Google Cloud Deployment
The target infrastructure on GCP and how a tenant maps to it. Pairs with Terraform provisioning and CI/CD.
The target infrastructure on GCP and how a tenant maps to it. Pairs with
51(Terraform/provisioning) and52(CI/CD).
GCP project layout
- One host/org project for shared infra (CI/CD, the control plane, the container registry, the connector catalog).
- One GCP project per tenant (
insigz-<slug>) — decided (D11): strongest isolation + clean per-tenant billing/quota; the control plane absorbs the ops/quota cost.
Per-tenant resources (the silo)
| Resource | Service | Notes |
|---|---|---|
| App | Cloud Run (insigz-<slug>) | api + served frontend; min/max instances by plan; --no-allow-unauthenticated behind IAP/JWT |
| Canonical DB | Cloud SQL for PostgreSQL 16 | private IP, HA (regional) for pro/enterprise, PITR, CMEK |
| Doc/RAG DB | MongoDB Atlas | private endpoint to tenant VPC, DB-per-tenant |
| Blobs | Cloud Storage bucket | versioned, CMEK, lifecycle rules |
| Cache/queue | Memorystore Redis + Cloud Tasks/Pub-Sub | async ingest + agent jobs |
| Secrets | Secret Manager + Cloud KMS key ring | per-tenant (42) |
| Network | VPC + Serverless VPC connector | private egress to SQL/Mongo |
| Edge | Cloud Armor / WAF, Cloud Load Balancing, managed TLS | domain mapping <slug>.insigz.app or custom |
| Ingestors | Cloud Run Jobs / Pub-Sub consumers | per-source fetch/normalize/sign |
Regions & residency
Deploy a tenant into the region matching its data-residency requirement:
| Region | Locale | Residency |
|---|---|---|
europe-west6 | Zürich | CH |
europe-west1 / west3 | Belgium / Frankfurt | EU |
us-central1 | Iowa | US |
australia-southeast1 | Sydney | APAC |
All of a tenant's stateful resources (SQL, Mongo, GCS, KMS) stay in-region. "Placement is configuration; isolation is invariant" — the tenant works the same wherever it lives.
Networking & access
- Cloud Run reaches SQL/Mongo over private IP via the VPC connector; no public DB listeners.
- Public ingress only via the load balancer + Cloud Armor; the app authenticates every request (JWT).
- Service-to-service uses Workload Identity (no SA keys).
Cost shape
Cloud Run scales to zero for the stateless api only; the realistic per-tenant 24/7 floor is Cloud SQL + per-tenant Atlas + the realtime service (min-instances ≥ 1, 61). So a tenant needing live updates does not idle cheaply — drop the "cheap trials" framing for silo tenants and see the tiering decision in 00 (silo for regulated/enterprise; a pooled tier if you want genuinely cheap trials). This per-tenant cost is exactly what the control plane's margin view tracks (ACV − cloud cost, §17 Billing).
Decided
- Project-per-tenant (D11); org/folder hierarchy: one folder per environment.
- Ingress: app-level JWT for the tenant app; IAP only in front of
control-web(D12). - Frontend hosting: the SPA is served from a bucket + CDN (D4), not Cloud Run; Cloud Run serves only
api.
Gaps to close
- Finalize the region list + residency commitments per market (owner Q3).
- Confirm the Cloud Armor rule set.
- Size Cloud SQL / Atlas / Redis tiers per plan (Starter→Enterprise).
Security Program & Scanning
How you keep the software highly secure over time - secure SDLC, CI scanning, threat model, runtime defenses, IR, and compliance.
Provisioning & Infrastructure-as-Code (Terraform)
How a new tenant is stood up - the real pipeline behind the control plane's provisioning wizard.