@moifort/stack 0.0.0-stage → 0.1.0

package/templates/backend/infra/firestore.tf

@@ -0,0 +1,53 @@
+resource "google_firebaserules_ruleset" "firestore" {
+  provider = google-beta
+  project  = google_project.this.project_id
+
+  source {
+    files {
+      name    = "firestore.rules"
+      content = file("${path.root}/../firestore.rules")
+    }
+  }
+
+  depends_on = [google_firestore_database.default]
+}
+
+resource "google_firebaserules_release" "firestore" {
+  provider     = google-beta
+  project      = google_project.this.project_id
+  name         = "cloud.firestore"
+  ruleset_name = "projects/${google_project.this.project_id}/rulesets/${google_firebaserules_ruleset.firestore.name}"
+}
+
+locals {
+  firestore_indexes = jsondecode(file("${path.root}/../firestore.indexes.json")).indexes
+}
+
+resource "google_firestore_index" "composite" {
+  # Keyed by a stable identifier (collection + fields), not the array position, so
+  # adding or removing an index never re-keys — and therefore never destroys and
+  # recreates — the others. A position key caused a transient FAILED_PRECONDITION
+  # whenever the list changed in the middle.
+  for_each = {
+    for idx in local.firestore_indexes :
+    "${idx.collectionGroup}|${join(",", [for f in idx.fields : "${f.fieldPath}:${try(f.order, try(f.arrayConfig, "NA"))}"])}" => idx
+  }
+
+  provider    = google-beta
+  project     = google_project.this.project_id
+  database    = google_firestore_database.default.name
+  collection  = each.value.collectionGroup
+  query_scope = each.value.queryScope
+
+  # A field is indexed either by order (a scalar, ascending or descending) or by
+  # array config (`CONTAINS`, what array-contains queries need). Firestore rejects
+  # a field that declares neither, so both are read from firestore.indexes.json.
+  dynamic "fields" {
+    for_each = each.value.fields
+    content {
+      field_path   = fields.value.fieldPath
+      order        = try(fields.value.order, null)
+      array_config = try(fields.value.arrayConfig, null)
+    }
+  }
+}

