feat(cluster-server): add durable PostgreSQL public gateway ledger

.github/workflows/ci.yml

@@ -57,6 +57,46 @@ jobs:
           [[ "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]
           git diff --name-only -z "$BASE_SHA...$HEAD_SHA" | node scripts/ci-paths.mjs >> "$GITHUB_OUTPUT"
 
+  t4-api-generation:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Check out exact source
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Install pinned pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.10.0
+
+      - name: Install pinned Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24.13.1
+
+      - name: Install dependencies from the committed lockfile
+        run: pnpm install --frozen-lockfile
+
+      - name: Validate OpenAPI and deterministic generation
+        run: |
+          pnpm --filter @t4-code/t4-api-contract validate
+          pnpm --filter @t4-code/t4-api-contract generate:ci
+          pnpm --filter @t4-code/t4-api-contract check:generated
+          pnpm --filter @t4-code/t4-api-client typecheck
+          pnpm --filter @t4-code/client typecheck
+          pnpm --filter @t4-code/client exec vp test run test/t4-api-v1-conformance.test.ts
+      - name: Upload deterministic T4 API client
+        if: ${{ always() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: t4-api-generated-${{ github.run_id }}
+          path: artifacts/t4-api/generated/schema.ts
+          if-no-files-found: error
+
+
+
   core:
     runs-on: ubuntu-24.04
     timeout-minutes: 25
@@ -237,6 +277,23 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.cluster == 'true' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 25
+    services:
+      postgres:
+        image: postgres:17.6-bookworm@sha256:f3bd19c606e442c3d7bdfa8002e03fe260a1023351e0ea4598032022b68dd6e3
+        env:
+          POSTGRES_DB: t4_test
+          POSTGRES_USER: t4_test
+          POSTGRES_PASSWORD: t4_test_password
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U t4_test -d t4_test"
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 15
+    env:
+      T4_TEST_POSTGRES_URL: postgres://t4_test:t4_test_password@127.0.0.1:5432/t4_test
+
     steps:
       - name: Check out source
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -294,6 +351,8 @@ jobs:
 
       - name: Run operator tests
         working-directory: packages/cluster-operator
+        env:
+          GOFLAGS: -mod=readonly
         run: go test ./...
 
       - name: Lint cluster chart
@@ -521,14 +580,15 @@ jobs:
   verify:
     name: verify
     if: ${{ always() }}
-    needs: [changes, core, legacy-bridge-continuity, official-omp-gate0, cluster, tooling, android-debug, flutter, flutter-android, flutter-apple]
+    needs: [changes, t4-api-generation, core, legacy-bridge-continuity, official-omp-gate0, cluster, tooling, android-debug, flutter, flutter-android, flutter-apple]
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - name: Require every selected CI leg
         shell: bash
         env:
           CHANGES_RESULT: ${{ needs.changes.result }}
+          T4_API_GENERATION_RESULT: ${{ needs.t4-api-generation.result }}
           CORE_RESULT: ${{ needs.core.result }}
           CONTINUITY_RESULT: ${{ needs.legacy-bridge-continuity.result }}
           OFFICIAL_OMP_GATE0_RESULT: ${{ needs.official-omp-gate0.result }}
@@ -541,6 +601,7 @@ jobs:
         run: |
           set -euo pipefail
           test "$CHANGES_RESULT" = success
+          test "$T4_API_GENERATION_RESULT" = success
           test "$CORE_RESULT" = success
           for result in \
             "$CONTINUITY_RESULT" \

.woodpecker.yml

@@ -11,6 +11,14 @@ clone:
       depth: 50
       partial: false
 
+services:
+  - name: postgres
+    image: mirror.gcr.io/library/postgres:17.6-bookworm@sha256:f3bd19c606e442c3d7bdfa8002e03fe260a1023351e0ea4598032022b68dd6e3
+    environment:
+      POSTGRES_DB: t4_test
+      POSTGRES_USER: t4_test
+      POSTGRES_PASSWORD: t4_test_password
+
 steps:
   dependencies:
     image: mirror.gcr.io/library/node:24.13.1-bookworm@sha256:00e9195ebd49985a6da8921f419978d85dfe354589755192dc090425ce4da2f7
@@ -31,6 +39,32 @@ steps:
             memory: 2Gi
             ephemeral-storage: 4Gi
 
