unoverse 0.1.87 → 0.1.88

package/bin/unoverse.mjs

@@ -58,7 +58,7 @@ const UNIVERSE = findUniverse();
 // type it to update the CLI far more often than to refresh a local universe's images,
 // and that refresh now belongs to `start --pull`.
 const OPERATOR_COMMANDS = new Set([
-  "start", "stop", "check", "logs", "deploy", "destroy",
+  "start", "stop", "check", "logs", "deploy", "destroy", "db-allow",
   // kept working, not advertised
   "ground", "dev", "build", "publish", "init",
 ]);

package/operator/ansible/playbooks/db-setup.yml

@@ -90,20 +90,21 @@
     # terraform at deploy time and is never written to the server.
     - name: "[3b/5] Grant the universe user rights on its own schema"
       command: >
-        docker compose exec -T -e NODE_TLS_REJECT_UNAUTHORIZED=0 -e ADMIN_URL={{ pg_admin_url }} unoverse node -e
+        docker compose exec -T -e NODE_TLS_REJECT_UNAUTHORIZED=0 -e ADMIN_URL={{ pg_admin_url }} -e PG_USER={{ pg_user | default('universe') }} unoverse node -e
         "const{Client}=require('pg');
         const c=new Client({connectionString:process.env.ADMIN_URL,ssl:{rejectUnauthorized:false}});
         (async()=>{
           await c.connect();
-          await c.query('GRANT ALL ON SCHEMA public TO \"universe\"');
-          await c.query('GRANT ALL ON ALL TABLES IN SCHEMA public TO \"universe\"');
-          await c.query('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO \"universe\"');
+          const u = JSON.stringify(process.env.PG_USER).replace(/^\"|\"$/g,'');
+          await c.query('GRANT ALL ON SCHEMA public TO \"'+u+'\"');
+          await c.query('GRANT ALL ON ALL TABLES IN SCHEMA public TO \"'+u+'\"');
+          await c.query('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO \"'+u+'\"');
           await c.end();
           console.log('granted');
         })().catch(e=>{console.error(e.message);process.exit(1)})"
       args:
         chdir: /opt/gravity
-      when: (pg_admin_url | default('')) | length > 0
+      when: (pg_admin_url | default('')) | length > 0 and (pg_user | default('')) | length > 0
       no_log: true
       register: grant_result
 

package/operator/infra/digitalocean/main.tf

@@ -272,16 +272,20 @@ resource "digitalocean_database_cluster" "pg" {
   node_count = 1
 }
 
+# NAMED AFTER THE UNIVERSE, not "universe". A cluster can host several universes — that
+# is the whole point of adopting one rather than provisioning per stack — and a hardcoded
+# name means the second one either collides with the first or, worse, attaches to it and
+# silently shares its data. Everything else on this ground is already ${var.name}-prefixed.
 resource "digitalocean_database_db" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
-  name       = "universe"
+  name       = var.name
 }
 
 resource "digitalocean_database_user" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
-  name       = "universe"
+  name       = var.name
 
   # NEVER UPDATE THIS USER IN PLACE. Provider 2.96 grew a `settings` block (Kafka and
   # OpenSearch ACLs) and an update path that fires whenever it sees any diff on the
@@ -305,7 +309,7 @@ resource "digitalocean_database_user" "universe" {
 resource "digitalocean_database_connection_pool" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
-  name       = "universe-pool"
+  name       = "${var.name}-pool"
   mode       = "transaction"
   size       = local.s.pgbouncer
   db_name    = digitalocean_database_db.universe[0].name

package/operator/infra/digitalocean/outputs.tf

@@ -59,6 +59,13 @@ output "api_url" {
   value       = local.has_domain ? "https://${local.api_host}" : "http://${digitalocean_loadbalancer.public.ip}"
 }
 
