infrastructure/servers/gcp/cloud-run-soma.tf

# ── Soma — AI Inference Gateway — Cloud Run ───────────────────────────────────
# Soma is a Rust/Axum inference proxy that speaks OpenAI-compatible API.
# Single region (us-central1) — inference latency matters, no need for global
# multi-region replication at this stage.
#
# Public endpoint: https://ai.neurontechnologies.ai/v1/chat/completions
# Auth: Bearer token (svc-* prefix) via require_api_key middleware.

locals {
  soma_labels = {
    "managed-by" = "terraform"
    "service"    = "neuron-soma"
  }
  soma_image = "us-central1-docker.pkg.dev/${var.project_id}/neuron-soma/soma:latest"
}

# ── Artifact Registry ─────────────────────────────────────────────────────────

resource "google_artifact_registry_repository" "soma" {
  location      = "us-central1"
  repository_id = "neuron-soma"
  description   = "Soma AI inference gateway (Rust) Docker images"
  format        = "DOCKER"
  project       = var.project_id

  cleanup_policies {
    id     = "keep-last-10"
    action = "KEEP"
    most_recent_versions {
      keep_count = 10
    }
  }
}

# ── CI pusher access to soma repo ─────────────────────────────────────────────

resource "google_artifact_registry_repository_iam_member" "ci_soma" {
  project    = var.project_id
  location   = "us-central1"
  repository = google_artifact_registry_repository.soma.name
  role       = "roles/artifactregistry.writer"
  member     = "serviceAccount:${google_service_account.ci_pusher.email}"
}

resource "google_service_account_iam_member" "ci_pusher_act_as_soma" {
  service_account_id = google_service_account.soma.name
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${google_service_account.ci_pusher.email}"
}

# ── Service Account ───────────────────────────────────────────────────────────

resource "google_service_account" "soma" {
  account_id   = "neuron-soma-sa"
  display_name = "Neuron Soma Cloud Run SA"
  description  = "Service account for the Soma AI inference gateway on Cloud Run"
  project      = var.project_id
}

resource "google_project_iam_member" "soma_secret_accessor" {
  project = var.project_id
  role    = "roles/secretmanager.secretAccessor"
  member  = "serviceAccount:${google_service_account.soma.email}"
}

# ── Secrets ───────────────────────────────────────────────────────────────────

resource "google_secret_manager_secret" "soma_hf_token" {
  secret_id = "soma-hf-token"
  project   = var.project_id

  replication {
    auto {}
  }
}

resource "google_secret_manager_secret_version" "soma_hf_token" {
  secret      = google_secret_manager_secret.soma_hf_token.id
  secret_data = "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"
}

resource "google_secret_manager_secret" "soma_operator_key" {
  secret_id = "soma-operator-key"
  project   = var.project_id

  replication {
    auto {}
  }
}

resource "google_secret_manager_secret_version" "soma_operator_key" {
  secret      = google_secret_manager_secret.soma_operator_key.id
  secret_data = "svc-will-1ab07c23ab5112aa14378f2941f7cd3f"
}

# ── Cloud Run Service — us-central1 ──────────────────────────────────────────

resource "google_cloud_run_v2_service" "soma_us" {
  name     = "soma-prod-us"
  location = "us-central1"
  project  = var.project_id
  ingress  = "INGRESS_TRAFFIC_ALL"
  labels   = local.soma_labels

  template {
    service_account = google_service_account.soma.email

    scaling {
      # min=1: always warm — inference latency is unacceptable on cold start
      min_instance_count = 1
      max_instance_count = 10
    }

    containers {
      image = local.soma_image

      resources {
        limits = {
          cpu    = "2"
          memory = "2Gi"
        }
        # cpu_idle=false: keep CPU allocated — inference proxy needs fast response
        cpu_idle = false
      }

      env {
        name  = "SOMA_CONFIG_PATH"
        value = "/etc/soma/soma.toml"
      }

      env {
        name = "HF_TOKEN"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.soma_hf_token.secret_id
            version = "latest"
          }
        }
      }

      env {
        name = "SOMA_OPERATOR_KEY"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.soma_operator_key.secret_id
            version = "latest"
          }
        }
      }

      ports {
        container_port = 8080
        name           = "http1"
      }

      startup_probe {
        http_get {
          path = "/health"
          port = 8080
        }
        initial_delay_seconds = 2
        timeout_seconds       = 5
        period_seconds        = 5
        failure_threshold     = 10
      }

      liveness_probe {
        http_get {
          path = "/health"
          port = 8080
        }
        timeout_seconds   = 5
        period_seconds    = 30
        failure_threshold = 3
      }
    }

    max_instance_request_concurrency = 100
  }

  traffic {
    type    = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
    percent = 100
  }

  depends_on = [
    google_project_iam_member.soma_secret_accessor,
    google_secret_manager_secret_version.soma_hf_token,
    google_secret_manager_secret_version.soma_operator_key,
  ]
}

# ── Public Invoker IAM ────────────────────────────────────────────────────────

resource "google_cloud_run_v2_service_iam_member" "soma_us_public" {
  project  = var.project_id
  location = "us-central1"
  name     = google_cloud_run_v2_service.soma_us.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

# ── Serverless NEG ────────────────────────────────────────────────────────────

resource "google_compute_region_network_endpoint_group" "soma_us" {
  name                  = "soma-neg-us"
  network_endpoint_type = "SERVERLESS"
  region                = "us-central1"
  project               = var.project_id

  cloud_run {
    service = google_cloud_run_v2_service.soma_us.name
  }
}

# ── Backend Service ───────────────────────────────────────────────────────────

resource "google_compute_backend_service" "soma" {
  name                  = "soma-backend-prod"
  project               = var.project_id
  load_balancing_scheme = "EXTERNAL_MANAGED"
  protocol              = "HTTPS"

  # Cloud Armor — same policy as other services (SQLi/XSS/rate-limit)
  security_policy = google_compute_security_policy.marketing.self_link

  # No CDN — inference responses are always unique
  enable_cdn = false

  backend {
    group = google_compute_region_network_endpoint_group.soma_us.self_link
  }

  log_config {
    enable      = true
    sample_rate = 1.0
  }
}

# ── SSL Certificate ───────────────────────────────────────────────────────────

resource "google_compute_managed_ssl_certificate" "soma" {
  name    = "soma-cert-prod"
  project = var.project_id

  managed {
    domains = ["ai.neurontechnologies.ai"]
  }
}