Expand GCP infra: accounts + API services, Cloud SQL, Artifact Registry
Architecture: intelligence stays on Legion; only compiled artifacts cross to GCP. Source code and Neuron's knowledge base never leave the system. Artifact Registry: - neuron-marketing, neuron-accounts, neuron-api repos in us-central1 - Keep-last-10 cleanup policy; ci-pusher SA with writer access - Legion CI runners authenticate via GCP_SA_KEY Gitea secret Cloud SQL (cloud-sql.tf): - postgres-15 on db-g1-small, us-central1 (scale up to REGIONAL HA at 1k users) - Point-in-time recovery, 14-day backup retention - Accounts DB + user; password generated and stored in Secret Manager - JWT signing key in Secret Manager (shared by accounts + api) - Cloud Run connects via built-in Auth Proxy (Unix socket volume mount) Accounts Cloud Run (cloud-run-accounts.tf): - 3 regions (us-central1, europe-west1, asia-northeast1), min:1 max:50 - Cloud SQL proxy volume mount; secrets via Secret Manager - Stripe + JWT env vars; health probe on /health API Cloud Run (cloud-run-api.tf): - 3 regions, min:1 max:100, cpu_idle=false (always-hot) - Validates JWTs from accounts service; no direct DB connection - License admin token from Secret Manager Load balancer (host-based routing): - Same global anycast IP for all three services - URL map routes by Host: neurontechnologies.ai→marketing, api.neurontechnologies.ai→api, accounts.neurontechnologies.ai→accounts - New managed SSL certs for api.* and accounts.* added to HTTPS proxy - Cloud Armor (WAF + rate limit) applied to all backends Service accounts + IAM: - neuron-accounts-sa: secretmanager.secretAccessor + cloudsql.client - neuron-api-sa: secretmanager.secretAccessor - allUsers invoker on all prod Cloud Run services (LB health checks) bootstrap.sh: - One-shot setup: pulls Stripe secrets from Vault → Secret Manager, creates CI SA JSON key, prints DNS + next-step instructions
This commit is contained in:
Will Anderson
@@ -0,0 +1,226 @@
|
||||
# ── REST API (neuron-rest) — Cloud Run ────────────────────────────────────────
|
||||
# Stateless API layer. Validates JWTs issued by the accounts service.
|
||||
# Does NOT connect to Cloud SQL directly — reads from accounts service for
|
||||
# user context; maintains its own in-process state only.
|
||||
# No Cloud SQL volume needed here.
|
||||
|
||||
locals {
|
||||
api_labels = {
|
||||
"managed-by" = "terraform"
|
||||
"service" = "neuron-api"
|
||||
}
|
||||
}
|
||||
|
||||
# ── Prod — us-central1 ────────────────────────────────────────────────────────
|
||||
|
||||
resource "google_cloud_run_v2_service" "api_us" {
|
||||
name = "api-prod-us"
|
||||
location = "us-central1"
|
||||
project = var.project_id
|
||||
ingress = "INGRESS_TRAFFIC_ALL"
|
||||
labels = local.api_labels
|
||||
|
||||
template {
|
||||
service_account = google_service_account.api.email
|
||||
|
||||
scaling {
|
||||
min_instance_count = 1
|
||||
max_instance_count = 100
|
||||
}
|
||||
|
||||
containers {
|
||||
image = local.api_image
|
||||
|
||||
resources {
|
||||
limits = {
|
||||
cpu = "2"
|
||||
memory = "1Gi"
|
||||
}
|
||||
cpu_idle = false # API needs to be always-hot; no cold starts
|
||||
}
|
||||
|
||||
env { name = "ENV"; value = "production" }
|
||||
env { name = "PORT"; value = "8080" }
|
||||
|
||||
# JWT key — shared with accounts service for token validation
|
||||
env {
|
||||
name = "JWT_SECRET"
|
||||
value_source {
|
||||
secret_key_ref {
|
||||
secret = google_secret_manager_secret.jwt_secret.secret_id
|
||||
version = "latest"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# License admin token — for neuron-mcp license checks
|
||||
env {
|
||||
name = "LICENSE_ADMIN_TOKEN"
|
||||
value_source {
|
||||
secret_key_ref {
|
||||
secret = google_secret_manager_secret.license_admin_token.secret_id
|
||||
version = "latest"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Accounts service URL — for JWT validation and user lookups
|
||||
env {
|
||||
name = "ACCOUNTS_SERVICE_URL"
|
||||
value = "https://accounts.neurontechnologies.ai"
|
||||
}
|
||||
|
||||
ports {
|
||||
container_port = 8080
|
||||
name = "http1"
|
||||
}
|
||||
|
||||
startup_probe {
|
||||
http_get {
|
||||
path = "/health"
|
||||
port = 8080
|
||||
}
|
||||
initial_delay_seconds = 2
|
||||
timeout_seconds = 5
|
||||
period_seconds = 5
|
||||
failure_threshold = 6
|
