Cloud: Google Cloud, Azure and Alternatives

#!/usr/bin/env bash
set -euo pipefail

PROJECT_ID="$(gcloud config get-value project)"
REGION=europe-west1
NETWORK=default

gcloud services enable container.googleapis.com artifactregistry.googleapis.com \
  sqladmin.googleapis.com secretmanager.googleapis.com file.googleapis.com \
  memorystore.googleapis.com

gcloud artifacts repositories create pocketcoffee \
  --repository-format=docker --location="$REGION"

gcloud container clusters create-auto pocketcoffee-prod \
  --location="$REGION" --release-channel=regular
gcloud container clusters get-credentials pocketcoffee-prod --location="$REGION"
kubectl create namespace pocketcoffee

# Cloud SQL for MySQL 8.4, regional (primary + standby), private address only.
gcloud sql instances create pocketcoffee-prod \
  --database-version=MYSQL_8_4 \
  --edition=ENTERPRISE \
  --tier=db-custom-4-15360 \
  --region="$REGION" \
  --availability-type=REGIONAL \
  --network="projects/$PROJECT_ID/global/networks/$NETWORK" \
  --no-assign-ip \
  --ssl-mode=ENCRYPTED_ONLY \
  --storage-type=SSD --storage-size=100GB --storage-auto-increase \
  --enable-bin-log --retained-backups-count=14 --retained-transaction-log-days=7 \
  --database-flags=log_bin_trust_function_creators=on \
  --deletion-protection

gcloud sql databases create pocketcoffee \
  --instance=pocketcoffee-prod --charset=utf8mb4 --collation=utf8mb4_unicode_ci

# The passwords come from the operator's environment, never from a file in Git.
gcloud sql users create mg_app --instance=pocketcoffee-prod --host=% --password="$MG_APP_PASSWORD"
gcloud sql users create mg_migrate --instance=pocketcoffee-prod --host=% --password="$MG_MIGRATE_PASSWORD"

# Memorystore for Valkey, one instance per purpose, a single shard (cluster mode disabled).
for purpose in cache session; do
  gcloud memorystore instances create "pocketcoffee-prod-$purpose" \
    --location="$REGION" \
    --mode=cluster-disabled \
    --shard-count=1 --replica-count=1 \
    --node-type=standard-small \
    --engine-version=VALKEY_9_0 \
    --endpoints="connections=[{pscAutoConnection={network=projects/$PROJECT_ID/global/networks/$NETWORK,projectId=$PROJECT_ID}}]" \
    --transit-encryption-mode=server-authentication \
    --authorization-mode=auth-disabled \
    --deletion-protection-enabled
done

apiVersion: batch/v1
kind: Job
metadata:
  name: pocketcoffee-migrate
  namespace: pocketcoffee
spec:
  backoffLimit: 0
  template:
    spec:
      restartPolicy: Never
      serviceAccountName: pocketcoffee-magento
      initContainers:
        - name: cloud-sql-proxy
          image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:<pinned-2.x-version>
          restartPolicy: Always
          args:
            - "--private-ip"
            - "--structured-logs"
            - "--port=3306"
            - "<project-id>:europe-west1:pocketcoffee-prod"
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          resources:
            requests: {cpu: 50m, memory: 64Mi}
      containers:
        - name: migrate
          image: europe-west1-docker.pkg.dev/<project-id>/pocketcoffee/magento:<git-sha>
          workingDir: /var/www/html
          command: ["sh", "-c"]
          args:
            - |
              # 0 = current, 2 = upgrade required, anything else = failure.
              rc=0
              bin/magento setup:db:status --no-interaction || rc=$?
              if [ "$rc" -eq 2 ]; then
                exec bin/magento setup:upgrade --keep-generated --no-interaction
              fi
              exit "$rc"
          env:
            - name: MAGENTO_DB_HOST
              value: "127.0.0.1"
          envFrom:
            - secretRef:
                name: pocketcoffee-magento

apiVersion: opensearch.org/v1
kind: OpenSearchCluster
metadata:
  name: pocketcoffee-search
  namespace: pocketcoffee
spec:
  general:
    serviceName: pocketcoffee-search
    version: "3"
  nodePools:
    - component: nodes
      replicas: 3
      diskSize: "50Gi"
      resources:
        requests:
          memory: "4Gi"
          cpu: "1"
        limits:
          memory: "4Gi"
      roles:
        - "cluster_manager"
        - "data"
  security:
    tls:
      transport:
        generate: true
      http:
        generate: true

apiVersion: rabbitmq.com/v1beta1
kind: RabbitmqCluster
metadata:
  name: pocketcoffee-mq
  namespace: pocketcoffee
spec:
  replicas: 3
  persistence:
    storageClassName: standard-rwo
    storage: 20Gi
  resources:
    requests:
      cpu: "1"
      memory: 2Gi
    limits:
      memory: 2Gi

