Edit production guide to match requirements for IAM. #102
Conversation
apognu
added
documentation
|
|
||
| This service account **must** have the following roles or permissions: | ||
|
|
||
| - Role: `Storage Object User` on the configured buckets to store and retrieve blobs |
There was a problem hiding this comment.
I assume that this is enough, but I would like to check before we commit to it.
| 2. **Configure Authentication** | ||
|
|
||
| - Enable Firebase Authentication | ||
| - Go to Project overview → project settings → Service Accounts → Generate new private key |
There was a problem hiding this comment.
We do not need the Firebase admin private key. It is actually against best practice to do it that way, so this goes.
apognu
force-pushed
the
feat/gcp-iam-config
branch
from
2c9d31e to
f684a95
Compare
| 2. **API URL Configuration** | ||
|
|
||
| - Frontend needs two API URLs configured: | ||
| - `MARBLE_API_URL_CLIENT`: URL for browser requests (public URL) |
There was a problem hiding this comment.
I am preparing the path the when the whole /config PR will be merged. At that point, technically, the frontend will only require:
- ENV
- NODE_ENV
- MARBLE_API_URL_SERVER
- SESSION_SECRET
- + anything that is secret
| - Service account: | ||
| - Check that the detected Google Cloud project and service account match your environment | ||
|
|
||
| - ⚠️ Backend service will fail to start without accessible Firebase service account key |
There was a problem hiding this comment.
Same as above, this assumed the Firebase admin SA.
| - `FIREBASE_AUTH_DOMAIN`: Auth domain from Firebase settings | ||
| - `FIREBASE_APP_ID`: Application ID from Firebase Console | ||
| - If you plan on using Single-Sign On (SSO) with Firebase (to delegate authentication to another Identity Provider), you will need to configure the following directives: | ||
| - `FIREBASE_AUTH_DOMAIN`: Auth domain from Firebase settings |
There was a problem hiding this comment.
Removes app ID, which is not required at all, and moved the auth domain as optional, since it's only used for SSO.
apognu
force-pushed
the
feat/gcp-iam-config
branch
from
f684a95 to
c0a169a
Compare
apognu
force-pushed
the
feat/gcp-iam-config
branch
from
c0a169a to
32b0710
Compare
|
@apognu ok time to take this PR out of the dustbin. |
I'll add inline comments to rationalize my changes.