surshar / claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Built by Anthropic · github.com/anthropics
| 1 | # Inputs — mirror the env-overridable knobs in setup.sh (same defaults). |
| 2 | |
| 3 | variable "project_id" { |
| 4 | description = "GCP project ID." |
| 5 | type = string |
| 6 | } |
| 7 | |
| 8 | variable "region" { |
| 9 | description = "Infra region for Artifact Registry, Cloud SQL, subnet, and Cloud Run. (Agent Platform region is set separately inside gateway.yaml.)" |
| 10 | type = string |
| 11 | default = "us-east5" |
| 12 | } |
| 13 | |
| 14 | # ── Service account (§2) ──────────────────────────────────────────────────── |
| 15 | variable "sa_name" { |
| 16 | description = "Service account account_id (the part before @)." |
| 17 | type = string |
| 18 | default = "claude-gateway" |
| 19 | } |
| 20 | |
| 21 | # ── Image (§3) ────────────────────────────────────────────────────────────── |
| 22 | # Terraform creates the Artifact Registry repo but does NOT build/push the image |
| 23 | # (that's a docker build step — see README). It references the image by tag. |
| 24 | variable "ar_repo" { |
| 25 | description = "Artifact Registry Docker repository ID." |
| 26 | type = string |
| 27 | default = "claude-gateway" |
| 28 | } |
| 29 | |
| 30 | variable "image_name" { |
| 31 | description = "Image name within the repo." |
| 32 | type = string |
| 33 | default = "gateway" |
| 34 | } |
| 35 | |
| 36 | variable "image_tag" { |
| 37 | description = "Image tag — the Claude Code release version you build and push (must already be pushed as linux/amd64). See the README Deploy section for the build command." |
| 38 | type = string |
| 39 | validation { |
| 40 | condition = can(regex("^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$", var.image_tag)) |
| 41 | error_message = "image_tag must be a valid OCI tag — set it to the Claude Code release version you pushed (the '<version>' in terraform.tfvars.example is a placeholder)." |
| 42 | } |
| 43 | } |
| 44 | |
| 45 | # ── Networking (§4) ───────────────────────────────────────────────────────── |
| 46 | variable "vpc_network" { |
| 47 | description = "Custom VPC network name." |
| 48 | type = string |
| 49 | default = "cc-gateway-vpc" |
| 50 | } |
| 51 | |
| 52 | variable "subnet" { |
| 53 | description = "Subnet name (Cloud Run Direct VPC egress attaches here)." |
| 54 | type = string |
| 55 | default = "cc-gateway-subnet" |
| 56 | } |
| 57 | |
| 58 | variable "subnet_range" { |
| 59 | description = "Subnet primary CIDR." |
| 60 | type = string |
| 61 | default = "10.0.0.0/24" |
| 62 | } |
| 63 | |
| 64 | variable "psa_prefix_length" { |
| 65 | description = "Prefix length for the Private Services Access allocated range (/16 is GCP's recommendation)." |
| 66 | type = number |
| 67 | default = 16 |
| 68 | } |
| 69 | |
| 70 | # ── Cloud SQL (§4) ────────────────────────────────────────────────────────── |
| 71 | variable "db_instance" { |
| 72 | description = "Cloud SQL instance name." |
| 73 | type = string |
| 74 | default = "claude-gateway-db" |
| 75 | } |
| 76 | |
| 77 | variable "db_version" { |
| 78 | description = "Postgres major version. The gateway supports PostgreSQL 14 or newer; 16 is the recommended default." |
| 79 | type = string |
| 80 | default = "POSTGRES_16" |
| 81 | } |
| 82 | |
| 83 | variable "db_tier" { |
| 84 | description = "Cloud SQL machine tier." |
| 85 | type = string |
| 86 | default = "db-g1-small" |
| 87 | } |
| 88 | |
| 89 | variable "db_name" { |
| 90 | description = "Database name." |
| 91 | type = string |
| 92 | default = "claude_gateway" |
| 93 | } |
| 94 | |
| 95 | variable "db_user" { |
| 96 | description = "Database user (the gateway connects as this role)." |
| 97 | type = string |
| 98 | default = "gateway" |
| 99 | } |
| 100 | |
| 101 | # ── Secrets (§5 / §6) ───────────────────────────────────────────────────── |
| 102 | variable "secret_name" { |
| 103 | description = "Secret Manager secret holding the Postgres connection string." |
| 104 | type = string |
| 105 | default = "gateway-postgres-url" |
| 106 | } |
| 107 | |
| 108 | variable "jwt_secret_name" { |
| 109 | description = "Secret Manager secret holding the session JWT signing key." |
