111 lines
3.2 KiB
HCL
111 lines
3.2 KiB
HCL
terraform {
|
|
required_version = ">= 1.6.0, < 2.0.0"
|
|
required_providers {
|
|
google = {
|
|
source = "hashicorp/google"
|
|
version = "~> 6.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "google" {
|
|
project = var.project_id
|
|
region = var.region
|
|
}
|
|
|
|
resource "google_project_service" "services" {
|
|
for_each = toset([
|
|
"run.googleapis.com", "sqladmin.googleapis.com", "pubsub.googleapis.com",
|
|
"artifactregistry.googleapis.com", "secretmanager.googleapis.com",
|
|
"logging.googleapis.com", "monitoring.googleapis.com", "cloudtrace.googleapis.com"
|
|
])
|
|
project = var.project_id
|
|
service = each.value
|
|
disable_on_destroy = false
|
|
}
|
|
|
|
resource "google_artifact_registry_repository" "images" {
|
|
location = var.region
|
|
repository_id = "${var.name}-images"
|
|
format = "DOCKER"
|
|
depends_on = [google_project_service.services]
|
|
}
|
|
|
|
resource "google_sql_database_instance" "primary" {
|
|
name = "${var.name}-sql"
|
|
database_version = "POSTGRES_15"
|
|
region = var.region
|
|
settings {
|
|
tier = var.sql_tier
|
|
availability_type = var.sql_ha ? "REGIONAL" : "ZONAL"
|
|
disk_type = "PD_SSD"
|
|
disk_autoresize = true
|
|
backup_configuration { enabled = true }
|
|
ip_configuration { ipv4_enabled = true }
|
|
}
|
|
deletion_protection = var.deletion_protection
|
|
depends_on = [google_project_service.services]
|
|
}
|
|
|
|
resource "google_sql_database" "app" {
|
|
name = var.name
|
|
instance = google_sql_database_instance.primary.name
|
|
}
|
|
|
|
resource "google_pubsub_topic" "events" { name = "${var.name}-events" }
|
|
resource "google_pubsub_topic" "dead_letter" { name = "${var.name}-dead-letter" }
|
|
|
|
resource "google_pubsub_subscription" "worker" {
|
|
name = "${var.name}-worker"
|
|
topic = google_pubsub_topic.events.name
|
|
dead_letter_policy {
|
|
dead_letter_topic = google_pubsub_topic.dead_letter.id
|
|
max_delivery_attempts = 10
|
|
}
|
|
ack_deadline_seconds = 30
|
|
}
|
|
|
|
resource "google_secret_manager_secret" "database_url" {
|
|
secret_id = "${var.name}-database-url"
|
|
replication { auto {} }
|
|
depends_on = [google_project_service.services]
|
|
}
|
|
|
|
resource "google_service_account" "runtime" {
|
|
account_id = "${var.name}-runtime"
|
|
display_name = "${var.name} runtime identity"
|
|
}
|
|
|
|
resource "google_project_iam_member" "runtime_log_writer" {
|
|
project = var.project_id
|
|
role = "roles/logging.logWriter"
|
|
member = "serviceAccount:${google_service_account.runtime.email}"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service" "api" {
|
|
name = "${var.name}-api"
|
|
location = var.region
|
|
template {
|
|
service_account = google_service_account.runtime.email
|
|
containers {
|
|
image = var.api_image
|
|
env { name = "PUBSUB_TOPIC" value = google_pubsub_topic.events.name }
|
|
env { name = "DATABASE_SECRET" value = google_secret_manager_secret.database_url.secret_id }
|
|
}
|
|
}
|
|
depends_on = [google_project_service.services]
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service" "worker" {
|
|
name = "${var.name}-worker"
|
|
location = var.region
|
|
template {
|
|
service_account = google_service_account.runtime.email
|
|
containers {
|
|
image = var.worker_image
|
|
env { name = "DATABASE_SECRET" value = google_secret_manager_secret.database_url.secret_id }
|
|
}
|
|
}
|
|
depends_on = [google_project_service.services]
|
|
}
|