@moifort/stack 0.0.0-stage → 0.1.0

package/templates/backend/.env.example

@@ -0,0 +1,10 @@
+# Bearer token guarding /admin/* (migrations, scheduled routes). Any string locally.
+NITRO_ADMIN_TOKEN=your-admin-token
+# Sentry DSN of the <app>-node project. Blank disables reporting; never set in dev.
+NITRO_SENTRY_DSN=
+# Sentry user auth token, for the local error triage tooling only (read + resolve
+# issues through the REST API). Not a runtime setting.
+SENTRY_AUTH_TOKEN=
+# Dev-only: the Firebase UID the auth bypass signs requests as, so Apollo Sandbox
+# works without a token.
+NITRO_DEV_USER_ID=

package/templates/backend/.github/workflows/deploy.yml

@@ -0,0 +1,151 @@
+name: Deploy
+
+# Every push to main redeploys, except one that touches only the landing page,
+# the docs or the captures: none of them reaches the backend, and the Pages
+# workflow publishes the site on its own. The backend is never applied from a
+# workstation: the Terraform state lives in GCS and this job is its only writer.
+# A pull request labelled `staging` deploys its branch to the staging project.
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - 'site/**'
+      - 'docs/**'
+      - 'screenshots/**'
+      - 'README.md'
+      - 'CLAUDE.md'
+  pull_request:
+    types: [labeled, synchronize]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write   # required for Workload Identity Federation
+
+# The Terraform state takes a lock, so two applies at once do not interleave.
+# Queue the runs instead of racing them, and never cancel one mid-apply.
+concurrency:
+  group: deploy-${{ github.event_name == 'pull_request' && 'staging' || 'production' }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: 🚀 Backend (${{ github.event_name == 'pull_request' && 'staging' || 'production' }})
+    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'staging')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      # One workspace per environment: the staging project is the same Terraform
+      # with its own state prefix and variables.
+      TF_WORKSPACE: ${{ github.event_name == 'pull_request' && 'staging' || 'default' }}
+      PROJECT_ID: ${{ github.event_name == 'pull_request' && vars.GCP_STAGING_PROJECT_ID || vars.GCP_PROJECT_ID }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0   # sentry-cli reads the commit history to attach it to the release
+
+      # A missing secret reaches Terraform as an empty string, not as null: an unset
+      # ADMIN_TOKEN would leave /admin/* unguarded. Fail before anything is applied.
+      - name: Check the deploy secrets are set
+        env:
+          GCP_WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER }}
+          GCP_DEPLOY_SA: ${{ secrets.GCP_DEPLOY_SA }}
+          GCP_BILLING_ACCOUNT: ${{ secrets.GCP_BILLING_ACCOUNT }}
+          ADMIN_TOKEN: ${{ secrets.ADMIN_TOKEN }}
+          GCP_ORG_ID: ${{ vars.GCP_ORG_ID }}
+        run: |
+          missing=0
+          for name in GCP_WIF_PROVIDER GCP_DEPLOY_SA GCP_BILLING_ACCOUNT ADMIN_TOKEN GCP_ORG_ID PROJECT_ID; do
+            if [ -z "${!name}" ]; then
+              echo "::error::$name is not set"
+              missing=1
+            fi
+          done
+          exit "$missing"
+
+      - uses: oven-sh/setup-bun@v2
+      - uses: hashicorp/setup-terraform@v4
+        with:
+          terraform_version: v1.16.6
+
+      - name: Authenticate to Google Cloud (workload identity)
+        uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
+          service_account: ${{ secrets.GCP_DEPLOY_SA }}
+
+      - name: Build the Nitro bundle (firebase preset)
+        env:
+          # Baked into the bundle, so every error Sentry receives says which
+          # deploy produced it and which source maps decode it.
+          SENTRY_RELEASE: {{APP_SLUG}}-node@${{ github.sha }}
+        run: |
+          bun install --frozen-lockfile
+          bun run generate:assets
+          bunx nitro prepare
+          bun run generate:graphql
+          bun run build
+
+      # The update screen sends every build below the floor to the App Store: a floor
+      # above the build on sale would block users with nothing to install.
+      - name: Check the build floor is on the App Store
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+        run: bun scripts/deprecations.ts check-floor
+
+      - name: Upload the source maps to Sentry
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: polyforms
+          SENTRY_PROJECT: {{APP_SLUG}}-node
+          SENTRY_RELEASE: {{APP_SLUG}}-node@${{ github.sha }}
+        run: |
+          set -euo pipefail
+          if [ -n "$SENTRY_AUTH_TOKEN" ]; then
+            curl -sL https://sentry.io/get-cli/ | bash
+            sentry-cli releases new "$SENTRY_RELEASE"
+            sentry-cli sourcemaps inject .output/server
+            sentry-cli sourcemaps upload --release "$SENTRY_RELEASE" .output/server
+            sentry-cli releases set-commits "$SENTRY_RELEASE" --local --ignore-missing
+            sentry-cli releases finalize "$SENTRY_RELEASE"
+          else
+            echo "::warning::SENTRY_AUTH_TOKEN is unset, deploying without source maps"
+          fi
+          # The maps themselves never ship: Terraform zips this directory as-is.
+          find .output/server -name '*.map' -delete
+
+      - name: Materialize terraform.tfvars from GitHub secrets
+        run: |
+          set -euo pipefail
+          printf '%s' "${{ secrets.APPLE_PRIVATE_KEY_P8 }}" > infra/apple.p8
+          chmod 600 infra/apple.p8
+          cat > infra/terraform.tfvars <<EOF
+          project_id               = "${PROJECT_ID}"
+          billing_account_id       = "${{ secrets.GCP_BILLING_ACCOUNT }}"
+          org_id                   = "${{ vars.GCP_ORG_ID }}"
+          region                   = "europe-west3"
+          firestore_location       = "eur3"
+          apple_team_id            = "${{ secrets.APPLE_TEAM_ID }}"
+          apple_services_id        = "${{ secrets.APPLE_SERVICES_ID }}"
+          apple_key_id             = "${{ secrets.APPLE_KEY_ID }}"
+          apple_private_key_path   = "${{ secrets.APPLE_PRIVATE_KEY_P8 != '' && './apple.p8' || '' }}"
+          sentry_dsn               = "${{ secrets.SENTRY_DSN }}"
+          admin_token              = "${{ secrets.ADMIN_TOKEN }}"
+          observer_service_account = "${{ vars.OBSERVER_SERVICE_ACCOUNT }}"
+          EOF
+
+      - name: Terraform init + apply
+        working-directory: infra
+        run: |
+          terraform init -input=false
+          terraform apply -auto-approve -input=false
+
+      - name: Run Firestore migrations
+        working-directory: infra
+        run: |
+          URL=$(terraform output -raw function_url)
+          curl -fsS -X POST \
+            -H "Authorization: Bearer ${{ secrets.ADMIN_TOKEN }}" \
+            "${URL}/admin/migrate"

