Phase A — Migrate Treepolitics API to Cloud Run

[amrtgaber]

Goal

Deploy the FastAPI backend to Cloud Run in treepolitics-prod, replacing the local docker-compose setup. End state: api.treepolitics.net serves the live API from Cloud Run.

Steps

1. Enable required APIs on treepolitics-prod: run, sqladmin, secretmanager, artifactregistry, cloudbuild.
2. Create Artifact Registry Docker repo; build + push first image from the existing Dockerfile.
3. Provision Cloud SQL Postgres (smallest tier, ~$10–15/mo).
4. Create Secret Manager secrets: SECRET_KEY, DATABASE_URL, anything else currently in .env.
5. First Cloud Run deploy with Cloud SQL Auth Proxy sidecar.
6. Run Alembic migrations against Cloud SQL.
7. Smoke-test API endpoints.
8. Wire api.treepolitics.net DNS → Cloud Run.

Done when

• api.treepolitics.net serves the FastAPI app
• DB migrations applied against Cloud SQL
• All secrets sourced from Secret Manager (no .env in prod)

Cost estimate

~$10–15/mo (dominated by Cloud SQL).

Notes

Prerequisite for Phase C (frontend wiring) and Phase D (CI/CD).

[amrtgaber]

Phase A status — checkpointed 2026-05-08

Branch phase-a-cloud-run pushed @ acae363. Not yet PR'd.

Done

GCP infra (all in treepolitics-prod, region us-east1):

• APIs enabled: run, sqladmin, secretmanager, artifactregistry, cloudbuild.
• Cloud SQL: instance treepolitics-db (Postgres 16, ENTERPRISE edition, db-f1-micro, zonal). Connection: treepolitics-prod:us-east1:treepolitics-db. Public IP, no authorized networks (only reachable via Cloud SQL connector).
• DB treepolitics and user app (password in Secret Manager).
• Artifact Registry: docker repo api. Image base: us-east1-docker.pkg.dev/treepolitics-prod/api/api.
• Runtime SA: treepolitics-api-runtime@treepolitics-prod.iam.gserviceaccount.com, roles: cloudsql.client (project) + secretmanager.secretAccessor (resource-scoped to the two secrets).
• Compute default SA granted Cloud Build's standard role bundle (cloudbuild.builds.builder, artifactregistry.writer, logging.logWriter) — required since the April-2024 migration off the legacy Cloud Build SA.
• Secrets in Secret Manager: DATABASE_URL (asyncpg URL with /cloudsql Unix-socket host), SECRET_KEY (32-byte hex).

Code changes (committed on phase-a-cloud-run @ acae363):

• start.sh: alembic-on-startup removed.
• scripts/deploy.sh: canonical Cloud Build + gcloud run deploy invocation, image tags pinned to git short-SHA.
• docker-compose.yml: one-shot migrate service so local dev keeps auto-migrating.
• README.md: Production Deployment (Cloud Run) section.
• .env.production.example: prod env-var reference.

Bootstrap deploy (with image built from main @ 44eb17e, not from the new branch):

• Image: us-east1-docker.pkg.dev/treepolitics-prod/api/api:44eb17e.
• Migrations applied to prod DB via cloud-sql-proxy + local alembic. Head: c4e8f2a1b5d7.
• Cloud Run service treepolitics-api deployed (revision treepolitics-api-00001-hwh), env vars + secrets bound, Cloud SQL attached, --allow-unauthenticated requested.
• Service URL: https://treepolitics-api-825485923973.us-east1.run.app.

Blocker hit + partial fix

Org has DRS (constraints/iam.allowedPolicyMemberDomains) restricting IAM bindings to two customer IDs (C03rv6vto/treepolitics.net, C037f536c/agtechgroup.solutions). allUsers doesn't satisfy any customer → public invoker binding rejected (HTTP 403 on the service URL).

Project-level override applied: allValues: ALLOW on the constraint, scoped to treepolitics-prod only — keeps the org-wide DRS protection but exempts this project. Effective policy on the project confirms ALLOW-all. However, IAM was still rejecting allUsers bindings as of checkpoint — almost certainly cache propagation (Google docs: up to 7 min).

Remaining

1. Confirm the allUsers binding goes through (retry; cache should be propagated by next session):

   gcloud run services add-iam-policy-binding treepolitics-api \
     --region=us-east1 --member=allUsers --role=roles/run.invoker \
     --account=amr@agtechgroup.solutions --project=treepolitics-prod
   

   If still rejected after waiting, check gcloud resource-manager org-policies describe iam.allowedPolicyMemberDomains --project=treepolitics-prod --effective is still allValues: ALLOW.

