Host the Crunu server on Google Cloud Run

What Crunu does on Cloud Run

Crunu runs in the cloud at app.crunu.com, so you don't need your own server to start. If your infrastructure lives in Google Cloud, the Crunu server deploys to Cloud Run with one script, keeps its secrets in Secret Manager and uses Postgres on Cloud SQL or Neon.

The server is blind on Cloud Run as everywhere else: the database holds ciphertext, public keys, signed documents and metadata, never a key that decrypts a value.

Deploy

You need Node.js 24, gcloud signed in, a project with billing, a Postgres database and a .env file created by server-init. The commands run from the Crunu server's directory, where the deploy scripts live.

node scripts/server-init.mjs --origin https://vault.company.example --database-url env:DATABASE_URL
sh deploy/gcp/deploy.sh --project my-project --region europe-west1 --service vault

The script checks .env, enables the Cloud Run, Artifact Registry and Secret Manager APIs, builds a linux/amd64 image into Artifact Registry, stores the server's secrets in Secret Manager and creates a service account that can read only those secrets. Then it deploys the service.

• Secrets pinned per revision. A new secret version appears only when a value changes, and the service references secrets by version number, not as latest. Each revision keeps the values it was deployed with, so rolling traffic back to an older revision brings its secrets back too.
• Cloud SQL over its socket. Use an address like postgres://user:password@/database?host=/cloudsql/project:region:instance. The script attaches the instance to the service and grants its service account the Cloud SQL Client role.
• Merged settings. Environment variables are merged, so values you set on the service by hand stay. Variables that are no longer in .env are listed and removed only with --prune.
• Client addresses. By default clients reach the service directly. Behind Google's external load balancer, deploy with --trust-proxy xff:2: the service then accepts traffic only from the load balancer, and PUBLIC_ORIGIN must be the balancer's address.

Cleanup runs only with traffic

Machines running the crunu agent check the server every minute by default, so with machines online cleanup runs along the way about every 5 minutes.

Old revisions

The deploy script doesn't tag revisions, so older ones have no addresses of their own. If you tagged revisions by hand, remove those tags, because a tagged old revision works with the same database and secrets:

gcloud run services update-traffic <service> --region <region> --remove-tags <tag>

Related

• Self-hosting
• Google Cloud Run in the docs
• Move between platforms
• Docker