package/templates/backend/infra/function.tf

@@ -0,0 +1,171 @@
+resource "google_service_account" "function" {
+  project      = google_project.this.project_id
+  account_id   = "{{APP_SLUG}}-runtime"
+  display_name = "{{APP_NAME}} runtime"
+}
+
+resource "google_project_iam_member" "function_firestore" {
+  project = google_project.this.project_id
+  role    = "roles/datastore.user"
+  member  = "serviceAccount:${google_service_account.function.email}"
+}
+
+# Deleting an account ends with deleting its Firebase Auth user, which needs
+# Firebase Authentication admin rights: without them the wipe stops at its last
+# step with "insufficient permission", every trace of data already gone.
+resource "google_project_iam_member" "function_firebase_auth" {
+  project = google_project.this.project_id
+  role    = "roles/firebaseauth.admin"
+  member  = "serviceAccount:${google_service_account.function.email}"
+}
+
+# Cloud Functions Gen 2 builds run in Cloud Build under the default Compute
+# service account. In a fresh project that role binding is not granted by
+# default, so the first deploy fails. Bound explicitly to make the bootstrap
+# deterministic.
+data "google_compute_default_service_account" "default" {
+  project    = google_project.this.project_id
+  depends_on = [google_project_service.apis]
+}
+
+resource "google_project_iam_member" "compute_default_builder" {
+  project = google_project.this.project_id
+  role    = "roles/cloudbuild.builds.builder"
+  member  = "serviceAccount:${data.google_compute_default_service_account.default.email}"
+}
+
+resource "google_secret_manager_secret_iam_member" "function" {
+  for_each  = google_secret_manager_secret.this
+  project   = google_project.this.project_id
+  secret_id = each.value.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.function.email}"
+}
+
+resource "google_storage_bucket" "source" {
+  project                     = google_project.this.project_id
+  name                        = "${google_project.this.project_id}-fn-source"
+  location                    = local.bucket_location
+  force_destroy               = true
+  uniform_bucket_level_access = true
+
+  depends_on = [google_project_service.apis]
+}
+
+data "archive_file" "source" {
+  type        = "zip"
+  source_dir  = "${path.root}/../.output/server"
+  output_path = "${path.root}/../.output/server-source.zip"
+}
+
+resource "google_storage_bucket_object" "source" {
+  name   = "source-${data.archive_file.source.output_md5}.zip"
+  bucket = google_storage_bucket.source.name
+  source = data.archive_file.source.output_path
+}
+
+resource "google_cloudfunctions2_function" "server" {
+  provider = google-beta
+  project  = google_project.this.project_id
+  name     = "{{APP_SLUG}}-server"
+  location = var.region
+
+  build_config {
+    runtime     = "nodejs22"
+    entry_point = "server"
+
+    source {
+      storage_source {
+        bucket = google_storage_bucket.source.name
+        object = google_storage_bucket_object.source.name
+      }
+    }
+  }
+
+  service_config {
+    # One whole CPU and several requests per instance: the app asks a screen's
+    # queries at once, and they mostly wait on Firestore. The globals are
+    # per-instance on purpose and the request cache lives on the event, so
+    # nothing leaks between requests.
+    available_memory                 = "512Mi"
+    available_cpu                    = "1"
+    max_instance_request_concurrency = 8
+    # Mirrors `timeoutSeconds` in nitro.config.ts, which Terraform does not read:
+    # raise both together.
+    timeout_seconds    = 60
+    max_instance_count = 100
+    # Scale to zero on purpose: cold starts are accepted, never a warm instance.
+    min_instance_count    = 0
+    service_account_email = google_service_account.function.email
+
+    environment_variables = {
+      NITRO_FIREBASE_PROJECT_ID = google_project.this.project_id
+    }
+
+    dynamic "secret_environment_variables" {
+      for_each = google_secret_manager_secret.this
+      content {
+        key        = "NITRO_${replace(upper(secret_environment_variables.key), "-", "_")}"
+        project_id = google_project.this.project_id
+        secret     = secret_environment_variables.value.secret_id
+        version    = "latest"
+      }
+    }
+  }
+
+  depends_on = [
+    google_project_iam_member.function_firestore,
+    google_project_iam_member.compute_default_builder,
+    google_secret_manager_secret_iam_member.function,
+  ]
+}
+
+# Auth is enforced inside the function (server/middleware/auth.ts verifies the
+# Firebase ID token), so the underlying Cloud Run service is publicly invokable.
+resource "google_cloud_run_service_iam_member" "invoker" {
+  project  = google_project.this.project_id
+  location = var.region
+  service  = google_cloudfunctions2_function.server.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+
+  depends_on = [google_org_policy_policy.allow_public_iam]
+}
+
+# Every deploy builds a container image into this repository, which Cloud
+# Functions creates on its first deploy and never prunes. Any image is rebuilt
+# from its commit, so only the running one and the one before are kept.
+import {
+  to = google_artifact_registry_repository.functions
+  id = "projects/${var.project_id}/locations/${var.region}/repositories/gcf-artifacts"
+}
+
+resource "google_artifact_registry_repository" "functions" {
+  project       = google_project.this.project_id
+  location      = var.region
+  repository_id = "gcf-artifacts"
+  format        = "DOCKER"
+  description   = "This repository is created and used by Cloud Functions for storing function docker images."
+
+  cleanup_policy_dry_run = false
+
+  cleanup_policies {
+    id     = "delete-every-version"
+    action = "DELETE"
+    condition {
+      tag_state = "ANY"
+    }
+  }
+
+  cleanup_policies {
+    id     = "keep-the-two-latest"
+    action = "KEEP"
+    most_recent_versions {
+      keep_count = 2
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [labels]
+  }
+}

package/templates/backend/infra/main.tf

@@ -0,0 +1,26 @@
+provider "google" {
+  project               = var.project_id
+  region                = var.region
+  billing_project       = local.quota_project
+  user_project_override = true
+}
+
+provider "google-beta" {
+  project               = var.project_id
+  region                = var.region
+  billing_project       = local.quota_project
+  user_project_override = true
+}
+
+locals {
+  quota_project = var.quota_project_id != "" ? var.quota_project_id : var.project_id
+
+  # Cloud Storage multi-region IDs are uppercase ("EU", "US", "ASIA"),
+  # while Firestore uses lowercase ("eur3", "nam5"). Map between the two
+  # so buckets can be co-located with Firestore without a separate var.
+  bucket_location = lookup(
+    { eur3 = "EU", nam5 = "US", asia1 = "ASIA" },
+    var.firestore_location,
+    var.firestore_location,
+  )
+}

