From b101e9258454d8c6fb74a5614485b8def2a59ccb Mon Sep 17 00:00:00 2001
From: seonNoh <dark.pearl.nst@gmail.com>
Date: Wed, 23 Sep 2026 23:48:04 +0900
Subject: [PATCH] feat: add legacy-api compose and apply script for MIG
 instances
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MIG 인스턴스 startup script가 실행하는 vm/legacy-api/apply.sh를 추가한다.
VM SA의 메타데이터 토큰으로 Secret Manager(selfheal-db-password)에서 DB 비밀번호를
받아 env 파일(0600)에 DSN을 쓰고, 고정 태그 이미지(legacy-api:7186ef0)로 compose up.
Alloy는 WP-15에서 추가한다.
---
 vm/legacy-api/README.md    |  3 ---
 vm/legacy-api/apply.sh     | 22 ++++++++++++++++++++++
 vm/legacy-api/compose.yaml | 16 ++++++++++++++++
 3 files changed, 38 insertions(+), 3 deletions(-)
 delete mode 100644 vm/legacy-api/README.md
 create mode 100755 vm/legacy-api/apply.sh
 create mode 100644 vm/legacy-api/compose.yaml

diff --git a/vm/legacy-api/README.md b/vm/legacy-api/README.md
deleted file mode 100644
index 2fbeb77..0000000
--- a/vm/legacy-api/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# vm/legacy-api
-
-Placeholder. See the root README for the work package that fills this directory.
diff --git a/vm/legacy-api/apply.sh b/vm/legacy-api/apply.sh
new file mode 100755
index 0000000..aadb69c
--- /dev/null
+++ b/vm/legacy-api/apply.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# legacy-api VM (GCP MIG instance). Idempotent: run at first boot by the startup script and again by `make vm-sync`.
+# 1) DB password from Secret Manager via the VM service account (metadata token; no key files, design 6.11)
+# 2) docker compose up with the pinned image tag
+# Alloy (metrics/logs shipping) is added in WP-15.
+set -euo pipefail
+cd "$(dirname "$0")"
+PROJECT="$(curl -sf -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/project/project-id)"
+command -v jq >/dev/null || { apt-get update -qq && apt-get install -y -qq jq >/dev/null; }
+TOKEN="$(curl -sf -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' | jq -r .access_token)"
+DB_PASSWORD="$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
+  "https://secretmanager.googleapis.com/v1/projects/${PROJECT}/secrets/selfheal-db-password/versions/latest:access" \
+  | jq -r .payload.data | base64 -d || true)"
+unset TOKEN
+ENV_FILE=/opt/selfheal/legacy-api.env
+umask 077
+{
+  printf 'DB_DSN=postgres://app:%s@10.20.0.20:5432/app?sslmode=disable\n' "${DB_PASSWORD}"
+} > "$ENV_FILE"
+unset DB_PASSWORD
+docker compose --env-file "$ENV_FILE" -f compose.yaml up -d --pull always --remove-orphans
+docker compose -f compose.yaml ps
diff --git a/vm/legacy-api/compose.yaml b/vm/legacy-api/compose.yaml
new file mode 100644
index 0000000..977625c
--- /dev/null
+++ b/vm/legacy-api/compose.yaml
@@ -0,0 +1,16 @@
+# legacy-api on the MIG instance (experiment design 3.2). Image tag is pinned to the apps repo commit.
+services:
+  legacy-api:
+    image: asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal/legacy-api:7186ef0
+    container_name: legacy-api
+    restart: always
+    ports:
+      - "8080:8080"
+    environment:
+      PORT: "8080"
+      DB_DSN: "${DB_DSN}"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/healthz"]
+      interval: 10s
+      timeout: 3s
+      retries: 3