# Variables del projecte — ajusta-les al que vas decidir al disseny
export PROY_BASE="refugio"
export PROY_DEV="${PROY_BASE}-dev"
export PROY_PROD="${PROY_BASE}-prod"
export PROY_DATOS="${PROY_BASE}-datos"
export REGION="europe-west1"
export BILLING_ACCOUNT="0X0X0X-0X0X0X-0X0X0X"   # gcloud billing accounts list

# Crear els projectes
for P in "${PROY_DEV}" "${PROY_PROD}" "${PROY_DATOS}"; do
  gcloud projects create "${P}" --name="${P}"
  gcloud billing projects link "${P}" --billing-account="${BILLING_ACCOUNT}"
done

# Comprovar
gcloud projects list --filter="projectId:${PROY_BASE}-*" \
  --format="table(projectId, name, lifecycleState)"

APIS=(
  cloudresourcemanager.googleapis.com   # Terraform necessita aquesta la primera
  serviceusage.googleapis.com
  iam.googleapis.com
  iamcredentials.googleapis.com
  compute.googleapis.com                # xarxa, adreces, tallafoc
  servicenetworking.googleapis.com      # peering per a Cloud SQL privada
  vpcaccess.googleapis.com              # connector serverless
  run.googleapis.com
  artifactregistry.googleapis.com
  cloudbuild.googleapis.com
  sqladmin.googleapis.com
  secretmanager.googleapis.com
  storage.googleapis.com
  pubsub.googleapis.com
  bigquery.googleapis.com
  cloudfunctions.googleapis.com
  eventarc.googleapis.com
  cloudscheduler.googleapis.com
  monitoring.googleapis.com
  logging.googleapis.com
  cloudtrace.googleapis.com
  language.googleapis.com               # substitueix per la teva API d'IA
)

for P in "${PROY_DEV}" "${PROY_PROD}"; do
  gcloud services enable "${APIS[@]}" --project="${P}"
done

gcloud services enable bigquery.googleapis.com storage.googleapis.com \
  --project="${PROY_DATOS}"

gcloud services list --enabled --project="${PROY_PROD}" | wc -l   # ha de rondar 25+

gcloud billing budgets create \
  --billing-account="${BILLING_ACCOUNT}" \
  --display-name="Projecte final ${PROY_BASE}" \
  --budget-amount=12EUR \
  --threshold-rule=percent=0.5 \
  --threshold-rule=percent=0.9 \
  --threshold-rule=percent=1.0 \
  --filter-projects="projects/${PROY_DEV}","projects/${PROY_PROD}","projects/${PROY_DATOS}"

gcloud billing budgets list --billing-account="${BILLING_ACCOUNT}"

mi-proyecto/
├── README.md
├── .gitignore
├── cloudbuild.yaml                 # pipeline de dev
├── cloudbuild-prod.yaml            # promoció a prod
├── app/
│   ├── Dockerfile
│   ├── requirements.txt
│   ├── src/
│   │   ├── main.py
│   │   ├── db.py
│   │   ├── eventos.py
│   │   └── observabilidad.py
│   └── tests/
│       ├── test_unitarios.py
│       └── test_integracion.py
├── infra/
│   ├── modules/
│   │   ├── red/
│   │   ├── identidad/
│   │   ├── datos/
│   │   ├── servicio/
│   │   └── observabilidad/
│   ├── envs/
│   │   ├── dev/{main.tf,variables.tf,terraform.tfvars,backend.tf}
│   │   └── prod/{main.tf,variables.tf,terraform.tfvars,backend.tf}
│   └── bootstrap/                  # crea el bucket d'estat. S'aplica una vegada
├── data/
│   ├── seed/generar.py
│   ├── migraciones/
│   │   ├── 001_esquema_inicial.sql
│   │   └── 002_indices.sql
│   └── sql/analitica.sql
├── ml/
│   └── analizar_opiniones.py
└── docs/
    ├── arquitectura.md
    ├── runbook.md
    ├── diario.md
    └── adr/

# RefugioReserva

Plataforma de reserves de refugis de muntanya. Projecte final del curs de GCP.
**Totes les dades són fictícies.**

🔗 **Demo:** https://refugioreserva.example
📊 **Tauler de control:** [Looker Studio](...)
📐 **Arquitectura:** [docs/arquitectura.md](docs/arquitectura.md)

## Què fa
Un excursionista consulta disponibilitat de places en 12 refugis i reserva.
El guarda veu les reserves del dia. La federació consulta indicadors.

## Arquitectura en una línia
Cloud Run (Python/FastAPI) → Cloud SQL PostgreSQL privada · fotos a Cloud
Storage · esdeveniments per Pub/Sub → BigQuery → Looker Studio · sentiment de
les opinions amb l'API de Natural Language. Tot en Terraform, desplegat per
Cloud Build sense claus (WIF).

## Com aixecar-ho des de zero

## Cost
**~10 €/mes.** Vegeu [docs/adr/ADR-006-sin-balanceador.md](docs/adr/) per a
la decisió de cost més rellevant.

## Estat i deute tècnic conegut
Vegeu la secció «Deute tècnic» més avall. Sí, n'hi ha, i està prioritzat.

# infra/bootstrap/main.tf
terraform {
  required_version = ">= 1.9"
  required_providers {
    google = { source = "hashicorp/google", version = "~> 6.0" }
  }
  # Sense backend: estat local, s'aplica una vegada i es puja el .tfstate xifrat
  # o simplement s'accepta que aquest mòdul es torna a crear a mà si es perd.
}

provider "google" {
  project = var.proyecto_estado
  region  = var.region
}

resource "google_storage_bucket" "estado" {
  name          = "${var.prefijo}-terraform-estado"
  location      = var.region
  force_destroy = false

  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"

  versioning { enabled = true }        # ← imprescindible: permet recuperar un estat corrupte

  lifecycle_rule {
    condition { num_newer_versions = 20 }
    action    { type = "Delete" }
  }

  labels = {
    proyecto       = var.prefijo
    componente     = "iac"
    gestionado-por = "terraform"
  }
}

cd infra/bootstrap
terraform init && terraform apply
gcloud storage buckets describe gs://refugio-terraform-estado \
  --format="value(versioning.enabled,iamConfiguration.publicAccessPrevention)"
# Esperat: True  enforced

