Deploy to Google Cloud Run

Reference architecture only. This page is not a production-certified deployment procedure and predates the current activation, image-pinning, secret-management, and network-isolation baseline. Use the supported on-premises guide or complete an enterprise architecture review before deployment.

The repository deployment workflows now build and deploy the complete service set, including the private, always-on casebender-connector-worker. See Integration Execution Plane for its required secrets, queue contract, and health checks.

Overview

This guide walks you through deploying CaseBender on Google Cloud Run using our pre-built Docker images.

Prerequisites

Step 1: Initial Setup

Install Google Cloud CLI

# Using Homebrew
brew install google-cloud-sdk

# Login to Google Cloud

gcloud auth login

# Configure Docker to use Google Cloud

gcloud auth configure-docker

# Download the archive
curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-VERSION-linux-x86_64.tar.gz

# Extract the archive
tar -xf google-cloud-cli-VERSION-linux-x86_64.tar.gz

# Run the install script
./google-cloud-sdk/install.sh

# Login to Google Cloud
gcloud auth login

# Configure Docker to use Google Cloud
gcloud auth configure-docker

# Download and run the installer
# https://dl.google.com/dl/cloudsdk/channels/rapid/GoogleCloudSDKInstaller.exe

# Login to Google Cloud
gcloud auth login

# Configure Docker to use Google Cloud
gcloud auth configure-docker

Initialize Project

# Set your project ID
gcloud config set project YOUR_PROJECT_ID

# Enable required APIs
gcloud services enable \
  cloudbuild.googleapis.com \
  run.googleapis.com \
  secretmanager.googleapis.com \
  cloudresourcemanager.googleapis.com \
  artifactregistry.googleapis.com

Step 2: Set Up Cloud Infrastructure

Connect existing Cloud Storage buckets

CaseBender uses customer-owned GCS buckets. It does not create, empty, or delete buckets. Provision separate quarantine, records, and ephemeral buckets before this deployment. Use Cloud Run service identity or GKE Workload Identity with Application Default Credentials. Do not download a service-account key for a new production deployment.

gcloud storage buckets describe gs://casebender-storage

gcloud iam service-accounts create casebender-storage \
  --display-name "CaseBender Storage Service Account"

STORAGE_SA_EMAIL=$(gcloud iam service-accounts list \
  --filter="displayName:CaseBender Storage Service Account" \
  --format="value(email)")

gcloud storage buckets add-iam-policy-binding gs://casebender-storage \
  --member="serviceAccount:${STORAGE_SA_EMAIL}" \
  --role="roles/storage.objectUser"

The canonical runtime variables are STORAGE_PROVIDER=gcs, GCS_BUCKET, and optional GCS_PROJECT_ID. GOOGLE_STORAGE_BUCKET is not a CaseBender storage variable. See Enterprise Storage Overview and Storage Security Baseline.

Set Up Cloud SQL (PostgreSQL)

# Create PostgreSQL instance
gcloud sql instances create casebender-db \
  --database-version=POSTGRES_14 \
  --cpu=2 \
  --memory=4GB \
  --region=us-central1 \
  --root-password="YOUR_SECURE_PASSWORD"

# Create database
gcloud sql databases create casebender \
  --instance=casebender-db

# Create user
gcloud sql users create casebender \
  --instance=casebender-db \
  --password="YOUR_SECURE_PASSWORD"

Set Up Memorystore (Redis)

CaseBender services refuse to start in production when Redis has no password. Create the instance with AUTH and in-transit encryption, then let secure-redis.sh write REDIS_URL and the server CA to Secret Manager:

gcloud redis instances create casebender-redis \
  --size=2 \
  --region=us-central1 \
  --redis-version=redis_7_0 \
  --enable-auth \
  --transit-encryption-mode=SERVER_AUTHENTICATION

GCP_PROJECT_ID="$PROJECT_ID" ./deploy/gcloud/secure-redis.sh

For an existing instance without AUTH, run ./deploy/gcloud/secure-redis.sh in a maintenance window. It enables AUTH, rewrites REDIS_URL, and stores the private IP in REDIS_TLS_EXEMPT_HOSTS (in-transit encryption cannot be added to an existing instance). Clients without the password are rejected as soon as AUTH is on, so redeploy every service immediately afterwards.

