Expand GCP infra: accounts + API services, Cloud SQL, Artifact Registry
Architecture: intelligence stays on Legion; only compiled artifacts cross to GCP. Source code and Neuron's knowledge base never leave the system. Artifact Registry: - neuron-marketing, neuron-accounts, neuron-api repos in us-central1 - Keep-last-10 cleanup policy; ci-pusher SA with writer access - Legion CI runners authenticate via GCP_SA_KEY Gitea secret Cloud SQL (cloud-sql.tf): - postgres-15 on db-g1-small, us-central1 (scale up to REGIONAL HA at 1k users) - Point-in-time recovery, 14-day backup retention - Accounts DB + user; password generated and stored in Secret Manager - JWT signing key in Secret Manager (shared by accounts + api) - Cloud Run connects via built-in Auth Proxy (Unix socket volume mount) Accounts Cloud Run (cloud-run-accounts.tf): - 3 regions (us-central1, europe-west1, asia-northeast1), min:1 max:50 - Cloud SQL proxy volume mount; secrets via Secret Manager - Stripe + JWT env vars; health probe on /health API Cloud Run (cloud-run-api.tf): - 3 regions, min:1 max:100, cpu_idle=false (always-hot) - Validates JWTs from accounts service; no direct DB connection - License admin token from Secret Manager Load balancer (host-based routing): - Same global anycast IP for all three services - URL map routes by Host: neurontechnologies.ai→marketing, api.neurontechnologies.ai→api, accounts.neurontechnologies.ai→accounts - New managed SSL certs for api.* and accounts.* added to HTTPS proxy - Cloud Armor (WAF + rate limit) applied to all backends Service accounts + IAM: - neuron-accounts-sa: secretmanager.secretAccessor + cloudsql.client - neuron-api-sa: secretmanager.secretAccessor - allUsers invoker on all prod Cloud Run services (LB health checks) bootstrap.sh: - One-shot setup: pulls Stripe secrets from Vault → Secret Manager, creates CI SA JSON key, prints DNS + next-step instructions
This commit is contained in:
Will Anderson
@@ -0,0 +1,330 @@
|
||||
# ── Accounts Service — Cloud Run ──────────────────────────────────────────────
|
||||
# Handles auth, billing, subscriptions, marketplace.
|
||||
# Connects to Cloud SQL via built-in Auth Proxy (Unix socket volume mount).
|
||||
# Deployed in 3 regions for global latency; all regions share the same
|
||||
# Cloud SQL instance (us-central1). Auth lookups are fast — cross-region
|
||||
# latency acceptable until read replicas are warranted.
|
||||
|
||||
locals {
|
||||
accounts_labels = {
|
||||
"managed-by" = "terraform"
|
||||
"service" = "neuron-accounts"
|
||||
}
|
||||
sql_instance = google_sql_database_instance.main.connection_name
|
||||
}
|
||||
|
||||
# ── Prod — us-central1 ────────────────────────────────────────────────────────
|
||||
|
||||
resource "google_cloud_run_v2_service" "accounts_us" {
|
||||
name = "accounts-prod-us"
|
||||
location = "us-central1"
|
||||
project = var.project_id
|
||||
ingress = "INGRESS_TRAFFIC_ALL"
|
||||
labels = local.accounts_labels
|
||||
|
||||
template {
|
||||
service_account = google_service_account.accounts.email
|
||||
|
||||
scaling {
|
||||
min_instance_count = 1
|
||||
max_instance_count = 50
|
||||
}
|
||||
|
||||
containers {
|
||||
image = local.accounts_image
|
||||
|
||||
resources {
|
||||
limits = {
|
||||
cpu = "1"
|
||||
memory = "512Mi"
|
||||
}
|
||||
cpu_idle = true # accounts is bursty; don't pay for idle CPU
|
||||
}
|
||||
|
||||
env {
|
||||
name = "ENV"
|
||||
value = "production"
|
||||
}
|
||||
env {
|
||||
name = "PORT"
|
||||
value = "8080"
|
||||
}
|
||||
|
||||
# Database URL via Secret Manager (uses /cloudsql/ socket path)
|
||||
env {
|
||||
name = "ACCOUNTS_DATABASE_URL"
|
||||
value_source {
|
||||
secret_key_ref {
|
||||
secret = google_secret_manager_secret.accounts_database_url.secret_id
|
||||
