feat(projects): migrate haumdaucherde website into monorepo and document in AGENTS.md

2026-10-12 10:42:30 +02:00
parent f225d4fe4e
commit 3b190988be
76 changed files with 16748 additions and 0 deletions
@@ -0,0 +1,42 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/google" {
+  version     = "5.45.2"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:y2hf6zus1eKA5vpAfoyYkNBKDBQTVqmx4OVh3iRBaRo=",
+    "zh:0d09c8f20b556305192cdbe0efa6d333ceebba963a8ba91f9f1714b5a20c4b7a",
+    "zh:117143fc91be407874568df416b938a6896f94cb873f26bba279cedab646a804",
+    "zh:16ccf77d18dd2c5ef9c0625f9cf546ebdf3213c0a452f432204c69feed55081e",
+    "zh:3e555cf22a570a4bd247964671f421ed7517970cd9765ceb46f335edc2c6f392",
+    "zh:688bd5b05a75124da7ae6e885b2b92bd29f4261808b2b78bd5f51f525c1052ca",
+    "zh:6db3ef37a05010d82900bfffb3261c59a0c247e0692049cb3eb8c2ef16c9d7bf",
+    "zh:70316fde75f6a15d72749f66d994ccbdde5f5ed4311b6d06b99850f698c9bbf9",
+    "zh:84b8e583771a4f2bd514e519d98ed7fd28dce5efe0634e973170e1cfb5556fb4",
+    "zh:9d4b8ef0a9b6677935c604d94495042e68ff5489932cfd1ec41052e094a279d3",
+    "zh:a2089dd9bd825c107b148dd12d6b286f71aa37dfd4ca9c35157f2dcba7bc19d8",
+    "zh:f03d795c0fd9721e59839255ee7ba7414173017dc530b4ce566daf3802a0d6dd",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/google-beta" {
+  version     = "5.45.2"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:r9Tpv9w6j6hTI7MR7zeaUveGsyt/yNXjCmuO80asz98=",
+    "zh:16b77bac5d1555b7f066ba8014f4fc8a6d0de64e252a1988d3fbb400984a4b19",
+    "zh:1b13f515c4809343840aed8265915cc4191f138bdab5a8c5e1f542fdfc69989f",
+    "zh:1dcce4309aeab7c88fd36aea664d57e620d8a413b967ce513a5a866e8de901f2",
+    "zh:24db65d7929f2a731e9cac1750c569cb4528b312ef182a5e2e8c0cf008d8a71b",
+    "zh:28c0b9e68d97570f03b2c4770607701580055bcba50069efd145954aa13b23e4",
+    "zh:3a898a1ad1569f6486a2bc20014087284c8cab919bc8f155833de5128ccd12eb",
+    "zh:4eed99cfb9daada70f813f2cedcf490d3097de1ccb9b391fc451ecc46509c067",
+    "zh:888c4cb1f13b23674ba1091835dd3f1bff5d8e7729ef302183d8d01233819e54",
+    "zh:8baae3b949f6e9505425f5fa4785de786e9cedc4c3f3ad906d8ed560bd2e39c6",
+    "zh:cf2c8928b764592fa2cd14a9f109d01cd0a92049a4fca9d0a74cf2fe588364e2",
+    "zh:edff09394f5bd0b278a4adc800a31b7f150249a1ea92ca273ccf4acd25be3f63",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
@@ -0,0 +1,166 @@
+# Enable foundational APIs required for Terraform to manage other services
+resource "google_project_service" "cloudresourcemanager" {
+  provider = google-beta
+  project  = var.project_id
+  service  = "cloudresourcemanager.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "serviceusage" {
+  provider = google-beta
+  project  = var.project_id
+  service  = "serviceusage.googleapis.com"
+  disable_on_destroy = false
+}
+
+# Enable required APIs
+resource "google_project_service" "firebase" {
+  provider = google-beta
+  project  = var.project_id
+  service  = "firebase.googleapis.com"
+  disable_on_destroy = false
+  
+  depends_on = [
+    google_project_service.cloudresourcemanager,
+    google_project_service.serviceusage
+  ]
+}
+
+resource "google_project_service" "identitytoolkit" {
+  provider = google-beta
+  project  = var.project_id
+  service  = "identitytoolkit.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "firestore" {
+  provider = google-beta
+  project  = var.project_id
+  service  = "firestore.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "firebaserules" {
+  provider = google-beta
+  project  = var.project_id
+  service  = "firebaserules.googleapis.com"
+  disable_on_destroy = false
+}
+
+# Firebase Project
+resource "google_firebase_project" "default" {
+  provider = google-beta
+  project  = var.project_id
+
+  depends_on = [
+    google_project_service.firebase,
+  ]
+}
+
+# Firebase Web App
+resource "google_firebase_web_app" "default" {
+  provider     = google-beta
+  project      = var.project_id
+  display_name = "Haumdaucher Web"
+
+  depends_on = [google_firebase_project.default]
+}
+
+data "google_firebase_web_app_config" "default" {
+  provider   = google-beta
+  web_app_id = google_firebase_web_app.default.app_id
+  project    = var.project_id
+}
+
+# Identity Platform (Auth)
+resource "google_identity_platform_config" "default" {
+  provider = google-beta
+  project  = var.project_id
+
+  # Authorized Domains for OAuth
+  authorized_domains = [
+    "localhost",
+    "${var.project_id}.firebaseapp.com",
+    "${var.project_id}.web.app",
