{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"google/cloud-project-run","name":"Google Cloud project with Cloud Run, Firestore and a custom domain","vendor":"Google","status":"verified","last_verified":"2026-10-24","last_researched":"2026-10-24","summary":"Create a project under your organisation, link billing, enable APIs, create Firestore and Artifact Registry, fix Cloud Build permissions for source deploys, deploy to Cloud Run with Secret Manager, and put a global HTTPS load balancer with a Google-managed certificate in front for your domain.","account_model":{"summary":"The project lives under the organisation; billing comes from a separate Cloud Billing account.","accounts":[{"name":"Google account","kind":"personal","owned_by":"the person","required":true},{"name":"Google Cloud organisation","kind":"organisation","owned_by":"the company","parent":"Google account","required":false,"note":"Projects can also be created without an organisation; this entry was verified under one."},{"name":"Cloud Billing account","kind":"billing","required":true},{"name":"Google Cloud project","kind":"project","parent":"Google Cloud organisation","required":true}]},"prerequisites":[],"identity_requires":[],"have_ready":[{"kind":"payment_card","description":"Payment card for the Cloud Billing account","why":null,"needed_for":["link-billing"],"auto_check":"none","source_url":"https://console.cloud.google.com/"}],"steps":[{"id":"create-project","title":"Create a project under your organisation","summary":"Create the project in the console (or `gcloud projects create <id> --organization=<org-id>`). You press create.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":[],"optional":false,"url":"https://console.cloud.google.com/projectcreate","lead_time":null,"preflight":[],"captures":null},{"id":"link-billing","title":"Link a billing account","summary":"Link the project to a Cloud Billing account. A new billing account may show free-trial credit; check the amount and expiry on the billing page [to verify].","route":"guided","gate":"human_payment","human_only":true,"gate_label":"You add payment details","depends_on":["create-project"],"optional":false,"url":"https://console.cloud.google.com/billing","lead_time":null,"preflight":[],"captures":null},{"id":"enable-apis","title":"Enable the APIs","summary":"Enable the services you need, e.g. `gcloud services enable run.googleapis.com cloudbuild.googleapis.com artifactregistry.googleapis.com firestore.googleapis.com secretmanager.googleapis.com compute.googleapis.com`.","route":"api","gate":"none","human_only":false,"gate_label":null,"depends_on":["link-billing"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"firestore","title":"Create the Firestore database","summary":"Create a Firestore (Native mode) database in your region, e.g. `gcloud firestore databases create --location=europe-west2`.","route":"api","gate":"none","human_only":false,"gate_label":null,"depends_on":["enable-apis"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"artifact-registry","title":"Create an Artifact Registry repository","summary":"Create a Docker repository for your images, e.g. `gcloud artifacts repositories create <repo> --repository-format=docker --location=europe-west2`.","route":"api","gate":"none","human_only":false,"gate_label":null,"depends_on":["enable-apis"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"build-permissions","title":"Give the build service account the roles source builds need","summary":"For `gcloud run deploy --source`, the default compute service account used by Cloud Build needs roles/artifactregistry.writer, roles/logging.logWriter and roles/storage.objectViewer.","route":"api","gate":"none","human_only":false,"gate_label":null,"depends_on":["artifact-registry"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"secrets","title":"Store secrets in Secret Manager","summary":"Create one secret per value and grant roles/secretmanager.secretAccessor on each secret to the Cloud Run runtime service account (per-secret IAM, not project-wide).","route":"api","gate":"none","human_only":false,"gate_label":null,"depends_on":["enable-apis"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"deploy-run","title":"Deploy the Cloud Run service","summary":"Deploy with `gcloud run deploy`. Use /health, not /healthz, for health checks: /healthz is reserved on Cloud Run. Note that `gcloud run services update --env-vars-file` replaces all plain env vars.","route":"api","gate":"none","human_only":false,"gate_label":null,"depends_on":["build-permissions","secrets","firestore"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"custom-domain","title":"Put a global HTTPS load balancer in front for your domain","summary":"Cloud Run domain mapping is not offered in europe-west2, so create a global external HTTPS load balancer with a serverless NEG pointing at the service, reserve static IPv4/IPv6 addresses, and attach a Google-managed certificate. Point DNS at the addresses (see namecheap/dns); the certificate provisions once DNS resolves.","route":"api","gate":"none","human_only":false,"gate_label":null,"depends_on":["deploy-run"],"optional":false,"url":null,"lead_time":{"official":null,"reported":{"text":"Certificate provisioned after DNS resolved, from minutes up to about 60 minutes (first-hand, 2026-10-24)","source_url":"https://console.cloud.google.com/","source_title":"verapli owner's live Google Cloud setup for verapli.com in europe-west2 (first-hand)"},"typical_minutes":null},"preflight":["dns_record_resolves"],"captures":null}],"gates":[{"step":"create-project","gate":"human_submit","label":"You press submit"},{"step":"link-billing","gate":"human_payment","label":"You add payment details"}],"lead_times":[{"step":"custom-domain","what":"Put a global HTTPS load balancer in front for your domain","official":null,"reported":{"text":"Certificate provisioned after DNS resolved, from minutes up to about 60 minutes (first-hand, 2026-10-24)","source_url":"https://console.cloud.google.com/","source_title":"verapli owner's live Google Cloud setup for verapli.com in europe-west2 (first-hand)"}}],"outputs":[{"name":"GOOGLE_CLOUD_PROJECT","description":"Google Cloud project id","secret":false,"example_format":"<project-id>","environments":null},{"name":"GOOGLE_CLOUD_REGION","description":"Region used for Cloud Run, Firestore and Artifact Registry","secret":false,"example_format":"europe-west2","environments":null}],"renewals":[],"estimated_minutes":null,"guide_url":"https://verapli.com/guides/google/cloud-project-run"}