ProjectBuild a Permission-Aware Knowledge Hub as an MCP Server: the explanation · Module 20: Deploying to Google Cloud with CI/CD · part 22 of 22
Part 22 · Module 20: Deploying to Google Cloud with CI/CD

Module 20: Deploying to Google Cloud with CI/CD

25 min read·
About 45 minutes · Needs: Module 19 (the containers and the local stack), Module 18 (X-Forwarded-For, rate limits and demo accounts), Module 12 (OAuth and the token audience), Module 13 (elicitation in create_issue) · Code: deploy/terraform/*.tf, deploy/deploy.sh, deploy/cloudbuild.yaml, deploy/README.md, server/wayfinder/core/proxy.py, console/nginx.conf.template, .github/workflows/ci.yml, .github/workflows/deploy.yml

Where this fits

WHERE THIS FITS Wayfinder this module AI CLIENTS the model writes the answer CONSOLE React, nginx WAYFINDER SERVER Starlette, mcp 2.3 RETRIEVAL permission filter before ranking INDEXING fastembed DATA Postgres 17 OPERATIONS evals, Docker, Cloud Run Claude Code HTTP + OAuth Cursor HTTP + OAuth Claude Desktop stdio bridge or connector MCP Inspector debugging, quick OAuth Web console React: search, audit, connect nginx one URL: /mcp, OAuth, /api MCP layer tools, resources Elicitation confirm create_issue OAuth 2.1 auth server, PKCE Tokens, sessions wf_pat_, cookie Console API /api REST Audit log every call, redacted stdio bridge wayfinder-stdio Guards proxy secret, limits Access rules groups per team Hybrid search pgvector + full text Fusion, boosts RRF, freshness, ADRs Knowledge decisions, owners Indexer loader, chunker bge-small-en fastembed, CPU PostgreSQL pgvector, full text Seed company Tidewater Freight Evaluation retrieval, 0 leaks Containers Docker Compose Deploy Cloud Run, Cloud SQL CI/CD GitHub Actions, WIF
The parts this module puts in the cloud (blue): the deploy and CI/CD, the same containers, Postgres as Cloud SQL, nginx as the one public front door, and the proxy-secret guard.

Module 19 ran the system on one laptop. This module puts the same two images on Google Cloud, so that AI clients anywhere, including Claude's custom connectors, can reach Wayfinder over HTTPS, and every commit that passes the tests is deployed without anyone holding a cloud key.

Read this first: none of this has run. The Terraform was written and documented but never validated (Terraform was not installed where it was written) and never applied to a real Google Cloud project, and the nginx change for Cloud Run has never run in a container. Every statement below about Cloud Run, Cloud SQL and the pipelines is design, not observation.

The rest of this project is yours to keep

This project is bought on its own, once, and stays readable afterwards, including the parts added to it later.

Buy this project · ₹799See what is inside

Or open everything with a plan