Finish GCLB Terraform setup

terraform/lb.tf

@@ -11,47 +11,108 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
-# TODO(icco): This is currently all setup manually.
-#resource "google_compute_backend_service" "apiserver" {
-#  provider   = google-beta
-#  name       = "apiserver"
-#  project    = var.project
-#  enable_cdn = true
-#
-#  backend {
-#    group = google_compute_region_network_endpoint_group.apiserver.id
-#  }
-#}
-
 resource "google_compute_global_address" "verification-server" {
   name    = "verification-server-address"
   project = var.project
 }
 
-#resource "google_compute_url_map" "urlmap" {
-#  name            = "verification-server"
-#  project         = var.project
-#  default_service = google_compute_backend_service.apiserver.id
-#
-# TODO(icco): Add host base routing for all four services.
-#}
-#
-#resource "google_compute_target_http_proxy" "default" {
-#  name    = "verification-server"
-#  project = var.project
-#  url_map = google_compute_url_map.urlmap.id
-#}
-#
-#resource "google_compute_forwarding_rule" "verification-server" {
-#  provider = google-beta
-#  name     = "verification-server"
-#  project  = var.project
-#
-#  ip_protocol           = "TCP"
-#  ip_address            = google_compute_global_address.verification-server.address
-#  load_balancing_scheme = "EXTERNAL"
-#  port_range            = "80"
-#  target                = google_compute_target_http_proxy.default.id
-#  network_tier          = "PREMIUM"
-#}
+# Redirects all requests to https
+resource "google_compute_url_map" "urlmap-http" {
+  name     = "https-redirect"
+  provider = google-beta
+  project  = var.project
+
+  default_url_redirect {
+    strip_query    = false
+    https_redirect = true
+  }
+}
+
+resource "google_compute_url_map" "urlmap-https" {
+  name            = "verification-server"
+  provider        = google-beta
+  project         = var.project
+  default_service = google_compute_backend_service.apiserver.id
+
+  host_rule {
+    hosts        = [var.server-host]
+    path_matcher = "server"
+  }
+
+  path_matcher {
+    name            = "server"
+    default_service = google_compute_backend_service.server.id
+  }
+
+  host_rule {
+    hosts        = [var.apiserver-host]
+    path_matcher = "apiserver"
+  }
+
+  path_matcher {
+    name            = "apiserver"
+    default_service = google_compute_backend_service.apiserver.id
+  }
+
+  host_rule {
+    hosts        = [var.adminapi-host]
+    path_matcher = "adminapi"
+  }
+
+  path_matcher {
+    name            = "adminapi"
+    default_service = google_compute_backend_service.adminapi.id
+  }
+}
+
+resource "google_compute_target_http_proxy" "http" {
+  provider = google-beta
+  name     = "verification-server"
+  project  = var.project
+
+  url_map = google_compute_url_map.urlmap-http.id
+}
+
+resource "google_compute_target_https_proxy" "https" {
+  name    = "verification-server"
+  project = var.project
+
+  url_map          = google_compute_url_map.urlmap-https.id
+  ssl_certificates = [google_compute_managed_ssl_certificate.default.id]
+}
+
+resource "google_compute_forwarding_rule" "http" {
+  provider = google-beta
+  name     = "verification-server-http"
+  project  = var.project
+
+  ip_protocol           = "TCP"
+  ip_address            = google_compute_global_address.verification-server.address
+  load_balancing_scheme = "EXTERNAL"
+  port_range            = "80"
+  target                = google_compute_target_http_proxy.http.id
+  network_tier          = "PREMIUM"
+}
+
+resource "google_compute_forwarding_rule" "https" {
+  provider = google-beta
+  name     = "verification-server-https"
+  project  = var.project
+
+  ip_protocol           = "TCP"
+  ip_address            = google_compute_global_address.verification-server.address
+  load_balancing_scheme = "EXTERNAL"
+  port_range            = "443"
+  target                = google_compute_target_https_proxy.https.id
+  network_tier          = "PREMIUM"
+}
+
+resource "google_compute_managed_ssl_certificate" "default" {
+  provider = google-beta
+
+  name = "verification-cert"
+
+  managed {
+    domains = [var.server-host, var.apiserver-host, var.adminapi-host]
+  }
+}

terraform/service_admin_apiserver.tf

@@ -147,11 +147,23 @@ resource "google_compute_region_network_endpoint_group" "adminapi" {
   project  = var.project
   region   = var.region
 
+  network_endpoint_type = "SERVERLESS"
+
   cloud_run {
     service = google_cloud_run_service.adminapi.name
   }
 }
 
+resource "google_compute_backend_service" "adminapi" {
+  provider = google-beta
+  name     = "adminapi"
+  project  = var.project
+
+  backend {
+    group = google_compute_region_network_endpoint_group.adminapi.id
+  }
+}
+
 resource "google_cloud_run_domain_mapping" "adminapi" {
   count    = var.adminapi_custom_domain != "" ? 1 : 0
   location = var.cloudrun_location

terraform/service_apiserver.tf

@@ -155,11 +155,23 @@ resource "google_compute_region_network_endpoint_group" "apiserver" {
   project  = var.project
   region   = var.region
 
+  network_endpoint_type = "SERVERLESS"
+
   cloud_run {
     service = google_cloud_run_service.apiserver.name
   }
 }
 
+resource "google_compute_backend_service" "apiserver" {
+  provider = google-beta
+  name     = "apiserver"
+  project  = var.project
+
+  backend {
+    group = google_compute_region_network_endpoint_group.apiserver.id
+  }
+}
+
 resource "google_cloud_run_domain_mapping" "apiserver" {
   count    = var.apiserver_custom_domain != "" ? 1 : 0
   location = var.cloudrun_location

terraform/service_server.tf

@@ -188,11 +188,23 @@ resource "google_compute_region_network_endpoint_group" "server" {
   project  = var.project
   region   = var.region
 
+  network_endpoint_type = "SERVERLESS"
+
   cloud_run {
     service = google_cloud_run_service.server.name
   }
 }
 
+resource "google_compute_backend_service" "server" {
+  provider = google-beta
+  name     = "server"
+  project  = var.project
+
+  backend {
+    group = google_compute_region_network_endpoint_group.server.id
+  }
+}
+
 resource "google_cloud_run_domain_mapping" "server" {
   count    = var.server_custom_domain != "" ? 1 : 0
   location = var.cloudrun_location

terraform/variables.tf

@@ -155,17 +155,32 @@ variable "server_custom_domain" {
   description = "Custom domain to map for server. This domain must already be verified by Google, and you must have a DNS CNAME record pointing to ghs.googlehosted.com in advance. If not provided, no domain mapping is created."
 }
 
+variable "server-host" {
+  type        = string
+  description = "Domain web ui is hosted on."
+}
+
+variable "apiserver-host" {
+  type        = string
+  description = "Domain apiserver is hosted on."
+}
+
+variable "adminapi-host" {
+  type        = string
+  description = "Domain adminapi is hosted on."
+}
+
 terraform {
   required_version = ">= 0.13"
 
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = "~> 3.36"
+      version = "~> 3.37"
     }
     google-beta = {
       source  = "hashicorp/google-beta"
-      version = "~> 3.36"
+      version = "~> 3.37"
     }
     local = {
       source  = "hashicorp/local"