unoverse 0.1.87 → 0.1.89

package/bin/unoverse.mjs

@@ -58,7 +58,7 @@ const UNIVERSE = findUniverse();
 // type it to update the CLI far more often than to refresh a local universe's images,
 // and that refresh now belongs to `start --pull`.
 const OPERATOR_COMMANDS = new Set([
-  "start", "stop", "check", "logs", "deploy", "destroy",
+  "start", "stop", "check", "logs", "deploy", "destroy", "db-allow",
   // kept working, not advertised
   "ground", "dev", "build", "publish", "init",
 ]);

package/operator/ansible/playbooks/db-setup.yml

@@ -90,20 +90,21 @@
     # terraform at deploy time and is never written to the server.
     - name: "[3b/5] Grant the universe user rights on its own schema"
       command: >
-        docker compose exec -T -e NODE_TLS_REJECT_UNAUTHORIZED=0 -e ADMIN_URL={{ pg_admin_url }} unoverse node -e
+        docker compose exec -T -e NODE_TLS_REJECT_UNAUTHORIZED=0 -e ADMIN_URL={{ pg_admin_url }} -e PG_USER={{ pg_user | default('universe') }} unoverse node -e
         "const{Client}=require('pg');
         const c=new Client({connectionString:process.env.ADMIN_URL,ssl:{rejectUnauthorized:false}});
         (async()=>{
           await c.connect();
-          await c.query('GRANT ALL ON SCHEMA public TO \"universe\"');
-          await c.query('GRANT ALL ON ALL TABLES IN SCHEMA public TO \"universe\"');
-          await c.query('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO \"universe\"');
+          const u = JSON.stringify(process.env.PG_USER).replace(/^\"|\"$/g,'');
+          await c.query('GRANT ALL ON SCHEMA public TO \"'+u+'\"');
+          await c.query('GRANT ALL ON ALL TABLES IN SCHEMA public TO \"'+u+'\"');
+          await c.query('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO \"'+u+'\"');
           await c.end();
           console.log('granted');
         })().catch(e=>{console.error(e.message);process.exit(1)})"
       args:
         chdir: /opt/gravity
-      when: (pg_admin_url | default('')) | length > 0
+      when: (pg_admin_url | default('')) | length > 0 and (pg_user | default('')) | length > 0
       no_log: true
       register: grant_result
 

package/operator/infra/digitalocean/main.tf

@@ -272,16 +272,20 @@ resource "digitalocean_database_cluster" "pg" {
   node_count = 1
 }
 
+# NAMED AFTER THE UNIVERSE, not "universe". A cluster can host several universes — that
+# is the whole point of adopting one rather than provisioning per stack — and a hardcoded
+# name means the second one either collides with the first or, worse, attaches to it and
+# silently shares its data. Everything else on this ground is already ${var.name}-prefixed.
 resource "digitalocean_database_db" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
-  name       = "universe"
+  name       = var.name
 }
 
 resource "digitalocean_database_user" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
-  name       = "universe"
+  name       = var.name
 
   # NEVER UPDATE THIS USER IN PLACE. Provider 2.96 grew a `settings` block (Kafka and
   # OpenSearch ACLs) and an update path that fires whenever it sees any diff on the
@@ -305,7 +309,7 @@ resource "digitalocean_database_user" "universe" {
 resource "digitalocean_database_connection_pool" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
-  name       = "universe-pool"
+  name       = "${var.name}-pool"
   mode       = "transaction"
   size       = local.s.pgbouncer
   db_name    = digitalocean_database_db.universe[0].name

package/operator/infra/digitalocean/outputs.tf

@@ -59,6 +59,13 @@ output "api_url" {
   value       = local.has_domain ? "https://${local.api_host}" : "http://${digitalocean_loadbalancer.public.ip}"
 }
 
