAppDeps(workers, org, () => recordedIds), entryKey, target.id || undefined, recordedIds, (label, task) => withCallTimeout(WORKER_APP_CALL_TIMEOUT_MS, `${at}: ${label}`, task), org.id);
                     return;
                 }
                 case 'edge:key': {

package/dist/plan/plan-apply.d.ts

@@ -226,6 +226,10 @@ export interface StepExecutor {
      * copy is not recorded. Optional: an executor without it runs no release.
      */
     releaseHost?(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /** Whether the executor's held keys can store a Worker app database's CA and certificate. Absent: true. */
+    workerAppDbKeysPuttable?(): boolean;
+    /** Whether the host supplies the backup bucket a Worker app database dumps into. Absent: true. */
+    workerAppDbBackupConfigured?(): boolean;
     /** Whether the executor's held keys can store the sign-in database's CA and certificate (#746). Absent: true. */
     ownSigninDbKeysPuttable?(): boolean;
     /** Whether the host supplies the backup bucket the sign-in database dumps into (#746). Absent: true. */

package/dist/plan/plan-apply.js

@@ -1359,6 +1359,8 @@ export class FoundryPlanApply {
                     }),
                 }
                 : {}),
+            workerAppDbKeysPuttable: this.executor.workerAppDbKeysPuttable?.() ?? true,
+            workerAppDbBackupConfigured: this.executor.workerAppDbBackupConfigured?.() ?? true,
             ownSigninDbKeysPuttable: this.executor.ownSigninDbKeysPuttable?.() ?? true,
             ownSigninDbBackupConfigured: this.executor.ownSigninDbBackupConfigured?.() ?? true,
             ...(this.backupGate
@@ -2205,6 +2207,7 @@ const STEP_FIELDS = {
     'coolify:chat': 'chat.usesDomain',
     'coolify:own-auth': 'services.own',
     'coolify:own-auth-db-move': 'services.own',
+    'coolify:worker-app-db': 'hosting.entries.workerApp.database',
     'coolify:own-files': 'services.own',
     'coolify:own-files-r2': 'services.own',
     'coolify:own-jobs': 'services.own',

package/dist/plan/signin-db-backup.d.ts

@@ -61,6 +61,11 @@ export declare function ensureSigninDbBackupTarget(port: SigninDbBackupPort, inp
     };
     record(key: string, id: string): Promise<void>;
     onSecret?(value: string): void;
+    /** Where the key's ids are recorded; the sign-in database's by default. */
+    keys?: {
+        backupKey: string;
+        backupKeyUndelivered: string;
+    };
 }): Promise<{
     target: SigninDbBackupTarget;
     tokenId: string;
@@ -77,11 +82,12 @@ export declare const SIGNIN_DB_BACKUP_ENV: {
     readonly script: "BACKUP_S3_SCRIPT";
 };
 /** Where in the bucket a company's dumps go: `signin-db/<slug>/signin-db-<UTC time>.dump`. */
-export declare function signinDbBackupPrefix(slug: string): string;
+export declare function signinDbBackupPrefix(slug: string, base?: string): string;
 /** The env entries the backup command needs, for the database app, the script included. */
 export declare function signinDbBackupEnvs(target: SigninDbBackupTarget, slug: string, db: {
     user: string;
     database: string;
+    prefixBase?: string;
 }): Array<{
     key: string;
     value: string;

package/dist/plan/signin-db-backup.js

@@ -54,9 +54,11 @@ const usable = (value) => typeof value === 'string' && value.length > 0 && value
  * move stops anything. Errors name the label only.
  */
 export async function ensureSigninDbBackupTarget(port, input) {
+    const keyScope = input.keys?.backupKey ?? SIGNIN_DB_BACKUP_KEY_SCOPE_KEY;
+    const undeliveredScope = input.keys?.backupKeyUndelivered ?? SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY;
     const { label, recorded } = input;
     const bucket = await portCall(port.r2Buckets.ensureBucket(input.bucketName), label, `the sign-in backup bucket ${input.bucketName}`);
-    const kept = recorded[SIGNIN_DB_BACKUP_KEY_SCOPE_KEY];
+    const kept = recorded[keyScope];
     if (kept && input.held.keyId && input.held.secret) {
         input.onSecret?.(input.held.secret);
         input.onSecret?.(input.held.keyId);
@@ -72,11 +74,8 @@ export async function ensureSigninDbBackupTarget(port, input) {
         };
     }
     for (const [scopeKey, tokenId] of [
-        [
-            SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY,
-            recorded[SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY],
-        ],
-        [SIGNIN_DB_BACKUP_KEY_SCOPE_KEY, kept],
+        [undeliveredScope, recorded[undeliveredScope]],
+        [keyScope, kept],
     ]) {
         if (!tokenId)
             continue;
@@ -90,7 +89,7 @@ export async function ensureSigninDbBackupTarget(port, input) {
         input.onSecret?.(key.accessKeyId);
     // A token id we can read is recorded even when the rest of the answer is unusable, so it is deleted next run.
     if (usable(key?.tokenId))
-        await input.record(SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY, key.tokenId);
+        await input.record(undeliveredScope, key.tokenId);
     if (!usable(key?.accessKeyId) || !usable(key?.secretAccessKey) || !usable(key?.tokenId)) {
         throw new Error(`${label}: the sign-in backup key mint answered with an unusable key`);
     }
@@ -116,8 +115,8 @@ export const SIGNIN_DB_BACKUP_ENV = {
     script: 'BACKUP_S3_SCRIPT',
 };
 /** Where in the bucket a company's dumps go: `signin-db/<slug>/signin-db-<UTC time>.dump`. */
-export function signinDbBackupPrefix(slug) {
-    return `signin-db/${slug}`;
+export function signinDbBackupPrefix(slug, base = 'signin-db') {
+    return `${base}/${slug}`;
 }
 /** The env entries the backup command needs, for the database app, the script included. */
 export function signinDbBackupEnvs(target, slug, db) {
@@ -127,7 +126,7 @@ export function signinDbBackupEnvs(target, slug, db) {
         { key: SIGNIN_DB_BACKUP_ENV.region, value: target.region ?? 'auto' },
         { key: SIGNIN_DB_BACKUP_ENV.keyId, value: target.accessKeyId },
         { key: SIGNIN_DB_BACKUP_ENV.secret, value: target.secretAccessKey },
-        { key: SIGNIN_DB_BACKUP_ENV.prefix, value: signinDbBackupPrefix(slug) },
+        { key: SIGNIN_DB_BACKUP_ENV.prefix, value: signinDbBackupPrefix(slug, db.prefixBase) },
         {
             key: SIGNIN_DB_BACKUP_ENV.script,
             value: Buffer.from(signinDbBackupScript(db.user, db.database), 'utf8').toString('base64'),

