139 lines
4.1 KiB
Markdown
139 lines
4.1 KiB
Markdown
> **STATUS (2026-05-25):** IAP API aktivert (`iap.googleapis.com` ✅). Kartlegging av Cloud Run-tjenester fullført.
|
|
> OAuth-klient `Vauco OS Web App` (`357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com`) identifisert og klar for IAP-bruk.
|
|
> Beslutning: Fokuserer IAP-beskyttelse på `osvauco-agent` (OPAX-hub). `vauco-tui-bridge` vurderes separat.
|
|
> Neste steg: Opprett serverless NEG + backend service for valgt tjeneste.
|
|
|
|
# Google Cloud IAP Setup Guide
|
|
|
|
This guide configures Identity-Aware Proxy (IAP) for `opax.vauco.no`, restricting access to `user:chris.christiansen@vauco.no`.
|
|
|
|
---
|
|
|
|
## Kartlegging — Cloud Run-tjenester (2026-05-25)
|
|
|
|
Live output fra `gcloud run services list --platform=managed --project=propane-will-491900-m5`:
|
|
|
|
| Service | Region | URL | Sist deployet |
|
|
|---|---|---|---|
|
|
| `billing-auto-teardown` | us-central1 | https://billing-auto-teardown-357036551735.us-central1.run.app | 2026-05-23 |
|
|
| `jason-bot` | europe-north1 | https://jason-bot-357036551735.europe-north1.run.app | 2026-04-10 |
|
|
| `osvauco-agent` | us-central1 | https://osvauco-agent-357036551735.us-central1.run.app | 2026-05-24 |
|
|
| `vauco-tui-bridge` | europe-west1 | https://vauco-tui-bridge-357036551735.europe-west1.run.app | 2026-05-17 |
|
|
|
|
**IAP-mål:** `osvauco-agent` (us-central1) — OPAX-hub, sist deployet, mest aktiv.
|
|
|
|
**OAuth-klient klar:**
|
|
- Navn: `Vauco OS Web App`
|
|
- Client ID: `357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com`
|
|
- Client secret: lagret lokalt (ikke i repo)
|
|
|
|
---
|
|
|
|
## Steg 1 — Aktiver IAP API
|
|
|
|
```bash
|
|
gcloud services enable iap.googleapis.com --project=propane-will-491900-m5
|
|
```
|
|
✅ Fullført 2026-05-25.
|
|
|
|
---
|
|
|
|
## Steg 2 — Opprett Serverless NEG for osvauco-agent
|
|
|
|
```bash
|
|
gcloud compute network-endpoint-groups create opax-neg \
|
|
--region=us-central1 \
|
|
--network-endpoint-type=serverless \
|
|
--cloud-run-service=osvauco-agent \
|
|
--project=propane-will-491900-m5
|
|
```
|
|
|
|
---
|
|
|
|
## Steg 3 — Opprett Backend Service
|
|
|
|
```bash
|
|
gcloud compute backend-services create opax-backend \
|
|
--global \
|
|
--project=propane-will-491900-m5
|
|
|
|
gcloud compute backend-services add-backend opax-backend \
|
|
--global \
|
|
--network-endpoint-group=opax-neg \
|
|
--network-endpoint-group-region=us-central1 \
|
|
--project=propane-will-491900-m5
|
|
```
|
|
|
|
---
|
|
|
|
## Steg 4 — URL Map + HTTPS Proxy + SSL-sertifikat
|
|
|
|
```bash
|
|
gcloud compute url-maps create opax-url-map \
|
|
--default-service opax-backend \
|
|
--project=propane-will-491900-m5
|
|
|
|
gcloud compute ssl-certificates create opax-cert \
|
|
--domains=opax.vauco.no \
|
|
--project=propane-will-491900-m5
|
|
|
|
gcloud compute target-https-proxies create opax-https-proxy \
|
|
--url-map=opax-url-map \
|
|
--ssl-certificates=opax-cert \
|
|
--project=propane-will-491900-m5
|
|
|
|
gcloud compute forwarding-rules create opax-forwarding-rule \
|
|
--global \
|
|
--target-https-proxy=opax-https-proxy \
|
|
--ports=443 \
|
|
--project=propane-will-491900-m5
|
|
```
|
|
|
|
---
|
|
|
|
## Steg 5 — Aktiver IAP på Backend Service
|
|
|
|
```bash
|
|
gcloud iap web enable \
|
|
--resource-type=backend-service \
|
|
--service=opax-backend \
|
|
--oauth2-client-id=357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com \
|
|
--oauth2-client-secret=DIN_CLIENT_SECRET \
|
|
--project=propane-will-491900-m5
|
|
```
|
|
|
|
> ⚠️ Erstatt `DIN_CLIENT_SECRET` med secret lagret lokalt. Aldri commit denne verdien.
|
|
|
|
---
|
|
|
|
## Steg 6 — Gi tilgang til chris.christiansen@vauco.no
|
|
|
|
```bash
|
|
gcloud projects add-iam-policy-binding propane-will-491900-m5 \
|
|
--member="user:chris.christiansen@vauco.no" \
|
|
--role="roles/iap.httpsResourceAccessor"
|
|
```
|
|
|
|
---
|
|
|
|
## Steg 7 — Verifiser
|
|
|
|
```bash
|
|
# Sjekk at IAP er aktivert
|
|
gcloud iap web get-iam-policy \
|
|
--resource-type=backend-service \
|
|
--service=opax-backend \
|
|
--project=propane-will-491900-m5
|
|
|
|
# Sjekk at opax.vauco.no svarer med IAP-redirect (ikke direkte JSON)
|
|
curl -I https://opax.vauco.no/health
|
|
# Forventet: HTTP 302 redirect til accounts.google.com
|
|
```
|
|
|
|
---
|
|
|
|
## vauco-tui-bridge — parkert til separat vurdering
|
|
|
|
`vauco-tui-bridge` (europe-west1) har eksisterende NEG-referanser i tidligere versjoner av dette dokumentet.
|
|
IAP for denne tjenesten aktiveres i egen fase etter at `osvauco-agent`-IAP er verifisert.
|