Grant soma compute permissions for GCE inference nodes

- Add roles/compute.instanceAdmin.v1 for soma SA (provision/terminate GCE VMs)
- Add roles/iam.serviceAccountUser for soma SA (assign SA to inference VMs)
- Add firewall rule: allow TCP 8000 inbound to soma-inference-node tagged VMs
- Add soma-node-secret to Secret Manager (GCE startup script auth)
- Inject SOMA_NODE_SECRET, GCP_PROJECT_ID, GCP_ZONE, SOMA_PUBLIC_URL into
  the soma Cloud Run service via env vars

servers/gcp/cloud-run-soma.tf

@@ -63,6 +63,36 @@ resource "google_project_iam_member" "soma_secret_accessor" {
   member  = "serviceAccount:${google_service_account.soma.email}"
 }
 
+# soma needs to create/terminate GCE GPU instances for inference
+resource "google_project_iam_member" "soma_compute_admin" {
+  project = var.project_id
+  role    = "roles/compute.instanceAdmin.v1"
+  member  = "serviceAccount:${google_service_account.soma.email}"
+}
+
+# Allow soma to use the default Compute Engine SA for the instances it creates
+resource "google_project_iam_member" "soma_service_account_user" {
+  project = var.project_id
+  role    = "roles/iam.serviceAccountUser"
+  member  = "serviceAccount:${google_service_account.soma.email}"
+}
+
+# Firewall: allow inbound TCP 8000 (vLLM) to inference nodes from anywhere.
+# Tighten later to Cloud Run egress IP ranges.
+resource "google_compute_firewall" "allow_vllm_from_soma" {
+  name    = "allow-vllm-from-soma"
+  project = var.project_id
+  network = "default"
+
+  allow {
+    protocol = "tcp"
+    ports    = ["8000"]
+  }
+
+  source_ranges = ["0.0.0.0/0"]
+  target_tags   = ["soma-inference-node"]
+}
+
 # ── Secrets ───────────────────────────────────────────────────────────────────
 
 resource "google_secret_manager_secret" "soma_hf_token" {
@@ -93,6 +123,21 @@ resource "google_secret_manager_secret_version" "soma_operator_key" {
   secret_data = "svc-will-1ab07c23ab5112aa14378f2941f7cd3f"
 }
 
+resource "google_secret_manager_secret" "soma_node_secret" {
+  secret_id = "soma-node-secret"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret_version" "soma_node_secret" {
+  secret      = google_secret_manager_secret.soma_node_secret.id
+  # 32-char hex secret for GCE startup script authentication
+  secret_data = "a3f8d2e1c4b5a6978f0e3d2c1b4a5978f"
+}
+
 # ── Cloud Run Service — us-central1 ──────────────────────────────────────────
 
 resource "google_cloud_run_v2_service" "soma_us" {
@@ -148,6 +193,31 @@ resource "google_cloud_run_v2_service" "soma_us" {
         }
       }
 
+      env {
+        name = "SOMA_NODE_SECRET"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.soma_node_secret.secret_id
+            version = "latest"
+          }
+        }
+      }
+
+      env {
+        name  = "GCP_PROJECT_ID"
+        value = var.project_id
+      }
+
+      env {
+        name  = "GCP_ZONE"
+        value = "us-central1-a"
+      }
+
+      env {
+        name  = "SOMA_PUBLIC_URL"
+        value = "https://ai.neurontechnologies.ai"
+      }
+
       ports {
         container_port = 8080
         name           = "http1"
@@ -185,8 +255,11 @@ resource "google_cloud_run_v2_service" "soma_us" {
 
   depends_on = [
     google_project_iam_member.soma_secret_accessor,
+    google_project_iam_member.soma_compute_admin,
+    google_project_iam_member.soma_service_account_user,
     google_secret_manager_secret_version.soma_hf_token,
     google_secret_manager_secret_version.soma_operator_key,
+    google_secret_manager_secret_version.soma_node_secret,
   ]
 }