+    "haumdaucher.de",
+  ]
+
+  # Enable Google Sign-In (and others if needed, but keeping it simple)
+  sign_in {
+    allow_duplicate_emails = false
+
+    anonymous {
+      enabled = false
+    }
+
+    email {
+      enabled = true
+    }
+  }
+
+  depends_on = [google_project_service.identitytoolkit]
+}
+
+# Enable Google Default Identity Provider
+resource "google_identity_platform_default_supported_idp_config" "google" {
+  provider      = google-beta
+  project       = var.project_id
+  enabled       = false
+  idp_id        = "google.com"
+  client_id     = data.google_secret_manager_secret_version.oauth_client_id.secret_data
+  client_secret = data.google_secret_manager_secret_version.oauth_client_secret.secret_data
+
+  depends_on = [google_project_service.identitytoolkit]
+}
+
+# NOTE: OAuth Client ID usually needs to be configured in console for Identity Platform
+# or imported. Terraform support for *creating* the OAuth client for IAP/Identity is limited/complex.
+# We will assume the default one created by Firebase is used or documented.
+
+# Firestore Database (Native)
+resource "google_firestore_database" "database" {
+  provider                    = google-beta
+  project                     = var.project_id
+  name                        = "(default)"
+  location_id                 = var.region
+  type                        = "FIRESTORE_NATIVE"
+  concurrency_mode            = "OPTIMISTIC"
+  app_engine_integration_mode = "DISABLED"
+
+  depends_on = [google_project_service.firestore]
+}
+
+# Firestore Security Rules
+resource "google_firebaserules_ruleset" "firestore" {
+  provider = google
+
+  source {
+    files {
+      name = "firestore.rules"
+      content = <<-EOT
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    match /{document=**} {
+      allow read, write: if false;
+    }
+  }
+}
+EOT
+    }
+  }
+
+  depends_on = [
+    google_project_service.firestore,
+    google_project_service.firebaserules
+  ]
+}
+
+resource "google_firebaserules_release" "firestore" {
+  provider     = google
+  project      = var.project_id
+  name         = "cloud.firestore" # This specific name targets the default Firestore database
+  ruleset_name = google_firebaserules_ruleset.firestore.name
+
+  depends_on = [google_firebaserules_ruleset.firestore]
+}
@@ -0,0 +1,31 @@
+terraform {
+  required_providers {
+    google = {
+      source                = "hashicorp/google"
+      version               = "~> 5.0"
+    }
+    google-beta = {
+      source                = "hashicorp/google-beta"
+      version               = "~> 5.0"
+    }
+  }
+
+  backend "gcs" {
+    bucket  = "haumdaucher-tf-state"
+    prefix  = "terraform/state"
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+  billing_project = var.project_id
+  user_project_override = true
+}
+
+provider "google-beta" {
+  project = var.project_id
+  region  = var.region
+  billing_project = var.project_id
+  user_project_override = true
+}
@@ -0,0 +1,11 @@
+output "firebase_config" {
+  value = {
+    apiKey        = data.google_firebase_web_app_config.default.api_key
+    authDomain    = data.google_firebase_web_app_config.default.auth_domain
+    projectId     = var.project_id
+    storageBucket = lookup(data.google_firebase_web_app_config.default, "storage_bucket", "${var.project_id}.appspot.com")
+    messagingSenderId = data.google_firebase_web_app_config.default.messaging_sender_id
+    appId         = google_firebase_web_app.default.app_id
+  }
+  description = "Firebase Configuration Object for Frontend"
+}
@@ -0,0 +1,14 @@
+# Fetch secrets from Secret Manager
+# Expects these secrets to be created via scripts/manage_secrets.py
+
+data "google_secret_manager_secret_version" "oauth_client_id" {
+  provider = google-beta
+  project  = var.project_id
+  secret   = "haumdaucher-oauth-client-id"
+}
+
+data "google_secret_manager_secret_version" "oauth_client_secret" {
+  provider = google-beta
+  project  = var.project_id
+  secret   = "haumdaucher-oauth-client-secret"
+}
@@ -0,0 +1,18 @@
+variable "project_id" {
+  description = "The GCP Project ID"
+  type        = string
+  default     = "haumdaucher"
+}
+
+variable "region" {
+  description = "The GCP region for resources"
+  type        = string
+  default     = "europe-west3"
+}
+
+
+variable "allowed_users" {
+  description = "List of email addresses allowed to access restricted features"
+  type        = list(string)
+  default     = ["moritz@haumdaucher.de"]
+}