feat: add terraform module for partners

infra/migration.py

@@ -0,0 +1,22 @@
+from google.oauth2 import service_account
+from google.cloud import datastore
+
+credentials_source = service_account.Credentials.from_service_account_file(
+    '../source-service-keys.json')
+client_source = datastore.Client(project="pagoda-discovery-platform-dev", credentials=credentials_source)
+
+credentials_target = service_account.Credentials.from_service_account_file(
+    '../target-service-keys.json')
+client_target = datastore.Client(project="pagoda-discovery-platform-prod", credentials=credentials_target)
+
+print('Fetching source entities')
+query = credentials_source.query(kind="EncryptedUserCredentials-dev")
+entities = []
+for entity in list(query.fetch()):
+    entity.key = client_target.key('EncryptedUserCredentials-mainnet').completed_key(entity.key.id_or_name)
+    print(entity.key)
+    print(entity)
+    entities.append(entity)
+
+print("Uploading a total of " + str(len(entities)) + " entities to target")
+client_target.put_multi(entities)

infra/partner/main.tf

@@ -0,0 +1,98 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "4.66.0"
+    }
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "3.0.2"
+    }
+  }
+}
+
+locals {
+  credentials  = file(var.credentials_file)
+  client_email = jsondecode(local.credentials).client_email
+  client_id    = jsondecode(local.credentials).client_id
+}
+
+provider "google" {
+  credentials = local.credentials
+
+  project = var.project
+  region  = var.region
+  zone    = var.zone
+}
+
+provider "docker" {
+  registry_auth {
+    address  = "${var.region}-docker.pkg.dev"
+    username = "_json_key"
+    password = local.credentials
+  }
+}
+
+resource "google_service_account" "service_account" {
+  account_id   = "mpc-recovery-${var.env}"
+  display_name = "MPC Recovery ${var.env} Account"
+}
+
+resource "google_service_account_iam_binding" "serivce-account-iam" {
+  service_account_id = google_service_account.service_account.name
+  role               = "roles/iam.serviceAccountUser"
+
+  members = [
+    "serviceAccount:${local.client_email}",
+  ]
+}
+
+resource "google_project_iam_binding" "service-account-datastore-user" {
+  project = var.project
+  role    = "roles/datastore.user"
+
+  members = [
+    "serviceAccount:${google_service_account.service_account.email}",
+  ]
+}
+
+resource "google_artifact_registry_repository" "mpc_recovery" {
+  repository_id = "mpc-recovery-signer-${var.env}"
+  format        = "DOCKER"
+}
+
+resource "docker_registry_image" "mpc_recovery" {
+  name          = docker_tag.mpc_recovery.target_image
+  keep_remotely = true
+}
+
+resource "docker_tag" "mpc_recovery" {
+  source_image = var.docker_image
+  target_image = "${var.region}-docker.pkg.dev/${var.project}/${google_artifact_registry_repository.mpc_recovery.name}/mpc-recovery-${var.env}"
+}
+
+# resource "docker_image" "mpc_recovery" {
+#   name = "${var.region}-docker.pkg.dev/${var.project}/${google_artifact_registry_repository.mpc_recovery.name}/mpc-recovery-${var.env}"
+#   build {
+#     context = "${path.cwd}/.."
+#   }
+# }
+
+module "signer" {
+  source = "../modules/signer"
+
+  env                   = var.env
+  project               = var.project
+  region                = var.region
+  zone                  = var.zone
+  service_account_email = google_service_account.service_account.email
+  docker_image          = docker_tag.mpc_recovery.target_image
+
+  node_id              = var.node_id
+  firebase_audience_id = var.firebase_audience_id
+
+  cipher_key = var.cipher_key
+  sk_share   = var.sk_share
+
+  depends_on = [docker_registry_image.mpc_recovery]
+}

infra/partner/variables.tf

@@ -0,0 +1,35 @@
+variable "env" {
+}
+
+variable "project" {
+}
+
+variable "credentials_file" {}
+
+variable "region" {
+  default = "us-east1"
+}
+
+variable "zone" {
+  default = "us-east1-c"
+}
+
+# Application variables
+variable "firebase_audience_id" {
+  default = "pagoda-oboarding-dev"
+}
+
+variable "docker_image" {
+}
+
+variable "node_id" {
+}
+
+# Secrets
+variable "cipher_key" {
+  type = string
+}
+
+variable "sk_share" {
+  type = string
+}