LibreChat を Cloud Run と Firestore MongoDB 互換で構築する

# =================================================================
# 変数定義
# ======================+==========================================

variable "project_id" {
  description = "GCP プロジェクト ID"
  type        = string
}

variable "region" {
  description = "GCP リージョン"
  type        = string
  default     = "asia-northeast1"
}

variable "environment" {
  description = "環境名 (dev / stg / prod)"
  type        = string
  default     = "dev"
}

variable "firestore_database_name" {
  description = "Firestore データベース名"
  type        = string
  default     = "librechat"
}

variable "firestore_location" {
  description = "Firestore ロケーション"
  type        = string
  default     = "asia-northeast1"
}

variable "librechat_cpu" {
  description = "Cloud Run の vCPU 数"
  type        = string
  default     = "2"
}

variable "librechat_memory" {
  description = "Cloud Run のメモリ"
  type        = string
  default     = "1Gi"
}

# =================================================================
# プロバイダー設定
# =================================================================

terraform {
  required_version = ">= 1.5"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">= 7.19"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

data "google_project" "current" {
  project_id = var.project_id
}

# =================================================================
# Firestore (MongoDB 互換モード)
# =================================================================

# Enterprise エディション + mongodb_compatible_data_access_mode を有効化することで、
# MongoDB プロトコルでの接続が可能になる。
# 接続文字列の詳細は後述の「Firestore MongoDB 互換モードの解説」を参照。

resource "google_firestore_database" "librechat" {
  project     = var.project_id
  name        = var.firestore_database_name
  location_id = var.firestore_location
  type        = "FIRESTORE_NATIVE"

  database_edition                    = "ENTERPRISE"
  mongodb_compatible_data_access_mode = "DATA_ACCESS_MODE_ENABLED"

  concurrency_mode        = "PESSIMISTIC"
  delete_protection_state = "DELETE_PROTECTION_DISABLED"
  depends_on = [google_project_service.firestore]
}

resource "google_project_service" "firestore" {
  project            = var.project_id
  service            = "firestore.googleapis.com"
  disable_on_destroy = false
}

# =================================================================
# Artifact Registry
# =================================================================

# Cloud Run は ghcr.io から直接 pull できないため、
# Artifact Registry にリモートリポジトリを作成して中継する。

resource "google_artifact_registry_repository" "ghcr_remote" {
  project       = var.project_id
  location      = var.region
  repository_id = "ghcr-remote"
  format        = "DOCKER"
  mode          = "REMOTE_REPOSITORY"

  # NOTE: custom_repository は deprecated。
  # 最新の Provider では common_repository への移行が推奨されている。
  remote_repository_config {
    docker_repository {
      custom_repository {
        uri = "https://ghcr.io"
      }
    }
  }
  depends_on = [google_project_service.artifactregistry]
}

resource "google_project_service" "artifactregistry" {
  project            = var.project_id
  service            = "artifactregistry.googleapis.com"
  disable_on_destroy = false
}

# =================================================================
# Secret Manager
# =================================================================

# LibreChat に必要なシークレット（JWT、暗号化キー等）を管理。
# Terraform ではシークレットの「箱」のみ作成する。値は apply 後に手動で設定する。
# 例: echo -n "your-secret-value" | gcloud secrets versions add dev-librechat-jwt-secret --data-file=-
# 各シークレットに対して上記コマンドを実行し、適切な値を設定すること。

locals {
  secrets = {
    jwt-secret         = "LibreChat JWT シークレット"
    jwt-refresh-secret = "LibreChat JWT リフレッシュシークレット"
    creds-key          = "LibreChat 暗号化キー"
    creds-iv           = "LibreChat 暗号化 IV"
  }
}

resource "google_secret_manager_secret" "secrets" {
  for_each  = local.secrets
  project   = var.project_id
  secret_id = "${var.environment}-librechat-${each.key}"
  replication {
    auto {}
  }
  depends_on = [google_project_service.secretmanager]
}

