Deploying Visulate with Google Cloud Vertex AI & Identity-Aware Proxy (IAP)

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

# 1. Enable Required Services
resource "google_project_service" "services" {
  for_each = toset([
    "compute.googleapis.com",
    "aiplatform.googleapis.com",
    "iap.googleapis.com",
    "secretmanager.googleapis.com"
  ])
  service            = each.key
  disable_on_destroy = false
}

# 2. Dedicated Service Account for Visulate VM
resource "google_service_account" "visulate_sa" {
  account_id   = "visulate-app-sa"
  display_name = "Visulate Application Dedicated Service Account"
  depends_on   = [google_project_service.services]
}

# Grant Vertex AI User role
resource "google_project_iam_member" "vertex_ai_user" {
  project = var.project_id
  role    = "roles/aiplatform.user"
  member  = "serviceAccount:${google_service_account.visulate_sa.email}"
}

# Grant Cloud Logging Writer role
resource "google_project_iam_member" "logging_writer" {
  project = var.project_id
  role    = "roles/logging.logWriter"
  member  = "serviceAccount:${google_service_account.visulate_sa.email}"
}

# 3. VPC Network & Subnet with Private Google Access
resource "google_compute_network" "vpc" {
  name                    = "visulate-vpc"
  auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "subnet" {
  name                     = "visulate-subnet"
  ip_cidr_range            = "10.0.1.0/24"
  region                   = var.region
  network                  = google_compute_network.vpc.id
  private_ip_google_access = true
}

# 4. Cloud Router & NAT (Outbound access for updates and container pulls)
resource "google_compute_router" "router" {
  name    = "visulate-router"
  region  = var.region
  network = google_compute_network.vpc.id
}

resource "google_compute_router_nat" "nat" {
  name                               = "visulate-nat"
  router                             = google_compute_router.router.name
  region                             = var.region
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
}

# 5. Firewall Rules
resource "google_compute_firewall" "allow_health_checks" {
  name    = "allow-health-checks"
  network = google_compute_network.vpc.id

  allow {
    protocol = "tcp"
    ports    = ["80"]
  }

  source_ranges = ["130.211.0.0/22", "35.191.0.0/16"]
  target_tags   = ["visulate-node"]
}

resource "google_compute_firewall" "allow_iap_ssh" {
  name    = "allow-iap-ssh"
  network = google_compute_network.vpc.id

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = ["35.235.240.0/20"]
  target_tags   = ["visulate-node"]
}

# 6. Compute Engine Instance with Visulate Bootstrap
resource "google_compute_instance" "visulate_vm" {
  name         = "visulate-vm"
  machine_type = "e2-standard-4"
  zone         = "${var.region}-a"
  tags         = ["visulate-node"]

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
      size  = 50
    }
  }

  network_interface {
    network    = google_compute_network.vpc.id
    subnetwork = google_compute_subnetwork.subnet.id
    # No external public IP - private access only
  }

  service_account {
    email  = google_service_account.visulate_sa.email
    scopes = ["https://www.googleapis.com/auth/cloud-platform"]
  }

  metadata_startup_script = <<-EOT
    #!/bin/bash
    set -e

    # 1. Install Docker & Compose plugin
    apt-get update
    apt-get install -y ca-certificates curl gnupg
    install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
    chmod a+r /etc/apt/keyrings/docker.gpg
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
    apt-get update
    apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
    systemctl enable --now docker

    # 2. Directory structure
    mkdir -p /home/visulate/config /home/visulate/downloads /home/visulate/repos /home/visulate/wallet
    chmod -R 777 /home/visulate/downloads /home/visulate/repos

    cat << 'CFG' > /home/visulate/config/database.js
    const endpoints = [];
    module.exports.endpoints = endpoints;
    CFG

    cat << 'CFG' > /home/visulate/config/endpoints.json
    {}
    CFG

    # 3. Environment settings
    cat << ENV > /home/visulate/.env
    GOOGLE_GENAI_USE_VERTEXAI=true
    GOOGLE_CLOUD_PROJECT=${var.project_id}
    GOOGLE_CLOUD_LOCATION=${var.region}
    ENV

    # 4. Compose stack
    cat << 'COMPOSE' > /home/visulate/docker-compose.yaml
    version: "3.8"
    services:
      reverseproxy:
        image: gcr.io/visulate-llc-public/visulate-for-oracle/proxy:3.0
        ports:
          - 80:80
        networks:
          - visulate_net

      visapi:
        image: gcr.io/visulate-llc-public/visulate-for-oracle:3.0
        depends_on:
          - reverseproxy
        volumes:
          - /home/visulate/config:/visulate-server/config
          - /home/visulate/downloads:/visulate-server/downloads
          - /home/visulate/repos:/app/repos
        environment:
          - GOOGLE_GENAI_USE_VERTEXAI=true
          - GOOGLE_CLOUD_PROJECT=${var.project_id}
          - GOOGLE_CLOUD_LOCATION=${var.region}
          - VISULATE_AGENT_URL=http://ai-agent:10000/agent/generate
        networks:
          - visulate_net

