Install on Google Cloud

Two variants

	`gcp-firebase`	`gcp`
Public site	Firebase Hosting	Cloud Storage behind a load balancer with Cloud CDN
Admin and API gateway	Cloud Run	Cloud Run
Database	Cloud SQL Postgres, private IP only	Cloud SQL Postgres, private IP only
Web application firewall	none; Caelo's rate limits and Firebase's edge protection	Cloud Armor on the gateway
Estimated floor cost	about $14 / month	about $33 / month

Both cost figures are estimates from the installer's own price table (smallest Cloud SQL tier, no high availability, scale-to-zero services, europe-west1 list prices). The difference is mainly the load balancer, about $18 a month. Cloud SQL high availability is off by default; it roughly doubles the database line.

Prerequisites

A Google account that can create a project and link a billing account, or that owns an existing project with billing.
A domain name. For the live site you need to control its DNS. To try Caelo on gcp-firebase, any valid name you plan to use is enough (see Try it without DNS).
For the terminal route also: the gcloud CLI signed in (gcloud auth login), Application Default Credentials for the same account (gcloud auth application-default login), and Bun. Running everything locally (the default outside Cloud Shell) needs the Pulumi CLI. With --install-job that part runs in your project instead and needs cosign to verify the release first.

You do not create a service account or download a key. The installer creates caelo-provisioner in your project and lets your own account impersonate it with short-lived tokens.

Try it without DNS

With gcp-firebase you can try Caelo without setting up DNS:

The installer asks for a domain. Enter any valid name you plan to use. It checks only the format, not who owns the domain, and it does not wait for DNS.
At the end you get the admin on its Cloud Run address (https://….run.app), behind Google's login, and the setup link.
You can set up your AI and build pages with it right away.
You need DNS only when the live site and the protected staging site should go on your domain.

The gcp variant is different: its install waits for DNS and the certificate before it finishes.

Option A: the Cloud Shell button

One click opens Google Cloud Shell in your browser with the installer for the current release (v0.10.51) and a step-by-step tutorial:

Open in Cloud Shell: gcp-firebase (Firebase Hosting, lower fixed cost)
Open in Cloud Shell: gcp (load balancer, Cloud CDN, Cloud Armor)

The buttons come from the caelo-cms/install repository. Each release gets its own release-v<version> branch there, so a button always installs the release it names.

Cloud Shell asks whether you trust the repository. It is not Google's, so it opens in a temporary session without your credentials, whatever you answer.
Sign in: gcloud auth login --update-adc.
Run ./run.sh gcp-firebase (or ./run.sh gcp). Before anything runs, it checks the pinned checksums of the Bun and cosign builds it downloads, installs the provisioner at exactly that release and verifies its npm signatures and provenance.
Answer the installer's questions and confirm the cost.
The rest runs as a Cloud Run job in your project. On gcp, when it reaches "Waiting for DNS", set the records it prints. On gcp-firebase it does not wait for DNS.
At the end the terminal shows your setup link.

You can close the tab. The install job keeps running in your project, through a closed tab or Cloud Shell's idle timeout. To follow it again, click the button, sign in and run ./run.sh with the same project: it attaches to the running install, shows a finished one, or resumes one that stopped.

Option B: from your terminal

bunx @caelo-cms/provisioning@latest --provider gcp-firebase

Use --provider gcp for the load balancer variant. The installer asks for everything it needs. For scripts, pass --project-id, --domain, --owner-email, --region and --non-interactive. --staging-domain sets the staging host (default staging.<domain>). --local or --install-job picks where the long part runs.

What the installer does

Checks your gcloud login and asks for the project id, domain, owner email and region.
Creates the project if needed, links billing, enables the APIs and creates the caelo-provisioner service account with keyless impersonation. None of this costs money.
Prints the estimated monthly cost for your region and asks once. Nothing billable is created before you say yes.
Creates the install's state bucket (gs://<project>-caelo-ops) and a Cloud KMS key that encrypts the secrets in it. The installer's state lives in your project, not on your laptop.
Runs Pulumi, locally or as the install job: VPC with a private Cloud SQL connection, Cloud SQL, buckets, Secret Manager, Cloud Run, and either the load balancer or Firebase Hosting. It uses the prebuilt release images.
Deletes the four permissive firewall rules Google pre-creates on the default network, where that is safe. Caelo does not use that network.
On gcp: handles DNS (below) and waits for the certificate. On gcp-firebase this step does not wait.
Runs the database migrations, sets up the upgrader job and the job that keeps Google IAP access in step with your user list.
Prints the setup link.

The region is fixed after install. The installer only offers regions where every service it needs exists; gcp-firebase offers fewer, because it needs Cloud Run domain mappings. Re-running the installer or upgrade with another region stops instead of moving anything.

DNS and your domain

The installer prints the records in two groups:

Set now: admin.<domain>, the staging host and verification records. These hosts are not live yet.
Only at go-live: the records for <domain> and www.<domain>. If a site is live on that domain today, changing them takes it offline until you publish in Caelo. The installer never sets these itself.

With CLOUDFLARE_API_TOKEN in your shell, the installer sets records through Cloudflare. Otherwise it prints them. On gcp it then waits until they resolve; the install job waits up to two hours. On gcp-firebase the records are information only, and the install finishes without them. After the install, the records are also listed under Settings, Domains in the admin.

On gcp-firebase the admin starts on its Cloud Run URL. Two commands put the admin and the protected staging site on your domain. Each one prints the DNS record to add and waits for the certificate:

bunx @caelo-cms/provisioning@<version> admin-domain enable
bunx @caelo-cms/provisioning@<version> staging-domain enable

After the install

Open the setup link while signed in with the owner's Google account. Google's Identity-Aware Proxy lets only that account through at first. The link is valid for 24 hours. If you lose the terminal output, read it from Secret Manager: gcloud secrets versions access latest --secret=caelo-install-setup-link --project=<project>.
Choose your AI provider and paste the key. See the Quickstart.
Add people under Settings, Users, or ask the AI. Google IAP follows the user list automatically. Each user needs a Google account.

Common problems

Certificate stays at "provisioning". DNS has not propagated yet. Google-managed certificates usually take 15 to 60 minutes after the record resolves. Check with dig +short admin.<domain>.
"No Application Default Credentials on this machine". Run gcloud auth application-default login as the same account gcloud uses, then re-run.
The install job failed. The message is the job's last output; the full log is under Cloud Run, Jobs, caelo-install. Fix the cause and run the installer again for the same project. It resumes at the failed step.
Stuck at "Waiting for DNS" (gcp). Set the printed records at your registrar and run the installer again. It resumes at the DNS step.
"Could not verify release". cosign is missing or cannot reach the registry. A signature error means the release is not the one Caelo's release workflow signed: stop and open an issue.
The Cloud Shell button says the release branch does not exist. The release is less than about 30 minutes old and not pinned yet. Try again shortly.
A new user gets "You don't have access" from Google. Usually the address is not a Google account. Click "Re-sync Google IAP access" under Settings, Users after fixing it.
Site shows Firebase's "Site Not Found" (gcp-firebase). Firebase stopped re-checking a domain created while DNS still pointed elsewhere. Settings, Domains marks it as stuck; click Reconnect.

Every step of the installer can be re-run. Upgrades, backups and secret rotation are on Updates and maintenance.