Google Cloud

Run Bearicorn on one Compute Engine VM with a static external IP. This matches the repository's single-host Docker Compose architecture; Cloud Run, GKE, Cloud SQL, and load balancers require a different deployment design.

Requirements

• a billing-enabled Google Cloud project;
• the Google Cloud CLI or Cloud Shell;
• a domain name; and
• permission to manage Compute Engine, VPC firewall rules, addresses, and IAP.

This guide uses an e2-medium VM, Ubuntu 24.04 LTS, and a 30 GB balanced persistent disk. e2-medium provides 2 vCPUs and 4 GB of memory according to the E2 machine specification.

Cost and availability

The VM, disk, static IP, snapshots, and network traffic can incur charges. This is a single zonal VM, not a highly available deployment. Consider a billing budget, but note that budget alerts do not cap spending.

Prepare the project

gcloud init
gcloud config set project PROJECT_ID
gcloud services enable compute.googleapis.com iap.googleapis.com

Choose a region and a zone inside it, such as europe-west1 and europe-west1-b. Use the same region for the subnet and static address.

Create the network

gcloud compute networks create bearicorn-network --subnet-mode=custom

gcloud compute networks subnets create bearicorn-subnet \
  --network=bearicorn-network \
  --range=10.10.0.0/24 \
  --region=REGION

Allow public web traffic and SSH only through Identity-Aware Proxy:

gcloud compute firewall-rules create bearicorn-web \
  --network=bearicorn-network \
  --direction=INGRESS \
  --action=ALLOW \
  --rules=tcp:80,tcp:443 \
  --source-ranges=0.0.0.0/0 \
  --target-tags=bearicorn-web

gcloud compute firewall-rules create bearicorn-iap-ssh \
  --network=bearicorn-network \
  --direction=INGRESS \
  --action=ALLOW \
  --rules=tcp:22 \
  --source-ranges=35.235.240.0/20 \
  --target-tags=bearicorn-iap

35.235.240.0/20 is Google's documented source range for IAP TCP forwarding. Do not create public rules for ports 5432 or 8080.

Reserve an IP and create the VM

gcloud compute addresses create bearicorn-ip --region=REGION

gcloud compute addresses describe bearicorn-ip \
  --region=REGION \
  --format="get(address)"

Copy the returned address and use it as STATIC_IP:

gcloud compute instances create bearicorn \
  --zone=ZONE \
  --machine-type=e2-medium \
  --subnet=bearicorn-subnet \
  --address=STATIC_IP \
  --image-project=ubuntu-os-cloud \
  --image-family=ubuntu-2404-lts-amd64 \
  --boot-disk-type=pd-balanced \
  --boot-disk-size=30GB \
  --tags=bearicorn-web,bearicorn-iap \
  --no-service-account \
  --no-scopes \
  --deletion-protection

The image family is listed in Google's public OS image details. No service account is attached because the Bearicorn containers do not call Google Cloud APIs.

Configure DNS and connect

At your DNS provider, create an A record such as:

chat.example.com  ->  STATIC_IP

Then connect through IAP:

gcloud compute ssh bearicorn --zone=ZONE --tunnel-through-iap

Operators other than the project owner need the IAP tunnel and Compute Engine permissions described in the IAP access guide.

Install Bearicorn

On the VM:

1. Install Docker on Ubuntu.
2. Follow the quick start.
3. Use docker-compose.caddy.yml and set CADDY_SITE_ADDRESS=chat.example.com.

Verify DNS and HTTPS from your computer:

dig +short chat.example.com
curl -I https://chat.example.com

Backups

Use the logical PostgreSQL backup as the portable recovery path. Persistent Disk snapshots are a useful second layer, but ordinary snapshots are not automatically application-consistent for PostgreSQL. Google documents the additional guest-flush workflow for application-consistent snapshots.