Set up server-side tagging with Cloud Run

This guide explains how to:

Provision a preview server to enable the preview feature for the container.
Provision a tagging server to handle live traffic.
Increase or decrease the number of servers that are running your Google Tag Manager container.
Keep your tagging server version updated after provisioning the server.

Prerequisites

You need a GCP account. If you don't have one, create a new GCP account.
You need a GCP billing account. If you don't have one, create a GCP billing account (requires the Billing Account Creator role).
You need the Project Creator and the Billing Account User role. Learn more about adding roles.

Provision a preview and tagging server

You can provision a Cloud Run service either automatically in Google Tag Manager or manually in Google Cloud.

Create a Google Tag Manager server container

Open Google Tag Manager.
In the account row, click on the overflow menu > Create Container.
Create a new server container.
Click the "Manually provision tagging server" radio button. Note the container config. You'll need it to provision your server.

Create a new GCP project

To create a new GCP project for your tagging server:

Open Google Cloud Console.
Create a new GCP project.
Name your project. We recommend using your container ID for convenience. This name is used only within GCP.
Note the GCP project ID, because you will need it to create your tagging server.

Provision a new preview and tagging server

You can provision a Cloud Run service either via the command line (CLI) or in the user interface. Both steps involve provisioning both a tagging and a preview server. The tagging server runs your container and handles live traffic while the preview server enables you to preview the server container.

To create your preview and tagging servers:

Command Line

Open the Cloud Shell.
Set the GCP project in the Cloud Shell. Replace project ID with the GCP project ID that you noted earlier:
```
gcloud config set project project ID
```

Set up your tagging server and your preview server by running the following commands. If there is an existing deployment, the commands will let you change the configuration by creating a new revision and shifting traffic to the new revision.

Replace REGION with a supported Cloud Run region closest to your customers.
Replace CONTAINER_CONFIG with the container config string from Tag Manager.

gcloud run deploy "server-side-tagging-preview" \
--region REGION \
--image gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable \
--min-instances 0 \
--max-instances 1 \
--timeout 60 \
--allow-unauthenticated \
--no-cpu-throttling \
--update-env-vars \
RUN_AS_PREVIEW_SERVER=true,CONTAINER_CONFIG="CONTAINER_CONFIG" &&

gcloud run deploy "server-side-tagging" \
--region REGION \
--image gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable \
--platform managed \
--ingress all \
--min-instances 2 \
--max-instances 10 \
--timeout 60 \
--allow-unauthenticated \
--no-cpu-throttling \
--update-env-vars PREVIEW_SERVER_URL="$(
gcloud run services describe server-side-tagging-preview --region "REGION" \
--format="value(status.url)")",CONTAINER_CONFIG="CONTAINER_CONFIG"

User Interface

Open Cloud Run.
Preview server: To create the service for a preview server, click Create service and set the following settings:
1. Select Deploy one revision from an existing container image.
  
  Container image: gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable
2. Service name: server-side-tagging-preview
3. Region: Select the location closest to your customers.
4. CPU allocation: Set to CPU is always allocated.
5. Autoscaling: Set minimum instances to 0 and maximum instances to 1.
  
  Warning: On a preview server, you can have one instance at most. If you set maximum instances to more than one, the preview feature breaks.
6. Ingress: Select Allow all traffic.
7. Authentication: Select Allow unauthenticated invocations.
8. Expand the Container, Connections, Security section. In the Container tab, under Capacity, set
  1. Memory = 512 MiB
  2. CPU = 1
  3. Request timeout = 60
  In the Container tab, under Environment variables, add the following variables:
  1. Name: RUN_AS_PREVIEW_SERVER Value: true
  2. Name: CONTAINER_CONFIG Value: Your Tag Manager server container configuration string.
Click Create to deploy the image to Cloud Run and wait for the deployment to finish.
Note the preview server URL. You will need it for deploying the tagging server.
Tagging server: To create the service for a tagging server, click Create service and set the following settings:
1. Select Deploy one revision from an existing container image.
  
