From 6866cff1a273c23b51dcd51bcc3708fd540af10b Mon Sep 17 00:00:00 2001 From: chrischristiansen-glitch Date: Mon, 25 May 2026 14:05:22 +0200 Subject: [PATCH] docs: IAP-SETUP kartlegging av Cloud Run-tjenester 2026-05-25 --- docs/IAP-SETUP.md | 203 ++++++++++++++++++++++++++++------------------ 1 file changed, 122 insertions(+), 81 deletions(-) diff --git a/docs/IAP-SETUP.md b/docs/IAP-SETUP.md index f24f9cb..feb90e4 100644 --- a/docs/IAP-SETUP.md +++ b/docs/IAP-SETUP.md @@ -1,97 +1,138 @@ -> **STATUS (2026-05-25):** Ikke startet — Phase 5 scope. -> `opax.vauco.no` svarer `{"status":"ok"}` på `/health` uten IAP. -> IAP-oppsett starter når Phase 4 docs hardening er fullført. -> Neste ansvarlig: OPS · Gate: ingen (Phase 5 er neste roadmap-steg) +> **STATUS (2026-05-25):** IAP API aktivert (`iap.googleapis.com` ✅). Kartlegging av Cloud Run-tjenester fullført. +> OAuth-klient `Vauco OS Web App` (`357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com`) identifisert og klar for IAP-bruk. +> Beslutning: Fokuserer IAP-beskyttelse på `osvauco-agent` (OPAX-hub). `vauco-tui-bridge` vurderes separat. +> Neste steg: Opprett serverless NEG + backend service for valgt tjeneste. # Google Cloud IAP Setup Guide -This guide provides the `gcloud` commands to configure Identity-Aware Proxy (IAP) for the Vauco TUI Bridge, securing it so that only `user:chris.christiansen@vauco.no` can access it. +This guide configures Identity-Aware Proxy (IAP) for `opax.vauco.no`, restricting access to `user:chris.christiansen@vauco.no`. -## 1. Enable Required APIs +--- -First, enable the IAP API for your project. +## Kartlegging — Cloud Run-tjenester (2026-05-25) + +Live output fra `gcloud run services list --platform=managed --project=propane-will-491900-m5`: + +| Service | Region | URL | Sist deployet | +|---|---|---|---| +| `billing-auto-teardown` | us-central1 | https://billing-auto-teardown-357036551735.us-central1.run.app | 2026-05-23 | +| `jason-bot` | europe-north1 | https://jason-bot-357036551735.europe-north1.run.app | 2026-04-10 | +| `osvauco-agent` | us-central1 | https://osvauco-agent-357036551735.us-central1.run.app | 2026-05-24 | +| `vauco-tui-bridge` | europe-west1 | https://vauco-tui-bridge-357036551735.europe-west1.run.app | 2026-05-17 | + +**IAP-mål:** `osvauco-agent` (us-central1) — OPAX-hub, sist deployet, mest aktiv. + +**OAuth-klient klar:** +- Navn: `Vauco OS Web App` +- Client ID: `357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com` +- Client secret: lagret lokalt (ikke i repo) + +--- + +## Steg 1 — Aktiver IAP API ```bash -gcloud services enable iap.googleapis.com +gcloud services enable iap.googleapis.com --project=propane-will-491900-m5 ``` +✅ Fullført 2026-05-25. -## 2. Deploy the Service and Create a Load Balancer +--- -Deploy your Cloud Run service (if you haven't already using the `deploy_cloudrun.sh` script) and then set up a global external HTTPS load balancer that points to it. - -### Create a Serverless NEG -```bash -gcloud compute network-endpoint-groups create vauco-tui-bridge-neg - --region=europe-west1 - --network-endpoint-type=serverless - --cloud-run-service=vauco-tui-bridge -``` - -### Create a Backend Service -```bash -gcloud compute backend-services create vauco-tui-bridge-backend - --global -``` - -### Add the NEG to the Backend Service -```bash -gcloud compute backend-services add-backend vauco-tui-bridge-backend - --global - --network-endpoint-group=vauco-tui-bridge-neg - --network-endpoint-group-region=europe-west1 -``` - -### Create a URL Map -```bash -gcloud compute url-maps create vauco-tui-bridge-url-map - --default-service vauco-tui-bridge-backend -``` - -### Create a Target HTTPS Proxy -```bash -# You will need a managed SSL certificate for this step -gcloud compute ssl-certificates create vauco-tui-bridge-cert - --domains=your-domain.com # Replace with your actual domain - -gcloud compute target-https-proxies create vauco-tui-bridge-https-proxy - --url-map=vauco-tui-bridge-url-map - --ssl-certificates=vauco-tui-bridge-cert -``` - -### Create a