{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"b63250f9e92fa66fbaa1730e50291e6a9706c05375bcf2ee8578b58af257647d","entry":{"id":"google/cloud-project-run","name":"Google Cloud project with Cloud Run, Firestore and a custom domain","vendor":"Google","summary":"Create a project under your organisation, link billing, enable APIs, create Firestore and Artifact Registry, fix Cloud Build permissions for source deploys, deploy to Cloud Run with Secret Manager, and put a global HTTPS load balancer with a Google-managed certificate in front for your domain.","aliases":["gcp","google-cloud","cloud-run"],"category":"hosting","group":"C","homepage":"https://cloud.google.com/","docs":["https://cloud.google.com/run/docs/mapping-custom-domains","https://cloud.google.com/run/docs/known-issues","https://cloud.google.com/load-balancing/docs/https/setting-up-https-serverless"],"status":"verified","last_verified":"2026-10-24","last_researched":"2026-10-24","verified_by":["jon"],"sources":[{"id":"owner-session","url":"https://console.cloud.google.com/","title":"verapli owner's live Google Cloud setup for verapli.com in europe-west2 (first-hand)","accessed":"2026-10-24","supports":"Project under org; billing link with free-trial credit note; API enablement; Firestore; Artifact Registry; Cloud Build default compute service account roles for source builds; no Cloud Run domain mapping in europe-west2, so global external HTTPS LB + serverless NEG + Google-managed certificate (provisioned after DNS resolved, minutes up to about an hour); /healthz reserved on Cloud Run; --env-vars-file replaces all plain env vars; Secret Manager with per-secret IAM","kind":"first_hand"}],"allowed_domains":["console.cloud.google.com"],"account_model":{"summary":"The project lives under the organisation; billing comes from a separate Cloud Billing account.","accounts":[{"name":"Google account","kind":"personal","owned_by":"the person","required":true},{"name":"Google Cloud organisation","kind":"organisation","owned_by":"the company","parent":"Google account","required":false,"note":"Projects can also be created without an organisation; this entry was verified under one."},{"name":"Cloud Billing account","kind":"billing","required":true},{"name":"Google Cloud project","kind":"project","parent":"Google Cloud organisation","required":true}]},"have_ready":[{"kind":"payment_card","description":"Payment card for the Cloud Billing account","needed_for":["link-billing"],"auto_check":"none","source":"owner-session"}],"steps":[{"id":"create-project","title":"Create a project under your organisation","summary":"Create the project in the console (or `gcloud projects create <id> --organization=<org-id>`). You press create.","route":"guided","depends_on":[],"gate":"human_submit","url":"https://console.cloud.google.com/projectcreate","sources":["owner-session"]},{"id":"link-billing","title":"Link a billing account","summary":"Link the project to a Cloud Billing account. A new billing account may show free-trial credit; check the amount and expiry on the billing page [to verify].","route":"guided","depends_on":["create-project"],"gate":"human_payment","url":"https://console.cloud.google.com/billing","sources":["owner-session"]},{"id":"enable-apis","title":"Enable the APIs","summary":"Enable the services you need, e.g. `gcloud services enable run.googleapis.com cloudbuild.googleapis.com artifactregistry.googleapis.com firestore.googleapis.com secretmanager.googleapis.com compute.googleapis.com`.","route":"api","depends_on":["link-billing"],"gate":"none","sources":["owner-session"]},{"id":"firestore","title":"Create the Firestore database","summary":"Create a Firestore (Native mode) database in your region, e.g. `gcloud firestore databases create --location=europe-west2`.","route":"api","depends_on":["enable-apis"],"gate":"none","sources":["owner-session"]},{"id":"artifact-registry","title":"Create an Artifact Registry repository","summary":"Create a Docker repository for your images, e.g. `gcloud artifacts repositories create <repo> --repository-format=docker --location=europe-west2`.","route":"api","depends_on":["enable-apis"],"gate":"none","sources":["owner-session"]},{"id":"build-permissions","title":"Give the build service account the roles source builds need","summary":"For `gcloud run deploy --source`, the default compute service account used by Cloud Build needs roles/artifactregistry.writer, roles/logging.logWriter and roles/storage.objectViewer.","route":"api","depends_on":["artifact-registry"],"gate":"none","recovery":[{"hiccup":"A source deploy fails with a permission error during the build","fix":"Grant the default compute service account artifactregistry.writer, logging.logWriter and storage.objectViewer, then redeploy.","source":"owner-session"}],"sources":["owner-session"]},{"id":"secrets","title":"Store secrets in Secret Manager","summary":"Create one secret per value and grant roles/secretmanager.secretAccessor on each secret to the Cloud Run runtime service account (per-secret IAM, not project-wide).","route":"api","depends_on":["enable-apis"],"gate":"none","sources":["owner-session"]},{"id":"deploy-run","title":"Deploy the Cloud Run service","summary":"Deploy with `gcloud run deploy`. Use /health, not /healthz, for health checks: /healthz is reserved on Cloud Run. Note that `gcloud run services update --env-vars-file` replaces all plain env vars.","route":"api","depends_on":["build-permissions","secrets","firestore"],"gate":"none","recovery":[{"hiccup":"Requests to /healthz never reach your container","fix":"/healthz is reserved on Cloud Run; serve health checks on /health instead.","source":"owner-session"},{"hiccup":"Env vars disappeared after an update","fix":"--env-vars-file replaces every plain env var; put all of them in the file, or use --update-env-vars for single changes.","source":"owner-session"}],"sources":["owner-session"]},{"id":"custom-domain","title":"Put a global HTTPS load balancer in front for your domain","summary":"Cloud Run domain mapping is not offered in europe-west2, so create a global external HTTPS load balancer with a serverless NEG pointing at the service, reserve static IPv4/IPv6 addresses, and attach a Google-managed certificate. Point DNS at the addresses (see namecheap/dns); the certificate provisions once DNS resolves.","route":"api","depends_on":["deploy-run"],"gate":"none","lead_time":{"reported":{"text":"Certificate provisioned after DNS resolved, from minutes up to about 60 minutes (first-hand, 2026-10-24)","source":"owner-session"}},"preflight":[{"rule":"dns_record_resolves","params":{"name":"@","type":"A"}}],"recovery":[{"hiccup":"The managed certificate stays in PROVISIONING","fix":"Check the domain's A/AAAA records resolve to the load balancer addresses on public resolvers, then wait.","source":"owner-session"}],"sources":["owner-session"]}],"outputs":[{"name":"GOOGLE_CLOUD_PROJECT","description":"Google Cloud project id","secret":false,"example_format":"<project-id>","from_step":"create-project"},{"name":"GOOGLE_CLOUD_REGION","description":"Region used for Cloud Run, Firestore and Artifact Registry","secret":false,"example_format":"europe-west2"}],"api_provisioning":{"available":"yes","notes":"Everything after billing can be done with gcloud / the official APIs; project creation and billing linking are human steps."}}}