# infra/envs/prod/backend.tf
terraform {
  required_version = ">= 1.9"

  backend "gcs" {
    bucket = "refugio-terraform-estado"
    prefix = "envs/prod"                  # dev fa servir "envs/dev": estats separats
  }

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"                  # fixat. MAI sense versió
    }
    random = { source = "hashicorp/random", version = "~> 3.6" }
  }
}

# infra/modules/red/main.tf
variable "proyecto"    { type = string }
variable "prefijo"     { type = string }
variable "region"      { type = string }
variable "cidr_app"    { type = string }
variable "cidr_conector" { type = string }
variable "cidr_privado"  { type = string }
variable "etiquetas"   { type = map(string) }

resource "google_compute_network" "vpc" {
  project                 = var.proyecto
  name                    = "${var.prefijo}-vpc"
  auto_create_subnetworks = false        # ← MAI la xarxa default
  routing_mode            = "REGIONAL"
}

resource "google_compute_subnetwork" "app" {
  project                  = var.proyecto
  name                     = "${var.prefijo}-app-${substr(var.region, 0, 8)}"
  network                  = google_compute_network.vpc.id
  region                   = var.region
  ip_cidr_range            = var.cidr_app
  private_ip_google_access = true        # sortida a APIs de Google sense IP pública
}

# Connector d'accés serverless: exigeix un /28 exacte
resource "google_vpc_access_connector" "conector" {
  project       = var.proyecto
  name          = "${var.prefijo}-conn"
  region        = var.region
  ip_cidr_range = var.cidr_conector
  network       = google_compute_network.vpc.name
  min_instances = 2
  max_instances = 3                      # topall de cost
}

# --- Accés privat a serveis (necessari per a Cloud SQL amb IP privada) ---
resource "google_compute_global_address" "rango_privado" {
  project       = var.proyecto
  name          = "${var.prefijo}-rango-privado"
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 20
  address       = split("/", var.cidr_privado)[0]
  network       = google_compute_network.vpc.id
}

resource "google_service_networking_connection" "peering" {
  network                 = google_compute_network.vpc.id
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.rango_privado.name]
}

# --- Tallafoc: denegació per defecte explícita ---
resource "google_compute_firewall" "denegar_entrada" {
  project   = var.proyecto
  name      = "${var.prefijo}-denegar-entrada"
  network   = google_compute_network.vpc.name
  direction = "INGRESS"
  priority  = 65534
  deny { protocol = "all" }
  source_ranges = ["0.0.0.0/0"]
  log_config { metadata = "INCLUDE_ALL_METADATA" }
}

output "red_id"        { value = google_compute_network.vpc.id }
output "red_nombre"    { value = google_compute_network.vpc.name }
output "conector_id"   { value = google_vpc_access_connector.conector.id }
output "peering_listo" { value = google_service_networking_connection.peering.id }

# infra/envs/prod/terraform.tfvars
proyecto      = "refugio-prod"
entorno       = "prod"
prefijo       = "refugio"
region        = "europe-west1"
cidr_app      = "10.20.0.0/24"
cidr_conector = "10.20.8.0/28"
cidr_privado  = "10.20.16.0/20"

bd_tier            = "db-f1-micro"
bd_alta_disp       = false
bd_backup_retencion = 7

run_min_instancias = 0
run_max_instancias = 5

# infra/envs/dev/terraform.tfvars — mateixes claus, valors més petits
proyecto      = "refugio-dev"
entorno       = "dev"
prefijo       = "refugio"
region        = "europe-west1"
cidr_app      = "10.10.0.0/24"
cidr_conector = "10.10.8.0/28"
cidr_privado  = "10.10.16.0/20"

bd_tier            = "db-f1-micro"
bd_alta_disp       = false
bd_backup_retencion = 1
run_min_instancias = 0
run_max_instancias = 2

cd infra/envs/dev
terraform init
terraform fmt -recursive ../..     # format consistent, gratis
terraform validate                 # sintaxi i referències
terraform plan -out=plan.tfplan    # LLEGIR LA SORTIDA SENCERA
terraform apply plan.tfplan

# infra/modules/identidad/main.tf

resource "google_service_account" "web" {
  project      = var.proyecto
  account_id   = "sa-${var.prefijo}-web"
  display_name = "Compte de l'aplicació web"
  description  = "Cloud Run: llegeix BD, llegeix 2 secrets, escriu fotos, publica esdeveniments"
}

# --- Rols a nivell de PROJECTE: només els que no es poden acotar més ---
resource "google_project_iam_member" "web_proyecto" {
  for_each = toset([
    "roles/cloudsql.client",
    "roles/logging.logWriter",
    "roles/cloudtrace.agent",
    "roles/monitoring.metricWriter",
  ])
  project = var.proyecto
  role    = each.value
  member  = "serviceAccount:${google_service_account.web.email}"
}

# --- Rols acotats AL RECURS: així és com es fa bé ---
resource "google_secret_manager_secret_iam_member" "web_secretos" {
  for_each  = toset(var.secretos_de_la_web)   # ["refugio-db-password", "refugio-session-key"]
  project   = var.proyecto
  secret_id = each.value
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.web.email}"
}

resource "google_storage_bucket_iam_member" "web_fotos" {
  bucket = var.bucket_fotos
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:${google_service_account.web.email}"
}

resource "google_pubsub_topic_iam_member" "web_publica" {
  project = var.proyecto
  topic   = var.topic_eventos
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:${google_service_account.web.email}"
}

# infra/modules/identidad/wif.tf

resource "google_iam_workload_identity_pool" "github" {
  project                   = var.proyecto
  workload_identity_pool_id = "gh-pool"
  display_name              = "GitHub Actions"
}

resource "google_iam_workload_identity_pool_provider" "github" {
  project                            = var.proyecto
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = "gh-provider"

