98 lines
3.4 KiB
Markdown
98 lines
3.4 KiB
Markdown
> **STATUS (2026-05-25):** Ikke startet — Phase 5 scope.
|
|
> `opax.vauco.no` svarer `{"status":"ok"}` på `/health` uten IAP.
|
|
> IAP-oppsett starter når Phase 4 docs hardening er fullført.
|
|
> Neste ansvarlig: OPS · Gate: ingen (Phase 5 er neste roadmap-steg)
|
|
|
|
# Google Cloud IAP Setup Guide
|
|
|
|
This guide provides the `gcloud` commands to configure Identity-Aware Proxy (IAP) for the Vauco TUI Bridge, securing it so that only `user:chris.christiansen@vauco.no` can access it.
|
|
|
|
## 1. Enable Required APIs
|
|
|
|
First, enable the IAP API for your project.
|
|
|
|
```bash
|
|
gcloud services enable iap.googleapis.com
|
|
```
|
|
|
|
## 2. Deploy the Service and Create a Load Balancer
|
|
|
|
Deploy your Cloud Run service (if you haven't already using the `deploy_cloudrun.sh` script) and then set up a global external HTTPS load balancer that points to it.
|
|
|
|
### Create a Serverless NEG
|
|
```bash
|
|
gcloud compute network-endpoint-groups create vauco-tui-bridge-neg
|
|
--region=europe-west1
|
|
--network-endpoint-type=serverless
|
|
--cloud-run-service=vauco-tui-bridge
|
|
```
|
|
|
|
### Create a Backend Service
|
|
```bash
|
|
gcloud compute backend-services create vauco-tui-bridge-backend
|
|
--global
|
|
```
|
|
|
|
### Add the NEG to the Backend Service
|
|
```bash
|
|
gcloud compute backend-services add-backend vauco-tui-bridge-backend
|
|
--global
|
|
--network-endpoint-group=vauco-tui-bridge-neg
|
|
--network-endpoint-group-region=europe-west1
|
|
```
|
|
|
|
### Create a URL Map
|
|
```bash
|
|
gcloud compute url-maps create vauco-tui-bridge-url-map
|
|
--default-service vauco-tui-bridge-backend
|
|
```
|
|
|
|
### Create a Target HTTPS Proxy
|
|
```bash
|
|
# You will need a managed SSL certificate for this step
|
|
gcloud compute ssl-certificates create vauco-tui-bridge-cert
|
|
--domains=your-domain.com # Replace with your actual domain
|
|
|
|
gcloud compute target-https-proxies create vauco-tui-bridge-https-proxy
|
|
--url-map=vauco-tui-bridge-url-map
|
|
--ssl-certificates=vauco-tui-bridge-cert
|
|
```
|
|
|
|
### Create a Global Forwarding Rule (This creates the Load Balancer)
|
|
```bash
|
|
gcloud compute forwarding-rules create vauco-tui-bridge-forwarding-rule
|
|
--global
|
|
--target-https-proxy=vauco-tui-bridge-https-proxy
|
|
--ports=443
|
|
```
|
|
|
|
## 3. Enable IAP on the Backend Service
|
|
|
|
Now, enable IAP for the backend service you created. You will need your OAuth2 client ID and secret, which can be created in the Google Cloud Console under "APIs & Services" -> "Credentials".
|
|
|
|
### Get the Backend Service ID
|
|
```bash
|
|
BACKEND_SERVICE_ID=$(gcloud compute backend-services describe vauco-tui-bridge-backend --global --format="value(id)")
|
|
```
|
|
|
|
### Enable IAP
|
|
```bash
|
|
gcloud iap web enable --resource-type=backend-service --service=vauco-tui-bridge-backend
|
|
```
|
|
|
|
## 4. Grant Access to the User
|
|
|
|
Grant the `IAP-secured Web App User` role to `chris.christiansen@vauco.no`.
|
|
|
|
```bash
|
|
gcloud projects add-iam-policy-binding <YOUR_PROJECT_ID>
|
|
--member="user:chris.christiansen@vauco.no"
|
|
--role="roles/iap.httpsResourceAccessor"
|
|
```
|
|
|
|
## 5. Verify Access
|
|
|
|
- **Verify access for `chris.christiansen@vauco.no`**: Open a browser where you are logged in as `chris.christiansen@vauco.no` and navigate to the HTTPS URL of the load balancer. You should be able to access the bridge's root endpoint.
|
|
|
|
- **Verify access is denied for other accounts**: Open an incognito browser window or a browser where you are logged in with a different Google account. Navigate to the same URL. You should see a "You don't have access" message from Google, not the application.
|