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pocketcoffee-media
  namespace: pocketcoffee
spec:
  accessModes: ["ReadWriteMany"]
  storageClassName: enterprise-rwx
  resources:
    requests:
      storage: 1Ti

terraform {
  required_version = ">= 1.12"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 7.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = "europe-west1"
}

variable "project_id" {
  type = string
}

variable "network_id" {
  description = "Self link of the VPC with private services access configured."
  type        = string
}

resource "google_sql_database_instance" "magento" {
  name                = "pocketcoffee-prod"
  database_version    = "MYSQL_8_4"
  region              = "europe-west1"
  deletion_protection = true

  settings {
    edition           = "ENTERPRISE"
    tier              = "db-custom-4-15360"
    availability_type = "REGIONAL"
    disk_type         = "PD_SSD"
    disk_size         = 100
    disk_autoresize   = true

    backup_configuration {
      enabled                        = true
      binary_log_enabled             = true
      start_time                     = "03:00"
      transaction_log_retention_days = 7
    }

    ip_configuration {
      ipv4_enabled    = false
      private_network = var.network_id
      ssl_mode        = "ENCRYPTED_ONLY"
    }

    database_flags {
      name  = "log_bin_trust_function_creators"
      value = "on"
    }
  }
}

resource "google_sql_database" "magento" {
  name      = "pocketcoffee"
  instance  = google_sql_database_instance.magento.name
  charset   = "utf8mb4"
  collation = "utf8mb4_unicode_ci"
}

#!/usr/bin/env bash
set -euo pipefail

RG=rg-pocketcoffee
LOCATION=westeurope

az group create --name "$RG" --location "$LOCATION"
az acr create --resource-group "$RG" --name acrpocketcoffee --sku Standard

az aks create \
  --resource-group "$RG" --name pocketcoffee-prod \
  --tier standard --node-count 3 --zones 1 2 3 \
  --network-plugin azure --network-plugin-mode overlay --network-dataplane cilium \
  --enable-oidc-issuer --enable-workload-identity \
  --enable-addons azure-keyvault-secrets-provider \
  --attach-acr acrpocketcoffee --generate-ssh-keys

az aks get-credentials --resource-group "$RG" --name pocketcoffee-prod
kubectl create namespace pocketcoffee

# Azure Database for MySQL Flexible Server 8.4 in a delegated subnet (VNet integration).
az mysql flexible-server create \
  --resource-group "$RG" --name mysql-pocketcoffee-prod --location "$LOCATION" \
  --tier GeneralPurpose --sku-name Standard_D4ds_v4 --storage-size 128 \
  --version 8.4 --high-availability ZoneRedundant --zone 1 --standby-zone 2 \
  --vnet vnet-pocketcoffee --subnet snet-mysql \
  --private-dns-zone mysql-pocketcoffee.private.mysql.database.azure.com \
  --database-name pocketcoffee \
  --admin-user mg_admin --admin-password "$MYSQL_ADMIN_PASSWORD"

# Magento runs triggers: allow functions to be created under binary logging.
az mysql flexible-server parameter set \
  --resource-group "$RG" --server-name mysql-pocketcoffee-prod \
  --name log_bin_trust_function_creators --value ON

# Azure Managed Redis (Redis Enterprise based, not Valkey): one endpoint, one database.
az extension add --name redisenterprise --only-show-errors
az redisenterprise create \
  --resource-group "$RG" --cluster-name pocketcoffee-prod-cache --location "$LOCATION" \
  --sku Balanced_B5 --zones 1 2 3 \
  --clustering-policy EnterpriseCluster --eviction-policy VolatileLRU \
  --client-protocol Encrypted --minimum-tls-version 1.2 \
  --access-keys-authentication Enabled --port 10000

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: azurefile-nfs-pocketcoffee
provisioner: file.csi.azure.com
parameters:
  protocol: nfs
  skuName: Premium_LRS
reclaimPolicy: Retain
volumeBindingMode: Immediate
allowVolumeExpansion: true
mountOptions:
  - nconnect=4
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pocketcoffee-media
  namespace: pocketcoffee
spec:
  accessModes: ["ReadWriteMany"]
  storageClassName: azurefile-nfs-pocketcoffee
  resources:
    requests:
      storage: 200Gi

