# Project variables — adjust them to what you decided in the design
export PROY_BASE="refugio"
export PROY_DEV="${PROY_BASE}-dev"
export PROY_PROD="${PROY_BASE}-prod"
export PROY_DATOS="${PROY_BASE}-datos"
export REGION="europe-west1"
export BILLING_ACCOUNT="0X0X0X-0X0X0X-0X0X0X"   # gcloud billing accounts list

# Create the projects
for P in "${PROY_DEV}" "${PROY_PROD}" "${PROY_DATOS}"; do
  gcloud projects create "${P}" --name="${P}"
  gcloud billing projects link "${P}" --billing-account="${BILLING_ACCOUNT}"
done

# Check
gcloud projects list --filter="projectId:${PROY_BASE}-*" \
  --format="table(projectId, name, lifecycleState)"

APIS=(
  cloudresourcemanager.googleapis.com   # Terraform needs this one first
  serviceusage.googleapis.com
  iam.googleapis.com
  iamcredentials.googleapis.com
  compute.googleapis.com                # network, addresses, firewall
  servicenetworking.googleapis.com      # peering for private Cloud SQL
  vpcaccess.googleapis.com              # serverless connector
  run.googleapis.com
  artifactregistry.googleapis.com
  cloudbuild.googleapis.com
  sqladmin.googleapis.com
  secretmanager.googleapis.com
  storage.googleapis.com
  pubsub.googleapis.com
  bigquery.googleapis.com
  cloudfunctions.googleapis.com
  eventarc.googleapis.com
  cloudscheduler.googleapis.com
  monitoring.googleapis.com
  logging.googleapis.com
  cloudtrace.googleapis.com
  language.googleapis.com               # replace with your AI API
)

for P in "${PROY_DEV}" "${PROY_PROD}"; do
  gcloud services enable "${APIS[@]}" --project="${P}"
done

gcloud services enable bigquery.googleapis.com storage.googleapis.com \
  --project="${PROY_DATOS}"

gcloud services list --enabled --project="${PROY_PROD}" | wc -l   # should be around 25+

gcloud billing budgets create \
  --billing-account="${BILLING_ACCOUNT}" \
  --display-name="Final project ${PROY_BASE}" \
  --budget-amount=12EUR \
  --threshold-rule=percent=0.5 \
  --threshold-rule=percent=0.9 \
  --threshold-rule=percent=1.0 \
  --filter-projects="projects/${PROY_DEV}","projects/${PROY_PROD}","projects/${PROY_DATOS}"

gcloud billing budgets list --billing-account="${BILLING_ACCOUNT}"

mi-proyecto/
├── README.md
├── .gitignore
├── cloudbuild.yaml                 # dev pipeline
├── cloudbuild-prod.yaml            # promotion to prod
├── app/
│   ├── Dockerfile
│   ├── requirements.txt
│   ├── src/
│   │   ├── main.py
│   │   ├── db.py
│   │   ├── eventos.py
│   │   └── observabilidad.py
│   └── tests/
│       ├── test_unitarios.py
│       └── test_integracion.py
├── infra/
│   ├── modules/
│   │   ├── red/
│   │   ├── identidad/
│   │   ├── datos/
│   │   ├── servicio/
│   │   └── observabilidad/
│   ├── envs/
│   │   ├── dev/{main.tf,variables.tf,terraform.tfvars,backend.tf}
│   │   └── prod/{main.tf,variables.tf,terraform.tfvars,backend.tf}
│   └── bootstrap/                  # creates the state bucket. Applied once
├── data/
│   ├── seed/generar.py
│   ├── migraciones/
│   │   ├── 001_esquema_inicial.sql
│   │   └── 002_indices.sql
│   └── sql/analitica.sql
├── ml/
│   └── analizar_opiniones.py
└── docs/
    ├── arquitectura.md
    ├── runbook.md
    ├── diario.md
    └── adr/

# RefugioReserva

Mountain refuge booking platform. Final project of the GCP course.
**All data is fictional.**

🔗 **Demo:** https://refugioreserva.example
📊 **Dashboard:** [Looker Studio](...)
📐 **Architecture:** [docs/arquitectura.md](docs/arquitectura.md)

## What it does
A hiker checks the availability of places in 12 refuges and books.
The warden sees the day's bookings. The federation checks indicators.

## Architecture in one line
Cloud Run (Python/FastAPI) → private Cloud SQL PostgreSQL · photos in Cloud
Storage · events over Pub/Sub → BigQuery → Looker Studio · sentiment of
reviews with the Natural Language API. All in Terraform, deployed by
Cloud Build with no keys (WIF).

## How to bring it up from scratch

## Cost
**~€10/month.** See [docs/adr/ADR-006-sin-balanceador.md](docs/adr/) for
the most relevant cost decision.

## Status and known technical debt
See the "Technical debt" section below. Yes, there is some, and it is prioritised.

# infra/bootstrap/main.tf
terraform {
  required_version = ">= 1.9"
  required_providers {
    google = { source = "hashicorp/google", version = "~> 6.0" }
  }
  # No backend: local state, applied once and the .tfstate is uploaded encrypted
  # or you simply accept that this module gets re-created by hand if it is lost.
}

provider "google" {
  project = var.proyecto_estado
  region  = var.region
}

resource "google_storage_bucket" "estado" {
  name          = "${var.prefijo}-terraform-estado"
  location      = var.region
  force_destroy = false

  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"

  versioning { enabled = true }        # ← essential: lets you recover a corrupted state

  lifecycle_rule {
    condition { num_newer_versions = 20 }
    action    { type = "Delete" }
  }

  labels = {
    proyecto       = var.prefijo
    componente     = "iac"
    gestionado-por = "terraform"
  }
}

cd infra/bootstrap
terraform init && terraform apply
gcloud storage buckets describe gs://refugio-terraform-estado \
  --format="value(versioning.enabled,iamConfiguration.publicAccessPrevention)"
# Expected: True  enforced

