이 가이드는 서버 측 태그 지정에 Cloud Run을 사용하여 비공개 미리보기 서버를 설정하려고 하는 개발자를 위한 가이드입니다.
서버 측 태그 지정을 사용하면 태그 지정 변경사항을 적용하기 전에 미리보기 및 디버그 모드에서 미리 볼 수 있습니다. 이 단계는 개발 워크플로에서 태그가 의도대로 작동하는지 확인하기 위한 중요한 부분입니다. 이 기능을 사용 설정하려면 태그 관리 서버용 하나, 미리보기 서버용 하나 등 두 개의 Cloud Run 배포가 필요합니다.
이 가이드에서는 두 서버가 커뮤니케이션하는 방법 및 엔터프라이즈 환경에서 서버를 구성하는 방법을 자세히 설명합니다.
개요
서버 측 태그 지정을 Cloud Run에 배포할 때 부하 분산기를 사용하거나 사용하지 않고 배포할 수 있습니다. 멀티 리전 배포의 경우 트래픽을 가장 가까운 인스턴스로 유도하기 위해 부하 분산기가 필요합니다.
부하 분산기를 사용하지 않음
그림 1: 부하 분산기를 사용하지 않는 배포
부하 분산기 사용
그림 2: 부하 분산기를 사용한 배포
두 배포에서 미리보기 서버와 프로덕션 태그 지정 환경의 진입점은 동일한 URL(예: sgtm.example.com)입니다. 태그 관리 서버는 미리보기 서버의 URL을 나타내는 PREVIEW_SERVER_URL이라고 하는 환경 변수를 사용하여 배포됩니다.
tagmanager.google.com을 방문하여 미리보기 서버를 열면 태그 관리자가 sgtm.example.com?id=[gtm_server_id]>m_auth=[auth_id]>m_preview=[env_id]로 이동하여 쿠키를 설정합니다. 그런 다음 동일한 브라우저를 사용하여 대상 웹사이트를 살펴보면 sgtm.example.com에 전송된 요청도 쿠키를 전달합니다. 쿠키 때문에 태그 관리 서버에서 이 이벤트가 사용자의 이벤트임을 알게 되므로, 사용자가 보고 문제를 해결할 수 있도록 이벤트를 미리보기 서버에만 전달합니다.
태그 관리 서버는 PREVIEW_SERVER_URL 환경 변수에 설정된 URL에 HTTP 요청을 보내 이러한 이벤트를 전달합니다.
공개용 미리보기 서버에 대한 정보
이 기본 동작을 실행하려면 미리보기 서버를 공개해야 합니다. 하지만, 일부 조직의 경우 공개할 수 있는 인프라에 대한 제한이 있고 일반적으로 부하 분산기를 통해 보안 조치가 적용되므로 미리보기 서버를 공개하는 데 문제가 있습니다. 부하 분산기는 다음과 같은 기능을 제공합니다.
암호화 스위트를 제한하기 위한 SSL 정책과 같은 더 세부적인 관리 기능
웹 애플리케이션 방화벽(WAF) 또는 DDoS에 대한 Cloud Armor와 기본 통합.
고급 트래픽 측정 기능
부하 분산기를 통해 미리보기 서버 라우팅
비공개 미리보기 서버를 만들려면 추가 하위 도메인이 있는 부하 분산기를 통해 호스트 기반 라우팅을 사용하세요. 이 가이드의 나머지 부분에서는 부하 분산기를 통해 미리보기 서버를 라우팅하는 방법을 설명합니다.
[null,null,["최종 업데이트: 2024-04-17(UTC)"],[[["\u003cp\u003eThis guide details how to set up a private preview server for server-side tagging in Google Tag Manager using Cloud Run.\u003c/p\u003e\n"],["\u003cp\u003eA private preview server enhances security by routing traffic through a load balancer with host-based routing and an additional subdomain.\u003c/p\u003e\n"],["\u003cp\u003eThe setup involves updating environment variables, configuring the load balancer, and adjusting ingress control for the preview server.\u003c/p\u003e\n"],["\u003cp\u003eThis approach allows developers to preview tagging changes in a secure environment before applying them to the production tagging server.\u003c/p\u003e\n"],["\u003cp\u003ePath-based routing is not recommended as it may prevent events from reaching the correct destination; host-based routing provides better separation.\u003c/p\u003e\n"]]],["This guide details how to configure a private preview server for server-side tagging in Cloud Run. It focuses on routing traffic through a load balancer to restrict public access to the preview server. Key actions include updating the tagging server's `PREVIEW_SERVER_URL` environment variable to a new subdomain (e.g., `preview.sgtm.example.com`), configuring the load balancer for host-based routing, creating a new backend service, updating the ingress control for the preview server to internal and test the configuration.\n"],null,["# Set up a private preview server\n\n\u003e This guide is for developers using [Cloud Run](https://console.cloud.google.com/run) for server-side tagging who want\n\u003e to set up a private preview server.\n\nServer-side tagging lets you [preview](/tag-platform/tag-manager/server-side/debug) tagging changes in preview and debug mode\nbefore applying them. This is a critical part of the development workflow to\nensure your tags behave as intended. To enable this capability requires two\nCloud Run [deployments](/tag-platform/tag-manager/server-side/cloud-run-setup-guide.): one for a tagging server and one for a preview server.\nThis guide provides more information on how the two servers communicate and how\nyou can configure them in an enterprise environment.\n\nOverview\n--------\n\nWhen you deploy server-side tagging to Cloud Run you can deploy it with or\nwithout a load balancer. For multi-region deployments, you need a load balancer\nto direct traffic to the nearest instance. \n\n### Without load balancer\n\n\n*Figure 1: Deployment without a load balancer.*\n\n### With load balancer\n\n\n*Figure 2: Deployment with a load balancer.*\n\nIn both deployments, the entry point for both the preview server and production\ntagging environment is the same URL (for example, `sgtm.example.com`). The\ntagging server is deployed with an environment variable called\n`PREVIEW_SERVER_URL` which represents the URL of the preview server.\n\nWhen you visit `tagmanager.google.com` and open preview mode, Tag Manager\nnavigates to\n`sgtm.example.com?id=[gtm_server_id]>m_auth=[auth_id]>m_preview=[env_id]`\nand sets a cookie. When you then use the same browser to explore the target\nwebsite, requests sent to `sgtm.example.com` also forward the cookie. Because\nof the cookie, the tagging server knows these are your events, so it only\nforwards your events on to the preview server for you to view and troubleshoot.\n\nThe tagging server forwards these events by making HTTP requests to the URL set\nin the `PREVIEW_SERVER_URL` environment variable.