prod: fix Cloud Run config for v1.0 (port 8080, env vars, secrets)

2026-05-01 18:13:00 -05:00
parent 89e6c811d7
commit ec2d5794ec
3 changed files with 526 additions and 13 deletions
@@ -0,0 +1,96 @@
+# ── Cloud Storage ─────────────────────────────────────────────────────────────
+# Share card blobs from the marketing landing page demo chat.
+# Separate buckets for prod and stage/test.
+# Each blob is a small JSON file (~1KB) keyed by share ID.
+# Public read so the landing server can serve card pages.
+# Marketing SA has write access to upload new cards.
+
+locals {
+  share_bucket_labels = {
+    "managed-by" = "terraform"
+    "project"    = "neuron-marketing"
+    "purpose"    = "share-cards"
+  }
+}
+
+# ── Prod bucket ───────────────────────────────────────────────────────────────
+
+resource "google_storage_bucket" "shares_prod" {
+  name          = "neuron-shares-prod"
+  project       = var.project_id
+  location      = "US"
+  storage_class = "STANDARD"
+
+  uniform_bucket_level_access = true
+
+  cors {
+    origin          = ["https://neurontechnologies.ai"]
+    method          = ["GET"]
+    response_header = ["Content-Type"]
+    max_age_seconds = 3600
+  }
+
+  lifecycle_rule {
+    action {
+      type = "Delete"
+    }
+    condition {
+      age = 365
+    }
+  }
+
+  labels = merge(local.share_bucket_labels, { "env" = "prod" })
+}
+
+resource "google_storage_bucket_iam_member" "shares_prod_public_read" {
+  bucket = google_storage_bucket.shares_prod.name
+  role   = "roles/storage.objectViewer"
+  member = "allUsers"
+}
+
+resource "google_storage_bucket_iam_member" "shares_prod_marketing_write" {
+  bucket = google_storage_bucket.shares_prod.name
+  role   = "roles/storage.objectUser"
+  member = "serviceAccount:${google_service_account.marketing.email}"
+}
+
+# ── Stage / test bucket ───────────────────────────────────────────────────────
+
+resource "google_storage_bucket" "shares_stage" {
+  name          = "neuron-shares-stage"
+  project       = var.project_id
+  location      = "US"
+  storage_class = "STANDARD"
+
+  uniform_bucket_level_access = true
+
+  cors {
+    origin          = ["https://stage.neurontechnologies.ai", "http://localhost:3001"]
+    method          = ["GET"]
+    response_header = ["Content-Type"]
+    max_age_seconds = 3600
+  }
+
+  lifecycle_rule {
+    action {
+      type = "Delete"
+    }
+    condition {
+      age = 30
+    }
+  }
+
+  labels = merge(local.share_bucket_labels, { "env" = "stage" })
+}
+
+resource "google_storage_bucket_iam_member" "shares_stage_public_read" {
+  bucket = google_storage_bucket.shares_stage.name
+  role   = "roles/storage.objectViewer"
+  member = "allUsers"
+}
+
+resource "google_storage_bucket_iam_member" "shares_stage_marketing_write" {
+  bucket = google_storage_bucket.shares_stage.name
+  role   = "roles/storage.objectUser"
+  member = "serviceAccount:${google_service_account.marketing.email}"
+}