+# The database user this universe owns. db-setup grants it rights on its own schema, and
+# the name follows var.name now, so the playbook can no longer assume "universe".
+output "pg_user" {
+  value       = length(digitalocean_database_user.universe) > 0 ? digitalocean_database_user.universe[0].name : ""
+  description = "This universe's database user, when the ground manages one"
+}
+
 # Read by deploy for the one-time schema grant, never written to the server. Empty when
 # the database is BYO: somebody else's cluster, whose permissions are theirs to run.
 output "pg_admin_url" {

package/operator/lib/deploy.sh

@@ -26,6 +26,123 @@
 # stale rule behind — and worse, terraform's own destroy of an authoritative firewall
 # resource PUT an EMPTY list and locked the operator out of a database it had borrowed.
 # Both directions now touch exactly one rule and never the list.
+# Keep the DEVELOPER'S OWN MACHINE able to reach an adopted database, across networks.
+#
+# A managed cluster's trusted sources are a list of IP addresses, and a laptop's address is
+# not a stable thing: a different office, a hotspot, a train, and local `npm run dev` dies
+# on "Connection terminated unexpectedly" ten seconds into boot, with nothing on screen
+# connecting that to the network you joined this morning. The droplet's own firewall already
+# follows the operator around (_ensure_ground_config re-checks admin_cidr every deploy);
+# this is the same idea for the one rule that lets a laptop in.
+#
+# IT ONLY EVER REMOVES ITS OWN. The addresses it added are recorded in .unoverse/trusted-ips,
+# and nothing absent from that file is touched — the operator's other machines, their
+# colleagues, their CI, their other droplets and apps all survive untouched. That rule
+# exists because the opposite mistake is what wiped this exact cluster's firewall once
+# already: an authoritative write that assumed the whole list was ours to own.
+_operator_db_access() {
+  local cloud="$1" dir="$ROOT/infra/$cloud" cluster
+  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  [ -n "$cluster" ] || return 0
+  [ -n "${DIGITALOCEAN_TOKEN:-}" ] || return 0
+  mkdir -p "$ROOT/.unoverse"
+
+  node - "$cluster" "$ROOT/.unoverse/trusted-ips" <<'NODE'
+const [cluster, ledgerPath] = process.argv.slice(2);
+const fs = require("fs");
+const T = process.env.DIGITALOCEAN_TOKEN;
+const H = { Authorization: `Bearer ${T}`, "Content-Type": "application/json" };
+const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { headers: H, ...o });
+const read = () => { try { return fs.readFileSync(ledgerPath, "utf8").split("\n").map(s => s.trim()).filter(Boolean); } catch { return []; } };
+
+(async () => {
+  const ip = (await (await fetch("https://api.ipify.org", { signal: AbortSignal.timeout(5000) })).text()).trim();
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(ip)) return;
+
+  const list = await (await api("/databases")).json();
+  const db = (list.databases || []).find((d) => d.name === cluster);
+  if (!db) return;
+
+  const fw = await (await api(`/databases/${db.id}/firewall`)).json();
+  let rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
+
+  const ours = read();                                   // only these may be removed
+  const stale = ours.filter((v) => v !== ip);
+  const had = rules.some((r) => r.type === "ip_addr" && r.value === ip);
+  // SAY SO EVEN WHEN NOTHING CHANGES. Returning silently made the command look like it had
+  // failed: the developer typed it because they could not connect, and got a blank line.
+  if (had && stale.length === 0) {
+    fs.writeFileSync(ledgerPath, ip + "\n");
+    console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) can already reach ${cluster} \x1b[2m(nothing changed)\x1b[0m`);
+    return;
+  }
+
+  rules = rules.filter((r) => !(r.type === "ip_addr" && stale.includes(r.value)));
+  if (!had) rules.push({ type: "ip_addr", value: ip });
+
+  const res = await api(`/databases/${db.id}/firewall`, { method: "PUT", body: JSON.stringify({ rules }) });
+  if (!res.ok) {
+    console.log(`  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add ${ip} by hand`);
+    return;
+  }
+  fs.writeFileSync(ledgerPath, ip + "\n");
+  console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) may reach ${cluster} \x1b[2m(${rules.length} trusted sources, only ours changed)\x1b[0m`);
+})().catch(() => {});
+NODE
+}
+
+# unoverse db-allow — let THIS machine reach this universe's database.
+#
+# Typed, never automatic. It changes a live database's network ACL, and doing that as a
+# side effect of `start` meant a coffee shop's shared address quietly joined a production
+# cluster's trusted sources. Typing it is the consent.
+#
+# What makes it safe to hand a developer: the DigitalOcean token gates it, so nobody
+# without your cloud credential can run it at all, and the database still demands its own
+# password afterwards. This opens a door in the network layer; it does not open the
+# database.
+cmd_db_allow() {
+  local cloud="" g
+  for g in digitalocean aws; do
+    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
+  done
+  if [ -z "$cloud" ]; then
+    fail "No ground here. There is no database to reach"
+    return 1
+  fi
+
+  local cluster
+  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$ROOT/infra/$cloud/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+
+  # THE MONOREPO NEEDS THIS TOO, and it has no ground. The platform's own checkout is
+  # developed against a managed cluster named only in .env, so a ground-only lookup found
+  # nothing and the one place the developer actually types `npm run dev` was the one place
+  # this could not help. A cluster host is `<name>-do-user-...`, so the name is right there
+  # in DATABASE_URL.
+  if [ -z "$cluster" ]; then
+    cluster=$(grep -E '^DATABASE_URL=' "$ROOT/.env" 2>/dev/null | head -1 \
+      | sed -E 's|.*@([a-z0-9-]+)-do-user-[^.]*\..*|\1|; t; d')
+  fi
+
+  if [ -z "$cluster" ]; then
+    ok "This database has no trusted-source list to join"
+    info "Nothing to do — you can already reach it"
+    return 0
+  fi
+
+  _ground_credentials
+  if [ -z "${DIGITALOCEAN_TOKEN:-}" ]; then
+    fail "No DigitalOcean credential. Run ${BOLD}unoverse deploy${NC} once, or ${BOLD}doctl auth init${NC}"
+    return 1
+  fi
+
+  echo ""
+  _operator_db_access "$cloud"
+  echo ""
+  info "Run this again whenever you change network"
+  echo ""
+}
+
 _adopted_db_access() {
   local cloud="$1" dir="$ROOT/infra/$cloud" cluster droplet_id
   local mode="$2"

