Vertex — decision log
All decisions below were taken on 2026-09-24 unless stated otherwise. Vendor facts were checked against the linked documentation on that date.
| # | Decision | Why | Alternatives rejected |
|---|---|---|---|
| D1 | Environments are named stage and prod | "stage" signals UAT with deliberate deploys; avoids the legacy vertex-dev-* AWS names | dev/prod (name collision with legacy), test |
| D2 | Code repo + infra repo pattern: <name> and <name>-infra | Vendor keeps write on code; all cloud credentials and deploy logic live in a TTG-only repo; no paid GitHub plan needed | Two code repos (dev/prod) — duplicate codebase |
| D3 | Both stage and prod deploy manually from ttg-infra | On GitHub Free, anyone with write can read every repo secret, so no deploy credential may live in vertex | Auto-deploy from vertex (credential exposure), scheduled polling |
| D4 | One Cloudflare account, per-Worker scoped API tokens | Cloudflare supports tokens scoped to Specified Workers with the Editor role (GA 2026-09-15) | Separate Cloudflare accounts |
| D5 | No Workers Builds (Cloudflare-side CI) for now | Build tokens are user tokens only ("account-owned token support coming soon") and cannot be scoped to one Worker; the build runs code from the vendor repo | Revisit when account-owned build tokens ship |
| D6 | Images in GHCR, not ECR | Container registry storage and bandwidth are currently free; packages published from ttg-infra inherit its access | ECR |
| D7 | Region eu-west-1 (Ireland) | Cheapest EU region for the stack (≈10 % below Frankfurt); fully EU for GDPR | eu-central-1 Frankfurt (+$4.41/month for prod) |
| D8 | ECS Fargate, one task per env with three containers (core, identity, cloudflared) | No servers to patch, rolling deploys with automatic rollback, stage can scale to zero; containers share localhost | EC2 + Docker Compose; merging core and identity (no code changes wanted now) |
| D9 | x86_64 task architecture | Current images already build and run as amd64; no code or build changes | ARM64 (≈$5.37/month cheaper — revisit later) |
| D10 | Private subnets + NAT instance | AWS guidance prefers private subnets for containers that store user data; a NAT instance keeps the standard layout at low cost | Public subnet + public IP (cheaper, less isolation); NAT gateway (≈$41/month per env) |
| D11 | Dedicated RDS per env, clean start | Complete stage/prod separation; no dependency on the legacy VPC | Shared legacy RDS instance with peering |
| D12 | One Cloudflare Tunnel per env, path-based ingress | A single cloudflared can route /auth, /api/auth, /api/users → identity and everything else → core | One tunnel per service |
| D13 | Separate Google Cloud project per env | Internal/External user type is per project; stage can run in Testing mode with vendor test users while prod stays Internal or brand-verified | Shared OAuth client (would leak the prod secret into stage) |
| D14 | Hostnames on thetaxgraph.com: prod <subdomain>, stage stage-<subdomain> | Zone is already on Cloudflare (full setup) in the same account | workers.dev only |
| D15 | One infra repository ttg-infra for all TTG apps (renamed from vertex-infra) | Shared layer, app stacks and deploy workflows in one TTG-only place; on GitHub Free, environments are unavailable on private repos, so workflows in one repo are not isolated from each other — acceptable while only TTG admins operate it | One infra repo per app (revisit if ownership splits) |
| D16 | Naming: common layer ttg-<env>-*, app resources <app>-<env>-* | Shared VPC, NAT and RDS are not Vertex-specific; names must survive new apps | Vertex-prefixed shared resources |
Sources
- Cloudflare per-Worker permissions: changelog 2026-09-15, Workers roles
- Workers Builds token limitation: Builds configuration
- GitHub secrets and write access: Secure use reference
- GitHub Actions minutes (Free: 2,000/month on private repos): Actions billing
- GHCR billing and access inheritance: Packages billing, Container registry
- Public vs private subnets for ECS: Connect Amazon ECS applications to the internet
- Tunnel ingress rules: cloudflared configuration file
- GitHub environments availability: Managing environments
- Prices: AWS Price List API, on-demand, queried 2026-09-24