  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.repository" = "assertion.repository"
    "attribute.ref"        = "assertion.ref"
  }

  # CONDICIÓ OBLIGATÒRIA: sense això, QUALSEVOL repositori de GitHub
  # del món podria autenticar-se contra el teu projecte.
  attribute_condition = "assertion.repository == '${var.github_repo}'"

  oidc { issuer_uri = "https://token.actions.githubusercontent.com" }
}

resource "google_service_account" "deploy" {
  project      = var.proyecto
  account_id   = "sa-${var.prefijo}-deploy"
  display_name = "Desplegament des de CI"
}

# Només la branca main del repositori pot impersonar el compte de desplegament
resource "google_service_account_iam_member" "deploy_wif" {
  service_account_id = google_service_account.deploy.name
  role               = "roles/iam.workloadIdentityUser"
  member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository/${var.github_repo}"
}

resource "google_project_iam_member" "deploy_roles" {
  for_each = toset([
    "roles/run.developer",
    "roles/artifactregistry.writer",
  ])
  project = var.proyecto
  role    = each.value
  member  = "serviceAccount:${google_service_account.deploy.email}"
}

# EL PERMÍS QUE S'OBLIDA SEMPRE:
# per desplegar un servei que corre com sa-web, deploy ha de poder «actuar com» ella.
resource "google_service_account_iam_member" "deploy_actua_como_web" {
  service_account_id = google_service_account.web.name
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${google_service_account.deploy.email}"
}

# .github/workflows/deploy.yml
permissions:
  contents: read
  id-token: write            # imprescindible perquè GitHub emeti el testimoni OIDC

jobs:
  desplegar:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123456789/locations/global/workloadIdentityPools/gh-pool/providers/gh-provider
          service_account: [email protected]
      # A partir d'aquí, gcloud està autenticat. Sense cap secret a GitHub.

# 1. Cap compte de servei amb rol primitiu
gcloud projects get-iam-policy "${PROY_PROD}" --format=json | \
  jq -r '.bindings[] | select(.role | test("roles/(owner|editor)")) |
         .members[] | select(startswith("serviceAccount:"))'
# Esperat: buit

# 2. Zero claus de compte de servei gestionades per l'usuari
for SA in $(gcloud iam service-accounts list --project="${PROY_PROD}" --format="value(email)"); do
  echo -n "$SA: "
  gcloud iam service-accounts keys list --iam-account="$SA" \
    --managed-by=user --format="value(name)" | wc -l
done
# Esperat: 0 a totes

# infra/modules/datos/sql.tf

resource "random_password" "bd" {
  length  = 32
  special = true
}

resource "google_secret_manager_secret" "bd_password" {
  project   = var.proyecto
  secret_id = "${var.prefijo}-db-password"
  replication { auto {} }
}

resource "google_secret_manager_secret_version" "bd_password" {
  secret      = google_secret_manager_secret.bd_password.id
  secret_data = random_password.bd.result
}

resource "google_sql_database_instance" "principal" {
  project          = var.proyecto
  name             = "${var.prefijo}-db"
  region           = var.region
  database_version = "POSTGRES_16"

  # El peering ha d'existir abans. Cas legítim de depends_on explícit.
  depends_on = [var.peering_listo]

  settings {
    tier              = var.bd_tier
    availability_type = var.bd_alta_disp ? "REGIONAL" : "ZONAL"
    disk_size         = 10
    disk_type         = "PD_HDD"      # més barat; suficient a aquest volum
    disk_autoresize   = true

    ip_configuration {
      ipv4_enabled    = false          # ← SENSE IP PÚBLICA
      private_network = var.red_id
      ssl_mode        = "ENCRYPTED_ONLY"
    }

    backup_configuration {
      enabled                        = true
      start_time                     = "03:00"
      point_in_time_recovery_enabled = var.entorno == "prod"
      backup_retention_settings { retained_backups = var.bd_backup_retencion }
    }

    maintenance_window { day = 7, hour = 4 }   # diumenge de matinada

    database_flags {
      name  = "cloudsql.iam_authentication"
      value = "on"
    }

    user_labels = var.etiquetas
  }

  # Protecció contra el destroy accidental en producció
  deletion_protection = var.entorno == "prod"
}

resource "google_sql_database" "app" {
  project  = var.proyecto
  instance = google_sql_database_instance.principal.name
  name     = "reservas"
}

resource "google_sql_user" "app" {
  project  = var.proyecto
  instance = google_sql_database_instance.principal.name
  name     = "app"
  password = random_password.bd.result
}

resource "random_id" "sufijo" { byte_length = 2 }

resource "google_storage_bucket" "fotos" {
  project  = var.proyecto
  name     = "${var.prefijo}-fotos-${random_id.sufijo.hex}"   # nom global
  location = var.region

  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"

  versioning { enabled = true }

  lifecycle_rule {
    condition { age = 90, matches_storage_class = ["STANDARD"] }
    action    { type = "SetStorageClass", storage_class = "NEARLINE" }
  }
  lifecycle_rule {
    condition { age = 365, matches_storage_class = ["NEARLINE"] }
    action    { type = "SetStorageClass", storage_class = "COLDLINE" }
  }
  lifecycle_rule {
    condition { num_newer_versions = 3 }     # no acumular versions antigues
    action    { type = "Delete" }
  }

  cors {
    origin          = ["https://${var.dominio}"]
    method          = ["GET", "HEAD"]
    response_header = ["Content-Type"]
    max_age_seconds = 3600
  }

  labels = merge(var.etiquetas, { componente = "web" })
}

data/migraciones/
├── 001_esquema_inicial.sql
├── 002_indice_disponibilidad.sql
└── 003_columnas_sentimiento.sql

-- data/migraciones/001_esquema_inicial.sql
-- Idempotent: es pot executar dues vegades sense trencar res.
BEGIN;

