Initial release: rarelens platform skeleton (AGPL-3.0)

End-to-end variant interpretation platform for rare genetic disease research:
SvelteKit UI, FastAPI + PostgreSQL API, Nextflow/Ensembl VEP pipeline,
LightGBM pathogenicity scoring with MLflow, K8s/ArgoCD/GCP infrastructure.
Public test data only; no clinical claims.

infra/terraform/cloudsql.tf

@@ -0,0 +1,29 @@
+resource "google_sql_database_instance" "pg" {
+  name             = "rarelens-pg"
+  database_version = "POSTGRES_16"
+  region           = var.region
+  deletion_protection = false
+
+  settings {
+    tier              = "db-f1-micro" # lab budget; bump for real use
+    availability_type = "ZONAL"
+    backup_configuration { enabled = true }
+    ip_configuration {
+      ipv4_enabled    = false
+      private_network = google_compute_network.vpc.id
+    }
+  }
+}
+
+resource "google_sql_database" "rarelens" {
+  name     = "rarelens"
+  instance = google_sql_database_instance.pg.name
+}
+
+resource "google_sql_user" "api" {
+  name     = "rarelens"
+  instance = google_sql_database_instance.pg.name
+  password = random_password.pg.result
+}
+
+resource "random_password" "pg" { length = 32 }

infra/terraform/gke.tf

@@ -0,0 +1,9 @@
+resource "google_container_cluster" "rarelens" {
+  name             = "rarelens"
+  location         = var.region
+  enable_autopilot = true
+  deletion_protection = false
+
+  workload_identity_config { workload_pool = "${var.project}.svc.id.goog" }
+  release_channel { channel = "REGULAR" }
+}

infra/terraform/iam.tf

@@ -0,0 +1,50 @@
+# Workload Identity Federation: GitHub Actions pushes images without long-lived keys.
+resource "google_iam_workload_identity_pool" "github" {
+  workload_identity_pool_id = "github"
+}
+
+resource "google_iam_workload_identity_pool_provider" "github" {
+  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
+  workload_identity_pool_provider_id = "github"
+  attribute_mapping = {
+    "google.subject"       = "assertion.sub"
+    "attribute.repository" = "assertion.repository"
+  }
+  attribute_condition = "assertion.repository == \"${var.github_repo}\""
+  oidc { issuer_uri = "https://token.actions.githubusercontent.com" }
+}
+
+resource "google_service_account" "ci" { account_id = "rarelens-ci" }
+
+resource "google_service_account_iam_member" "ci_wif" {
+  service_account_id = google_service_account.ci.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository/${var.github_repo}"
+}
+
+resource "google_artifact_registry_repository_iam_member" "ci_push" {
+  repository = google_artifact_registry_repository.images.name
+  location   = var.region
+  role       = "roles/artifactregistry.writer"
+  member     = "serviceAccount:${google_service_account.ci.email}"
+}
+
+# Runtime identities (bound to k8s ServiceAccounts via GKE Workload Identity)
+resource "google_service_account" "api"      { account_id = "rarelens-api" }
+resource "google_service_account" "pipeline" { account_id = "rarelens-pipeline" }
+
+resource "google_project_iam_member" "api_sql" {
+  project = var.project
+  role    = "roles/cloudsql.client"
+  member  = "serviceAccount:${google_service_account.api.email}"
+}
+resource "google_project_iam_member" "api_pubsub" {
+  project = var.project
+  role    = "roles/pubsub.publisher"
+  member  = "serviceAccount:${google_service_account.api.email}"
+}
+resource "google_storage_bucket_iam_member" "pipeline_data" {
+  bucket = google_storage_bucket.data.name
+  role   = "roles/storage.objectAdmin"
+  member = "serviceAccount:${google_service_account.pipeline.email}"
+}

infra/terraform/network.tf

@@ -0,0 +1,4 @@
+resource "google_compute_network" "vpc" {
+  name                    = "rarelens-vpc"
+  auto_create_subnetworks = true
+}

infra/terraform/outputs.tf

@@ -0,0 +1,5 @@
+output "cluster_name"   { value = google_container_cluster.rarelens.name }
+output "sql_connection" { value = google_sql_database_instance.pg.connection_name }
+output "data_bucket"    { value = google_storage_bucket.data.name }
+output "wif_provider"   { value = google_iam_workload_identity_pool_provider.github.name }
+output "ci_sa"          { value = google_service_account.ci.email }

infra/terraform/storage.tf

@@ -0,0 +1,20 @@
+resource "google_storage_bucket" "data" {
+  name                        = "${var.project}-rarelens-data"
+  location                    = var.region
+  uniform_bucket_level_access = true
+  lifecycle_rule {
+    condition {
+      age            = 30
+      matches_prefix = ["work/"]
+    }
+    action { type = "Delete" }
+  }
+}
+
+resource "google_artifact_registry_repository" "images" {
+  repository_id = "rarelens"
+  location      = var.region
+  format        = "DOCKER"
+}
+
+resource "google_pubsub_topic" "vcf_uploaded" { name = "vcf-uploaded" }

infra/terraform/variables.tf

@@ -0,0 +1,9 @@
+variable "project" { type = string }
+variable "region" {
+  type    = string
+  default = "europe-west2" # London: keeps public genomic test data and the Cambridge team in one jurisdiction
+}
+variable "github_repo" {
+  type    = string
+  default = "lynchaos/rarelens"
+}

infra/terraform/versions.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.8"
+  required_providers {
+    google = { source = "hashicorp/google", version = "~> 6.0" }
+    random = { source = "hashicorp/random", version = "~> 3.6" }
+  }
+  backend "gcs" { bucket = "REPLACE-tfstate", prefix = "rarelens" }
+}
+
+provider "google" {
+  project = var.project
+  region  = var.region
+}