will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove stage environment from GCP — staging is local only

Browse Source
This commit is contained in:
Will Anderson
2026-04-26 01:09:44 -05:00
parent 74dd054a36
commit 5b16aebdcb
4 changed files with 0 additions and 235 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/gcp/cloud-run.tf
-108
View File
@@ -357,111 +357,3 @@ resource "google_cloud_run_v2_service" "prod_apac" {
depends_on = [google_project_iam_member.marketing_secret_accessor]
}
# ── Stage — us-central1 ───────────────────────────────────────────────────────
# min_instances=0 to save cost on staging.
# Cloudflare Access handles auth in front; Cloud Run itself is open so the LB
# health checks pass without credentials.
resource "google_cloud_run_v2_service" "stage" {
name = "marketing-stage"
location = "us-central1"
project = var.project_id
ingress = "INGRESS_TRAFFIC_ALL"
labels = merge(local.run_labels, {
"environment" = "stage"
})
template {
service_account = google_service_account.marketing.email
scaling {
min_instance_count = 0
max_instance_count = 10
}
containers {
image = local.image
resources {
limits = {
cpu = "1"
memory = "512Mi"
}
cpu_idle = true
}
env {
name = "NODE_ENV"
value = "production"
}
env {
name = "NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY"
value = local.stripe_publishable_key
}
env {
name = "STRIPE_SECRET_KEY"
value_source {
secret_key_ref {
secret = "stripe-secret-key"
version = "latest"
}
}
}
env {
name = "STRIPE_WEBHOOK_SECRET"
value_source {
secret_key_ref {
secret = "stripe-webhook-secret"
version = "latest"
}
}
}
env {
name = "STRIPE_PRICE_PROFESSIONAL"
value_source {
secret_key_ref {
secret = "stripe-price-professional"
version = "latest"
}
}
}
env {
name = "STRIPE_PRICE_FOUNDING"
value_source {
secret_key_ref {
secret = "stripe-price-founding"
version = "latest"
}
}
}
ports {
container_port = 3000
name = "http1"
}
startup_probe {
http_get {
path = "/api/health"
port = 3000
}
initial_delay_seconds = 10
timeout_seconds = 5
period_seconds = 10
failure_threshold = 5
}
}
max_instance_request_concurrency = 1000
}
traffic {
type = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
percent = 100
}
depends_on = [google_project_iam_member.marketing_secret_accessor]
}
servers/gcp/load-balancer.tf
-105
View File
@@ -35,17 +35,6 @@ resource "google_compute_region_network_endpoint_group" "prod_apac" {
}
}
resource "google_compute_region_network_endpoint_group" "stage" {
name = "marketing-neg-stage"
network_endpoint_type = "SERVERLESS"
region = "us-central1"
project = var.project_id
cloud_run {
service = google_cloud_run_v2_service.stage.name
}
}
# ── Cloud Armor Security Policy ───────────────────────────────────────────────
# Applied to the backend service. Rules evaluated top-down (lowest priority wins).
@@ -173,30 +162,6 @@ resource "google_compute_backend_service" "prod" {
}
}
# ── Stage Backend Service ─────────────────────────────────────────────────────
resource "google_compute_backend_service" "stage" {
name = "marketing-backend-stage"
project = var.project_id
load_balancing_scheme = "EXTERNAL_MANAGED"
protocol = "HTTPS"
timeout_sec = 30
# Cloud Armor on stage too
security_policy = google_compute_security_policy.marketing.self_link
enable_cdn = false # CDN off for stage — we want fresh responses always
backend {
group = google_compute_region_network_endpoint_group.stage.self_link
}
log_config {
enable = true
sample_rate = 1.0
}
}
# ── SSL Certificates ──────────────────────────────────────────────────────────
# google_compute_managed_ssl_certificate — Google-managed, auto-renewed.
# Provisioning requires DNS A records pointing to the LB IP (chicken-and-egg:
@@ -214,15 +179,6 @@ resource "google_compute_managed_ssl_certificate" "prod" {
}
}
resource "google_compute_managed_ssl_certificate" "stage" {
name = "marketing-cert-stage"
project = var.project_id
managed {
domains = ["stage.neurontechnologies.ai"]
