Skip to content

GCP_SETUP.md

Latest commit

 

History

History
213 lines (153 loc) · 4.51 KB

GCP_SETUP.md

File metadata and controls

213 lines (153 loc) · 4.51 KB

Google Cloud Platform Setup Guide

How to set up GCP for Pill Reminder.

Step 1: Create Project

  1. Go to console.cloud.google.com
  2. Click project dropdown > "New Project"
  3. Name it (e.g., pill-reminder)
  4. Note the Project ID (you'll need this)

Step 2: Enable Billing

  1. Go to Billing
  2. Link a billing account to your project
  3. You get $300 free credits for new accounts

Step 3: Enable APIs

Run this command or enable manually in Console:

gcloud services enable \
    cloudfunctions.googleapis.com \
    cloudscheduler.googleapis.com \
    cloudtasks.googleapis.com \
    secretmanager.googleapis.com \
    storage.googleapis.com \
    cloudbuild.googleapis.com

Or manually:

  1. Go to APIs & Services > Library
  2. Search and enable each:
    • Cloud Functions API
    • Cloud Scheduler API
    • Cloud Tasks API
    • Secret Manager API
    • Cloud Storage API
    • Cloud Build API

Step 4: Install gcloud CLI

macOS

brew install google-cloud-sdk

Windows

Download from cloud.google.com/sdk/docs/install

Linux

curl https://sdk.cloud.google.com | bash
exec -l $SHELL

Initialize

gcloud init
gcloud auth login
gcloud config set project YOUR_PROJECT_ID

Step 5: Set Up Service Account (For Sheets)

If you want Google Sheets logging:

Create Service Account

# Create account
gcloud iam service-accounts create sheets-writer \
    --display-name="Sheets Writer"

# Get email
SA_EMAIL=$(gcloud iam service-accounts list \
    --filter="displayName:Sheets Writer" \
    --format='value(email)')

echo "Service account: $SA_EMAIL"

Create Key

gcloud iam service-accounts keys create service-account.json \
    --iam-account=$SA_EMAIL

Upload to Secret Manager

gcloud secrets create google-sheets-creds \
    --data-file=service-account.json

# Delete local file
rm service-account.json

Grant Access

# Get the default compute service account
COMPUTE_SA=$(gcloud iam service-accounts list \
    --filter="displayName:Default compute service account" \
    --format='value(email)')

# Grant secret access
gcloud secrets add-iam-policy-binding google-sheets-creds \
    --member="serviceAccount:$COMPUTE_SA" \
    --role="roles/secretmanager.secretAccessor"

Step 6: Create Cloud Tasks Queue

gcloud tasks queues create pill-retries --location=us-central1

Step 7: Set Up Environment

# Add to .env
GCP_PROJECT_ID=your-project-id
GCP_REGION=us-central1

Free Tier Limits

GCP has a generous free tier:

Service Free Tier Pill Reminder Usage
Cloud Functions 2M invocations/month ~200/month
Cloud Scheduler 3 jobs 4 jobs ($0.30 extra)
Cloud Tasks 1M operations/month ~100/month
Cloud Storage 5 GB <1 MB
Secret Manager 6 active versions 1

Expected cost: ~$0.10-0.40/month (mostly Cloud Scheduler)

Security Best Practices

1. Least Privilege

Functions only need specific permissions:

  • storage.objects.get - Read audio files
  • cloudtasks.tasks.create - Schedule retries
  • secretmanager.versions.access - Read Sheets credentials

2. Secret Management

Never hardcode secrets. Use:

  • Environment variables (set in deploy.sh)
  • Secret Manager for credentials

3. HTTPS Only

All Cloud Functions automatically use HTTPS.

4. Audit Logging

Enable Cloud Audit Logs to track who does what:

  1. Go to IAM & Admin > Audit Logs
  2. Enable for Cloud Functions

Troubleshooting

"Permission denied" errors

# Check current project
gcloud config list project

# Check authentication
gcloud auth list

# Re-authenticate if needed
gcloud auth login

Cloud Functions deploy fails

  1. Check Cloud Build API is enabled
  2. Check you have Editor role on project
  3. View build logs in Cloud Console

Cloud Scheduler not triggering

  1. Verify timezone is correct
  2. Check job is not paused
  3. View execution logs in Cloud Console

Secret Manager access denied

# Grant access to function's service account
gcloud secrets add-iam-policy-binding google-sheets-creds \
    --member="serviceAccount:YOUR_PROJECT_ID@appspot.gserviceaccount.com" \
    --role="roles/secretmanager.secretAccessor"

Cleanup / Delete Project

If you want to stop all charges:

# Delete entire project (WARNING: irreversible)
gcloud projects delete YOUR_PROJECT_ID

# Or delete individual resources (see SETUP.md > Uninstalling)