package/templates/backend/.github/workflows/schema.yml

@@ -0,0 +1,59 @@
+name: Schema
+
+# A field or an argument leaves the GraphQL schema only after it was deprecated:
+# builds on the App Store may still ask for anything else. See docs/api-evolution.md.
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - 'site/**'
+      - 'docs/**'
+      - 'screenshots/**'
+      - 'README.md'
+      - 'CLAUDE.md'
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - 'site/**'
+      - 'docs/**'
+      - 'screenshots/**'
+      - 'README.md'
+      - 'CLAUDE.md'
+
+# A newer push to the same branch, or to the same pull request, makes this run
+# pointless: it is cancelled rather than left to use a runner for nothing. Keyed on
+# the workflow file and the ref, since the three test workflows share one name.
+concurrency:
+  group: ${{ github.workflow_ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  breaking:
+    name: 🧬 No breaking change without deprecation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0   # the diff reads the schema at the base commit
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install --frozen-lockfile
+      # The base is what main held before this push, or the target of the pull request.
+      # A first push has no before (all zeros): there is nothing to compare against.
+      - name: Compare the schema with its base
+        env:
+          BEFORE: ${{ github.event.before }}
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          set -euo pipefail
+          if [ -n "$BASE_REF" ]; then
+            base="origin/$BASE_REF"
+          elif [ -z "${BEFORE//0/}" ]; then
+            echo "No previous commit to compare with"
+            exit 0
+          else
+            base="$BEFORE"
+          fi
+          SCHEMA_BASE="$base" bun run schema:check

package/templates/backend/.github/workflows/test-feat.yml

@@ -0,0 +1,40 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - 'site/**'
+      - 'docs/**'
+      - 'screenshots/**'
+      - 'README.md'
+      - 'CLAUDE.md'
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - 'site/**'
+      - 'docs/**'
+      - 'screenshots/**'
+      - 'README.md'
+      - 'CLAUDE.md'
+
+# A newer push to the same branch, or to the same pull request, makes this run
+# pointless: it is cancelled rather than left to use a runner for nothing. Keyed on
+# the workflow file and the ref, since the three test workflows share one name.
+concurrency:
+  group: ${{ github.workflow_ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  feat:
+    name: 🎯 Feature
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install --frozen-lockfile
+      - run: bunx nitro prepare
+      - run: bun test .feat.test