\n\n### About public-facing preview servers\n\nThis default behavior requires your preview server to be public. However, this\nis problematic for some organizations as they have restrictions about what\ninfrastructure can be public facing and usually enforce additional security\nmeasures through a load balancer. A load balancer gives you:\n\n- More control over features such as SSL policies to restrict cipher suites.\n- Native integration with Cloud Armor for web-application firewall (WAF) or distributed denial-of-service (DDoS).\n- Advanced traffic-management capabilities.\n\nRoute your preview server through a load balancer\n-------------------------------------------------\n\nTo create a private preview server, use host-based routing through the load\nbalancer with an additional subdomain. The rest of this guide explains how to\nroute your preview server through a load balancer.\n\n### Prerequisites\n\n- Tagging server is [deployed](/tag-platform/tag-manager/server-side/cloud-run-setup-guide.) on Cloud Run behind a load balancer.\n- Access to the Google Cloud project.\n- Access to a new subdomain for the preview server, for exaple, `preview.sgtm.example.com`.\n\n### Step 1: Update the environment variable with a new subdomain\n\nTo use the new preview server domain, update the\nserver-side tagging server environment variable `PREVIEW_SERVER_URL`:\n\n1. Open [Cloud Run](https://console.cloud.google.com/run).\n2. Select the tagging server.\n3. Click **Edit** and **Deploy new revision**.\n4. Under the **Variables and secrets** tab, in the **Containers** section, change the `PREVIEW_SERVER_URL` to the new domain. For example: `preview.sgtm.example.com`.\n\n### Step 2: Configure the existing load balancer to use host-based routing\n\nTo configure the existing load balancer, use host-based routing and send\ntraffic to the correct server:\n\n1. In Cloud Run, open the [Load balancing](https://console.cloud.google.com/net-services/loadbalancing/list/loadBalancers) page and click the name of your load balancer.\n2. Click the **Edit** button.\n3. Click the **Backend configuration** page and open the drop down for **Backend services and backend buckets**.\n4. Click **Create a backend service** and complete the following:\n 1. Give it an appropriate name (for example, `preview-backend-service`).\n 2. Select the backend type as **Serverless network endpoint group**.\n5. In the **Backend** section, create a new serverless network endpoint group and complete the following:\n 1. Give it a name and select the region where the preview server is hosted.\n 2. Select **Cloud Run** as the serverless network endpoint group type, and the preview server as the service.\n 3. Click **Create**.\n6. Change other settings as needed, or keep the defaults, and click **Create**.\n\n### Step 3: Add a new rule and update the ingress control\n\nTo add a rule for the new host URL and update the ingress control:\n\n1. Open the **Host and path rules** page.\n2. Add a new rule where:\n - The host is the new URL: `preview.sgtm.example.com`\n - The path is: `/*`\n - The backend is: `preview-backend-service`\n3. Click the **Update** button to redeploy the load balancer.\n4. Back in [Cloud Run](https://console.cloud.google.com/run) open the preview server, and select the **Networking** tab.\n5. Change the **Ingress control** to **Internal** and check **Allow traffic from external application load balancers** so that it isn't publicly accessible.\n\n**Result** : Your server architecture should now look like *Figure 3*, where traffic requests are all\ndirected to the tagging server, and the tagging server is able to forward\nrequests to the preview server.\n\n*Figure 3: Using host-based routing.*\n| **Note:** You can't use path-based routing, for example, mapping `/gtm/debug` to `preview-backend-service`. Using this method you can view the debug window but can't see the events comes through. This is because the tagging server forwards events to other paths, and these can't get to the correct end destination. The host provides a clear separation between the two destinations.\n\nCheck your configuration\n------------------------\n\nTo check your configuration:\n\n1. [Open Google Tag Manager](https://tagmanager.google.com/#/home).\n2. Open your server container.\n3. Click **Admin \\\u003e Container settings** and set the server container URL to the tagging server URL.\n4. Close the window and preview the workspace. The debug window opens. As you navigate your website, your events should appear in the debug window.\n\nRelated links\n-------------\n\n- [Set up server-side tagging with Cloud Run](/tag-platform/tag-manager/server-side/cloud-run-setup-guide?provisioning=ui)\n- [Enable region specific behavior in server-side tagging](/tag-platform/tag-manager/server-side/enable-region-specific-settings#CloudRun)"]]