package/templates/backend/infra/observer.tf

@@ -0,0 +1,18 @@
+# The organisation's read-only observer account (one for every project, living
+# in polyforms-billing) is granted viewer roles here, so the scheduled routines
+# read logs, metrics, scheduler state and Firestore without a personal login.
+# Nothing it holds can change the project.
+resource "google_project_iam_member" "observer" {
+  for_each = var.observer_service_account == "" ? toset([]) : toset([
+    "roles/logging.viewer",
+    "roles/monitoring.viewer",
+    "roles/cloudscheduler.viewer",
+    "roles/cloudfunctions.viewer",
+    "roles/run.viewer",
+    "roles/datastore.viewer",
+  ])
+
+  project = google_project.this.project_id
+  role    = each.value
+  member  = "serviceAccount:${var.observer_service_account}"
+}

package/templates/backend/infra/outputs.tf

@@ -0,0 +1,30 @@
+output "project_id" {
+  value       = google_project.this.project_id
+  description = "GCP project id"
+}
+
+output "function_url" {
+  value       = google_cloudfunctions2_function.server.service_config[0].uri
+  description = "HTTPS URL of the Cloud Function (Gen 2)"
+}
+
+output "admin_token" {
+  value       = local.admin_token_value
+  sensitive   = true
+  description = "Bearer token for /admin/* routes (used by the post-deploy migration step)"
+}
+
+output "tfstate_bucket" {
+  value       = google_storage_bucket.tfstate.name
+  description = "GCS bucket holding the Terraform state. Referenced by infra/backend.tf."
+}
+
+output "deploy_sa_email" {
+  value       = google_service_account.deploy.email
+  description = "Service account impersonated by the GitHub Actions deploy workflow (GitHub secret GCP_DEPLOY_SA)"
+}
+
+output "wif_provider" {
+  value       = google_iam_workload_identity_pool_provider.github.name
+  description = "Full resource name of the WIF provider (GitHub secret GCP_WIF_PROVIDER)"
+}

package/templates/backend/infra/project.tf

@@ -0,0 +1,64 @@
+resource "google_project" "this" {
+  name            = var.project_name
+  project_id      = var.project_id
+  org_id          = var.org_id
+  folder_id       = var.folder_id
+  billing_account = var.billing_account_id
+
+  labels = {
+    app = "{{APP_SLUG}}"
+  }
+}
+
+resource "google_project_service" "apis" {
+  for_each = toset([
+    "firebase.googleapis.com",
+    "firestore.googleapis.com",
+    "identitytoolkit.googleapis.com",
+    "cloudfunctions.googleapis.com",
+    "cloudbuild.googleapis.com",
+    "compute.googleapis.com",
+    "run.googleapis.com",
+    "artifactregistry.googleapis.com",
+    "eventarc.googleapis.com",
+    "storage.googleapis.com",
+    "secretmanager.googleapis.com",
+    "iam.googleapis.com",
+    "iamcredentials.googleapis.com",
+    "serviceusage.googleapis.com",
+    "cloudresourcemanager.googleapis.com",
+    "firebaserules.googleapis.com",
+    "orgpolicy.googleapis.com",
+    "cloudscheduler.googleapis.com",
+    "logging.googleapis.com",
+    "monitoring.googleapis.com",
+  ])
+
+  project            = google_project.this.project_id
+  service            = each.value
+  disable_on_destroy = false
+}
+
+# Many GCP organizations enforce iam.allowedPolicyMemberDomains, which blocks
+# IAM bindings to allUsers. The Cloud Run service must be publicly invokable
+# because auth is enforced inside the function (Firebase ID token verification).
+# The constraint is overridden at the project scope, never org-wide.
+resource "google_org_policy_policy" "allow_public_iam" {
+  parent = "projects/${google_project.this.project_id}"
+  name   = "projects/${google_project.this.project_id}/policies/iam.allowedPolicyMemberDomains"
+
+  spec {
+    rules {
+      allow_all = "TRUE"
+    }
+  }
+
+  depends_on = [google_project_service.apis]
+}
+
+# Org policy changes take about a minute to propagate before downstream IAM
+# bindings succeed. Without this gate the first apply fails and needs a rerun.
+resource "time_sleep" "wait_for_org_policy" {
+  depends_on      = [google_org_policy_policy.allow_public_iam]
+  create_duration = "90s"
+}

