Expand GCP infra: accounts + API services, Cloud SQL, Artifact Registry
Architecture: intelligence stays on Legion; only compiled artifacts cross to GCP. Source code and Neuron's knowledge base never leave the system. Artifact Registry: - neuron-marketing, neuron-accounts, neuron-api repos in us-central1 - Keep-last-10 cleanup policy; ci-pusher SA with writer access - Legion CI runners authenticate via GCP_SA_KEY Gitea secret Cloud SQL (cloud-sql.tf): - postgres-15 on db-g1-small, us-central1 (scale up to REGIONAL HA at 1k users) - Point-in-time recovery, 14-day backup retention - Accounts DB + user; password generated and stored in Secret Manager - JWT signing key in Secret Manager (shared by accounts + api) - Cloud Run connects via built-in Auth Proxy (Unix socket volume mount) Accounts Cloud Run (cloud-run-accounts.tf): - 3 regions (us-central1, europe-west1, asia-northeast1), min:1 max:50 - Cloud SQL proxy volume mount; secrets via Secret Manager - Stripe + JWT env vars; health probe on /health API Cloud Run (cloud-run-api.tf): - 3 regions, min:1 max:100, cpu_idle=false (always-hot) - Validates JWTs from accounts service; no direct DB connection - License admin token from Secret Manager Load balancer (host-based routing): - Same global anycast IP for all three services - URL map routes by Host: neurontechnologies.ai→marketing, api.neurontechnologies.ai→api, accounts.neurontechnologies.ai→accounts - New managed SSL certs for api.* and accounts.* added to HTTPS proxy - Cloud Armor (WAF + rate limit) applied to all backends Service accounts + IAM: - neuron-accounts-sa: secretmanager.secretAccessor + cloudsql.client - neuron-api-sa: secretmanager.secretAccessor - allUsers invoker on all prod Cloud Run services (LB health checks) bootstrap.sh: - One-shot setup: pulls Stripe secrets from Vault → Secret Manager, creates CI SA JSON key, prints DNS + next-step instructions
This commit is contained in:
Will Anderson
@@ -1,13 +1,27 @@
|
||||
# ── Service Account ───────────────────────────────────────────────────────────
|
||||
# ── Service Accounts ──────────────────────────────────────────────────────────
|
||||
|
||||
resource "google_service_account" "marketing" {
|
||||
account_id = "neuron-marketing-sa"
|
||||
display_name = "Neuron Marketing Cloud Run SA"
|
||||
description = "Service account for the neurontechnologies.ai marketing site on Cloud Run"
|
||||
project = var.project_id
|
||||
}
|
||||
|
||||
# ── IAM — Secret Manager accessor ─────────────────────────────────────────────
|
||||
# Grant the SA access to read all marketing secrets from Secret Manager.
|
||||
resource "google_service_account" "accounts" {
|
||||
account_id = "neuron-accounts-sa"
|
||||
display_name = "Neuron Accounts Cloud Run SA"
|
||||
description = "Service account for the accounts service (auth, billing, marketplace)"
|
||||
project = var.project_id
|
||||
}
|
||||
|
||||
resource "google_service_account" "api" {
|
||||
account_id = "neuron-api-sa"
|
||||
display_name = "Neuron REST API Cloud Run SA"
|
||||
description = "Service account for the neuron-rest API service"
|
||||
project = var.project_id
|
||||
}
|
||||
|
||||
# ── IAM — Secret Manager ──────────────────────────────────────────────────────
|
||||
|
||||
resource "google_project_iam_member" "marketing_secret_accessor" {
|
||||
project = var.project_id
|
||||
@@ -15,9 +29,32 @@ resource "google_project_iam_member" "marketing_secret_accessor" {
|
||||
member = "serviceAccount:${google_service_account.marketing.email}"
