wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-07-05 05:13:54 +02:00
Code Issues Projects Releases Wiki Activity
algo/docs/cloud-gce.md
Bruno Tavares 54a91447bf Add documentation on how to setup GCE accounts (#1164) 
* Add documentation on how to setup GCE accounts

This commit adds the steps needed to create a credential with the needed access on Google Cloud Platform to be able to successfully create a new algo VPN.

Related to:
- https://github.com/trailofbits/algo/issues/682
- https://github.com/trailofbits/algo/issues/658

* Adds links on main README to GCP

* Adds link to Ansible documentation

* Update cloud-gce.md
2018-10-28 09:35:43 +03:00

1.8 KiB
Raw Blame History

Google Cloud Platform setup

Follow the installation instructions to have the CLI commands to interact with Google.

After creating an account and installing, login in on your account using gcloud init

Creating a project

The recommendation on GCP is to group resources on Projets, so we will create one project to put our VPN server and service account restricted to it.

## Create the project to group the resources
### You might need to change it to have a global unique project id
PROJECT_ID=${USER}-algo-vpn
BILLING_ID="$(gcloud beta billing accounts list --format="value(ACCOUNT_ID)")"

gcloud projects create ${PROJECT_ID} --name algo-vpn --set-as-default
gcloud beta billing projects link ${PROJECT_ID} --billing-account ${BILLING_ID}

## Create an account that have access to the VPN
gcloud iam service-accounts create algo-vpn --display-name "Algo VPN"
gcloud iam service-accounts keys create configs/gce.json \
  --iam-account algo-vpn@${PROJECT_ID}.iam.gserviceaccount.com
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member serviceAccount:algo-vpn@${PROJECT_ID}.iam.gserviceaccount.com \
  --role roles/compute.admin
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member serviceAccount:algo-vpn@${PROJECT_ID}.iam.gserviceaccount.com \
  --role roles/iam.serviceAccountUser

## Enable the services
gcloud services enable compute.googleapis.com

./algo -e "provider=gce" -e "gce_credentials_file=$(pwd)/configs/gce.json"

Attention: take care of the configs/gce.json file, which contains the credentials to manage your Google Cloud account, including create and delete servers on this project.

There are more advanced arguments available for deploynment using ansible