118 lines
4.8 KiB
Bash
Executable File
118 lines
4.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# =============================================================================
|
|
# 02-setup-project.sh (Linux)
|
|
# One-time GCP project setup:
|
|
# - Links a billing account to the project
|
|
# - Enables required APIs (Cloud Run, Artifact Registry, Secret Manager)
|
|
# - Creates an Artifact Registry Docker repository
|
|
# - Grants the current user the minimum required IAM roles
|
|
#
|
|
# Safe to re-run — most operations are idempotent.
|
|
# Windows users: run GCR/scripts/02-setup-project.ps1 in PowerShell instead.
|
|
# =============================================================================
|
|
set -euo pipefail
|
|
|
|
if [[ "$(uname -s)" != "Linux" ]]; then
|
|
echo "ERROR: This script is for Linux only."
|
|
echo "Windows users: run GCR/scripts/02-setup-project.ps1"
|
|
exit 1
|
|
fi
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
# ── Load .env ─────────────────────────────────────────────────────────────────
|
|
ENV_FILE="$SCRIPT_DIR/../.env"
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
echo "ERROR: $ENV_FILE not found."
|
|
echo "Copy GCR/.env.example to GCR/.env and fill in your values first."
|
|
exit 1
|
|
fi
|
|
# shellcheck disable=SC1090
|
|
source "$ENV_FILE"
|
|
|
|
: "${GCP_PROJECT_ID:?GCP_PROJECT_ID is not set in .env}"
|
|
: "${GCP_REGION:?GCP_REGION is not set in .env}"
|
|
: "${GCP_REPOSITORY:?GCP_REPOSITORY is not set in .env}"
|
|
|
|
# ── Confirm active project ────────────────────────────────────────────────────
|
|
echo ">>> Active project: $GCP_PROJECT_ID"
|
|
echo ">>> Region: $GCP_REGION"
|
|
echo ">>> AR repository: $GCP_REPOSITORY"
|
|
echo ""
|
|
|
|
# ── Step 1: Link billing account ──────────────────────────────────────────────
|
|
echo ">>> Checking billing status..."
|
|
BILLING_ENABLED=$(gcloud billing projects describe "$GCP_PROJECT_ID" \
|
|
--format="value(billingEnabled)" 2>/dev/null || echo "false")
|
|
|
|
if [[ "$BILLING_ENABLED" == "True" ]]; then
|
|
echo " Billing is already enabled — skipping."
|
|
else
|
|
echo ""
|
|
echo " Billing is NOT enabled on this project."
|
|
echo " Listing available billing accounts..."
|
|
echo ""
|
|
gcloud billing accounts list --format="table(name,displayName,open)"
|
|
echo ""
|
|
read -rp " Enter the BILLING_ACCOUNT_ID from the list above (format: XXXXXX-XXXXXX-XXXXXX): " BILLING_ACCOUNT_ID
|
|
gcloud billing projects link "$GCP_PROJECT_ID" \
|
|
--billing-account="$BILLING_ACCOUNT_ID"
|
|
echo " Billing linked."
|
|
fi
|
|
|
|
# ── Step 2: Enable required APIs ─────────────────────────────────────────────
|
|
echo ""
|
|
echo ">>> Enabling required Google Cloud APIs (this may take a minute)..."
|
|
gcloud services enable \
|
|
run.googleapis.com \
|
|
artifactregistry.googleapis.com \
|
|
secretmanager.googleapis.com \
|
|
cloudresourcemanager.googleapis.com \
|
|
--project="$GCP_PROJECT_ID"
|
|
echo " APIs enabled."
|
|
|
|
# ── Step 3: Create Artifact Registry Docker repository ───────────────────────
|
|
echo ""
|
|
echo ">>> Creating Artifact Registry repository: $GCP_REPOSITORY ..."
|
|
if gcloud artifacts repositories describe "$GCP_REPOSITORY" \
|
|
--location="$GCP_REGION" \
|
|
--project="$GCP_PROJECT_ID" &>/dev/null; then
|
|
echo " Repository already exists — skipping."
|
|
else
|
|
gcloud artifacts repositories create "$GCP_REPOSITORY" \
|
|
--repository-format=docker \
|
|
--location="$GCP_REGION" \
|
|
--description="Container images for Htmx app" \
|
|
--project="$GCP_PROJECT_ID"
|
|
echo " Repository created."
|
|
fi
|
|
|
|
# ── Step 4: Grant current user the minimum required IAM roles ─────────────────
|
|
CURRENT_USER="$(gcloud config get-value account)"
|
|
echo ""
|
|
echo ">>> Granting IAM roles to $CURRENT_USER ..."
|
|
|
|
for ROLE in \
|
|
"roles/run.developer" \
|
|
"roles/artifactregistry.writer" \
|
|
"roles/iam.serviceAccountUser" \
|
|
"roles/secretmanager.admin" \
|
|
"roles/secretmanager.secretAccessor" \
|
|
"roles/secretmanager.secretVersionAdder"; do
|
|
echo " Adding role: $ROLE"
|
|
gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
|
|
--member="user:$CURRENT_USER" \
|
|
--role="$ROLE" \
|
|
--quiet
|
|
done
|
|
|
|
echo ""
|
|
echo ">>> Project setup complete."
|
|
echo ""
|
|
echo ">>> Summary:"
|
|
echo " Project ID: $GCP_PROJECT_ID"
|
|
echo " Region: $GCP_REGION"
|
|
echo " Artifact Registry: ${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GCP_REPOSITORY}"
|
|
echo ""
|
|
echo ">>> Next step: run GCR/scripts/03-create-secrets.sh"
|