Something went wrong. Try again.
Tangled infrastructure definitions in Nix
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163locals { endpoints = merge([ for svc, name in var.services : { for cell, region in var.regions : "${svc}-${cell}" => { service = name region = region } } ]...)}
resource "google_compute_region_network_endpoint_group" "this" { for_each = local.endpoints
project = var.project name = "${each.key}-neg" region = each.value.region network_endpoint_type = "SERVERLESS"
cloud_run { service = each.value.service }}
resource "google_compute_backend_service" "this" { for_each = var.services
project = var.project name = each.value load_balancing_scheme = "EXTERNAL_MANAGED"
dynamic "backend" { for_each = var.regions content { group = google_compute_region_network_endpoint_group.this["${each.key}-${backend.key}"].id } }}
resource "google_compute_url_map" "this" { for_each = var.services
project = var.project name = "${var.name}-${each.key}" default_service = google_compute_backend_service.this[each.key].id}
# a service with a hostname is served over https with a google-managed cert. dns# authorization lets the cert issue before the name points here, so a cutover has no gaplocals { https = { for svc, host in var.hostnames : svc => host if contains(keys(var.services), svc) }}
resource "google_certificate_manager_dns_authorization" "this" { for_each = local.https
project = var.project name = "${var.name}-${each.key}" domain = each.value}
resource "google_certificate_manager_certificate" "this" { for_each = local.https
project = var.project name = "${var.name}-${each.key}"
managed { domains = [each.value] dns_authorizations = [google_certificate_manager_dns_authorization.this[each.key].id] }}
resource "google_certificate_manager_certificate_map" "this" { for_each = local.https
project = var.project name = "${var.name}-${each.key}"}
resource "google_certificate_manager_certificate_map_entry" "this" { for_each = local.https
project = var.project name = "${var.name}-${each.key}" map = google_certificate_manager_certificate_map.this[each.key].name hostname = each.value certificates = [google_certificate_manager_certificate.this[each.key].id]}
resource "google_compute_url_map" "to_https" { for_each = local.https
project = var.project name = "${var.name}-${each.key}-to-https"
default_url_redirect { https_redirect = true redirect_response_code = "MOVED_PERMANENTLY_DEFAULT" strip_query = false }}
resource "google_compute_target_http_proxy" "this" { for_each = var.services
project = var.project name = "${var.name}-${each.key}" url_map = contains(keys(local.https), each.key) ? google_compute_url_map.to_https[each.key].id : google_compute_url_map.this[each.key].id}
resource "google_compute_target_https_proxy" "this" { for_each = local.https
project = var.project name = "${var.name}-${each.key}" url_map = google_compute_url_map.this[each.key].id certificate_map = "//certificatemanager.googleapis.com/${google_certificate_manager_certificate_map.this[each.key].id}"}
resource "google_compute_global_address" "this" { for_each = var.services
project = var.project name = "${var.name}-${each.key}"}
resource "google_compute_global_forwarding_rule" "this" { for_each = var.services
project = var.project name = "${var.name}-${each.key}" ip_address = google_compute_global_address.this[each.key].id port_range = "80" target = google_compute_target_http_proxy.this[each.key].id load_balancing_scheme = "EXTERNAL_MANAGED"}
resource "google_compute_global_forwarding_rule" "https" { for_each = local.https
project = var.project name = "${var.name}-${each.key}-https" ip_address = google_compute_global_address.this[each.key].id port_range = "443" target = google_compute_target_https_proxy.this[each.key].id load_balancing_scheme = "EXTERNAL_MANAGED"}
output "ips" { value = { for k, a in google_compute_global_address.this : k => a.address }}
output "dns_records" { description = "what the dns zone needs: the address, and the record that lets the cert issue" value = { for svc, host in local.https : svc => { a = { name = host, value = google_compute_global_address.this[svc].address } challenge = one(google_certificate_manager_dns_authorization.this[svc].dns_resource_record) } }}