# infra/envs/prod/backend.tf
terraform {
  required_version = ">= 1.9"

  backend "gcs" {
    bucket = "refugio-terraform-estado"
    prefix = "envs/prod"                  # dev uses "envs/dev": separate states
  }

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"                  # pinned. NEVER without a version
    }
    random = { source = "hashicorp/random", version = "~> 3.6" }
  }
}

# infra/modules/red/main.tf
variable "proyecto"    { type = string }
variable "prefijo"     { type = string }
variable "region"      { type = string }
variable "cidr_app"    { type = string }
variable "cidr_conector" { type = string }
variable "cidr_privado"  { type = string }
variable "etiquetas"   { type = map(string) }

resource "google_compute_network" "vpc" {
  project                 = var.proyecto
  name                    = "${var.prefijo}-vpc"
  auto_create_subnetworks = false        # ← NEVER the default network
  routing_mode            = "REGIONAL"
}

resource "google_compute_subnetwork" "app" {
  project                  = var.proyecto
  name                     = "${var.prefijo}-app-${substr(var.region, 0, 8)}"
  network                  = google_compute_network.vpc.id
  region                   = var.region
  ip_cidr_range            = var.cidr_app
  private_ip_google_access = true        # egress to Google APIs without a public IP
}

# Serverless access connector: requires an exact /28
resource "google_vpc_access_connector" "conector" {
  project       = var.proyecto
  name          = "${var.prefijo}-conn"
  region        = var.region
  ip_cidr_range = var.cidr_conector
  network       = google_compute_network.vpc.name
  min_instances = 2
  max_instances = 3                      # cost cap
}

# --- Private services access (needed for Cloud SQL with a private IP) ---
resource "google_compute_global_address" "rango_privado" {
  project       = var.proyecto
  name          = "${var.prefijo}-rango-privado"
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 20
  address       = split("/", var.cidr_privado)[0]
  network       = google_compute_network.vpc.id
}

resource "google_service_networking_connection" "peering" {
  network                 = google_compute_network.vpc.id
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.rango_privado.name]
}

# --- Firewall: explicit deny by default ---
resource "google_compute_firewall" "denegar_entrada" {
  project   = var.proyecto
  name      = "${var.prefijo}-denegar-entrada"
  network   = google_compute_network.vpc.name
  direction = "INGRESS"
  priority  = 65534
  deny { protocol = "all" }
  source_ranges = ["0.0.0.0/0"]
  log_config { metadata = "INCLUDE_ALL_METADATA" }
}

output "red_id"        { value = google_compute_network.vpc.id }
output "red_nombre"    { value = google_compute_network.vpc.name }
output "conector_id"   { value = google_vpc_access_connector.conector.id }
output "peering_listo" { value = google_service_networking_connection.peering.id }

# infra/envs/prod/terraform.tfvars
proyecto      = "refugio-prod"
entorno       = "prod"
prefijo       = "refugio"
region        = "europe-west1"
cidr_app      = "10.20.0.0/24"
cidr_conector = "10.20.8.0/28"
cidr_privado  = "10.20.16.0/20"

bd_tier            = "db-f1-micro"
bd_alta_disp       = false
bd_backup_retencion = 7

run_min_instancias = 0
run_max_instancias = 5

# infra/envs/dev/terraform.tfvars — same keys, smaller values
proyecto      = "refugio-dev"
entorno       = "dev"
prefijo       = "refugio"
region        = "europe-west1"
cidr_app      = "10.10.0.0/24"
cidr_conector = "10.10.8.0/28"
cidr_privado  = "10.10.16.0/20"

bd_tier            = "db-f1-micro"
bd_alta_disp       = false
bd_backup_retencion = 1
run_min_instancias = 0
run_max_instancias = 2

cd infra/envs/dev
terraform init
terraform fmt -recursive ../..     # consistent formatting, free
terraform validate                 # syntax and references
terraform plan -out=plan.tfplan    # READ THE WHOLE OUTPUT
terraform apply plan.tfplan

# infra/modules/identidad/main.tf

resource "google_service_account" "web" {
  project      = var.proyecto
  account_id   = "sa-${var.prefijo}-web"
  display_name = "Web application account"
  description  = "Cloud Run: reads the DB, reads 2 secrets, writes photos, publishes events"
}

# --- PROJECT-level roles: only those that cannot be narrowed further ---
resource "google_project_iam_member" "web_proyecto" {
  for_each = toset([
    "roles/cloudsql.client",
    "roles/logging.logWriter",
    "roles/cloudtrace.agent",
    "roles/monitoring.metricWriter",
  ])
  project = var.proyecto
  role    = each.value
  member  = "serviceAccount:${google_service_account.web.email}"
}

# --- Roles scoped TO THE RESOURCE: this is how it is done properly ---
resource "google_secret_manager_secret_iam_member" "web_secretos" {
  for_each  = toset(var.secretos_de_la_web)   # ["refugio-db-password", "refugio-session-key"]
  project   = var.proyecto
  secret_id = each.value
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.web.email}"
}

resource "google_storage_bucket_iam_member" "web_fotos" {
  bucket = var.bucket_fotos
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:${google_service_account.web.email}"
}

resource "google_pubsub_topic_iam_member" "web_publica" {
  project = var.proyecto
  topic   = var.topic_eventos
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:${google_service_account.web.email}"
}

# infra/modules/identidad/wif.tf

resource "google_iam_workload_identity_pool" "github" {
  project                   = var.proyecto
  workload_identity_pool_id = "gh-pool"
  display_name              = "GitHub Actions"
}

resource "google_iam_workload_identity_pool_provider" "github" {
  project                            = var.proyecto
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = "gh-provider"

  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.repository" = "assertion.repository"
    "attribute.ref"        = "assertion.ref"
  }

