> **STATUS (2026-05-25):** IAP API aktivert (`iap.googleapis.com` ✅). Kartlegging av Cloud Run-tjenester fullført.
> OAuth-klient `Vauco OS Web App` (`357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com`) identifisert og klar for IAP-bruk.
> Beslutning: Fokuserer IAP-beskyttelse på `osvauco-agent` (OPAX-hub). `vauco-tui-bridge` vurderes separat.
> Neste steg: Opprett serverless NEG + backend service for valgt tjeneste.

# Google Cloud IAP Setup Guide

This guide configures Identity-Aware Proxy (IAP) for `opax.vauco.no`, restricting access to `user:chris.christiansen@vauco.no`.

---

## Kartlegging — Cloud Run-tjenester (2026-05-25)

Live output fra `gcloud run services list --platform=managed --project=propane-will-491900-m5`:

| Service | Region | URL | Sist deployet |
|---|---|---|---|
| `billing-auto-teardown` | us-central1 | https://billing-auto-teardown-357036551735.us-central1.run.app | 2026-05-23 |
| `jason-bot` | europe-north1 | https://jason-bot-357036551735.europe-north1.run.app | 2026-04-10 |
| `osvauco-agent` | us-central1 | https://osvauco-agent-357036551735.us-central1.run.app | 2026-05-24 |
| `vauco-tui-bridge` | europe-west1 | https://vauco-tui-bridge-357036551735.europe-west1.run.app | 2026-05-17 |

**IAP-mål:** `osvauco-agent` (us-central1) — OPAX-hub, sist deployet, mest aktiv.

**OAuth-klient klar:**
- Navn: `Vauco OS Web App`
- Client ID: `357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com`
- Client secret: lagret lokalt (ikke i repo)

---

## Steg 1 — Aktiver IAP API

```bash
gcloud services enable iap.googleapis.com --project=propane-will-491900-m5
```
✅ Fullført 2026-05-25.

---

## Steg 2 — Opprett Serverless NEG for osvauco-agent

```bash
gcloud compute network-endpoint-groups create opax-neg \
  --region=us-central1 \
  --network-endpoint-type=serverless \
  --cloud-run-service=osvauco-agent \
  --project=propane-will-491900-m5
```

---

## Steg 3 — Opprett Backend Service

```bash
gcloud compute backend-services create opax-backend \
  --global \
  --project=propane-will-491900-m5

gcloud compute backend-services add-backend opax-backend \
  --global \
  --network-endpoint-group=opax-neg \
  --network-endpoint-group-region=us-central1 \
  --project=propane-will-491900-m5
```

---

## Steg 4 — URL Map + HTTPS Proxy + SSL-sertifikat

```bash
gcloud compute url-maps create opax-url-map \
  --default-service opax-backend \
  --project=propane-will-491900-m5

gcloud compute ssl-certificates create opax-cert \
  --domains=opax.vauco.no \
  --project=propane-will-491900-m5

gcloud compute target-https-proxies create opax-https-proxy \
  --url-map=opax-url-map \
  --ssl-certificates=opax-cert \
  --project=propane-will-491900-m5

gcloud compute forwarding-rules create opax-forwarding-rule \
  --global \
  --target-https-proxy=opax-https-proxy \
  --ports=443 \
  --project=propane-will-491900-m5
```

---

## Steg 5 — Aktiver IAP på Backend Service

```bash
gcloud iap web enable \
  --resource-type=backend-service \
  --service=opax-backend \
  --oauth2-client-id=357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com \
  --oauth2-client-secret=DIN_CLIENT_SECRET \
  --project=propane-will-491900-m5
```

> ⚠️ Erstatt `DIN_CLIENT_SECRET` med secret lagret lokalt. Aldri commit denne verdien.

---

## Steg 6 — Gi tilgang til chris.christiansen@vauco.no

```bash
gcloud projects add-iam-policy-binding propane-will-491900-m5 \
  --member="user:chris.christiansen@vauco.no" \
  --role="roles/iap.httpsResourceAccessor"
```

---

## Steg 7 — Verifiser

```bash
# Sjekk at IAP er aktivert
gcloud iap web get-iam-policy \
  --resource-type=backend-service \
  --service=opax-backend \
  --project=propane-will-491900-m5

# Sjekk at opax.vauco.no svarer med IAP-redirect (ikke direkte JSON)
curl -I https://opax.vauco.no/health
# Forventet: HTTP 302 redirect til accounts.google.com
```

---

## vauco-tui-bridge — parkert til separat vurdering

`vauco-tui-bridge` (europe-west1) har eksisterende NEG-referanser i tidligere versjoner av dette dokumentet.
IAP for denne tjenesten aktiveres i egen fase etter at `osvauco-agent`-IAP er verifisert.