Configure Secret Manager

CaseBender’s web, api, and worker services require one stable AUDIT_INTEGRITY_SECRET to authenticate the tamper-evident audit chain. Create it once, grant the runtime service account access, and bind the same secret to all three services. Never replace it during a normal deployment. The repository’s deploy/gcloud/setup-infrastructure.sh and deploy-gcloud.yml workflow create the secret only when it is absent and preserve existing values. For a manual deployment:

PROJECT_NUMBER="$(gcloud projects describe "$PROJECT_ID" --format='value(projectNumber)')"
RUNTIME_SA="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"

if ! gcloud secrets describe AUDIT_INTEGRITY_SECRET >/dev/null 2>&1; then
  openssl rand -hex 32 | tr -d '\n' |
    gcloud secrets create AUDIT_INTEGRITY_SECRET --data-file=-
fi

gcloud secrets add-iam-policy-binding AUDIT_INTEGRITY_SECRET \
  --member="serviceAccount:${RUNTIME_SA}" \
  --role="roles/secretmanager.secretAccessor"

# Create and store environment variables
cat << EOF | gcloud secrets create casebender-env --data-file=-
AUTH_SECRET=your-auth-secret
AUTH_SALT=your-auth-salt
POSTGRES_PRISMA_URL="postgresql://casebender:YOUR_SECURE_PASSWORD@/casebender?host=/cloudsql/YOUR_PROJECT_ID:us-central1:casebender-db"
REDIS_URL="redis://REDIS_IP_ADDRESS:6379"
STORAGE_PROVIDER=gcs
GCS_BUCKET=casebender-storage
EOF

Step 3: Pull and Push Docker Images

# Create Artifact Registry repository
gcloud artifacts repositories create casebender \
  --repository-format=docker \
  --location=us-central1

# Configure Docker for Artifact Registry
gcloud auth configure-docker us-central1-docker.pkg.dev

# Pull CaseBender images
docker pull casebender/casebender:latest
docker pull casebender/workflow-processor:latest
docker pull casebender/connector-worker:latest
docker pull casebender/misp-processor:latest

# Tag images for Google Artifact Registry
docker tag casebender/casebender:latest us-central1-docker.pkg.dev/$PROJECT_ID/casebender/app:latest
docker tag casebender/workflow-processor:latest us-central1-docker.pkg.dev/$PROJECT_ID/casebender/workflow-processor:latest
docker tag casebender/connector-worker:latest us-central1-docker.pkg.dev/$PROJECT_ID/casebender/connector-worker:latest
docker tag casebender/misp-processor:latest us-central1-docker.pkg.dev/$PROJECT_ID/casebender/misp-processor:latest

# Push images
docker push us-central1-docker.pkg.dev/$PROJECT_ID/casebender/app:latest
docker push us-central1-docker.pkg.dev/$PROJECT_ID/casebender/workflow-processor:latest
docker push us-central1-docker.pkg.dev/$PROJECT_ID/casebender/connector-worker:latest
docker push us-central1-docker.pkg.dev/$PROJECT_ID/casebender/misp-processor:latest

Step 4: Deploy Services

Deploy Main Application

# Deploy to Cloud Run
gcloud run deploy casebender \
  --image us-central1-docker.pkg.dev/$PROJECT_ID/casebender/app:latest \
  --platform managed \
  --region us-central1 \
  --allow-unauthenticated \
  --set-env-vars STORAGE_PROVIDER=gcs,GCS_BUCKET=casebender-storage \
  --service-account=$STORAGE_SA_EMAIL \
  --add-cloudsql-instances $PROJECT_ID:us-central1:casebender-db \
  --set-secrets "AUDIT_INTEGRITY_SECRET=AUDIT_INTEGRITY_SECRET:latest,/app/.env=casebender-env:latest"

Apply the same AUDIT_INTEGRITY_SECRET binding to the API and worker deployments. A missing binding does not necessarily fail a basic health probe; it fails the first operation that must append a protected audit record.