version = "latest"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# JWT signing key (shared with API service)
|
||||
env {
|
||||
name = "JWT_SECRET"
|
||||
value_source {
|
||||
secret_key_ref {
|
||||
secret = google_secret_manager_secret.jwt_secret.secret_id
|
||||
version = "latest"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Stripe secrets (accounts handles purchase webhooks + subscription management)
|
||||
env {
|
||||
name = "STRIPE_SECRET_KEY"
|
||||
value_source {
|
||||
secret_key_ref {
|
||||
secret = "stripe-secret-key"
|
||||
version = "latest"
|
||||
}
|
||||
}
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_WEBHOOK_SECRET"
|
||||
value_source {
|
||||
secret_key_ref {
|
||||
secret = "stripe-webhook-secret"
|
||||
version = "latest"
|
||||
}
|
||||
}
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_PRICE_PROFESSIONAL"
|
||||
value_source {
|
||||
secret_key_ref {
|
||||
secret = "stripe-price-professional"
|
||||
version = "latest"
|
||||
}
|
||||
}
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_PRICE_FOUNDING"
|
||||
value_source {
|
||||
secret_key_ref {
|
||||
secret = "stripe-price-founding"
|
||||
version = "latest"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
ports {
|
||||
container_port = 8080
|
||||
name = "http1"
|
||||
}
|
||||
|
||||
startup_probe {
|
||||
http_get {
|
||||
path = "/health"
|
||||
port = 8080
|
||||
}
|
||||
initial_delay_seconds = 2
|
||||
timeout_seconds = 5
|
||||
period_seconds = 5
|
||||
failure_threshold = 10
|
||||
}
|
||||
|
||||
liveness_probe {
|
||||
http_get {
|
||||
path = "/health"
|
||||
port = 8080
|
||||
}
|
||||
timeout_seconds = 5
|
||||
period_seconds = 30
|
||||
failure_threshold = 3
|
||||
}
|
||||
|
||||
# Cloud SQL Auth Proxy socket mount
|
||||
volume_mounts {
|
||||
name = "cloudsql"
|
||||
mount_path = "/cloudsql"
|
||||
}
|
||||
}
|
||||
|
||||
volumes {
|
||||
name = "cloudsql"
|
||||
cloud_sql_instance {
|
||||
instances = [local.sql_instance]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
traffic {
|
||||
type = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
|
||||
percent = 100
|
||||
}
|
||||
|
||||
depends_on = [
|
||||
google_project_iam_member.accounts_secret_accessor,
|
||||
google_project_iam_member.accounts_sql_client,
|
||||
google_secret_manager_secret_version.accounts_database_url,
|
||||
google_secret_manager_secret_version.jwt_secret,
|
||||
]
|
||||
}
|
||||
|
||||
# ── Prod — europe-west1 ───────────────────────────────────────────────────────
|
||||
|
||||
resource "google_cloud_run_v2_service" "accounts_eu" {
|
||||
name = "accounts-prod-eu"
|
||||
location = "europe-west1"
|
||||
project = var.project_id
|
||||
ingress = "INGRESS_TRAFFIC_ALL"
|
||||
labels = local.accounts_labels
|
||||
|
||||
template {
|
||||
service_account = google_service_account.accounts.email
|
||||
|
||||
scaling {
|
||||
min_instance_count = 1
|
||||
max_instance_count = 50
|
||||
}
|
||||
|
||||
containers {
|
||||
image = local.accounts_image
|
||||
|
||||
resources {
|
||||
limits = {
|
||||
cpu = "1"
|
||||
memory = "512Mi"
|
||||
}
|
||||
cpu_idle = true
|
||||
}
|
||||
|
||||
env { name = "ENV"; value = "production" }
|
||||
env { name = "PORT"; value = "8080" }
|
||||
|
||||
env {
|
||||
name = "ACCOUNTS_DATABASE_URL"
|
||||
value_source { secret_key_ref { secret = google_secret_manager_secret.accounts_database_url.secret_id; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "JWT_SECRET"
|
||||
value_source { secret_key_ref { secret = google_secret_manager_secret.jwt_secret.secret_id; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_SECRET_KEY"
|
||||
value_source { secret_key_ref { secret = "stripe-secret-key"; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_WEBHOOK_SECRET"
|
||||
value_source { secret_key_ref { secret = "stripe-webhook-secret"; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_PRICE_PROFESSIONAL"
