deploy-infra

Infrastructure Change Patterns

Thesis: Every env var follows a full chain: config struct, env file, deploy script, service constructor. Secrets go through Secret Manager, never hardcoded.

High-risk, low-frequency changes. Follow the full chain for every modification.

Adding a New Environment Variable

Two chains depending on whether the value is a secret or plain config.

If it's a SECRET (API key, password, signing key):

1. backend/internal/config/config.go — add field to Config struct + os.Getenv() in Load()
2. config/.env.local — add with dev/sandbox value (local dev only)
3. config/.env.example — add with placeholder
4. Create in GCP Secret Manager: echo -n "value" | gcloud secrets create golid-{name}-{env} --data-file=- --project=PROJECT
5. scripts/deploy.sh — add secret_exists guard + append to secrets string in ship_api()
6. Service constructor in internal/wire/services.go (BuildServices) — pass cfg.NewField to the service

If it's plain CONFIG (URL, domain, feature flag):

1. backend/internal/config/config.go — add field to Config struct + os.Getenv() in Load()
2. config/.env.local — add with dev/sandbox value
3. config/.env.example — add with placeholder (backend vars only)
4. frontend/.env.example — add with placeholder (for VITE_* browser-exposed vars only). Per-environment values (e.g. QA vs prod VITE_API_URL) go in config/.env.{qa,prod} and are passed as build args during frontend image build.
5. config/.env.qa — add with QA value
6. config/.env.prod — add with production value
7. scripts/deploy.sh — add to the env_vars block in ship_api() (if backend needs it at runtime)
8. Service constructor in internal/wire/services.go (BuildServices) — pass cfg.NewField to the service

// config.go
type Config struct {
    // ...
    NewAPIKey string
}

// In Load():
NewAPIKey: os.Getenv("NEW_API_KEY"),

Docker Patterns

• Multi-stage builds: build stage (Go compile) → runtime stage (minimal image)
• Never copy .env files into images — env vars injected at runtime
• Health check: HEALTHCHECK CMD curl -f http://localhost:8080/health || exit 1
• Non-root user in production images