Will Anderson
40c6a31784
Locked down to email_domain == neurontechnologies.ai via Cloudflare Access. Dedicated SA with zero prod IAM. Isolated Supabase project (not a schema in prod). No outbound email path. /api/share and /said return 410 Gone in sandbox so the public-artifact surface stays strictly in prod. Stub deploy ready. Real soul build pipeline lands separately.
64 lines
2.2 KiB
Terraform
64 lines
2.2 KiB
Terraform
variable "project_id" {
|
|
description = "GCP project ID"
|
|
type = string
|
|
default = "neuron-785695"
|
|
}
|
|
|
|
variable "image_tag" {
|
|
description = "Docker image tag to deploy for the marketing site"
|
|
type = string
|
|
default = "latest"
|
|
}
|
|
|
|
variable "accounts_image_tag" {
|
|
description = "Docker image tag to deploy for the accounts service"
|
|
type = string
|
|
default = "latest"
|
|
}
|
|
|
|
variable "api_image_tag" {
|
|
description = "Docker image tag to deploy for the REST API (neuron-rest)"
|
|
type = string
|
|
default = "latest"
|
|
}
|
|
|
|
variable "cloudflare_zone_id_neurontechnologies" {
|
|
description = "Cloudflare zone ID for neurontechnologies.ai (look up from Legion Terraform state or Cloudflare dashboard)"
|
|
type = string
|
|
# Set this in terraform.tfvars — do not hardcode here.
|
|
# To find: cloudflare_zone.neurontechnologies_ai.id in the Legion Terraform state,
|
|
# or: curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=neurontechnologies.ai" -H "X-Auth-Email: andersonwilliam85@gmail.com" -H "X-Auth-Key: <key>"
|
|
}
|
|
|
|
variable "cloudflare_api_key" {
|
|
description = "Cloudflare global API key (from Vault: secret/cloudflare api_key)"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "cloudflare_email" {
|
|
description = "Cloudflare account email (from Vault: secret/cloudflare email)"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_account_id" {
|
|
description = "Cloudflare account ID (used for Zero Trust Access policies)"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
locals {
|
|
project_id = var.project_id
|
|
|
|
# Image refs per service
|
|
marketing_image = "us-central1-docker.pkg.dev/${var.project_id}/neuron-marketing/marketing:${var.image_tag}"
|
|
accounts_image = "us-central1-docker.pkg.dev/${var.project_id}/neuron-accounts/accounts:${var.accounts_image_tag}"
|
|
api_image = "us-central1-docker.pkg.dev/${var.project_id}/neuron-api/api:${var.api_image_tag}"
|
|
|
|
# Keep backward-compat alias (used in cloud-run.tf for marketing service)
|
|
image = local.marketing_image
|
|
|
|
# Static publishable key (not sensitive — lives in source)
|
|
stripe_publishable_key = "pk_live_51TPoHnJg9Fv1D3AUPMXnYyOJIVhn1FyH56zCMNnATo9tR7pO9lNDbXncp6VeDxm38qSdBHZPfqEBipUh3GZsWNyd00jvIO97E6"
|
|
}
|