1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
# Terraform configuration for the GCP project 'tazjins-infrastructure'
provider "google" {
project = "tazjins-infrastructure"
region = "europe-north1"
version = "~> 2.20"
}
# Configure a storage bucket in which to keep Terraform state and
# other data, such as Nixery's layers.
resource "google_storage_bucket" "tazjins-data" {
name = "tazjins-data"
location = "EU"
}
terraform {
backend "gcs" {
bucket = "tazjins-data"
prefix = "terraform"
}
}
# Configure enabled APIs
resource "google_project_services" "primary" {
project = "tazjins-infrastructure"
services = [
"bigquery-json.googleapis.com",
"bigquerystorage.googleapis.com",
"cloudapis.googleapis.com",
"cloudbuild.googleapis.com",
"clouddebugger.googleapis.com",
"cloudfunctions.googleapis.com",
"cloudkms.googleapis.com",
"cloudtrace.googleapis.com",
"compute.googleapis.com",
"container.googleapis.com",
"containerregistry.googleapis.com",
"datastore.googleapis.com",
"distance-matrix-backend.googleapis.com",
"dns.googleapis.com",
"gmail.googleapis.com",
"iam.googleapis.com",
"iamcredentials.googleapis.com",
"logging.googleapis.com",
"monitoring.googleapis.com",
"oslogin.googleapis.com",
"pubsub.googleapis.com",
"run.googleapis.com",
"secretmanager.googleapis.com",
"servicemanagement.googleapis.com",
"serviceusage.googleapis.com",
"sourcerepo.googleapis.com",
"sql-component.googleapis.com",
"storage-api.googleapis.com",
"storage-component.googleapis.com",
]
}
# Configure the main Kubernetes cluster in which services are deployed
resource "google_container_cluster" "primary" {
name = "tazjin-cluster"
location = "europe-north1"
remove_default_node_pool = true
initial_node_count = 1
}
resource "google_container_node_pool" "primary_nodes" {
name = "primary-nodes"
location = "europe-north1"
cluster = google_container_cluster.primary.name
node_count = 1
node_config {
preemptible = true
machine_type = "n1-standard-2"
oauth_scopes = [
"storage-rw",
"logging-write",
"monitoring",
"https://www.googleapis.com/auth/source.read_only",
]
}
}
# Configure a service account for which GCS URL signing keys can be created.
resource "google_service_account" "nixery" {
account_id = "nixery"
display_name = "Nixery service account"
}
# Configure Cloud KMS for secret encryption
resource "google_kms_key_ring" "tazjins_keys" {
name = "tazjins-keys"
location = "europe-north1"
lifecycle {
prevent_destroy = true
}
}
resource "google_kms_crypto_key" "kontemplate_key" {
name = "kontemplate-key"
key_ring = google_kms_key_ring.tazjins_keys.id
lifecycle {
prevent_destroy = true
}
}
# Configure the git repository that contains everything.
resource "google_sourcerepo_repository" "depot" {
name = "depot"
}
|
