pgcopydb-migration-instance.tf

# GCP Terraform Template for pgcopydb Migration Instance
# Generated by PlanetScale Liftoff Migration Reviewer
# Generated on: 2026-05-29
#
# This template creates a compute instance pre-configured with pgcopydb
# for PostgreSQL-to-PlanetScale migrations.

terraform {
  required_version = ">= 1.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region

  # Optional: service account impersonation (leave vars unset to use your own credentials)
  impersonate_service_account           = var.impersonate_service_account
  impersonate_service_account_delegates = var.impersonate_delegates
}

# Variables
variable "project_id" {
  description = "GCP project ID"
  type        = string
}

variable "impersonate_service_account" {
  description = "Optional service account email to impersonate. Leave unset to use your own credentials."
  type        = string
  default     = null
}

variable "impersonate_delegates" {
  description = "Optional delegation chain for service account impersonation"
  type        = list(string)
  default     = null
}

variable "region" {
  description = "GCP region for resources"
  type        = string
  default     = "us-central1"
}

variable "zone" {
  description = "GCP zone for compute instance"
  type        = string
  default     = "us-central1-a"
}

variable "vpc_name" {
  description = "Name of existing VPC network"
  type        = string
}

variable "subnet_name" {
  description = "Name of existing subnet"
  type        = string
}

variable "service_account_email" {
  description = "Email of the service account to attach to the instance"
  type        = string
}

variable "ssh_public_key" {
  description = "SSH public key for accessing the instance. If provided, OS Login is disabled and key-based SSH is used. If omitted, OS Login is enabled (requires direct IAM access)."
  type        = string
  default     = null
}

variable "your_public_ip" {
  description = "Your public IP address to restrict direct SSH access (recommended). Leave null to allow SSH from anywhere. Get your IP from icanhazip.com. IAP tunneling is always available regardless of this setting."
  type        = string
  default     = null

  validation {
    condition     = var.your_public_ip == null || can(regex("^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", var.your_public_ip))
    error_message = "Must be null or a valid IPv4 address (e.g., 203.0.113.123)."
  }
}

variable "machine_type" {
  description = "Compute instance machine type"
  type        = string
  default     = "n2-standard-8"

  validation {
    condition     = can(regex("^(n2-standard|c3d-standard)", var.machine_type))
    error_message = "Machine type must be n2-standard or c3d-standard family."
  }
}

variable "disk_size_gb" {
  description = "Boot disk size in GB"
  type        = number
  default     = 500

  validation {
    condition     = var.disk_size_gb >= 100 && var.disk_size_gb <= 10000
    error_message = "Disk size must be between 100 and 10000 GB."
  }
}

variable "disk_type" {
  description = "Persistent disk type (pd-ssd, pd-balanced, or pd-standard)"
  type        = string
  default     = "pd-ssd"

  validation {
    condition     = contains(["pd-ssd", "pd-balanced", "pd-standard"], var.disk_type)
    error_message = "Disk type must be pd-ssd, pd-balanced, or pd-standard."
  }
}

variable "resource_prefix" {
  description = "Prefix for resource names"
  type        = string
  default     = "planetscale-migration"

  validation {
    condition     = can(regex("^[a-z][-a-z0-9]*$", var.resource_prefix))
    error_message = "Resource prefix must start with lowercase letter and contain only lowercase letters, numbers, and hyphens."
  }
}

# Enable required APIs
resource "google_project_service" "compute" {
  service            = "compute.googleapis.com"
  disable_on_destroy = false
}

resource "google_project_service" "iap" {
  service            = "iap.googleapis.com"
  disable_on_destroy = false
}

# Data sources for existing network resources
data "google_compute_network" "vpc" {
  name = var.vpc_name

  depends_on = [google_project_service.compute]
}

data "google_compute_subnetwork" "subnet" {
  name   = var.subnet_name
  region = var.region

  depends_on = [google_project_service.compute]
}

# Firewall Rules
resource "google_compute_firewall" "allow_ssh" {
  name    = "${var.resource_prefix}-allow-ssh"
  network = data.google_compute_network.vpc.id

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = var.your_public_ip != null ? ["${var.your_public_ip}/32"] : ["0.0.0.0/0"]
  target_tags   = ["${var.resource_prefix}-instance"]

  description = "Allow SSH access to migration instance"
}

resource "google_compute_firewall" "allow_iap" {
  name    = "${var.resource_prefix}-allow-iap"
  network = data.google_compute_network.vpc.id