  Container image: gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable
2. Service name: server-side-tagging
3. Region: Select the location closest to your customers.
4. CPU allocation: Set to CPU is always allocated.
5. Autoscaling: Set minimum instances to 2 and maximum instances to 10.
  
  Note: Autoscaling adjusts the number of servers automatically when traffic increases or decreases, see Cloud Run cost. We expect this to handle 35-350 requests per second.
6. Ingress: Select Allow all traffic.
7. Authentication: Select Allow unauthenticated invocations.
8. Expand the Container, Connections, Security section. In the Container tab, under Capacity, set
  1. Memory = 512 MiB
  2. CPU = 1
  3. Request timeout = 60
  In the Container tab, under Environment variables, add the following variables:
  1. Name: PREVIEW_SERVER_URL Value: Your preview server's URL.
  2. Name: CONTAINER_CONFIG Value: Your Tag Manager server container configuration string.
Click Create to deploy the image to Cloud Run and wait for the deployment to finish.

Result: You've created a preview and tagging server to manage your Google Tag Manager server container.

Edit the service configuration

To change your service configuration:

Open Cloud Run.
Select the service you need to adjust.
Click Edit & Deploy New Revision.
Make changes and click Deploy.

Cloud Run cost

In this Cloud Run configuration, each server costs approximately $45 /month (USD). Each server is a Cloud Run instance with 1 vCPU and 0.5GB memory using the CPU always allocated pricing model.

We recommend running a minimum of 2 instances to reduce the risk of data loss in case of a server outage. However, you may choose to run fewer (or more) servers. We expect that autoscaling 2-10 servers will handle 35-350 requests per second, though the performance will vary with the number of tags, and what those tags do.

Cloud Run will dynamically scale with load. The max-instances setting is the worst case scenario for how much you will need to pay for resources. Cloud Run won't provision that many instances unless necessary.

Cloud Run calculator

Optional: Migrating from App Engine

If you previously created an App Engine deployment and have verified that it is no longer receiving any traffic, disable the App Engine application to prevent unexpected billing charges.

Optional: Multi-region deployment

If your website has a global presence or you would like to build redundancy into the service, deploy the tagging servers to multiple regions.

Before you start:

Create a load balancer
Note your chosen BACKEND_NAME.

To add more regions to your deployment:

Replace REGION with the region where the preview server is deployed. This may already be filled out if you followed the command line options to provision the preview and tagging server.
Replace CONTAINER_CONFIG with container config string from Tag Manager. This may already be filled out if you followed the command line options to provision the preview and tagging server.
Replace NEW_REGION with the new region where you would like the tagging server to be deployed.
Replace BACKEND_NAME with the name you chose while provisioning the load balancer.
Optional: To add another region, substitute NEW_REGION variable and the re-run the code snippet.

    gcloud run deploy "server-side-tagging" \
    --region NEW_REGION \
    --image gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable \
    --platform managed \
    --ingress all \
    --min-instances 2 \
    --max-instances 10 \
    --timeout 60 \
    --allow-unauthenticated \
    --no-cpu-throttling \
    --update-env-vars PREVIEW_SERVER_URL="$(
      gcloud run services describe server-side-tagging-preview \--region "REGION" \
      --format="value(status.url)")",CONTAINER_CONFIG="CONTAINER_CONFIG" && \

    gcloud compute network-endpoint-groups create server-side-tagging-neg \
    --region=NEW_REGION \
    --network-endpoint-type=SERVERLESS \
    --cloud-run-service="server-side-tagging" && \

    gcloud compute backend-services add-backend --global "BACKEND_NAME" \
    --network-endpoint-group-region=NEW_REGION \
    --network-endpoint-group=server-side-tagging-neg

Optional: Disable logging

Request logging

By default, information about every single request (e.g. request path, query parameters, etc) is logged. If your tagging server handles a lot of requests per month (e.g. greater than 1 million), those log messages may incur significant logging charges. To reduce or eliminate the logging charges, we recommend disabling the request logging.