Configure authenticated Pub/Sub alert pushes

Pub/Sub must attach a Google-signed OIDC token when it pushes alerts to /api/pubsub/alerts. Configure an exact audience and an allow-list that maps each push service account to an existing organization and active organization member. CaseBender uses the mapped member as the audit actor and always scopes created alerts to the mapped organization.

PUBSUB_AUDIENCE="https://casebender.example/api/pubsub/alerts"
PUBSUB_PUSH_SA="casebender-pubsub@${PROJECT_ID}.iam.gserviceaccount.com"

gcloud pubsub subscriptions update casebender-alerts \
  --push-endpoint="${PUBSUB_AUDIENCE}" \
  --push-auth-service-account="${PUBSUB_PUSH_SA}" \
  --push-auth-token-audience="${PUBSUB_AUDIENCE}"

Set these variables on the web service:

PUBSUB_AUTH_MODE=required
PUBSUB_OIDC_AUDIENCE=https://casebender.example/api/pubsub/alerts
PUBSUB_PUSH_IDENTITY_MAPPINGS=[{"serviceAccountEmail":"casebender-pubsub@example-project.iam.gserviceaccount.com","organizationId":"replace-with-organization-id","systemUserEmail":"ingestion@example.com"}]

PUBSUB_PUSH_IDENTITY_MAPPINGS must be a JSON array. Service-account emails must be unique, and every referenced organization and system user must already exist. The system user must be active and belong to the mapped organization. Requests with a missing, forged, expired, wrong-audience, or unlisted-identity token are rejected before the message body is processed.

PUBSUB_AUTH_MODE=disabled is accepted only when NODE_ENV is development or test, and it still requires exactly one organization mapping. Never set it on a deployed service.

Include AUDIT_INTEGRITY_SECRET in the protected recovery inventory. Losing or rotating it prevents verification of audit entries written with the previous key.

Deploy Workflow Processor

# Deploy workflow processor
gcloud run deploy workflow-processor \
  --image us-central1-docker.pkg.dev/$PROJECT_ID/casebender/workflow-processor:latest \
  --platform managed \
  --region us-central1 \
  --no-allow-unauthenticated \
  --service-account=$STORAGE_SA_EMAIL \
  --add-cloudsql-instances $PROJECT_ID:us-central1:casebender-db \
  --set-secrets "/app/.env=casebender-env:latest"

Deploy Connector Worker

gcloud run deploy casebender-connector-worker \
  --image us-central1-docker.pkg.dev/$PROJECT_ID/casebender/connector-worker:latest \
  --platform managed \
  --region us-central1 \
  --no-allow-unauthenticated \
  --port 3015 \
  --min-instances 1 \
  --no-cpu-throttling \
  --add-cloudsql-instances $PROJECT_ID:us-central1:casebender-db \
  --set-secrets "POSTGRES_PRISMA_URL=POSTGRES_PRISMA_URL:latest,REDIS_URL=REDIS_URL:latest,CREDENTIAL_ENCRYPTION_KEY=CREDENTIAL_ENCRYPTION_KEY:latest" \
  --set-env-vars "CONNECTOR_ACTION_QUEUE_NAME=connector-actions,CONNECTOR_ACTION_RESULT_QUEUE_NAME=connector-action-results,CONNECTOR_MOCK_DESTRUCTIVE=0"