package/dist/plan/signin-db-tls.d.ts

@@ -10,6 +10,22 @@
  */
 /** The platform's one CA, held as JSON `{ cert, key }` (PEM strings). */
 export declare const SIGNIN_DB_CA_REF = "signin-db:platform:ca";
+/**
+ * The recorded ids of one TLS database: the app, the marker that it is in use, and the server
+ * certificate's expiry (milliseconds since the epoch, so the planner can renew it; not a secret).
+ */
+export interface TlsDbScopeKeys {
+    app: string;
+    tls: string;
+    certNotAfter: string;
+    /** The id of the database's backup key (kept) and of one minted and not yet delivered. */
+    backupKey: string;
+    backupKeyUndelivered: string;
+    /** The id of the nightly dump's schedule. */
+    backupTask: string;
+}
+/** The scope keys of a TLS database named by `prefix`: `<prefix>_app`, `<prefix>_tls`, `<prefix>_cert_not_after`. */
+export declare function tlsDbScopeKeys(prefix: string): TlsDbScopeKeys;
 /** The recorded id of the server certificate's expiry (milliseconds since the epoch), so the planner can renew it. Not a secret. */
 export declare const SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY = "signin_db_cert_not_after";
 /** Recorded id of the database app. */
@@ -19,6 +35,8 @@ export declare const SIGNIN_DB_APP_SCOPE_KEY = "signin_db_app";
  * provisions this database and never the Coolify one.
  */
 export declare const SIGNIN_DB_TLS_SCOPE_KEY = "signin_db_tls";
+/** The sign-in database's scope keys. */
+export declare const SIGNIN_DB_SCOPE_KEYS: TlsDbScopeKeys;
 /**
  * Recorded while ZITADEL has been started on the TLS database and not yet seen healthy there: the
  * planner then plans the sign-in step, which starts ZITADEL again and clears it (#746).
@@ -26,6 +44,8 @@ export declare const SIGNIN_DB_TLS_SCOPE_KEY = "signin_db_tls";
 export declare const SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY = "signin_db_zitadel_pending";
 /** A server certificate with less than this left is issued again. */
 export declare const SIGNIN_DB_CERT_RENEW_WINDOW_MS: number;
+/** The CA's subject unless the caller names another. */
+export declare const SIGNIN_DB_CA_COMMON_NAME = "foundry sign-in database CA";
 export interface SigninDbKeys {
     resolve(ref: string): Promise<string | null | undefined>;
     put?(ref: string, value: string): Promise<void>;
@@ -47,14 +67,19 @@ export interface ServerCert extends PemPair {
 }
 /**
  * The platform's CA: the held one, else a new one stored under
- * {@link SIGNIN_DB_CA_REF}. A held value that cannot be read, or whose
+ * {@link SIGNIN_DB_CA_REF} (or `ca.ref`). A held value that cannot be read, or whose
  * certificate does not match its key, is an error and is never replaced: a
  * company's database may already trust it. The value read back after a store
  * is the one used, so two applies at once end with the same CA.
  */
 export declare function ensureSigninDbCa(keys: SigninDbKeys, runtime?: SigninDbTlsRuntime, 
 /** A company already has a database or certificate made under the CA: a lost CA is then an error, never made again. */
-inUse?: boolean): Promise<PemPair>;
+inUse?: boolean, 
+/** The held key of the CA and its subject; the sign-in database's by default. */
+ca?: {
+    ref?: string;
+    commonName?: string;
+}): Promise<PemPair>;
 /**
  * The server certificate held under `ref` for `host`, issued again when it is
  * missing, unreadable, for another host, signed by another CA, or has less
@@ -66,4 +91,6 @@ export declare function ensureSigninDbServerCert(keys: SigninDbKeys, ca: PemPair
  * Whether the recorded server certificate expires within the renew window.
  * Nothing recorded (a company not on the TLS database) is never due.
  */
-export declare function signinDbCertDue(recordedIds: Readonly<Record<string, string>>, now: number): boolean;
+export declare function signinDbCertDue(recordedIds: Readonly<Record<string, string>>, now: number, 
+/** The scope keys of the database; the sign-in database's by default. */
+scopeKeys?: TlsDbScopeKeys): boolean;

