unoverse 0.1.86 → 0.1.88

package/bin/unoverse.mjs

@@ -58,7 +58,7 @@ const UNIVERSE = findUniverse();
 // type it to update the CLI far more often than to refresh a local universe's images,
 // and that refresh now belongs to `start --pull`.
 const OPERATOR_COMMANDS = new Set([
-  "start", "stop", "check", "logs", "deploy", "destroy",
+  "start", "stop", "check", "logs", "deploy", "destroy", "db-allow",
   // kept working, not advertised
   "ground", "dev", "build", "publish", "init",
 ]);

package/lib/urls.mjs

@@ -39,6 +39,7 @@ function section(title, rows, subtitle) {
 import { existsSync } from "node:fs";
 import { join, resolve, dirname } from "node:path";
 import { spawnSync } from "node:child_process";
+import { lookup } from "node:dns/promises";
 
 import { bold, dim, cyan, green, red } from "./ui.mjs";
 
@@ -75,11 +76,35 @@ function terraformOutputs(root) {
   return {};
 }
 
-async function probe(url) {
+/**
+ * "no answer" AND "answering from the wrong machine" ARE DIFFERENT PROBLEMS.
+ *
+ * A URL that does not respond used to report identically whether the service was down or
+ * the hostname resolved somewhere else entirely. That sent an operator to look at
+ * infrastructure that was already working: two load balancers up, a verified certificate,
+ * and every deployed URL reading "no answer" because a resolver was still holding a
+ * deleted A record. The address had a cached answer pointing at a destroyed server, which
+ * is not a fact any amount of staring at containers reveals.
+ *
+ * So when a probe fails, ask what the name actually resolves to and compare it with the
+ * address the ground says it should be. Stale DNS then says so in the one place the
+ * operator is already looking.
+ */
+async function probe(url, expectedIp) {
   try {
     const res = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(5000) });
     return { up: true, status: res.status };
   } catch {
+    if (!expectedIp) return { up: false };
+    try {
+      const { hostname } = new URL(url);
+      const { address } = await lookup(hostname);
+      if (address !== expectedIp) {
+        return { up: false, note: `DNS says ${address}, should be ${expectedIp} — a resolver is holding an old record` };
+      }
+    } catch {
+      return { up: false, note: "that hostname does not resolve yet" };
+    }
     return { up: false };
   }
 }
@@ -103,14 +128,14 @@ export async function urls() {
     domain = /^https:\/\/api\.(.+)$/.exec(apiBase)?.[1] || "";
     const candidates = [];
     if (apiBase) {
-      candidates.push({ label: "API", url: apiBase, note: "MCP at /mcp" });
-      candidates.push({ label: "Health", url: `${apiBase}/health` });
+      candidates.push({ label: "API", url: apiBase, note: "MCP at /mcp", expect: tf.lb_ip });
+      candidates.push({ label: "Health", url: `${apiBase}/health`, expect: tf.lb_ip });
     }
     const canvas = tf.canvas_url && tf.canvas_url.startsWith("http") ? tf.canvas_url : null;
-    if (canvas) candidates.push({ label: "Canvas", url: canvas, note: "add to IdP origins" });
+    if (canvas) candidates.push({ label: "Canvas", url: canvas, note: "add to IdP origins", expect: tf.canvas_lb_ip });
     if (tf.deploy_host) candidates.push({ label: "Logs", url: `http://${tf.deploy_host}:8080`, note: "admin IP only" });
     if (tf.cognito_hosted_ui) candidates.push({ label: "Login", url: tf.cognito_hosted_ui });
-    deployed = await Promise.all(candidates.map(async (c) => ({ ...c, ...(await probe(c.url)) })));
+    deployed = await Promise.all(candidates.map(async (c) => ({ ...c, ...(await probe(c.url, c.expect)) })));
   }
 
   const anyUp = [...local, ...deployed].some((r) => r.up);

