feat: add platform terraform for GKE deployment

platform/README.md

@@ -0,0 +1,112 @@
+# Platform Infrastructure
+
+Terraform configuration for deploying Vellum Assistant to GKE.
+
+## Architecture
+
+```
+                    ┌─────────────────┐
+                    │  assistant.     │
+                    │  vellum.ai      │
+                    └────────┬────────┘
+                             │
+                    ┌────────▼────────┐
+                    │  Cloud Load     │
+                    │  Balancer       │
+                    │  (Static IP)    │
+                    └────────┬────────┘
+                             │
+                    ┌────────▼────────┐
+                    │  GKE Ingress    │
+                    │  (SSL/TLS)      │
+                    └────────┬────────┘
+                             │
+              ┌──────────────┼──────────────┐
+              │              │              │
+        ┌─────▼─────┐  ┌─────▼─────┐  ┌─────▼─────┐
+        │  Pod 1    │  │  Pod 2    │  │  Pod N    │
+        │  Next.js  │  │  Next.js  │  │  Next.js  │
+        └───────────┘  └───────────┘  └───────────┘
+```
+
+## Prerequisites
+
+1. GCP project with billing enabled
+2. `gcloud` CLI authenticated
+3. Terraform >= 1.0
+4. Existing GKE cluster (or set `create_cluster = true`)
+
+## Quick Start
+
+```bash
+cd terraform
+
+# Copy and edit variables
+cp terraform.tfvars.example terraform.tfvars
+
+# Set sensitive variables via environment
+export TF_VAR_database_url="postgresql://..."
+export TF_VAR_anthropic_api_key="sk-ant-..."
+
+# Initialize Terraform
+terraform init
+
+# Plan changes
+terraform plan
+
+# Apply
+terraform apply
+```
+
+## DNS Setup
+
+After applying, Terraform outputs the static IP. Create an A record:
+
+```
+assistant.vellum.ai -> <ingress_ip from output>
+```
+
+The managed SSL certificate will auto-provision once DNS propagates.
+
+## Building the Docker Image
+
+```bash
+cd ../web
+
+# Build
+docker build -t gcr.io/PROJECT_ID/vellum-assistant:latest .
+
+# Push
+docker push gcr.io/PROJECT_ID/vellum-assistant:latest
+```
+
+## Files
+
+- `main.tf` - GCP provider, GKE cluster, static IP, SSL cert
+- `k8s.tf` - Kubernetes deployment, service, ingress
+- `variables.tf` - Input variables
+- `outputs.tf` - Useful outputs
+- `terraform.tfvars.example` - Example configuration
+
+## Using Existing Cluster
+
+If you have an existing GKE cluster:
+
+```hcl
+create_cluster = false
+cluster_name   = "your-existing-cluster"
+```
+
+The Terraform will deploy the app to the existing cluster.
+
+## Creating New Cluster
+
+```hcl
+create_cluster = true
+cluster_name   = "vellum-assistant"
+```
+
+This creates a private GKE cluster with:
+- Workload Identity enabled
+- Autoscaling node pool (1-3 nodes)
+- Network policy enabled

platform/terraform/k8s.tf

@@ -0,0 +1,184 @@
+# Kubernetes Namespace
+resource "kubernetes_namespace" "vellum_assistant" {
+  metadata {
+    name = "vellum-assistant"
+
+    labels = {
+      app = "vellum-assistant"
+      env = var.environment
+    }
+  }
+}
+
+# ConfigMap for non-sensitive config
+resource "kubernetes_config_map" "app_config" {
+  metadata {
+    name      = "vellum-assistant-config"
+    namespace = kubernetes_namespace.vellum_assistant.metadata[0].name
+  }
+
+  data = {
+    NODE_ENV = "production"
+  }
+}
+
+# Secret for sensitive values
+resource "kubernetes_secret" "app_secrets" {
+  metadata {
+    name      = "vellum-assistant-secrets"
+    namespace = kubernetes_namespace.vellum_assistant.metadata[0].name
+  }
+
+  data = {
+    DATABASE_URL      = var.database_url
+    ANTHROPIC_API_KEY = var.anthropic_api_key
+  }
+
+  type = "Opaque"
+}
+
+# Deployment
+resource "kubernetes_deployment" "app" {
+  metadata {
+    name      = "vellum-assistant"
+    namespace = kubernetes_namespace.vellum_assistant.metadata[0].name
+
+    labels = {
+      app = "vellum-assistant"
+    }
+  }
+
+  spec {
+    replicas = var.app_replicas
+
+    selector {
+      match_labels = {
+        app = "vellum-assistant"
+      }
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "vellum-assistant"
+        }
+      }
+
+      spec {
+        container {
+          name  = "web"
+          image = var.app_image
+
+          port {
+            container_port = 3000
+          }
+
+          env_from {
+            config_map_ref {
+              name = kubernetes_config_map.app_config.metadata[0].name
+            }
+          }
+
+          env_from {
+            secret_ref {
+              name = kubernetes_secret.app_secrets.metadata[0].name
+            }
+          }
+
+          resources {
+            requests = {
+              cpu    = "100m"
+              memory = "256Mi"
+            }
+            limits = {
+              cpu    = "500m"
+              memory = "512Mi"
+            }
+          }
+
+          liveness_probe {
+            http_get {
+              path = "/api/health"
+              port = 3000
+            }
+            initial_delay_seconds = 30
+            period_seconds        = 10
+          }
+
+          readiness_probe {
+            http_get {
+              path = "/api/health"
+              port = 3000
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 5
+          }
+        }
+      }
+    }
+  }
+}
+
+# Service
+resource "kubernetes_service" "app" {
+  metadata {
+    name      = "vellum-assistant"
+    namespace = kubernetes_namespace.vellum_assistant.metadata[0].name
+
+    annotations = {
+      "cloud.google.com/neg" = jsonencode({
+        ingress = true
+      })
+    }
+  }
+
+  spec {
+    selector = {
+      app = "vellum-assistant"
+    }
+
+    port {
+      port        = 80
+      target_port = 3000
+    }
+
+    type = "ClusterIP"
+  }
+}
+
+# Ingress with Google-managed SSL
+resource "kubernetes_ingress_v1" "app" {
+  metadata {
+    name      = "vellum-assistant"
+    namespace = kubernetes_namespace.vellum_assistant.metadata[0].name
+
+    annotations = {
+      "kubernetes.io/ingress.class"                 = "gce"
+      "kubernetes.io/ingress.global-static-ip-name" = google_compute_global_address.ingress_ip.name
+      "ingress.gcp.kubernetes.io/pre-shared-cert"   = google_compute_managed_ssl_certificate.default.name
+      "kubernetes.io/ingress.allow-http"            = "false"
+    }
+  }
+
+  spec {
+    rule {
+      host = var.domain
+
+      http {
+        path {
+          path      = "/*"
+          path_type = "ImplementationSpecific"
+
+          backend {
+            service {
+              name = kubernetes_service.app.metadata[0].name
+              port {
+                number = 80
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}