Skip to content

Support multiple domains #706

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
phbnf merged 5 commits into from
Feb 19, 2026
Merged

Support multiple domains #706

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c9b232d
support multiple domains
phbnf Feb 18, 2026
7ada0be
add TODO
phbnf Feb 18, 2026
7023705
use maps
phbnf Feb 18, 2026
c120246
remove old variable
phbnf Feb 18, 2026
6e8857d
comments
phbnf Feb 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 16 additions & 8 deletions deployment/live/gcp/static-ct-staging/loadbalancer/terragrunt.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,23 @@ terraform {
}

locals {
env = "staging"
project_id = get_env("GOOGLE_PROJECT", "static-ct-staging")
location = get_env("GOOGLE_REGION", "us-central1")
submission_host_suffix = ".staging.ct.transparency.dev"
enable_cloud_armor = true
env = "staging"
project_id = get_env("GOOGLE_PROJECT", "static-ct-staging")
location = get_env("GOOGLE_REGION", "us-central1")
enable_cloud_armor = true
logs = {
"arche2025h1" = "us-central1"
"arche2025h2" = "us-central1"
"arche2026h1" = "us-central1"
"arche2025h1" = {
region = "us-central1"
submission_host_suffix = "staging.ct.transparency.dev"
}
"arche2025h2" = {
region = "us-central1"
submission_host_suffix = "staging.ct.transparency.dev"
}
"arche2026h1" = {
region = "us-central1"
submission_host_suffix = "staging.ct.transparency.dev"
}
}
}

Expand Down
8 changes: 4 additions & 4 deletions deployment/modules/gcp/loadbalancer/external/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ module "gce-lb-http" {
ssl = true
// Create one cert per log, wildcard certificates are not supported.
// Put staging.ct.transparency.dev first for it be used as the Common Name.
managed_ssl_certificate_domains = concat(["staging.ct.transparency.dev"], [for log_name, _ in var.logs: "${log_name}.staging.ct.transparency.dev"])
managed_ssl_certificate_domains = concat(["staging.ct.transparency.dev"], [for name, v in var.logs: "${name}${v.submission_host_suffix}"])
random_certificate_suffix = true

// Firewalls are defined externally.
Expand All @@ -30,7 +30,7 @@ module "gce-lb-http" {
// Use the Cloud Armor policy, if it's enabled.
security_policy = one(module.cloud_armor[*].policy.self_link)

backends = { for name, region in var.logs:
backends = { for name, v in var.logs:
"${name}-backend" => {
protocol = "HTTP"
port = 80
Expand All @@ -55,7 +55,7 @@ module "gce-lb-http" {
groups = [
{
// A Backend group must have beed deployed independently at this URI.
group = "projects/${var.project_id}/regions/${region}/instanceGroups/${name}-instance-group-manager"
group = "projects/${var.project_id}/regions/${v.region}/instanceGroups/${name}-instance-group-manager"
balancing_mode = "RATE"
// Based on the most recent load tests /docs/performance.md
// Caution:
Expand Down Expand Up @@ -89,7 +89,7 @@ resource "google_compute_url_map" "url_map" {
for_each = var.logs
iterator = log
content {
hosts = ["${log.key}${var.submission_host_suffix}"]
hosts = ["${log.key}${log.value.submission_host_suffix}"]
path_matcher = "${log.key}-path-matcher"
}
}
Expand Down
17 changes: 12 additions & 5 deletions deployment/modules/gcp/loadbalancer/external/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,19 @@ variable "project_id" {

variable "logs" {
description = "Map of log names to regions."
type = map(string)
}
type = map(object({
// Region in which the backends are
region = string
// origin = [basename].[submission_host_suffix]
submission_host_suffix = string
Copy link
Collaborator

@AlCutter AlCutter Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As discussed IRL - maybe we could change this to submission_domain and add the . on L21 of loadbalancer/external/main.tf?
I think that might be a bit clearer on what's expected.

Copy link
Collaborator Author

@phbnf phbnf Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also added variable validation.

}))

variable "submission_host_suffix" {
description = "Submission host suffix, appended to each log name."
type = string
validation {
condition = alltrue([
for name, v in var.logs: v.region != "" && v.submission_host_suffix != "" && !startswith(v.submission_host_suffix, ".")
])
error_message = "Both the region and submission_host_suffix must be set for each log. submission_host_suffix must not start with a \".\""
}
}

variable "enable_cloud_armor" {
Expand Down
Loading