CREATE TABLE IF NOT EXISTS refugio (
    id        SERIAL PRIMARY KEY,
    nombre    TEXT NOT NULL UNIQUE,
    altitud_m INTEGER NOT NULL CHECK (altitud_m BETWEEN 500 AND 3500),
    capacidad INTEGER NOT NULL CHECK (capacidad > 0),
    activo    BOOLEAN NOT NULL DEFAULT TRUE,
    creado_en TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE IF NOT EXISTS reserva (
    id             UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    refugio_id     INTEGER NOT NULL REFERENCES refugio(id),
    fecha          DATE NOT NULL,
    plazas         INTEGER NOT NULL CHECK (plazas BETWEEN 1 AND 12),
    nombre_titular TEXT NOT NULL,
    email_titular  TEXT NOT NULL,
    estado         TEXT NOT NULL DEFAULT 'confirmada'
                   CHECK (estado IN ('confirmada','cancelada')),
    creada_en      TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Registre de migracions aplicades
CREATE TABLE IF NOT EXISTS _migraciones (
    version    TEXT PRIMARY KEY,
    aplicada_en TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
INSERT INTO _migraciones (version) VALUES ('001')
  ON CONFLICT (version) DO NOTHING;

COMMIT;

# Descarrega cloud-sql-proxy si no el tens
./cloud-sql-proxy --port 5432 "${PROY_DEV}:${REGION}:refugio-db" &

PGPASSWORD=$(gcloud secrets versions access latest --secret=refugio-db-password --project="${PROY_DEV}")
export PGPASSWORD

for f in data/migraciones/*.sql; do
  echo "→ $f"
  psql -h 127.0.0.1 -U app -d reservas -v ON_ERROR_STOP=1 -f "$f"
done

unset PGPASSWORD

# data/seed/generar.py — genera dades 100% inventades
import random, uuid
from datetime import date, timedelta

random.seed(42)  # reproduïble: mateixes dades a cada execució

REFUGIS = [
    ("Refugio de Cotiella", 2100, 40), ("Refugio Peña Blanca", 1850, 28),
    ("Refugio del Ibón Verde", 2340, 22), ("Refugio de Valdellosa", 1620, 55),
]
NOMS = ["Ana", "Luis", "Marta", "Jorge", "Carmen", "Diego", "Elena", "Pablo"]
COGNOMS = ["Soler", "Ibáñez", "Marín", "Vidal", "Rey", "Castaño", "Lorca"]

def titular_fictici(i):
    nom = f"{random.choice(NOMS)} {random.choice(COGNOMS)}"
    # example.com està reservat per l'RFC 2606 just per a això
    correu = f"usuario{i:04d}@example.com"
    return nom, correu

def factor_estacional(d: date) -> float:
    """Juliol-agost x4, caps de setmana x2,5, la resta normal."""
    f = 4.0 if d.month in (7, 8) else (2.0 if d.month in (6, 9) else 1.0)
    if d.weekday() >= 5:
        f *= 2.5
    return f

def generar_reserves(n=2000):
    inici = date.today() - timedelta(days=540)
    files = []
    i = 0
    while len(files) < n:
        d = inici + timedelta(days=random.randint(0, 540))
        if random.random() > factor_estacional(d) / 10:
            continue
        i += 1
        nom, correu = titular_fictici(i)
        files.append((
            str(uuid.uuid4()), random.randint(1, len(REFUGIS)), d.isoformat(),
            random.randint(1, 6), nom, correu,
            "cancelada" if random.random() < 0.08 else "confirmada",
        ))
    return files

# app/Dockerfile — multietapa, sense root, i amb el mínim a dins
FROM python:3.12-slim AS build
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

FROM python:3.12-slim
RUN useradd --create-home --uid 1001 app
WORKDIR /app
COPY --from=build /root/.local /home/app/.local
COPY --chown=app:app src/ ./src/
USER app
ENV PATH=/home/app/.local/bin:$PATH \
    PYTHONUNBUFFERED=1

# $PORT l'injecta Cloud Run. El 8080 és només el valor per defecte local.
ENV PORT=8080
CMD exec uvicorn src.main:app --host 0.0.0.0 --port ${PORT}

resource "google_cloud_run_v2_service" "web" {
  project  = var.proyecto
  name     = "${var.prefijo}-web"
  location = var.region
  ingress  = "INGRESS_TRAFFIC_ALL"

  template {
    service_account = var.sa_web_email

    scaling {
      min_instance_count = var.run_min_instancias   # 0: escala a zero
      max_instance_count = var.run_max_instancias   # topall de despesa
    }

    vpc_access {
      connector = var.conector_id
      egress    = "PRIVATE_RANGES_ONLY"   # només la BD va per la VPC
    }

    containers {
      image = var.imagen

      resources {
        limits = { cpu = "1", memory = "512Mi" }
        cpu_idle = true                    # no pagar CPU entre peticions
      }

      # --- Configuració: en clar, no sensible ---
      env { name = "ENTORNO"   value = var.entorno }
      env { name = "REGION"    value = var.region }
      env { name = "BD_HOST"   value = var.bd_ip_privada }
      env { name = "BD_NOMBRE" value = "reservas" }
      env { name = "TOPIC_EVENTOS" value = var.topic_eventos }
      env { name = "BUCKET_FOTOS"  value = var.bucket_fotos }

      # --- Secrets: per referència, mai per valor ---
      env {
        name = "BD_PASSWORD"
        value_source {
          secret_key_ref {
            secret  = var.secreto_bd_password
            version = "latest"
          }
        }
      }

      startup_probe {
        http_get { path = "/salud/arranque" }
        initial_delay_seconds = 3
        period_seconds        = 3
        failure_threshold     = 10
      }
      liveness_probe {
        http_get { path = "/salud/vivo" }
        period_seconds = 30
      }
    }
  }

  traffic {
    type    = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
    percent = 100
  }
}

# app/src/main.py (fragment)
from fastapi import FastAPI, Response
from . import db

app = FastAPI()

@app.get("/salud/arranque")
async def arrencada(response: Response):
    """Sonda d'arrencada: estic a punt per rebre trànsit?
    Comprova dependències crítiques. Si falla, Cloud Run no envia trànsit."""
    try:
        await db.ping()
        return {"estado": "listo"}
    except Exception as e:
        response.status_code = 503
        return {"estado": "no listo", "motivo": str(e)[:200]}

