Static site on Cloud Storage behind an HTTPS load balancer, API on the same origin
The static site is served from a Cloud Storage bucket behind Google’s HTTPS load balancer, which also routes /api to Cloud Run, so the site and its API share one origin.
Context
Options were Firebase Hosting (free, but its rewrites to Cloud Run buffer responses, which breaks server-sent events, and impose a 60-second limit), Cloudflare Pages (free, outside GCP), or a Cloud Storage bucket behind Google's external Application Load Balancer (~$18–20/month for the forwarding rule).
Decision
Cloud Storage bucket + Cloud CDN behind the HTTPS load balancer with a Google-managed certificate. The same
URL map sends /api/* to the Cloud Run service through a serverless network endpoint group.
Consequences
- One origin: no CORS, first-party cookies for the admin session, SSE streams pass through unbuffered.
- Hashed assets are cached immutably at the edge; HTML is served with a short TTL.
- A fixed monthly cost for the load balancer — accepted for the cleaner architecture.