about summary refs log tree commit diff
path: root/ops/infra/gcp/default.tf
blob: 2cb57836fa6dc1aa90ad08a95fb75ee7e9ee7cb7 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
# Terraform configuration for the GCP project 'tazjins-infrastructure'

provider "google" {
  project = "tazjins-infrastructure"
  region  = "europe-north1"
}

# Configure a storage bucket in which to keep Terraform state and
# other data, such as Nixery's layers.
resource "google_storage_bucket" "tazjins-data" {
  name     = "tazjins-data"
  location = "EU"
}

terraform {
  backend "gcs" {
    bucket = "tazjins-data"
    prefix = "terraform"
  }
}

# Configure enabled APIs
resource "google_project_services" "primary" {
  project = "tazjins-infrastructure"
  services = [
    "bigquery-json.googleapis.com",
    "bigquerystorage.googleapis.com",
    "cloudapis.googleapis.com",
    "clouddebugger.googleapis.com",
    "cloudfunctions.googleapis.com",
    "cloudkms.googleapis.com",
    "cloudtrace.googleapis.com",
    "compute.googleapis.com",
    "container.googleapis.com",
    "containerregistry.googleapis.com",
    "datastore.googleapis.com",
    "dns.googleapis.com",
    "iam.googleapis.com",
    "iamcredentials.googleapis.com",
    "logging.googleapis.com",
    "monitoring.googleapis.com",
    "oslogin.googleapis.com",
    "pubsub.googleapis.com",
    "run.googleapis.com",
    "servicemanagement.googleapis.com",
    "serviceusage.googleapis.com",
    "sourcerepo.googleapis.com",
    "sql-component.googleapis.com",
    "storage-api.googleapis.com",
    "storage-component.googleapis.com",
  ]
}


# Configure the main Kubernetes cluster in which services are deployed
resource "google_container_cluster" "primary" {
  name     = "tazjin-cluster"
  location = "europe-north1"

  remove_default_node_pool = true
  initial_node_count       = 1
}

resource "google_container_node_pool" "primary_nodes" {
  name       = "primary-nodes"
  location   = "europe-north1"
  cluster    = google_container_cluster.primary.name
  node_count = 1

  node_config {
    preemptible  = true
    machine_type = "n1-standard-2"

    oauth_scopes = [
      "storage-rw",
      "logging-write",
      "monitoring",
      "https://www.googleapis.com/auth/source.read_only",
    ]
  }
}

# Configure a service account for which GCS URL signing keys can be created.
resource "google_service_account" "nixery" {
  account_id   = "nixery"
  display_name = "Nixery service account"
}

# Configure Cloud KMS for secret encryption
resource "google_kms_key_ring" "tazjins_keys" {
  name     = "tazjins-keys"
  location = "europe-north1"

  lifecycle {
    prevent_destroy = true
  }
}

resource "google_kms_crypto_key" "kontemplate_key" {
  name     = "kontemplate-key"
  key_ring = google_kms_key_ring.tazjins_keys.id

  lifecycle {
    prevent_destroy = true
  }
}

# Configure the git repository that contains everything.
resource "google_sourcerepo_repository" "depot" {
  name = "depot"
}