@app.get("/salud/vivo")
async def viu():
    """Sonda de vida: el procés respon?
    NO comprova dependències: si la BD cau, no volem que
    Cloud Run reiniciï la instància en bucle — no arreglaria res."""
    return {"estado": "vivo"}

# app/src/observabilidad.py
import json, os, sys, contextvars

_trace = contextvars.ContextVar("trace", default=None)
PROJECTE = os.environ.get("GOOGLE_CLOUD_PROJECT", "")

def fixar_trace(capcalera: str | None):
    """Cloud Run envia X-Cloud-Trace-Context: TRACE_ID/SPAN_ID;o=1"""
    if capcalera:
        _trace.set(capcalera.split("/")[0])

def log(severitat: str, missatge: str, **camps):
    entrada = {
        "severity": severitat,           # noms que Cloud Logging entén
        "message": missatge,
        **camps,
    }
    t = _trace.get()
    if t and PROJECTE:
        # Aquesta clau exacta és la que enllaça el registre amb la traça a la consola
        entrada["logging.googleapis.com/trace"] = f"projects/{PROJECTE}/traces/{t}"
    print(json.dumps(entrada, ensure_ascii=False), file=sys.stdout, flush=True)

# Al middleware de l'aplicació
@app.middleware("http")
async def correlacio(request, call_next):
    fixar_trace(request.headers.get("X-Cloud-Trace-Context"))
    resposta = await call_next(request)
    log("INFO", "peticion",
        ruta=request.url.path, metodo=request.method,
        codigo=resposta.status_code)
    return resposta

export IMAGEN="${REGION}-docker.pkg.dev/${PROY_DEV}/refugio-imagenes/web:manual-1"

gcloud builds submit app/ --tag="${IMAGEN}" --project="${PROY_DEV}"

gcloud run deploy refugio-web \
  --image="${IMAGEN}" \
  --region="${REGION}" \
  --project="${PROY_DEV}" \
  --service-account="sa-refugio-web@${PROY_DEV}.iam.gserviceaccount.com" \
  --vpc-connector="refugio-conn" \
  --vpc-egress=private-ranges-only \
  --set-env-vars="ENTORNO=dev,BD_HOST=10.10.16.3,BD_NOMBRE=reservas" \
  --set-secrets="BD_PASSWORD=refugio-db-password:latest" \
  --min-instances=0 --max-instances=2 \
  --no-allow-unauthenticated

URL=$(gcloud run services describe refugio-web --region="${REGION}" \
      --project="${PROY_DEV}" --format="value(status.url)")
curl -s -H "Authorization: Bearer $(gcloud auth print-identity-token)" "${URL}/salud/arranque"

# cloudbuild.yaml
substitutions:
  _REGION: europe-west1
  _SERVICIO: refugio-web
  _REPO: refugio-imagenes

steps:
  # 1. Proves ABANS de construir. Si fallen, no hi ha imatge.
  - id: pruebas
    name: python:3.12-slim
    entrypoint: bash
    args:
      - -c
      - |
        pip install --no-cache-dir -r app/requirements.txt -r app/requirements-dev.txt
        cd app && python -m pytest tests/ -v --tb=short

  # 2. Construir amb memòria cau de la imatge anterior
  - id: construir
    name: gcr.io/cloud-builders/docker
    args:
      - build
      - --cache-from=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web:latest
      - -t=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web:$SHORT_SHA
      - -t=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web:latest
      - app/
    waitFor: [pruebas]

  # 3. Publicar
  - id: publicar
    name: gcr.io/cloud-builders/docker
    args: [push, --all-tags, "${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web"]

  # 4. Desplegar a DESENVOLUPAMENT
  - id: desplegar
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: gcloud
    args:
      - run
      - deploy
      - ${_SERVICIO}
      - --image=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPO}/web:$SHORT_SHA
      - --region=${_REGION}
      - --revision-suffix=$SHORT_SHA

  # 5. Fum: si la revisió acabada de desplegar no respon, el build falla
  - id: humo
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: bash
    args:
      - -c
      - |
        URL=$(gcloud run services describe ${_SERVICIO} --region=${_REGION} --format='value(status.url)')
        TOKEN=$(gcloud auth print-identity-token)
        CODIGO=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $$TOKEN" "$$URL/salud/arranque")
        echo "Codi: $$CODIGO"
        test "$$CODIGO" = "200"

options:
  logging: CLOUD_LOGGING_ONLY
  machineType: E2_HIGHCPU_8
timeout: 900s

# cloudbuild-prod.yaml — NO construeix. Promociona la imatge ja provada.
substitutions:
  _IMAGEN_SHA: ""     # es passa explícitament: la que ja funciona en dev

steps:
  - id: verificar-imagen-existe
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: bash
    args:
      - -c
      - |
        test -n "${_IMAGEN_SHA}" || { echo "Falta _IMAGEN_SHA"; exit 1; }
        gcloud artifacts docker images describe \
          europe-west1-docker.pkg.dev/refugio-dev/refugio-imagenes/web:${_IMAGEN_SHA}

  # Desplegament CANARI: 10% del trànsit a la revisió nova
  - id: canario
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: gcloud
    args:
      - run
      - deploy
      - refugio-web
      - --image=europe-west1-docker.pkg.dev/refugio-dev/refugio-imagenes/web:${_IMAGEN_SHA}
      - --region=europe-west1
      - --project=refugio-prod
      - --no-traffic                       # es desplega sense rebre trànsit
      - --revision-suffix=${_IMAGEN_SHA}

  - id: repartir-10
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: gcloud
    args:
      - run
      - services
      - update-traffic
      - refugio-web
      - --region=europe-west1
      - --project=refugio-prod
      - --to-revisions=refugio-web-${_IMAGEN_SHA}=10

