Will Anderson
53f2ad3c16
- accounts: add ACCOUNTS_PORT=8080 env var (service defaults to 7753) - api: add SERVER_PORT=8080 env var, change probe path to /actuator/health - LB backends: remove timeout_sec (not supported for serverless NEG backends)
118 lines
4.7 KiB
Terraform
118 lines
4.7 KiB
Terraform
# ── Serverless NEGs — Accounts ────────────────────────────────────────────────
|
|
|
|
resource "google_compute_region_network_endpoint_group" "accounts_us" {
|
|
name = "accounts-neg-us"
|
|
network_endpoint_type = "SERVERLESS"
|
|
region = "us-central1"
|
|
project = var.project_id
|
|
cloud_run { service = google_cloud_run_v2_service.accounts_us.name }
|
|
}
|
|
|
|
resource "google_compute_region_network_endpoint_group" "accounts_eu" {
|
|
name = "accounts-neg-eu"
|
|
network_endpoint_type = "SERVERLESS"
|
|
region = "europe-west1"
|
|
project = var.project_id
|
|
cloud_run { service = google_cloud_run_v2_service.accounts_eu.name }
|
|
}
|
|
|
|
resource "google_compute_region_network_endpoint_group" "accounts_apac" {
|
|
name = "accounts-neg-apac"
|
|
network_endpoint_type = "SERVERLESS"
|
|
region = "asia-northeast1"
|
|
project = var.project_id
|
|
cloud_run { service = google_cloud_run_v2_service.accounts_apac.name }
|
|
}
|
|
|
|
# ── Serverless NEGs — API ─────────────────────────────────────────────────────
|
|
|
|
resource "google_compute_region_network_endpoint_group" "api_us" {
|
|
name = "api-neg-us"
|
|
network_endpoint_type = "SERVERLESS"
|
|
region = "us-central1"
|
|
project = var.project_id
|
|
cloud_run { service = google_cloud_run_v2_service.api_us.name }
|
|
}
|
|
|
|
resource "google_compute_region_network_endpoint_group" "api_eu" {
|
|
name = "api-neg-eu"
|
|
network_endpoint_type = "SERVERLESS"
|
|
region = "europe-west1"
|
|
project = var.project_id
|
|
cloud_run { service = google_cloud_run_v2_service.api_eu.name }
|
|
}
|
|
|
|
resource "google_compute_region_network_endpoint_group" "api_apac" {
|
|
name = "api-neg-apac"
|
|
network_endpoint_type = "SERVERLESS"
|
|
region = "asia-northeast1"
|
|
project = var.project_id
|
|
cloud_run { service = google_cloud_run_v2_service.api_apac.name }
|
|
}
|
|
|
|
# ── Backend Service — Accounts ────────────────────────────────────────────────
|
|
|
|
resource "google_compute_backend_service" "accounts" {
|
|
name = "accounts-backend-prod"
|
|
project = var.project_id
|
|
load_balancing_scheme = "EXTERNAL_MANAGED"
|
|
protocol = "HTTPS"
|
|
# timeout_sec not supported for serverless NEG backends
|
|
security_policy = google_compute_security_policy.marketing.self_link
|
|
|
|
# No CDN for accounts — responses are user-specific and must not be cached
|
|
enable_cdn = false
|
|
|
|
backend { group = google_compute_region_network_endpoint_group.accounts_us.self_link }
|
|
backend { group = google_compute_region_network_endpoint_group.accounts_eu.self_link }
|
|
backend { group = google_compute_region_network_endpoint_group.accounts_apac.self_link }
|
|
|
|
log_config {
|
|
enable = true
|
|
sample_rate = 1.0
|
|
}
|
|
}
|
|
|
|
# ── Backend Service — API ─────────────────────────────────────────────────────
|
|
|
|
resource "google_compute_backend_service" "api" {
|
|
name = "api-backend-prod"
|
|
project = var.project_id
|
|
load_balancing_scheme = "EXTERNAL_MANAGED"
|
|
protocol = "HTTPS"
|
|
# timeout_sec not supported for serverless NEG backends
|
|
security_policy = google_compute_security_policy.marketing.self_link
|
|
|
|
enable_cdn = false # API responses are per-request; no CDN benefit
|
|
|
|
backend { group = google_compute_region_network_endpoint_group.api_us.self_link }
|
|
backend { group = google_compute_region_network_endpoint_group.api_eu.self_link }
|
|
backend { group = google_compute_region_network_endpoint_group.api_apac.self_link }
|
|
|
|
log_config {
|
|
enable = true
|
|
sample_rate = 1.0
|
|
}
|
|
}
|
|
|
|
# ── SSL Certs — accounts and api subdomains ───────────────────────────────────
|
|
# Added to the existing prod HTTPS proxy alongside the marketing cert.
|
|
# DNS must point to the same prod global IP (marketing-ip-prod) for
|
|
# provisioning to succeed.
|
|
|
|
resource "google_compute_managed_ssl_certificate" "accounts" {
|
|
name = "accounts-cert-prod"
|
|
project = var.project_id
|
|
managed {
|
|
domains = ["accounts.neurontechnologies.ai"]
|
|
}
|
|
}
|
|
|
|
resource "google_compute_managed_ssl_certificate" "api" {
|
|
name = "api-cert-prod"
|
|
project = var.project_id
|
|
managed {
|
|
domains = ["api.neurontechnologies.ai"]
|
|
}
|
|
}
|