2. Redeploy with the new branch (current revision was built from main, before the start.sh change):

   git checkout phase-a-cloud-run
   ./scripts/deploy.sh
   

3. Smoke-test at https://treepolitics-api-825485923973.us-east1.run.app/: /, /health, /docs, register/login round-trip.

4. Domain mapping for api.treepolitics.net:

   gcloud run domain-mappings create --service=treepolitics-api \
     --domain=api.treepolitics.net --region=us-east1 \
     --account=amr@agtechgroup.solutions --project=treepolitics-prod
   

   Add the CNAME at the registrar per the command's output. Wait for managed cert to provision.

5. Final smoke-test at https://api.treepolitics.net.

6. Open the PR, wait for CI, merge phase-a-cloud-run into main.

Cost so far

~$0.30/day Cloud SQL idle + minimal Cloud Run idle + a few cents storage. Trending well under the $10–15/mo issue estimate.

Resume command (any machine)

cd treepolitics-api
git fetch && git checkout phase-a-cloud-run && git pull
gcloud auth login amr@agtechgroup.solutions   # if reauth needed
# Then start at "Remaining" #1 above.

[amrtgaber]

Phase A status — checkpointed 2026-05-09

Branch phase-a-cloud-run still @ acae363. Not yet PR'd. Parked pending Will (DNS, unavailable a few days).

Done since last checkpoint

• allUsers invoker binding confirmed. DRS cache had propagated by the next session; the binding from yesterday is live. gcloud run services get-iam-policy treepolitics-api --region=us-east1 --project=treepolitics-prod returns allUsers: roles/run.invoker. Effective iam.allowedPolicyMemberDomains on the project is still allValues: ALLOW.

• Redeployed from branch. ./scripts/deploy.sh ran cleanly. New revision treepolitics-api-00002-8sr serving 100% traffic, image us-east1-docker.pkg.dev/treepolitics-prod/api/api:acae363 (built from phase-a-cloud-run HEAD, replacing the :44eb17e bootstrap image).

• Smoke test green at https://treepolitics-api-ogj3oialea-ue.a.run.app (and the equivalent …-825485923973.… form):

  • GET / → 200 {"status":"ok","message":"API Template"}
  • GET /health → 200 {"status":"healthy"}
  • GET /docs → 200 (Scalar UI)
  • POST /auth/register → 201
  • POST /auth/jwt/login → 204 + Set-Cookie: app_access=…; Domain=.treepolitics.net; HttpOnly; SameSite=none; Secure (and app_refresh on /auth/refresh)
  • GET /auth/me (with cookie) → 200
  • POST /notes + GET /notes (with cookie) → 201 / 200

  Note: the cookies have Domain=.treepolitics.net, so curl's auto-jar drops them on a .run.app host (RFC 6265). Had to extract app_access from the response headers and re-send via Cookie:. This is correct prod behavior — once api.treepolitics.net is mapped, browser/cURL auto-handling will work.

Blocker

gcloud beta run domain-mappings create --domain=api.treepolitics.net … rejects with:

The provided domain does not appear to be verified for the current account. … Currently verified domains: agtechgroup.solutions, criticalbit.gg.

Verification is per-account (tied to amr@agtechgroup.solutions), happens via Google Search Console, and requires a TXT record at the apex. Tried the Site Verification REST API as a CLI shortcut — gcloud's default access token is missing the siteverification scope (ACCESS_TOKEN_SCOPE_INSUFFICIENT), and broadening the scope means re-running gcloud auth login with --enable-gdrive-access-style flags or hand-issuing OAuth tokens, which mutates shared auth state. Not worth it; browser flow is two minutes.

Current DNS state (for context)

• api.treepolitics.net → A 75.101.201.152 (legacy host — must be removed during cutover)
• treepolitics.net → A 75.2.60.5
• www.treepolitics.net → CNAME treepolitics-web.netlify.app (Netlify, leave alone)

Remaining — split by who-does-what

Step 1 — Amr (browser, ~2 min):

1. Open https://search.google.com/search-console/welcome signed in as amr@agtechgroup.solutions.
2. Choose Domain property type, enter treepolitics.net (apex — verifying it covers all subdomains).
3. Search Console shows a TXT record. Copy the host (usually @) and the full value (google-site-verification=…). Don't click Verify yet.

