wip for release

sanspace · sanspace · commit 0541c067aaa1 · 2026-05-24T08:48:33.000Z
diff --git a/deploy.sh b/deploy.sh
diff --git a/frontend/.gitignore b/frontend/.gitignore
@@ -5,6 +5,8 @@
 !environment.ts
 !environment.prod.ts
 proxy.conf.json
+public/assets/config.json
+
 
 # Compiled output
 /dist
diff --git a/frontend/public/assets/config.json.example b/frontend/public/assets/config.json.example
@@ -0,0 +1,15 @@
+{
+  "production": true,
+  "isLocal": false,
+  "backendURL": "https://cstudio-backend-dev.mydomain.com/api",
+  "GOOGLE_CLIENT_ID": "your-oauth-web-client-id-here.apps.googleusercontent.com",
+  "firebase": {
+    "apiKey": "your-firebase-api-key",
+    "authDomain": "your-firebase-auth-domain.firebaseapp.com",
+    "projectId": "your-firebase-project-id",
+    "storageBucket": "your-firebase-storage-bucket.appspot.com",
+    "messagingSenderId": "your-firebase-messaging-sender-id",
+    "appId": "your-firebase-web-app-id",
+    "measurementId": "your-google-analytics-measurement-id"
+  }
+}
diff --git a/infrastructure/.terraform.lock.hcl b/infrastructure/.terraform.lock.hcl
diff --git a/infrastructure/app.tf b/infrastructure/app.tf
@@ -21,7 +21,7 @@ module "compute" {
   vpc_subnet_name = module.network.cloud_run_subnet_name
   database_ip     = module.database.private_ip_address
   image_url       = "${module.artifact.repository_url}/${var.backend_image_name}:${var.backend_image_tag}"
-  
+
   # References the list keys to configure secret environment block mappings
-  secret_ids      = var.application_secrets
+  secret_ids = var.application_secrets
 }
diff --git a/infrastructure/data.tf b/infrastructure/data.tf
@@ -6,8 +6,8 @@ module "database" {
   region          = var.region
   resource_prefix = var.resource_prefix
   environment     = var.environment
-  
-  vpc_id          = module.network.network_id
+
+  vpc_id = module.network.network_id
 
   # Guardrail: Explicitly wait for Private Services Access peering to 
   # finish provisioning before kicking off database creation.
@@ -54,11 +54,15 @@ resource "google_secret_manager_secret" "app_secrets" {
   secret_id = each.key
 
   replication {
-    automatic = true
+    user_managed {
+      replicas {
+        location = var.region # restricted to the infra region
+      }
+    }
   }
 
   labels = merge(var.labels, {
-    component = "security"
+    component  = "security"
     managed_by = "terraform"
   })
 }
@@ -70,7 +74,7 @@ resource "google_secret_manager_secret_iam_member" "backend_accessor" {
   project   = google_secret_manager_secret.app_secrets[each.key].project
   secret_id = google_secret_manager_secret.app_secrets[each.key].secret_id
   role      = "roles/secretmanager.secretAccessor"
-  
+
   # References backend module's service account output dynamically
-  member    = "serviceAccount:${module.compute.service_account_email}"
+  member = "serviceAccount:${module.compute.service_account_email}"
 }
diff --git a/infrastructure/hosting.tf b/infrastructure/hosting.tf
@@ -2,15 +2,15 @@
 # Creates the Firebase Hosting site to deploy to
 resource "google_firebase_hosting_site" "frontend" {
   provider = google-beta
-  project  = var.firebase_project_id
+  project  = var.project_id
   site_id  = var.firebase_site_id
 }
 