+  t4-api-contract:
+    depends_on: [dependencies]
+    image: mirror.gcr.io/library/node:24.13.1-bookworm@sha256:00e9195ebd49985a6da8921f419978d85dfe354589755192dc090425ce4da2f7
+    commands:
+      - corepack enable
+      - pnpm --filter @t4-code/t4-api-contract validate
+      - pnpm --filter @t4-code/t4-api-contract generate:ci
+      - test -f artifacts/t4-api/generated/schema.ts
+      - echo "T4_API_GENERATED_ARTIFACT=artifacts/t4-api/generated/schema.ts"
+      - pnpm --filter @t4-code/t4-api-contract check:generated
+      - pnpm --filter @t4-code/t4-api-client typecheck
+      - pnpm --filter @t4-code/client typecheck
+      - pnpm --filter @t4-code/client exec vp test run test/t4-api-v1-conformance.test.ts
+    backend_options:
+      kubernetes:
+        serviceAccountName: woodpecker-ci-untrusted
+        resources:
+          requests:
+            cpu: "0"
+            memory: 256Mi
+            ephemeral-storage: 256Mi
+          limits:
+            cpu: "1"
+            memory: 2Gi
+            ephemeral-storage: 2Gi
+
   bun-runtime:
     depends_on: [dependencies]
     image: mirror.gcr.io/oven/bun:1.3.14@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4
@@ -50,7 +84,7 @@ steps:
             ephemeral-storage: 256Mi
 
   upstream-core:
-    depends_on: [cluster-ci-contracts, bun-runtime]
+    depends_on: [cluster-ci-contracts, t4-api-contract, bun-runtime]
     image: mirror.gcr.io/library/node:24.13.1-bookworm@sha256:00e9195ebd49985a6da8921f419978d85dfe354589755192dc090425ce4da2f7
     commands:
       - export PATH="$PWD/.ci:$PATH"
@@ -204,6 +238,7 @@ steps:
     image: mirror.gcr.io/oven/bun:1.3.14@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4
     environment:
       T4_PROOF_OUTPUT_DIR: artifacts/cluster-proof/scenarios
+      T4_TEST_POSTGRES_URL: postgres://t4_test:t4_test_password@postgres:5432/t4_test
     commands:
       - export SSL_CERT_FILE="$PWD/.ci/ca-certificates.crt"
       - export NODE_EXTRA_CA_CERTS="$SSL_CERT_FILE"
@@ -250,9 +285,9 @@ steps:
     image: mirror.gcr.io/library/golang:1.25.1-bookworm@sha256:c423747fbd96fd8f0b1102d947f51f9b266060217478e5f9bf86f145969562ee
     directory: packages/cluster-operator
     commands:
-      - GOMAXPROCS=1 GOFLAGS=-p=1 go test ./api/... ./controllers/... ./cmd/...
+      - GOMAXPROCS=1 GOFLAGS='-mod=readonly -p=1' go test ./api/... ./controllers/... ./cmd/...
       - mkdir -p ../../artifacts/cluster-proof
-      - CGO_ENABLED=0 GOMAXPROCS=1 GOFLAGS=-p=1 go test -c ./charttests -o ../../artifacts/cluster-proof/chart-contract.test
+      - CGO_ENABLED=0 GOMAXPROCS=1 GOFLAGS='-mod=readonly -p=1' go test -c ./charttests -o ../../artifacts/cluster-proof/chart-contract.test
     backend_options:
       kubernetes:
         serviceAccountName: woodpecker-ci-untrusted

