diff --git a/docs/images/self-hosting/guides/google-cloud-run/cloud-run-container-image.png b/docs/images/self-hosting/reference-architectures/google-cloud-run/cloud-run-container-image.png similarity index 100% rename from docs/images/self-hosting/guides/google-cloud-run/cloud-run-container-image.png rename to docs/images/self-hosting/reference-architectures/google-cloud-run/cloud-run-container-image.png diff --git a/docs/images/self-hosting/guides/google-cloud-run/container-env-vars.png b/docs/images/self-hosting/reference-architectures/google-cloud-run/container-env-vars.png similarity index 100% rename from docs/images/self-hosting/guides/google-cloud-run/container-env-vars.png rename to docs/images/self-hosting/reference-architectures/google-cloud-run/container-env-vars.png diff --git a/docs/images/self-hosting/reference-architectures/google-cloud-run/container-network-configuration.png b/docs/images/self-hosting/reference-architectures/google-cloud-run/container-network-configuration.png new file mode 100644 index 000000000..9a8ae13cb Binary files /dev/null and b/docs/images/self-hosting/reference-architectures/google-cloud-run/container-network-configuration.png differ diff --git a/docs/self-hosting/guides/google-cloud-run.mdx b/docs/self-hosting/guides/google-cloud-run.mdx deleted file mode 100644 index f3c82cb8f..000000000 --- a/docs/self-hosting/guides/google-cloud-run.mdx +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Google Cloud Run" -description: "Learn how to deploy Infisical to Google Cloud Run." ---- - -This guide will provide step by step instructions on how to self-host Infisical using Cloud Run. - -## Configuration - - - - Visit [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) and select a version of Infisical image you would like to deploy. - Then paste the url of the specific Infisical Docker image you would like to use within the `Container image URL` field. - - ![Cloud Run container image settings UI](/images/self-hosting/guides/google-cloud-run/cloud-run-container-image.png) - - Remember to replace `` with the docker image tag of your choice. - - - For a minimal installation of Infisical, you must configure `ENCRYPTION_KEY`, `AUTH_SECRET`, `DB_CONNECTION_URI`, `SITE_URL`, and `REDIS_URL`. [View all available configurations](/self-hosting/configuration/envars). - - You will want to setup Postgres and Redis within Google Cloud Platform to connect to Infisical. - - Once you have added the required environment variables to the `Environment Variables` section within Cloud Run, - create the container to get Infisical up and running. - - ![Cloud Run container environment variables settings UI](/images/self-hosting/guides/google-cloud-run/container-env-vars.png) - - - The above environment variable values are only to be used as an example and should not be used in production - - - \ No newline at end of file diff --git a/docs/self-hosting/reference-architectures/google-cloud-run.mdx b/docs/self-hosting/reference-architectures/google-cloud-run.mdx new file mode 100644 index 000000000..b06bf36a7 --- /dev/null +++ b/docs/self-hosting/reference-architectures/google-cloud-run.mdx @@ -0,0 +1,111 @@ +--- +title: "Google Cloud Run" +description: "Reference architecture for self-hosting Infisical on Google Cloud Run." +--- + +## Overview +This guide outlines a reference architecture for deploying Infisical in a self-hosted configuration using Google Cloud Run. +It is intended to provide a scalable, secure, and production-ready baseline for organizations choosing Google Cloud Platform (GCP) as their infrastructure provider. + +## Core Components + +- **Cloud Run:** Infisical backend and frontend services are containerized and deployed as fully managed Cloud Run services. + +- **Cloud SQL:** Infisical uses Postgres as it's persistence layer. As such, Cloud SQL for PostgresSQL is used. + +- **MemoryStore for Redis:** To enhance performance, Infisical requires Redis. + +## Securing Infisical's root credential + +- **Secrets Manager:** To secure Infisical’s root credentials (database connection string, encryption key, etc), +we highly recommend that you use Google Secrets Manager and only allow the tasks running Infisical to access them. + +## High Availability and Scalability + +This architecture leverages Google Cloud's managed services to achieve high availability and scalability out of the box: + +**Cloud Run:** + +- Automatically scales the number of container instances up or down based on incoming request volume. +- Supports rapid scaling during traffic spikes, ensuring low latency. +- Configurable minimum and maximum instances to handle baseline and peak loads. + +**Cloud SQL:** + +- Provides high availability configurations (regional instances with automatic failover) to ensure database uptime. +- Automated backups, point-in-time recovery, and maintenance. + +**MemoryStore:** + +- Offers highly available Redis configurations with replication. +- Fully managed with automatic scaling and patching. + +**Cloud Load Balancer:** + +- Distributes user traffic across available Cloud Run instances. +- Provides SSL termination, global load balancing, and health checks. + + + **Note:** To further improve performance and availability, consider enabling multi-region deployment strategies, + regional VPC Connectors, and database replicas for read-heavy workloads. + + +## Configuration + + + + **Cloud SQL (PostgreSQL):** + - Create a Cloud SQL instance. + - Under `Zonal availability`, select the `Multiple zones` option to ensure High Availability. + - Configure private IP access. + + **MemoryStore (Redis):** + - Deploy a Redis instance. + - Configure VPC access. + + + + Visit [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) and select a version of Infisical image you would like to deploy. + Then, within Cloud Run, paste the url of the specific Infisical Docker image you would like to use within the `Container image URL` field. + + ![Cloud Run container image settings UI](/images/self-hosting/reference-architectures/google-cloud-run/cloud-run-container-image.png) + + Remember to replace `` with the docker image tag of your choice. + + + For a minimal installation of Infisical, you must configure `ENCRYPTION_KEY`, `AUTH_SECRET`, `DB_CONNECTION_URI`, `SITE_URL`, and `REDIS_URL`. [View all available configurations](/self-hosting/configuration/envars). + + You will want to setup Postgres and Redis within Google Cloud Platform to connect to Infisical. + + Once you have added the required environment variables to the `Environment Variables` section within Cloud Run, + create the container to get Infisical up and running. + + ![Cloud Run container environment variables settings UI](/images/self-hosting/reference-architectures/google-cloud-run/container-env-vars.png) + + + The above environment variable values are only to be used as an example and should not be used in production + + + + + + Enable `Connect to a VPC for outbound traffic`: This enables the service to talk to private resources (e.g., a Cloud SQL database, Redis instance on a private IP) inside your Google Cloud VPC network. + + Select `Send traffic directly to a VPC`: It gives lower latency and better performance, but uses more IPs from the subnet. + + + Your Cloud Run revision must be in the same VPC network + + + ![Cloud Run container network settings UI](/images/self-hosting/reference-architectures/google-cloud-run/container-network-configuration.png) + + Once the container is running, verify the installation by opening your web browser and navigating to the site url. + + + + +## Summary + +Self-hosting Infisical on Google Cloud Run enables a highly scalable and secure deployment without managing infrastructure manually. + Using GCP-managed services like Cloud SQL and MemoryStore, combined with Cloud Run's serverless capabilities, organizations can quickly + deploy Infisical with minimal operational overhead while maintaining enterprise-grade security and performance. \ No newline at end of file