 # Conditionally map the Custom Domain if provided
 resource "google_firebase_hosting_custom_domain" "custom_domain" {
   provider = google-beta
   # Evaluates to 1 if a domain string is provided, 0 if left blank
-  count    = var.custom_domain != "" ? 1 : 0
+  count = var.custom_domain != "" ? 1 : 0
 
   project       = var.project_id
   site_id       = google_firebase_hosting_site.frontend.site_id
diff --git a/infrastructure/modules/artifact/main.tf b/infrastructure/modules/artifact/main.tf
@@ -5,10 +5,10 @@ resource "google_artifact_registry_repository" "ghcr_proxy" {
   repository_id = "${var.resource_prefix}-${var.environment}-${var.repository_id}"
   description   = "Regional proxy for GHCR with vulnerability scanning"
   format        = "DOCKER"
-  
+
   # Remote Repository Mode
   mode = "REMOTE_REPOSITORY"
-  
+
   remote_repository_config {
     description = "Proxy for GitHub Container Registry"
     docker_repository {
@@ -24,7 +24,7 @@ resource "google_artifact_registry_repository" "ghcr_proxy" {
   vulnerability_scanning_config {
     enablement_config = "INHERITED" # Inherits project-level scan settings
   }
-  
+
   # Cost Guardrail: Automatically purge cached layers unaccessed for 30 days
   cleanup_policies {
     id     = "delete-stale-cache"
diff --git a/infrastructure/modules/compute/main.tf b/infrastructure/modules/compute/main.tf
@@ -1,3 +1,17 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 locals {
 
   # The format requires: REGION-docker.pkg.dev / PROJECT_ID / PROXY_REPO_ID / GH_ORG / GH_REPO / IMAGE_NAME
diff --git a/infrastructure/modules/database/main.tf b/infrastructure/modules/database/main.tf
@@ -13,7 +13,7 @@ resource "random_id" "db_name_suffix" {
 resource "google_secret_manager_secret" "db_secret" {
   secret_id = "${var.resource_prefix}-${var.environment}-db-password"
   project   = var.project_id
-  
+
   replication {
     user_managed {
       replicas {
@@ -25,41 +25,41 @@ resource "google_secret_manager_secret" "db_secret" {
 
 resource "google_secret_manager_secret_version" "db_secret_version" {
   secret = google_secret_manager_secret.db_secret.id
-  
+
   # Using a write-only argument prevents the password 
   # from being captured in the terraform.tfstate file.
   secret_data_wo = ephemeral.random_password.db_pass.result
 }
 
 resource "google_sql_database_instance" "default" {
   name             = "${var.resource_prefix}-${var.environment}-db-${random_id.db_name_suffix.hex}"
-  database_version = var.database_version 
+  database_version = var.database_version
   region           = var.region
   project          = var.project_id
 
   # Ensure networking PSA is established before instance creation
   depends_on = [var.psa_connection_dependency]
 
   settings {
-    tier = var.db_tier # "db-perf-optimized-N-2"
+    tier              = var.db_tier # "db-perf-optimized-N-2"
     availability_type = var.db_availability_type
-    
+
     # Enable IAM Authentication for better security
     database_flags {
       name  = "cloudsql.iam_authentication"
       value = "on"
     }
 
     # --- Storage Flexibility ---
-    disk_type              = "PD_SSD"
-    disk_size              = var.initial_disk_size
-    disk_autoresize        = true           # Allows growth as needed
-    disk_autoresize_limit  = var.max_disk_size # Prevents unlimited expansion/billing surprises
+    disk_type             = "PD_SSD"
+    disk_size             = var.initial_disk_size
+    disk_autoresize       = true              # Allows growth as needed
+    disk_autoresize_limit = var.max_disk_size # Prevents unlimited expansion/billing surprises
 
     backup_configuration {
       enabled                        = true
       point_in_time_recovery_enabled = true
-      location                       = var.region 
+      location                       = var.region
     }
 
     # --- Network Isolation ---
@@ -72,18 +72,18 @@ resource "google_sql_database_instance" "default" {
     # --- Enterprise Metadata ---
     # Merges common labels (from root) with module-specific labels
     user_labels = merge(var.labels, {
-      component = "database"
+      component  = "database"
       managed_by = "terraform"
-      region = var.region
+      region     = var.region
     })
-    
+
   }
-  
+
   deletion_protection = var.deletion_protection
 
