Setelan setiap layanan Google Cloud

export PROJECT_ID="asapify-hackathon"           # ganti dengan project tim
export PROJECT_NUMBER="$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)')"
export REGION="asia-southeast2"
export GEMINI_LOCATION="global"
export GEMINI_MODEL="<nama model Gemini Flash terbaru>"   # cek di Model Garden
export PUBLIC_BUCKET="asapify-public-$PROJECT_ID"
export DATA_BUCKET="asapify-data-$PROJECT_ID"
export PROVINCE="KT"                              # KT = Kalteng, KB = Kalbar
gcloud config set project $PROJECT_ID

gcloud services enable \
  run.googleapis.com cloudscheduler.googleapis.com cloudbuild.googleapis.com \
  artifactregistry.googleapis.com firestore.googleapis.com storage.googleapis.com \
  secretmanager.googleapis.com aiplatform.googleapis.com earthengine.googleapis.com \
  iamcredentials.googleapis.com logging.googleapis.com monitoring.googleapis.com \
  firebase.googleapis.com firebasehosting.googleapis.com identitytoolkit.googleapis.com

for SA in sa-api sa-jobs sa-scheduler; do
  gcloud iam service-accounts create $SA --display-name "$SA"
done
API_SA="sa-api@$PROJECT_ID.iam.gserviceaccount.com"
JOBS_SA="sa-jobs@$PROJECT_ID.iam.gserviceaccount.com"
SCHED_SA="sa-scheduler@$PROJECT_ID.iam.gserviceaccount.com"

for ROLE in roles/datastore.user roles/aiplatform.user; do
  gcloud projects add-iam-policy-binding $PROJECT_ID --member "serviceAccount:$API_SA" --role $ROLE
done
for ROLE in roles/datastore.user roles/earthengine.writer roles/serviceusage.serviceUsageConsumer; do
  gcloud projects add-iam-policy-binding $PROJECT_ID --member "serviceAccount:$JOBS_SA" --role $ROLE
done
gcloud projects add-iam-policy-binding $PROJECT_ID --member "serviceAccount:$SCHED_SA" --role roles/run.invoker
# peran pada bucket, secret, dan service ditambahkan di bagian 04, 06, 09

printf "%s" "ISI_MAP_KEY_DI_SINI" | gcloud secrets create firms-map-key --data-file=-
gcloud secrets add-iam-policy-binding firms-map-key \
  --member "serviceAccount:$JOBS_SA" --role roles/secretmanager.secretAccessor

{ "indexes": [
  { "collectionGroup": "alerts", "queryScope": "COLLECTION", "fields": [
      { "fieldPath": "status", "order": "ASCENDING" },
      { "fieldPath": "level_rank", "order": "DESCENDING" },
      { "fieldPath": "created_at", "order": "DESCENDING" } ] },
  { "collectionGroup": "incidents", "queryScope": "COLLECTION", "fields": [
      { "fieldPath": "province", "order": "ASCENDING" },
      { "fieldPath": "updated_at", "order": "DESCENDING" } ] }
] }

COMMON_ENV="GOOGLE_CLOUD_PROJECT=$PROJECT_ID,PROVINCE=$PROVINCE,\
PUBLIC_BUCKET=$PUBLIC_BUCKET,DATA_BUCKET=$DATA_BUCKET,\
API_URL=$(gcloud run services describe asapify-api --region $REGION --format='value(status.url)')"

gcloud run jobs deploy asapify-ingest --source ./jobs --region $REGION \
  --service-account $JOBS_SA --cpu 1 --memory 2Gi \
  --task-timeout 15m --max-retries 1 \
  --command python --args=ingest.py \
  --set-env-vars "$COMMON_ENV" --set-secrets FIRMS_MAP_KEY=firms-map-key:latest

gcloud run jobs deploy asapify-daily --source ./jobs --region $REGION \
  --service-account $JOBS_SA --cpu 1 --memory 2Gi \
  --task-timeout 20m --max-retries 1 \
  --command python --args=daily.py \
  --set-env-vars "$COMMON_ENV"

# mode replay untuk demo
gcloud run jobs execute asapify-ingest --region $REGION \
  --args=ingest.py,--as-of,2026-09-12T10:00:00+07:00

for JOB in asapify-ingest:"5 * * * *" asapify-daily:"0 6 * * *"; do
  NAME="${JOB%%:*}"; CRON="${JOB#*:}"
  gcloud scheduler jobs create http "$NAME-schedule" \
    --location $REGION --schedule "$CRON" --time-zone "Asia/Jakarta" \
    --uri "https://run.googleapis.com/v2/projects/$PROJECT_ID/locations/$REGION/jobs/$NAME:run" \
    --http-method POST \
    --oauth-service-account-email $SCHED_SA
done