Will Anderson
91bfc42989
Scaled to replicas: 0: fornax (coordinator/ui/workers), jellyfin via media, overseerr, plex, radarr, sonarr, bazarr, prowlarr, flaresolverr, ollama, harmonic-wordpress, docuseal, listmonk, memos, plane, redpanda, wp-coordinator
55 lines
2.2 KiB
Terraform
55 lines
2.2 KiB
Terraform
# ── Service Account ───────────────────────────────────────────────────────────
|
|
|
|
resource "google_service_account" "marketing" {
|
|
account_id = "neuron-marketing-sa"
|
|
display_name = "Neuron Marketing Cloud Run SA"
|
|
description = "Service account for the neurontechnologies.ai marketing site on Cloud Run"
|
|
}
|
|
|
|
# ── IAM — Secret Manager accessor ─────────────────────────────────────────────
|
|
# Grant the SA access to read all marketing secrets from Secret Manager.
|
|
|
|
resource "google_project_iam_member" "marketing_secret_accessor" {
|
|
project = var.project_id
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.marketing.email}"
|
|
}
|
|
|
|
# ── IAM — Public (unauthenticated) invocation for prod services ───────────────
|
|
# Cloud Run v2: allow-unauthenticated is set per-service via google_cloud_run_v2_service_iam_member.
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "prod_us_public" {
|
|
project = var.project_id
|
|
location = "us-central1"
|
|
name = google_cloud_run_v2_service.prod_us.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "prod_eu_public" {
|
|
project = var.project_id
|
|
location = "europe-west1"
|
|
name = google_cloud_run_v2_service.prod_eu.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "prod_apac_public" {
|
|
project = var.project_id
|
|
location = "asia-northeast1"
|
|
name = google_cloud_run_v2_service.prod_apac.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "stage_public" {
|
|
project = var.project_id
|
|
location = "us-central1"
|
|
name = google_cloud_run_v2_service.stage.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
|
|
# Note: Cloudflare Access enforces authentication in front of stage.
|
|
# Cloud Run itself allows allUsers so the LB health checks pass.
|
|
}
|