mirror of
https://github.com/trailofbits/algo.git
synced 2025-07-09 23:34:01 +02:00
54a91447bf
* Add documentation on how to setup GCE accounts This commit adds the steps needed to create a credential with the needed access on Google Cloud Platform to be able to successfully create a new algo VPN. Related to: - https://github.com/trailofbits/algo/issues/682 - https://github.com/trailofbits/algo/issues/658 * Adds links on main README to GCP * Adds link to Ansible documentation * Update cloud-gce.md
41 lines
1.8 KiB
Markdown
41 lines
1.8 KiB
Markdown
# Google Cloud Platform setup
|
|
|
|
Follow the [installation instructions](https://cloud.google.com/sdk/) to have the CLI commands to interact with Google.
|
|
|
|
After creating an account and installing, login in on your account using `gcloud init`
|
|
|
|
### Creating a project
|
|
|
|
The recommendation on GCP is to group resources on **Projets**, so we will create one project to put our VPN server and service account restricted to it.
|
|
|
|
```bash
|
|
## Create the project to group the resources
|
|
### You might need to change it to have a global unique project id
|
|
PROJECT_ID=${USER}-algo-vpn
|
|
BILLING_ID="$(gcloud beta billing accounts list --format="value(ACCOUNT_ID)")"
|
|
|
|
gcloud projects create ${PROJECT_ID} --name algo-vpn --set-as-default
|
|
gcloud beta billing projects link ${PROJECT_ID} --billing-account ${BILLING_ID}
|
|
|
|
## Create an account that have access to the VPN
|
|
gcloud iam service-accounts create algo-vpn --display-name "Algo VPN"
|
|
gcloud iam service-accounts keys create configs/gce.json \
|
|
--iam-account algo-vpn@${PROJECT_ID}.iam.gserviceaccount.com
|
|
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
|
|
--member serviceAccount:algo-vpn@${PROJECT_ID}.iam.gserviceaccount.com \
|
|
--role roles/compute.admin
|
|
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
|
|
--member serviceAccount:algo-vpn@${PROJECT_ID}.iam.gserviceaccount.com \
|
|
--role roles/iam.serviceAccountUser
|
|
|
|
## Enable the services
|
|
gcloud services enable compute.googleapis.com
|
|
|
|
./algo -e "provider=gce" -e "gce_credentials_file=$(pwd)/configs/gce.json"
|
|
|
|
```
|
|
|
|
**Attention:** take care of the `configs/gce.json` file, which contains the credentials to manage your Google Cloud account, including create and delete servers on this project.
|
|
|
|
|
|
There are more advanced arguments available for deploynment [using ansible](deploy-from-ansible.md)
|