a2c05a5d97
Breaking changes:
- infra/main.tf, variables.tf, outputs.tf, terraform.tfvars.example removed
- Single-file monolith replaced by reusable module + example
New structure:
- infra/modules/customer-instance/ — the module:
- main.tf: VMs, disks, firewall, Secret Manager, dedicated VM SA
- variables.tf: prod_instance + dev_instances flexible schema
- outputs.tf: IPs, SA email, JWT secret reference
- startup-script.sh.tpl: bootstraps VM, fetches secrets, runs compose,
adds Watchtower for auto-upgrade
- infra/examples/minimal/ — OSS self-host quickstart using the module
Supports:
- Per-customer GCP project isolation
- Branch-aware dev VMs via dev_instances list (any image_tag)
- Persistent /data disk (rebuild-safe)
- OS Login (no per-user SSH keys)
- Caddy TLS mode (opt-in via tls_mode="caddy" + domain)
- Watchtower auto-upgrade (opt-in via upgrade_mode="auto")
19 lines
588 B
HCL
19 lines
588 B
HCL
output "instance_ips" {
|
|
description = "Mapa { name => external IP }"
|
|
value = { for k, v in google_compute_address.ip : k => v.address }
|
|
}
|
|
|
|
output "prod_ip" {
|
|
description = "External IP prod instance"
|
|
value = google_compute_address.ip[var.prod_instance.name].address
|
|
}
|
|
|
|
output "vm_service_account" {
|
|
description = "Email VM SA (pro další IAM bindings, např. BigQuery)"
|
|
value = google_service_account.vm.email
|
|
}
|
|
|
|
output "jwt_secret_name" {
|
|
description = "Plný název JWT secretu v Secret Manageru"
|
|
value = google_secret_manager_secret.jwt.name
|
|
}
|