[AI in Practice] Deploying Song Lingo to Cloud Run: Making a Private Lyrics Website Just for Me

In the previous post, the author used Gemini 3.8 Flash TTS to build Song Lingo, a website that pastes a YouTube MV URL and transcribes the lyrics, adds furigana, translation, and grammar notes, and reads it line by line using a teacher designed via voice design. The website has only run on the author's computer, but the goal of this post is to move it to Cloud Run so it can be used on mobile.

The author acknowledges that the website contains full lyrics and translations, and moving it public has two practical consequences: copyright and cost. To ensure the website remains private and only accessible to the author, they compared two solutions: using IAP + In-app Verification and no external access, using gcloud run services proxy.

They chose the former solution because it allows for a login function and ensures that only the author's account can access the lyrics and APIs at every layer, from start to finish. The author initially planned to use signed URLs to store audio files in GCS and generate short-lived signed URLs for playback, but they realized this was a vulnerability.

Instead, they decided to read the audio files directly through Cloud Run and send them to the browser, with IAP and in-app verification in place before playback. This extra hop adds negligible traffic cost. The architecture consists of a single container image containing both Node 22 and Python, with the song data and audio stored in a private Cloud Storage bucket mounted as the /data folder.

The API key is provided as an environment variable, and access control is enforced using IAP and in-app verification. The author uses four layers of protection: Cloud Run permissions, IAP, in-app verification, and a private bucket. Any failure in these layers prevents access, even if the others hold.