Provider Breakdown, Cost Analysis & GCP Reference

# stackhouse-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: stackhouse-api
  namespace: stackhouse
  labels:
    app: stackhouse-api
    version: "1.0.0"
spec:
  replicas: 3
  selector:
    matchLabels:
      app: stackhouse-api
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0        # Zero downtime deployments
  template:
    metadata:
      labels:
        app: stackhouse-api
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "3000"
        prometheus.io/path: "/v1/stats"
    spec:
      serviceAccountName: stackhouse-sa
      terminationGracePeriodSeconds: 30
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: stackhouse-api
      containers:
        - name: stackhouse
          image: us-central1-docker.pkg.dev/PROJECT/stackhouse/api:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 3000
          env:
            - name: STACKHOUSE_PORT
              value: "3000"
            - name: STACKHOUSE_HOST
              value: "0.0.0.0"
            - name: STACKHOUSE_URL
              valueFrom:
                secretKeyRef:
                  name: stackhouse-secrets
                  key: database-url
            - name: STACKHOUSE_JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: stackhouse-secrets
                  key: jwt-secret
            - name: REDIS_URL
              valueFrom:
                secretKeyRef:
                  name: stackhouse-secrets
                  key: redis-url
          resources:
            requests:
              cpu: "500m"
              memory: "256Mi"
            limits:
              cpu: "2000m"
              memory: "512Mi"
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 10
            periodSeconds: 10
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "sleep 5"]   # Drain requests
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
        - name: cloud-sql-proxy             # Sidecar for DB
          image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:latest
          args:
            - "--structured-logs"
            - "--port=5432"
            - "PROJECT:us-central1:stackhouse-pg"
          resources:
            requests:
              cpu: "50m"
              memory: "64Mi"
            limits:
              cpu: "200m"
              memory: "128Mi"
---
apiVersion: v1
kind: Service
metadata:
  name: stackhouse-api
  namespace: stackhouse
spec:
  selector:
    app: stackhouse-api
  ports:
    - port: 80
      targetPort: 3000
      protocol: TCP
  type: ClusterIP
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: stackhouse-api-hpa
  namespace: stackhouse
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: stackhouse-api
  minReplicas: 3
  maxReplicas: 30
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 60
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 70
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 60
      policies:
        - type: Pods
          value: 3
          periodSeconds: 60
    scaleDown:
      stabilizationWindowSeconds: 600     # Wait 10 min before scaling down
      policies:
        - type: Pods
          value: 1
          periodSeconds: 120
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: stackhouse-api-pdb
  namespace: stackhouse
spec:
  minAvailable: 2                          # Always keep 2 pods up
  selector:
    matchLabels:
      app: stackhouse-api
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: stackhouse-netpol
  namespace: stackhouse
spec:
  podSelector:
    matchLabels:
      app: stackhouse-api
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - port: 3000
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: stackhouse-api   # Allow pod-to-pod (same app)
    - ports:
        - port: 5432            # PostgreSQL (via Cloud SQL Proxy)
        - port: 6379            # Redis
        - port: 6333            # Qdrant REST API
        - port: 6334            # Qdrant gRPC API
        - port: 443             # External HTTPS (OpenAI, etc.)
        - port: 53              # DNS

# pgbouncer-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: pgbouncer-config
  namespace: stackhouse
data:
  pgbouncer.ini: |
    [databases]
    stackhouse = host=127.0.0.1 port=5432 dbname=stackhouse

    [pgbouncer]
    listen_port = 6432
    listen_addr = 0.0.0.0
    auth_type = md5
    pool_mode = transaction
    max_client_conn = 1000
    default_pool_size = 50
    reserve_pool_size = 10
    reserve_pool_timeout = 3
    server_lifetime = 3600
    server_idle_timeout = 600
    log_connections = 0
    log_disconnections = 0
    stats_period = 60

# ================================================
# STACKHOUSE PRODUCTION ENVIRONMENT VARIABLES
# Store in GCP Secret Manager / AWS Secrets Manager
# NEVER commit to git
# ================================================

# Server
STACKHOUSE_PORT=3000
STACKHOUSE_HOST=0.0.0.0
STACKHOUSE_LOG_DIR=/var/log/stackhouse

# Database (via Cloud SQL Proxy or direct)
STACKHOUSE_URL=postgres://stackhouse_user:PASSWORD@127.0.0.1:5432/stackhouse

# Authentication
STACKHOUSE_JWT_SECRET=<256-bit random hex, generated at deploy>
# Generate: openssl rand -hex 32

# Redis
REDIS_URL=redis://:PASSWORD@10.0.0.5:6379/0

# Qdrant (Vector Database)
QDRANT_URL=http://qdrant.stackhouse.svc.cluster.local:6333

# Object Storage
GCS_BUCKET=stackhouse-storage-prod
GCS_PROJECT=your-gcp-project
# OR for AWS S3:
AWS_S3_BUCKET=stackhouse-storage-prod
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=<key>
AWS_SECRET_ACCESS_KEY=<secret>

# AI Services (all optional)
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
GEMINI_API_KEY=AIza...
COHERE_API_KEY=...

# OAuth Providers
GOOGLE_CLIENT_ID=xxx.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=xxx
GITHUB_CLIENT_ID=xxx
GITHUB_CLIENT_SECRET=xxx

# CAPTCHA
HCAPTCHA_SECRET=xxx
RECAPTCHA_SECRET_KEY=xxx
TURNSTILE_SECRET_KEY=xxx

# Twilio (phone OTP)
TWILIO_ACCOUNT_SID=xxx
TWILIO_AUTH_TOKEN=xxx
TWILIO_PHONE_NUMBER=+1xxx

# Monitoring
SENTRY_DSN=https://xxx@o0.ingest.sentry.io/0
DATADOG_API_KEY=xxx

# Feature flags
STACKHOUSE_ENABLE_FUNCTIONS=true
STACKHOUSE_ENABLE_AI_ENDPOINTS=true
STACKHOUSE_ENABLE_REALTIME=true
STACKHOUSE_MAX_FILE_SIZE_MB=100
STACKHOUSE_RATE_LIMIT_RPS=100