921094ae40
Critical fixes: - C1: VM SA now gets secretmanager.secretAccessor only on specific secrets (JWT + each entry in runtime_secrets). Previously project-wide. - C3: chmod 640 on /var/log/agnes-startup.log (defense in depth) - C4: Remove '|| echo ""' fallback on keboola-storage-token — boot now fails loudly if the secret is missing instead of starting a broken app. - C5: Cron auto-upgrade script sources /opt/agnes/.env for AGNES_TAG. If an operator edits .env to pin a specific stable-YYYY.MM.N, cron picks it up immediately with no drift. Removed AGNES_TAG from crontab entry. - C7: explicit depends_on = [IAM bindings, secret_version] on VM — prevents race where VM boots before IAM propagates. Important fixes: - I1: Split firewall into web (80/443 + conditional 8000) and ssh (port 22 with configurable source_ranges, default IAP range only). - I4: Fetch docker-compose files from compose_ref (default 'main'), so customers can pin a specific tag for reproducibility. - I5+I6: Merge order fixed — user-supplied dev_instances values now override defaults (was the other way around). Dev tls_mode default flipped to 'none'. - I7: Remove '|| true' on Caddyfile fetch; surface failures loudly. - New acme_email variable (falls back to seed_admin_email if empty). Out-of-module: - Comments translated from Czech to English where applicable (M1).
108 lines
3.3 KiB
HCL
108 lines
3.3 KiB
HCL
variable "gcp_project_id" {
|
|
description = "GCP project ID kde bude instance nasazená"
|
|
type = string
|
|
}
|
|
|
|
variable "region" {
|
|
description = "GCP region"
|
|
type = string
|
|
default = "europe-west1"
|
|
}
|
|
|
|
variable "zone" {
|
|
description = "GCP zone"
|
|
type = string
|
|
default = "europe-west1-b"
|
|
}
|
|
|
|
variable "customer_name" {
|
|
description = "Krátký identifikátor zákazníka (např. keboola, grpn). Použije se v prefixu resourců."
|
|
type = string
|
|
validation {
|
|
condition = can(regex("^[a-z][a-z0-9-]{1,20}$", var.customer_name))
|
|
error_message = "customer_name musí být lowercase, začínat písmenem, 2-21 znaků."
|
|
}
|
|
}
|
|
|
|
variable "prod_instance" {
|
|
description = "Prod VM konfigurace"
|
|
type = object({
|
|
name = string
|
|
machine_type = optional(string, "e2-small")
|
|
disk_size_gb = optional(number, 30)
|
|
data_disk_gb = optional(number, 50)
|
|
image_tag = optional(string, "stable")
|
|
upgrade_mode = optional(string, "auto")
|
|
tls_mode = optional(string, "caddy")
|
|
domain = optional(string, "")
|
|
})
|
|
}
|
|
|
|
variable "dev_instances" {
|
|
description = "Seznam dev VMs. Prázdné pole = žádné dev VMs."
|
|
type = list(object({
|
|
name = string
|
|
machine_type = optional(string, "e2-small")
|
|
image_tag = optional(string, "dev")
|
|
}))
|
|
default = []
|
|
}
|
|
|
|
variable "seed_admin_email" {
|
|
description = "Email prvního admin usera"
|
|
type = string
|
|
}
|
|
|
|
variable "data_source" {
|
|
description = "Typ data source — keboola | bigquery | csv"
|
|
type = string
|
|
default = "keboola"
|
|
}
|
|
|
|
variable "keboola_stack_url" {
|
|
description = "Keboola Stack URL (pokud data_source = keboola)"
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "image_repo" {
|
|
description = "Docker image repo"
|
|
type = string
|
|
default = "ghcr.io/keboola/agnes-the-ai-analyst"
|
|
}
|
|
|
|
variable "compose_ref" {
|
|
description = "Git ref to fetch docker-compose.yml and overlays from (in keboola/agnes-the-ai-analyst). Use `main` for latest, or a tag like `stable-2026.04.47` for reproducibility."
|
|
type = string
|
|
default = "main"
|
|
}
|
|
|
|
variable "enable_monitoring" {
|
|
description = "Create uptime checks + alert policies for each VM. Requires notification_channel_ids to be useful."
|
|
type = bool
|
|
default = true
|
|
}
|
|
|
|
variable "notification_channel_ids" {
|
|
description = "Full resource IDs of GCP Monitoring notification channels (create in customer project via gcloud alpha monitoring channels create). Empty list = alerts fire but nothing is notified."
|
|
type = list(string)
|
|
default = []
|
|
}
|
|
|
|
variable "runtime_secrets" {
|
|
description = "Names of existing Secret Manager secrets the VM needs to read at runtime (e.g. Keboola Storage token). VM SA gets scoped secretAccessor on each."
|
|
type = list(string)
|
|
default = ["keboola-storage-token"]
|
|
}
|
|
|
|
variable "firewall_ssh_source_ranges" {
|
|
description = "CIDR ranges allowed to reach SSH (port 22). Default is IAP tunnel range only (use `gcloud compute ssh --tunnel-through-iap`). Override to `[\"0.0.0.0/0\"]` for unrestricted (not recommended)."
|
|
type = list(string)
|
|
default = ["35.235.240.0/20"]
|
|
}
|
|
|
|
variable "acme_email" {
|
|
description = "Email for Let's Encrypt account (used when tls_mode=caddy). Defaults to seed_admin_email if empty."
|
|
type = string
|
|
default = ""
|
|
}
|