  # MANDATORY CONDITION: without this, ANY GitHub repository
  # in the world could authenticate against your project.
  attribute_condition = "assertion.repository == '${var.github_repo}'"

  oidc { issuer_uri = "https://token.actions.githubusercontent.com" }
}

resource "google_service_account" "deploy" {
  project      = var.proyecto
  account_id   = "sa-${var.prefijo}-deploy"
  display_name = "Deployment from CI"
}

# Only the repository's main branch can impersonate the deployment account
resource "google_service_account_iam_member" "deploy_wif" {
  service_account_id = google_service_account.deploy.name
  role               = "roles/iam.workloadIdentityUser"
  member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository/${var.github_repo}"
}

resource "google_project_iam_member" "deploy_roles" {
  for_each = toset([
    "roles/run.developer",
    "roles/artifactregistry.writer",
  ])
  project = var.proyecto
  role    = each.value
  member  = "serviceAccount:${google_service_account.deploy.email}"
}

# THE PERMISSION EVERYBODY ALWAYS FORGETS:
# to deploy a service that runs as sa-web, deploy must be able to "act as" it.
resource "google_service_account_iam_member" "deploy_actua_como_web" {
  service_account_id = google_service_account.web.name
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${google_service_account.deploy.email}"
}

# .github/workflows/deploy.yml
permissions:
  contents: read
  id-token: write            # essential for GitHub to issue the OIDC token

jobs:
  desplegar:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123456789/locations/global/workloadIdentityPools/gh-pool/providers/gh-provider
          service_account: [email protected]
      # From here on, gcloud is authenticated. With no secret in GitHub at all.

# 1. No service account with a primitive role
gcloud projects get-iam-policy "${PROY_PROD}" --format=json | \
  jq -r '.bindings[] | select(.role | test("roles/(owner|editor)")) |
         .members[] | select(startswith("serviceAccount:"))'
# Expected: empty

# 2. Zero user-managed service account keys
for SA in $(gcloud iam service-accounts list --project="${PROY_PROD}" --format="value(email)"); do
  echo -n "$SA: "
  gcloud iam service-accounts keys list --iam-account="$SA" \
    --managed-by=user --format="value(name)" | wc -l
done
# Expected: 0 for all of them

# infra/modules/datos/sql.tf

resource "random_password" "bd" {
  length  = 32
  special = true
}

resource "google_secret_manager_secret" "bd_password" {
  project   = var.proyecto
  secret_id = "${var.prefijo}-db-password"
  replication { auto {} }
}

resource "google_secret_manager_secret_version" "bd_password" {
  secret      = google_secret_manager_secret.bd_password.id
  secret_data = random_password.bd.result
}

resource "google_sql_database_instance" "principal" {
  project          = var.proyecto
  name             = "${var.prefijo}-db"
  region           = var.region
  database_version = "POSTGRES_16"

  # The peering must exist first. A legitimate case for an explicit depends_on.
  depends_on = [var.peering_listo]

  settings {
    tier              = var.bd_tier
    availability_type = var.bd_alta_disp ? "REGIONAL" : "ZONAL"
    disk_size         = 10
    disk_type         = "PD_HDD"      # cheaper; enough at this volume
    disk_autoresize   = true

    ip_configuration {
      ipv4_enabled    = false          # ← NO PUBLIC IP
      private_network = var.red_id
      ssl_mode        = "ENCRYPTED_ONLY"
    }

    backup_configuration {
      enabled                        = true
      start_time                     = "03:00"
      point_in_time_recovery_enabled = var.entorno == "prod"
      backup_retention_settings { retained_backups = var.bd_backup_retencion }
    }

    maintenance_window { day = 7, hour = 4 }   # early Sunday morning

    database_flags {
      name  = "cloudsql.iam_authentication"
      value = "on"
    }

    user_labels = var.etiquetas
  }

  # Protection against an accidental destroy in production
  deletion_protection = var.entorno == "prod"
}

resource "google_sql_database" "app" {
  project  = var.proyecto
  instance = google_sql_database_instance.principal.name
  name     = "reservas"
}

resource "google_sql_user" "app" {
  project  = var.proyecto
  instance = google_sql_database_instance.principal.name
  name     = "app"
  password = random_password.bd.result
}

resource "random_id" "sufijo" { byte_length = 2 }

resource "google_storage_bucket" "fotos" {
  project  = var.proyecto
  name     = "${var.prefijo}-fotos-${random_id.sufijo.hex}"   # global name
  location = var.region

  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"

  versioning { enabled = true }

  lifecycle_rule {
    condition { age = 90, matches_storage_class = ["STANDARD"] }
    action    { type = "SetStorageClass", storage_class = "NEARLINE" }
  }
  lifecycle_rule {
    condition { age = 365, matches_storage_class = ["NEARLINE"] }
    action    { type = "SetStorageClass", storage_class = "COLDLINE" }
  }
  lifecycle_rule {
    condition { num_newer_versions = 3 }     # do not pile up old versions
    action    { type = "Delete" }
  }

  cors {
    origin          = ["https://${var.dominio}"]
    method          = ["GET", "HEAD"]
    response_header = ["Content-Type"]
    max_age_seconds = 3600
  }

  labels = merge(var.etiquetas, { componente = "web" })
}

data/migraciones/
├── 001_esquema_inicial.sql
├── 002_indice_disponibilidad.sql
└── 003_columnas_sentimiento.sql

-- data/migraciones/001_esquema_inicial.sql
-- Idempotent: it can be run twice without breaking anything.
BEGIN;