Global Forwarding Rule (This creates the Load Balancer) -```bash -gcloud compute forwarding-rules create vauco-tui-bridge-forwarding-rule - --global - --target-https-proxy=vauco-tui-bridge-https-proxy - --ports=443 -``` - -## 3. Enable IAP on the Backend Service - -Now, enable IAP for the backend service you created. You will need your OAuth2 client ID and secret, which can be created in the Google Cloud Console under "APIs & Services" -> "Credentials". - -### Get the Backend Service ID -```bash -BACKEND_SERVICE_ID=$(gcloud compute backend-services describe vauco-tui-bridge-backend --global --format="value(id)") -``` - -### Enable IAP -```bash -gcloud iap web enable --resource-type=backend-service --service=vauco-tui-bridge-backend -``` - -## 4. Grant Access to the User - -Grant the `IAP-secured Web App User` role to `chris.christiansen@vauco.no`. +## Steg 2 — Opprett Serverless NEG for osvauco-agent ```bash -gcloud projects add-iam-policy-binding - --member="user:chris.christiansen@vauco.no" - --role="roles/iap.httpsResourceAccessor" +gcloud compute network-endpoint-groups create opax-neg \ + --region=us-central1 \ + --network-endpoint-type=serverless \ + --cloud-run-service=osvauco-agent \ + --project=propane-will-491900-m5 ``` -## 5. Verify Access +--- -- **Verify access for `chris.christiansen@vauco.no`**: Open a browser where you are logged in as `chris.christiansen@vauco.no` and navigate to the HTTPS URL of the load balancer. You should be able to access the bridge's root endpoint. +## Steg 3 — Opprett Backend Service -- **Verify access is denied for other accounts**: Open an incognito browser window or a browser where you are logged in with a different Google account. Navigate to the same URL. You should see a "You don't have access" message from Google, not the application. +```bash +gcloud compute backend-services create opax-backend \ + --global \ + --project=propane-will-491900-m5 + +gcloud compute backend-services add-backend opax-backend \ + --global \ + --network-endpoint-group=opax-neg \ + --network-endpoint-group-region=us-central1 \ + --project=propane-will-491900-m5 +``` + +--- + +## Steg 4 — URL Map + HTTPS Proxy + SSL-sertifikat + +```bash +gcloud compute url-maps create opax-url-map \ + --default-service opax-backend \ + --project=propane-will-491900-m5 + +gcloud compute ssl-certificates create opax-cert \ + --domains=opax.vauco.no \ + --project=propane-will-491900-m5 + +gcloud compute target-https-proxies create opax-https-proxy \ + --url-map=opax-url-map \ + --ssl-certificates=opax-cert \ + --project=propane-will-491900-m5 + +gcloud compute forwarding-rules create opax-forwarding-rule \ + --global \ + --target-https-proxy=opax-https-proxy \ + --ports=443 \ + --project=propane-will-491900-m5 +``` + +--- + +## Steg 5 — Aktiver IAP på Backend Service + +```bash +gcloud iap web enable \ + --resource-type=backend-service \ + --service=opax-backend \ + --oauth2-client-id=357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com \ + --oauth2-client-secret=DIN_CLIENT_SECRET \ + --project=propane-will-491900-m5 +``` + +> ⚠️ Erstatt `DIN_CLIENT_SECRET` med secret lagret lokalt. Aldri commit denne verdien. + +--- + +## Steg 6 — Gi tilgang til chris.christiansen@vauco.no + +```bash +gcloud projects add-iam-policy-binding propane-will-491900-m5 \ + --member="user:chris.christiansen@vauco.no" \ + --role="roles/iap.httpsResourceAccessor" +``` + +--- + +## Steg 7 — Verifiser + +```bash +# Sjekk at IAP er aktivert +gcloud iap web get-iam-policy \ + --resource-type=backend-service \ + --service=opax-backend \ + --project=propane-will-491900-m5 + +# Sjekk at opax.vauco.no svarer med IAP-redirect (ikke direkte JSON) +curl -I https://opax.vauco.no/health +# Forventet: HTTP 302 redirect til accounts.google.com +``` + +--- + +## vauco-tui-bridge — parkert til separat vurdering + +`vauco-tui-bridge` (europe-west1) har eksisterende NEG-referanser i tidligere versjoner av dette dokumentet. +IAP for denne tjenesten aktiveres i egen fase etter at `osvauco-agent`-IAP er verifisert.