package/templates/backend/.github/workflows/test-int.yml

@@ -0,0 +1,40 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - 'site/**'
+      - 'docs/**'
+      - 'screenshots/**'
+      - 'README.md'
+      - 'CLAUDE.md'
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - 'site/**'
+      - 'docs/**'
+      - 'screenshots/**'
+      - 'README.md'
+      - 'CLAUDE.md'
+
+# A newer push to the same branch, or to the same pull request, makes this run
+# pointless: it is cancelled rather than left to use a runner for nothing. Keyed on
+# the workflow file and the ref, since the three test workflows share one name.
+concurrency:
+  group: ${{ github.workflow_ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  int:
+    name: 🔗 Integration
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install --frozen-lockfile
+      - run: bunx nitro prepare
+      - run: bun test .int.test

package/templates/backend/.github/workflows/test-unit.yml

@@ -0,0 +1,64 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - 'site/**'
+      - 'docs/**'
+      - 'screenshots/**'
+      - 'README.md'
+      - 'CLAUDE.md'
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - 'site/**'
+      - 'docs/**'
+      - 'screenshots/**'
+      - 'README.md'
+      - 'CLAUDE.md'
+
+# A newer push to the same branch, or to the same pull request, makes this run
+# pointless: it is cancelled rather than left to use a runner for nothing. Keyed on
+# the workflow file and the ref, since the three test workflows share one name.
+concurrency:
+  group: ${{ github.workflow_ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  unit:
+    name: 🧪 Unit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install --frozen-lockfile
+      - run: bunx nitro prepare
+      - run: bun tsc --noEmit
+      - run: bunx biome check
+      - run: bun test .unit.test
+
+  # Guard: the Cloud Function build on GCP runs `npm install` (strict peer deps)
+  # on the package.json Nitro generates in .output/server. bun is lenient about
+  # peer deps, so an incompatible bump passes locally and only fails at
+  # `terraform apply`. This reproduces that resolution here so it fails fast.
+  deploy-deps:
+    name: 📦 Prod deps (npm strict)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - run: bun install --frozen-lockfile
+      - run: bun run build
+      - name: Validate generated function deps under npm (strict peer deps)
+        working-directory: .output/server
+        # --dry-run builds the full dependency tree (so ERESOLVE peer-dep
+        # conflicts still surface) without the reify/write step, which avoids an
+        # unrelated npm arborist crash ("fsTop") on the runner.
+        run: npm install --dry-run --ignore-scripts

