1
Cloud DNS resolves *.hiolly.com to the load balancer's anycast IP.
2
Global HTTPS LB terminates TLS using a Google-managed cert and routes by host.
3
Cloud Storage + CDN serves SPA bundles (member, employer, triage, docs).
4
Cloud Armor filters OWASP Top 10, bots, and DDoS before traffic hits the gateway.
5
Apigee X validates JWT, enforces quota, and proxies to GKE services.
6
Cloud Run hosts the Next.js admin console (SSR, scale-to-zero).
7
Identity Platform issues JWTs to all 5 client apps; Apigee validates them on every call.
8
GKE Autopilot runs the 14 Go services, Triage (Python), Keycloak, Temporal, OpenSearch, Mirth, Langfuse.
9
Vertex AI hosts Gemini for triage; OpenAI/Anthropic kept as A/B fallback.
10
Cloud SQL Postgres 16 + PostGIS — one schema per service, HA, PITR, PSC.
11
Pub/Sub primary event bus — outbox CDC publishes domain events; Managed Kafka for log-replay topics.
12
Cloud Build runs CI on PRs — Go test, lint, SAST, container scan.
13
Artifact Registry stores signed container images + Helm charts; Binary Authorization gates GKE.
14
Datastream streams Cloud SQL CDC into BigQuery in near real time.
15
BigQuery serves the actuarial / financial / regulatory layer (replaces planned Snowflake).
16
Looker serves broker / employer / FCA dashboards on top of BigQuery (LookML).
17
Cloud Operations Suite — Logging + Trace + Monitoring + Managed Prometheus + SCC + Grafana + Langfuse.