Will Anderson
872a834989
Vault: - Annotate vault-helm-gke Service with cloud.google.com/neg exposed_ports to create container-native NEGs (k8s1-bfbeff02-vault-...) in 3 zones - Add vault-api-from-lb-gke firewall rule allowing GCP health check ranges (130.211.0.0/22, 35.191.0.0/16) to reach GKE pod IPs on port 8200 - Replace GCE instance group backends in google_compute_backend_service.vault with GKE NEG backends (RATE balancing mode, 100 req/endpoint) - GCP Global HTTPS LB frontend unchanged — DNS stays at 34.54.164.21 - vault.neuralplatform.ai now terminates at GKE pods (all 3 NEGs HEALTHY) Gitea: - Change GKE Gitea Service from ClusterIP to LoadBalancer (external IP: 34.31.145.131) - Add Cloudflare DNS A record for git.neuralplatform.ai → 34.31.145.131 (proxied) - Remove git.neuralplatform.ai route from Legion Cloudflare tunnel config - Add Cloudflare config rule: flexible SSL for git.neuralplatform.ai (origin serves HTTP/3000, CF proxies HTTPS termination) - Scale Legion Gitea deployment to 0 replicas (PVC preserved) - git.neuralplatform.ai now serves from GKE Gitea pod
54 lines
2.1 KiB
Terraform
54 lines
2.1 KiB
Terraform
# ── neuralplatform.ai DNS ─────────────────────────────────────────────────────
|
|
# Infrastructure and platform service subdomains.
|
|
# All route through the legion Cloudflare tunnel to Traefik unless noted.
|
|
|
|
# vpn.neuralplatform.ai — Headscale coordination server (Tailscale control plane)
|
|
resource "cloudflare_record" "np_vpn" {
|
|
zone_id = local.zone_neuralplatform_ai
|
|
name = "vpn"
|
|
type = "CNAME"
|
|
content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
# web-stage.neuralplatform.ai — Phase 1 Legion deploy of neuron-web (the El
|
|
# native landing server). Coexists with the Cloud Run prod marketing site
|
|
# at neurontechnologies.ai; this lets us iterate on the native build.
|
|
resource "cloudflare_record" "np_web_stage" {
|
|
zone_id = local.zone_neuralplatform_ai
|
|
name = "web-stage"
|
|
type = "CNAME"
|
|
content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
# vault.neuralplatform.ai — GCP Global HTTPS LB with managed cert.
|
|
# DNS-only (not proxied) — GCP managed TLS cert terminates at the LB.
|
|
# Backend is now GKE container-native NEGs (cut over from GCE instance groups).
|
|
# IP: terraform output vault_lb_ip from servers/gcp workspace = 34.54.164.21
|
|
resource "cloudflare_record" "np_vault" {
|
|
zone_id = local.zone_neuralplatform_ai
|
|
name = "vault"
|
|
type = "A"
|
|
content = "34.54.164.21"
|
|
proxied = false
|
|
ttl = 60
|
|
}
|
|
|
|
# git.neuralplatform.ai — Gitea on GKE via GCP Network LB.
|
|
# Cloudflare proxied (provides TLS termination). Gitea listens on port 80 internally.
|
|
# IP: external IP of the GKE LoadBalancer service in namespace gitea.
|
|
# Get it with:
|
|
# kubectl --context=gke_neuron-785695_us-central1_neuron-platform -n gitea get svc gitea
|
|
# Update content below with the actual IP, then terraform apply.
|
|
resource "cloudflare_record" "np_gitea" {
|
|
zone_id = local.zone_neuralplatform_ai
|
|
name = "git"
|
|
type = "A"
|
|
content = "34.31.145.131" # GKE LoadBalancer external IP — gitea svc in namespace gitea
|
|
proxied = true
|
|
ttl = 1
|
|
}
|