deploy/charts/t4-cluster/templates/_helpers.tpl

@@ -33,3 +33,28 @@ app.kubernetes.io/instance: {{ .Release.Name | quote }}
 {{- define "t4-cluster.image" -}}
 {{- printf "%s@%s" .repository .digest -}}
 {{- end -}}
+
+{{- define "t4-cluster.validatePublicApi" -}}
+{{- if .Values.publicApi.enabled -}}
+{{- $existingSecret := required "publicApi.existingSecret is required when publicApi.enabled is true" .Values.publicApi.existingSecret -}}
+{{- $postgresURLKey := required "publicApi.postgresURLKey is required when publicApi.enabled is true" .Values.publicApi.postgresURLKey -}}
+{{- $credentialsKey := required "publicApi.credentialsKey is required when publicApi.enabled is true" .Values.publicApi.credentialsKey -}}
+{{- if eq $postgresURLKey $credentialsKey -}}
+{{- fail "publicApi.postgresURLKey and publicApi.credentialsKey must be different" -}}
+{{- end -}}
+{{- if not .Values.networkPolicy.enabled -}}
+{{- fail "networkPolicy.enabled must be true when publicApi.enabled is true" -}}
+{{- end -}}
+{{- if empty .Values.networkPolicy.postgresPorts -}}
+{{- fail "networkPolicy.postgresPorts must contain at least one port when publicApi.enabled is true" -}}
+{{- end -}}
+{{- $hasPostgresNamespaceSelector := not (empty .Values.networkPolicy.postgres.namespaceSelector) -}}
+{{- $hasPostgresPodSelector := not (empty .Values.networkPolicy.postgres.podSelector) -}}
+{{- if ne $hasPostgresNamespaceSelector $hasPostgresPodSelector -}}
+{{- fail "networkPolicy.postgres namespaceSelector and podSelector must both be configured or both be empty" -}}
+{{- end -}}
+{{- if and (empty .Values.networkPolicy.postgresCIDRs) (not $hasPostgresNamespaceSelector) -}}
+{{- fail "publicApi.enabled requires a PostgreSQL CIDR or complete selector destination" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

deploy/charts/t4-cluster/templates/deployments.yaml

@@ -1,4 +1,5 @@
 {{- if .Values.enabled }}
+{{- include "t4-cluster.validatePublicApi" . -}}
 {{- if eq .Values.session.omp.modelsKey .Values.session.omp.settingsKey }}
 {{- fail "session.omp.modelsKey and session.omp.settingsKey must be different" }}
 {{- end }}
@@ -258,6 +259,14 @@ spec:
               valueFrom: {fieldRef: {fieldPath: metadata.name}}
             - name: POD_UID
               valueFrom: {fieldRef: {fieldPath: metadata.uid}}
+            {{- if .Values.publicApi.enabled }}
+            - name: T4_POSTGRES_URL_FILE
+              value: /var/run/secrets/t4-public-api/postgres-url
+            - name: T4_PUBLIC_API_CREDENTIALS_FILE
+              value: /var/run/secrets/t4-public-api/credentials.json
+            - name: T4_PUBLIC_API_RUNTIME_PROFILE
+              value: {{ first .Values.clusterHost.runtimeProfiles | quote }}
+            {{- end }}
             {{- if .Values.woodpecker.existingSecret }}
             - name: T4_WOODPECKER_TOKEN
               valueFrom:
@@ -324,6 +333,11 @@ spec:
             - name: kubernetes-api-access
               mountPath: /var/run/secrets/kubernetes.io/serviceaccount
               readOnly: true
+            {{- if .Values.publicApi.enabled }}
+            - name: public-api
+              mountPath: /var/run/secrets/t4-public-api
+              readOnly: true
+            {{- end }}
             {{- if .Values.woodpecker.serviceAccountAudience }}
             - name: ci-identity
               mountPath: /var/run/secrets/t4-ci
@@ -351,6 +365,17 @@ spec:
                   items:
                     - key: ca.crt
                       path: ca.crt
+        {{- if .Values.publicApi.enabled }}
+        - name: public-api
+          secret:
+            secretName: {{ .Values.publicApi.existingSecret | quote }}
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.publicApi.postgresURLKey | quote }}
+                path: postgres-url
+              - key: {{ .Values.publicApi.credentialsKey | quote }}
+                path: credentials.json
+        {{- end }}
         {{- if .Values.woodpecker.serviceAccountAudience }}
         - name: ci-identity
           projected:

deploy/charts/t4-cluster/templates/networkpolicies.yaml

@@ -1,4 +1,6 @@
-{{- if and .Values.enabled .Values.networkPolicy.enabled }}
+{{- if .Values.enabled }}
+{{- include "t4-cluster.validatePublicApi" . -}}
+{{- if .Values.networkPolicy.enabled }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -101,6 +103,27 @@ spec:
         {{- end }}
     {{- end }}
     {{- end }}
+    {{- if and .Values.publicApi.enabled .Values.networkPolicy.postgresPorts }}
+    {{- range .Values.networkPolicy.postgresCIDRs }}
+    - to:
+        - ipBlock: {cidr: {{ . | quote }}}
+      ports:
+        {{- range $.Values.networkPolicy.postgresPorts }}
+        - {protocol: TCP, port: {{ . }}}
+        {{- end }}
+    {{- end }}
+    {{- if and (not (empty .Values.networkPolicy.postgres.namespaceSelector)) (not (empty .Values.networkPolicy.postgres.podSelector)) }}
+    - to:
+        - namespaceSelector:
+            {{- toYaml .Values.networkPolicy.postgres.namespaceSelector | nindent 12 }}
+          podSelector:
+            {{- toYaml .Values.networkPolicy.postgres.podSelector | nindent 12 }}
+      ports:
+        {{- range .Values.networkPolicy.postgresPorts }}
+        - {protocol: TCP, port: {{ . }}}
+        {{- end }}
+    {{- end }}
+    {{- end }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -205,3 +228,4 @@ spec:
   ingress: []
   {{- end }}
 {{- end }}
+{{- end }}