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = ["35.235.240.0/20"]
  target_tags   = ["${var.resource_prefix}-instance"]

  description = "Allow IAP tunneling for SSH"
}

resource "google_compute_firewall" "allow_internal" {
  name    = "${var.resource_prefix}-allow-internal"
  network = data.google_compute_network.vpc.id

  allow {
    protocol = "tcp"
  }

  allow {
    protocol = "udp"
  }

  allow {
    protocol = "icmp"
  }

  source_ranges = [data.google_compute_subnetwork.subnet.ip_cidr_range]
  target_tags   = ["${var.resource_prefix}-instance"]

  description = "Allow internal VPC traffic"
}

resource "google_compute_firewall" "allow_icmp" {
  name    = "${var.resource_prefix}-allow-icmp"
  network = data.google_compute_network.vpc.id

  allow {
    protocol = "icmp"
  }

  source_ranges = ["0.0.0.0/0"]
  target_tags   = ["${var.resource_prefix}-instance"]

  description = "Allow ICMP for path MTU discovery"
}

# Compute Instance
resource "google_compute_instance" "pgcopydb_instance" {
  name         = "${var.resource_prefix}-instance"
  machine_type = var.machine_type
  zone         = var.zone

  tags = ["${var.resource_prefix}-instance"]

  labels = {
    purpose     = "postgresql-migration"
    tool        = "pgcopydb"
    environment = "migration"
    managed_by  = "terraform"
  }

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"
      size  = var.disk_size_gb
      type  = var.disk_type
    }
  }

  network_interface {
    network    = data.google_compute_network.vpc.id
    subnetwork = data.google_compute_subnetwork.subnet.id

    access_config {
      # Ephemeral external IP
    }
  }

  service_account {
    email  = var.service_account_email
    scopes = ["cloud-platform"]
  }

  metadata = var.ssh_public_key != null ? {
    ssh-keys = "ubuntu:${var.ssh_public_key}"
    } : {
    enable-oslogin = "TRUE"
  }

  metadata_startup_script = file("${path.module}/startup-script.sh")

  allow_stopping_for_update = true

  depends_on = [
    google_project_service.compute,
    google_compute_firewall.allow_ssh,
    google_compute_firewall.allow_iap,
    google_compute_firewall.allow_internal
  ]
}

# Outputs
output "instance_name" {
  description = "Name of the compute instance"
  value       = google_compute_instance.pgcopydb_instance.name
}

output "instance_id" {
  description = "ID of the compute instance"
  value       = google_compute_instance.pgcopydb_instance.id
}

output "external_ip" {
  description = "External IP address of the instance"
  value       = google_compute_instance.pgcopydb_instance.network_interface[0].access_config[0].nat_ip
}

output "internal_ip" {
  description = "Internal IP address of the instance"
  value       = google_compute_instance.pgcopydb_instance.network_interface[0].network_ip
}

output "zone" {
  description = "Zone where instance is deployed"
  value       = google_compute_instance.pgcopydb_instance.zone
}

output "service_account_email" {
  description = "Service account email"
  value       = var.service_account_email
}

output "ssh_command" {
  description = "Command to SSH into the instance"
  value       = "gcloud compute ssh ${google_compute_instance.pgcopydb_instance.name} --zone=${var.zone} --project=${var.project_id}"
}

output "iap_tunnel_command" {
  description = "Command to SSH via IAP tunnel (works without external IP)"
  value       = "gcloud compute ssh ${google_compute_instance.pgcopydb_instance.name} --zone=${var.zone} --project=${var.project_id} --tunnel-through-iap"
}

output "console_url" {
  description = "GCP Console URL for the instance"
  value       = "https://console.cloud.google.com/compute/instancesDetail/zones/${var.zone}/instances/${google_compute_instance.pgcopydb_instance.name}?project=${var.project_id}"
}

output "migration_scripts_path" {
  description = "Path to the migration helper scripts on the instance"
  value       = "/home/ubuntu/"
}

output "quick_start" {
  description = "Quick start instructions"
  value       = <<-EOT
    🚀 Quick Start Guide:

    1. Wait 10-15 minutes for instance initialization to complete

    2. Connect to the instance:
       gcloud compute ssh ${google_compute_instance.pgcopydb_instance.name} --zone=${var.zone} --project=${var.project_id}

    3. Check installation logs:
       sudo tail -f /var/log/syslog | grep startup-script

    4. Verify installations:
       pgcopydb --version
       psql --version

    5. See ~/README.md for usage instructions

    📖 Helper scripts location: /home/ubuntu/
    🌐 Console: https://console.cloud.google.com/compute/instancesDetail/zones/${var.zone}/instances/${google_compute_instance.pgcopydb_instance.name}?project=${var.project_id}
  EOT
}