# app/src/eventos.py
import json, os
from google.cloud import pubsub_v1

_publisher = pubsub_v1.PublisherClient()
_TOPIC = _publisher.topic_path(os.environ["GOOGLE_CLOUD_PROJECT"],
                               os.environ["TOPIC_EVENTOS"])

def publicar_reserva(esdeveniment: dict) -> None:
    """Publica l'esdeveniment de negoci. MAI inclou dades de contacte."""
    carrega = {
        "evento_id":      esdeveniment["id"],
        "tipo_evento":    esdeveniment["tipo"],       # creada | cancelada
        "reserva_id":     esdeveniment["reserva_id"],
        "refugio_id":     esdeveniment["refugio_id"],
        "refugio_nombre": esdeveniment["refugio_nombre"],
        "fecha_estancia": esdeveniment["fecha"],
        "plazas":         esdeveniment["plazas"],
        "ocurrido_en":    esdeveniment["ts"],
    }
    futur = _publisher.publish(_TOPIC, json.dumps(carrega).encode("utf-8"))
    futur.result(timeout=10)

# ml/../funcion/main.py
import base64, json, os
from google.cloud import bigquery

_bq = bigquery.Client()
_TAULA = os.environ["TABLA_EVENTOS"]

def processar(esdeveniment, context):
    """Subscriptor de Pub/Sub. Insereix l'esdeveniment a BigQuery."""
    dades = json.loads(base64.b64decode(esdeveniment["data"]).decode("utf-8"))

    errors = _bq.insert_rows_json(_TAULA, [dades], row_ids=[dades["evento_id"]])
    if errors:
        # Llançar excepció fa que Pub/Sub reintenti; després de N intents,
        # el missatge va a la cua de missatges fallits.
        raise RuntimeError(f"Error inserint a BigQuery: {errors}")

-- data/sql/analitica.sql
CREATE TABLE IF NOT EXISTS `refugio-datos.refugio_analitica.reservas_eventos` (
  evento_id      STRING NOT NULL,
  ocurrido_en    TIMESTAMP NOT NULL,
  tipo_evento    STRING NOT NULL,
  reserva_id     STRING NOT NULL,
  refugio_id     INT64 NOT NULL,
  refugio_nombre STRING,
  fecha_estancia DATE NOT NULL,
  plazas         INT64 NOT NULL
)
PARTITION BY DATE(ocurrido_en)
CLUSTER BY refugio_id
OPTIONS (partition_expiration_days = 1095, require_partition_filter = TRUE);

-- Vista agregada: és el que consumeix el tauler de control.
-- Que el tauler consulti una vista i no la taula base redueix l'escaneig.
CREATE OR REPLACE VIEW `refugio-datos.refugio_analitica.v_ocupacion_diaria` AS
SELECT
  fecha_estancia,
  refugio_id,
  ANY_VALUE(refugio_nombre) AS refugio,
  SUM(IF(tipo_evento = 'creada',    plazas, 0)) AS plazas_reservadas,
  SUM(IF(tipo_evento = 'cancelada', plazas, 0)) AS plazas_canceladas,
  SUM(IF(tipo_evento = 'creada', plazas, -plazas)) AS plazas_netas
FROM `refugio-datos.refugio_analitica.reservas_eventos`
WHERE DATE(ocurrido_en) >= DATE_SUB(CURRENT_DATE(), INTERVAL 730 DAY)
GROUP BY fecha_estancia, refugio_id;

# ml/analizar_opiniones.py
from google.cloud import language_v2

_client = language_v2.LanguageServiceClient()

def analitzar(text: str) -> dict:
    """Sentiment d'una opinió. Text FICTICI, sense dades personals."""
    document = language_v2.Document(
        content=text,
        type_=language_v2.Document.Type.PLAIN_TEXT,
        language_code="es",
    )
    r = _client.analyze_sentiment(request={"document": document})
    return {
        "sentimiento": round(r.document_sentiment.score, 3),   # -1..1
        "magnitud":    round(r.document_sentiment.magnitude, 3),
    }

# Prova d'extrem a extrem: crear una reserva i veure-la a BigQuery
curl -s -X POST "${URL}/api/reservas" -H 'Content-Type: application/json' \
  -d '{"refugio_id":1,"fecha":"2026-12-20","plazas":2,
       "nombre_titular":"Prova Fictícia","email_titular":"[email protected]"}'

sleep 30

bq query --use_legacy_sql=false --project_id="${PROY_DATOS}" \
'SELECT evento_id, tipo_evento, refugio_id, plazas
 FROM `refugio-datos.refugio_analitica.reservas_eventos`
 WHERE DATE(ocurrido_en) = CURRENT_DATE()
 ORDER BY ocurrido_en DESC LIMIT 5'

resource "google_cloud_run_domain_mapping" "web" {
  project  = var.proyecto
  location = var.region
  name     = var.dominio                 # "refugioreserva.example"
  metadata { namespace = var.proyecto }
  spec     { route_name = google_cloud_run_v2_service.web.name }
}

output "registros_dns" {
  description = "Registres a crear al registrador"
  value       = google_cloud_run_domain_mapping.web.status[0].resource_records
}

resource "google_compute_region_network_endpoint_group" "neg" {
  project               = var.proyecto
  name                  = "${var.prefijo}-neg"
  region                = var.region
  network_endpoint_type = "SERVERLESS"
  cloud_run { service = google_cloud_run_v2_service.web.name }
}

resource "google_compute_backend_service" "bs" {
  project                 = var.proyecto
  name                    = "${var.prefijo}-bs"
  protocol                = "HTTPS"
  load_balancing_scheme   = "EXTERNAL_MANAGED"
  enable_cdn              = true
  security_policy         = google_compute_security_policy.waf.id

  backend { group = google_compute_region_network_endpoint_group.neg.id }

  cdn_policy {
    cache_mode        = "CACHE_ALL_STATIC"
    default_ttl       = 3600
    client_ttl        = 3600
    negative_caching  = true
  }

  log_config { enable = true, sample_rate = 1.0 }
}

resource "google_compute_security_policy" "waf" {
  project = var.proyecto
  name    = "${var.prefijo}-waf"