package/templates/backend/docs/api-evolution.md

@@ -0,0 +1,67 @@
+# API evolution — deprecation and forced update
+
+The GraphQL schema is not versioned. Builds of the app stay installed for weeks after a
+release, so the schema only ever grows, and what the app stops using leaves it in two steps:
+first deprecated, then removed once a build without it has been on the App Store for two
+weeks — and in that same commit, the builds that still ask for it are sent to update.
+
+The design is [the deprecation routine spec](superpowers/specs/2026-09-27-deprecation-routine-design.md).
+
+## Moving parts
+
+| Piece | File |
+|---|---|
+| Build floor and App Store URL | `server/system/app-support.ts` (`MINIMUM_SUPPORTED_IOS_BUILD`) |
+| Public config route (`GET /app-config`) | `server/routes/app-config.get.ts`, whitelisted in `server/middleware/auth.ts` |
+| Launch and foreground check, fail-open, skipped in Debug | `ios/{{APP_NAME}}/Shared/Services/AppSupportGate.swift` |
+| Blocking screen | `ios/{{APP_NAME}}/Shared/Components/UpdateRequiredView.swift`, wired in `AuthRoot.swift` |
+| What can go, and the floor to set | `scripts/deprecations.ts` (`bun run deprecations`) |
+| No breaking change without deprecation | `bun run schema:check`, the Schema workflow |
+| The floor never outruns the App Store | `bun scripts/deprecations.ts check-floor`, in the Deploy workflow |
+
+The comparison key is the build number (`CFBundleVersion`), which CI sets to
+`git rev-list --count HEAD`: it names a commit and only grows, nightly or App Store alike.
+Never the marketing version.
+
+## What breaks an installed build
+
+Removing or renaming a field, an argument or an input field; changing a type; making an
+argument or an input field required; making a non-null output field nullable. Adding a field,
+a query, a mutation, an optional argument or an enum value does not — the app reads an enum
+value it does not know as a neutral one (`Book+GraphQL.swift`).
+
+## The routine
+
+1. **Deprecate, in the commit where the app stops asking.** The iOS operations
+   (`ios/**/*.graphql`) stop selecting the field or argument, and the server marks it with
+   `deprecationReason`, naming what replaces it. The resolver keeps working.
+2. **At every App Store release, ask what can go:** `bun run deprecations` (with
+   `ASC_KEY_ID`, `ASC_ISSUER_ID` and `ASC_KEY_PATH` set to the team key). For each deprecated
+   element it finds, in git, the first build whose operations no longer select it, and
+   compares it with the build on sale:
+   - **removable** — a build without it has been on the App Store for fourteen days, counted
+     from the `ios-v<version>` tag; or no build ever asked for it;
+   - **in grace until `<date>`** — on sale, not for fourteen days yet;
+   - **waiting for a release** — the App Store still sells a build that asks for it;
+   - **still asked by the app** — an operation at `HEAD` selects it;
+   - **check by hand** — an input field or an enum value, which the operations cannot show:
+     Swift fills inputs through variables, and enum values travel in responses.
+3. **Remove, in one commit:** the removable elements — schema, resolver, the code and tests
+   only they used — and `MINIMUM_SUPPORTED_IOS_BUILD` set to the floor the script proposes.
+   The Deploy workflow ships both together; an older build shows the update screen at its next
+   launch or return to the foreground.
+
+## Guards
+
+- `bun run schema:check` compares `shared/schema.graphql` with `origin/main` (or
+  `SCHEMA_BASE`) through `graphql-inspector`. It fails on any breaking change except the
+  removal of a field or an argument that was deprecated — the second through
+  `scripts/deprecations/inspector-rule.ts`, since the built-in rule spares fields only.
+- `check-floor` fails the deploy when the floor is above the build on sale: readers would be
+  blocked with no update to install. A floor of `1` passes without calling Apple.
+
+## Fail-open
+
+If `/app-config` is unreachable or undecodable, the app stays usable. A build that slips past
+the gate meets GraphQL errors until its next check — never lock readers out because the check
+itself failed.

package/templates/backend/firebase.json

@@ -0,0 +1,21 @@
+{
+  "firestore": {
+    "rules": "firestore.rules",
+    "indexes": "firestore.indexes.json"
+  },
+  "functions": [
+    {
+      "source": ".output/server",
+      "codebase": "server",
+      "runtime": "nodejs22",
+      "ignore": ["node_modules"]
+    }
+  ],
+  "emulators": {
+    "auth": { "port": 9099 },
+    "functions": { "port": 5001 },
+    "firestore": { "port": 8080 },
+    "ui": { "enabled": true, "port": 4000 },
+    "singleProjectMode": true
+  }
+}

package/templates/backend/firestore.indexes.json

@@ -0,0 +1,4 @@
+{
+  "indexes": [],
+  "fieldOverrides": []
+}

package/templates/backend/firestore.rules

@@ -0,0 +1,11 @@
+rules_version = '2';
+
+// All Firestore access goes through Cloud Functions (Application Default
+// Credentials bypass these rules). Direct client access is denied.
+service cloud.firestore {
+  match /databases/{database}/documents {
+    match /{document=**} {
+      allow read, write: if false;
+    }
+  }
+}

package/templates/backend/infra/auth.tf

@@ -0,0 +1,54 @@
+locals {
+  apple_sign_in_configured = var.apple_services_id != "" && var.apple_key_id != "" && var.apple_private_key_path != ""
+}
+
+resource "google_identity_platform_config" "this" {
+  provider                   = google-beta
+  project                    = google_project.this.project_id
+  autodelete_anonymous_users = false
+
+  sign_in {
+    allow_duplicate_emails = false
+
+    email {
+      enabled           = false
+      password_required = false
+    }
+
+    anonymous {
+      enabled = false
+    }
+  }
+
+  depends_on = [google_firebase_project.this]
+}
+
+# Apple Sign-In, configured as a built-in (default supported) provider.
+# The iOS SDK calls OAuthProvider.appleCredential(...) which targets the
+# provider id "apple.com", so a custom OIDC config (oidc.apple.com) would
+# never be matched and produces "identity provider configuration is not
+# found" at runtime.
+#
+# Identity Platform accepts the Apple key material as a JSON-encoded
+# client_secret; it generates the OAuth JWT internally on each sign-in.
+resource "google_identity_platform_default_supported_idp_config" "apple" {
+  # Skipped entirely when the Apple credentials are blank. The provider cannot be
+  # half-configured: Identity Platform rejects an empty client_id, and a resource
+  # created with placeholder key material would fail at the first sign-in rather
+  # than at apply time, which is the worse place to find out.
+  count = local.apple_sign_in_configured ? 1 : 0
+
+  provider  = google-beta
+  project   = google_project.this.project_id
+  enabled   = true
+  idp_id    = "apple.com"
+  client_id = var.apple_services_id
+
+  client_secret = jsonencode({
+    teamId     = var.apple_team_id
+    keyId      = var.apple_key_id
+    privateKey = file(var.apple_private_key_path)
+  })
+
+  depends_on = [google_identity_platform_config.this]
+}

