explain how to authenticate with GCP outside of GCP environment

fix

Author: Pascal-Delange

.env.example

@@ -22,6 +22,9 @@ MARBLE_APP_HOST=localhost:3000
 # Leave the "test-project" value if you are using the firebase emulator
 GOOGLE_CLOUD_PROJECT=test-project
 
+# Required for authentication if you are running with a real firebase app and cloud storage bucket, outside of a GCP environment
+GOOGLE_APPLICATION_CREDENTIALS=
+
 SENTRY_DSN=
 
 

README.md

@@ -121,22 +121,30 @@ It will run out of the box with the firebase auth emulator. If you wish to run M
 
 The first time you run the code, you should enter an organization name and organization admin user email to create using the `CREATE_ORG_NAME` and `CREATE_ORG_ADMIN_EMAIL` environment variables. Unless using the firebase emulator, you must enter an actual email address that you own so that you may verify it and login with firebase. You can always create new organizations later using the same procedure.
 
-In a local demo setup:
+**In a local demo setup:**
 
 > In a local test setup (meaning if you are running with the firebase auth emulator), the License key is not required. You can leave it empty. The full feature set is available.
 
 - just run the docker-compose as it is, it should work
 - give the firebase emulator a moment to get started, it's a bit slow when first launched
 - create a Firebase user with the email you provided in the `CREATE_ORG_ADMIN_EMAIL` environment variable (you can do this on the Marble login page by using the SSO button or sign up with email)
 
-In a production setup:
+**In a production setup:**
 
 - set the `FIREBASE_AUTH_EMULATOR_HOST_SERVER` and `FIREBASE_AUTH_EMULATOR_HOST_CLIENT` env variables to empty strings in your .env file
 - create a Firebase project and a Firebase app, and set the relevant env variables (`FIREBASE_API_KEY` to `FIREBASE_APP_ID` as well as `GOOGLE_CLOUD_PROJECT`) in your .env file
 - if you plan to use the batch ingestion feature or the case manager with file storign feature, make sure you create the Google Cloud Storage buckets, set the corresponding env variables and run your code in a setup that will allow default application credentials detection
 - create a Firebase user with the email you provided in the `CREATE_ORG_ADMIN_EMAIL` environment variable (you can do this on the Marble login page by using the SSO button or sign up with email)
 - if you have a license key, set it in the `LICENSE_KEY` env variable in your .env file
 
+**Firebase authentication:**
+
+In a production setup, you need to authenticate to GCP to use Firebase and Cloud Storage. If you are not running the container directly in a GCP environment, here is how you could do this:
+
+- create a volume attached to the marble-api container (see the )
+- place the json service account key for GCP in the local shared folder (or otherwise inject it into the docker container, depending on how you run Marble)
+- set the `GOOGLE_APPLICATION_CREDENTIALS` variable equal to the path to the service account key
+
 Open the Marble console by visiting `http://localhost:3000`, and interact with the Marble API at `http://localhost:8080` (assuming you use the default ports). Change those values accordingly if you configured a different port or if you are calling a specific host.
 
 ### 🕵 **How to use Marble**

docker-compose.yaml

@@ -38,6 +38,7 @@ services:
       - ${HOST_API_PORT:-8080}:${API_PORT:-8080}
     volumes:
       - marble-tempfiles:/tempFiles
+      # - ./local_shared:/shared # uncomment and adapt this line if you need to inject a service account key into the container
     environment:
       ENV: ${ENV:-}
       PORT: ${API_PORT:-}
@@ -52,6 +53,7 @@ services:
       MARBLE_APP_HOST: ${MARBLE_APP_HOST:-localhost:${HOST_APP_PORT:-3000}}
       # default value of GOOGLE_CLOUD_PROJECT must be kept if working with the emulator (and the emulator is running in the docker image below)
       GOOGLE_CLOUD_PROJECT: ${GOOGLE_CLOUD_PROJECT:-test-project}
+      GOOGLE_APPLICATION_CREDENTIALS: ${GOOGLE_APPLICATION_CREDENTIALS:-}
       REQUEST_LOGGING_LEVEL: ${REQUEST_LOGGING_LEVEL:-}
       LOGGING_FORMAT: ${LOGGING_FORMAT:-}
       CREATE_GLOBAL_ADMIN_EMAIL: ${CREATE_GLOBAL_ADMIN_EMAIL:-}