Skip to content

Commit bfc352c

Browse files
author
Florentin CHAUSSOY
committed
feat(api-1973): add 'deployments' folder
1 parent de87bee commit bfc352c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+1410
-47
lines changed

‎.circleci/config.yml‎

Lines changed: 358 additions & 47 deletions
Large diffs are not rendered by default.

‎deployments/modules/dependencies/apis.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resource "google_project_service" "apis" {
2+
for_each = toset(var.google_project_services)
3+
project = var.project_id
4+
service = each.key
5+
disable_dependent_services = true
6+
}

‎deployments/modules/dependencies/artifact-registry.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
resource "google_artifact_registry_repository" "docker" {
2+
provider = google-beta
3+
project = var.project_id
4+
5+
location = var.docker_registry_location
6+
repository_id = var.docker_registry_id
7+
description = "Docker Registry"
8+
format = "DOCKER"
9+
10+
depends_on = [
11+
google_project_service.apis,
12+
]
13+
}
14+
15+
resource "google_artifact_registry_repository_iam_member" "main_docker_iam" {
16+
provider = google-beta
17+
project = var.project_id
18+
19+
location = google_artifact_registry_repository.docker.location
20+
repository = google_artifact_registry_repository.docker.name
21+
role = "roles/artifactregistry.writer"
22+
member = "serviceAccount:main-service-account@${var.project_id}.iam.gserviceaccount.com"
23+
24+
depends_on = [
25+
google_artifact_registry_repository.docker,
26+
]
27+
}

‎deployments/modules/dependencies/dns.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
resource "google_dns_managed_zone" "project_zone" {
2+
name = "api-${var.stage}-${var.dns_managed_zone}"
3+
dns_name = "api-${var.stage}.${replace(var.dns_managed_zone, "-", ".")}."
4+
description = "api-${var.stage} DNS zone"
5+
project = var.project_id
6+
7+
dnssec_config {
8+
state = "on"
9+
}
10+
11+
depends_on = [
12+
google_project_service.dns,
13+
]
14+
}
15+
16+
resource "google_project_service" "dns" {
17+
project = var.project_id
18+
service = "dns.googleapis.com"
19+
disable_dependent_services = true
20+
}