package/templates/backend/infra/scheduler.tf

@@ -0,0 +1,28 @@
+# One Cloud Scheduler job per scheduled route of the backend. A route called
+# here is idempotent (a retry neither pays twice nor notifies twice), answers
+# quickly, does its work in bounded batches, and is gated by the admin token,
+# exactly like the migration step of the Deploy workflow.
+#
+# resource "google_cloud_scheduler_job" "example" {
+#   project   = google_project.this.project_id
+#   region    = var.region
+#   name      = "example"
+#   schedule  = "0 6 * * *"
+#   time_zone = "Europe/Paris"
+#
+#   attempt_deadline = "60s"
+#
+#   retry_config {
+#     retry_count = 1
+#   }
+#
+#   http_target {
+#     http_method = "POST"
+#     uri         = "${google_cloudfunctions2_function.server.service_config[0].uri}/admin/example"
+#     headers = {
+#       Authorization = "Bearer ${local.admin_token_value}"
+#     }
+#   }
+#
+#   depends_on = [google_project_service.apis]
+# }

package/templates/backend/infra/secrets.tf

@@ -0,0 +1,44 @@
+resource "random_password" "admin_token" {
+  count   = var.admin_token == null ? 1 : 0
+  length  = 48
+  special = false
+}
+
+locals {
+  admin_token_value = var.admin_token != null ? var.admin_token : random_password.admin_token[0].result
+
+  # Every secret the function reads, by Secret Manager id. The id becomes the
+  # NITRO_* variable name (function.tf). Generated material uses `random_bytes`,
+  # never `random_id`: the latter makes the value its own id, which Terraform
+  # prints into the build log of a public repository.
+  secret_values = {
+    admin-token = local.admin_token_value
+    sentry-dsn  = var.sentry_dsn
+  }
+
+  # Secret Manager rejects empty payloads, so optional secrets are skipped when
+  # blank. Iterating a map of sensitive values would propagate sensitivity into
+  # for_each keys, which Terraform forbids, hence nonsensitive().
+  secret_ids = toset(compact([
+    "admin-token",
+    nonsensitive(var.sentry_dsn) != "" ? "sentry-dsn" : "",
+  ]))
+}
+
+resource "google_secret_manager_secret" "this" {
+  for_each  = local.secret_ids
+  project   = google_project.this.project_id
+  secret_id = each.value
+
+  replication {
+    auto {}
+  }
+
+  depends_on = [google_project_service.apis]
+}
+
+resource "google_secret_manager_secret_version" "this" {
+  for_each    = local.secret_ids
+  secret      = google_secret_manager_secret.this[each.value].id
+  secret_data = local.secret_values[each.value]
+}

package/templates/backend/infra/state.tf

@@ -0,0 +1,13 @@
+resource "google_storage_bucket" "tfstate" {
+  project                     = google_project.this.project_id
+  name                        = "${google_project.this.project_id}-tfstate"
+  location                    = local.bucket_location
+  force_destroy               = false
+  uniform_bucket_level_access = true
+
+  versioning {
+    enabled = true
+  }
+
+  depends_on = [google_project_service.apis]
+}

package/templates/backend/infra/terraform.tfvars.example

@@ -0,0 +1,16 @@
+project_id         = "{{APP_SLUG}}-polyforms"
+project_name       = "{{APP_NAME}}"
+org_id             = "123456789012"          # OR set folder_id instead
+billing_account_id = "AAAA-BBBB-CCCC-DDDD"
+region             = "europe-west3"
+firestore_location = "eur3"
+
+# Apple Sign-In (download the .p8 and the ids from https://developer.apple.com/account)
+apple_team_id          = "ABCD123456"
+apple_services_id      = "{{BUNDLE_ID}}.signin"
+apple_key_id           = "KEY1234567"
+apple_private_key_path = "./AuthKey_KEY1234567.p8"
+
+# Backend secrets
+sentry_dsn  = ""                               # optional
+# admin_token = "..."                          # optional, auto-generated if omitted

