Repository navigation
feat(phase-6b): Terraform infrastructure for the production architecture - #23
Merged
Merged
Conversation
Provisions the full stack from docs/02-TECH-STACK.md and 10-DIAGRAMS.md SS8: 3 Cloud Run services (api/web/agents), Cloud SQL, Memorystore, Pub/Sub (job dispatch + dead-letter), Cloud Storage, Secret Manager, Artifact Registry, least-privilege IAM per service account, and Grafana Cloud dashboard provisioning (gated behind grafana_enabled, since that's a third-party account only the project owner can create). Validated for real: `terraform validate` passes, and `terraform plan` against the actual scene-craft-507404 GCP project produces a clean 56-resource plan with no errors or warnings. Not yet applied — Cloud SQL and Memorystore bill continuously once real resources exist, so infra/README.md documents the deliberate decision to hold off on `terraform apply` until closer to Phase 7 demo prep, plus the account setup (Grafana Cloud, WIF) and one-time steps (Firestore import, CORS bootstrapping around a genuine Cloud-Run-to-Cloud-Run URL dependency cycle) needed before a real apply. Part 2 of 3 for Phase 6 — see feat/phase-6a-otel-and-runtime-hardening (merged prerequisite: app-level OTel/Redis/Pub/Sub code) and feat/phase-6c-cicd-deploy-pipeline (follows). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
infra/terraform/: 3 Cloud Run services (api/web/agents), Cloud SQL (public IP + Auth Proxy volume mount, no VPC needed), Memorystore (Basic tier, direct VPC egress), Pub/Sub (job dispatch + dead-letter), Cloud Storage, Secret Manager (JWT/internal-service-key/Gemini key/full DATABASE_URL), Artifact Registry, least-privilege IAM per service account with an explicit "why" comment on every binding (and every deliberate omission).grafana.tf+infra/grafana/dashboards/*.json), gated behindgrafana_enabledsince it needs a third-party account only the project owner can create.infra/README.md: account setup, cost estimate, and whyterraform applyis deliberately not run yet (Cloud SQL + Memorystore bill continuously, unlike this project's per-call Gemini/Firestore usage through Phase 5).Live verification
terraform validate: passes.terraform planagainst the realscene-craft-507404project: clean, 56 resources, no errors/warnings — real credentials, real API calls, noapply.api's CORS origin ↔web's API base URL both wired to each other's Cloud Run.uri) with a documented bootstrapping variable, a well-known pattern for this exact Cloud-Run-to-Cloud-Run problem.Test plan
terraform fmt -check,terraform validateterraform plan -var-file=dev.tfvarsagainst the real project (documented above)terraform apply— deliberately deferred, seeinfra/README.mdPart 2 of 3 for Phase 6.
🤖 Generated with Claude Code