package/dist/plan/signin-db-tls.js

@@ -11,6 +11,17 @@ import { X509Certificate, createHash, createPrivateKey, createPublicKey, generat
  */
 /** The platform's one CA, held as JSON `{ cert, key }` (PEM strings). */
 export const SIGNIN_DB_CA_REF = 'signin-db:platform:ca';
+/** The scope keys of a TLS database named by `prefix`: `<prefix>_app`, `<prefix>_tls`, `<prefix>_cert_not_after`. */
+export function tlsDbScopeKeys(prefix) {
+    return {
+        app: `${prefix}_app`,
+        tls: `${prefix}_tls`,
+        certNotAfter: `${prefix}_cert_not_after`,
+        backupKey: `${prefix}_backup_key`,
+        backupKeyUndelivered: `${prefix}_backup_key_undelivered`,
+        backupTask: `${prefix}_backup_task`,
+    };
+}
 /** The recorded id of the server certificate's expiry (milliseconds since the epoch), so the planner can renew it. Not a secret. */
 export const SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY = 'signin_db_cert_not_after';
 /** Recorded id of the database app. */
@@ -20,6 +31,16 @@ export const SIGNIN_DB_APP_SCOPE_KEY = 'signin_db_app';
  * provisions this database and never the Coolify one.
  */
 export const SIGNIN_DB_TLS_SCOPE_KEY = 'signin_db_tls';
+/** The sign-in database's scope keys. */
+export const SIGNIN_DB_SCOPE_KEYS = {
+    app: SIGNIN_DB_APP_SCOPE_KEY,
+    tls: SIGNIN_DB_TLS_SCOPE_KEY,
+    certNotAfter: SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY,
+    // The same strings as `signin-db-backup.ts` exports (that file imports this one); a test pins them.
+    backupKey: 'signin_db_backup_key',
+    backupKeyUndelivered: 'signin_db_backup_key_undelivered',
+    backupTask: 'signin_db_backup_task',
+};
 /**
  * Recorded while ZITADEL has been started on the TLS database and not yet seen healthy there: the
  * planner then plans the sign-in step, which starts ZITADEL again and clears it (#746).
@@ -29,8 +50,9 @@ export const SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY = 'signin_db_zitadel_pending';
 export const SIGNIN_DB_CERT_RENEW_WINDOW_MS = 30 * 24 * 3_600_000;
 const SERVER_CERT_VALIDITY_MS = 365 * 24 * 3_600_000;
 const CA_VALIDITY_MS = 10 * 365 * 24 * 3_600_000;
-/** The CA's subject. */
-const CA_COMMON_NAME = 'foundry sign-in database CA';
+/** The CA's subject unless the caller names another. */
+export const SIGNIN_DB_CA_COMMON_NAME = 'foundry sign-in database CA';
+const CA_COMMON_NAME = SIGNIN_DB_CA_COMMON_NAME;
 // ---- DER ---------------------------------------------------------------------
 const der = (tag, ...parts) => {
     const body = Buffer.concat(parts);
@@ -103,11 +125,11 @@ function newKeyPair() {
     };
 }
 // ---- the CA ------------------------------------------------------------------
-function newCa(now) {
+function newCa(now, commonName) {
     const { publicKey, privateKey, keyPem } = newKeyPair();
     const certPem = certificate({
-        subject: CA_COMMON_NAME,
-        issuer: CA_COMMON_NAME,
+        subject: commonName,
+        issuer: commonName,
         publicKey,
         signingKey: privateKey,
         notBefore: now - 3_600_000,
@@ -144,15 +166,18 @@ function pairMatches(pair) {
 }
 /**
  * The platform's CA: the held one, else a new one stored under
- * {@link SIGNIN_DB_CA_REF}. A held value that cannot be read, or whose
+ * {@link SIGNIN_DB_CA_REF} (or `ca.ref`). A held value that cannot be read, or whose
  * certificate does not match its key, is an error and is never replaced: a
  * company's database may already trust it. The value read back after a store
  * is the one used, so two applies at once end with the same CA.
  */
 export async function ensureSigninDbCa(keys, runtime = {}, 
 /** A company already has a database or certificate made under the CA: a lost CA is then an error, never made again. */
-inUse = false) {
-    const held = await keys.resolve(SIGNIN_DB_CA_REF);
+inUse = false, 
+/** The held key of the CA and its subject; the sign-in database's by default. */
+ca = {}) {
+    const ref = ca.ref ?? SIGNIN_DB_CA_REF;
+    const held = await keys.resolve(ref);
     if (held) {
         const pair = readPair(held);
         if (!pair)
@@ -164,14 +189,14 @@ inUse = false) {
         return pair;
     }
     if (inUse) {
-        throw new Error(`the sign-in database CA (${SIGNIN_DB_CA_REF}) is not held, but a company's database already trusts it; a new CA would break every company's sign-in, so none is made. Restore the CA from the keys backup (docs/runbooks/signin-db-tls.md, "A lost CA")`);
+        throw new Error(`the sign-in database CA (${ref}) is not held, but a company's database already trusts it; a new CA would break every company's sign-in, so none is made. Restore the CA from the keys backup (docs/runbooks/signin-db-tls.md, "A lost CA")`);
     }
     if (!keys.put)
         throw new Error('the host cannot store the sign-in database CA: heldKeys has no put');
-    const created = newCa((runtime.now ?? Date.now)());
+    const created = newCa((runtime.now ?? Date.now)(), ca.commonName ?? CA_COMMON_NAME);
     runtime.onSecret?.(created.keyPem);
-    await keys.put(SIGNIN_DB_CA_REF, JSON.stringify({ cert: created.certPem, key: created.keyPem }));
-    const stored = readPair(await keys.resolve(SIGNIN_DB_CA_REF));
+    await keys.put(ref, JSON.stringify({ cert: created.certPem, key: created.keyPem }));
+    const stored = readPair(await keys.resolve(ref));
     if (!stored)
         throw new Error('the sign-in database CA was stored but cannot be read back');
     runtime.onSecret?.(stored.keyPem);
@@ -182,9 +207,11 @@ function newServerCert(ca, host, now) {
     const { publicKey, keyPem } = newKeyPair();
     const caCert = new X509Certificate(ca.certPem);
     const notAfter = now + SERVER_CERT_VALIDITY_MS;
+    // The issuer is the CA's own subject, whatever common name it was made with.
+    const issuer = /^CN=(.*)$/m.exec(caCert.subject)?.[1] ?? CA_COMMON_NAME;
     const certPem = certificate({
         subject: host,
-        issuer: CA_COMMON_NAME,
+        issuer,
         publicKey,
         signingKey: createPrivateKey(ca.keyPem),
         notBefore: now - 3_600_000,
@@ -249,7 +276,9 @@ export async function ensureSigninDbServerCert(keys, ca, ref, host, runtime = {}
  * Whether the recorded server certificate expires within the renew window.
  * Nothing recorded (a company not on the TLS database) is never due.
  */
-export function signinDbCertDue(recordedIds, now) {
-    const notAfter = Number(recordedIds[SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY]);
+export function signinDbCertDue(recordedIds, now, 
+/** The scope keys of the database; the sign-in database's by default. */
+scopeKeys = SIGNIN_DB_SCOPE_KEYS) {
+    const notAfter = Number(recordedIds[scopeKeys.certNotAfter]);
     return (Number.isFinite(notAfter) && notAfter > 0 && notAfter - now < SIGNIN_DB_CERT_RENEW_WINDOW_MS);
 }