deploy/charts/t4-cluster/templates/rbac.yaml

@@ -41,7 +41,7 @@ rules:
     verbs: [get, list, watch]
   - apiGroups: [cluster.t4.dev]
     resources: [t4workspaces, t4sessions]
-    verbs: [get, list, watch, create, delete]
+    verbs: [get, list, watch, create, patch, delete]
   - apiGroups: ['']
     resources: [pods, services, endpoints]
     verbs: [get, list, watch]

deploy/charts/t4-cluster/values.schema.json

@@ -10,6 +10,7 @@
     "server",
     "session",
     "storage",
+    "publicApi",
     "woodpecker",
     "ingress",
     "networkPolicy",
@@ -129,6 +130,17 @@
         }
       }
     },
+    "publicApi": {
+      "type": "object",
+      "required": ["enabled", "existingSecret", "postgresURLKey", "credentialsKey"],
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "existingSecret": { "$ref": "#/definitions/optionalDNSSubdomain" },
+        "postgresURLKey": { "$ref": "#/definitions/configKey" },
+        "credentialsKey": { "$ref": "#/definitions/configKey" }
+      },
+      "additionalProperties": false
+    },
     "woodpecker": {
       "type": "object",
       "required": ["existingSecret", "tokenKey", "configMap", "baseURLKey", "webBaseURLKey", "repositoriesKey", "serviceAccountAudience", "tokenExpirationSeconds"],
@@ -172,7 +184,7 @@
     },
     "networkPolicy": {
       "type": "object",
-      "required": ["enabled", "kubernetesApiCIDRs", "modelRouteCIDRs", "modelRoutePorts", "modelRoute", "ciProviderCIDRs", "ciProviderPorts", "ciProvider", "dns", "gatewayIngress", "observability"],
+      "required": ["enabled", "kubernetesApiCIDRs", "modelRouteCIDRs", "modelRoutePorts", "modelRoute", "ciProviderCIDRs", "ciProviderPorts", "ciProvider", "postgresCIDRs", "postgresPorts", "postgres", "dns", "gatewayIngress", "observability"],
       "properties": {
         "enabled": { "type": "boolean" },
         "kubernetesApiCIDRs": { "$ref": "#/definitions/cidrList" },
@@ -182,6 +194,9 @@
         "ciProviderCIDRs": { "$ref": "#/definitions/cidrList" },
         "ciProviderPorts": { "$ref": "#/definitions/tcpPortList" },
         "ciProvider": { "$ref": "#/definitions/pairedSelectors" },
+        "postgresCIDRs": { "$ref": "#/definitions/cidrList" },
+        "postgresPorts": { "$ref": "#/definitions/tcpPortList" },
+        "postgres": { "$ref": "#/definitions/pairedSelectors" },
         "dns": {
           "type": "object",
           "required": ["namespaceSelector", "podSelector"],
@@ -397,6 +412,41 @@
         }
       }
     },
+    {
+      "if": {
+        "properties": {
+          "publicApi": { "properties": { "enabled": { "const": true } } }
+        }
+      },
+      "then": {
+        "properties": {
+          "publicApi": {
+            "properties": {
+              "existingSecret": { "minLength": 1 }
+            }
+          },
+          "networkPolicy": {
+            "properties": {
+              "enabled": { "const": true },
+              "postgresPorts": { "minItems": 1 }
+            },
+            "anyOf": [
+              { "properties": { "postgresCIDRs": { "minItems": 1 } } },
+              {
+                "properties": {
+                  "postgres": {
+                    "properties": {
+                      "namespaceSelector": { "minProperties": 1 },
+                      "podSelector": { "minProperties": 1 }
+                    }
+                  }
+                }
+              }
+            ]
+          }
+        }
+      }
+    },
     {
       "if": { "properties": { "ingress": { "properties": { "enabled": { "const": true } } } } },
       "then": {