  # Limitació de taxa: protegeix la butxaca tant com l'aplicació
  rule {
    action   = "throttle"
    priority = 1000
    match {
      versioned_expr = "SRC_IPS_V1"
      config { src_ip_ranges = ["*"] }
    }
    rate_limit_options {
      conform_action = "allow"
      exceed_action  = "deny(429)"
      enforce_on_key = "IP"
      rate_limit_threshold { count = 100, interval_sec = 60 }
    }
  }

  rule {
    action   = "allow"
    priority = 2147483647
    match {
      versioned_expr = "SRC_IPS_V1"
      config { src_ip_ranges = ["*"] }
    }
    description = "Regla per defecte"
  }
}

curl -sI "https://${DOMINIO}" | head -1                       # HTTP/2 200
curl -sI "https://${DOMINIO}" | grep -i strict-transport       # HSTS present
echo | openssl s_client -connect "${DOMINIO}:443" -servername "${DOMINIO}" 2>/dev/null \
  | openssl x509 -noout -dates -issuer                         # certificat vàlid
curl -sI "http://${DOMINIO}" | head -1                         # 301 a HTTPS

resource "google_monitoring_dashboard" "principal" {
  project = var.proyecto
  dashboard_json = jsonencode({
    displayName = "RefugioReserva — visió general"
    gridLayout  = { columns = 2, widgets = [
      {
        title = "Trànsit (peticions/s)"
        xyChart = { dataSets = [{ timeSeriesQuery = { timeSeriesFilter = {
          filter = "metric.type=\"run.googleapis.com/request_count\" resource.type=\"cloud_run_revision\""
          aggregation = { alignmentPeriod = "60s", perSeriesAligner = "ALIGN_RATE" }
        }}}]}
      },
      {
        title = "Errors (5xx/s)"
        xyChart = { dataSets = [{ timeSeriesQuery = { timeSeriesFilter = {
          filter = "metric.type=\"run.googleapis.com/request_count\" metric.label.response_code_class=\"5xx\""
          aggregation = { alignmentPeriod = "60s", perSeriesAligner = "ALIGN_RATE" }
        }}}]}
      },
      {
        title = "Latència p95 (ms)"
        xyChart = { dataSets = [{ timeSeriesQuery = { timeSeriesFilter = {
          filter = "metric.type=\"run.googleapis.com/request_latencies\""
          aggregation = { alignmentPeriod = "60s", perSeriesAligner = "ALIGN_DELTA",
                          crossSeriesReducer = "REDUCE_PERCENTILE_95" }
        }}}]}
      },
      {
        title = "Instàncies actives (saturació)"
        xyChart = { dataSets = [{ timeSeriesQuery = { timeSeriesFilter = {
          filter = "metric.type=\"run.googleapis.com/container/instance_count\""
          aggregation = { alignmentPeriod = "60s", perSeriesAligner = "ALIGN_MEAN" }
        }}}]}
      }
    ]}
  })
}

resource "google_monitoring_notification_channel" "correo" {
  project      = var.proyecto
  display_name = "Correu del responsable"
  type         = "email"
  labels       = { email_address = var.correo_alertas }
}

resource "google_monitoring_alert_policy" "errores_5xx" {
  project      = var.proyecto
  display_name = "Taxa d'errors 5xx > 5%"
  combiner     = "OR"

  conditions {
    display_name = "5xx elevats durant 5 minuts"
    condition_threshold {
      filter = join(" ", [
        "metric.type=\"run.googleapis.com/request_count\"",
        "resource.type=\"cloud_run_revision\"",
        "metric.label.response_code_class=\"5xx\"",
      ])
      comparison      = "COMPARISON_GT"
      threshold_value = 0.05
      duration        = "300s"
      aggregations {
        alignment_period   = "60s"
        per_series_aligner = "ALIGN_RATE"
      }
    }
  }

  notification_channels = [google_monitoring_notification_channel.correo.id]

  documentation {
    content = <<-EOT
      ## Errors 5xx elevats

      **Primers passos** (vegeu `docs/runbook.md`):
      1. `gcloud logging read 'severity>=ERROR' --limit=20 --freshness=15m`
      2. Coincideix amb un desplegament? `gcloud run revisions list --limit=5`
      3. Si coincideix: revertir amb
         `gcloud run services update-traffic refugio-web --to-revisions=<anterior>=100`
      4. Base de dades accessible? `gcloud sql instances describe refugio-db`
    EOT
    mime_type = "text/markdown"
  }
}

resource "google_monitoring_slo" "disponibilidad" {
  project = var.proyecto
  service = google_monitoring_service.web.service_id
  slo_id  = "disponibilidad-api"
  display_name = "99,5% de peticions sense error 5xx (30 dies)"

  goal                = 0.995
  rolling_period_days = 30

  request_based_sli {
    good_total_ratio {
      total_service_filter = "metric.type=\"run.googleapis.com/request_count\" resource.type=\"cloud_run_revision\""
      bad_service_filter   = "metric.type=\"run.googleapis.com/request_count\" resource.type=\"cloud_run_revision\" metric.label.response_code_class=\"5xx\""
    }
  }
}

resource "google_monitoring_uptime_check_config" "web" {
  project      = var.proyecto
  display_name = "RefugioReserva disponible"
  timeout      = "10s"
  period       = "300s"

  http_check {
    path         = "/salud/arranque"
    port         = 443
    use_ssl      = true
    validate_ssl = true
  }

  monitored_resource {
    type   = "uptime_url"
    labels = { host = var.dominio, project_id = var.proyecto }
  }

  selected_regions = ["EUROPE", "USA"]
}

# Provocar l'alerta expressament: desplega una revisió que retorni 500
# en un endpoint de prova, genera trànsit, i espera el correu.
for i in $(seq 1 200); do curl -s -o /dev/null "${URL}/api/error-de-prueba"; done
# Espera 5-10 minuts. Si no arriba el correu, l'alerta no serveix.

git add infra/modules/red/
git commit -m "Afegeix mòdul de xarxa: VPC, subxarxa, connector /28 i peering de serveis"

terraform plan -out=plan.tfplan
terraform show -json plan.tfplan | \
  jq -r '.resource_changes[] | select(.change.actions | index("delete")) | .address'
# Si això retorna alguna cosa que no esperes, no apliquis.