CREATE TABLE IF NOT EXISTS refugio (
    id        SERIAL PRIMARY KEY,
    nombre    TEXT NOT NULL UNIQUE,
    altitud_m INTEGER NOT NULL CHECK (altitud_m BETWEEN 500 AND 3500),
    capacidad INTEGER NOT NULL CHECK (capacidad > 0),
    activo    BOOLEAN NOT NULL DEFAULT TRUE,
    creado_en TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE IF NOT EXISTS reserva (
    id             UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    refugio_id     INTEGER NOT NULL REFERENCES refugio(id),
    fecha          DATE NOT NULL,
    plazas         INTEGER NOT NULL CHECK (plazas BETWEEN 1 AND 12),
    nombre_titular TEXT NOT NULL,
    email_titular  TEXT NOT NULL,
    estado         TEXT NOT NULL DEFAULT 'confirmada'
                   CHECK (estado IN ('confirmada','cancelada')),
    creada_en      TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Record of applied migrations
CREATE TABLE IF NOT EXISTS _migraciones (
    version    TEXT PRIMARY KEY,
    aplicada_en TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
INSERT INTO _migraciones (version) VALUES ('001')
  ON CONFLICT (version) DO NOTHING;

COMMIT;

# Download cloud-sql-proxy if you do not have it
./cloud-sql-proxy --port 5432 "${PROY_DEV}:${REGION}:refugio-db" &

PGPASSWORD=$(gcloud secrets versions access latest --secret=refugio-db-password --project="${PROY_DEV}")
export PGPASSWORD

for f in data/migraciones/*.sql; do
  echo "→ $f"
  psql -h 127.0.0.1 -U app -d reservas -v ON_ERROR_STOP=1 -f "$f"
done

unset PGPASSWORD

# data/seed/generar.py — generates 100% invented data
import random, uuid
from datetime import date, timedelta

random.seed(42)  # reproducible: the same data on every run

REFUGIOS = [
    ("Refugio de Cotiella", 2100, 40), ("Refugio Peña Blanca", 1850, 28),
    ("Refugio del Ibón Verde", 2340, 22), ("Refugio de Valdellosa", 1620, 55),
]
NOMBRES = ["Ana", "Luis", "Marta", "Jorge", "Carmen", "Diego", "Elena", "Pablo"]
APELLIDOS = ["Soler", "Ibáñez", "Marín", "Vidal", "Rey", "Castaño", "Lorca"]

def titular_ficticio(i):
    nombre = f"{random.choice(NOMBRES)} {random.choice(APELLIDOS)}"
    # example.com is reserved by RFC 2606 for exactly this
    correo = f"usuario{i:04d}@example.com"
    return nombre, correo

def factor_estacional(d: date) -> float:
    """July-August x4, weekends x2.5, the rest normal."""
    f = 4.0 if d.month in (7, 8) else (2.0 if d.month in (6, 9) else 1.0)
    if d.weekday() >= 5:
        f *= 2.5
    return f

def generar_reservas(n=2000):
    inicio = date.today() - timedelta(days=540)
    filas = []
    i = 0
    while len(filas) < n:
        d = inicio + timedelta(days=random.randint(0, 540))
        if random.random() > factor_estacional(d) / 10:
            continue
        i += 1
        nombre, correo = titular_ficticio(i)
        filas.append((
            str(uuid.uuid4()), random.randint(1, len(REFUGIOS)), d.isoformat(),
            random.randint(1, 6), nombre, correo,
            "cancelada" if random.random() < 0.08 else "confirmada",
        ))
    return filas

# app/Dockerfile — multi-stage, no root, and with the bare minimum inside
FROM python:3.12-slim AS build
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

FROM python:3.12-slim
RUN useradd --create-home --uid 1001 app
WORKDIR /app
COPY --from=build /root/.local /home/app/.local
COPY --chown=app:app src/ ./src/
USER app
ENV PATH=/home/app/.local/bin:$PATH \
    PYTHONUNBUFFERED=1

# $PORT is injected by Cloud Run. 8080 is just the local default.
ENV PORT=8080
CMD exec uvicorn src.main:app --host 0.0.0.0 --port ${PORT}

resource "google_cloud_run_v2_service" "web" {
  project  = var.proyecto
  name     = "${var.prefijo}-web"
  location = var.region
  ingress  = "INGRESS_TRAFFIC_ALL"

  template {
    service_account = var.sa_web_email

    scaling {
      min_instance_count = var.run_min_instancias   # 0: scales to zero
      max_instance_count = var.run_max_instancias   # spending cap
    }

    vpc_access {
      connector = var.conector_id
      egress    = "PRIVATE_RANGES_ONLY"   # only the DB goes through the VPC
    }

    containers {
      image = var.imagen

      resources {
        limits = { cpu = "1", memory = "512Mi" }
        cpu_idle = true                    # do not pay for CPU between requests
      }

      # --- Configuration: in the clear, not sensitive ---
      env { name = "ENTORNO"   value = var.entorno }
      env { name = "REGION"    value = var.region }
      env { name = "BD_HOST"   value = var.bd_ip_privada }
      env { name = "BD_NOMBRE" value = "reservas" }
      env { name = "TOPIC_EVENTOS" value = var.topic_eventos }
      env { name = "BUCKET_FOTOS"  value = var.bucket_fotos }

      # --- Secrets: by reference, never by value ---
      env {
        name = "BD_PASSWORD"
        value_source {
          secret_key_ref {
            secret  = var.secreto_bd_password
            version = "latest"
          }
        }
      }

      startup_probe {
        http_get { path = "/salud/arranque" }
        initial_delay_seconds = 3
        period_seconds        = 3
        failure_threshold     = 10
      }
      liveness_probe {
        http_get { path = "/salud/vivo" }
        period_seconds = 30
      }
    }
  }

  traffic {
    type    = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
    percent = 100
  }
}

# app/src/main.py (excerpt)
from fastapi import FastAPI, Response
from . import db

app = FastAPI()

@app.get("/salud/arranque")
async def arranque(response: Response):
    """Startup probe: am I ready to receive traffic?
    Checks critical dependencies. If it fails, Cloud Run sends no traffic."""
    try:
        await db.ping()
        return {"estado": "listo"}
    except Exception as e:
        response.status_code = 503
        return {"estado": "no listo", "motivo": str(e)[:200]}

