Context
Every time a new client was onboarded, their web application had to be deployed and exposed to the internet.
As part of the deployment, the infrastructure required several configuration steps across different services before the application was ready to receive traffic.
Problem
Although the deployment workflow was always the same, every new client required repeating the exact same operational tasks:
- Creating GCP firewall rules
- Retrieving the VM's public IP
- Creating or updating Cloudflare DNS records
- Installing and configuring Nginx
- Generating Let's Encrypt SSL certificates
- Validating the routing and HTTPS configuration
Since these tasks were performed manually for every client, the provisioning process typically took around four hours to complete. Besides being time-consuming, it also increased the likelihood of configuration mistakes and inconsistencies.
Solution
After repeating the same workflow several times, I realized the process was entirely deterministic. The only inputs that changed between deployments were values such as the domain name, backend ports, and service account.
Instead of spending hours repeating the same sequence of tasks, I automated the entire workflow with Ansible and integrated it into our CI/CD pipeline.
How the workflow looks
GitLab CI/CD
│
▼
Run Ansible Playbook
│
▼
Create GCP Firewall Rule
│
▼
Retrieve VM Public IP
│
▼
Create / Update Cloudflare DNS Record
│
▼
Install Nginx
│
▼
Generate HTTP Configuration
│
▼
Request Let's Encrypt Certificate
│
▼
Generate HTTPS Configuration
│
▼
Reload Nginx
│
▼
Application Available via HTTPS
A single CI/CD job orchestrates the entire workflow. Ansible handles the infrastructure configuration, DNS updates, reverse proxy setup, and SSL provisioning, making the deployment consistent and repeatable.
Implementation Highlights
- Google Cloud Firewall Automation – Creates HTTP/HTTPS firewall rules through the GCP API.
- Automatic Public IP Discovery – Retrieves the VM's external IP from the GCP metadata service instead of requiring manual input.
- Cloudflare DNS Management – Updates DNS records automatically as part of the deployment.
- Dynamic Nginx Configuration – Uses Jinja2 templates to generate HTTP and HTTPS configurations.
- Automated SSL Provisioning – Obtains and configures Let's Encrypt certificates without manual intervention.
- CI/CD Integration – The entire process runs automatically through GitLab CI.
Results
| Before | After |
|---|---|
| ~4 hours to provision and configure | ~3 minutes through CI/CD |
| Multiple manual steps | Fully automated workflow |
| Manual DNS, firewall and SSL configuration | Managed by Ansible |
| Repetitive onboarding process | Consistent and repeatable deployment |
Beyond the time savings, every deployment now follows the exact same process.
Instead of spending hours repeating the same steps, I simply trigger the pipeline and let the automation do the work.
Check the code
GCP - Ingress Proxy with Ansible
An Ansible automation repository to provision Google Cloud Platform (GCP) network infrastructure, automate Cloudflare DNS management, and deploy a secure Nginx Reverse Proxy / Ingress Gateway.
This gateway acts as the single entry point (Layer 7 smart router) directing public internet traffic to a decoupled application ecosystem:
-
Next.js Frontend & BFF (Handles the main UI and
/api/proxyrequests) -
Nest.js API (Handles core backend logic via
/apirequests)
🏗️ Architecture Blueprint
[ Public Internet ]
│
Ports: 80 / 443
▼
┌───────────────────────────┐
│ GCP Compute Engine │
│ (Nginx Ingress Proxy) │
└─────────────┬─────────────┘
│
┌──────────────┴──────────────┐
▼ ▼
[ localhost:3000 ] [ localhost:4000 ]
Next.js Frontend Nest.js Backend
& BFF Layer API Layer
✨ Features
- Infrastructure as Code: Automatically creates GCP Compute Engine firewall rules for HTTP/HTTPS access.
- Dynamic DNS: Fetches the host VM's public IP address via the GCP link-local metadata service and updates Cloudflare…
Top comments (0)