chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity
6866cff1a2
OSVauco/docs/IAP-SETUP.md

4.1 KiB
Raw Blame History

STATUS (2026-05-25): IAP API aktivert (iap.googleapis.com ✅). Kartlegging av Cloud Run-tjenester fullført. OAuth-klient Vauco OS Web App (357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com) identifisert og klar for IAP-bruk. Beslutning: Fokuserer IAP-beskyttelse på osvauco-agent (OPAX-hub). vauco-tui-bridge vurderes separat. Neste steg: Opprett serverless NEG + backend service for valgt tjeneste.

Google Cloud IAP Setup Guide

This guide configures Identity-Aware Proxy (IAP) for opax.vauco.no, restricting access to user:chris.christiansen@vauco.no.

Kartlegging — Cloud Run-tjenester (2026-05-25)

Live output fra gcloud run services list --platform=managed --project=propane-will-491900-m5:

Service Region URL Sist deployet
billing-auto-teardown us-central1 https://billing-auto-teardown-357036551735.us-central1.run.app 2026-05-23
jason-bot europe-north1 https://jason-bot-357036551735.europe-north1.run.app 2026-04-10
osvauco-agent us-central1 https://osvauco-agent-357036551735.us-central1.run.app 2026-05-24
vauco-tui-bridge europe-west1 https://vauco-tui-bridge-357036551735.europe-west1.run.app 2026-05-17

IAP-mål: osvauco-agent (us-central1) — OPAX-hub, sist deployet, mest aktiv.

OAuth-klient klar:

  • Navn: Vauco OS Web App
  • Client ID: 357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com
  • Client secret: lagret lokalt (ikke i repo)

Steg 1 — Aktiver IAP API

gcloud services enable iap.googleapis.com --project=propane-will-491900-m5

✅ Fullført 2026-05-25.

Steg 2 — Opprett Serverless NEG for osvauco-agent

gcloud compute network-endpoint-groups create opax-neg \
  --region=us-central1 \
  --network-endpoint-type=serverless \
  --cloud-run-service=osvauco-agent \
  --project=propane-will-491900-m5

Steg 3 — Opprett Backend Service

gcloud compute backend-services create opax-backend \
  --global \
  --project=propane-will-491900-m5

gcloud compute backend-services add-backend opax-backend \
  --global \
  --network-endpoint-group=opax-neg \
  --network-endpoint-group-region=us-central1 \
  --project=propane-will-491900-m5

Steg 4 — URL Map + HTTPS Proxy + SSL-sertifikat

gcloud compute url-maps create opax-url-map \
  --default-service opax-backend \
  --project=propane-will-491900-m5

gcloud compute ssl-certificates create opax-cert \
  --domains=opax.vauco.no \
  --project=propane-will-491900-m5

gcloud compute target-https-proxies create opax-https-proxy \
  --url-map=opax-url-map \
  --ssl-certificates=opax-cert \
  --project=propane-will-491900-m5

gcloud compute forwarding-rules create opax-forwarding-rule \
  --global \
  --target-https-proxy=opax-https-proxy \
  --ports=443 \
  --project=propane-will-491900-m5

Steg 5 — Aktiver IAP på Backend Service

gcloud iap web enable \
  --resource-type=backend-service \
  --service=opax-backend \
  --oauth2-client-id=357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com \
  --oauth2-client-secret=DIN_CLIENT_SECRET \
  --project=propane-will-491900-m5

⚠️ Erstatt DIN_CLIENT_SECRET med secret lagret lokalt. Aldri commit denne verdien.

Steg 6 — Gi tilgang til chris.christiansen@vauco.no

gcloud projects add-iam-policy-binding propane-will-491900-m5 \
  --member="user:chris.christiansen@vauco.no" \
  --role="roles/iap.httpsResourceAccessor"

Steg 7 — Verifiser

# Sjekk at IAP er aktivert
gcloud iap web get-iam-policy \
  --resource-type=backend-service \
  --service=opax-backend \
  --project=propane-will-491900-m5

# Sjekk at opax.vauco.no svarer med IAP-redirect (ikke direkte JSON)
curl -I https://opax.vauco.no/health
# Forventet: HTTP 302 redirect til accounts.google.com

vauco-tui-bridge — parkert til separat vurdering

vauco-tui-bridge (europe-west1) har eksisterende NEG-referanser i tidligere versjoner av dette dokumentet. IAP for denne tjenesten aktiveres i egen fase etter at osvauco-agent-IAP er verifisert.