      visui:
        image: gcr.io/visulate-llc-public/visulate-for-oracle/ui:3.0
        depends_on:
          - reverseproxy
        networks:
          - visulate_net

      vissql:
        image: gcr.io/visulate-llc-public/visulate-for-oracle/sql:3.0
        depends_on:
          - reverseproxy
        volumes:
          - /home/visulate/config:/query-engine/sql2csv/config
        networks:
          - visulate_net

      ai-agent:
        image: gcr.io/visulate-llc-public/visulate-for-oracle/ai-agent:3.0
        depends_on:
          - reverseproxy
          - vissql
          - visapi
        volumes:
          - /home/visulate/downloads:/app/downloads
          - /home/visulate/repos:/app/repos
        environment:
          - GOOGLE_GENAI_USE_VERTEXAI=true
          - GOOGLE_CLOUD_PROJECT=${var.project_id}
          - GOOGLE_CLOUD_LOCATION=${var.region}
          - VISULATE_BASE=http://reverseproxy
        networks:
          - visulate_net

    networks:
      visulate_net:
    COMPOSE

    cd /home/visulate
    docker compose up -d
  EOT
}

# 7. Zonal Network Endpoint Group (NEG)
resource "google_compute_network_endpoint_group" "visulate_neg" {
  name                  = "visulate-neg"
  network               = google_compute_network.vpc.id
  subnetwork            = google_compute_subnetwork.subnet.id
  default_port          = "80"
  zone                  = "${var.region}-a"
  network_endpoint_type = "GCE_VM_IP_PORT"
}

resource "google_compute_network_endpoint" "visulate_endpoint" {
  network_endpoint_group = google_compute_network_endpoint_group.visulate_neg.name
  instance               = google_compute_instance.visulate_vm.name
  port                   = 80
  ip_address             = google_compute_instance.visulate_vm.network_interface[0].network_ip
  zone                   = "${var.region}-a"
}

# 8. Load Balancer with IAP
resource "google_compute_health_check" "http" {
  name               = "visulate-http-health-check"
  check_interval_sec = 10
  timeout_sec        = 5

  http_health_check {
    port         = 80
    request_path = "/healthz"
  }
}

resource "google_compute_backend_service" "visulate_backend" {
  name                  = "visulate-backend-service"
  protocol              = "HTTP"
  port_name             = "http"
  timeout_sec           = 60
  enable_cdn            = false
  health_checks         = [google_compute_health_check.http.id]
  load_balancing_scheme = "EXTERNAL"
  session_affinity      = "GENERATED_COOKIE"
  affinity_cookie_ttl_sec = 86400

  backend {
    group                 = google_compute_network_endpoint_group.visulate_neg.id
    balancing_mode        = "RATE"
    max_rate_per_endpoint = 100
  }

  iap {
    oauth2_client_id     = var.iap_client_id
    oauth2_client_secret = var.iap_client_secret
  }
}

resource "google_compute_managed_ssl_certificate" "ssl_cert" {
  name = "visulate-managed-cert"

  managed {
    domains = [var.domain_name]
  }
}

resource "google_compute_url_map" "url_map" {
  name            = "visulate-url-map"
  default_service = google_compute_backend_service.visulate_backend.id
}

resource "google_compute_target_https_proxy" "https_proxy" {
  name             = "visulate-https-proxy"
  url_map          = google_compute_url_map.url_map.id
  ssl_certificates = [google_compute_managed_ssl_certificate.ssl_cert.id]
}

resource "google_compute_global_address" "lb_ip" {
  name = "visulate-lb-ip"
}

resource "google_compute_global_forwarding_rule" "https_forwarding_rule" {
  name                  = "visulate-https-rule"
  ip_protocol           = "TCP"
  load_balancing_scheme = "EXTERNAL"
  port_range            = "443"
  target                = google_compute_target_https_proxy.https_proxy.id
  ip_address            = google_compute_global_address.lb_ip.id
}

# 9. IAP Authorized Users
resource "google_iap_web_backend_service_iam_member" "iap_users" {
  for_each               = toset(var.iap_authorized_users)
  project                = var.project_id
  web_backend_service    = google_compute_backend_service.visulate_backend.name
  role                   = "roles/iap.httpsResourceAccessor"
  member                 = each.value
}

variable "project_id" {
  description = "Google Cloud Project ID (e.g. Assured Workloads project)"
  type        = string
}

variable "region" {
  description = "Target GCP region (e.g. us-central1)"
  type        = string
  default     = "us-central1"
}

variable "domain_name" {
  description = "Fully qualified domain name for Visulate (e.g. visulate.mycompany.com)"
  type        = string
}

variable "iap_client_id" {
  description = "OAuth 2.0 Client ID for Identity-Aware Proxy"
  type        = string
}

variable "iap_client_secret" {
  description = "OAuth 2.0 Client Secret for Identity-Aware Proxy"
  type        = string
  sensitive   = true
}

variable "iap_authorized_users" {
  description = "List of users or groups authorized to access Visulate via IAP"
  type        = list(string)
  default     = ["group:dbas@mycompany.com"]
}

session_affinity        = "GENERATED_COOKIE"
affinity_cookie_ttl_sec = 86400 # 1 day