Production GCP Terraform Deployment
Budget: $250 – $750 AUD
I’m moving a full-stack Node.js / TypeScript application (Express API plus a React-Vite front end) from Replit into a secure, production-grade Google Cloud environment. Everything will be green-field, so you can design the layout cleanly without wrestling with legacy resources. Only the production tier is required.
WHAT I NEED YOU TO BUILD
• A GitHub-triggered Cloud Build pipeline that containerises the app, pushes to Artifact Registry, and rolls out to Cloud Run with zero-downtime updates.
• Private Cloud SQL for PostgreSQL (Private IP via Private Service Access) reachable from Cloud Run through a Serverless VPC Access connector.
• Secrets (DB creds, JWT keys, etc.) stored in Secret Manager and injected at runtime.
• External HTTPS Load Balancer fronting Cloud Run, with Cloud DNS records for healthcopilot.com.au and a managed SSL certificate. I already own the domain; you’ll handle certificate provisioning and validation.
• Identity-Aware Proxy in front of the load balancer, locked down by an OAuth client and an email allowlist for password-protected access.
• End-to-end Terraform: custom VPC, subnets, firewall rules, IAM (least privilege roles and service accounts), Cloud Run service, Cloud SQL instance, Serverless connector, Secret Manager bindings, Build triggers, LB/IAP/DNS, and monitoring/log-based alerts.
• Ops collateral: a concise runbook outlining release flow, rollback, and common operational tasks.
ACCEPTANCE CRITERIA
1. Pushing to the main branch of GitHub automatically builds, stores, and deploys a new container to Cloud Run.
2. healthcopilot.com.au resolves over HTTPS with a valid certificate, responds through the load balancer, and prompts for IAP sign-in restricted to the allowlist.
3. Application can read/write to Cloud SQL over a private connection; no public IP is exposed.
4. All secrets are served from Secret Manager; no plaintext credentials exist in the repo or Terraform state.
5. `terraform apply` from a fresh clone recreates the full stack with no manual steps.
6. IAM policy report shows principle of least privilege (no broad Editor roles).
7. Logging and basic uptime metrics appear in Cloud Monitoring dashboards.
If this matches your expertise in Terraform, Cloud Run, Cloud SQL, and secure GCP networking, I’d love to review your approach and timeline.
WHAT I NEED YOU TO BUILD
• A GitHub-triggered Cloud Build pipeline that containerises the app, pushes to Artifact Registry, and rolls out to Cloud Run with zero-downtime updates.
• Private Cloud SQL for PostgreSQL (Private IP via Private Service Access) reachable from Cloud Run through a Serverless VPC Access connector.
• Secrets (DB creds, JWT keys, etc.) stored in Secret Manager and injected at runtime.
• External HTTPS Load Balancer fronting Cloud Run, with Cloud DNS records for healthcopilot.com.au and a managed SSL certificate. I already own the domain; you’ll handle certificate provisioning and validation.
• Identity-Aware Proxy in front of the load balancer, locked down by an OAuth client and an email allowlist for password-protected access.
• End-to-end Terraform: custom VPC, subnets, firewall rules, IAM (least privilege roles and service accounts), Cloud Run service, Cloud SQL instance, Serverless connector, Secret Manager bindings, Build triggers, LB/IAP/DNS, and monitoring/log-based alerts.
• Ops collateral: a concise runbook outlining release flow, rollback, and common operational tasks.
ACCEPTANCE CRITERIA
1. Pushing to the main branch of GitHub automatically builds, stores, and deploys a new container to Cloud Run.
2. healthcopilot.com.au resolves over HTTPS with a valid certificate, responds through the load balancer, and prompts for IAP sign-in restricted to the allowlist.
3. Application can read/write to Cloud SQL over a private connection; no public IP is exposed.
4. All secrets are served from Secret Manager; no plaintext credentials exist in the repo or Terraform state.
5. `terraform apply` from a fresh clone recreates the full stack with no manual steps.
6. IAM policy report shows principle of least privilege (no broad Editor roles).
7. Logging and basic uptime metrics appear in Cloud Monitoring dashboards.
If this matches your expertise in Terraform, Cloud Run, Cloud SQL, and secure GCP networking, I’d love to review your approach and timeline.
Related categories:
Node.js
Express JS
OAuth
Typescript
Google Cloud Platform
React.js Framework
GitHub
Terraform