OSVauco/infrastructure/terraform/main.tf

provider "google" {
  project = var.project_id
  region  = var.region
}

resource "google_project_service" "apis" {
  for_each = toset([
    "aiplatform.googleapis.com",
    "storage.googleapis.com",
    "cloudbilling.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "iam.googleapis.com",
    "run.googleapis.com",
    "artifactregistry.googleapis.com",
    "cloudbuild.googleapis.com",
    "cloudbuildv2.googleapis.com",
    "secretmanager.googleapis.com",
    "monitoring.googleapis.com",
    "logging.googleapis.com",
    "cloudtrace.googleapis.com",
    "pubsub.googleapis.com",
    "cloudfunctions.googleapis.com",
  ])
  service                    = each.key
  disable_dependent_services = true
}

resource "google_service_account" "agent_sa" {
  account_id   = "osvauco-agent-sa"
  display_name = "OSVauco Agent Runner SA"
}

resource "google_project_iam_member" "agent_sa_roles" {
  for_each = toset([
    "roles/aiplatform.user",
    "roles/storage.objectAdmin",
    "roles/logging.logWriter",
    "roles/cloudtrace.agent",
    "roles/monitoring.metricWriter",
    "roles/secretmanager.secretAccessor",
    "roles/run.invoker",
  ])
  project = var.project_id
  role    = each.key
  member  = "serviceAccount:${google_service_account.agent_sa.email}"
}

resource "google_pubsub_topic" "billing_alerts" {
  name = "billing-alert-auto-teardown"
}

resource "google_storage_bucket" "agent_staging" {
  name          = "${var.project_id}-agent-staging"
  location      = var.region
  force_destroy = true // Set to true for ephemeral staging buckets

  lifecycle_rule {
    action {
      type = "Delete"
    }
    condition {
      age = 7
    }
  }
}

resource "google_billing_budget" "prod_budget" {
  billing_account = var.billing_account_id
  display_name    = "OSVauco-Agent-Budget-500USD"

  amount {
    specified_amount {
      currency_code = "NOK"
      units         = "2500"
    }
  }

  threshold_rules {
    threshold_percent = 0.5
  }

  threshold_rules {
    threshold_percent = 0.8
  }

  threshold_rules {
    threshold_percent = 1.0
  }

  all_updates_rule {
    pubsub_topic   = google_pubsub_topic.billing_alerts.id
    schema_version = "1.0"
  }
}

resource "google_billing_budget" "dev_budget" {
  billing_account = var.billing_account_id
  display_name    = "OSVauco-Dev-Budget-75USD"

  amount {
    specified_amount {
      currency_code = "NOK"
      units         = "500"
    }
  }

  threshold_rules {
    threshold_percent = 0.7
  }

  threshold_rules {
    threshold_percent = 0.9
  }

  threshold_rules {
    threshold_percent = 1.0
  }

  all_updates_rule {
    pubsub_topic   = google_pubsub_topic.billing_alerts.id
    schema_version = "1.0"
  }
}

# Managed via Cloud Budget alerts — not Pub/Sub push
# resource "google_pubsub_subscription" "billing_alerts_sub" {
#   name  = "billing-alert-subscription"
#   topic = google_pubsub_topic.billing_alerts.name
#
#   # Push to an email address
#   push_config {
#     push_endpoint = "mailto:${var.alert_email}"
#   }
# }

resource "google_artifact_registry_repository" "repo" {
  location      = var.artifact_region
  repository_id = var.artifact_repo_name
  format        = "DOCKER"
}

# Managed via Cloud Build CI/CD — not Terraform
# resource "google_cloud_run_v2_service" "agent_service" {
#   name     = var.cloud_run_service_name
#   location = var.cloud_run_region
#
#   template {
#     service_account = google_service_account.agent_sa.email
#
#     containers {
#       image = var.container_image
#       env {
#         name  = "CUSTOMER_ID"
#         value = var.customer_id
#       }
#     }
#   }
#
#   depends_on = [google_project_service.apis]
# }
#
# resource "google_cloud_run_v2_service_iam_member" "invoker" {
#   project  = var.project_id
#   location = google_cloud_run_v2_service.agent_service.location
#   name     = google_cloud_run_v2_service.agent_service.name
#   role     = "roles/run.invoker"
#   member   = "user:chris.christiansen@vauco.no"
# }

# BigQuery — Cloud Run structured logs
resource "google_bigquery_dataset" "logs" {
  dataset_id                  = "osvauco_logs"
  friendly_name               = "OSVauco Logs"
  location                    = var.region
  default_table_expiration_ms = 7776000000 # 90 dager
}

resource "google_bigquery_table" "cloud_run_logs" {
  dataset_id          = google_bigquery_dataset.logs.dataset_id
  table_id            = "cloud_run_logs"
  deletion_protection = false

  time_partitioning {
    type          = "DAY"
    field         = "timestamp"
    expiration_ms = 7776000000
  }

  schema = jsonencode([
    { name = "timestamp", type = "TIMESTAMP", mode = "REQUIRED" },
    { name = "severity", type = "STRING", mode = "NULLABLE" },
    { name = "service_name", type = "STRING", mode = "NULLABLE" },
    { name = "revision", type = "STRING", mode = "NULLABLE" },
    { name = "http_method", type = "STRING", mode = "NULLABLE" },
    { name = "http_url", type = "STRING", mode = "NULLABLE" },
    { name = "http_status", type = "INTEGER", mode = "NULLABLE" },
    { name = "latency_ms", type = "FLOAT", mode = "NULLABLE" },
    { name = "message", type = "STRING", mode = "NULLABLE" },
    { name = "trace", type = "STRING", mode = "NULLABLE" },
    { name = "labels", type = "JSON", mode = "NULLABLE" }
  ])
}

resource "google_project_iam_member" "bq_log_writer" {
  project = var.project_id
  role    = "roles/bigquery.dataEditor"
  member  = "serviceAccount:${google_service_account.agent_sa.email}"
}

resource "google_logging_project_sink" "cloudrun_to_bq" {
  name                   = "osvauco-cloudrun-sink"
  destination            = "bigquery.googleapis.com/projects/${var.project_id}/datasets/${google_bigquery_dataset.logs.dataset_id}"
  filter                 = "resource.type=\"cloud_run_revision\" AND resource.labels.service_name=\"osvauco-agent\""
  unique_writer_identity = true
}

resource "google_project_iam_member" "log_sink_bq_writer" {
  project = var.project_id
  role    = "roles/bigquery.dataEditor"
  member  = google_logging_project_sink.cloudrun_to_bq.writer_identity
}