+# The database user this universe owns. db-setup grants it rights on its own schema, and
+# the name follows var.name now, so the playbook can no longer assume "universe".
+output "pg_user" {
+  value       = length(digitalocean_database_user.universe) > 0 ? digitalocean_database_user.universe[0].name : ""
+  description = "This universe's database user, when the ground manages one"
+}
+
 # Read by deploy for the one-time schema grant, never written to the server. Empty when
 # the database is BYO: somebody else's cluster, whose permissions are theirs to run.
 output "pg_admin_url" {

package/operator/lib/deploy.sh

@@ -26,6 +26,123 @@
 # stale rule behind — and worse, terraform's own destroy of an authoritative firewall
 # resource PUT an EMPTY list and locked the operator out of a database it had borrowed.
 # Both directions now touch exactly one rule and never the list.
+# Keep the DEVELOPER'S OWN MACHINE able to reach an adopted database, across networks.
+#
+# A managed cluster's trusted sources are a list of IP addresses, and a laptop's address is
+# not a stable thing: a different office, a hotspot, a train, and local `npm run dev` dies
+# on "Connection terminated unexpectedly" ten seconds into boot, with nothing on screen
+# connecting that to the network you joined this morning. The droplet's own firewall already
+# follows the operator around (_ensure_ground_config re-checks admin_cidr every deploy);
+# this is the same idea for the one rule that lets a laptop in.
+#
+# IT ONLY EVER REMOVES ITS OWN. The addresses it added are recorded in .unoverse/trusted-ips,
+# and nothing absent from that file is touched — the operator's other machines, their
+# colleagues, their CI, their other droplets and apps all survive untouched. That rule
+# exists because the opposite mistake is what wiped this exact cluster's firewall once
+# already: an authoritative write that assumed the whole list was ours to own.
+_operator_db_access() {
+  local cloud="$1" dir="$ROOT/infra/$cloud" cluster
+  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  [ -n "$cluster" ] || return 0
+  [ -n "${DIGITALOCEAN_TOKEN:-}" ] || return 0
+  mkdir -p "$ROOT/.unoverse"
+
+  node - "$cluster" "$ROOT/.unoverse/trusted-ips" <<'NODE'
+const [cluster, ledgerPath] = process.argv.slice(2);
+const fs = require("fs");
+const T = process.env.DIGITALOCEAN_TOKEN;
+const H = { Authorization: `Bearer ${T}`, "Content-Type": "application/json" };
+const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { headers: H, ...o });
+const read = () => { try { return fs.readFileSync(ledgerPath, "utf8").split("\n").map(s => s.trim()).filter(Boolean); } catch { return []; } };
+
+(async () => {
+  const ip = (await (await fetch("https://api.ipify.org", { signal: AbortSignal.timeout(5000) })).text()).trim();
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(ip)) return;
+
+  const list = await (await api("/databases")).json();
+  const db = (list.databases || []).find((d) => d.name === cluster);
+  if (!db) return;
+
+  const fw = await (await api(`/databases/${db.id}/firewall`)).json();
+  let rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
+
+  const ours = read();                                   // only these may be removed
+  const stale = ours.filter((v) => v !== ip);
+  const had = rules.some((r) => r.type === "ip_addr" && r.value === ip);
+  // SAY SO EVEN WHEN NOTHING CHANGES. Returning silently made the command look like it had
+  // failed: the developer typed it because they could not connect, and got a blank line.
+  if (had && stale.length === 0) {
+    fs.writeFileSync(ledgerPath, ip + "\n");
+    console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) can already reach ${cluster} \x1b[2m(nothing changed)\x1b[0m`);
+    return;
+  }
+
+  rules = rules.filter((r) => !(r.type === "ip_addr" && stale.includes(r.value)));
+  if (!had) rules.push({ type: "ip_addr", value: ip });
+
+  const res = await api(`/databases/${db.id}/firewall`, { method: "PUT", body: JSON.stringify({ rules }) });
+  if (!res.ok) {
+    console.log(`  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add ${ip} by hand`);
+    return;
+  }
+  fs.writeFileSync(ledgerPath, ip + "\n");
+  console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) may reach ${cluster} \x1b[2m(${rules.length} trusted sources, only ours changed)\x1b[0m`);
+})().catch(() => {});
+NODE
+}
+
+# unoverse db-allow — let THIS machine reach this universe's database.
+#
+# Typed, never automatic. It changes a live database's network ACL, and doing that as a
+# side effect of `start` meant a coffee shop's shared address quietly joined a production
+# cluster's trusted sources. Typing it is the consent.
+#
+# What makes it safe to hand a developer: the DigitalOcean token gates it, so nobody
+# without your cloud credential can run it at all, and the database still demands its own
+# password afterwards. This opens a door in the network layer; it does not open the
+# database.
+cmd_db_allow() {
+  local cloud="" g
+  for g in digitalocean aws; do
+    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
+  done
+  if [ -z "$cloud" ]; then
+    fail "No ground here. There is no database to reach"
+    return 1
+  fi
+
+  local cluster
+  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$ROOT/infra/$cloud/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+
+  # THE MONOREPO NEEDS THIS TOO, and it has no ground. The platform's own checkout is
+  # developed against a managed cluster named only in .env, so a ground-only lookup found
+  # nothing and the one place the developer actually types `npm run dev` was the one place
+  # this could not help. A cluster host is `<name>-do-user-...`, so the name is right there
+  # in DATABASE_URL.
+  if [ -z "$cluster" ]; then
+    cluster=$(grep -E '^DATABASE_URL=' "$ROOT/.env" 2>/dev/null | head -1 \
+      | sed -E 's|.*@([a-z0-9-]+)-do-user-[^.]*\..*|\1|; t; d')
+  fi
+
+  if [ -z "$cluster" ]; then
+    ok "This database has no trusted-source list to join"
+    info "Nothing to do — you can already reach it"
+    return 0
+  fi
+
+  _ground_credentials
+  if [ -z "${DIGITALOCEAN_TOKEN:-}" ]; then
+    fail "No DigitalOcean credential. Run ${BOLD}unoverse deploy${NC} once, or ${BOLD}doctl auth init${NC}"
+    return 1
+  fi
+
+  echo ""
+  _operator_db_access "$cloud"
+  echo ""
+  info "Run this again whenever you change network"
+  echo ""
+}
+
 _adopted_db_access() {
   local cloud="$1" dir="$ROOT/infra/$cloud" cluster droplet_id
   local mode="$2"
@@ -143,28 +260,68 @@ _ensure_ground_config() {
     fi
   fi
 