package/operator/lib/help.sh

@@ -24,6 +24,7 @@ cmd_help() {
   echo -e "    ${GREEN}logs${NC}        What is it doing ${DIM}(unoverse logs <service> for one)${NC}"
   echo -e "    ${GREEN}deploy${NC}      Ship it to a server ${DIM}(first run asks which cloud)${NC}"
   echo -e "    ${GREEN}destroy${NC}     Take the deployment down ${DIM}(shows what goes, and what stays)${NC}"
+  echo -e "    ${GREEN}db-allow${NC}    Let this machine reach the database ${DIM}(run it when you change network)${NC}"
   echo ""
   # Owner-only lane. Printed ONLY when publish.sh is present, so a starter kit never
   # advertises a command it does not have (sync-starter.sh deletes that file).

package/operator/lib/start.sh

@@ -52,6 +52,12 @@ pull_missing_images() {
 }
 
 cmd_start() {
+  # NO FIREWALL CHANGE HERE. Starting a dev server briefly did this automatically, so a
+  # laptop that had moved could always reach its database. It also meant every `start` on
+  # café or hotel Wi-Fi silently added THAT network's shared egress address to a production
+  # cluster's trusted sources, where it stayed until the next run. An ACL change is a
+  # deliberate act: `unoverse db-allow`, typed, when you move network.
+
   # Login to registry if DOCR_TOKEN is set
   local docr_token
   docr_token=$(grep "^DOCR_TOKEN=" "$ROOT/.env" 2>/dev/null | cut -d'=' -f2-)

package/operator/operator.sh

@@ -66,6 +66,7 @@ case "${1:-}" in
   dev)       cmd_dev ;;
   ground)    shift; cmd_ground "$@" ;;
   destroy)   cmd_destroy ;;
+  db-allow)  cmd_db_allow ;;
   refresh-images)
     # internal: `unoverse update` runs this after updating the CLI. Pull newer images
     # if the registry has them, and recreate only what is already running — an update

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.87",
+  "version": "0.1.88",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",