Google Cloud

Navi has native support for Google Cloud Platform. It provisions instances through Terraform, installs NixOS onto them, and reaches them afterwards — over a public address, or through an Identity-Aware Proxy tunnel for instances that have none.

Declaring a GCP node

A node's GCP settings live under deployment.providers.gcp. They name the project and zone the instance lives in, and whether to reach it through IAP:

"staging-acme-app-1" = { ... }: {
  deployment.tags = [ "app" "staging" "acme" ];
  deployment.provisioner = "acme";
  deployment.providers.gcp = {
    project = "<project-id>";
    zone = "europe-west3-a";
    iap = true;
  };
};

deployment.provisioner ties the node to the provisioner that creates its infrastructure; see Provisioners and facts.

Identity-Aware Proxy

iap controls whether Navi tunnels SSH through Google's Identity-Aware Proxy. It defaults to true. With IAP, you can deploy to instances that have no public address: Navi establishes the tunnel and runs the deploy through it, so the same apply, ssh, and exec commands work whether or not the machine is exposed.

navi apply --on @app switch -v
navi ssh staging-acme-app-1

No extra flags are needed at the command line — the tunnel is set up from the node's declared providers.gcp settings.

Authentication

Navi uses your local Google Cloud credentials to provision and to open IAP tunnels. Authenticate with gcloud before running provisioning or connecting, the same way you would for any other GCP tooling.