Skip to content
Engineering

ADR-007: Migration from Dedicated Bare-Metal Hosting to Google Cloud Platform (GCP)

Status

Section titled “Status”

ACCEPTED  2026-10-04

Context

Section titled “Context”

The initial infrastructure design of the GERCIA Platform relied on dedicated bare-metal hosting (São Paulo, Brazil), deploying multi-container stacks via Docker Compose. While offering predictable hardware costs in Brazilian Reais (BRL), operating on-premises bare-metal servers introduced critical operational bottlenecks, enterprise compliance barriers, and single points of failure (SPOF):

  1. Severe Operational & SRE Overhead:

    • Operating bare-metal infrastructure forced the engineering team to manually manage Linux kernel patching, UFW/iptables firewall rules, Caddy reverse-proxy certificates, Percona PostgreSQL replication topologies, PMM (Percona Monitoring and Management), and local Vector log shipping daemons.
    • Manual disaster recovery and backup streaming (pgBackRest) required dedicated storage nodes and constant human verification, pulling core engineering focus away from healthcare product delivery.

  2. Single Point of Failure (SPOF) & Lack of Autoscaling:

    • A single physical bare-metal server represents an unacceptable risk for enterprise clinical operations. Physical hardware defects (memory faults, motherboard failures, power supply outages) trigger complete downtime until data center technicians replace physical parts.
    • Dedicated hardware cannot scale to zero during off-peak night hours or automatically scale out under sudden daytime traffic surges from compounding pharmacy quotation spikes.

  3. Enterprise Healthcare Compliance & Institutional Trust:

    • GERCIA serves multidisciplinary clinics, compounding pharmacies, and medical specialists handling confidential patient records, electronic prescriptions (CFM Res. 1.821), and regulated substances (ANVISA Portaria 344/98).
    • Enterprise B2B prospects and sanitary compliance auditors require certified physical security, automated Point-in-Time Recovery (PITR), and global standards (ISO 27001, SOC 2, HIPAA, LGPD). Self-managed Docker Compose environments on dedicated hosting trigger red flags during institutional security audits.

  4. Ecosystem Fragmentation:

    • The platform already leverages Google Cloud Build for CI/CD, Google Secret Manager (GSM) for cryptographic secrets, and Google Workspace (@gercia.com.br) for corporate identity. Running compute and data storage in an external bare-metal provider created unnecessary network hops, cross-provider bandwidth costs, and split governance.

Decision

Section titled “Decision”

The GERCIA Platform officially decommissions all dedicated bare-metal infrastructure and Docker Compose host stacks, establishing Google Cloud Platform (GCP) (Region: southamerica-east1 - São Paulo) as the universal cloud-native hosting and data tier.

flowchart TD
    subgraph EDGE ["Edge & Zero Trust Network (Cloudflare)"]
        CF_PAGE["Cloudflare Pages<br>(Static Angular SPA & Astro Sites)"]
        CF_TUNNEL["Cloudflare Zero Trust Tunnel<br>(Authenticated Service Tokens - No Public Ingress)"]
    end

    subgraph GCP ["Google Cloud Platform (southamerica-east1 - São Paulo)"]
        subgraph COMPUTE ["Serverless Compute Tier"]
            SERVER["Gercia.Server (.NET 10)<br>Google Cloud Run (Stateless Minimal APIs & MCP Protocol)<br>Scale-to-Zero • Automated Health Checks"]
            MIGRATOR["gercia-migrator (.NET 10)<br>Cloud Run Jobs (Database Migrations --migrate)"]
        end

        subgraph DATA ["Managed Data & Storage Tier"]
            DB[(Google Cloud SQL for PostgreSQL<br>Multi-Tenant Row-Level Security<br>High Availability • Automated PITR Backups)]
            GSM["Google Secret Manager (GSM)<br>Centralized Cryptographic Secrets"]
        end

        VPC["Google Cloud VPC Connector<br>(Private Internal Subnets - Zero Public IPs)"]
    end

    CF_PAGE -- "HTTPS API Calls" --> CF_TUNNEL
    CF_TUNNEL -- "Private Routing" --> SERVER
    SERVER --> VPC
    MIGRATOR --> VPC
    VPC --> DB
    SERVER <--> GSM
    MIGRATOR <--> GSM

Architectural Specifications:

Section titled “Architectural Specifications:”

  1. Stateless Compute on Google Cloud Run:

    • Gercia.Server runs as a fully managed, stateless container on Google Cloud Run serving REST endpoints, OpenIddict STS, and AI MCP. Instances scale automatically based on request concurrency and scale to zero during idle periods, eliminating idle compute costs.
    • gercia-migrator operates as an ephemeral Cloud Run Job, executing database migration orchestrations (--migrate) on-demand prior to revision rollout.

  2. Managed Relational Data on Google Cloud SQL for PostgreSQL:

    • PostgreSQL database clusters are hosted on managed Google Cloud SQL with automated High Availability (HA) regional failover.
    • Enforces continuous Point-in-Time Recovery (PITR) with automated backups, enterprise encryption-at-rest (Google-managed or CMEK), and enforced TLS 1.3 transport encryption over private VPC with high-entropy SCRAM-SHA-256 authentication.
    • Full fidelity with PostgreSQL Row-Level Security (SET LOCAL app.current_tenant_id) is strictly preserved without external connection pooling proxies.

  3. Zero Public Ingress via Cloudflare Zero Trust Tunnels:

    • No virtual machine or container in Google Cloud exposes public ports 80/443 to the internet.
    • Traffic routes exclusively through encrypted Cloudflare Tunnels into private VPC connectors, authenticated with high-assurance Service Tokens (CF-Access-Client-Id and CF-Access-Client-Secret).

  4. Unified Secrets Management:

    • All environment credentials, database strings, and OIDC signing certificates are dynamically resolved at runtime from Google Secret Manager (_STG and _PRD canonical keys).

Consequences

Section titled “Consequences”

Positive

Section titled “Positive”
  • Zero Host/OS Maintenance: Completely eliminates manual Linux sysadmin work, Caddy configurations, and Docker Compose orchestration overhead.
  • Instant Disaster Recovery & Backups: Google Cloud SQL delivers automated continuous backups with one-click Point-in-Time Recovery (PITR), guaranteeing RPO $\le$ 5 minutes and RTO $\le$ 15 minutes.
  • Cost Efficiency via Scale-to-Zero: Cloud Run bills compute strictly per CPU/millisecond consumed during active requests. Off-peak hours incur zero server costs.
  • Audit & Enterprise Compliance: Leverages Google Cloud’s SOC 1/2/3, ISO 27001, and HIPAA-compliant data centers in São Paulo, satisfying the strictest healthcare institutional audits.
  • Unified Developer Experience: Single cloud console, single billing account, and seamless integration between Cloud Build CI/CD, Secret Manager, and compute targets.

Negative & Neutral

Section titled “Negative & Neutral”
  • Variable Billing & Egress Discipline: Shifting from fixed bare-metal hosting to cloud billing requires strict Google Cloud Budget Alerts and cost caps to prevent surprise overages.
  • Local Emulation Requirement: Local developer workstations run PostgreSQL in Docker containers with local dev profiles, perfectly mirrored against Cloud SQL behavior.