arche2025h2 configs

deployment/live/gcp/static-ct-staging/cloudbuild/preloader/arche2025h1/terragrunt.hcl

@@ -0,0 +1,18 @@
+terraform {
+  source = "${get_repo_root()}/deployment/modules/gcp//cloudbuild/preloader"
+}
+
+locals {
+  source_log_uri = "https://ct.googleapis.com/logs/us1/argon2025h1"
+}
+
+include "root" {
+  path   = find_in_parent_folders()
+  expose = true
+}
+
+inputs = merge(
+  local,
+  include.root.locals,
+)
+

deployment/live/gcp/static-ct-staging/cloudbuild/preloader/arche2025h2/terragrunt.hcl

@@ -0,0 +1,18 @@
+terraform {
+  source = "${get_repo_root()}/deployment/modules/gcp//cloudbuild/preloader"
+}
+
+locals {
+  source_log_uri = "https://ct.googleapis.com/logs/us1/argon2025h2"
+}
+
+include "root" {
+  path   = find_in_parent_folders()
+  expose = true
+}
+
+inputs = merge(
+  local,
+  include.root.locals,
+)
+

deployment/live/gcp/static-ct-staging/cloudbuild/preloader/terragrunt.hcl

@@ -1,27 +1,20 @@
-terraform {
-  source = "${get_repo_root()}/deployment/modules/gcp//cloudbuild/preloader"
-}
-
 locals {
   env            = get_env("GOOGLE_ENV", "staging")
-  docker_env     = get_env("GOOGLE_ENV", "staging")
   project_id     = get_env("GOOGLE_PROJECT", "static-ct-staging")
   location       = get_env("GOOGLE_REGION", "us-central1")
+  base_name      = path_relative_to_include()
   github_owner   = get_env("GITHUB_OWNER", "transparency-dev")
-  source_log_uri = get_env("SOURCE_LOG_URI", "https://ct.googleapis.com/logs/us1/argon2025h1")
-  submission_url = get_env("SUBMISSION_URL", "https://arche2025h1-64t3hlisgq-uc.a.run.app/arche2025h1.ct.transparency.dev")
-  monitoring_url = get_env("MONITORING_URL", " https://storage.googleapis.com/static-ct-staging-arche2025h1-bucket")
+  submission_url = get_env("SUBMISSION_URL", "https://${local.base_name}-64t3hlisgq-uc.a.run.app/${local.base_name}.ct.transparency.dev")
+  monitoring_url = get_env("MONITORING_URL", " https://storage.googleapis.com/static-ct-staging-${local.base_name}-bucket")
 }
 
-inputs = local
-
 remote_state {
   backend = "gcs"
 
   config = {
     project  = local.project_id
     location = local.location
-    bucket   = "${local.project_id}-cloudbuild-preloader-terraform-state"
+    bucket   = "${local.project_id}-preloader-${local.base_name}-terraform-state"
     prefix   = "terraform.tfstate"
 
     gcs_bucket_labels = {

deployment/live/gcp/static-ct-staging/cloudbuild/arche2025h1/README.md → deployment/live/gcp/static-ct-staging/cloudbuild/tesseract/README.md

@@ -6,9 +6,8 @@ The Cloud Build pipeline is triggered when a commit in the repo is tagged with
 `^staging-deploy-(.+)$` and is responsible for:
 
 1. Building the `cmd/gcp` and `cmd/gcp/staging` docker images from the last commit with a `^staging-deploy-(.+)$` tag,
-1. Deploying the `cmd/gcp/staging` image to Cloud Run,
-1. Update [arche2025h1](/deployment/live/gcp/static-ct-staging/logs/arche2025h1/) Cloud Run service with the latest docker image,
-1. Update [arche2025h1](/deployment/live/gcp/static-ct-staging/logs/arche2025h1/) infrastructure with the latest Terraform config.
+1. Update [staging logs'](/deployment/live/gcp/static-ct-staging/logs/) Cloud Run service with the latest docker image,
+1. Update [staging logs'](/deployment/live/gcp/static-ct-staging/logs/) infrastructure with the latest Terraform config.
 
