Will Anderson
d4c65d5857
Architecture: intelligence stays on Legion; only compiled artifacts cross to GCP. Source code and Neuron's knowledge base never leave the system. Artifact Registry: - neuron-marketing, neuron-accounts, neuron-api repos in us-central1 - Keep-last-10 cleanup policy; ci-pusher SA with writer access - Legion CI runners authenticate via GCP_SA_KEY Gitea secret Cloud SQL (cloud-sql.tf): - postgres-15 on db-g1-small, us-central1 (scale up to REGIONAL HA at 1k users) - Point-in-time recovery, 14-day backup retention - Accounts DB + user; password generated and stored in Secret Manager - JWT signing key in Secret Manager (shared by accounts + api) - Cloud Run connects via built-in Auth Proxy (Unix socket volume mount) Accounts Cloud Run (cloud-run-accounts.tf): - 3 regions (us-central1, europe-west1, asia-northeast1), min:1 max:50 - Cloud SQL proxy volume mount; secrets via Secret Manager - Stripe + JWT env vars; health probe on /health API Cloud Run (cloud-run-api.tf): - 3 regions, min:1 max:100, cpu_idle=false (always-hot) - Validates JWTs from accounts service; no direct DB connection - License admin token from Secret Manager Load balancer (host-based routing): - Same global anycast IP for all three services - URL map routes by Host: neurontechnologies.ai→marketing, api.neurontechnologies.ai→api, accounts.neurontechnologies.ai→accounts - New managed SSL certs for api.* and accounts.* added to HTTPS proxy - Cloud Armor (WAF + rate limit) applied to all backends Service accounts + IAM: - neuron-accounts-sa: secretmanager.secretAccessor + cloudsql.client - neuron-api-sa: secretmanager.secretAccessor - allUsers invoker on all prod Cloud Run services (LB health checks) bootstrap.sh: - One-shot setup: pulls Stripe secrets from Vault → Secret Manager, creates CI SA JSON key, prints DNS + next-step instructions
42 lines
912 B
Terraform
42 lines
912 B
Terraform
terraform {
|
|
required_version = ">= 1.5"
|
|
|
|
required_providers {
|
|
google = {
|
|
source = "hashicorp/google"
|
|
version = "~> 5.0"
|
|
}
|
|
google-beta = {
|
|
source = "hashicorp/google-beta"
|
|
version = "~> 5.0"
|
|
}
|
|
random = {
|
|
source = "hashicorp/random"
|
|
version = "~> 3.6"
|
|
}
|
|
}
|
|
|
|
backend "s3" {
|
|
bucket = "legion-terraform-state"
|
|
key = "gcp/terraform.tfstate"
|
|
region = "auto"
|
|
endpoint = "https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com"
|
|
|
|
# R2 is S3-compatible but not AWS — skip AWS-specific checks
|
|
skip_credentials_validation = true
|
|
skip_metadata_api_check = true
|
|
skip_region_validation = true
|
|
force_path_style = true
|
|
}
|
|
}
|
|
|
|
provider "google" {
|
|
project = var.project_id
|
|
region = "us-central1"
|
|
}
|
|
|
|
provider "google-beta" {
|
|
project = var.project_id
|
|
region = "us-central1"
|
|
}
|