verapli
Sign inJoin free
Menu

Guides · hosting · Popular APIs

Google Cloud project with Cloud Run, Firestore and a custom domain

Create a project under your organisation, link billing, enable APIs, create Firestore and Artifact Registry, fix Cloud Build permissions for source deploys, deploy to Cloud Run with Secret Manager, and put a global HTTPS load balancer with a Google-managed certificate in front for your domain.

Verified live 24 October 2026Last researched 24 October 2026 · Google · provider site

Do this with verapliJSON for agents

Who owns what

The project lives under the organisation; billing comes from a separate Cloud Billing account.

  • Google account personal owned by the person
  • Google Cloud organisation organisationoptional owned by the company · under Google accountProjects can also be created without an organisation; this entry was verified under one.
  • Cloud Billing account billing
  • Google Cloud project project · under Google Cloud organisation

Have ready

  • Payment card for the Cloud Billing account [1]Needed for: Link a billing account

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Create a project under your organisation

    Create the project in the console (or `gcloud projects create <id> --organization=<org-id>`). You press create.

    • Guided by hand
    • Human step: You press submit

    Where: https://console.cloud.google.com/projectcreate

  2. Enable the APIs

    Enable the services you need, e.g. `gcloud services enable run.googleapis.com cloudbuild.googleapis.com artifactregistry.googleapis.com firestore.googleapis.com secretmanager.googleapis.com compute.googleapis.com`.

    • Official API
    • After: Link a billing account

  3. Create the Firestore database

    Create a Firestore (Native mode) database in your region, e.g. `gcloud firestore databases create --location=europe-west2`.

    • Official API
    • After: Enable the APIs

  4. Create an Artifact Registry repository

    Create a Docker repository for your images, e.g. `gcloud artifacts repositories create <repo> --repository-format=docker --location=europe-west2`.

    • Official API
    • After: Enable the APIs

  5. Give the build service account the roles source builds need

    For `gcloud run deploy --source`, the default compute service account used by Cloud Build needs roles/artifactregistry.writer, roles/logging.logWriter and roles/storage.objectViewer.

    • Official API
    • After: Create an Artifact Registry repository
    If something goes wrong (1)
    • A source deploy fails with a permission error during the build: Grant the default compute service account artifactregistry.writer, logging.logWriter and storage.objectViewer, then redeploy. [1]

  6. Store secrets in Secret Manager

    Create one secret per value and grant roles/secretmanager.secretAccessor on each secret to the Cloud Run runtime service account (per-secret IAM, not project-wide).

    • Official API
    • After: Enable the APIs

  7. Deploy the Cloud Run service

    Deploy with `gcloud run deploy`. Use /health, not /healthz, for health checks: /healthz is reserved on Cloud Run. Note that `gcloud run services update --env-vars-file` replaces all plain env vars.

    • Official API
    • After: Give the build service account the roles source builds need, Store secrets in Secret Manager, Create the Firestore database
    If something goes wrong (2)
    • Requests to /healthz never reach your container: /healthz is reserved on Cloud Run; serve health checks on /health instead. [1]
    • Env vars disappeared after an update: --env-vars-file replaces every plain env var; put all of them in the file, or use --update-env-vars for single changes. [1]

  8. Put a global HTTPS load balancer in front for your domain

    Cloud Run domain mapping is not offered in europe-west2, so create a global external HTTPS load balancer with a serverless NEG pointing at the service, reserve static IPv4/IPv6 addresses, and attach a Google-managed certificate. Point DNS at the addresses (see namecheap/dns); the certificate provisions once DNS resolves.

    • Official API
    • After: Deploy the Cloud Run service
    People report
    Certificate provisioned after DNS resolved, from minutes up to about 60 minutes (first-hand, 2026-10-24) [1]
    If something goes wrong (1)
    • The managed certificate stays in PROVISIONING: Check the domain's A/AAAA records resolve to the load balancer addresses on public resolvers, then wait. [1]

What you end up with

Env varSecretFormatWhat it is
GOOGLE_CLOUD_PROJECTnot secret<project-id>Google Cloud project id
GOOGLE_CLOUD_REGIONnot secreteurope-west2Region used for Cloud Run, Firestore and Artifact Registry

For agents

The same entry as JSON: /api/v1/entries/google/cloud-project-run · requirements /api/v1/requirements/google/cloud-project-run · terms /api/v1/terms/google/cloud-project-run.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Google Cloud project with Cloud Run, Firestore and a custom domain, and how long will it take?"
  → tools/call requirements { "provider_id": "google/cloud-project-run" }

Sources

  1. verapli owner's live Google Cloud setup for verapli.com in europe-west2 (first-hand) Project under org; billing link with free-trial credit note; API enablement; Firestore; Artifact Registry; Cloud Build default compute service account roles for source builds; no Cloud Run domain mapping in europe-west2, so global external HTTPS LB + serverless NEG + Google-managed certificate (provisioned after DNS resolved, minutes up to about an hour); /healthz reserved on Cloud Run; --env-vars-file replaces all plain env vars; Secret Manager with per-secret IAM · accessed 24 October 2026 · first-hand

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Google is not affiliated with verapli.