package/operator/ansible/playbooks/db-setup.yml

@@ -90,20 +90,21 @@
     # terraform at deploy time and is never written to the server.
     - name: "[3b/5] Grant the universe user rights on its own schema"
       command: >
-        docker compose exec -T -e NODE_TLS_REJECT_UNAUTHORIZED=0 -e ADMIN_URL={{ pg_admin_url }} unoverse node -e
+        docker compose exec -T -e NODE_TLS_REJECT_UNAUTHORIZED=0 -e ADMIN_URL={{ pg_admin_url }} -e PG_USER={{ pg_user | default('universe') }} unoverse node -e
         "const{Client}=require('pg');
         const c=new Client({connectionString:process.env.ADMIN_URL,ssl:{rejectUnauthorized:false}});
         (async()=>{
           await c.connect();
-          await c.query('GRANT ALL ON SCHEMA public TO \"universe\"');
-          await c.query('GRANT ALL ON ALL TABLES IN SCHEMA public TO \"universe\"');
-          await c.query('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO \"universe\"');
+          const u = JSON.stringify(process.env.PG_USER).replace(/^\"|\"$/g,'');
+          await c.query('GRANT ALL ON SCHEMA public TO \"'+u+'\"');
+          await c.query('GRANT ALL ON ALL TABLES IN SCHEMA public TO \"'+u+'\"');
+          await c.query('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO \"'+u+'\"');
           await c.end();
           console.log('granted');
         })().catch(e=>{console.error(e.message);process.exit(1)})"
       args:
         chdir: /opt/gravity
-      when: (pg_admin_url | default('')) | length > 0
+      when: (pg_admin_url | default('')) | length > 0 and (pg_user | default('')) | length > 0
       no_log: true
       register: grant_result
 

package/operator/ansible/playbooks/deploy-images.yml

@@ -42,6 +42,25 @@
         src: "{{ universe_root | default(playbook_dir + '/../..') }}/docker-compose.yml"
         dest: "{{ gravity_dir }}/docker-compose.yml"
 
+    # THE ENVIRONMENT TRAVELS WITH THE DEPLOY TOO. This step used to be skipped on the
+    # grounds that `.env` held per-server values a deploy must not clobber. That stopped
+    # being true when the ground started rendering it in full: it is `terraform output -raw
+    # env_production`, derived from the same state that built the infrastructure, and
+    # nothing on the server edits it.
+    #
+    # Skipping it meant a change to the ground reached docker-compose.yml and stopped there.
+    # Setting a domain updated the compose file, while the environment still said
+    # DOMAIN= and API_URL=http://<lb-ip> — so Canvas loaded over HTTPS and called the API
+    # over plain HTTP at a raw IP, and the browser blocked it as mixed content. The compose
+    # file and the environment describe one deployment; shipping one without the other
+    # leaves them disagreeing.
+    - name: "[1b/4] Sync .env (the ground renders it, so it travels with the deploy)"
+      copy:
+        src: "{{ env_file }}"
+        dest: /opt/gravity/.env
+        owner: "{{ ansible_user }}"
+        mode: "0600"
+
     - name: "[2/4] Pull latest platform images"
       shell: |
         cd {{ gravity_dir }}

package/operator/infra/digitalocean/main.tf

@@ -272,16 +272,20 @@ resource "digitalocean_database_cluster" "pg" {
   node_count = 1
 }
 
+# NAMED AFTER THE UNIVERSE, not "universe". A cluster can host several universes — that
+# is the whole point of adopting one rather than provisioning per stack — and a hardcoded
+# name means the second one either collides with the first or, worse, attaches to it and
+# silently shares its data. Everything else on this ground is already ${var.name}-prefixed.
 resource "digitalocean_database_db" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
-  name       = "universe"
+  name       = var.name
 }
 
 resource "digitalocean_database_user" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
-  name       = "universe"
+  name       = var.name
 
   # NEVER UPDATE THIS USER IN PLACE. Provider 2.96 grew a `settings` block (Kafka and
   # OpenSearch ACLs) and an update path that fires whenever it sees any diff on the
@@ -305,7 +309,7 @@ resource "digitalocean_database_user" "universe" {
 resource "digitalocean_database_connection_pool" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
-  name       = "universe-pool"
+  name       = "${var.name}-pool"
   mode       = "transaction"
   size       = local.s.pgbouncer
   db_name    = digitalocean_database_db.universe[0].name

package/operator/infra/digitalocean/outputs.tf

@@ -42,6 +42,13 @@ output "lb_ip" {
   value       = digitalocean_loadbalancer.public.ip
 }
 
+# Canvas's own load balancer address. Read by `unoverse where` so a hostname resolving to
+# something else can be reported as stale DNS rather than as a dead service.
+output "canvas_lb_ip" {
+  description = "The Canvas load balancer's IP — canvas.<domain>'s A record target. Empty when Canvas is not public or there is no domain."
+  value       = length(digitalocean_loadbalancer.canvas) > 0 ? digitalocean_loadbalancer.canvas[0].ip : ""
+}
+
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the IdP's allowed origins."
   value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${digitalocean_loadbalancer.public.ip}:3001") : "canvas is admin-only (direct http://<droplet-ip>:3001 from admin_cidr)"
@@ -52,6 +59,13 @@ output "api_url" {
   value       = local.has_domain ? "https://${local.api_host}" : "http://${digitalocean_loadbalancer.public.ip}"
 }
 
