[pragmaticbear]

What changed

Turns terraform/quickstart into a minimal-cost dev deployment and adds the missing frontend container build.

• Database: the Cloud SQL module is replaced by db_host / db_port / db_name / db_user variables pointing at an external MySQL (deployed against Aiven's free tier). The password lives only in the Secret Manager secret db-password; Terraform creates a placeholder version with ignore_changes and the real value is added out of band with gcloud secrets versions add.
• JDBC URL carries sessionVariables=sql_require_primary_key=0. Managed MySQL providers that enforce sql_require_primary_key reject Liquibase's DATABASECHANGELOG table, which has no primary key. The earlier private-IP URL was also empty because the SQL module never configured a private network.
• Cloud Run: min 0 / max 2 instances, 1 vCPU, 2Gi backend / 512Mi UI, so idle cost is zero.
• Backend env: AUTH_ENABLED=false with placeholder GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET so the auth.google.* placeholders resolve at startup; FEATURE_GATE_REDIS_ENABLED=false.
• UI env: NEXT_PUBLIC_API_BASE_URL / NEXT_PUBLIC_APP_BASE_URL derived from the project number; NEXT_PUBLIC_AUTH_ENABLED=false.
• frontend/Dockerfile + .dockerignore: the repo had no frontend Dockerfile; NEXT_PUBLIC_* values are build args because Next.js inlines them at build time.
• pubsub.googleapis.com added to apis.tf; *.tfvars gitignored.

Why

Stand up a dev instance that stays inside free tiers. Cloud SQL has no free tier, and the quickstart defaults (Enterprise Plus, regional HA, 16Gi always-on Cloud Run) are production-sized.

Reviewer notes

• Verified end to end on a GCP project: both services Ready, Liquibase applied all 161 changesets, the UI lists the seeded project through the backend.
• The backend stays allow_unauthenticated with Google SSO off, same exposure as the upstream quickstart but without SSO. The commented GOOGLE_CLIENT_* blocks still work for enabling it.
• sslMode=REQUIRED encrypts but does not verify the server certificate. VERIFY_CA needs the provider's CA bundled into the image.
• Cloud Build on a fresh project returned PERMISSION_DENIED for the owner account, so the images were built locally and pushed with crane.

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[pragmaticbear]

Opened by mistake; this work is not intended as an upstream contribution.