package/dist/plan/signin-db.d.ts

@@ -1,6 +1,6 @@
 import type { CoolifyPort } from './executor.js';
 import { SIGNIN_DB_BACKUP_TASK_SCOPE_KEY, type SigninDbBackupPort } from './signin-db-backup.js';
-import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, type SigninDbKeys, type SigninDbTlsRuntime } from './signin-db-tls.js';
+import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, type SigninDbKeys, type SigninDbTlsRuntime, type TlsDbScopeKeys } from './signin-db-tls.js';
 /**
  * A company's sign-in database as foundry's own image (#746). Coolify 4.4.2
  * cannot turn on a database's TLS and mounts files root-owned, so Postgres
@@ -42,9 +42,15 @@ export declare function signinDbStartScript(): string[];
  * official image); every network connection must be TLS with a password, so a client that skips
  * TLS is refused by the server, not only by the client's own setting.
  */
-export declare function signinDbDockerfile(): string;
+export declare function signinDbDockerfile(db?: {
+    user?: string;
+    database?: string;
+}): string;
 /** ZITADEL's DSN: the whole chain is checked, host name included. A secret (it holds the password). */
-export declare function signinDbDsn(host: string, password: string): string;
+export declare function signinDbDsn(host: string, password: string, db?: {
+    user?: string;
+    database?: string;
+}): string;
 type Coolify = Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deploy' | 'raw'> & Partial<Pick<CoolifyPort, 'listStorages' | 'createPersistentStorage' | 'createFileStorage'>>;
 export interface SigninDbRuntime extends SigninDbTlsRuntime {
     sleep?: (ms: number) => Promise<void>;
@@ -97,6 +103,22 @@ export interface ProvisionSigninDbInput {
     };
     record(key: string, id: string): Promise<void>;
 }
+/** What differs between TLS databases; every default is the sign-in database's. */
+export interface TlsDbOptions {
+    /** The Coolify app name (default `input.name`). */
+    appName?: string;
+    /** Postgres user (default `zitadel`). */
+    user?: string;
+    /** Postgres database (default `zitadel`). */
+    database?: string;
+    /** The held key and subject of the CA. */
+    caRef?: string;
+    caCommonName?: string;
+    /** Recorded-id keys. */
+    scopeKeys?: TlsDbScopeKeys;
+    /** The folder in the bucket before the slug (default `signin-db`). */
+    backupPrefix?: string;
+}
 /**
  * Brings the TLS database up and returns ZITADEL's DSN: the CA and server certificate (held in
  * keys), the app with its data volume and no domain, its env (the password minted once and read
@@ -104,7 +126,7 @@ export interface ProvisionSigninDbInput {
  * database reports healthy. A secret (password, key) goes only to the app's env and to
  * `runtime.onSecret`.
  */
-export declare function provisionSigninDb(input: ProvisionSigninDbInput): Promise<{
+export declare function provisionSigninDb(input: ProvisionSigninDbInput, options?: TlsDbOptions): Promise<{
     appId: string;
     dsn: string;
     ca: string;