@app.get("/salud/vivo")
async def vivo():
    """Liveness probe: is the process responding?
    Does NOT check dependencies: if the DB goes down, we do not want
    Cloud Run restarting the instance in a loop — it would fix nothing."""
    return {"estado": "vivo"}

# app/src/observabilidad.py
import json, os, sys, contextvars

_trace = contextvars.ContextVar("trace", default=None)
PROYECTO = os.environ.get("GOOGLE_CLOUD_PROJECT", "")

def fijar_trace(cabecera: str | None):
    """Cloud Run sends X-Cloud-Trace-Context: TRACE_ID/SPAN_ID;o=1"""
    if cabecera:
        _trace.set(cabecera.split("/")[0])

def log(severidad: str, mensaje: str, **campos):
    entrada = {
        "severity": severidad,           # names Cloud Logging understands
        "message": mensaje,
        **campos,
    }
    t = _trace.get()
    if t and PROYECTO:
        # This exact key is what links the log to the trace in the console
        entrada["logging.googleapis.com/trace"] = f"projects/{PROYECTO}/traces/{t}"
    print(json.dumps(entrada, ensure_ascii=False), file=sys.stdout, flush=True)

# In the application middleware
@app.middleware("http")
async def correlacion(request, call_next):
    fijar_trace(request.headers.get("X-Cloud-Trace-Context"))
    respuesta = await call_next(request)
    log("INFO", "peticion",
        ruta=request.url.path, metodo=request.method,
        codigo=respuesta.status_code)
    return respuesta

export IMAGEN="${REGION}-docker.pkg.dev/${PROY_DEV}/refugio-imagenes/web:manual-1"

gcloud builds submit app/ --tag="${IMAGEN}" --project="${PROY_DEV}"

gcloud run deploy refugio-web \
  --image="${IMAGEN}" \
  --region="${REGION}" \
  --project="${PROY_DEV}" \
  --service-account="sa-refugio-web@${PROY_DEV}.iam.gserviceaccount.com" \
  --vpc-connector="refugio-conn" \
  --vpc-egress=private-ranges-only \
  --set-env-vars="ENTORNO=dev,BD_HOST=10.10.16.3,BD_NOMBRE=reservas" \
  --set-secrets="BD_PASSWORD=refugio-db-password:latest" \
  --min-instances=0 --max-instances=2 \
  --no-allow-unauthenticated

URL=$(gcloud run services describe refugio-web --region="${REGION}" \
      --project="${PROY_DEV}" --format="value(status.url)")
curl -s -H "Authorization: Bearer $(gcloud auth print-identity-token)" "${URL}/salud/arranque"

# cloudbuild.yaml
substitutions:
  _REGION: europe-west1
  _SERVICIO: refugio-web
  _REPO: refugio-imagenes

steps:
  # 1. Tests BEFORE building. If they fail, there is no image.
  - id: pruebas
    name: python:3.12-slim
    entrypoint: bash
    args:
      - -c
      - |
        pip install --no-cache-dir -r app/requirements.txt -r app/requirements-dev.txt
        cd app && python -m pytest tests/ -v --tb=short

  # 2. Build using the previous image as cache
  - id: construir
    name: gcr.io/cloud-builders/docker
    args:
      - build
      - --cache-from=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web:latest
      - -t=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web:$SHORT_SHA
      - -t=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web:latest
      - app/
    waitFor: [pruebas]

  # 3. Publish
  - id: publicar
    name: gcr.io/cloud-builders/docker
    args: [push, --all-tags, "${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web"]

  # 4. Deploy to DEVELOPMENT
  - id: desplegar
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: gcloud
    args:
      - run
      - deploy
      - ${_SERVICIO}
      - --image=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web:$SHORT_SHA
      - --region=${_REGION}
      - --revision-suffix=$SHORT_SHA

  # 5. Smoke: if the freshly deployed revision does not respond, the build fails
  - id: humo
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: bash
    args:
      - -c
      - |
        URL=$(gcloud run services describe ${_SERVICIO} --region=${_REGION} --format='value(status.url)')
        TOKEN=$(gcloud auth print-identity-token)
        CODIGO=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $$TOKEN" "$$URL/salud/arranque")
        echo "Code: $$CODIGO"
        test "$$CODIGO" = "200"

options:
  logging: CLOUD_LOGGING_ONLY
  machineType: E2_HIGHCPU_8
timeout: 900s

# cloudbuild-prod.yaml — does NOT build. It promotes the already-tested image.
substitutions:
  _IMAGEN_SHA: ""     # passed explicitly: the one already working in dev

steps:
  - id: verificar-imagen-existe
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: bash
    args:
      - -c
      - |
        test -n "${_IMAGEN_SHA}" || { echo "Missing _IMAGEN_SHA"; exit 1; }
        gcloud artifacts docker images describe \
          europe-west1-docker.pkg.dev/refugio-dev/refugio-imagenes/web:${_IMAGEN_SHA}

  # CANARY deployment: 10% of traffic to the new revision
  - id: canario
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: gcloud
    args:
      - run
      - deploy
      - refugio-web
      - --image=europe-west1-docker.pkg.dev/refugio-dev/refugio-imagenes/web:${_IMAGEN_SHA}
      - --region=europe-west1
      - --project=refugio-prod
      - --no-traffic                       # deployed without receiving traffic
      - --revision-suffix=${_IMAGEN_SHA}

  - id: repartir-10
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: gcloud
    args:
      - run
      - services
      - update-traffic
      - refugio-web
      - --region=europe-west1
      - --project=refugio-prod
      - --to-revisions=refugio-web-${_IMAGEN_SHA}=10