| 110 | type = string |
| 111 | default = "gateway-jwt-secret" |
| 112 | } |
| 113 | |
| 114 | variable "oidc_secret_name" { |
| 115 | description = "Secret Manager secret holding the Google OAuth client secret." |
| 116 | type = string |
| 117 | default = "gateway-oidc-client-secret" |
| 118 | } |
| 119 | |
| 120 | variable "config_secret_name" { |
| 121 | description = "Secret Manager secret holding gateway.yaml (mounted at /etc/claude/gateway.yaml)." |
| 122 | type = string |
| 123 | default = "gateway-config" |
| 124 | } |
| 125 | |
| 126 | variable "oidc_client_secret" { |
| 127 | description = "Google OAuth client secret value. Leave empty to NOT manage the version via Terraform (only if you add the secret version out-of-band — without one the deploy fails)." |
| 128 | type = string |
| 129 | default = "" |
| 130 | sensitive = true |
| 131 | } |
| 132 | |
| 133 | variable "gateway_config_path" { |
| 134 | description = "Path to gateway.yaml. Empty = ../gateway.yaml relative to this module." |
| 135 | type = string |
| 136 | default = "" |
| 137 | } |
| 138 | |
| 139 | # ── Cloud Run (§7) ────────────────────────────────────────────────────────── |
| 140 | variable "service_name" { |
| 141 | description = "Cloud Run service name." |
| 142 | type = string |
| 143 | default = "claude-gateway" |
| 144 | } |
| 145 | |
| 146 | variable "min_instances" { |
| 147 | description = "Minimum Cloud Run instances (1 avoids cold OIDC discovery)." |
| 148 | type = number |
| 149 | default = 1 |
| 150 | } |
| 151 | |
| 152 | variable "max_instances" { |
| 153 | description = "Maximum Cloud Run instances. Each instance opens a Postgres pool of up to 5 connections (the gateway's store.max_connections default) and db-g1-small caps at ~50 max_connections — keep max_instances × 5 below the DB tier's limit, or raise the tier before raising this." |
| 154 | type = number |
| 155 | default = 8 |
| 156 | } |
| 157 | |
| 158 | variable "ingress" { |
| 159 | description = "Cloud Run ingress — Claude Code's /login only accepts gateway hosts on private addresses, so public ingress cannot serve clients: INGRESS_TRAFFIC_INTERNAL_ONLY (default; no public URL — VPC-only; reaches corp on-prem only with the private-access prerequisites in the README; public_url stays the run.app URL, so no LB or custom cert needed) or INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER (front with your own internal ALB for a custom hostname/cert)." |
| 160 | type = string |
| 161 | default = "INGRESS_TRAFFIC_INTERNAL_ONLY" |
| 162 | validation { |
| 163 | condition = contains(["INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"], var.ingress) |
| 164 | error_message = "ingress must be INGRESS_TRAFFIC_INTERNAL_ONLY or INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER — Claude Code only connects to gateways on private addresses." |
| 165 | } |
| 166 | } |
| 167 | |
| 168 | variable "invoker_iam_disabled" { |
| 169 | description = "PREFERRED public-access path: disable the Cloud Run invoker IAM check so requests reach the container with no allUsers binding (works under Domain Restricted Sharing). Real auth stays the gateway's own OIDC. When true, the allUsers grant below is skipped. May be blocked by org policy constraints/run.managed.requireInvokerIam, or unavailable for the org (\"invoker_iam_disabled is not currently available for your organization\") — then fall back to allow_unauthenticated. Requires google provider >= 6.8." |
| 170 | type = bool |
| 171 | default = false |
| 172 | } |
| 173 | |
| 174 | variable "allow_unauthenticated" { |
| 175 | description = "Fallback public-access path: grant allUsers run.invoker (the gateway needs the IAM layer open for its own OIDC). Prefer invoker_iam_disabled. Domain Restricted Sharing orgs reject allUsers — set false there and use invoker_iam_disabled, a DRS exception, or GKE." |
| 176 | type = bool |
| 177 | default = true |
| 178 | } |
| 179 | |
| 180 | variable "deletion_protection" { |
| 181 | description = "Provider-level deletion protection on Cloud SQL and Cloud Run. Keep true to avoid accidental deletion of the running deployment." |
| 182 | type = bool |
| 183 | default = true |
| 184 | } |