feat: add futo backup surveys (#406)

deployment/modules/cloudflare/static-pages/remote-state.tf

@@ -21,6 +21,6 @@ data "terraform_remote_state" "cloudflare_pages_project" {
 
   config = {
     conn_str    = var.tf_state_postgres_conn_str
-    schema_name = "cloudflare_pages_project_immich_app_${var.app_name}_${var.env}"
+    schema_name = "cloudflare_pages_project_immich_app_${replace(var.app_name, "-", "_")}_${var.env}"
   }
 }

deployment/modules/cloudflare/workers/futo-backups-survey/config.tf

@@ -0,0 +1,11 @@
+terraform {
+  backend "pg" {}
+  required_version = "~> 1.7"
+
+  required_providers {
+    cloudflare = {
+      source = "cloudflare/cloudflare"
+      version = "4.52.5"
+    }
+  }
+}

deployment/modules/cloudflare/workers/futo-backups-survey/d1.tf

@@ -0,0 +1,25 @@
+resource "cloudflare_d1_database" "survey" {
+  account_id = var.cloudflare_account_id
+  name       = "futo-backups-survey${local.resource_suffix}"
+}
+
+resource "null_resource" "d1_migrations" {
+  triggers = {
+    migrations_hash = sha256(join("", [for f in fileset(var.migrations_dir, "*.sql") : filesha256("${var.migrations_dir}/${f}")]))
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      for f in $(ls ${var.migrations_dir}/*.sql | sort); do
+        echo "Applying migration: $f"
+        curl -sf -X POST \
+          "https://api.cloudflare.com/client/v4/accounts/${var.cloudflare_account_id}/d1/database/${cloudflare_d1_database.survey.id}/query" \
+          -H "Authorization: Bearer ${data.terraform_remote_state.api_keys_state.outputs.terraform_key_cloudflare_account}" \
+          -H "Content-Type: application/json" \
+          -d "{\"sql\": $(cat "$f" | jq -Rs .)}" || echo "Migration $f may already be applied"
+      done
+    EOT
+  }
+
+  depends_on = [cloudflare_d1_database.survey]
+}

deployment/modules/cloudflare/workers/futo-backups-survey/locals.tf

@@ -0,0 +1,5 @@
+locals {
+  resource_stage  = var.stage != "" ? "-${var.stage}" : ""
+  resource_env    = "-${var.env}"
+  resource_suffix = "${local.resource_env}${local.resource_stage}"
+}

deployment/modules/cloudflare/workers/futo-backups-survey/providers.tf

@@ -0,0 +1,3 @@
+provider "cloudflare" {
+  api_token = data.terraform_remote_state.api_keys_state.outputs.terraform_key_cloudflare_account
+}

deployment/modules/cloudflare/workers/futo-backups-survey/remote-state.tf

@@ -0,0 +1,17 @@
+data "terraform_remote_state" "api_keys_state" {
+  backend = "pg"
+
+  config = {
+    conn_str = var.tf_state_postgres_conn_str
+    schema_name = "prod_cloudflare_api_keys"
+  }
+}
+
+data "terraform_remote_state" "cloudflare_account" {
+  backend = "pg"
+
+  config = {
+    conn_str = var.tf_state_postgres_conn_str
+    schema_name = "prod_cloudflare_account"
+  }
+}

deployment/modules/cloudflare/workers/futo-backups-survey/terragrunt.hcl

@@ -0,0 +1,26 @@
+terraform {
+  source = "."
+
+  extra_arguments custom_vars {
+    commands = get_terraform_commands_that_need_vars()
+  }
+}
+
+include {
+  path = find_in_parent_folders("state.hcl")
+}
+
+locals {
+  env = get_env("TF_VAR_env")
+  stage = get_env("TF_VAR_stage")
+  app_name = replace(get_env("TF_VAR_app_name"), "-", "_")
+}
+
+remote_state {
+  backend = "pg"
+
+  config = {
+    conn_str = get_env("TF_VAR_tf_state_postgres_conn_str")
+    schema_name = "cloudflare_workers_immich_app_${local.app_name}_${local.env}${local.stage}"
+  }
+}

deployment/modules/cloudflare/workers/futo-backups-survey/variables.tf

@@ -0,0 +1,7 @@
+variable "tf_state_postgres_conn_str" {}
+variable "stage" {}
+variable "env" {}
+variable "app_name" {}
+variable "cloudflare_account_id" {}
+variable "dist_dir" {}
+variable "migrations_dir" {}

deployment/modules/cloudflare/workers/futo-backups-survey/worker.tf

@@ -0,0 +1,41 @@
+resource "cloudflare_workers_script" "api" {
+  account_id         = var.cloudflare_account_id
+  name               = "futo-backups-survey-api${local.resource_suffix}"
+  content            = file("${var.dist_dir}/index.js")
+  compatibility_date = "2025-06-03"
+  module             = true
+
+  secret_text_binding {
+    name = "CF_TURNSTILE_SECRET"
+    text = data.terraform_remote_state.cloudflare_account.outputs.turnstile_default_invisible_secret
+  }
+
+  d1_database_binding {
+    name        = "DB"
+    database_id = cloudflare_d1_database.survey.id
+  }
+}
+
+data "cloudflare_zone" "immich_app" {
+  name = "immich.app"
+}
+
+resource "cloudflare_workers_route" "survey_api_root" {
+  pattern     = "${module.domain.fqdn}/api"
+  script_name = cloudflare_workers_script.api.name
+  zone_id     = data.cloudflare_zone.immich_app.zone_id
+}
+
+resource "cloudflare_workers_route" "survey_api_wildcard" {
+  pattern     = "${module.domain.fqdn}/api/*"
+  script_name = cloudflare_workers_script.api.name
+  zone_id     = data.cloudflare_zone.immich_app.zone_id
+}
+
+module "domain" {
+  source = "git::https://github.com/immich-app/devtools.git//tf/shared/modules/domain?ref=main"
+
+  app_name = var.app_name
+  stage    = var.stage
+  env      = var.env
+}