# Terraform 1.5+: bloc import, versionable al codi
cat >> infra/envs/dev/imports.tf <<'EOF'
import {
  to = google_storage_bucket.temporal
  id = "refugio-dev/refugio-temporal-a1b2"
}
EOF
terraform plan   # genera la configuració que falta

# Àlies que convé tenir a mà
gcloud billing accounts list
# I, quan l'exportació a BigQuery porti uns dies poblant:
bq query --use_legacy_sql=false \
'SELECT service.description AS servicio, ROUND(SUM(cost),2) AS coste_eur
 FROM `mi-proyecto.facturacion.gcp_billing_export_v1_XXXX`
 WHERE DATE(usage_start_time) >= DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY)
 GROUP BY servicio ORDER BY coste_eur DESC'

terraform -chdir=infra/envs/dev destroy -auto-approve   # divendres
terraform -chdir=infra/envs/dev apply   -auto-approve   # dissabte

$ terraform -chdir=infra/envs/dev plan
No changes. Your infrastructure matches the configuration.

$ gcloud projects get-iam-policy refugio-dev --format=json | \
  jq -r '.bindings[] | select(.role|test("roles/(owner|editor)")) |
         "\(.role): \(.members[])"'
roles/owner: user:[email protected]
# Cap compte de servei. Correcte.

$ for SA in $(gcloud iam service-accounts list --project=refugio-dev --format="value(email)"); do
    N=$(gcloud iam service-accounts keys list --iam-account="$SA" --managed-by=user \
        --format="value(name)" | wc -l)
    echo "$SA -> $N claus d'usuari"
  done
[email protected] -> 0
[email protected] -> 0
[email protected] -> 0
[email protected] -> 0

# 1. Verificar la base de dades
$ gcloud sql instances describe refugio-db --project=refugio-dev \
    --format="value(settings.ipConfiguration.ipv4Enabled, state)"
False   RUNNABLE

# 2. Verificar el secret
$ gcloud secrets versions list refugio-db-password --project=refugio-dev \
    --format="value(name,state)"
1   ENABLED

# 3. Dades sembrades
$ psql -h 127.0.0.1 -U app -d reservas -c \
    "SELECT count(*) AS reservas, count(DISTINCT refugio_id) AS refugios FROM reserva"
 reservas | refugios
----------+----------
     2000 |       12

# 4. L'aplicació respon i llegeix de la BD
$ curl -s "${URL}/api/refugios" | jq '.[0]'
{"id":1,"nombre":"Refugio de Cotiella","altitud_m":2100,"capacidad":40}

# 5. Crear una reserva (dades FICTÍCIES)
$ curl -s -X POST "${URL}/api/reservas" -H 'Content-Type: application/json' \
    -d '{"refugio_id":3,"fecha":"2026-12-20","plazas":2,
         "nombre_titular":"Prova Fictícia","email_titular":"[email protected]"}' | jq
{"id":"7c2e...","estado":"confirmada","plazas_restantes":20}

# 6. El registre estructurat, amb la seva traça
$ gcloud logging read 'resource.type="cloud_run_revision" jsonPayload.ruta="/api/reservas"' \
    --limit=1 --format="value(jsonPayload.message, jsonPayload.codigo, trace)"
peticion  201  projects/refugio-dev/traces/8a1f...

# 7. L'esdeveniment va arribar a BigQuery (26 segons després)
$ bq query --use_legacy_sql=false --project_id=refugio-datos \
  'SELECT evento_id, tipo_evento, refugio_id, plazas, ocurrido_en
   FROM `refugio-datos.refugio_analitica.reservas_eventos`
   WHERE DATE(ocurrido_en) = CURRENT_DATE() ORDER BY ocurrido_en DESC LIMIT 1'
+-----------+-------------+------------+--------+---------------------+
| evento_id | tipo_evento | refugio_id | plazas |     ocurrido_en     |
+-----------+-------------+------------+--------+---------------------+
| 7c2e...   | creada      |          3 |      2 | 2026-10-14 18:42:11 |
+-----------+-------------+------------+--------+---------------------+

# 8. I el sentiment de les opinions
$ psql -c "SELECT count(*) FILTER (WHERE sentimiento IS NOT NULL) AS analizadas,
           round(avg(sentimiento)::numeric,3) AS media FROM opinion"
 analizadas | media
------------+--------
        400 |  0.412

# app/tests/test_unitarios.py — canvi temporal
def test_no_sobreventa():
    disponible = calcular_disponibilidad(refugio_id=1, fecha="2026-08-15")
    assert disponible == 999   # ← valor incorrecte expressament

$ git commit -am "PROVA: trenco el test d'aforament expressament" && git push
$ gcloud builds list --limit=1 --format="table(id, status, createTime)"
ID                                    STATUS   CREATE_TIME
9f2a-...                              FAILURE  2026-10-21T19:14:22

$ gcloud run revisions list --service=refugio-web --region=europe-west1 --limit=2 \
    --format="table(name, active, createTime)"
NAME                    ACTIVE  CREATE_TIME
refugio-web-a3f81c      True    2026-10-21T18:02:11   ← l'anterior continua servint

$ curl -sI https://dev.refugioreserva.example | head -3
HTTP/2 200
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8

$ echo | openssl s_client -connect dev.refugioreserva.example:443 \
    -servername dev.refugioreserva.example 2>/dev/null | \
    openssl x509 -noout -dates -issuer
notBefore=Oct 20 09:14:00 2026 GMT
notAfter=Jan 18 09:13:59 2027 GMT
issuer=C = US, O = Google Trust Services, CN = WE1

$ curl -sI http://dev.refugioreserva.example | head -1
HTTP/1.1 301 Moved Permanently

$ for i in $(seq 1 300); do curl -s -o /dev/null "${URL}/api/error-de-prueba"; done
$ # 6 minuts després:
$ gcloud alpha monitoring policies list --format="value(displayName,enabled)"
Tasa de errores 5xx > 5%   True