{
  "family": "pocketcoffee-web",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "2048",
  "memory": "4096",
  "runtimePlatform": {"cpuArchitecture": "ARM64", "operatingSystemFamily": "LINUX"},
  "executionRoleArn": "arn:aws:iam::123456789012:role/pocketcoffee-ecs-execution",
  "taskRoleArn": "arn:aws:iam::123456789012:role/pocketcoffee-prod-magento",
  "volumes": [
    {"name": "var", "host": {}},
    {
      "name": "media",
      "efsVolumeConfiguration": {
        "fileSystemId": "fs-<id>",
        "transitEncryption": "ENABLED",
        "authorizationConfig": {"accessPointId": "fsap-<id>", "iam": "ENABLED"}
      }
    }
  ],
  "containerDefinitions": [
    {
      "name": "nginx",
      "image": "123456789012.dkr.ecr.eu-west-1.amazonaws.com/pocketcoffee/magento:<git-sha>-nginx",
      "essential": true,
      "portMappings": [{"containerPort": 8080, "protocol": "tcp"}],
      "dependsOn": [{"containerName": "php-fpm", "condition": "START"}],
      "mountPoints": [{"sourceVolume": "media", "containerPath": "/var/www/html/pub/media", "readOnly": true}]
    },
    {
      "name": "php-fpm",
      "image": "123456789012.dkr.ecr.eu-west-1.amazonaws.com/pocketcoffee/magento:<git-sha>",
      "essential": true,
      "readonlyRootFilesystem": true,
      "environment": [
        {"name": "MAGENTO_MODE", "value": "production"},
        {"name": "MAGENTO_DB_HOST", "value": "<rds-endpoint>"},
        {"name": "MAGENTO_DB_NAME", "value": "pocketcoffee"},
        {"name": "MAGENTO_DB_USER", "value": "mg_app"},
        {"name": "MAGENTO_VARNISH_HOSTS", "value": "<varnish-task-addresses>"}
      ],
      "secrets": [
        {"name": "MAGENTO_DB_PASSWORD", "valueFrom": "arn:aws:secretsmanager:eu-west-1:123456789012:secret:pocketcoffee/prod/magento-<suffix>:db_app_password::"},
        {"name": "MAGENTO_CRYPT_KEY", "valueFrom": "arn:aws:secretsmanager:eu-west-1:123456789012:secret:pocketcoffee/prod/magento-<suffix>:crypt_key::"}
      ],
      "mountPoints": [
        {"sourceVolume": "var", "containerPath": "/var/www/html/var"},
        {"sourceVolume": "media", "containerPath": "/var/www/html/pub/media"}
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/pocketcoffee-web",
          "awslogs-region": "eu-west-1",
          "awslogs-stream-prefix": "php-fpm"
        }
      }
    }
  ]
}

#!/usr/bin/env bash
# User data of the "worker" Auto Scaling group (min = max = 1): cron and consumers only.
set -euo pipefail

APP=/var/www/html
install -d -o www-data -g www-data "$APP/var"

# The release is an AMI or a pulled artifact that already holds the compiled code (no setup:di:compile here).
mount -t efs -o tls,accesspoint=fsap-0123456789abcdef0 fs-0123456789abcdef0:/ "$APP/pub/media"

cat > /etc/systemd/system/magento-cron.service <<'UNIT'
[Unit]
Description=Magento cron:run (one scheduler for the whole fleet)

[Service]
Type=oneshot
User=www-data
WorkingDirectory=/var/www/html
EnvironmentFile=/etc/magento/env
ExecStart=/usr/bin/php bin/magento cron:run
UNIT

cat > /etc/systemd/system/magento-cron.timer <<'UNIT'
[Unit]
Description=Run Magento cron every minute

[Timer]
OnCalendar=*-*-* *:*:00
AccuracySec=1s

[Install]
WantedBy=timers.target
UNIT

cat > /etc/systemd/system/magento-consumer@.service <<'UNIT'
[Unit]
Description=Magento queue consumer %i
After=network-online.target

[Service]
User=www-data
WorkingDirectory=/var/www/html
EnvironmentFile=/etc/magento/env
ExecStart=/usr/bin/php bin/magento queue:consumers:start %i --max-messages=1000
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload
systemctl enable --now magento-cron.timer
for consumer in async.operations.all product_action_attribute.update media.storage.catalog.image.resize; do
  systemctl enable --now "magento-consumer@${consumer}.service"
done