# variables.tf — generated by `autumn release init --target gcp-cloud-run`
variable "project_id" {
description = "GCP project ID to deploy into. Find yours with `gcloud config get-value project`."
type = string
}
variable "app_name" {
description = "Name used to prefix every provisioned GCP resource."
type = string
default = "{{project_name}}"
}
variable "region" {
description = "GCP region for all resources."
type = string
default = "us-central1"
}
variable "image_tag" {
description = "Tag of the {{project_name}} image in Artifact Registry to deploy. Documents the tag scheme used by `gcloud run services update`/CI after bootstrap — Terraform itself only ever sets `bootstrap_image` (see below) and never manages the image after the first apply."
type = string
default = "latest"
}
# Cloud Run must pull an image to create the service's (and the migration
# job's) first revision, but a brand-new Artifact Registry repository has
# none yet — so Terraform points both at this public placeholder on the
# first apply, then ignores further image drift (see the
# `lifecycle.ignore_changes` blocks in main.tf) once CI/the manual
# walkthrough takes over managing the real image. Google's own Cloud Run
# quickstart image honors the `PORT` env var Cloud Run injects, so it
# correctly listens on 3000 to match `containers.ports.container_port` in
# main.tf with no bootstrap-specific port workaround needed.
variable "bootstrap_image" {
description = "Public placeholder image Terraform uses to create the Cloud Run service and migration job before any real image has been pushed to Artifact Registry."
type = string
default = "us-docker.pkg.dev/cloudrun/container/hello"
}
variable "db_tier" {
description = "Machine tier for the Cloud SQL PostgreSQL instance (e.g. db-f1-micro for dev, db-custom-2-7680 for production)."
type = string
default = "db-f1-micro"
}
# ── Connection budget ────────────────────────────────────────────────────────
# The default db_tier (db-f1-micro) initializes Postgres with a small
# max_connections ceiling — around 25, run `SHOW max_connections;` against
# your instance to confirm the exact figure for its memory size. Each Cloud
# Run instance opens up to `pool_size` connections
# (autumn.production.toml.example defaults to 10), so scaling out past ~2
# concurrently-busy instances at that default pool size can already exhaust
# a db-f1-micro instance's connection budget well before max_instances'
# default ceiling of 10 is reached. db-f1-micro is a dev-appropriate default
# specifically because of this — before relying on autoscaling toward
# max_instances in production, size db_tier so its max_connections
# comfortably exceeds `max_instances * pool_size` (e.g. db-custom-2-7680
# supports roughly 200) or lower pool_size/max_instances to fit the tier
# you're on.
variable "vpc_connector_cidr" {
description = "Unused /28 CIDR range in the VPC for the Serverless VPC Access connector. Must not overlap 10.100.0.0/16 — the private-service-access range Cloud SQL/Memorystore use (see main.tf's google_compute_global_address.private_service_access)."
type = string
default = "10.8.0.0/28"
}
# ── Scale config defaults ────────────────────────────────────────────────────
# Min instances: 1 (set to 0 for true scale-to-zero at the cost of cold
# starts), Max: 10. Concurrency: 80 requests per instance (Cloud Run's own
# default; not configured here — override `containers.max_instance_request_
# concurrency` in main.tf's template block if you need to tune it).
variable "min_instances" {
description = "Minimum number of Cloud Run instances kept running. Set to 0 for scale-to-zero."
type = number
default = 1
}
variable "max_instances" {
description = "Maximum number of Cloud Run instances under load."
type = number
default = 10
}
variable "enable_redis_cache" {
description = "Provision an optional Memorystore Redis instance and wire its URL into the app. Infrastructure only: your app must ALSO depend on the autumn-cache-redis crate and register RedisCachePlugin in main.rs for this to take effect — see docs/guide/cloud-native.md. Off by default to avoid the extra cost."
type = bool
default = false
}
# ── Secrets — no default. Supply via TF_VAR_* env vars or your CI's secret
# store. Never commit real values in terraform.tfvars. ──────────────────────
#
# Note: there is no `database_url` variable. A single `terraform apply` must
# succeed without a second, targeted apply to fill in a value that depends on
# a resource the same apply is about to create — so main.tf derives the full
# connection string from `google_sql_database_instance.this`'s private IP and
# this password, rather than requiring the operator to pre-compute it.
variable "database_admin_password" {
description = "Password for the Cloud SQL PostgreSQL admin user."
type = string
sensitive = true
}
variable "signing_secret" {
description = "Signing secret stored in Secret Manager as AUTUMN_SECURITY__SIGNING_SECRET; generate with `openssl rand -hex 32`."
type = string
sensitive = true
}