Step 2 — Will (Spaceship DNS):

1. Add the TXT record from Step 1 to treepolitics.net (host @, type TXT, value google-site-verification=…). TTL default is fine.
2. Confirm to Amr when saved.

Step 3 — Amr (browser):

1. In Search Console, click Verify. Should succeed within a few minutes of Will's TXT propagating.
2. Confirm with gcloud domains list-user-verified --account=amr@agtechgroup.solutions --project=treepolitics-prod — treepolitics.net should now appear.

Step 4 — Resume Claude session. Run:

gcloud beta run domain-mappings create \
  --service=treepolitics-api \
  --domain=api.treepolitics.net \
  --region=us-east1 \
  --account=amr@agtechgroup.solutions \
  --project=treepolitics-prod

Output will list the required DNS records — for a subdomain, expect a single CNAME api.treepolitics.net → ghs.googlehosted.com..

Step 5 — Will (Spaceship DNS, cutover):

1. Remove the existing A api.treepolitics.net → 75.101.201.152 record.
2. Add the CNAME api → ghs.googlehosted.com. from Step 4 output. (Some registrars want the trailing dot; Spaceship is fine with or without.)
3. TTL low (300s) is nice for a quick rollback if needed.

Step 6 — Resume Claude session, final:

1. Wait for managed cert (gcloud beta run domain-mappings describe --domain=api.treepolitics.net … until CertificateProvisioned: True; usually 15–60 min after the CNAME goes live).
2. Re-run smoke test (/, /health, /docs, register/login round-trip) at https://api.treepolitics.net — cookies should round-trip naturally on this host.
3. Open PR phase-a-cloud-run → main, watch CI, merge on Amr's approval.

Resume command (any machine)

cd treepolitics-api
git fetch && git checkout phase-a-cloud-run && git pull
gcloud auth login amr@agtechgroup.solutions   # if reauth needed
# then start at Step 4 above (Step 1–3 are out-of-band).

Cost

Still trending well under issue estimate. Cloud SQL idle dominates (~$0.30/day); Cloud Run idle is negligible.

[amrtgaber]

Update — 2026-05-09 (post-parking)

PR #7 (phase-a-cloud-run → main) was opened, CI green (lint + test), and squash-merged as fefc9c3 Wire up Cloud Run deployment (#7). Remote branch deleted. Cloud Run still serving from image :acae363; the squash on main has the same tree, so no redeploy needed.

Resume command (updated — supersedes the one in the previous comment)

The previous resume command pointed at the now-deleted phase-a-cloud-run branch. Use this instead, works from any machine including a fresh checkout:

# fresh machine — install gcloud + gh CLI, then:
git clone git@github.com:ag-tech-group/treepolitics-api.git
cd treepolitics-api

# existing checkout:
cd treepolitics-api && git checkout main && git pull

# auth (always specify the account; never bare `gcloud auth login`):
gcloud auth login amr@agtechgroup.solutions

# verify the prereq landed (treepolitics.net should appear here before continuing):
gcloud domains list-user-verified \
  --account=amr@agtechgroup.solutions --project=treepolitics-prod

# then jump to Step 4 in the previous checkpoint comment.

What's repo-resident vs. memory-resident

Everything needed to resume is in this issue + the repo. Specifically:

• scripts/deploy.sh (in repo) is the entry point if a code change needs to ship before the DNS cutover.
• All identifiers used in commands above (project, region, service, runtime SA, SQL instance) are inline in scripts/deploy.sh. No machine-local lookups required.
• Sensitive identifiers (org ID, billing account ID, Cloud Identity customer ID) are not needed for the remaining domain-mapping work. If they ever are, they're reproducible from gcloud organizations list / gcloud billing accounts list once authed.

One gotcha worth re-stating (would otherwise live only in machine-local memory)

Don't try to skip Search Console with the Site Verification REST API — gcloud auth print-access-token returns a token without the siteverification scope (ACCESS_TOKEN_SCOPE_INSUFFICIENT), and broadening it requires gcloud auth login with extra scopes which mutates shared credential state. Browser flow is two minutes; just do that.

[amrtgaber]

Phase A complete 2026-05-29. api.treepolitics.net is live on Cloud Run over HTTPS (Google-managed TLS). DB migrations applied against Cloud SQL; all secrets sourced from Secret Manager. DNS cut over in Route 53 (api A 75.101.201.152 -> CNAME ghs.googlehosted.com).