# Vertex AI 用 SA キーを自動生成し Secret Manager に保存
resource "google_service_account_key" "librechat_vertex" {
  service_account_id = google_service_account.librechat.name
}

resource "google_secret_manager_secret" "vertex_sa_key" {
  project   = var.project_id
  secret_id = "${var.environment}-librechat-vertex-sa-key"
  replication {
    auto {}
  }
  depends_on = [google_project_service.secretmanager]
}

resource "google_secret_manager_secret_version" "vertex_sa_key" {
  secret      = google_secret_manager_secret.vertex_sa_key.id
  secret_data = google_service_account_key.librechat_vertex.private_key
}

resource "google_project_service" "secretmanager" {
  project            = var.project_id
  service            = "secretmanager.googleapis.com"
  disable_on_destroy = false
}

# =================================================================
# Cloud Storage - librechat.yaml の配信
# =================================================================

# GCS バケットに配置し、Cloud Run の GCS FUSE マウントで読み込む。
# librechat.yaml の詳細は後述の「librechat.yaml の設定」を参照。

resource "google_storage_bucket" "librechat_config" {
  project                     = var.project_id
  name                        = "${var.project_id}-librechat-config"
  location                    = var.region
  force_destroy               = true
  uniform_bucket_level_access = true
}

resource "google_storage_bucket_object" "librechat_yaml" {
  name   = "librechat.yaml"
  bucket = google_storage_bucket.librechat_config.name
  source = "${path.module}/../librechat.yaml"
}

# =================================================================
# IAM - サービスアカウントと権限
# =================================================================

resource "google_service_account" "librechat" {
  project      = var.project_id
  account_id   = "librechat-${var.environment}"
  display_name = "LibreChat Cloud Run SA (${var.environment})"
}

resource "google_project_iam_member" "librechat_firestore" {
  project = var.project_id
  role    = "roles/datastore.user"
  member  = "serviceAccount:${google_service_account.librechat.email}"
}

resource "google_project_iam_member" "librechat_secretmanager" {
  project = var.project_id
  role    = "roles/secretmanager.secretAccessor"
  member  = "serviceAccount:${google_service_account.librechat.email}"
}

resource "google_project_iam_member" "librechat_vertexai" {
  project = var.project_id
  role    = "roles/aiplatform.user"
  member  = "serviceAccount:${google_service_account.librechat.email}"
}

resource "google_project_iam_member" "librechat_artifact_reader" {
  project = var.project_id
  role    = "roles/artifactregistry.reader"
  member  = "serviceAccount:${google_service_account.librechat.email}"
}

resource "google_storage_bucket_iam_member" "librechat_config_reader" {
  bucket = google_storage_bucket.librechat_config.name
  role   = "roles/storage.objectViewer"
  member = "serviceAccount:${google_service_account.librechat.email}"
}

# Cloud Run サービスエージェントにも Secret Manager へのアクセス権が必要。
# コンテナ起動時にシークレットを注入するのはサービスエージェントであり、
# アプリケーションの SA とは異なる。
resource "google_project_iam_member" "cloudrun_agent_secretmanager" {
  project = var.project_id
  role    = "roles/secretmanager.secretAccessor"
  member  = "serviceAccount:service-${data.google_project.current.number}@serverless-robot-prod.iam.gserviceaccount.com"
}

# =================================================================
# Cloud Run - LibreChat
# =================================================================

resource "google_cloud_run_v2_service" "librechat" {
  project             = var.project_id
  name                = "librechat-${var.environment}"
  location            = var.region
  ingress             = "INGRESS_TRAFFIC_ALL"
  deletion_protection = false

  template {
    service_account = google_service_account.librechat.email

    scaling {
      min_instance_count = 0
      max_instance_count = 2
    }

    containers {
      # Artifact Registry のリモートリポジトリ経由で ghcr.io のイメージを pull
      image = "${var.region}-docker.pkg.dev/${var.project_id}/ghcr-remote/danny-avila/librechat:v0.8.3"
      name  = "librechat"

      # PORT は Cloud Run の予約済み環境変数のため設定不可。
      # container_port を指定すると Cloud Run が自動的に PORT=3080 を設定する。
      ports {
        container_port = 3080
      }

