Added GCP service base module

Author: dylanratcliffe

.terraform.lock.hcl

@@ -250,12 +250,73 @@ module "agm_talk" {
   source = "./modules/agm-talk"
 }
 
-# Simple GCS bucket to validate GCP provider connectivity in CI
-resource "google_storage_bucket" "test" {
-  name                        = "${var.gcp_project_id}-tf-test"
-  location                    = var.gcp_region
-  force_destroy               = true
-  uniform_bucket_level_access = true
+# =============================================================================
+# GCP Platform Infrastructure
+# Shared VPC and alerting owned by the platform team. Service teams deploy
+# into this network via their own wrapper modules below.
+# =============================================================================
+
+resource "google_compute_network" "platform" {
+  name                    = "platform-services"
+  auto_create_subnetworks = false
+  project                 = var.gcp_project_id
+}
+
+resource "google_compute_subnetwork" "platform" {
+  name          = "platform-europe-west2"
+  ip_cidr_range = "10.10.0.0/24"
+  region        = var.gcp_region
+  network       = google_compute_network.platform.id
+  project       = var.gcp_project_id
+}
+
+resource "google_compute_firewall" "platform_ssh" {
+  name        = "platform-allow-ssh-iap"
+  network     = google_compute_network.platform.id
+  project     = var.gcp_project_id
+  description = "Allow SSH via Identity-Aware Proxy for instance management"
+
+  allow {
+    protocol = "tcp"
+    ports    = ["22"]
+  }
+
+  source_ranges = ["35.235.240.0/20"]
+  target_tags   = ["allow-ssh"]
+}
+
+resource "google_pubsub_topic" "platform_alerts" {
+  name    = "platform-alerts"
+  project = var.gcp_project_id
+
+  labels = {
+    environment = "production"
+    managed-by  = "terraform"
+  }
+}
+
+# =============================================================================
+# Service Deployments (each team owns their wrapper module)
+# =============================================================================
+
+module "payments_service" {
+  source = "./modules/gcp-service-payments"
+
+  network     = google_compute_network.platform.id
+  subnet      = google_compute_subnetwork.platform.id
+  project_id  = var.gcp_project_id
+  region      = var.gcp_region
+  alert_topic = google_pubsub_topic.platform_alerts.id
+}
+
+module "inventory_service" {
+  source = "./modules/gcp-service-inventory"
+
+  network     = google_compute_network.platform.id
+  subnet      = google_compute_subnetwork.platform.id
+  project_id  = var.gcp_project_id
+  region      = var.gcp_region
+  alert_topic = google_pubsub_topic.platform_alerts.id
 }
 
 module "api_access" {

main.tf

@@ -0,0 +1,143 @@
+data "google_compute_image" "debian" {
+  family  = "debian-12"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance" "service" {
+  name         = var.service_name
+  machine_type = "e2-micro"
+  zone         = "${var.region}-b"
+  project      = var.project_id
+
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.debian.self_link
+    }
+  }
+
+  network_interface {
+    network    = var.network
+    subnetwork = var.subnet
+  }
+
+  tags = [var.service_name, "allow-ssh"]
+
+  metadata_startup_script = <<-EOF
+    #!/bin/bash
+    cat > /opt/health_server.py << 'PY'
+    from http.server import BaseHTTPRequestHandler, HTTPServer
+
+    class Handler(BaseHTTPRequestHandler):
+        def do_GET(self):
+            if self.path in ("/health", "/healthz", "/"):
+                self.send_response(200)
+                self.send_header("Content-Type", "text/plain")
+                self.end_headers()
+                self.wfile.write(b"ok\n")
+                return
+            self.send_response(404)
+            self.end_headers()
+
+        def log_message(self, format, *args):
+            return
+
+    if __name__ == "__main__":
+        HTTPServer(("0.0.0.0", 9090), Handler).serve_forever()
+    PY
+    nohup python3 /opt/health_server.py &
+  EOF
+
+  labels = {
+    service     = var.service_name
+    environment = "production"
+    team        = var.team
+    managed-by  = "terraform"
+  }
+}
+
+# Service ingress — allows application and health-check traffic from internal ranges.
+# target_tags binds this rule to instances carrying the service_name tag.
+resource "google_compute_firewall" "service_ingress" {
+  name        = "${var.service_name}-ingress"
+  network     = var.network
+  project     = var.project_id
+  description = "Allow ${var.service_name} traffic on service and health-check ports"
+
+  allow {
+    protocol = "tcp"
+    ports    = [tostring(var.service_port), "9090"]
+  }
+
+  source_ranges = var.allowed_source_ranges
+  target_tags   = [var.service_name]
+}
+
+# Dedicated rule for Google Cloud health-check probes (source ranges are fixed
+# Google-owned prefixes). Also targets by service_name tag.
+resource "google_compute_firewall" "health_check" {
+  name        = "${var.service_name}-health-check"
+  network     = var.network
+  project     = var.project_id
+  description = "Allow Google Cloud health-check probes to ${var.service_name}"
+
+  allow {
+    protocol = "tcp"
+    ports    = ["9090"]
+  }
+
+  source_ranges = ["35.191.0.0/16", "130.211.0.0/22"]
+  target_tags   = [var.service_name]
+}
+
+resource "google_compute_health_check" "service" {
+  name    = "${var.service_name}-health"
+  project = var.project_id
+
+  tcp_health_check {
+    port = 9090
+  }
+
+  check_interval_sec  = 10
+  timeout_sec         = 5
+  healthy_threshold   = 2
+  unhealthy_threshold = 3
+}
+
+resource "google_monitoring_notification_channel" "oncall" {
+  display_name = "${var.service_name} On-Call (${var.team})"
+  type         = "pubsub"
+  project      = var.project_id
+
+  labels = {
+    topic = var.alert_topic
+  }
+}
+
+resource "google_monitoring_alert_policy" "health" {
+  display_name = "${var.service_name} Health Check Failed"
+  combiner     = "OR"
+  project      = var.project_id
+
+  conditions {
+    display_name = "${var.service_name} Instance Not Running"
+
+    condition_threshold {
+      filter          = "resource.type = \"gce_instance\" AND resource.labels.instance_id = \"${google_compute_instance.service.instance_id}\" AND metric.type = \"compute.googleapis.com/instance/uptime\""
+      comparison      = "COMPARISON_LT"
+      threshold_value = 1
+      duration        = "300s"
+
+      aggregations {
+        alignment_period   = "300s"
+        per_series_aligner = "ALIGN_RATE"
+      }
+    }
+  }
+
+  notification_channels = [google_monitoring_notification_channel.oncall.id]
+
+  user_labels = {
+    service = var.service_name
+    team    = var.team
+  }
+}