||||
}
|
||||
|
||||
liveness_probe {
|
||||
http_get {
|
||||
path = "/health"
|
||||
port = 8080
|
||||
}
|
||||
timeout_seconds = 5
|
||||
period_seconds = 30
|
||||
failure_threshold = 3
|
||||
}
|
||||
}
|
||||
|
||||
max_instance_request_concurrency = 1000
|
||||
}
|
||||
|
||||
traffic {
|
||||
type = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
|
||||
percent = 100
|
||||
}
|
||||
|
||||
depends_on = [
|
||||
google_project_iam_member.api_secret_accessor,
|
||||
google_secret_manager_secret_version.jwt_secret,
|
||||
]
|
||||
}
|
||||
|
||||
# ── Prod — europe-west1 ───────────────────────────────────────────────────────
|
||||
|
||||
resource "google_cloud_run_v2_service" "api_eu" {
|
||||
name = "api-prod-eu"
|
||||
location = "europe-west1"
|
||||
project = var.project_id
|
||||
ingress = "INGRESS_TRAFFIC_ALL"
|
||||
labels = local.api_labels
|
||||
|
||||
template {
|
||||
service_account = google_service_account.api.email
|
||||
|
||||
scaling {
|
||||
min_instance_count = 1
|
||||
max_instance_count = 100
|
||||
}
|
||||
|
||||
containers {
|
||||
image = local.api_image
|
||||
|
||||
resources {
|
||||
limits = { cpu = "2"; memory = "1Gi" }
|
||||
cpu_idle = false
|
||||
}
|
||||
|
||||
env { name = "ENV"; value = "production" }
|
||||
env { name = "PORT"; value = "8080" }
|
||||
|
||||
env {
|
||||
name = "JWT_SECRET"
|
||||
value_source { secret_key_ref { secret = google_secret_manager_secret.jwt_secret.secret_id; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "LICENSE_ADMIN_TOKEN"
|
||||
value_source { secret_key_ref { secret = google_secret_manager_secret.license_admin_token.secret_id; version = "latest" } }
|
||||
}
|
||||
env { name = "ACCOUNTS_SERVICE_URL"; value = "https://accounts.neurontechnologies.ai" }
|
||||
|
||||
ports { container_port = 8080; name = "http1" }
|
||||
|
||||
startup_probe {
|
||||
http_get { path = "/health"; port = 8080 }
|
||||
initial_delay_seconds = 2; timeout_seconds = 5; period_seconds = 5; failure_threshold = 6
|
||||
}
|
||||
liveness_probe {
|
||||
http_get { path = "/health"; port = 8080 }
|
||||
timeout_seconds = 5; period_seconds = 30; failure_threshold = 3
|
||||
}
|
||||
}
|
||||
|
||||
max_instance_request_concurrency = 1000
|
||||
}
|
||||
|
||||
traffic { type = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"; percent = 100 }
|
||||
depends_on = [google_project_iam_member.api_secret_accessor]
|
||||
}
|
||||
|
||||
# ── Prod — asia-northeast1 ────────────────────────────────────────────────────
|
||||
|
||||
resource "google_cloud_run_v2_service" "api_apac" {
|
||||
name = "api-prod-apac"
|
||||
location = "asia-northeast1"
|
||||
project = var.project_id
|
||||
ingress = "INGRESS_TRAFFIC_ALL"
|
||||
labels = local.api_labels
|
||||
|
||||
template {
|
||||
service_account = google_service_account.api.email
|
||||
|
||||
scaling {
|
||||
min_instance_count = 1
|
||||
max_instance_count = 100
|
||||
}
|
||||
|
||||
containers {
|
||||
image = local.api_image
|
||||
|
||||
resources {
|
||||
limits = { cpu = "2"; memory = "1Gi" }
|
||||
cpu_idle = false
|
||||
}
|
||||
|
||||
env { name = "ENV"; value = "production" }
|
||||
env { name = "PORT"; value = "8080" }
|
||||
|
||||
env {
|
||||
name = "JWT_SECRET"
|
||||
value_source { secret_key_ref { secret = google_secret_manager_secret.jwt_secret.secret_id; version = "latest" } }
|
||||
}
|
||||
env {
|
||||
name = "LICENSE_ADMIN_TOKEN"
|
||||
value_source { secret_key_ref { secret = google_secret_manager_secret.license_admin_token.secret_id; version = "latest" } }
|
||||
}
|
||||
env { name = "ACCOUNTS_SERVICE_URL"; value = "https://accounts.neurontechnologies.ai" }
|
||||
|
||||
ports { container_port = 8080; name = "http1" }
|
||||
|
||||
startup_probe {
|
||||
http_get { path = "/health"; port = 8080 }
|
||||
initial_delay_seconds = 2; timeout_seconds = 5; period_seconds = 5; failure_threshold = 6
|
||||
}
|
||||
liveness_probe {
|
||||
http_get { path = "/health"; port = 8080 }
|
||||
timeout_seconds = 5; period_seconds = 30; failure_threshold = 3
|
||||
}
|
||||
}
|
||||
|
||||
max_instance_request_concurrency = 1000
|
||||
}
|
||||
|
||||
traffic { type = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"; percent = 100 }
|
||||
depends_on = [google_project_iam_member.api_secret_accessor]
|
||||
}
|
||||
Reference in New Issue
Block a user