Will Anderson
d4c65d5857
Architecture: intelligence stays on Legion; only compiled artifacts cross to GCP. Source code and Neuron's knowledge base never leave the system. Artifact Registry: - neuron-marketing, neuron-accounts, neuron-api repos in us-central1 - Keep-last-10 cleanup policy; ci-pusher SA with writer access - Legion CI runners authenticate via GCP_SA_KEY Gitea secret Cloud SQL (cloud-sql.tf): - postgres-15 on db-g1-small, us-central1 (scale up to REGIONAL HA at 1k users) - Point-in-time recovery, 14-day backup retention - Accounts DB + user; password generated and stored in Secret Manager - JWT signing key in Secret Manager (shared by accounts + api) - Cloud Run connects via built-in Auth Proxy (Unix socket volume mount) Accounts Cloud Run (cloud-run-accounts.tf): - 3 regions (us-central1, europe-west1, asia-northeast1), min:1 max:50 - Cloud SQL proxy volume mount; secrets via Secret Manager - Stripe + JWT env vars; health probe on /health API Cloud Run (cloud-run-api.tf): - 3 regions, min:1 max:100, cpu_idle=false (always-hot) - Validates JWTs from accounts service; no direct DB connection - License admin token from Secret Manager Load balancer (host-based routing): - Same global anycast IP for all three services - URL map routes by Host: neurontechnologies.ai→marketing, api.neurontechnologies.ai→api, accounts.neurontechnologies.ai→accounts - New managed SSL certs for api.* and accounts.* added to HTTPS proxy - Cloud Armor (WAF + rate limit) applied to all backends Service accounts + IAM: - neuron-accounts-sa: secretmanager.secretAccessor + cloudsql.client - neuron-api-sa: secretmanager.secretAccessor - allUsers invoker on all prod Cloud Run services (LB health checks) bootstrap.sh: - One-shot setup: pulls Stripe secrets from Vault → Secret Manager, creates CI SA JSON key, prints DNS + next-step instructions
97 lines
3.5 KiB
Terraform
97 lines
3.5 KiB
Terraform
# ── Artifact Registry ─────────────────────────────────────────────────────────
|
|
# One repository per service. Images are pushed here from Legion CI runners
|
|
# (the only compiled artifacts that cross the boundary to GCP).
|
|
# Source code and intelligence stay on Legion — only the built container
|
|
# crosses out.
|
|
|
|
resource "google_artifact_registry_repository" "marketing" {
|
|
location = "us-central1"
|
|
repository_id = "neuron-marketing"
|
|
description = "Marketing site (Next.js) Docker images"
|
|
format = "DOCKER"
|
|
project = var.project_id
|
|
|
|
cleanup_policies {
|
|
id = "keep-last-10"
|
|
action = "KEEP"
|
|
most_recent_versions {
|
|
keep_count = 10
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "google_artifact_registry_repository" "accounts" {
|
|
location = "us-central1"
|
|
repository_id = "neuron-accounts"
|
|
description = "Accounts service (Go) Docker images"
|
|
format = "DOCKER"
|
|
project = var.project_id
|
|
|
|
cleanup_policies {
|
|
id = "keep-last-10"
|
|
action = "KEEP"
|
|
most_recent_versions {
|
|
keep_count = 10
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "google_artifact_registry_repository" "api" {
|
|
location = "us-central1"
|
|
repository_id = "neuron-api"
|
|
description = "REST API (neuron-rest, Go) Docker images"
|
|
format = "DOCKER"
|
|
project = var.project_id
|
|
|
|
cleanup_policies {
|
|
id = "keep-last-10"
|
|
action = "KEEP"
|
|
most_recent_versions {
|
|
keep_count = 10
|
|
}
|
|
}
|
|
}
|
|
|
|
# ── IAM: CI runner pushes images ──────────────────────────────────────────────
|
|
# The CI service account (from Legion's Gitea runner) needs Artifact Registry
|
|
# writer access so it can push compiled images after each build.
|
|
|
|
resource "google_service_account" "ci_pusher" {
|
|
account_id = "neuron-ci-pusher"
|
|
display_name = "Neuron CI Image Pusher"
|
|
description = "Legion CI runner uses this SA to push compiled images to Artifact Registry"
|
|
project = var.project_id
|
|
}
|
|
|
|
resource "google_artifact_registry_repository_iam_member" "ci_marketing" {
|
|
project = var.project_id
|
|
location = "us-central1"
|
|
repository = google_artifact_registry_repository.marketing.name
|
|
role = "roles/artifactregistry.writer"
|
|
member = "serviceAccount:${google_service_account.ci_pusher.email}"
|
|
}
|
|
|
|
resource "google_artifact_registry_repository_iam_member" "ci_accounts" {
|
|
project = var.project_id
|
|
location = "us-central1"
|
|
repository = google_artifact_registry_repository.accounts.name
|
|
role = "roles/artifactregistry.writer"
|
|
member = "serviceAccount:${google_service_account.ci_pusher.email}"
|
|
}
|
|
|
|
resource "google_artifact_registry_repository_iam_member" "ci_api" {
|
|
project = var.project_id
|
|
location = "us-central1"
|
|
repository = google_artifact_registry_repository.api.name
|
|
role = "roles/artifactregistry.writer"
|
|
member = "serviceAccount:${google_service_account.ci_pusher.email}"
|
|
}
|
|
|
|
# ── CI pusher JSON key (download once, store in Vault/Secret Manager) ─────────
|
|
# After `terraform apply`, create a key and save it to GCP Secret Manager:
|
|
# gcloud iam service-accounts keys create /tmp/ci-pusher.json \
|
|
# --iam-account=$(terraform output -raw ci_pusher_email)
|
|
# gcloud secrets create ci-gcp-sa-key --data-file=/tmp/ci-pusher.json
|
|
# rm /tmp/ci-pusher.json
|
|
# Then set it as a repo secret in Gitea: GCP_SA_KEY
|