 ## Initial setup
 

deployment/live/gcp/static-ct-staging/cloudbuild/tesseract/terragrunt.hcl

@@ -0,0 +1,31 @@
+terraform {
+  source = "${get_repo_root()}/deployment/modules/gcp//cloudbuild/tesseract"
+}
+
+locals {
+  env              = get_env("GOOGLE_ENV", "staging")
+  docker_env       = get_env("GOOGLE_ENV", "staging")
+  project_id       = get_env("GOOGLE_PROJECT", "static-ct-staging")
+  location         = get_env("GOOGLE_REGION", "us-central1")
+  github_owner     = get_env("GITHUB_OWNER", "transparency-dev")
+  logs_terragrunts = ["deployment/live/gcp/static-ct-staging/logs/arche2025h1", "deployment/live/gcp/static-ct-staging/logs/arche2025h2"]
+}
+
+inputs = local
+
+remote_state {
+  backend = "gcs"
+
+  config = {
+    project  = local.project_id
+    location = local.location
+    bucket   = "${local.project_id}-cloudbuild-terraform-state"
+    prefix   = "terraform.tfstate"
+
+    gcs_bucket_labels = {
+      name = "terraform_state"
+      env  = "${local.env}"
+    }
+  }
+}
+

deployment/live/gcp/static-ct-staging/logs/arche2025h2/README.md

@@ -0,0 +1,62 @@
+# Arche2025h2 staging log
+
+## Overview
+
+This config uses the [gcp/tesseract/cloudrun](/deployment/modules/gcp/tesseract/cloudrun) module to
+run TesseraCT on Cloud Run, backed by Trillian Tessera and preloaded with argon2025h2 entries.
+
+### Update the roots
+Run the following command from the root of the repository.
+
+It fetches roots from argon2025h2, and filters out roots that don't parse with `crypto/x509` and `internal/lax509`.
+As of 2025-03-21, these roots are:
+- https://crt.sh/?id=298, with a negative serial number
+- https://crt.sh/?id=9027356, affected by https://github.com/golang/go/issues/69463.
+
+```
+go run github.com/google/certificate-transparency-go/client/ctclient@master get-roots --log_uri=https://ct.googleapis.com/logs/us1/argon2025h2/ --text=false | \
+awk \
+  '/-----BEGIN CERTIFICATE-----/{c=1; pem=$0; show=1; next}
+   c{pem=pem ORS $0}
+   /-----END CERTIFICATE-----/{c=0; if(show) print pem}
+   ($0=="MIIFxDCCBKygAwIBAgIBAzANBgkqhkiG9w0BAQUFADCCAUsxGDAWBgNVBC0DDwBT"||$0=="MIIFVjCCBD6gAwIBAgIQ7is969Qh3hSoYqwE893EATANBgkqhkiG9w0BAQUFADCB"){show=0}' \
+   > deployment/live/gcp/static-ct-staging/logs/arche2025h2/roots.pem
+```
+
+
+### Automatic Deployment
+This GCP SCTFE preloaded staging environment is designed to be deployed by the Cloud Build ([Terraform module](/deployment/modules/gcp/cloudbuild/tesseract/), [Terragrunt configuration](/deployment/live/gcp/static-ct-staging/cloudbuild/arche2025h2/)).
+
+### Manual Deployment
+TODO(phboneff): come back to this, Cloud Run doesn't trigger a deployment if the tag does not change value.
+
+First authenticate via `gcloud` as a principle with sufficient ACLs for
+the project:
+
+```sh
+gcloud auth application-default login
+```
+
+Set the required environment variables:
+
+```sh
+export GOOGLE_PROJECT={VALUE}
+export GOOGLE_REGION={VALUE} # e.g: us-central1
+unset TESSERA_BASE_NAME
+```
+
+You need an Artifact Registry repository to store container images; adapt the configs and commands below to use your registry of choice. The rest of these instructions assume that the repository is hosted on GCP, and called `${GOOGLE_REGION}-docker.pkg.dev/${GOOGLE_PROJECT}/docker-staging`. For reference, here's a [terraform module](/deployment/modules/gcp/artifactregistry/) you can use to set up such a registry.
+
+Build and push the Docker image to Artifact Registry repository:
+
+```sh
+gcloud auth configure-docker ${GOOGLE_REGION}-docker.pkg.dev
+docker build -f ./cmd/gcp/Dockerfile -t tesseract-gcp:latest .
+docker build -f ./cmd/gcp/staging/Dockerfile -t conformance-gcp:latest .
+docker tag conformance-gcp:latest ${GOOGLE_REGION}-docker.pkg.dev/${GOOGLE_PROJECT}/docker-staging/conformance-gcp:latest
+docker push ${GOOGLE_REGION}-docker.pkg.dev/${GOOGLE_PROJECT}/docker-staging/conformance-gcp
+```
+
+Terraforming the project can be done by:
+  1. `cd` to [/deployment/live/gcp/static-ct-staging/logs/arche2025h2/](/deployment/live/gcp/static-ct-staging/logs/arche2025h2/).
+  2. Run `terragrunt apply`.