package/dist/plan/signin-db.js

@@ -1,8 +1,8 @@
 import { randomBytes } from 'node:crypto';
 import { pinnedRef } from '../bootstrap/versions.js';
 import { envsDiffer, findOrCreatePlatformApp, resolvePlatformServer, } from './platform-providers.js';
-import { SIGNIN_DB_BACKUP_ENV, SIGNIN_DB_BACKUP_KEY_SCOPE_KEY, SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY, SIGNIN_DB_BACKUP_TASK_SCOPE_KEY, ensureSigninDbBackupTarget, ensureSigninDbBackupTask, signinDbBackupEnvs, } from './signin-db-backup.js';
-import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, ensureSigninDbCa, ensureSigninDbServerCert, } from './signin-db-tls.js';
+import { SIGNIN_DB_BACKUP_ENV, SIGNIN_DB_BACKUP_TASK_SCOPE_KEY, ensureSigninDbBackupTarget, ensureSigninDbBackupTask, signinDbBackupEnvs, } from './signin-db-backup.js';
+import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_SCOPE_KEYS, SIGNIN_DB_TLS_SCOPE_KEY, ensureSigninDbCa, ensureSigninDbServerCert, } from './signin-db-tls.js';
 /**
  * A company's sign-in database as foundry's own image (#746). Coolify 4.4.2
  * cannot turn on a database's TLS and mounts files root-owned, so Postgres
@@ -84,7 +84,7 @@ export function signinDbStartScript() {
  * official image); every network connection must be TLS with a password, so a client that skips
  * TLS is refused by the server, not only by the client's own setting.
  */
-export function signinDbDockerfile() {
+export function signinDbDockerfile(db = {}) {
     const lines = signinDbStartScript();
     if (lines.some((l) => l.includes("'")))
         throw new Error('signin-db entrypoint holds a quote');
@@ -95,12 +95,12 @@ export function signinDbDockerfile() {
         `RUN printf '%s\\n' \\\n${lines.map((l) => `  '${l}'`).join(' \\\n')} > /usr/local/bin/signin-db-start \\\n  && chmod 0755 /usr/local/bin/signin-db-start`,
         `EXPOSE ${SIGNIN_DB_PORT}`,
         'ENTRYPOINT ["/usr/local/bin/signin-db-start"]',
-        `HEALTHCHECK --interval=10s --timeout=5s --start-period=60s --retries=5 CMD ["pg_isready", "-U", "${SIGNIN_DB_USER}", "-d", "${SIGNIN_DB_NAME}"]`,
+        `HEALTHCHECK --interval=10s --timeout=5s --start-period=60s --retries=5 CMD ["pg_isready", "-U", "${db.user ?? SIGNIN_DB_USER}", "-d", "${db.database ?? SIGNIN_DB_NAME}"]`,
     ].join('\n');
 }
 /** ZITADEL's DSN: the whole chain is checked, host name included. A secret (it holds the password). */
-export function signinDbDsn(host, password) {
-    return `postgres://${SIGNIN_DB_USER}:${password}@${host}:${SIGNIN_DB_PORT}/${SIGNIN_DB_NAME}?sslmode=verify-full&sslrootcert=${SIGNIN_DB_CA_MOUNT}`;
+export function signinDbDsn(host, password, db = {}) {
+    return `postgres://${db.user ?? SIGNIN_DB_USER}:${password}@${host}:${SIGNIN_DB_PORT}/${db.database ?? SIGNIN_DB_NAME}?sslmode=verify-full&sslrootcert=${SIGNIN_DB_CA_MOUNT}`;
 }
 /** The volume and file-mount calls, or an error naming the step: a host that cannot mount cannot run this database. */
 function storageCalls(coolify, label) {
@@ -168,7 +168,7 @@ export function dockerfileAppCreator(coolify, o) {
  * database reports healthy. A secret (password, key) goes only to the app's env and to
  * `runtime.onSecret`.
  */
-export async function provisionSigninDb(input) {
+export async function provisionSigninDb(input, options = {}) {
     const { runtime, label } = input;
     const coolify = withCallTimeout(input.coolify);
     if (!input.keys?.put) {
@@ -177,12 +177,13 @@ export async function provisionSigninDb(input) {
     if (!input.backup) {
         throw new Error(`${label}: the host supplies no backup bucket for the sign-in database`);
     }
-    const ca = await ensureSigninDbCa(input.keys, runtime, Boolean(input.recorded[SIGNIN_DB_TLS_SCOPE_KEY] ||
-        input.recorded[SIGNIN_DB_APP_SCOPE_KEY] ||
-        input.recorded[SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY]));
+    const user = options.user ?? SIGNIN_DB_USER;
+    const database = options.database ?? SIGNIN_DB_NAME;
+    const scope = options.scopeKeys ?? SIGNIN_DB_SCOPE_KEYS;
+    const ca = await ensureSigninDbCa(input.keys, runtime, Boolean(input.recorded[scope.tls] || input.recorded[scope.app] || input.recorded[scope.certNotAfter]), { ref: options.caRef, commonName: options.caCommonName });
     const server = await ensureSigninDbServerCert(input.keys, ca, input.serverCertRef, input.internalHost, runtime);
-    const app = await findOrCreatePlatformApp(coolify, input.name, input.environment, () => boundedCall(input.create(signinDbDockerfile()), 'Coolify createDockerfileApplication'));
-    await input.record(SIGNIN_DB_APP_SCOPE_KEY, app.appId);
+    const app = await findOrCreatePlatformApp(coolify, options.appName ?? input.name, input.environment, () => boundedCall(input.create(signinDbDockerfile({ user, database })), 'Coolify createDockerfileApplication'));
+    await input.record(scope.app, app.appId);
     // No `ports_mappings` and no `domains`: only the Docker network reaches the port.
     await coolify.updateApplication(app.appId, {
         custom_internal_name: input.internalHost,
@@ -214,34 +215,36 @@ export async function provisionSigninDb(input) {
         },
         record: input.record,
         onSecret: runtime.onSecret,
+        keys: scope,
     });
     const b64 = (pem) => Buffer.from(pem, 'utf8').toString('base64');
     runtime.onSecret?.(b64(server.keyPem));
     const envs = [
-        { key: SIGNIN_DB_ENV.user, value: SIGNIN_DB_USER },
+        { key: SIGNIN_DB_ENV.user, value: user },
         { key: SIGNIN_DB_ENV.password, value: password },
-        { key: SIGNIN_DB_ENV.database, value: SIGNIN_DB_NAME },
+        { key: SIGNIN_DB_ENV.database, value: database },
         { key: SIGNIN_DB_ENV.cert, value: b64(server.certPem) },
         { key: SIGNIN_DB_ENV.key, value: b64(server.keyPem) },
         ...signinDbBackupEnvs(backup.target, input.slug, {
-            user: SIGNIN_DB_USER,
-            database: SIGNIN_DB_NAME,
+            user,
+            database,
+            prefixBase: options.backupPrefix,
         }),
     ];
     const changed = await envsDiffer(coolify, app.appId, envs);
     await coolify.bulkUpsertEnvs(app.appId, envs);
     if (backup.fresh) {
-        await input.record(SIGNIN_DB_BACKUP_KEY_SCOPE_KEY, backup.tokenId);
-        await input.record(SIGNIN_DB_BACKUP_KEY_UNDELIVERED_SCOPE_KEY, '');
+        await input.record(scope.backupKey, backup.tokenId);
+        await input.record(scope.backupKeyUndelivered, '');
     }
     if (app.justCreated || !app.running || changed) {
         await coolify.deploy(app.appId);
         await waitHealthy(coolify, app.appId, runtime, label);
     }
-    await input.record(SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY, String(server.notAfter));
+    await input.record(scope.certNotAfter, String(server.notAfter));
     // The database is not used, and ZITADEL is not stopped for a move, until its nightly dump is scheduled.
-    await input.record(SIGNIN_DB_BACKUP_TASK_SCOPE_KEY, await ensureSigninDbBackupTask(coolify, app.appId, label));
-    const dsn = signinDbDsn(input.internalHost, password);
+    await input.record(scope.backupTask, await ensureSigninDbBackupTask(coolify, app.appId, label));
+    const dsn = signinDbDsn(input.internalHost, password, { user, database });
     runtime.onSecret?.(dsn);
     return { appId: app.appId, dsn, ca: ca.certPem, password };
 }