-    # POSTGRES: ASK, DO NOT ASSUME. The ground discovers an existing cluster and writes
-  # it as a COMMENTED line, so the default silently provisions a SECOND database next
-  # to one the account already pays for. A choice with a monthly bill attached is a
-  # question, not a line to notice in a file.
+  # PRODUCTION'S DATABASE IS NOT THE ONE IN .env, AND THE QUESTION MUST SAY SO.
+  #
+  # `.env` holds the DEVELOPMENT database — what `npm run dev` talks to on the laptop. The
+  # deployed universe gets its own, so a developer cannot break production by experimenting
+  # locally. That separation is right and is the default.
+  #
+  # What was wrong was the words. This asked "You already have a database — use it?", where
+  # "it" meant the CLUSTER and "use" meant "create a new database inside it". A developer
+  # who had typed a DATABASE_URL during setup read that as "use the database I gave you",
+  # answered yes, and got an empty one — then could not find their 21 workflows and
+  # reasonably concluded the deploy had lost them. Nothing was lost; the sentence was.
+  #
+  # So: name the cluster, say a NEW database goes in it, and say what happens to the one in
+  # .env. Anyone wanting production to share the development database sets byo_postgres_url
+  # deliberately, which is a different and much louder act.
   if [ "$cloud" = "digitalocean" ] \
-     && grep -q '^#[[:space:]]*existing_pg_cluster_name' "$tfv" 2>/dev/null \
      && ! grep -q '^existing_pg_cluster_name' "$tfv" 2>/dev/null \
      && ! grep -q '^byo_postgres_url' "$tfv" 2>/dev/null; then
-    local found
-    found=$(grep '^#[[:space:]]*existing_pg_cluster_name' "$tfv" | sed -E 's/.*"([^"]+)".*/\1/')
-    if [ -n "$found" ]; then
-      echo ""
-      echo -e "  ${CYAN}${BOLD}You already have a database.${NC} ${DIM}$found${NC}"
-      echo ""
-      pick_option "Use it" "Create a new one   ~\$15/month"
-      if [ "$PICKED" = "0" ]; then
-        node -e 'const fs=require("fs");const[f,c]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");s=s.replace(/^#\s*(existing_pg_cluster_name\s*=.*)$/m,"$1");fs.writeFileSync(f,s)' "$tfv" "$found"
-        ok "Reusing $found"
-      else
-        ok "A new database will be created"
-      fi
+    local found env_db db_name
+    found=$(grep '^#[[:space:]]*existing_pg_cluster_name' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+    env_db=$(grep -E '^DATABASE_URL=' "$ROOT/.env" 2>/dev/null | head -1 | cut -d= -f2-)
+    db_name=$(echo "$env_db" | sed -E 's|.*/([^/?]+)(\?.*)?$|\1|')
+
+    echo ""
+    echo -e "  ${CYAN}${BOLD}Which database should the DEPLOYED universe use?${NC}"
+    echo ""
+    echo -e "  ${DIM}Your .env is your local development database and does not change.${NC}"
+    echo ""
+    local opt_new_db="" opt_share=""
+    [ -n "$found" ] && opt_new_db="Its own new database on ${found}   free"
+    [ -n "$db_name" ] && opt_share="The same one you develop against   ${db_name}"
+
+    # Order is the recommendation. Its own database first: production and development stay
+    # independent, which is what almost everyone wants and what nobody regrets.
+    if [ -n "$opt_new_db" ] && [ -n "$opt_share" ]; then
+      pick_option "$opt_new_db" "$opt_share" "A new cluster of its own   ~\$15/month"
+    elif [ -n "$opt_new_db" ]; then
+      pick_option "$opt_new_db" "A new cluster of its own   ~\$15/month"
+    elif [ -n "$opt_share" ]; then
+      pick_option "$opt_share" "A new cluster of its own   ~\$15/month"
+    else
+      PICKED=99   # nothing to reuse: the ground provisions a cluster, no question worth asking
     fi
+
+    local choice=""
+    case "$PICKED" in
+      0) [ -n "$opt_new_db" ] && choice="own" || choice="share" ;;
+      1) [ -n "$opt_new_db" ] && [ -n "$opt_share" ] && choice="share" || choice="fresh" ;;
+      *) choice="fresh" ;;
+    esac
+
+    case "$choice" in
+      own)
+        node -e 'const fs=require("fs");const[f]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");s=s.replace(/^#\s*(existing_pg_cluster_name\s*=.*)$/m,"$1");fs.writeFileSync(f,s)' "$tfv"
+        ok "Production gets its own database on $found ${DIM}(your development data is untouched)${NC}"
+        ;;
+      share)
+        node -e 'const fs=require("fs");const[f,v]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");s=s.replace(/^#?\s*byo_postgres_url\s*=.*$/m,"byo_postgres_url = "+JSON.stringify(v));fs.writeFileSync(f,s)' "$tfv" "$env_db"
+        ok "Production reads ${BOLD}$db_name${NC} ${DIM}(the same database you develop against — local changes are live)${NC}"
+        ;;
+      *) ok "A new cluster will be created for production" ;;
+    esac
   fi
 