To disable request logging:

In Google Cloud platform, open the Logs Router. Make sure you're in the project that matches your container ID:
For the Type: Cloud Logging bucket, Name: _Default line, select the overflow menu, then click Edit Sink.
Under Sink destination, select logs bucket _Default.
Under Choose logs to include in sink, add a new line. Enter the following rule to the existing inclusion filter:
```
NOT LOG_ID("run.googleapis.com/requests")
```
To also disable logging from the load balancer, add a new line and enter the following rule to the existing inclusion filter:
```
NOT LOG_ID("requests")
```
Note: This will disable all logging from the load balancer, including requests that are not sent to the server container.
Update Sink to apply the changes. Now the requests will be excluded from logging.
Verify that no new requests are appearing in the Logs Explorer logs.

Console logging

The tagging server, clients, or tags in a container can log messages to console that may incur logging charges. To reduce or eliminate the logging charges, you can disable unwanted console log messages.

Identify unwanted console logs:

In GCP, open the Logs Explorer.
Look for any unwanted log messages that originate from your tags. For example:

A tag might send the following logs:
```
const logToConsole = require('logToConsole');

logToConsole('Custom message: ' + data.param1);
logToConsole('An important message to keep around!');
data.gtmOnSuccess()
```
Look for the corresponding log messages in the textPayload field:

To disable console log message:

In Google Cloud platform, open the Logs Router. Make sure you're in the project that matches your container ID:
For the Type: Cloud Logging bucket, Name: _Default line, select the overflow menu, then click Edit Sink.
Under Sink destination, select logs bucket _Default.
Under Choose logs to include in sink, add a new line. Enter the following rule to the existing inclusion filter:
```
NOT textPayload:"Custom message:"
```
For your console logs, replace the Custom message: text with a substring from console log you wish to disable. For more elaborate filters, utilize the logging query language.
Update Sink to apply the changes. The matching logToConsole message should be excluded from logging.
Verify that no new console log messages are appearing in the Logs Explorer.

2. Map the deployment to your custom domain

To set up a custom domain, use a global external Application Load Balancer.

3. Add the server URL to Google Tag Manager

Now that you have a server, you need to make sure that Google Tag Manager knows it should use your server.

Open Google Tag Manager.
Click on the server container you want to point to your tagging server.
Open your server container settings in the Admin tab > Container Settings.
Click Add URL and paste your server URL.
Save and go back to your workspace.

4. Validation

Now that you've set up your tagging server, make sure that it works as intended. In your Tag Manager workspace, click the Preview button. If the preview page loads, then everything is set up correctly.

Previewing multiple URLs

If you have mapped multiple domains to a single tagging server, make sure each URL is added to the container settings.

If you provided multiple URLs, all paths (the string after the domain name) must match.

Works	Does not work
URL 1: `example.com/abc` URL 2: `example2.com/abc`	URL 1: `example.com/abc` URL 2: `example2.com/def`

If multiple URLs are added, you will see an icon next to the Preview button that allows you to select the URL to preview.

Update the tagging server version

New tagging server updates contain security vulnerability fixes and new features. We recommend at least updating your tagging server for each major version release (e.g. upgrading from version 1.x.x to 2.x.x) when Tag Manager notifies you to update.

To update your tagging server, deploy a new revision using the same settings you used previously.

Open Cloud Run.
Select the service you want to update.
Click Edit & Deploy New Revision.
Make sure the Container image URL is set to gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable and click Deploy.

To verify that the update was successful:

In your server container, click the Preview button to start a new debug session and send a request on a separate tab.
In the Summary, select the Console tab and make sure there are no messages asking you to update the tagging server.

Tag Manager may show messages asking you to update your tagging server for up to a day after the server has been updated successfully. However, the preview page will show an up to date message about the tagging server version.