|
||||
}
|
||||
|
||||
# ── IAM — Public (unauthenticated) invocation for prod services ───────────────
|
||||
# Cloud Run v2: allow-unauthenticated is set per-service via google_cloud_run_v2_service_iam_member.
|
||||
resource "google_project_iam_member" "accounts_secret_accessor" {
|
||||
project = var.project_id
|
||||
role = "roles/secretmanager.secretAccessor"
|
||||
member = "serviceAccount:${google_service_account.accounts.email}"
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "api_secret_accessor" {
|
||||
project = var.project_id
|
||||
role = "roles/secretmanager.secretAccessor"
|
||||
member = "serviceAccount:${google_service_account.api.email}"
|
||||
}
|
||||
|
||||
# ── IAM — Cloud SQL ───────────────────────────────────────────────────────────
|
||||
# Only accounts connects to Cloud SQL; API and marketing don't need DB access.
|
||||
|
||||
resource "google_project_iam_member" "accounts_sql_client" {
|
||||
project = var.project_id
|
||||
role = "roles/cloudsql.client"
|
||||
member = "serviceAccount:${google_service_account.accounts.email}"
|
||||
}
|
||||
|
||||
# ── IAM — Public invocation (Cloud Run → LB) ──────────────────────────────────
|
||||
# allUsers invoker allows the global HTTP(S) load balancer's health checks
|
||||
# and traffic to reach the services without additional auth headers.
|
||||
|
||||
# Marketing
|
||||
resource "google_cloud_run_v2_service_iam_member" "prod_us_public" {
|
||||
project = var.project_id
|
||||
location = "us-central1"
|
||||
@@ -48,7 +85,55 @@ resource "google_cloud_run_v2_service_iam_member" "stage_public" {
|
||||
name = google_cloud_run_v2_service.stage.name
|
||||
role = "roles/run.invoker"
|
||||
member = "allUsers"
|
||||
|
||||
# Note: Cloudflare Access enforces authentication in front of stage.
|
||||
# Cloud Run itself allows allUsers so the LB health checks pass.
|
||||
# Note: Cloudflare Access enforces auth in front of stage.
|
||||
}
|
||||
|
||||
# Accounts
|
||||
resource "google_cloud_run_v2_service_iam_member" "accounts_us_public" {
|
||||
project = var.project_id
|
||||
location = "us-central1"
|
||||
name = google_cloud_run_v2_service.accounts_us.name
|
||||
role = "roles/run.invoker"
|
||||
member = "allUsers"
|
||||
}
|
||||
|
||||
resource "google_cloud_run_v2_service_iam_member" "accounts_eu_public" {
|
||||
project = var.project_id
|
||||
location = "europe-west1"
|
||||
name = google_cloud_run_v2_service.accounts_eu.name
|
||||
role = "roles/run.invoker"
|
||||
member = "allUsers"
|
||||
}
|
||||
|
||||
resource "google_cloud_run_v2_service_iam_member" "accounts_apac_public" {
|
||||
project = var.project_id
|
||||
location = "asia-northeast1"
|
||||
name = google_cloud_run_v2_service.accounts_apac.name
|
||||
role = "roles/run.invoker"
|
||||
member = "allUsers"
|
||||
}
|
||||
|
||||
# API
|
||||
resource "google_cloud_run_v2_service_iam_member" "api_us_public" {
|
||||
project = var.project_id
|
||||
location = "us-central1"
|
||||
name = google_cloud_run_v2_service.api_us.name
|
||||
role = "roles/run.invoker"
|
||||
member = "allUsers"
|
||||
}
|
||||
|
||||
resource "google_cloud_run_v2_service_iam_member" "api_eu_public" {
|
||||
project = var.project_id
|
||||
location = "europe-west1"
|
||||
name = google_cloud_run_v2_service.api_eu.name
|
||||
role = "roles/run.invoker"
|
||||
member = "allUsers"
|
||||
}
|
||||
|
||||
resource "google_cloud_run_v2_service_iam_member" "api_apac_public" {
|
||||
project = var.project_id
|
||||
location = "asia-northeast1"
|
||||
name = google_cloud_run_v2_service.api_apac.name
|
||||
role = "roles/run.invoker"
|
||||
member = "allUsers"
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user