Epic: Networking — VPC, subnets, and firewall for dev

[Chopsticks13]

Networking Epic

Our dev project (ops-dev-7x2) has no network. Without one, nothing can run — no VMs, no GKE, no Cloud SQL with private IP.

What we're building

ops-dev-7x2
└── ops-dev-vpc (VPC)
    └── ops-dev-subnet (10.0.0.0/24, europe-west2)
        ├── Private Google Access: enabled
        └── Firewall rules
            ├── deny all ingress (baseline)
            ├── allow internal traffic (10.0.0.0/24)
            ├── allow IAP SSH (from Google's IAP range)
            └── allow health checks (from Google's health check ranges)

Work items

1. Create modules/net-vpc — pure Terraform module

   • VPC with custom subnets (not auto-created)
   • Private Google Access per subnet
   • Optional flow logs
   • Optional secondary ranges (for future GKE pods/services)

2. Create modules/net-vpc-firewall — pure Terraform module

   • Default deny-all-ingress
   • Built-in rules for health checks and IAP SSH
   • Custom ingress/egress rules via simple maps

3. Create units + wire into stack

   • units/net-vpc/terragrunt.hcl
   • units/net-vpc-firewall/terragrunt.hcl
   • Add to live/terragrunt.stack.hcl under dev
   • VPC depends on project, firewall depends on VPC

How Fabric does it

• net-vpc module
• net-vpc-firewall module
• FAST networking stage

GCP docs

• VPC overview
• Subnets
• Firewall rules
• Private Google Access