package/templates/backend/infra/variables.tf

@@ -0,0 +1,104 @@
+variable "project_id" {
+  description = "Globally unique GCP project id ({{APP_SLUG}}-polyforms)"
+  type        = string
+}
+
+variable "project_name" {
+  description = "Human-readable project name shown in the GCP console"
+  type        = string
+  default     = "{{APP_NAME}}"
+}
+
+variable "org_id" {
+  description = "GCP organization id (mutually exclusive with folder_id)"
+  type        = string
+  default     = null
+}
+
+variable "folder_id" {
+  description = "GCP folder id (mutually exclusive with org_id)"
+  type        = string
+  default     = null
+}
+
+variable "billing_account_id" {
+  description = "GCP billing account id (AAAA-BBBB-CCCC-DDDD)"
+  type        = string
+}
+
+variable "region" {
+  description = "Region for the Cloud Function (Gen 2)"
+  type        = string
+  default     = "europe-west3"
+}
+
+variable "firestore_location" {
+  description = "Firestore multi-region or region (eur3, europe-west3)"
+  type        = string
+  default     = "eur3"
+}
+
+variable "github_repo" {
+  description = "GitHub repository (owner/name) allowed to deploy via Workload Identity Federation"
+  type        = string
+  default     = "{{GITHUB_REPO}}"
+}
+
+variable "observer_service_account" {
+  description = "Email of the organisation's read-only observer account (lives in polyforms-billing). Blank grants nothing."
+  type        = string
+  default     = ""
+}
+
+variable "quota_project_id" {
+  description = <<-EOT
+    Project the provider attributes API quota to (user_project_override).
+
+    Defaults to the project being created, which is right in steady state and
+    impossible on the very first apply: the billing pre-flight calls
+    cloudbilling.googleapis.com against a project that does not exist yet.
+    Point this at an existing project for the bootstrap run, then drop it.
+  EOT
+  type        = string
+  default     = ""
+}
+
+# Apple Sign-In. All blank leaves the provider unconfigured (auth.tf).
+variable "apple_team_id" {
+  description = "Apple Developer Team ID (10 characters)"
+  type        = string
+  default     = ""
+}
+
+variable "apple_services_id" {
+  description = "Apple Sign-In Services ID (the OAuth client_id)"
+  type        = string
+  default     = ""
+}
+
+variable "apple_key_id" {
+  description = "Apple private key ID (10 characters, matches the .p8 filename)"
+  type        = string
+  default     = ""
+}
+
+variable "apple_private_key_path" {
+  description = "Path to the AuthKey_XXXXXXXXXX.p8 file from Apple Developer"
+  type        = string
+  default     = ""
+}
+
+# Backend secrets
+variable "sentry_dsn" {
+  description = "Sentry DSN of the {{APP_SLUG}}-node project (empty disables Sentry). Only ever takes effect in the deployed function."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "admin_token" {
+  description = "Bearer token guarding /admin/* routes. Auto-generated if null."
+  type        = string
+  sensitive   = true
+  default     = null
+}

package/templates/backend/infra/versions.tf

@@ -0,0 +1,30 @@
+terraform {
+  required_version = ">= 1.6"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 8.0"
+    }
+    google-beta = {
+      source  = "hashicorp/google-beta"
+      version = "~> 8.0"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "~> 2.4"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.5"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.6"
+    }
+    time = {
+      source  = "hashicorp/time"
+      version = "~> 0.14"
+    }
+  }
+}

package/templates/backend/nitro.config.ts

@@ -0,0 +1,40 @@
+export default defineNitroConfig({
+  compatibilityDate: '2026-09-14',
+  experimental: { asyncContext: true },
+  srcDir: 'server',
+  ignore: ['**/*.test.ts'],
+  preset: 'firebase',
+  firebase: {
+    gen: 2,
+    nodeVersion: '22',
+    httpsOptions: {
+      region: 'europe-west3',
+      memory: '512MiB',
+      // Only `firebase deploy` reads this block. The deploy goes through
+      // Terraform, so the ceiling that applies is `timeout_seconds` in
+      // infra/function.tf; the two are kept equal so that neither misleads.
+      timeoutSeconds: 60,
+      concurrency: 80,
+    },
+  },
+  // Rollup minifies the whole backend into one file. The maps are uploaded to
+  // Sentry at deploy time and stay out of the deployed bundle.
+  sourceMap: true,
+  rollupConfig: {
+    treeshake: {
+      moduleSideEffects: (id) => id.includes('/graphql/') || id.includes('node_modules'),
+    },
+  },
+  runtimeConfig: {
+    adminToken: '',
+    sentryDsn: '',
+    // Baked in at build time by the deploy workflow (the git SHA), so Sentry can
+    // tell which deploy an error comes from and pick the matching source maps.
+    sentryRelease: process.env.SENTRY_RELEASE ?? '',
+    devUserId: '',
+    // The project the function runs in, set by Terraform.
+    firebaseProjectId: '',
+    // Dev only: the origin the simulator reaches this server at.
+    publicBaseUrl: 'http://127.0.0.1:3000',
+  },
+})