Deployment

Deployment (Cloud Run + Terraform)

The service runs on Google Cloud Run as a single full-stack container (the React SPA is bundled into the backend jar and served same-origin). Infrastructure is Terraform in terraform/.

What Terraform provisions

Resource	Purpose
google_project_service	Enables the Run, Artifact Registry, Secret Manager, IAM APIs
google_artifact_registry_repository	Docker repo for the image
random_password + Secret Manager secret/version	Auto-generated JWT signing key
google_service_account + IAM	Runtime identity with secretAccessor
google_cloud_run_v2_service	The service: scale 0→1, JWT injected from Secret Manager
Cloud Run IAM (allUsers invoker)	Public access (the app still enforces JWT)

Deploy

cd terraform
cp terraform.tfvars.example terraform.tfvars   # set project_id
terraform init && terraform apply

The first apply runs a public placeholder image; then build + push your image and redeploy — or let CI do it (see CI CD Pipeline). Outputs include the service URL, the Artifact Registry path, and the secret id. Build images for linux/amd64 (Cloud Run is amd64).

Characteristics

• Scale-to-zero → ~$0 when idle; the first request after idle pays a JVM cold start (a few seconds).
• Single instance (max_instance_count = 1) because the database is in-memory H2 and the limiter is in-memory — one instance keeps the data and counters consistent.
• No managed DB / Redis in this minimal setup (in-memory H2 + in-memory limiter). Region europe-west2.
• Terraform uses ignore_changes on the service image, so CI (which updates the image) and Terraform (which owns the infra) don't fight over it.

Tear everything down with terraform destroy. See Configuration and Environments for the env vars the service reads.