package/dist/plan/worker-app-database.d.ts

@@ -28,6 +28,12 @@ export interface HyperdriveOrigin {
     password: string;
     accessClientId: string;
     accessClientSecret: string;
+    /** Present when the database's certificate is checked against a CA uploaded to Cloudflare. */
+    tls?: {
+        sslmode: 'verify-ca';
+        caCertificateId: string;
+        caPem: string;
+    };
 }
 /** One migration of a release's `migrations.json`. */
 export interface DatabaseMigration {
@@ -50,6 +56,13 @@ export interface WorkerAppDatabasePort {
     }>;
     /** A no-op when the config is gone. */
     deleteHyperdrive(name: string): Promise<void>;
+    /** Uploads the CA certificate `pem` under `name` unless it is already there; returns its id. */
+    ensureCaCertificate(input: {
+        name: string;
+        pem: string;
+    }): Promise<{
+        id: string;
+    }>;
     /** The text of a release asset of a wtfalch repo, or `null` when the release has no such asset. */
     fetchReleaseAsset(url: string): Promise<string | null>;
     /** The migration ids the database's ledger holds, in the order applied. */
@@ -109,6 +122,13 @@ export interface WorkerAppDatabaseDeps {
     ownerUrl(databaseId: string): Promise<string>;
     /** Registers a value for redaction before it is written anywhere. */
     secret(value: string): void;
+    /**
+     * The PEM of the CA that signs the app database's certificate. Absent or `null`: the
+     * connection carries no TLS settings.
+     */
+    ca?: () => Promise<{
+        pem: string;
+    } | null>;
     heldKeys?: {
         resolve(ref: string): Promise<string | null | undefined>;
         put?(ref: string, value: string): Promise<void>;

package/dist/plan/worker-app-database.js

@@ -1,5 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { REMOTE_DATABASE_PORT, mergeTcpIngress, recordedHttpIngress, recordedTcpRoutes, remoteDatabaseKeys, } from './remote-database.js';
+import { WORKER_APP_DB_SCOPE_KEYS } from './worker-app-db.js';
 import { WORKER_APP_CALL_TIMEOUT_MS, withCallTimeout, workerAppSecretRef } from './worker-app.js';
 export const WORKER_APP_MIGRATION_TIMEOUT_MS = 300_000;
 export const MIGRATIONS_ASSET_NAME = 'migrations.json';
@@ -141,7 +142,9 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
         throw new Error(`${at}: needs a held-key store that can put`);
     const put = heldKeys.put;
     const keys = remoteDatabaseKeys(entry.key);
-    const databaseId = context.recordedIds()[`coolify:database:${org.id}`];
+    // The foundry-made TLS database (worker-app-db) when recorded, else the legacy Coolify database.
+    const databaseId = context.recordedIds()[WORKER_APP_DB_SCOPE_KEYS.app] ||
+        context.recordedIds()[`coolify:database:${org.id}`];
     if (!databaseId)
         throw new Error(`${at}: ${org.slug}'s database is not applied yet`);
     const tunnelId = context.recordedIds()[`cloudflare:tunnel:${org.id}`];
@@ -208,6 +211,19 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
         await call('hold the runtime password', () => put(rtRef, minted));
     }
     deps.secret(runtimePassword);
+    // The CA, uploaded before the first connection so both origins carry the same certificate id.
+    const ca = deps.ca
+        ? await call('read the CA certificate', () => deps.ca())
+        : null;
+    let tls;
+    let caName;
+    if (ca) {
+        caName = `foundry-${org.slug}-appdb-ca-${createHash('sha256').update(ca.pem).digest('hex').slice(0, 12)}`;
+        const pem = ca.pem;
+        const uploadName = caName;
+        const { id: caCertificateId } = await call('upload the CA certificate', () => port.ensureCaCertificate({ name: uploadName, pem }));
+        tls = { sslmode: 'verify-ca', caCertificateId, caPem: pem };
+    }
     const ownerOrigin = {
         host: hostname,
         database: owner.database,
@@ -215,6 +231,7 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
         password: owner.password,
         accessClientId: access.clientId,
         accessClientSecret: access.clientSecret,
+        ...(tls ? { tls } : {}),
     };
     // 4. Migrations with the owner credentials. A failure stops the deploy; ids already applied stay.
     const text = await call('fetch the release migrations', () => port.fetchReleaseAsset(migrationsUrl(want.artifactUrl)));
@@ -259,9 +276,10 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
             password: runtimePassword,
             accessClientId: access.clientId,
             accessClientSecret: access.clientSecret,
+            ...(tls ? { tls } : {}),
         },
     }));
-    context.recordScopeId(workerAppHyperdriveScopeKey(entry.key), JSON.stringify({ name, id }));
+    context.recordScopeId(workerAppHyperdriveScopeKey(entry.key), JSON.stringify(caName ? { name, id, ca: caName } : { name, id }));
     await context.persistScopeIds();
     return { hyperdriveId: id };
 }

