Add docker repository for browse page

Author: Sparrow0hawk

cloud/browse/README.md

@@ -11,3 +11,4 @@ This service is hosted on [Google Cloud Platform](https://console.cloud.google.c
 To provision the cloud infrastructure:
 
 1. Provision the [Terraform backend](tf-backend/README.md)
+2. Provision the [Docker repository](docker-repository/README.md)

cloud/browse/docker-repository/.terraform.lock.hcl

@@ -0,0 +1,68 @@
+# Docker repository
+
+This root module provisions an [Artifact Registry](https://cloud.google.com/artifact-registry/docs/overview) to store
+Docker images for this service.
+
+## Provisioning
+
+1. Change directory:
+
+   ```bash
+   cd cloud/docker-repository
+   ```
+
+1. Authenticate with Google Cloud:
+
+   ```bash
+   gcloud auth application-default login
+   ```
+
+1. Initialise Terraform:
+
+   ```bash
+   terraform init
+   ```
+
+1. Apply the changes:
+
+   ```bash
+   terraform apply
+   ```
+
+## Configuring GitHub Actions
+
+To configure the [CI workflow](../../.github/workflows/ci.yml) with credentials to push images to the repository:
+
+1. Obtain the Docker repository service account private key:
+
+   ```bash
+   terraform output -raw github_action_push_private_key
+   ```
+   
+1. [Set the GitHub Actions repository secret](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository) `GCP_CREDENTIALS_PUSH` to the private key
+
+## Destroying
+
+1. Change directory:
+
+   ```bash
+   cd cloud/docker-repository
+   ```
+
+1. Authenticate with Google Cloud:
+
+   ```bash
+   gcloud auth application-default login
+   ```
+
+1. Initialise Terraform:
+
+   ```bash
+   terraform init
+   ```
+
+1. Delete the resources:
+
+   ```bash
+   terraform destroy
+   ```

cloud/browse/docker-repository/README.md

@@ -0,0 +1,22 @@
+resource "google_service_account" "main" {
+  project      = var.project
+  account_id   = "github-action-push"
+  display_name = "Service account for push GitHub Action"
+}
+
+resource "google_project_iam_member" "service_account_token_creator" {
+  project = var.project
+  role    = "roles/iam.serviceAccountTokenCreator"
+  member  = "serviceAccount:${google_service_account.main.email}"
+}
+
+resource "google_project_iam_member" "artifact_registry_writer" {
+  project = var.project
+  role    = "roles/artifactregistry.writer"
+  member  = "serviceAccount:${google_service_account.main.email}"
+}
+
+resource "google_service_account_key" "main" {
+  service_account_id = google_service_account.main.name
+  public_key_type    = "TYPE_X509_PEM_FILE"
+}

cloud/browse/docker-repository/github-action-push/main.tf

@@ -0,0 +1,5 @@
+output "private_key" {
+  description = "Service account key for push GitHub Action service account"
+  value       = google_service_account_key.main.private_key
+  sensitive   = true
+}

cloud/browse/docker-repository/github-action-push/outputs.tf

@@ -0,0 +1,4 @@
+variable "project" {
+  description = "GCP project"
+  type        = string
+}

cloud/browse/docker-repository/github-action-push/variables.tf

@@ -0,0 +1,70 @@
+terraform {
+  backend "gcs" {
+    bucket = "dft-rlg-atip-dev-tf-backend"
+    prefix = "docker-repository"
+  }
+}
+
+locals {
+  day_in_seconds = 24 * 60 * 60
+}
+
+resource "google_project_service" "artifact_registry" {
+  project = var.project
+  service = "artifactregistry.googleapis.com"
+}
+
+resource "google_project_service" "compute" {
+  project = var.project
+  service = "compute.googleapis.com"
+}
+
+resource "google_project_service" "container_scanning" {
+  project = var.project
+  service = "containerscanning.googleapis.com"
+}
+
+resource "google_project_service" "iam_credentials" {
+  project = var.project
+  service = "iamcredentials.googleapis.com"
+}
+
+resource "google_project_iam_audit_config" "artifact_registry_data_write" {
+  project = var.project
+  service = "artifactregistry.googleapis.com"
+
+  audit_log_config {
+    log_type = "DATA_WRITE"
+  }
+}
+
+resource "google_artifact_registry_repository" "main" {
+  project       = var.project
+  repository_id = "docker"
+  location      = var.location
+  format        = "DOCKER"
+
+  cleanup_policies {
+    id     = "delete-untagged"
+    action = "DELETE"
+    condition {
+      tag_state = "UNTAGGED"
+    }
+  }
+
+  cleanup_policies {
+    id     = "keep-recent-untagged"
+    action = "KEEP"
+    condition {
+      tag_state  = "UNTAGGED"
+      newer_than = "${7 * local.day_in_seconds}s"
+    }
+  }
+
+  depends_on = [google_project_service.artifact_registry]
+}
+
+module "github_action_push" {
+  source  = "./github-action-push"
+  project = var.project
+}

cloud/browse/docker-repository/main.tf

@@ -0,0 +1,21 @@
+output "project" {
+  description = "GCP project"
+  value       = google_artifact_registry_repository.main.project
+}
+
+output "url" {
+  description = "Docker repository URL"
+  value = join("", [
+    google_artifact_registry_repository.main.location,
+    "-docker.pkg.dev/",
+    google_artifact_registry_repository.main.project,
+    "/",
+    google_artifact_registry_repository.main.repository_id
+  ])
+}
+
+output "github_action_push_private_key" {
+  description = "Service account key for push GitHub Action service account"
+  value       = module.github_action_push.private_key
+  sensitive   = true
+}

cloud/browse/docker-repository/outputs.tf

@@ -0,0 +1,11 @@
+variable "project" {
+  description = "GCP project"
+  type        = string
+  default     = "dft-rlg-atip-dev"
+}
+
+variable "location" {
+  description = "GCP location"
+  type        = string
+  default     = "europe-west1"
+}

cloud/browse/docker-repository/variables.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = "~> 1.15.0"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 7.30.0"
+    }
+  }
+}