      # GCS FUSE: バケットをディレクトリとしてマウント
      volume_mounts {
        name       = "librechat-config"
        mount_path = "/app/config"
      }

      resources {
        limits = {
          cpu    = var.librechat_cpu
          memory = var.librechat_memory
        }
        cpu_idle          = true
        startup_cpu_boost = true
      }

      # ---------- 環境変数 ----------
      env {
        name  = "HOST"
        value = "0.0.0.0"
      }

      env {
        name  = "NODE_ENV"
        value = "production"
      }
      env {
        name  = "NO_INDEX"
        value = "true"
      }
      env {
        name  = "CONFIG_PATH"
        value = "/app/config/librechat.yaml"
      }

      # Firestore MongoDB 互換接続
      # 接続文字列の詳細は後述の「Firestore MongoDB 互換モードの解説」を参照
      env {
        name  = "MONGO_URI"
        value = "mongodb://${google_firestore_database.librechat.uid}.${var.firestore_location}.firestore.goog:443/${var.firestore_database_name}?loadBalanced=true&tls=true&retryWrites=false&authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:gcp,TOKEN_RESOURCE:FIRESTORE"
      }
      # Firestore 互換との接続安定化:
      # autoIndex を無効にし、接続直後のインデックス一斉作成を抑制
      env {
        name  = "MONGO_AUTO_INDEX"
        value = "false"
      }
      env {
        name  = "MONGO_AUTO_CREATE"
        value = "false"
      }
      # mongoMeili 等の非同期エラーが uncaughtException になりクラッシュするのを防止
      env {
        name  = "CONTINUE_ON_UNCAUGHT_EXCEPTION"
        value = "true"
      }
      # Meilisearch 無効 (mongoMeili プラグインがクラッシュの原因のため)
      env {
        name  = "SEARCH"
        value = "false"
      }

      # Vertex AI (Gemini) - SA キーで認証
      env {
        name = "GOOGLE_SERVICE_KEY_FILE"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.vertex_sa_key.secret_id
            version = "latest"
          }
        }
      }
      # global を指定。リージョン指定だと一部モデルが利用不可
      env {
        name  = "GOOGLE_LOC"
        value = "global"
      }

      # Secret Manager からの参照
      env {
        name = "JWT_SECRET"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.secrets["jwt-secret"].secret_id
            version = "latest"
          }
        }
      }
      env {
        name = "JWT_REFRESH_SECRET"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.secrets["jwt-refresh-secret"].secret_id
            version = "latest"
          }
        }
      }
      env {
        name = "CREDS_KEY"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.secrets["creds-key"].secret_id
            version = "latest"
          }
        }
      }
      env {
        name = "CREDS_IV"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.secrets["creds-iv"].secret_id
            version = "latest"
          }
        }
      }
      env {
        name  = "ALLOW_REGISTRATION"
        value = "true"
      }
      env {
        name  = "SESSION_EXPIRY"
        value = "900000" # 15 min
      }
      env {
        name  = "REFRESH_TOKEN_EXPIRY"
        value = "604800000" # 7 days
      }

      startup_probe {
        http_get {
          path = "/health"
        }
        initial_delay_seconds = 10
        period_seconds        = 10
        timeout_seconds       = 5
        failure_threshold     = 30
      }

      liveness_probe {
        http_get {
          path = "/health"
        }
        period_seconds = 30
      }
    }

    volumes {
      name = "librechat-config"
      gcs {
        bucket    = google_storage_bucket.librechat_config.name
        read_only = true
      }
    }
  }

  depends_on = [
    google_project_service.run,
    google_project_service.aiplatform,
    google_secret_manager_secret.secrets,
    google_secret_manager_secret_version.vertex_sa_key,
    google_storage_bucket_object.librechat_yaml,
  ]
}

resource "google_project_service" "run" {
  project            = var.project_id
  service            = "run.googleapis.com"
  disable_on_destroy = false
}

resource "google_project_service" "aiplatform" {
  project            = var.project_id
  service            = "aiplatform.googleapis.com"
  disable_on_destroy = false
}