package/dist/plan/worker-app-db.d.ts

@@ -0,0 +1,78 @@
+import { type DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+import { type ProjectSource, type StepScope } from './own-services.js';
+import type { PlatformAuthDeps } from './platform-providers.js';
+import { type SigninDbKeys } from './signin-db-tls.js';
+import { type SigninDbRuntime } from './signin-db.js';
+/**
+ * A Worker app's database as foundry's own TLS Postgres (the sign-in database's image), so that
+ * Cloudflare Hyperdrive connects with `verify-ca`. It replaces the Coolify database that a Worker
+ * app entry used to force: Coolify 4.4.2 cannot turn on a database's TLS.
+ *
+ * One app `<slug>-app-db` per org, user `app_owner`, the org's `app` database. The CA is the org's
+ * own, held under {@link workerAppDbCaRef}; the server certificate is renewed by planning the step
+ * again when it is due.
+ */
+/** Recorded ids: the app, "the step finished", and the server certificate's expiry. */
+export declare const WORKER_APP_DB_SCOPE_KEYS: import("./signin-db-tls.js").TlsDbScopeKeys;
+/** `unmanaged` key of the one blocked line {@link planWorkerAppDb} reports. */
+export declare const WORKER_APP_DB_BLOCKED_KEY = "worker-app-db";
+/** `unmanaged` key of the note that the legacy Coolify database is no longer used. */
+export declare const WORKER_APP_DB_LEGACY_NOTE_KEY = "worker-app-db-legacy";
+export declare const WORKER_APP_DB_USER = "app_owner";
+export declare const WORKER_APP_DB_BACKUP_PREFIX = "worker-app-db";
+export declare const workerAppDbCaRef: (orgId: string) => string;
+export declare const workerAppDbServerRef: (orgId: string) => string;
+export declare const workerAppDbName: (org: Pick<DeclaredOrg, "slug">) => string;
+/** The org's Worker app entries declare a database. */
+export declare const orgHasWorkerAppDatabase: (org: DeclaredOrg) => boolean;
+/** The database's name on the server: the org's `app` home, as the Postgres server would name it. */
+export declare function workerAppDbDatabase(org: DeclaredOrg): string;
+export interface PlanWorkerAppDbOptions {
+    org: DeclaredOrg;
+    recordedIds: Readonly<Record<string, string>>;
+    now: number;
+    /** The held keys can store the CA and certificate. Default true. */
+    keysPuttable?: boolean;
+    /** The host supplies the backup bucket the database dumps into. Default true. */
+    backupConfigured?: boolean;
+}
+/**
+ * One `coolify:worker-app-db` step per org with a Worker app database: planned until the app and
+ * the "finished" marker are recorded, and again when the server certificate is due. A step that
+ * cannot succeed yet (no held-key put, no backup bucket) is a blocked line, not a step. The legacy
+ * Coolify database is never touched; a recorded one gets a note.
+ */
+export declare function planWorkerAppDb(options: PlanWorkerAppDbOptions): {
+    step: DraftStep | null;
+    blocked: string | null;
+    note: string | null;
+};
+export interface ProvisionWorkerAppDbDeps {
+    coolify: PlatformAuthDeps['coolify'];
+    heldKeys: SigninDbKeys | undefined;
+    signinDbBackup: PlatformAuthDeps['signinDbBackup'];
+    runtime?: SigninDbRuntime;
+}
+/**
+ * Brings the org's Worker app database up (`provisionSigninDb` with the app database's names) and
+ * records the "finished" marker last, so a run that died halfway is planned again. Returns the CA's
+ * PEM (public) and the app id.
+ */
+export declare function provisionWorkerAppDb(scope: StepScope, deps: ProvisionWorkerAppDbDeps, org: DeclaredOrg, input: {
+    project: ProjectSource;
+    label: string;
+}): Promise<{
+    appId: string;
+    ca: string;
+}>;
+/** The org's CA certificate (public) from the held `{ cert, key }`, or null when none is held or it cannot be read. */
+export declare function workerAppDbCaPem(keys: Pick<SigninDbKeys, 'resolve'> | undefined, orgId: string): Promise<{
+    pem: string;
+} | null>;
+/**
+ * The owner's address for foundry's own steps (migrations, roles): the app's internal host and the
+ * password in its env. A secret. The TLS settings are not part of the address; Hyperdrive gets the
+ * CA separately.
+ */
+export declare function workerAppDbOwnerUrl(coolify: Pick<PlatformAuthDeps['coolify'], 'listEnvs'>, org: DeclaredOrg, appId: string): Promise<string>;

