GCP Infrastructure

此文件呈現 GCP 基礎設施的完整架構，與 system-overview.md（應用層架構）互補。

最後更新：2026-04-30（新增 Cloudflare + HTTPS TLS termination、Stage 環境）

網路流量架構

                   [ GCP Infrastructure - YiBi MVP ]

  使用者 (Internet)
        |
        v HTTPS (443) / HTTP (80)
  +-----+------+
  | Cloudflare |  DNS Proxy + DDoS / WAF（orange cloud）
  | Proxy      |  domain: myyibi.com / staging.myyibi.com
  +-----+------+
        |
        | HTTPS → Origin CA cert（Cloudflare Origin CA 15y）
        v
  +-----+------+
  | Static IP  |  google_compute_global_address
  | (GCP LB)   |  34.50.145.82 (staging) / TBD (prod)
  +-----+------+
        |
        +--port 80---> HTTP Proxy → HTTPS Redirect
        |
        +--port 443--> HTTPS Proxy + SSL Cert (Origin CA)
        |
        v
  +-----+------+
  | Backend    |  google_compute_backend_service (EXTERNAL_MANAGED)
  | Service    |  protocol: HTTPS → Cloud Run
  +-----+------+
        |
        v
  +-----+------+
  | Serverless |  google_compute_region_network_endpoint_group
  | NEG        |  cloud_run → {env}-yibi-backend (asia-east1)
  +-----+------+
        |
        v (INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER)
        |  IAM: allUsers → roles/run.invoker
        |  Org Policy: project-level allowedPolicyMemberDomains = allowAll
  +-----+------+                    +---------------------+
  | Cloud Run  |----[VPC Connector]--| VPC (yibi-vpc)      |
  | Backend    |                    |                     |
  | (FastAPI)  |                    |  +--------------+   |
  +-----+------+                    |  | Cloud SQL    |   |
        |                           |  | PostgreSQL 16|   |
        |                           |  +--------------+   |
        |                           |                     |
        |                           |  +--------------+   |
        |                           |  | Memorystore  |   |
        |                           |  | Redis 7      |   |
        |                           |  +--------------+   |
        |                           +---------------------+
        |
        v
  +-----+------+     +-----------------+
  | Secret Mgr |     | GCS Bucket      |
  | jwt-secret |     | {env}-content   |
  | gemini-key |     | (MP3 audio)     |
  | db-password|     +-----------------+
  +------------+

環境

環境	Domain	Cloud Run Service	狀態
Staging	`staging.myyibi.com`	`staging-yibi-backend` (asia-east1)	✅ 運作中
Production	`api.myyibi.com`	`prod-yibi-backend` (asia-east1)	🚧 規劃中

CI/CD 架構

  GitHub (heyu-ai/yibi-mvp)
        |
        | push to main (backend/** 變更偵測)
        v
  +-----+------+
  | cd-stage   |  .github/workflows/cd-stage.yml
  | workflow   |
  +-----+------+
        |
        +--1. Preflight Secret Validation (staging secrets != CHANGE_ME)
        +--2. Build Docker image → Artifact Registry
        +--3. Run Alembic Migration (Cloud Run Job)
        +--4. Deploy Cloud Run (--update-env-vars, NOT --set-env-vars)
        +--5. Show Stage URL

  GitHub (heyu-ai/yibi-mvp)
        |
        | workflow_dispatch (target: ios / android / all)
        | push tag v*.*.*
        v
  +-----+--------+
  | cd-mobile    |  .github/workflows/cd-mobile.yml
  | workflow     |
  +--------------+
        |
        +--Android--> flutter build apk --flavor beta
        |             Firebase App Distribution → beta-families group
        |
        +--iOS------> flutter build ipa --flavor beta
                      xcrun altool → TestFlight (App Store Connect API)

  WIF: GitHub Actions → Workload Identity Federation → Deployer SA
       無需 Service Account JSON key

元件說明

元件	用途
Cloudflare Proxy	DNS + DDoS 防護；以 Origin CA 模式連接 GCP LB
GCP Static IP + HTTPS LB	外部 HTTPS 入口；port 80 → 301 redirect；port 443 TLS termination
Cloudflare Origin CA Cert	LB 的自簽 SSL 憑證（Cloudflare 信任，瀏覽器不直連）
Serverless NEG	將 LB 流量路由到 Cloud Run
Cloud Run	執行 FastAPI 後端；ingress 限制 `internal-and-cloud-load-balancer`
Cloud Run IAM	`allUsers → run.invoker`；org policy project-level override 允許
VPC + VPC Connector	Cloud Run 透過私有網路存取 Cloud SQL / Redis
Cloud SQL (PG 16)	主要關聯式資料庫
Memorystore (Redis 7)	Token store、Device cache、Rate limit、Playlist cache
Secret Manager	JWT secret、Gemini API key、DB password、Cloudflare Origin CA
GCS Bucket	儲存生成音訊（MP3）
Artifact Registry	Docker image 倉庫
Workload Identity Federation	GitHub Actions 免 SA key 部署
Cloud Run Job	Alembic migration（每次 deploy 前執行）

Terraform 模組對應

infra/terraform/
├── environments/
│   └── staging/          ← 目前唯一 apply 的環境
│       ├── main.tf       ← 組合所有 module
│       └── terraform.tfvars
└── modules/
    ├── cloud-run/        ← Cloud Run service + migration job + IAM binding
    ├── load-balancer/    ← HTTP/HTTPS forwarding + SSL cert（條件式）
    ├── cloud-sql/        ← PostgreSQL + DB password secret
    ├── memorystore/      ← Redis
    ├── networking/       ← VPC + VPC Connector
    ├── iam/              ← Backend SA + Deployer SA
    ├── wif/              ← Workload Identity Federation
    ├── artifact-registry/
    ├── gcs/
    └── cloudflare-dns/   ← DNS A records → LB IP

重要注意事項

--update-env-vars vs --set-env-vars：Cloud Run 更新 env 必須用 update，set 會清除現有變數
Terraform apply 已從 cd-stage.yml 移除：基礎設施（LB、DB、Redis）需手動 apply，只有 Docker image build + Cloud Run deploy 是自動化的
Origin CA cert 傳入方式：terraform apply 時用 TF_VAR_origin_ca_cert / TF_VAR_origin_ca_key 環境變數，不寫入 tfvars（敏感資料）
Org Policy：constraints/iam.allowedPolicyMemberDomains 在 org level 限制特定 customer domain；yibi-mvp project 已設 project-level allowAll: true override 讓 allUsers invoker binding 生效

GCP Infrastructure - YiBi MVP

網路流量架構

環境

CI/CD 架構

元件說明

Terraform 模組對應

重要注意事項

On this page