# app/src/eventos.py
import json, os
from google.cloud import pubsub_v1

_publisher = pubsub_v1.PublisherClient()
_TOPIC = _publisher.topic_path(os.environ["GOOGLE_CLOUD_PROJECT"],
                               os.environ["TOPIC_EVENTOS"])

def publicar_reserva(evento: dict) -> None:
    """Publishes the business event. NEVER includes contact details."""
    carga = {
        "evento_id":      evento["id"],
        "tipo_evento":    evento["tipo"],       # creada | cancelada
        "reserva_id":     evento["reserva_id"],
        "refugio_id":     evento["refugio_id"],
        "refugio_nombre": evento["refugio_nombre"],
        "fecha_estancia": evento["fecha"],
        "plazas":         evento["plazas"],
        "ocurrido_en":    evento["ts"],
    }
    futuro = _publisher.publish(_TOPIC, json.dumps(carga).encode("utf-8"))
    futuro.result(timeout=10)

# ml/../funcion/main.py
import base64, json, os
from google.cloud import bigquery

_bq = bigquery.Client()
_TABLA = os.environ["TABLA_EVENTOS"]

def procesar(evento, contexto):
    """Pub/Sub subscriber. Inserts the event into BigQuery."""
    datos = json.loads(base64.b64decode(evento["data"]).decode("utf-8"))

    errores = _bq.insert_rows_json(_TABLA, [datos], row_ids=[datos["evento_id"]])
    if errores:
        # Raising an exception makes Pub/Sub retry; after N attempts,
        # the message goes to the dead-letter queue.
        raise RuntimeError(f"Error inserting into BigQuery: {errores}")

-- data/sql/analitica.sql
CREATE TABLE IF NOT EXISTS `refugio-datos.refugio_analitica.reservas_eventos` (
  evento_id      STRING NOT NULL,
  ocurrido_en    TIMESTAMP NOT NULL,
  tipo_evento    STRING NOT NULL,
  reserva_id     STRING NOT NULL,
  refugio_id     INT64 NOT NULL,
  refugio_nombre STRING,
  fecha_estancia DATE NOT NULL,
  plazas         INT64 NOT NULL
)
PARTITION BY DATE(ocurrido_en)
CLUSTER BY refugio_id
OPTIONS (partition_expiration_days = 1095, require_partition_filter = TRUE);

-- Aggregated view: this is what the dashboard consumes.
-- Having the dashboard query a view rather than the base table reduces scanning.
CREATE OR REPLACE VIEW `refugio-datos.refugio_analitica.v_ocupacion_diaria` AS
SELECT
  fecha_estancia,
  refugio_id,
  ANY_VALUE(refugio_nombre) AS refugio,
  SUM(IF(tipo_evento = 'creada',    plazas, 0)) AS plazas_reservadas,
  SUM(IF(tipo_evento = 'cancelada', plazas, 0)) AS plazas_canceladas,
  SUM(IF(tipo_evento = 'creada', plazas, -plazas)) AS plazas_netas
FROM `refugio-datos.refugio_analitica.reservas_eventos`
WHERE DATE(ocurrido_en) >= DATE_SUB(CURRENT_DATE(), INTERVAL 730 DAY)
GROUP BY fecha_estancia, refugio_id;

# ml/analizar_opiniones.py
from google.cloud import language_v2

_cliente = language_v2.LanguageServiceClient()

def analizar(texto: str) -> dict:
    """Sentiment of a review. FICTIONAL text, no personal data."""
    documento = language_v2.Document(
        content=texto,
        type_=language_v2.Document.Type.PLAIN_TEXT,
        language_code="es",
    )
    r = _cliente.analyze_sentiment(request={"document": documento})
    return {
        "sentimiento": round(r.document_sentiment.score, 3),   # -1..1
        "magnitud":    round(r.document_sentiment.magnitude, 3),
    }

# End-to-end test: create a booking and see it in BigQuery
curl -s -X POST "${URL}/api/reservas" -H 'Content-Type: application/json' \
  -d '{"refugio_id":1,"fecha":"2026-12-20","plazas":2,
       "nombre_titular":"Fictional Test","email_titular":"[email protected]"}'

sleep 30

bq query --use_legacy_sql=false --project_id="${PROY_DATOS}" \
'SELECT evento_id, tipo_evento, refugio_id, plazas
 FROM `refugio-datos.refugio_analitica.reservas_eventos`
 WHERE DATE(ocurrido_en) = CURRENT_DATE()
 ORDER BY ocurrido_en DESC LIMIT 5'

resource "google_cloud_run_domain_mapping" "web" {
  project  = var.proyecto
  location = var.region
  name     = var.dominio                 # "refugioreserva.example"
  metadata { namespace = var.proyecto }
  spec     { route_name = google_cloud_run_v2_service.web.name }
}

output "registros_dns" {
  description = "Records to create at the registrar"
  value       = google_cloud_run_domain_mapping.web.status[0].resource_records
}

resource "google_compute_region_network_endpoint_group" "neg" {
  project               = var.proyecto
  name                  = "${var.prefijo}-neg"
  region                = var.region
  network_endpoint_type = "SERVERLESS"
  cloud_run { service = google_cloud_run_v2_service.web.name }
}

resource "google_compute_backend_service" "bs" {
  project                 = var.proyecto
  name                    = "${var.prefijo}-bs"
  protocol                = "HTTPS"
  load_balancing_scheme   = "EXTERNAL_MANAGED"
  enable_cdn              = true
  security_policy         = google_compute_security_policy.waf.id

  backend { group = google_compute_region_network_endpoint_group.neg.id }

  cdn_policy {
    cache_mode        = "CACHE_ALL_STATIC"
    default_ttl       = 3600
    client_ttl        = 3600
    negative_caching  = true
  }

  log_config { enable = true, sample_rate = 1.0 }
}

resource "google_compute_security_policy" "waf" {
  project = var.proyecto
  name    = "${var.prefijo}-waf"

