docs: update resume.tex and README.md with Go Serverless Visitor Tracker

Author: roguehunter7

README.md

@@ -16,10 +16,15 @@ Originally designed as a zero-ingress VM-based setup (using Cloudflare tunnels a
 ## 🏗️ Architecture Design
 
 ```
-  [USER] ─── (HTTPS) ───► [CLOUD RUN INGRESS] ───► [UNPRIVILEGED NGINX CONTAINER]
+  [USER] ─── (HTTPS) ───► [PORTFOLIO FRONTEND] ───► [UNPRIVILEGED NGINX]
                                                         (index.html & resume.pdf)
-                                                                   ▲
-                                                                   │ (Deploy)
+                                                                    │
+                                                             (Fetch API / CORS)
+                                                                    ▼
+  [FIRESTORE DB] ◄─── (atomic sdk) ───► [PORTFOLIO TRACKER API (Go)]
+                                           (us-central1, 128Mi, CPU Idle)
+                                                                    ▲
+                                                                    │ (Deploy)
 [GITHUB ACTIONS] ─── (OIDC/WIF) ───► [GCP ARTIFACT REGISTRY] ──────┘
 ```
 
@@ -31,37 +36,46 @@ Originally designed as a zero-ingress VM-based setup (using Cloudflare tunnels a
 We eliminated all long-lived Google Cloud Service Account JSON keys from GitHub Secrets. The deployment pipeline authenticates securely using short-lived OpenID Connect (OIDC) tokens through GCP Workload Identity Federation, drastically reducing the security risk profile.
 
 ### 2. Fully Managed Serverless Hosting
-Migrated from a self-managed `e2-micro` VM to **Google Cloud Run**. The application scales down to zero instances when idle, removing host OS maintenance, security patching overhead, and daemon service monitoring.
+Migrated from a self-managed `e2-micro` VM to **Google Cloud Run**. Both the static web app and the visitor tracker microservice are hosted on Cloud Run. The services scale down to zero instances when idle, removing host OS maintenance and daemon service monitoring.
 
-### 3. State-Locked Declarative IaC
-The infrastructure (Cloud Run service and public IAM bindings) is defined declaratively using **Terraform** with state locked in a **GCS Remote Backend**. The pipeline automatically applies modifications on push to the `main` branch.
+### 3. Serverless Go & Firestore Visitor Analytics
+Implemented a custom visitor and active session tracker API in **Go (Golang)**. It connects to **Google Cloud Firestore (Native Mode)** to record live session metadata and atomically increment unique site views.
+- **Resource Footprint Optimization:** The Go microservice runs within a resource-restricted container limited to `128Mi` memory, utilizing `cpu_idle = true` to throttle CPU during inactivity, reducing idle container costs to zero.
+- **Session Lifecycle & Bloat Prevention:** The API writes ephemeral active session documents and executes auto-eviction queries to delete sessions older than 5 minutes, preventing Firestore database bloat.
+- **Cache Control & CORS:** Sends strict no-cache headers to ensure metrics remain fresh, and includes proper CORS configuration for seamless client integration.
 
-### 4. LaTeX Resume Automation with Caching
+### 4. State-Locked Declarative IaC
+The infrastructure (Cloud Run services and public IAM invoker bindings) is defined declaratively using **Terraform** with state locked in a **GCS Remote Backend**. The pipeline automatically applies modifications on push to the `main` branch.
+
+### 5. LaTeX Resume Automation with Caching
 The pipeline compiles `resume.tex` to `resume.pdf` during the workflow run. To optimize deployment speed, `actions/cache` is used to cache `resume.pdf` based on the hash of `resume.tex`.
-* **Deployment Optimization:** If `resume.tex` has not changed, the LaTeX setup and compilation step are skipped completely, saving ~1.5 minutes per run.
+- **Deployment Optimization:** If `resume.tex` has not changed, the LaTeX setup and compilation step are skipped completely, saving ~1.5 minutes per run.
 
