will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix TF drift: add DOCUSEAL_WEBHOOK_TOKEN and TOGETHER_API_KEY env vars

Browse Source 
DOCUSEAL_WEBHOOK_TOKEN was present on all live marketing services but
missing from cloud-run.tf and cloud-run-stage.tf — next apply would
have stripped it and broken DocuSeal webhook validation.

TOGETHER_API_KEY (soma-together-api-key) was present on soma-prod-us
but missing from cloud-run-soma.tf — next apply would have broken the
Together.ai inference routing path.
This commit is contained in:
Will Anderson
2026-05-04 09:44:46 -05:00
parent d0a6ca753c
commit 7e092d4686
3 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/gcp/cloud-run-soma.tf
+27
View File
@@ -167,6 +167,20 @@ resource "google_secret_manager_secret_version" "soma_anthropic_api_key" {
secret_data = "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"
}
# ── Together.ai backend — cord-cut inference path ─────────────────────────────
# When TOGETHER_API_KEY is set, soma can route chat completions to Together's
# inference API as an alternative to the Anthropic backend.
# Secret value is populated out-of-band (contains live API key).
resource "google_secret_manager_secret" "soma_together_api_key" {
secret_id = "soma-together-api-key"
project = var.project_id
replication {
auto {}
}
}
# ── Cloud Run Service — us-central1 ──────────────────────────────────────────
resource "google_cloud_run_v2_service" "soma_us" {
@@ -287,6 +301,18 @@ resource "google_cloud_run_v2_service" "soma_us" {
value = "claude-sonnet-4-5"
}
env {
# Together.ai API key — cord-cut inference path. When set, soma can
# route chat completions to Together's API as an Anthropic alternative.
name = "TOGETHER_API_KEY"
value_source {
secret_key_ref {
secret = google_secret_manager_secret.soma_together_api_key.secret_id
version = "latest"
}
}
}
# ── Stripe billing ────────────────────────────────────────────────────────
env {
@@ -463,6 +489,7 @@ resource "google_cloud_run_v2_service" "soma_us" {
google_secret_manager_secret_version.soma_node_secret,
google_secret_manager_secret_version.soma_key_secret,
google_secret_manager_secret_version.soma_anthropic_api_key,
google_secret_manager_secret.soma_together_api_key,
# Stripe billing secrets — must exist before Cloud Run deploy.
# Versions are populated by provision_stripe_billing.py.
google_secret_manager_secret.stripe_secret_key,
servers/gcp/cloud-run-stage.tf
+9
View File
@@ -141,6 +141,15 @@ resource "google_cloud_run_v2_service" "stage_us" {
}
}
}
env {
name = "DOCUSEAL_WEBHOOK_TOKEN"
value_source {
secret_key_ref {
secret = "docuseal-webhook-token"
version = "latest"
}
}
}
ports {
container_port = 8080
servers/gcp/cloud-run.tf
+27
View File
@@ -158,6 +158,15 @@ resource "google_cloud_run_v2_service" "prod_us" {
}
}
}
env {
name = "DOCUSEAL_WEBHOOK_TOKEN"
value_source {
secret_key_ref {
secret = "docuseal-webhook-token"
version = "latest"
}
}
}
ports {
container_port = 8080
@@ -341,6 +350,15 @@ resource "google_cloud_run_v2_service" "prod_eu" {
}
}
}
env {
name = "DOCUSEAL_WEBHOOK_TOKEN"
value_source {
secret_key_ref {
secret = "docuseal-webhook-token"
version = "latest"
}
}
}
ports {
container_port = 8080
@@ -524,6 +542,15 @@ resource "google_cloud_run_v2_service" "prod_apac" {
}
}
}
env {
name = "DOCUSEAL_WEBHOOK_TOKEN"
value_source {
secret_key_ref {
secret = "docuseal-webhook-token"
version = "latest"
}
}
}
ports {
container_port = 8080