}
}
# ── Prod URL Map — host-based routing ────────────────────────────────────────
# One global IP handles all three services via Host header routing.
# - neurontechnologies.ai / www. → marketing (default)
@@ -324,64 +280,3 @@ resource "google_compute_global_forwarding_rule" "prod_http" {
load_balancing_scheme = "EXTERNAL_MANAGED"
}
# ── Stage URL Map ─────────────────────────────────────────────────────────────
resource "google_compute_url_map" "stage" {
name = "marketing-urlmap-stage"
project = var.project_id
default_service = google_compute_backend_service.stage.self_link
}
# ── Stage HTTPS Target Proxy ──────────────────────────────────────────────────
resource "google_compute_target_https_proxy" "stage" {
name = "marketing-https-proxy-stage"
project = var.project_id
url_map = google_compute_url_map.stage.self_link
ssl_certificates = [google_compute_managed_ssl_certificate.stage.self_link]
}
# ── Stage HTTP → HTTPS redirect ───────────────────────────────────────────────
resource "google_compute_url_map" "stage_http_redirect" {
name = "marketing-urlmap-stage-http-redirect"
project = var.project_id
default_url_redirect {
https_redirect = true
redirect_response_code = "MOVED_PERMANENTLY_DEFAULT"
strip_query = false
}
}
resource "google_compute_target_http_proxy" "stage" {
name = "marketing-http-proxy-stage"
project = var.project_id
url_map = google_compute_url_map.stage_http_redirect.self_link
}
# ── Stage Global Forwarding Rules ─────────────────────────────────────────────
# Separate global IP for stage so DNS is independent.
resource "google_compute_global_address" "stage" {
name = "marketing-ip-stage"
project = var.project_id
}
resource "google_compute_global_forwarding_rule" "stage_https" {
name = "marketing-fwd-stage-https"
project = var.project_id
target = google_compute_target_https_proxy.stage.self_link
ip_address = google_compute_global_address.stage.address
port_range = "443"
load_balancing_scheme = "EXTERNAL_MANAGED"
}
resource "google_compute_global_forwarding_rule" "stage_http" {
name = "marketing-fwd-stage-http"
project = var.project_id
target = google_compute_target_http_proxy.stage.self_link
ip_address = google_compute_global_address.stage.address
port_range = "80"
load_balancing_scheme = "EXTERNAL_MANAGED"
}
servers/gcp/outputs.tf
-13
View File
@@ -7,19 +7,12 @@
# www.neurontechnologies.ai → prod_lb_ip
# api.neurontechnologies.ai → prod_lb_ip
# accounts.neurontechnologies.ai → prod_lb_ip
#
# Stage: stage.neurontechnologies.ai → stage_lb_ip (separate IP)
output "prod_lb_ip" {
description = "Global anycast IP for all prod services (marketing, accounts, api)"
value = google_compute_global_address.prod.address
}
output "stage_lb_ip" {
description = "Global anycast IP for the staging load balancer"
value = google_compute_global_address.stage.address
}
output "prod_ssl_cert_name" {
description = "Marketing SSL cert (check provisioning status in GCP console)"
value = google_compute_managed_ssl_certificate.prod.name
@@ -35,11 +28,6 @@ output "api_ssl_cert_name" {
value = google_compute_managed_ssl_certificate.api.name
}
output "stage_ssl_cert_name" {
description = "Stage SSL cert"
value = google_compute_managed_ssl_certificate.stage.name
}
output "marketing_service_account_email" {
description = "Marketing Cloud Run SA"
value = google_service_account.marketing.email
@@ -76,7 +64,6 @@ output "cloud_run_services" {
marketing_us = google_cloud_run_v2_service.prod_us.uri
marketing_eu = google_cloud_run_v2_service.prod_eu.uri
marketing_apac = google_cloud_run_v2_service.prod_apac.uri
marketing_stage = google_cloud_run_v2_service.stage.uri
accounts_us = google_cloud_run_v2_service.accounts_us.uri
accounts_eu = google_cloud_run_v2_service.accounts_eu.uri
accounts_apac = google_cloud_run_v2_service.accounts_apac.uri
servers/gcp/service-account.tf
-9
View File
@@ -79,15 +79,6 @@ resource "google_cloud_run_v2_service_iam_member" "prod_apac_public" {
member = "allUsers"
}
resource "google_cloud_run_v2_service_iam_member" "stage_public" {
project = var.project_id
location = "us-central1"
name = google_cloud_run_v2_service.stage.name
role = "roles/run.invoker"
member = "allUsers"
# Note: Cloudflare Access enforces auth in front of stage.
}
# Accounts
resource "google_cloud_run_v2_service_iam_member" "accounts_us_public" {
project = var.project_id