   _tf_fill docr_token     DOCR_TOKEN     "Registry access token (from your Unoverse admin)"

package/operator/lib/help.sh

@@ -24,6 +24,7 @@ cmd_help() {
   echo -e "    ${GREEN}logs${NC}        What is it doing ${DIM}(unoverse logs <service> for one)${NC}"
   echo -e "    ${GREEN}deploy${NC}      Ship it to a server ${DIM}(first run asks which cloud)${NC}"
   echo -e "    ${GREEN}destroy${NC}     Take the deployment down ${DIM}(shows what goes, and what stays)${NC}"
+  echo -e "    ${GREEN}db-allow${NC}    Let this machine reach the database ${DIM}(run it when you change network)${NC}"
   echo ""
   # Owner-only lane. Printed ONLY when publish.sh is present, so a starter kit never
   # advertises a command it does not have (sync-starter.sh deletes that file).

package/operator/lib/start.sh

@@ -52,6 +52,12 @@ pull_missing_images() {
 }
 
 cmd_start() {
+  # NO FIREWALL CHANGE HERE. Starting a dev server briefly did this automatically, so a
+  # laptop that had moved could always reach its database. It also meant every `start` on
+  # café or hotel Wi-Fi silently added THAT network's shared egress address to a production
+  # cluster's trusted sources, where it stayed until the next run. An ACL change is a
+  # deliberate act: `unoverse db-allow`, typed, when you move network.
+
   # Login to registry if DOCR_TOKEN is set
   local docr_token
   docr_token=$(grep "^DOCR_TOKEN=" "$ROOT/.env" 2>/dev/null | cut -d'=' -f2-)

package/operator/operator.sh

@@ -66,6 +66,7 @@ case "${1:-}" in
   dev)       cmd_dev ;;
   ground)    shift; cmd_ground "$@" ;;
   destroy)   cmd_destroy ;;
+  db-allow)  cmd_db_allow ;;
   refresh-images)
     # internal: `unoverse update` runs this after updating the CLI. Pull newer images
     # if the registry has them, and recreate only what is already running — an update

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.87",
+  "version": "0.1.89",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",