Edit production guide to match requirements for IAM. - #102
Conversation
apognu
added
documentation
|
|
||
| This service account **must** have the following roles or permissions: | ||
|
|
||
| - Role: `Storage Object User` on the configured buckets to store and retrieve blobs |
There was a problem hiding this comment.
I assume that this is enough, but I would like to check before we commit to it.
| 2. **Configure Authentication** | ||
|
|
||
| - Enable Firebase Authentication | ||
| - Go to Project overview → project settings → Service Accounts → Generate new private key |
There was a problem hiding this comment.
We do not need the Firebase admin private key. It is actually against best practice to do it that way, so this goes.
2c9d31e to
f684a95
Compare
| 2. **API URL Configuration** | ||
|
|
||
| - Frontend needs two API URLs configured: | ||
| - `MARBLE_API_URL_CLIENT`: URL for browser requests (public URL) |
There was a problem hiding this comment.
I am preparing the path the when the whole /config PR will be merged. At that point, technically, the frontend will only require:
- ENV
- NODE_ENV
- MARBLE_API_URL_SERVER
- SESSION_SECRET
- + anything that is secret
| - Service account: | ||
| - Check that the detected Google Cloud project and service account match your environment | ||
|
|
||
| - ⚠️ Backend service will fail to start without accessible Firebase service account key |
There was a problem hiding this comment.
Same as above, this assumed the Firebase admin SA.
| - `FIREBASE_AUTH_DOMAIN`: Auth domain from Firebase settings | ||
| - `FIREBASE_APP_ID`: Application ID from Firebase Console | ||
| - If you plan on using Single-Sign On (SSO) with Firebase (to delegate authentication to another Identity Provider), you will need to configure the following directives: | ||
| - `FIREBASE_AUTH_DOMAIN`: Auth domain from Firebase settings |
There was a problem hiding this comment.
Removes app ID, which is not required at all, and moved the auth domain as optional, since it's only used for SSO.
f684a95 to
c0a169a
Compare
c0a169a to
32b0710
Compare
|
@apognu ok time to take this PR out of the dustbin. |
2 participants
I'll add inline comments to rationalize my changes.