unoverse 0.1.74 → 0.1.76

package/operator/infra/digitalocean/main.tf

@@ -261,8 +261,18 @@ resource "digitalocean_database_connection_pool" "universe" {
   user       = digitalocean_database_user.universe[0].name
 }
 
+# ONLY A CLUSTER THIS STACK CREATED. `digitalocean_database_firewall` is AUTHORITATIVE:
+# it replaces the whole trusted-sources list rather than adding to it. Applied to an
+# ADOPTED cluster it therefore deleted every rule the account already had — the
+# operator's own IP, their other droplets, their App Platform apps — and locked them out
+# of a database this universe merely borrows. It happened, on 2026-08-01.
+#
+# So terraform owns the firewall only when it owns the cluster (`provision_pg`). For an
+# adopted cluster the CLI appends this droplet to the existing rules instead
+# (scripts/lib/deploy.sh), which is additive and leaves everything else alone. A universe
+# never takes ownership of a database it did not create.
 resource "digitalocean_database_firewall" "pg" {
-  count      = local.pg_managed ? 1 : 0
+  count      = local.provision_pg ? 1 : 0
   cluster_id = local.pg_cluster_id
   rule {
     type  = "droplet"

package/operator/lib/deploy.sh

@@ -14,6 +14,59 @@
 # Terraform is one static binary: install it from the official release rather than
 # sending anyone to brew, whose compile chain can demand Xcode Command Line Tools
 # updates for a tool that needs no compiling.
+# Give this universe's droplet access to an ADOPTED database, additively.
+#
+# Terraform cannot do this safely: `digitalocean_database_firewall` replaces the whole
+# trusted-sources list, so pointing it at a borrowed cluster deletes the operator's own
+# IP, their other droplets and their apps. Read the rules, add ours if missing, write
+# them back. Nothing else moves, and running it twice changes nothing.
+_grant_droplet_to_adopted_db() {
+  local cloud="$1" dir="$ROOT/infra/$cloud" cluster droplet_id
+  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  [ -n "$cluster" ] || return 0
+  [ -n "${DIGITALOCEAN_TOKEN:-}" ] || return 0
+  droplet_id=$(terraform -chdir="$dir" state show digitalocean_droplet.app 2>/dev/null | awk -F'"' '/^ *id *=/{print $2; exit}')
+  [ -n "$droplet_id" ] || return 0
+
+  node - "$cluster" "$droplet_id" <<'NODE'
+const [cluster, droplet] = process.argv.slice(2);
+const T = process.env.DIGITALOCEAN_TOKEN;
+const H = { Authorization: `Bearer ${T}`, "Content-Type": "application/json" };
+const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { headers: H, ...o });
+(async () => {
+  const list = await (await api("/databases")).json();
+  const db = (list.databases || []).find((d) => d.name === cluster);
+  if (!db) return;
+  const fw = await (await api(`/databases/${db.id}/firewall`)).json();
+  const rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
+  if (rules.some((r) => r.type === "droplet" && String(r.value) === String(droplet))) return;
+  rules.push({ type: "droplet", value: String(droplet) });
+  const res = await api(`/databases/${db.id}/firewall`, { method: "PUT", body: JSON.stringify({ rules }) });
+  console.log(res.ok
+    ? `  \x1b[32m✓\x1b[0m This universe may reach ${cluster} \x1b[2m(added to its trusted sources, nothing else changed)\x1b[0m`
+    : `  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add droplet ${droplet} by hand`);
+})().catch(() => {});
+NODE
+}
+
+# The cloud credential terraform needs, from where the CLI already put it.
+#
+# By design the DO token lives in doctl's config and never in a repo file (main.tf: an
+# empty var falls through to DIGITALOCEAN_TOKEN). This used to sit INSIDE cmd_deploy, so
+# `unoverse destroy` ran with no credential at all and every API call came back 401 —
+# the same class of bug as the Postgres question living in one branch of two. Anything
+# that talks to a ground calls this first.
+_ground_credentials() {
+  [ -n "${DIGITALOCEAN_TOKEN:-}" ] && return 0
+  local _docfg
+  for _docfg in "$HOME/Library/Application Support/doctl/config.yaml" "$HOME/.config/doctl/config.yaml"; do
+    [ -f "$_docfg" ] || continue
+    DIGITALOCEAN_TOKEN=$(awk '/access-token:/{print $2; exit}' "$_docfg")
+    if [ -n "$DIGITALOCEAN_TOKEN" ]; then export DIGITALOCEAN_TOKEN; return 0; fi
+  done
+  return 0
+}
+
 _ensure_terraform() {
   command -v terraform >/dev/null 2>&1 && return 0
   local REPLY tf_arch tf_os tf_v="1.9.8" tf_dir
@@ -114,6 +167,26 @@ _ensure_ground_config() {
   cur_size=$(grep -E '^size[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
   [ -n "$cur_size" ] && info "Size: ${BOLD}${cur_size}${NC} ${DIM}(small · medium · large — change it in terraform.tfvars and deploy again whenever you outgrow it)${NC}"
 