package/dist/plan/worker-app-db.js

@@ -0,0 +1,154 @@
+import { ORG_SERVICE_SCHEMAS, orgServiceDatabase } from '../org.js';
+import { orgTarget } from './own-services.js';
+import { signinDbCertDue, tlsDbScopeKeys } from './signin-db-tls.js';
+import { SIGNIN_DB_ENV, SIGNIN_DB_PORT } from './signin-db.js';
+import { dockerfileAppCreator, provisionSigninDb, withCallTimeout, } from './signin-db.js';
+/**
+ * A Worker app's database as foundry's own TLS Postgres (the sign-in database's image), so that
+ * Cloudflare Hyperdrive connects with `verify-ca`. It replaces the Coolify database that a Worker
+ * app entry used to force: Coolify 4.4.2 cannot turn on a database's TLS.
+ *
+ * One app `<slug>-app-db` per org, user `app_owner`, the org's `app` database. The CA is the org's
+ * own, held under {@link workerAppDbCaRef}; the server certificate is renewed by planning the step
+ * again when it is due.
+ */
+/** Recorded ids: the app, "the step finished", and the server certificate's expiry. */
+export const WORKER_APP_DB_SCOPE_KEYS = tlsDbScopeKeys('workerapp_db');
+/** `unmanaged` key of the one blocked line {@link planWorkerAppDb} reports. */
+export const WORKER_APP_DB_BLOCKED_KEY = 'worker-app-db';
+/** `unmanaged` key of the note that the legacy Coolify database is no longer used. */
+export const WORKER_APP_DB_LEGACY_NOTE_KEY = 'worker-app-db-legacy';
+export const WORKER_APP_DB_USER = 'app_owner';
+export const WORKER_APP_DB_BACKUP_PREFIX = 'worker-app-db';
+export const workerAppDbCaRef = (orgId) => `worker-app-db:${orgId}:ca`;
+export const workerAppDbServerRef = (orgId) => `worker-app-db:${orgId}:server`;
+export const workerAppDbName = (org) => `${org.slug}-app-db`;
+/** The org's Worker app entries declare a database. */
+export const orgHasWorkerAppDatabase = (org) => org.hosting.entries.some((entry) => Boolean(entry.workerApp?.database));
+/** The database's name on the server: the org's `app` home, as the Postgres server would name it. */
+export function workerAppDbDatabase(org) {
+    const home = ORG_SERVICE_SCHEMAS.find((h) => h.schema === 'app');
+    if (!home)
+        throw new Error('the org service schemas have no app home');
+    return orgServiceDatabase(org, home).database;
+}
+/**
+ * One `coolify:worker-app-db` step per org with a Worker app database: planned until the app and
+ * the "finished" marker are recorded, and again when the server certificate is due. A step that
+ * cannot succeed yet (no held-key put, no backup bucket) is a blocked line, not a step. The legacy
+ * Coolify database is never touched; a recorded one gets a note.
+ */
+export function planWorkerAppDb(options) {
+    const { org, recordedIds } = options;
+    if (!orgHasWorkerAppDatabase(org))
+        return { step: null, blocked: null, note: null };
+    const note = recordedIds[`coolify:database:${org.id}`]
+        ? `${org.slug}'s Coolify database is no longer used by its Worker apps; it is left as it is`
+        : null;
+    const keys = WORKER_APP_DB_SCOPE_KEYS;
+    const done = Boolean(recordedIds[keys.app] && recordedIds[keys.tls]);
+    if (done && !signinDbCertDue(recordedIds, options.now, keys)) {
+        return { step: null, blocked: null, note };
+    }
+    if (options.keysPuttable === false) {
+        return {
+            step: null,
+            note,
+            blocked: `${org.slug}'s Worker app database is blocked, not planned: the host cannot store the database certificate (held keys have no put)`,
+        };
+    }
+    if (options.backupConfigured === false) {
+        return {
+            step: null,
+            note,
+            blocked: `${org.slug}'s Worker app database is blocked, not planned: the host supplies no backup bucket for the database`,
+        };
+    }
+    return {
+        blocked: null,
+        note,
+        step: {
+            action: { system: 'coolify', kind: 'worker-app-db', key: org.id, desired: {} },
+            step: {
+                description: done
+                    ? `renew the server certificate of ${org.slug}'s Worker app database`
+                    : `provision ${org.slug}'s Worker app database as a TLS Postgres`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+    };
+}
+/**
+ * Brings the org's Worker app database up (`provisionSigninDb` with the app database's names) and
+ * records the "finished" marker last, so a run that died halfway is planned again. Returns the CA's
+ * PEM (public) and the app id.
+ */
+export async function provisionWorkerAppDb(scope, deps, org, input) {
+    const coolify = withCallTimeout(deps.coolify);
+    const runtime = deps.runtime ?? {};
+    const name = workerAppDbName(org);
+    const keys = WORKER_APP_DB_SCOPE_KEYS;
+    const record = async (key, id) => {
+        scope.recordScopeId(key, id);
+        await scope.persist();
+    };
+    const projectUuid = await input.project.ensure(coolify, scope);
+    const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
+    const db = await provisionSigninDb({
+        coolify,
+        keys: deps.heldKeys,
+        runtime,
+        name,
+        internalHost: name,
+        volumeName: `${name}-data`,
+        serverCertRef: workerAppDbServerRef(org.id),
+        slug: org.slug,
+        backup: deps.signinDbBackup,
+        backupBucket: orgTarget(org).names.signinBackupBucket,
+        recorded: scope.recordedIds(),
+        label: input.label,
+        environment,
+        record,
+        create: dockerfileAppCreator(coolify, {
+            projectUuid,
+            environment,
+            name,
+            description: `${org.slug}'s Worker app database with TLS`,
+        }),
+    }, {
+        appName: name,
+        user: WORKER_APP_DB_USER,
+        database: workerAppDbDatabase(org),
+        caRef: workerAppDbCaRef(org.id),
+        caCommonName: `foundry ${org.slug} app database CA`,
+        scopeKeys: keys,
+        backupPrefix: WORKER_APP_DB_BACKUP_PREFIX,
+    });
+    await record(keys.tls, db.appId);
+    return { appId: db.appId, ca: db.ca };
+}
+/** The org's CA certificate (public) from the held `{ cert, key }`, or null when none is held or it cannot be read. */
+export async function workerAppDbCaPem(keys, orgId) {
+    const held = await keys?.resolve(workerAppDbCaRef(orgId));
+    if (!held)
+        return null;
+    try {
+        const cert = JSON.parse(held).cert;
+        return typeof cert === 'string' && cert ? { pem: cert } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The owner's address for foundry's own steps (migrations, roles): the app's internal host and the
+ * password in its env. A secret. The TLS settings are not part of the address; Hyperdrive gets the
+ * CA separately.
+ */
+export async function workerAppDbOwnerUrl(coolify, org, appId) {
+    const password = (await coolify.listEnvs(appId)).find((e) => e.key === SIGNIN_DB_ENV.password && !e.is_preview && e.value)?.value;
+    if (!password)
+        throw new Error('the database app holds no password yet');
+    return `postgres://${WORKER_APP_DB_USER}:${encodeURIComponent(password)}@${workerAppDbName(org)}:${SIGNIN_DB_PORT}/${workerAppDbDatabase(org)}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.51.5",
+  "version": "0.52.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",