modules/gcp-service-base/main.tf

@@ -0,0 +1,34 @@
+output "instance_name" {
+  description = "Name of the service instance"
+  value       = google_compute_instance.service.name
+}
+
+output "instance_id" {
+  description = "Server-assigned instance ID"
+  value       = google_compute_instance.service.instance_id
+}
+
+output "instance_internal_ip" {
+  description = "Internal IP address of the service instance"
+  value       = google_compute_instance.service.network_interface[0].network_ip
+}
+
+output "firewall_rule_name" {
+  description = "Name of the service ingress firewall rule"
+  value       = google_compute_firewall.service_ingress.name
+}
+
+output "health_check_firewall_name" {
+  description = "Name of the health-check probe firewall rule"
+  value       = google_compute_firewall.health_check.name
+}
+
+output "health_check_name" {
+  description = "Name of the TCP health check"
+  value       = google_compute_health_check.service.name
+}
+
+output "alert_policy_name" {
+  description = "Display name of the monitoring alert policy"
+  value       = google_monitoring_alert_policy.health.display_name
+}

modules/gcp-service-base/outputs.tf

@@ -0,0 +1,45 @@
+variable "service_name" {
+  description = "Name of the service — used for resource naming and GCE network tags"
+  type        = string
+}
+
+variable "service_port" {
+  description = "Primary port the service listens on"
+  type        = number
+}
+
+variable "allowed_source_ranges" {
+  description = "CIDR ranges allowed to reach the service"
+  type        = list(string)
+  default     = ["10.0.0.0/8"]
+}
+
+variable "network" {
+  description = "VPC network self_link or ID"
+  type        = string
+}
+
+variable "subnet" {
+  description = "Subnetwork self_link or ID"
+  type        = string
+}
+
+variable "project_id" {
+  description = "GCP project ID"
+  type        = string
+}
+
+variable "region" {
+  description = "GCP region for regional resources"
+  type        = string
+}
+
+variable "team" {
+  description = "Team identifier for labels and alert routing"
+  type        = string
+}
+
+variable "alert_topic" {
+  description = "Full Pub/Sub topic ID (projects/{project}/topics/{name}) for alert notifications"
+  type        = string
+}

modules/gcp-service-base/variables.tf

@@ -0,0 +1,22 @@
+module "base" {
+  source = "../gcp-service-base"
+
+  service_name = "inventory-api"
+  service_port = 8080
+  network      = var.network
+  subnet       = var.subnet
+  project_id   = var.project_id
+  region       = var.region
+  team         = "inventory"
+  alert_topic  = var.alert_topic
+}
+
+resource "google_pubsub_topic" "stock_events" {
+  name    = "inventory-stock-events"
+  project = var.project_id
+
+  labels = {
+    service = "inventory-api"
+    team    = "inventory"
+  }
+}

modules/gcp-service-inventory/main.tf

@@ -0,0 +1,24 @@
+output "instance_name" {
+  description = "Name of the inventory API instance"
+  value       = module.base.instance_name
+}
+
+output "instance_internal_ip" {
+  description = "Internal IP of the inventory API instance"
+  value       = module.base.instance_internal_ip
+}
+
+output "firewall_rule_name" {
+  description = "Name of the inventory ingress firewall rule"
+  value       = module.base.firewall_rule_name
+}
+
+output "health_check_name" {
+  description = "Name of the inventory health check"
+  value       = module.base.health_check_name
+}
+
+output "stock_events_topic" {
+  description = "Pub/Sub topic for inventory stock events"
+  value       = google_pubsub_topic.stock_events.name
+}

modules/gcp-service-inventory/outputs.tf

@@ -0,0 +1,24 @@
+variable "network" {
+  description = "VPC network self_link or ID"
+  type        = string
+}
+
+variable "subnet" {
+  description = "Subnetwork self_link or ID"
+  type        = string
+}
+
+variable "project_id" {
+  description = "GCP project ID"
+  type        = string
+}
+
+variable "region" {
+  description = "GCP region"
+  type        = string
+}
+
+variable "alert_topic" {
+  description = "Full Pub/Sub topic ID for alert notifications"
+  type        = string
+}