+  # REGION MUST MATCH, or the platform cannot reach its own database. DigitalOcean's
+  # private networking is per-region: the connection string uses the cluster's PRIVATE
+  # host, which a droplet in another region cannot resolve. Everything provisions
+  # perfectly and then the platform fails to start, which is the worst way to find out.
+  local reuse_name ground_region db_region
+  reuse_name=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  ground_region=$(grep -E '^region[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -n "$reuse_name" ] && [ -n "$ground_region" ] && command -v doctl >/dev/null 2>&1; then
+    db_region=$(doctl databases list --format Name,Region --no-header 2>/dev/null | awk -v n="$reuse_name" '$1==n{print $2}')
+    if [ -n "$db_region" ] && [ "$db_region" != "$ground_region" ]; then
+      echo ""
+      fail "Region mismatch: this universe is in ${BOLD}$ground_region${NC}, ${BOLD}$reuse_name${NC} is in ${BOLD}$db_region${NC}"
+      info "Private networking does not cross regions, so the platform could not reach it."
+      info "Either set ${BOLD}region = \"$db_region\"${NC} in infra/$cloud/terraform.tfvars,"
+      info "or comment out existing_pg_cluster_name to create a database in $ground_region."
+      echo ""
+      return 1
+    fi
+  fi
+
   # THE DATABASE DECISION, STATED EVERY RUN. It is asked once and then recorded in
   # terraform.tfvars, so later deploys correctly do not re-ask — but silence reads
   # exactly like never having been asked. Say what is in force, the same way Size does.
@@ -189,18 +262,7 @@ cmd_deploy() {
 
   local env_prod="$ROOT/.env.production"
 
-  # HAND TERRAFORM ITS TOKEN. By design the DO token lives in doctl's config and never
-  # in a repo file (main.tf: empty var falls through to DIGITALOCEAN_TOKEN). deploy
-  # authenticated doctl, so deploy passes the token on — process env only, no file.
-  # Without this, apply planned 6 resources and then 401'd on an empty credential.
-  if [ -z "${DIGITALOCEAN_TOKEN:-}" ]; then
-    local _docfg
-    for _docfg in "$HOME/Library/Application Support/doctl/config.yaml" "$HOME/.config/doctl/config.yaml"; do
-      [ -f "$_docfg" ] || continue
-      DIGITALOCEAN_TOKEN=$(awk '/access-token:/{print $2; exit}' "$_docfg")
-      if [ -n "$DIGITALOCEAN_TOKEN" ]; then export DIGITALOCEAN_TOKEN; break; fi
-    done
-  fi
+  _ground_credentials
 
   # ── ONE FLOW ────────────────────────────────────────────────────────────────
   # Which ground, is it configured, plan it, apply it, ship it. In that order, every
@@ -249,6 +311,8 @@ cmd_deploy() {
     exit 1
   fi
 
+  _grant_droplet_to_adopted_db "$cloud"
+
 
   # Read deploy target from .env.production
   local deploy_host deploy_user

package/operator/lib/destroy.sh

@@ -34,6 +34,7 @@ cmd_destroy() {
     return 1
   fi
 
+  _ground_credentials
   _ensure_terraform || return 1
 
   local pretty
@@ -72,7 +73,15 @@ cmd_destroy() {
   name="${name:-universe}"
 
   echo ""
-  echo -e "  ${RED}This deletes the server and its data. It cannot be undone.${NC}"
+  # Say what is actually lost. With a reused cluster the DATABASE survives, and claiming
+  # otherwise makes the warning untrue in the commonest case — which teaches people to
+  # skim warnings.
+  if [ -n "$kept" ]; then
+    echo -e "  ${RED}This deletes the server and everything on its disk. It cannot be undone.${NC}"
+    echo -e "  ${DIM}Your database and its contents survive in $kept.${NC}"
+  else
+    echo -e "  ${RED}This deletes the server, the database and all their data. It cannot be undone.${NC}"
+  fi
   echo ""
   local typed
   read -r -p "  Type the universe name to confirm ($name): " typed

package/operator/lib/tfsummary.mjs

@@ -48,7 +48,10 @@ function spec(size) {
  * and listing them separately turns one decision into eleven.
  */
 function describe(r) {
-  const a = r.change?.after ?? {};
+  // BEFORE, when there is no after. A destroy plan has `after: null` — every resource
+  // is being removed — so reading only `after` printed "Server · " with no size or
+  // region: the summary of a teardown, describing nothing.
+  const a = r.change?.after ?? r.change?.before ?? {};
   switch (r.type) {
     case "digitalocean_droplet":
       return { what: "Server", detail: `${spec(a.size)} · ${a.region ?? ""}`, price: PRICE[a.size] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",