Skip to content

Cloud Run deploy (Phase 3c)

Operator runbook for a cost-aware Cloud Run service plus Cloud Scheduler inbox poll.

Full PowerShell steps: scripts/cloudrun/deploy.md (local clone: same path).

Goals

Goal Approach
Lower cost min-instances=0, 2-hour Scheduler while testing, 4 vCPU / 8 GiB with LOINC
Ship assets GCS /data + /assets; image has no FAISS/catalog
Org browser access Cloudflare Worker → fax-edge → mapper; cookie login (APP_AUTH_*); mapper is not public unauthenticated
Local GCP key faxautomation/secrets/gcp-sa.json (gitignored)
Docs https://faxautomation.pages.dev/ (Cloudflare only; no GitHub Pages workflow)
LOINC mapper docs https://noise-to-loinc.pages.dev/ — deployment, registry, clinician learning
App URL Cloudflare Worker custom domain (e.g. fax.doctortro.com); fax-edge *.run.app fallback. Mapper *.run.app is not for browsers.

Architecture (summary)

Cloudflare Pages (docs only)     https://faxautomation.pages.dev/
Noise to LOINC (mapper docs)     https://noise-to-loinc.pages.dev/
Cloudflare Worker (staff host)   closed page after hours; 302 to fax-edge in clinic hours
fax-edge Cloud Run               tiny public door (mapper off); identity-token proxy
faxautomation Cloud Run          16Gi mapper; authenticated invoke only; scale day/night
Cloud Scheduler                  OIDC + poll token → /internal/inbox/poll

Staff must not bookmark the mapper *.run.app URL. After hours the Worker never fetches Cloud Run. Force-load uses AFTER_HOURS_FORCE_TOKEN (Secret Manager + Worker secret).

Security

  1. Share login password out of band — never on the docs site.
  2. /loinc-review is harness learning, not the production MA chart UI (that is Elation).
  3. Never commit gcp-sa.json or Elation / app-auth secrets.
  4. Poll endpoint requires X-Inbox-Poll-Token.
  5. Phase 4 is VPC + PGA without Cloud NAT (no extra NAT bill). Full default-deny is later.

Artifact bundle, registry snapshots, and publish contract: Noise to LOINC — Deployment and Clinician learning.

After deploy

Staff: open the Worker hostname (clinic hours) or Force load after hours.

Ops mapper health (authenticated):

. .\scripts\cloudrun\operator.env.ps1
gcloud run services proxy $ServiceName --region=$Region

Inbox path: Elation page images → Gemini for extract; img2pdf of the same pages only for POST /reports/. Sync noise_to_loinc config/ (safety, panel index/aliases, unit surface rules) plus src/loinc_mapper to the asset bucket before expecting /health fingerprints. Full commands: deploy.md §4 / day-2.