|
||||
value_source { secret_key_ref { secret = "stripe-price-professional"; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_PRICE_FOUNDING"
|
||||
value_source { secret_key_ref { secret = "stripe-price-founding"; version = "latest" } }
|
||||
}
|
||||
|
||||
ports { container_port = 8080; name = "http1" }
|
||||
|
||||
startup_probe {
|
||||
http_get { path = "/health"; port = 8080 }
|
||||
initial_delay_seconds = 2; timeout_seconds = 5; period_seconds = 5; failure_threshold = 10
|
||||
}
|
||||
liveness_probe {
|
||||
http_get { path = "/health"; port = 8080 }
|
||||
timeout_seconds = 5; period_seconds = 30; failure_threshold = 3
|
||||
}
|
||||
|
||||
volume_mounts { name = "cloudsql"; mount_path = "/cloudsql" }
|
||||
}
|
||||
|
||||
volumes {
|
||||
name = "cloudsql"
|
||||
cloud_sql_instance { instances = [local.sql_instance] }
|
||||
}
|
||||
}
|
||||
|
||||
traffic { type = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"; percent = 100 }
|
||||
|
||||
depends_on = [
|
||||
google_project_iam_member.accounts_secret_accessor,
|
||||
google_project_iam_member.accounts_sql_client,
|
||||
]
|
||||
}
|
||||
|
||||
# ── Prod — asia-northeast1 ────────────────────────────────────────────────────
|
||||
|
||||
resource "google_cloud_run_v2_service" "accounts_apac" {
|
||||
name = "accounts-prod-apac"
|
||||
location = "asia-northeast1"
|
||||
project = var.project_id
|
||||
ingress = "INGRESS_TRAFFIC_ALL"
|
||||
labels = local.accounts_labels
|
||||
|
||||
template {
|
||||
service_account = google_service_account.accounts.email
|
||||
|
||||
scaling {
|
||||
min_instance_count = 1
|
||||
max_instance_count = 50
|
||||
}
|
||||
|
||||
containers {
|
||||
image = local.accounts_image
|
||||
|
||||
resources {
|
||||
limits = { cpu = "1"; memory = "512Mi" }
|
||||
cpu_idle = true
|
||||
}
|
||||
|
||||
env { name = "ENV"; value = "production" }
|
||||
env { name = "PORT"; value = "8080" }
|
||||
|
||||
env {
|
||||
name = "ACCOUNTS_DATABASE_URL"
|
||||
value_source { secret_key_ref { secret = google_secret_manager_secret.accounts_database_url.secret_id; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "JWT_SECRET"
|
||||
value_source { secret_key_ref { secret = google_secret_manager_secret.jwt_secret.secret_id; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_SECRET_KEY"
|
||||
value_source { secret_key_ref { secret = "stripe-secret-key"; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_WEBHOOK_SECRET"
|
||||
value_source { secret_key_ref { secret = "stripe-webhook-secret"; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_PRICE_PROFESSIONAL"
|
||||
value_source { secret_key_ref { secret = "stripe-price-professional"; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "STRIPE_PRICE_FOUNDING"
|
||||
value_source { secret_key_ref { secret = "stripe-price-founding"; version = "latest" } }
|
||||
}
|
||||
|
||||
ports { container_port = 8080; name = "http1" }
|
||||
|
||||
startup_probe {
|
||||
http_get { path = "/health"; port = 8080 }
|
||||
initial_delay_seconds = 2; timeout_seconds = 5; period_seconds = 5; failure_threshold = 10
|
||||
}
|
||||
liveness_probe {
|
||||
http_get { path = "/health"; port = 8080 }
|
||||
timeout_seconds = 5; period_seconds = 30; failure_threshold = 3
|
||||
}
|
||||
|
||||
volume_mounts { name = "cloudsql"; mount_path = "/cloudsql" }
|
||||
}
|
||||
|
||||
volumes {
|
||||
name = "cloudsql"
|
||||
cloud_sql_instance { instances = [local.sql_instance] }
|
||||
}
|
||||
}
|
||||
|
||||
traffic { type = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"; percent = 100 }
|
||||
|
||||
depends_on = [
|
||||
google_project_iam_member.accounts_secret_accessor,
|
||||
google_project_iam_member.accounts_sql_client,
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user