ops: scale down all non-critical services — dedicate resources to Neuron

Scaled to replicas: 0: fornax (coordinator/ui/workers), jellyfin via media, overseerr, plex, radarr, sonarr, bazarr, prowlarr, flaresolverr, ollama, harmonic-wordpress, docuseal, listmonk, memos, plane, redpanda, wp-coordinator
2026-04-24 20:07:41 -05:00
parent 6160e8e6b8
commit 91bfc42989
31 changed files with 1022 additions and 27 deletions
@@ -0,0 +1,54 @@
+# ── Service Account ───────────────────────────────────────────────────────────
+
+resource "google_service_account" "marketing" {
+  account_id   = "neuron-marketing-sa"
+  display_name = "Neuron Marketing Cloud Run SA"
+  description  = "Service account for the neurontechnologies.ai marketing site on Cloud Run"
+}
+
+# ── IAM — Secret Manager accessor ─────────────────────────────────────────────
+# Grant the SA access to read all marketing secrets from Secret Manager.
+
+resource "google_project_iam_member" "marketing_secret_accessor" {
+  project = var.project_id
+  role    = "roles/secretmanager.secretAccessor"
+  member  = "serviceAccount:${google_service_account.marketing.email}"
+}
+
+# ── IAM — Public (unauthenticated) invocation for prod services ───────────────
+# Cloud Run v2: allow-unauthenticated is set per-service via google_cloud_run_v2_service_iam_member.
+
+resource "google_cloud_run_v2_service_iam_member" "prod_us_public" {
+  project  = var.project_id
+  location = "us-central1"
+  name     = google_cloud_run_v2_service.prod_us.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
+
+resource "google_cloud_run_v2_service_iam_member" "prod_eu_public" {
+  project  = var.project_id
+  location = "europe-west1"
+  name     = google_cloud_run_v2_service.prod_eu.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
+
+resource "google_cloud_run_v2_service_iam_member" "prod_apac_public" {
+  project  = var.project_id
+  location = "asia-northeast1"
+  name     = google_cloud_run_v2_service.prod_apac.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
+
+resource "google_cloud_run_v2_service_iam_member" "stage_public" {
+  project  = var.project_id
+  location = "us-central1"
+  name     = google_cloud_run_v2_service.stage.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+
+  # Note: Cloudflare Access enforces authentication in front of stage.
+  # Cloud Run itself allows allUsers so the LB health checks pass.
+}