+# The database user this universe owns. db-setup grants it rights on its own schema, and
+# the name follows var.name now, so the playbook can no longer assume "universe".
+output "pg_user" {
+  value       = length(digitalocean_database_user.universe) > 0 ? digitalocean_database_user.universe[0].name : ""
+  description = "This universe's database user, when the ground manages one"
+}
+
 # Read by deploy for the one-time schema grant, never written to the server. Empty when
 # the database is BYO: somebody else's cluster, whose permissions are theirs to run.
 output "pg_admin_url" {

package/operator/lib/deploy.sh

@@ -26,6 +26,123 @@
 # stale rule behind — and worse, terraform's own destroy of an authoritative firewall
 # resource PUT an EMPTY list and locked the operator out of a database it had borrowed.
 # Both directions now touch exactly one rule and never the list.
+# Keep the DEVELOPER'S OWN MACHINE able to reach an adopted database, across networks.
+#
+# A managed cluster's trusted sources are a list of IP addresses, and a laptop's address is
+# not a stable thing: a different office, a hotspot, a train, and local `npm run dev` dies
+# on "Connection terminated unexpectedly" ten seconds into boot, with nothing on screen
+# connecting that to the network you joined this morning. The droplet's own firewall already
+# follows the operator around (_ensure_ground_config re-checks admin_cidr every deploy);
+# this is the same idea for the one rule that lets a laptop in.
+#
+# IT ONLY EVER REMOVES ITS OWN. The addresses it added are recorded in .unoverse/trusted-ips,
+# and nothing absent from that file is touched — the operator's other machines, their
+# colleagues, their CI, their other droplets and apps all survive untouched. That rule
+# exists because the opposite mistake is what wiped this exact cluster's firewall once
+# already: an authoritative write that assumed the whole list was ours to own.
+_operator_db_access() {
+  local cloud="$1" dir="$ROOT/infra/$cloud" cluster
+  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  [ -n "$cluster" ] || return 0
+  [ -n "${DIGITALOCEAN_TOKEN:-}" ] || return 0
+  mkdir -p "$ROOT/.unoverse"
+
+  node - "$cluster" "$ROOT/.unoverse/trusted-ips" <<'NODE'
+const [cluster, ledgerPath] = process.argv.slice(2);
+const fs = require("fs");
+const T = process.env.DIGITALOCEAN_TOKEN;
+const H = { Authorization: `Bearer ${T}`, "Content-Type": "application/json" };
+const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { headers: H, ...o });
+const read = () => { try { return fs.readFileSync(ledgerPath, "utf8").split("\n").map(s => s.trim()).filter(Boolean); } catch { return []; } };
+
+(async () => {
+  const ip = (await (await fetch("https://api.ipify.org", { signal: AbortSignal.timeout(5000) })).text()).trim();
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(ip)) return;
+
+  const list = await (await api("/databases")).json();
+  const db = (list.databases || []).find((d) => d.name === cluster);
+  if (!db) return;
+
+  const fw = await (await api(`/databases/${db.id}/firewall`)).json();
+  let rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
+
+  const ours = read();                                   // only these may be removed
+  const stale = ours.filter((v) => v !== ip);
+  const had = rules.some((r) => r.type === "ip_addr" && r.value === ip);
+  // SAY SO EVEN WHEN NOTHING CHANGES. Returning silently made the command look like it had
+  // failed: the developer typed it because they could not connect, and got a blank line.
+  if (had && stale.length === 0) {
+    fs.writeFileSync(ledgerPath, ip + "\n");
+    console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) can already reach ${cluster} \x1b[2m(nothing changed)\x1b[0m`);
+    return;
+  }
+
+  rules = rules.filter((r) => !(r.type === "ip_addr" && stale.includes(r.value)));
+  if (!had) rules.push({ type: "ip_addr", value: ip });
+
+  const res = await api(`/databases/${db.id}/firewall`, { method: "PUT", body: JSON.stringify({ rules }) });
+  if (!res.ok) {
+    console.log(`  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add ${ip} by hand`);
+    return;
+  }
+  fs.writeFileSync(ledgerPath, ip + "\n");
+  console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) may reach ${cluster} \x1b[2m(${rules.length} trusted sources, only ours changed)\x1b[0m`);
+})().catch(() => {});
+NODE
+}
+
+# unoverse db-allow — let THIS machine reach this universe's database.
+#
+# Typed, never automatic. It changes a live database's network ACL, and doing that as a
+# side effect of `start` meant a coffee shop's shared address quietly joined a production
+# cluster's trusted sources. Typing it is the consent.
+#
+# What makes it safe to hand a developer: the DigitalOcean token gates it, so nobody
+# without your cloud credential can run it at all, and the database still demands its own
+# password afterwards. This opens a door in the network layer; it does not open the
+# database.
+cmd_db_allow() {
+  local cloud="" g
+  for g in digitalocean aws; do
+    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
+  done
+  if [ -z "$cloud" ]; then
+    fail "No ground here. There is no database to reach"
+    return 1
+  fi
+
+  local cluster
+  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$ROOT/infra/$cloud/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+
+  # THE MONOREPO NEEDS THIS TOO, and it has no ground. The platform's own checkout is
+  # developed against a managed cluster named only in .env, so a ground-only lookup found
+  # nothing and the one place the developer actually types `npm run dev` was the one place
+  # this could not help. A cluster host is `<name>-do-user-...`, so the name is right there
+  # in DATABASE_URL.
+  if [ -z "$cluster" ]; then
+    cluster=$(grep -E '^DATABASE_URL=' "$ROOT/.env" 2>/dev/null | head -1 \
+      | sed -E 's|.*@([a-z0-9-]+)-do-user-[^.]*\..*|\1|; t; d')
+  fi
+
+  if [ -z "$cluster" ]; then
+    ok "This database has no trusted-source list to join"
+    info "Nothing to do — you can already reach it"
+    return 0
+  fi
+
+  _ground_credentials
+  if [ -z "${DIGITALOCEAN_TOKEN:-}" ]; then
+    fail "No DigitalOcean credential. Run ${BOLD}unoverse deploy${NC} once, or ${BOLD}doctl auth init${NC}"
+    return 1
+  fi
+
+  echo ""
+  _operator_db_access "$cloud"
+  echo ""
+  info "Run this again whenever you change network"
+  echo ""
+}
+
 _adopted_db_access() {
   local cloud="$1" dir="$ROOT/infra/$cloud" cluster droplet_id
   local mode="$2"

