Building a Secure, AI-Powered Blog Platform on Cloud Run — From Zero to Production

A security-first serverless platform that publishes via API, narrates posts with AI, generates its own social cards, and ships a hidden, post-grounded AI assistant. Here's how every piece fits — and the bugs that shaped it.

FastAPICloud RunTerraform GeminiGoogle ADKGCS Cloud BuildCloud ArmorSecurity

1. Why I Built This

I wanted a blog I could publish to by automation — drop an HTML file at an endpoint and have it go live, daily, without touching a CMS. But "just a blog" quickly became a canvas for everything I care about as a Cloud Architect, Security Specialist, and AI Architect: how do you make an upload endpoint safe? How do you add AI without exploding cost? How do you run a public AI agent that can't be turned against you?

The result is a serverless platform where security is a first-class concern at every boundary, AI features run at publish time (not per-view), and the whole thing is reproducible from Terraform and shipped through CI/CD.

2. Architecture

 GitHub ──push──▶ Cloud Build ──build/push──▶ Artifact Registry
                  │ deploy                │ pull
 Custom Domain         ▼                    ▼
 blog.domain ─▶ Global LB + Cloud Armor (WAF + rate limit)
                  │ internal-ingress-only
                  ▼
        ┌──────────────────────────────────────┐
        │            Cloud Run (FastAPI)        │
        │ public blog · auth upload API ·       │
        │ audio · social cards · hidden agent   │
        └───┬──────────┬───────────┬────────────┘
            │          │           │
      ┌─────▼───┐  ┌───▼─────┐  ┌──▼──────────────┐
      │ GCS     │  │ Secret  │  │ Vertex AI       │
      │ posts/  │  │ Manager │  │ (Gemini) + TTS  │
      │ audio/  │  └─────────┘  └─────────────────┘
      │ cards/  │
      │ contact/├─finalize─▶ EventArc ─▶ Cloud Function ─▶ Email
      └─────────┘

3. Features

4. Security: First-Class, Not Bolted On

Every boundary has a control. The threat I cared most about: a public upload endpoint and a public AI endpoint are both attractive targets.

5. The Hidden AI Agent

The platform includes a hidden chat assistant (opened via a secret URL hash + access token) that answers questions about one post at a time. Its security is architectural: the agent has zero tools, so a prompt injection can make it say something off-policy but never do anything. The user supplies only a question; the server fetches and injects the single post.

6. Automated Publishing & CI/CD

Posting is a single authenticated API call — ideal for a daily cron that generates and uploads HTML. Infrastructure and app both ship through Cloud Build:

• App pipeline — on push to main: test → build → push → deploy, image pinned to the git SHA (immutable).
• Infra pipeline — Terraform plan on PR (read-only SA), apply on merge.
• Path-filtered triggers — app/** and infra/** changes run independent pipelines.

# Publish a post (what the daily automation calls)
curl -X POST https://blog.domain/api/posts \
  -H "X-API-Key: $KEY" \
  -F "file=@post.html;type=text/html" \
  -F "category=ai-ml"

7. Scalability & Reliability

8. Problems Faced

9. Future Scope

10. References

1. Cloud Run: cloud.google.com/run/docs
2. FastAPI: fastapi.tiangolo.com
3. Terraform Google Provider: registry.terraform.io
4. Cloud Build CI/CD: cloud.google.com/build/docs
5. Cloud Armor: cloud.google.com/armor/docs
6. Google ADK: google.github.io/adk-docs
7. Vertex AI (Gemini): cloud.google.com/vertex-ai/generative-ai
8. OWASP Top 10 for LLM Apps: owasp.org/.../top-10-for-llm
9. MDN — Content Security Policy: developer.mozilla.org/.../CSP
10. Secret Manager: cloud.google.com/secret-manager/docs