CI: Implement Terraform infrastructure specification

[jimbojw]

Deliberate Lab consists of two major components: a backend served by Firebase, and a static frontend suitable for hosting on Google Cloud App Engine. Google Cloud Build can be used to deploy to these services (see #953), but doing so requires enabling various cloud services, establishing service accounts, defining/collecting secrets, and granting roles.

To codify these configuration details, we should investigate using Terraform to track our infrastructure requirements. This will simplify maintenance of Deliberate Lab's canonical deployment and serve third parties who wish to deploy their own standard or customized stacks.

[jimbojw]

A key goal of the Terraform option is to formalize the "Deliberate Lab Deployer" archetype. Instead of ad-hoc manual role assignments, we should bundle all permissions required by the Cloud Build Service Account into a managed set.

1. Audit Current State
We can inspect the existing ad-hoc roles with:

gcloud projects get-iam-policy "${PROJECT_ID}" \
  --flatten="bindings[].members" \
  --format="table(bindings.role)" \
  --filter="bindings.members:serviceAccount:${SERVICE_ACCOUNT_EMAIL}"

2. Terraform Implementation
We can conceptually define the "Deliberate Lab Deployer" by iterating over a list of Google-maintained roles. This ensures our pipeline always has the standard permissions without the maintenance burden of a custom IAM Role.

# Variables to allow environment-specific configuration
variable "project_id" {
  type = string
}

variable "cloudbuild_sa_email" {
  type = string
}

# The "Deliberate Lab Deployer" Role Bundle
locals {
  deployer_roles = [
    "roles/appengine.appAdmin",
    "roles/cloudfunctions.developer",
    "roles/firebase.admin",
    "roles/iam.serviceAccountUser",
    "roles/storage.admin"
  ]
}

# Apply the roles
resource "google_project_iam_member" "deployer_permissions" {
  for_each = toset(local.deployer_roles)

  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${var.cloudbuild_sa_email}"
}