‎deployments/modules/dependencies/monitoring.tf‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# terraform {
2+
# required_providers {
3+
# datadog = {
4+
# source = "datadog/datadog"
5+
# }
6+
# }
7+
# }
8+
9+
# data "google_secret_manager_secret_version" "datadog_api_key" {
10+
# secret = "datadog-api-key"
11+
# project = var.project_id
12+
# }
13+
14+
# data "google_secret_manager_secret_version" "datadog_app_key" {
15+
# secret = "datadog-app-key"
16+
# project = var.project_id
17+
# }
18+
19+
# provider "datadog" {
20+
# app_key = data.google_secret_manager_secret_version.datadog_app_key.secret_data
21+
# api_key = data.google_secret_manager_secret_version.datadog_api_key.secret_data
22+
# api_url = "https://api.datadoghq.eu/"
23+
# }
24+
25+
# resource "datadog_integration_gcp" "gcp_project_integration" {
26+
# project_id = var.project_id
27+
# private_key_id = jsondecode(base64decode(google_service_account_key.datadog_monitoring.private_key))["private_key_id"]
28+
# private_key = jsondecode(base64decode(google_service_account_key.datadog_monitoring.private_key))["private_key"]
29+
# client_email = google_service_account.datadog_gcp_integration.email
30+
# client_id = google_service_account.datadog_gcp_integration.unique_id
31+
# }
32+
33+
# resource "google_service_account" "datadog_gcp_integration" {
34+
# account_id = "appstore-datadog-sa"
35+
# project = var.project_id
36+
# display_name = "Datadog <> Google Cloud integration service account"
37+
# }
38+
39+
# resource "google_service_account_key" "datadog_monitoring" {
40+
# service_account_id = google_service_account.datadog_gcp_integration.name
41+
# public_key_type = "TYPE_X509_PEM_FILE"
42+
# }
43+
44+
# resource "google_logging_project_sink" "log-export-sink" {
45+
# name = "appstore-datadog-log-sink"
46+
# destination = module.datadog_pubsub_destination.destination_uri
47+
# project = var.project_id
48+
# filter = "resource.type=workflows.googleapis.com/Workflow OR resource.type=cloud_run_revision"
49+
# unique_writer_identity = true
50+
# }
51+
52+
# module "datadog_pubsub_destination" {
53+
# source = "terraform-google-modules/log-export/google//modules/pubsub"
54+
# create_push_subscriber = true
55+
# create_subscriber = false
56+
# log_sink_writer_identity = "serviceAccount:${google_service_account.datadog_gcp_integration.email}"
57+
# project_id = var.project_id
58+
# push_endpoint = "https://gcp-intake.logs.datadoghq.eu/v1/input/${data.google_secret_manager_secret_version.datadog_api_key.secret_data}/"
59+
# topic_name = "datadog-sink"
60+
# }
61+
62+
# resource "datadog_logs_custom_pipeline" "appstore_cloud_run" {
63+
# filter {
64+
# query = "project_id:${var.project_id} source:(\"gcp.cloud.run.revision\" OR \"gcp.workflows.googleapis.com/workflow\")"
65+
# }
66+
# name = "${var.project_id} appstore cloud run logs processor"
67+
# is_enabled = true
68+
# processor {
69+
# status_remapper {
70+
# sources = ["data.severity", "data.jsonPayload.level_name", "data.jsonPayload.level"]
71+
# name = "Retrieve status from cloud run logs"
72+
# is_enabled = true
73+
# }
74+
# }
75+
# processor {
76+
# date_remapper {
77+
# sources = ["data.timestamp"]
78+
# name = "Retrieve timestamp from cloud run logs"
79+
# is_enabled = true
80+
# }
81+
# }
82+
# processor {
83+
# message_remapper {
84+
# sources = ["data.jsonPayload.msg", "data.jsonPayload.message"]
85+
# name = "JSON Payload as log official message"
86+
# is_enabled = true
87+
# }
88+
# }
89+
90+
# }
91+
92+
# resource "google_project_iam_member" "datadog_compute_viewer" {
93+
# project = var.project_id
94+
# role = "roles/compute.viewer"
95+
# member = "serviceAccount:${google_service_account.datadog_gcp_integration.email}"
96+
# }
97+
98+
# resource "google_project_iam_member" "datadog_monitoring_viewer" {
99+
# project = var.project_id
100+
# role = "roles/monitoring.viewer"
101+
# member = "serviceAccount:${google_service_account.datadog_gcp_integration.email}"
102+
# }
103+
104+
# resource "google_project_iam_member" "datadog_cloudasset_viewer" {
105+
# project = var.project_id
106+
# role = "roles/cloudasset.viewer"
107+
# member = "serviceAccount:${google_service_account.datadog_gcp_integration.email}"
108+
# }
109+
110+
# resource "google_project_iam_member" "sink_publisher" {
111+
# project = var.project_id
112+
# role = "roles/pubsub.publisher"
113+
# member = google_logging_project_sink.log-export-sink.writer_identity
114+
# }

‎deployments/modules/dependencies/variables.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
variable "project_id" {
2+
type = string
3+
description = "Project ID"
4+
}
5+
6+
variable "region" {
7+
type = string
8+
description = "Region"
9+
}
10+
11+
variable "stage" {
12+
type = string
13+
description = "Stage"
14+
}
15+
16+
variable "dns_managed_zone" {
17+
type = string
18+
description = "DNS Managed Zone"
19+
}
20+
21+
variable "docker_registry_id" {
22+
type = string
23+
description = "Docker Registry ID"
24+
}
25+
26+
variable "docker_registry_location" {
27+
type = string
28+
description = "Docker Registry Location"
29+
}
30+
31+
variable "google_project_services" {
32+
type = list(string)
33+
description = "List of all google project APIs to activate"
34+
default = [
35+
"container.googleapis.com",
36+
"monitoring.googleapis.com",
37+
"logging.googleapis.com",
38+
"servicenetworking.googleapis.com",
39+
"artifactregistry.googleapis.com",
40+
"run.googleapis.com",
41+
"secretmanager.googleapis.com",
42+
]
43+
}
44+
45+
data "google_project" "project" {
46+
project_id = var.project_id
47+
}
48+
49+
locals {
50+
project_number = data.google_project.project.number
51+
}