  # Rate limiting: it protects your wallet as much as your application
  rule {
    action   = "throttle"
    priority = 1000
    match {
      versioned_expr = "SRC_IPS_V1"
      config { src_ip_ranges = ["*"] }
    }
    rate_limit_options {
      conform_action = "allow"
      exceed_action  = "deny(429)"
      enforce_on_key = "IP"
      rate_limit_threshold { count = 100, interval_sec = 60 }
    }
  }

  rule {
    action   = "allow"
    priority = 2147483647
    match {
      versioned_expr = "SRC_IPS_V1"
      config { src_ip_ranges = ["*"] }
    }
    description = "Default rule"
  }
}

curl -sI "https://${DOMINIO}" | head -1                       # HTTP/2 200
curl -sI "https://${DOMINIO}" | grep -i strict-transport       # HSTS present
echo | openssl s_client -connect "${DOMINIO}:443" -servername "${DOMINIO}" 2>/dev/null \
  | openssl x509 -noout -dates -issuer                         # valid certificate
curl -sI "http://${DOMINIO}" | head -1                         # 301 to HTTPS

resource "google_monitoring_dashboard" "principal" {
  project = var.proyecto
  dashboard_json = jsonencode({
    displayName = "RefugioReserva — overview"
    gridLayout  = { columns = 2, widgets = [
      {
        title = "Traffic (requests/s)"
        xyChart = { dataSets = [{ timeSeriesQuery = { timeSeriesFilter = {
          filter = "metric.type=\"run.googleapis.com/request_count\" resource.type=\"cloud_run_revision\""
          aggregation = { alignmentPeriod = "60s", perSeriesAligner = "ALIGN_RATE" }
        }}}]}
      },
      {
        title = "Errors (5xx/s)"
        xyChart = { dataSets = [{ timeSeriesQuery = { timeSeriesFilter = {
          filter = "metric.type=\"run.googleapis.com/request_count\" metric.label.response_code_class=\"5xx\""
          aggregation = { alignmentPeriod = "60s", perSeriesAligner = "ALIGN_RATE" }
        }}}]}
      },
      {
        title = "p95 latency (ms)"
        xyChart = { dataSets = [{ timeSeriesQuery = { timeSeriesFilter = {
          filter = "metric.type=\"run.googleapis.com/request_latencies\""
          aggregation = { alignmentPeriod = "60s", perSeriesAligner = "ALIGN_DELTA",
                          crossSeriesReducer = "REDUCE_PERCENTILE_95" }
        }}}]}
      },
      {
        title = "Active instances (saturation)"
        xyChart = { dataSets = [{ timeSeriesQuery = { timeSeriesFilter = {
          filter = "metric.type=\"run.googleapis.com/container/instance_count\""
          aggregation = { alignmentPeriod = "60s", perSeriesAligner = "ALIGN_MEAN" }
        }}}]}
      }
    ]}
  })
}

resource "google_monitoring_notification_channel" "correo" {
  project      = var.proyecto
  display_name = "Owner's email"
  type         = "email"
  labels       = { email_address = var.correo_alertas }
}

resource "google_monitoring_alert_policy" "errores_5xx" {
  project      = var.proyecto
  display_name = "5xx error rate > 5%"
  combiner     = "OR"

  conditions {
    display_name = "Elevated 5xx for 5 minutes"
    condition_threshold {
      filter = join(" ", [
        "metric.type=\"run.googleapis.com/request_count\"",
        "resource.type=\"cloud_run_revision\"",
        "metric.label.response_code_class=\"5xx\"",
      ])
      comparison      = "COMPARISON_GT"
      threshold_value = 0.05
      duration        = "300s"
      aggregations {
        alignment_period   = "60s"
        per_series_aligner = "ALIGN_RATE"
      }
    }
  }

  notification_channels = [google_monitoring_notification_channel.correo.id]

  documentation {
    content = <<-EOT
      ## Elevated 5xx errors

      **First steps** (see `docs/runbook.md`):
      1. `gcloud logging read 'severity>=ERROR' --limit=20 --freshness=15m`
      2. Does it coincide with a deployment? `gcloud run revisions list --limit=5`
      3. If it does: roll back with
         `gcloud run services update-traffic refugio-web --to-revisions=<previous>=100`
      4. Is the database reachable? `gcloud sql instances describe refugio-db`
    EOT
    mime_type = "text/markdown"
  }
}

resource "google_monitoring_slo" "disponibilidad" {
  project = var.proyecto
  service = google_monitoring_service.web.service_id
  slo_id  = "disponibilidad-api"
  display_name = "99.5% of requests with no 5xx error (30 days)"

  goal                = 0.995
  rolling_period_days = 30

  request_based_sli {
    good_total_ratio {
      total_service_filter = "metric.type=\"run.googleapis.com/request_count\" resource.type=\"cloud_run_revision\""
      bad_service_filter   = "metric.type=\"run.googleapis.com/request_count\" resource.type=\"cloud_run_revision\" metric.label.response_code_class=\"5xx\""
    }
  }
}

resource "google_monitoring_uptime_check_config" "web" {
  project      = var.proyecto
  display_name = "RefugioReserva available"
  timeout      = "10s"
  period       = "300s"

  http_check {
    path         = "/salud/arranque"
    port         = 443
    use_ssl      = true
    validate_ssl = true
  }

  monitored_resource {
    type   = "uptime_url"
    labels = { host = var.dominio, project_id = var.proyecto }
  }

  selected_regions = ["EUROPE", "USA"]
}

# Provoke the alert on purpose: deploy a revision that returns 500
# on a test endpoint, generate traffic, and wait for the email.
for i in $(seq 1 200); do curl -s -o /dev/null "${URL}/api/error-de-prueba"; done
# Wait 5-10 minutes. If the email does not arrive, the alert is useless.

git add infra/modules/red/
git commit -m "Add network module: VPC, subnet, /28 connector and service peering"

terraform plan -out=plan.tfplan
terraform show -json plan.tfplan | \
  jq -r '.resource_changes[] | select(.change.actions | index("delete")) | .address'
# If this returns something you were not expecting, do not apply.