Deploy MISP Processor

# Deploy MISP processor
gcloud run deploy misp-processor \
  --image us-central1-docker.pkg.dev/$PROJECT_ID/casebender/misp-processor:latest \
  --platform managed \
  --region us-central1 \
  --no-allow-unauthenticated \
  --service-account=$STORAGE_SA_EMAIL \
  --add-cloudsql-instances $PROJECT_ID:us-central1:casebender-db \
  --set-secrets "/app/.env=casebender-env:latest"

Deploy Python Runner (optional)

Python workflow steps run tenant code only on the isolated python-runner service, inside an nsjail sandbox. Skip this section unless you enable Python steps with WORKFLOW_PYTHON_ENABLED=true. The runner needs the second-generation execution environment, which supports the Linux namespaces and seccomp filters nsjail uses. Deploy it without a VPC connector or Cloud SQL attachment, so code that escapes the sandbox still cannot reach private databases or Redis. Only the workflow processor’s service account may invoke it.

# Shared bearer token between the workflow processor and the runner (32+ chars)
openssl rand -hex 32 | tr -d '\n' | gcloud secrets create PYTHON_RUNNER_TOKEN --data-file=-

gcloud run deploy casebender-python-runner \
  --image us-central1-docker.pkg.dev/$PROJECT_ID/casebender/python-runner:latest \
  --platform managed \
  --region us-central1 \
  --no-allow-unauthenticated \
  --execution-environment gen2 \
  --port 8080 \
  --cpu 1 \
  --memory 1Gi \
  --concurrency 4 \
  --set-secrets "PYTHON_RUNNER_TOKEN=PYTHON_RUNNER_TOKEN:latest" \
  --set-env-vars "PYTHON_RUNNER_MAX_CONCURRENCY=4"

# Allow only the workflow processor's identity to call the runner
gcloud run services add-iam-policy-binding casebender-python-runner \
  --region us-central1 \
  --member "serviceAccount:$STORAGE_SA_EMAIL" \
  --role roles/run.invoker

# Point the workflow processor at the runner
RUNNER_URL=$(gcloud run services describe casebender-python-runner \
  --region us-central1 --format='value(status.url)')
gcloud run services update workflow-processor \
  --region us-central1 \
  --update-secrets "WORKFLOW_PYTHON_RUNNER_TOKEN=PYTHON_RUNNER_TOKEN:latest" \
  --update-env-vars "WORKFLOW_PYTHON_ENABLED=true,WORKFLOW_PYTHON_RUNNER_URL=$RUNNER_URL"

Set WORKFLOW_PYTHON_ENABLED=true on the web service as well, so the workflow editor offers Python steps. For a *.run.app runner URL, the workflow processor requests a Google ID token from the metadata server and sends it in X-Serverless-Authorization; the runner’s own bearer token stays in Authorization. If a custom domain fronts the runner, set WORKFLOW_PYTHON_RUNNER_AUDIENCE to the runner’s run.app URL. The GitHub Actions deployment (.github/workflows/deploy-gcloud.yml) performs all of these steps automatically. It generates PYTHON_RUNNER_TOKEN when missing, and the WORKFLOW_PYTHON_ENABLED repository variable controls the feature.

Step 5: Configure Domain and SSL

Map Custom Domain

# Add domain mapping
gcloud run domain-mappings create \
  --service casebender \
  --domain your-domain.com \
  --region us-central1

Follow the DNS verification steps in the Google Cloud Console to complete domain mapping.

Monitoring and Maintenance

Set Up Monitoring

Navigate to Cloud Monitoring in Google Cloud Console
Create an uptime check for your service
Set up alerts for:
- Error rates
- Latency
- Instance count
- Memory usage

View Logs

# View service logs
gcloud logging read "resource.type=cloud_run_revision AND resource.labels.service_name=casebender" --limit 50

# Stream logs
gcloud logging tail "resource.type=cloud_run_revision AND resource.labels.service_name=casebender"

Update Application

To deploy updates:

# Build and deploy new version
gcloud builds submit --config cloudbuild.yaml

# Roll back if needed
gcloud run services rollback casebender \
  --to-revision=REVISION_ID \
  --region=us-central1

Cost Optimization

Autoscaling Configuration

gcloud run services update casebender \
  --min-instances=1 \
  --max-instances=10 \
  --region=us-central1

Resource Allocation

gcloud run services update casebender \
  --memory=1Gi \
  --cpu=1 \
  --region=us-central1

Troubleshooting

Common Issues

Connection Issues
- Verify Cloud SQL connection
- Check Redis connectivity
- Validate environment variables
Performance Problems
- Review instance metrics
- Check resource allocation
- Analyze request patterns
Deployment Failures
- Check build logs
- Verify service account permissions
- Review deployment configuration
Seed did not run
- Cloud Run web startup must call ts-node --transpile-only for prisma/seed.ts.
- Without --transpile-only, seed typechecks console/process and exits with Seed already run or failed (non-critical) while the app still starts.
Uploaded images stay on HTTP 409
- GET /attachment/{id}?ready=1 returns 409 until the worker marks the object CLEAN and promotes it out of quarantine.
- Cloud Run has no ClamAV sidecar. The worker must set MALWARE_SCANNER_PROVIDER=skip. Without it, logs show A supported external malware scanner must be configured and uploads never leave quarantine.

Next Steps

Set up CI/CD pipelines
Configure backup strategies
Implement monitoring and alerting
Review security best practices

Getting Started

Deployment

Alert Management

Case Management

Task Management

Time Tracking

Analytics

Audits

Settings

Deploy to Google Cloud Run

Overview

Prerequisites

Step 1: Initial Setup

Install Google Cloud CLI

Initialize Project

Step 2: Set Up Cloud Infrastructure

Connect existing Cloud Storage buckets

Set Up Cloud SQL (PostgreSQL)

Set Up Memorystore (Redis)

Configure Secret Manager

Step 3: Pull and Push Docker Images

Step 4: Deploy Services

Deploy Main Application

Configure authenticated Pub/Sub alert pushes

Deploy Workflow Processor

Deploy Connector Worker

Deploy MISP Processor

Deploy Python Runner (optional)

Step 5: Configure Domain and SSL

Map Custom Domain

Monitoring and Maintenance

Set Up Monitoring

View Logs

Update Application

Cost Optimization

Troubleshooting

Common Issues

Next Steps

​Overview

​Prerequisites

​Step 1: Initial Setup

​Install Google Cloud CLI

​Initialize Project

​Step 2: Set Up Cloud Infrastructure

​Connect existing Cloud Storage buckets

​Set Up Cloud SQL (PostgreSQL)

​Set Up Memorystore (Redis)

​Configure Secret Manager

​Step 3: Pull and Push Docker Images

​Step 4: Deploy Services

​Deploy Main Application

​Configure authenticated Pub/Sub alert pushes

​Deploy Workflow Processor

​Deploy Connector Worker

​Deploy MISP Processor

​Deploy Python Runner (optional)

​Step 5: Configure Domain and SSL

​Map Custom Domain

​Monitoring and Maintenance

​Set Up Monitoring

​View Logs

​Update Application

​Cost Optimization

​Troubleshooting

​Common Issues

​Next Steps

Overview

Prerequisites

Step 1: Initial Setup

Install Google Cloud CLI

Initialize Project

Step 2: Set Up Cloud Infrastructure

Connect existing Cloud Storage buckets

Set Up Cloud SQL (PostgreSQL)

Set Up Memorystore (Redis)

Configure Secret Manager

Step 3: Pull and Push Docker Images

Step 4: Deploy Services

Deploy Main Application

Configure authenticated Pub/Sub alert pushes

Deploy Workflow Processor

Deploy Connector Worker

Deploy MISP Processor

Deploy Python Runner (optional)

Step 5: Configure Domain and SSL

Map Custom Domain

Monitoring and Maintenance

Set Up Monitoring

View Logs

Update Application

Cost Optimization

Troubleshooting

Common Issues

Next Steps