package/operator/lib/help.sh

@@ -24,6 +24,7 @@ cmd_help() {
   echo -e "    ${GREEN}logs${NC}        What is it doing ${DIM}(unoverse logs <service> for one)${NC}"
   echo -e "    ${GREEN}deploy${NC}      Ship it to a server ${DIM}(first run asks which cloud)${NC}"
   echo -e "    ${GREEN}destroy${NC}     Take the deployment down ${DIM}(shows what goes, and what stays)${NC}"
+  echo -e "    ${GREEN}db-allow${NC}    Let this machine reach the database ${DIM}(run it when you change network)${NC}"
   echo ""
   # Owner-only lane. Printed ONLY when publish.sh is present, so a starter kit never
   # advertises a command it does not have (sync-starter.sh deletes that file).

package/operator/lib/start.sh

@@ -52,6 +52,12 @@ pull_missing_images() {
 }
 
 cmd_start() {
+  # NO FIREWALL CHANGE HERE. Starting a dev server briefly did this automatically, so a
+  # laptop that had moved could always reach its database. It also meant every `start` on
+  # café or hotel Wi-Fi silently added THAT network's shared egress address to a production
+  # cluster's trusted sources, where it stayed until the next run. An ACL change is a
+  # deliberate act: `unoverse db-allow`, typed, when you move network.
+
   # Login to registry if DOCR_TOKEN is set
   local docr_token
   docr_token=$(grep "^DOCR_TOKEN=" "$ROOT/.env" 2>/dev/null | cut -d'=' -f2-)

package/operator/operator.sh

@@ -66,6 +66,7 @@ case "${1:-}" in
   dev)       cmd_dev ;;
   ground)    shift; cmd_ground "$@" ;;
   destroy)   cmd_destroy ;;
+  db-allow)  cmd_db_allow ;;
   refresh-images)
     # internal: `unoverse update` runs this after updating the CLI. Pull newer images
     # if the registry has them, and recreate only what is already running — an update

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.86",
+  "version": "0.1.88",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",