Something went wrong. Try again.
Tangled infrastructure definitions in Nix
Something went wrong. Try again.
5.1 kB · 174 lines
at master
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175locals { bobbin_name = "bobbin-${var.env.env_suffix}" svfe_name = "svfe-${var.env.env_suffix}"
registry = "${var.env.region}-docker.pkg.dev/${var.env.project}/${var.env.registry_name}"
service_accounts = { for svc, s in local.services : svc => s.sa }
services = { bobbin = { name = local.bobbin_name image = "${local.registry}/${local.bobbin_name}${var.env.services.bobbin.image}" sa = google_service_account.bobbin.email invokers = ["serviceAccount:${google_service_account.svfe.email}"] probe = "/_ready" cpu = "2" memory = "2Gi" min = 1 max = 1 timeout = 3600 cpu_idle = false vpc = true env = tomap(merge({ BOBBIN_BIND = "0.0.0.0:8080" BOBBIN_LOG = "info" BOBBIN_LOG_FORMAT = "json" }, var.env.services.bobbin.env)) secrets = var.env.services.bobbin.secrets public = var.env.services.bobbin.public } svfe = { name = local.svfe_name image = "${local.registry}/${local.svfe_name}${var.env.services.svfe.image}" sa = google_service_account.svfe.email invokers = [] probe = "/oauth-client-metadata.json" cpu = "1" memory = "1Gi" min = 0 max = 4 timeout = 300 cpu_idle = true vpc = false env = tomap(var.env.services.svfe.env) secrets = var.env.services.svfe.secrets public = var.env.services.svfe.public } }
robot_invoker = "serviceAccount:service-${data.google_project.this.number}@serverless-robot-prod.iam.gserviceaccount.com"
apps = merge([ for svc, s in local.services : { for cell, c in var.env.regions : "${svc}-${cell}" => { region = c.region service = merge(s, { ingress = var.env.lb ? "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER" : "INGRESS_TRAFFIC_ALL" invokers = var.env.lb ? concat(s.invokers, [local.robot_invoker]) : s.invokers vpc = s.vpc ? { network = google_compute_network.this.name subnetwork = google_compute_subnetwork.this[cell].name } : null }) } } ]...)}
data "google_project" "this" { project_id = var.env.project}
resource "google_compute_network" "this" { project = var.env.project name = var.env.network_name auto_create_subnetworks = false}
resource "google_compute_subnetwork" "this" { for_each = var.env.regions
project = var.env.project name = each.value.subnet region = each.value.region network = google_compute_network.this.id ip_cidr_range = each.value.cidr
stack_type = each.value.ipv6_access_type == null ? null : "IPV4_IPV6" ipv6_access_type = each.value.ipv6_access_type}
resource "google_artifact_registry_repository" "this" { project = var.env.project location = var.env.region repository_id = var.env.registry_name format = "DOCKER" description = var.env.registry_description
cleanup_policies { id = "keep-recent" action = "KEEP"
most_recent_versions { keep_count = var.env.registry_retention.keep } }
cleanup_policies { id = "delete-old-untagged" action = "DELETE"
condition { tag_state = "UNTAGGED" older_than = "${var.env.registry_retention.days * 86400}s" } }
# builds are tagged <env>-<sha8> and those tags never move, so without this they'd stay forever cleanup_policies { id = "delete-old-builds" action = "DELETE"
condition { tag_state = "TAGGED" tag_prefixes = ["dev-", "prod-"] older_than = "${var.env.registry_retention.days * 86400}s" } }}
resource "google_service_account" "bobbin" { project = var.env.project account_id = local.bobbin_name display_name = "${local.bobbin_name} cloud run runtime"}
resource "google_service_account" "svfe" { project = var.env.project account_id = local.svfe_name display_name = "${local.svfe_name} cloud run runtime"}
resource "google_artifact_registry_repository_iam_member" "reader" { for_each = local.service_accounts
project = var.env.project location = google_artifact_registry_repository.this.location repository = google_artifact_registry_repository.this.repository_id role = "roles/artifactregistry.reader" member = "serviceAccount:${each.value}"}
module "lb" { count = var.env.lb ? 1 : 0 source = "../lb"
project = var.env.project name = "tangled-lb"
regions = { for cell, r in var.env.regions : cell => r.region }
# the app name is cell-independent, so one cell carries it into the load balancer's service map services = { for k, s in local.services : k => module.app["${k}-${keys(var.env.regions)[0]}"].name } hostnames = var.env.hostnames}
module "app" { for_each = local.apps source = "../cloud-run-app"
project = var.env.project region = each.value.region service = each.value.service}