package/templates/backend/infra/backend.tf

@@ -0,0 +1,6 @@
+terraform {
+  backend "gcs" {
+    bucket = "{{APP_SLUG}}-polyforms-tfstate"
+    prefix = "{{APP_SLUG}}"
+  }
+}

package/templates/backend/infra/cicd.tf

@@ -0,0 +1,63 @@
+# Workload Identity Federation: lets the GitHub Actions deploy workflow
+# authenticate to GCP without a long-lived service account key. The flow is:
+#
+#   1. GitHub Actions exchanges its OIDC token at the WIF provider below.
+#   2. GCP returns a short-lived token that impersonates the deploy SA.
+#   3. Terraform runs apply against this project as that SA.
+#
+# Outputs (deploy_sa_email + wif_provider) are surfaced through outputs.tf
+# so they can be copied into GitHub secrets after a fresh bootstrap.
+
+resource "google_service_account" "deploy" {
+  project      = google_project.this.project_id
+  account_id   = "{{APP_SLUG}}-deploy"
+  display_name = "{{APP_NAME}} GitHub Actions deploy"
+}
+
+# Project-scoped owner: the deploy workflow runs `terraform apply`, which
+# touches every resource in this project (project services, IAM, Cloud Run,
+# Functions, Firestore, Secret Manager, GCS, org policy). Owner is the
+# simplest contract that survives future resource additions; the impact is
+# bounded because the binding is on a single project, not the org.
+resource "google_project_iam_member" "deploy_owner" {
+  project = google_project.this.project_id
+  role    = "roles/owner"
+  member  = "serviceAccount:${google_service_account.deploy.email}"
+}
+
+resource "google_iam_workload_identity_pool" "github" {
+  project                   = google_project.this.project_id
+  workload_identity_pool_id = "github"
+  display_name              = "GitHub Actions"
+  description               = "OIDC federation for GitHub-hosted runners"
+
+  depends_on = [google_project_service.apis]
+}
+
+resource "google_iam_workload_identity_pool_provider" "github" {
+  project                            = google_project.this.project_id
+  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
+  workload_identity_pool_provider_id = "github-actions"
+  display_name                       = "GitHub OIDC"
+
+  attribute_mapping = {
+    "google.subject"       = "assertion.sub"
+    "attribute.actor"      = "assertion.actor"
+    "attribute.repository" = "assertion.repository"
+    "attribute.ref"        = "assertion.ref"
+  }
+
+  # Mandatory since 2023: scope the provider to a single repository so that
+  # a leaked workflow on another repo cannot impersonate the deploy SA.
+  attribute_condition = "assertion.repository == '${var.github_repo}'"
+
+  oidc {
+    issuer_uri = "https://token.actions.githubusercontent.com"
+  }
+}
+
+resource "google_service_account_iam_member" "deploy_wif_user" {
+  service_account_id = google_service_account.deploy.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository/${var.github_repo}"
+}

package/templates/backend/infra/firebase.tf

@@ -0,0 +1,26 @@
+resource "google_firebase_project" "this" {
+  provider = google-beta
+  project  = google_project.this.project_id
+
+  depends_on = [google_project_service.apis]
+}
+
+resource "google_firestore_database" "default" {
+  provider                    = google-beta
+  project                     = google_project.this.project_id
+  name                        = "(default)"
+  location_id                 = var.firestore_location
+  type                        = "FIRESTORE_NATIVE"
+  concurrency_mode            = "OPTIMISTIC"
+  app_engine_integration_mode = "DISABLED"
+
+  # A console click or a stray script cannot delete the database: protection must be
+  # turned off first, on purpose.
+  delete_protection_state = "DELETE_PROTECTION_ENABLED"
+
+  # Keeps every document version for seven days, readable and restorable to the minute,
+  # so a failed migration or a bug that overwrites books can be undone.
+  point_in_time_recovery_enablement = "POINT_IN_TIME_RECOVERY_ENABLED"
+
+  depends_on = [google_firebase_project.this]
+}