-### 5. Runtime Hardening
-The portfolio is served using `nginxinc/nginx-unprivileged:1.27.0-alpine-slim` running on non-root UID 101, safeguarding the environment against container-escape vulnerabilities.
+### 6. Runtime Hardening
+The portfolio frontend is served using `nginxinc/nginx-unprivileged:1.27.0-alpine-slim` running on non-root UID 101, safeguarding the environment against container-escape vulnerabilities.
 
 ---
 
 ## 📂 Repository Structure
 
-* `main.tf` : Terraform configuration for the Cloud Run v2 service and public access bindings (`roles/run.invoker` for `allUsers`).
+* `main.tf` : Terraform configuration for both the frontend and tracker API Cloud Run services, including public access bindings (`roles/run.invoker` for `allUsers`).
 * `variables.tf` : Declarative input variables for container tags.
 * `Dockerfile` : Configured to optionally copy `resume.pdf` using wildcards to protect local/dev builds if the PDF hasn't been compiled locally.
-* `index.html` : The main web page detailing the 4-phase architectural evolution.
+* `index.html` : The main web page detailing the 4-phase architectural evolution and displaying live session stats in the footer.
 * `resume.tex` : The LaTeX source file for the professional resume.
-* `.github/workflows/deploy.yml` : Secure CI/CD workflow utilizing OIDC auth, LaTeX caching, Docker builds, and Terraform apply.
+* `tracker-api/` : Go API microservice codebase.
+  - `main.go` : The Go listener with Firestore SDK integrations, CORS, and cleanup routines.
+  - `Dockerfile` : Multi-stage build (`golang:alpine` to `alpine:latest`) to produce a highly-minimized execution image.
+* `.github/workflows/deploy.yml` : Secure CI/CD workflow utilizing OIDC auth, LaTeX caching, Docker builds for both containers, and Terraform apply.
 
 ---
 
 ## ⚙️ Automated Deployment Flow
 
 1. **Change Detection & Cache Check:** GitHub Actions checks if `resume.tex` has changed. If unchanged, it restores `resume.pdf` from the cache.
 2. **LaTeX Compilation (Conditional):** If the cache is missed, it compiles `resume.tex` into `resume.pdf`.
-3. **Hardened Containerization:** The runner builds the unprivileged Nginx image, copying both `index.html` and `resume.pdf` (if present) into the image, and pushes it to GCP Artifact Registry using OIDC authentication.
-4. **Declarative Deploy:** Runs `terraform init` and `terraform apply` using the new image tag, deploying the service and ensuring public web ingress access.
+3. **Hardened Containerization:** The runner builds the unprivileged Nginx frontend image and the compiled Go tracker API image, pushing both to GCP Artifact Registry using OIDC authentication.
+4. **Declarative Deploy:** Runs `terraform init` and `terraform apply` using the new image tags, deploying/updating both Cloud Run services and ensuring public web ingress access.
 
 ---
 

resume.tex

@@ -94,6 +94,13 @@ \section{Technical Projects}
 \item Hardened application deployments by using rootless, unprivileged Docker containers and enforcing E2E strict HTTPS, DNSSEC, and HSTS policies at the Cloudflare Edge to minimize the system attack surface.
 \end{itemize}
 
+\textbf{Serverless Visitor Tracker \& Session Analytics API} \hfill \href{https://sreeramkr.com}{sreeramkr.com}
+\begin{itemize}[itemsep=3pt]
+\item Developed a lightweight, low-latency API in \textbf{Go (Golang)} to track live website sessions and unique page views, running on an optimized \textbf{Google Cloud Run} container.
+\item Integrated \textbf{Google Cloud Firestore (Native Mode)} for transactional state storage, implementing atomic increment operations and concurrent query aggregations.
+\item Designed automated database bloat prevention to clean up expired sessions and enforced strict HTTP Cache-Control headers to deliver real-time metrics dynamically.
+\end{itemize}
+
 % --- EDUCATION ---
 \section{Education}