# Terraform 1.5+: import block, versionable in the code
cat >> infra/envs/dev/imports.tf <<'EOF'
import {
  to = google_storage_bucket.temporal
  id = "refugio-dev/refugio-temporal-a1b2"
}
EOF
terraform plan   # generates the missing configuration

# Aliases worth having to hand
gcloud billing accounts list
# And, once the BigQuery export has been populating for a few days:
bq query --use_legacy_sql=false \
'SELECT service.description AS service, ROUND(SUM(cost),2) AS cost_eur
 FROM `mi-proyecto.facturacion.gcp_billing_export_v1_XXXX`
 WHERE DATE(usage_start_time) >= DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY)
 GROUP BY service ORDER BY cost_eur DESC'

terraform -chdir=infra/envs/dev destroy -auto-approve   # Friday
terraform -chdir=infra/envs/dev apply   -auto-approve   # Saturday

$ terraform -chdir=infra/envs/dev plan
No changes. Your infrastructure matches the configuration.

$ gcloud projects get-iam-policy refugio-dev --format=json | \
  jq -r '.bindings[] | select(.role|test("roles/(owner|editor)")) |
         "\(.role): \(.members[])"'
roles/owner: user:[email protected]
# No service account. Correct.

$ for SA in $(gcloud iam service-accounts list --project=refugio-dev --format="value(email)"); do
    N=$(gcloud iam service-accounts keys list --iam-account="$SA" --managed-by=user \
        --format="value(name)" | wc -l)
    echo "$SA -> $N user keys"
  done
[email protected] -> 0
[email protected] -> 0
[email protected] -> 0
[email protected] -> 0

# 1. Verify the database
$ gcloud sql instances describe refugio-db --project=refugio-dev \
    --format="value(settings.ipConfiguration.ipv4Enabled, state)"
False   RUNNABLE

# 2. Verify the secret
$ gcloud secrets versions list refugio-db-password --project=refugio-dev \
    --format="value(name,state)"
1   ENABLED

# 3. Data seeded
$ psql -h 127.0.0.1 -U app -d reservas -c \
    "SELECT count(*) AS bookings, count(DISTINCT refugio_id) AS refuges FROM reserva"
 bookings | refuges
----------+---------
     2000 |      12

# 4. The application responds and reads from the DB
$ curl -s "${URL}/api/refugios" | jq '.[0]'
{"id":1,"nombre":"Refugio de Cotiella","altitud_m":2100,"capacidad":40}

# 5. Create a booking (FICTIONAL data)
$ curl -s -X POST "${URL}/api/reservas" -H 'Content-Type: application/json' \
    -d '{"refugio_id":3,"fecha":"2026-12-20","plazas":2,
         "nombre_titular":"Fictional Test","email_titular":"[email protected]"}' | jq
{"id":"7c2e...","estado":"confirmada","plazas_restantes":20}

# 6. The structured log, with its trace
$ gcloud logging read 'resource.type="cloud_run_revision" jsonPayload.ruta="/api/reservas"' \
    --limit=1 --format="value(jsonPayload.message, jsonPayload.codigo, trace)"
peticion  201  projects/refugio-dev/traces/8a1f...

# 7. The event reached BigQuery (26 seconds later)
$ bq query --use_legacy_sql=false --project_id=refugio-datos \
  'SELECT evento_id, tipo_evento, refugio_id, plazas, ocurrido_en
   FROM `refugio-datos.refugio_analitica.reservas_eventos`
   WHERE DATE(ocurrido_en) = CURRENT_DATE() ORDER BY ocurrido_en DESC LIMIT 1'
+-----------+-------------+------------+--------+---------------------+
| evento_id | tipo_evento | refugio_id | plazas |     ocurrido_en     |
+-----------+-------------+------------+--------+---------------------+
| 7c2e...   | creada      |          3 |      2 | 2026-10-14 18:42:11 |
+-----------+-------------+------------+--------+---------------------+

# 8. And the sentiment of the reviews
$ psql -c "SELECT count(*) FILTER (WHERE sentimiento IS NOT NULL) AS analysed,
           round(avg(sentimiento)::numeric,3) AS average FROM opinion"
 analysed | average
----------+---------
      400 |   0.412

# app/tests/test_unitarios.py — temporary change
def test_no_sobreventa():
    disponible = calcular_disponibilidad(refugio_id=1, fecha="2026-08-15")
    assert disponible == 999   # ← deliberately wrong value

$ git commit -am "TEST: breaking the capacity test on purpose" && git push
$ gcloud builds list --limit=1 --format="table(id, status, createTime)"
ID                                    STATUS   CREATE_TIME
9f2a-...                              FAILURE  2026-10-21T19:14:22

$ gcloud run revisions list --service=refugio-web --region=europe-west1 --limit=2 \
    --format="table(name, active, createTime)"
NAME                    ACTIVE  CREATE_TIME
refugio-web-a3f81c      True    2026-10-21T18:02:11   ← the previous one still serving

$ curl -sI https://dev.refugioreserva.example | head -3
HTTP/2 200
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8

$ echo | openssl s_client -connect dev.refugioreserva.example:443 \
    -servername dev.refugioreserva.example 2>/dev/null | \
    openssl x509 -noout -dates -issuer
notBefore=Oct 20 09:14:00 2026 GMT
notAfter=Jan 18 09:13:59 2027 GMT
issuer=C = US, O = Google Trust Services, CN = WE1

$ curl -sI http://dev.refugioreserva.example | head -1
HTTP/1.1 301 Moved Permanently

$ for i in $(seq 1 300); do curl -s -o /dev/null "${URL}/api/error-de-prueba"; done
$ # 6 minutes later:
$ gcloud alpha monitoring policies list --format="value(displayName,enabled)"
5xx error rate > 5%   True