‎deployments/modules/services/main.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
module "storage" {
2+
source = "./storage"
3+
project_id = var.project_id
4+
prefix = var.prefix
5+
stage = var.stage
6+
app_version = var.app_version
7+
pull_request = var.pull_request
8+
pull_request_id = var.pull_request_id
9+
}
10+
11+
module "networking" {
12+
source = "./networking"
13+
project_id = var.project_id
14+
region = var.region
15+
prefix = var.prefix
16+
bucket_name = module.storage.bucket_name
17+
dns_managed_zone = var.dns_managed_zone
18+
domains = var.domains
19+
stage = var.stage
20+
pull_request = var.pull_request
21+
pull_request_id = var.pull_request_id
22+
23+
depends_on = [
24+
module.storage
25+
]
26+
}

‎deployments/modules/services/networking/backend-bucket.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resource "google_compute_backend_bucket" "front" {
2+
name = "${local.context}-bb"
3+
description = "Contains static files"
4+
bucket_name = var.bucket_name
5+
enable_cdn = true
6+
}

‎deployments/modules/services/networking/dns.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
resource "google_dns_record_set" "public" {
2+
name = "${local.public_project_level_fqdn[0]}."
3+
managed_zone = "api-${var.stage}-${var.dns_managed_zone}"
4+
type = "A"
5+
ttl = 300
6+
project = var.project_id
7+
8+
rrdatas = [google_compute_global_address.default.address]
9+
10+
depends_on = [
11+
google_compute_global_address.default
12+
]
13+
}

‎deployments/modules/services/networking/load-balancer.tf‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
resource "google_compute_global_address" "default" {
2+
name = "${local.context}-ip"
3+
}
4+
5+
resource "google_compute_url_map" "default" {
6+
name = "${local.context}-https-lb"
7+
default_service = google_compute_backend_bucket.front.id
8+
}
9+
10+
resource "google_compute_url_map" "https_redirect" {
11+
name = "${local.context}-https-redirect"
12+
13+
default_url_redirect {
14+
https_redirect = true
15+
redirect_response_code = "MOVED_PERMANENTLY_DEFAULT"
16+
strip_query = false
17+
}
18+
}
19+
20+
resource "google_compute_managed_ssl_certificate" "default" {
21+
name = "${local.context}-cert"
22+
23+
managed {
24+
domains = local.public_domains
25+
}
26+
}
27+
28+
resource "google_compute_target_https_proxy" "default" {
29+
name = "${local.context}-https-lb-proxy"
30+
url_map = google_compute_url_map.default.id
31+
ssl_certificates = [google_compute_managed_ssl_certificate.default.id]
32+
}
33+
34+
resource "google_compute_target_http_proxy" "https_redirect" {
35+
name = "${local.context}-http-lb-proxy"
36+
url_map = google_compute_url_map.https_redirect.id
37+
}
38+
39+
resource "google_compute_global_forwarding_rule" "https_redirect" {
40+
name = "${local.context}-http-lb-forwarding-rule"
41+
ip_protocol = "TCP"
42+
load_balancing_scheme = "EXTERNAL"
43+
port_range = "80"
44+
target = google_compute_target_http_proxy.https_redirect.id
45+
ip_address = google_compute_global_address.default.id
46+
}
47+
48+
resource "google_compute_global_forwarding_rule" "default" {
49+
name = "${local.context}-https-lb-forwarding-rule"
50+
ip_protocol = "TCP"
51+
load_balancing_scheme = "EXTERNAL"
52+
port_range = "443"
53+
target = google_compute_target_https_proxy.default.id
54+
ip_address = google_compute_global_address.default.id
55+
}

0 commit comments

Comments
 (0)