   lifecycle {
     # Prevent accidental destruction of production data
-    prevent_destroy = false 
+    prevent_destroy = false
     # Ignore disk_size changes if auto-resize has grown the disk beyond the TF value
     ignore_changes = [settings[0].disk_size]
   }
@@ -99,9 +99,9 @@ resource "google_sql_user" "app_user" {
   name     = var.db_user
   instance = google_sql_database_instance.default.name
   project  = var.project_id
-  
+
   # We read the ephemeral value while creating the DB user,
   # keeping the DB state clean of plaintext passwords.
-  password_wo = ephemeral.random_password.db_pass.result
+  password_wo         = ephemeral.random_password.db_pass.result
   password_wo_version = var.db_password_version
 }
diff --git a/infrastructure/modules/gateway/main.tf b/infrastructure/modules/gateway/main.tf
@@ -61,9 +61,9 @@ module "lb-http" {
   version = "~> 12.0" # Always pin versions for production stability
 
   project = var.project_id
-  
+
   # Dynamic base name to safely isolate multi-tenant/customer deployments
-  name    = "${var.resource_prefix}-${var.environment}-lb"
+  name = "${var.resource_prefix}-${var.environment}-lb"
 
   # SSL Configuration (Mandatory Production Custom Domain Setup)
   ssl                             = true
@@ -78,7 +78,7 @@ module "lb-http" {
           group = var.serverless_neg_id
         }
       ]
-      
+
       # Correct parameter mapping for v12.0 caching rules
       enable_cdn      = var.enable_cdn
       security_policy = google_compute_security_policy.policy.name
diff --git a/infrastructure/modules/network/main.tf b/infrastructure/modules/network/main.tf
@@ -9,12 +9,12 @@ resource "google_compute_network" "vpc" {
 # --- Subnet for Cloud Run Direct VPC Egress ---
 # Cloud Run requires a dedicated subnet to inject private traffic into the VPC.
 resource "google_compute_subnetwork" "cloud_run_subnet" {
-  name                     = "${var.resource_prefix}-${var.environment}-run-subnet"
-  project                  = var.project_id
-  network                  = google_compute_network.vpc.id
-  region                   = var.region
-  ip_cidr_range            = var.cloud_run_cidr
-  
+  name          = "${var.resource_prefix}-${var.environment}-run-subnet"
+  project       = var.project_id
+  network       = google_compute_network.vpc.id
+  region        = var.region
+  ip_cidr_range = var.cloud_run_cidr
+
   # Crucial enterprise guardrail: allows internal routing to Google APIs without public IPs
   private_ip_google_access = true
 }
@@ -48,7 +48,7 @@ resource "google_compute_firewall" "allow_internal_egress" {
   allow {
     protocol = "tcp"
   }
-  
+
   allow {
     protocol = "udp"
   }
diff --git a/infrastructure/network.tf b/infrastructure/network.tf
@@ -11,11 +11,11 @@ module "network" {
 module "gateway" {
   source = "./modules/gateway"
 
-  project_id        = var.project_id
-  resource_prefix   = var.resource_prefix
-  environment       = var.environment
-  domain_name       = var.domain_name
-  
+  project_id      = var.project_id
+  resource_prefix = var.resource_prefix
+  environment     = var.environment
+  domain_name     = var.domain_name
+
   # Connects the serverless NEG exposed from the compute bundle
   serverless_neg_id = module.compute.serverless_neg_id
 }
diff --git a/infrastructure/outputs.tf b/infrastructure/outputs.tf
@@ -6,3 +6,40 @@ output "firebase_dns_verification_records" {
   ) : null
 }
 
+output "cloud_sql_connection_name" {
+  description = "The connection name of the Cloud SQL instance."
+  value       = module.database.instance_connection_name
+}
+
+output "db_name" {
+  description = "The name of the database."
+  value       = module.database.database_name
+}
+
+output "db_user" {
+  description = "The database user name."
+  value       = module.database.user_name
+}
+
+output "db_secret_id" {
+  description = "Secret Manager secret ID for DB Password."
+  value       = module.database.secret_id
+}
+
+output "frontend_service_url" {
+  description = "The default Firebase Hosting URL."
+  value       = "https://${google_firebase_hosting_site.frontend.site_id}.web.app"
+}
+
+output "backend_service_url" {
+  description = "The URL of the backend service."
+  value       = module.compute.service_uri
+}
+
+output "cloud_run_subnet_name" {
+  description = "The subnet name allocated for Cloud Run Direct VPC Egress."
+  value       = module.network.cloud_run_subnet_name
+}
+
+
+
diff --git a/infrastructure/variables.tf b/infrastructure/variables.tf
