opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: pulumi

Browse source
This commit is contained in:
gerrystev 2026-04-16 14:34:30 +08:00
parent 54272c7fc4
commit 6ac0c589f3
2 changed files with 37 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
infrastructure/Pulumi.dev.yaml
View file

@ -1,3 +1,4 @@
encryptionsalt: v1:Jf+BVg+eXws=:v1:MScHsvDc/TE20MSb:p+6j/0hGULp3a4VXaAzcd+vti9Mn3g== encryptionsalt: v1:Jf+BVg+eXws=:v1:MScHsvDc/TE20MSb:p+6j/0hGULp3a4VXaAzcd+vti9Mn3g==
config: config:
gcp:project: digital-equator-311106 gcp:project: digital-equator-311106
picoclaw-cloud-run:runInvokerMembers: group:intentaiplatform-dev@intnt.ai,user:gerry@intnt.ai

63
infrastructure/index.ts
View file

@ -6,10 +6,11 @@ const gcpConfig = new pulumi.Config("gcp");
const project = gcpConfig.require("project"); const project = gcpConfig.require("project");
const region = config.get("region") ?? "asia-southeast1"; const region = config.get("region") ?? "asia-southeast1";
const imageRegion = config.get("imageRegion") ?? "europe-west4";
const imageTag = config.get("imageTag") ?? "latest"; const imageTag = config.get("imageTag") ?? "latest";
const imageName = config.get("imageName") ?? "picoclaw"; const imageName = config.get("imageName") ?? "picoclaw";
const PICOCLAW_IMAGE = pulumi.interpolate`${region}-docker.pkg.dev/enterprise-automation-352103/container-repo/${imageName}:${imageTag}`; const PICOCLAW_IMAGE = pulumi.interpolate`${imageRegion}-docker.pkg.dev/enterprise-automation-352103/container-repo/${imageName}:${imageTag}`;
// ───────────────────────────────────────────── // ─────────────────────────────────────────────
// Look up pre-existing secrets in Secret Manager // Look up pre-existing secrets in Secret Manager
@ -62,14 +63,14 @@ const gatewayService = new gcp.cloudrunv2.Service("picoclaw-gateway", {
template: { template: {
serviceAccount: gatewayServiceAccount.email, serviceAccount: gatewayServiceAccount.email,
scaling: { scaling: {
minInstanceCount: 1, minInstanceCount: 0,
maxInstanceCount: 3, maxInstanceCount: 3,
}, },
containers: [ containers: [
{ {
image: PICOCLAW_IMAGE, image: PICOCLAW_IMAGE,
ports: { ports: {
containerPort: 18790, containerPort: 18800,
}, },
envs: [ envs: [
{ name: "PICOCLAW_GATEWAY_HOST", value: "0.0.0.0" }, { name: "PICOCLAW_GATEWAY_HOST", value: "0.0.0.0" },
@ -126,23 +127,23 @@ const gatewayService = new gcp.cloudrunv2.Service("picoclaw-gateway", {
}, },
cpuIdle: false, cpuIdle: false,
}, },
startupProbe: { // startupProbe: {
httpGet: { // httpGet: {
path: "/health", // path: "/health",
port: 18790, // port: 18790,
}, // },
initialDelaySeconds: 5, // initialDelaySeconds: 5,
periodSeconds: 10, // periodSeconds: 10,
failureThreshold: 6, // failureThreshold: 6,
}, // },
livenessProbe: { // livenessProbe: {
httpGet: { // httpGet: {
path: "/health", // path: "/health",
port: 18790, // port: 18790,
}, // },
periodSeconds: 30, // periodSeconds: 30,
failureThreshold: 3, // failureThreshold: 3,
}, // },
}, },
], ],
}, },
@ -150,17 +151,25 @@ const gatewayService = new gcp.cloudrunv2.Service("picoclaw-gateway", {
dependsOn: [iamSecretAccessor], dependsOn: [iamSecretAccessor],
}); });
// Grant invoker access only to authenticated members of the current project // Temporarily disable access filtering and allow unauthenticated access.
new gcp.cloudrunv2.ServiceIamBinding("picoclaw-gateway-invoker", { // Previous filtered access logic:
// const runInvokerMembers =
// config.get("runInvokerMembers")?.split(",").map((s) => s.trim()).filter(Boolean) ?? [];
// runInvokerMembers.forEach((member, i) => {
// new gcp.cloudrunv2.ServiceIamMember(`picoclaw-gateway-invoker-${i}`, {
// project,
// location: region,
// name: gatewayService.name,
// role: "roles/run.invoker",
// member,
// });
// });
new gcp.cloudrunv2.ServiceIamMember("picoclaw-gateway-public-invoker", {
project, project,
location: region, location: region,
name: gatewayService.name, name: gatewayService.name,
role: "roles/run.invoker", role: "roles/run.invoker",
members: [ member: "allUsers",
`projectOwner:${project}`,
`projectEditor:${project}`,
`projectViewer:${project}`,
],
}); });
export const serviceUrl = gatewayService.uri; export const serviceUrl = gatewayService.uri;