# applane-setup.sh flags

> Every flag of applane-setup.sh: --project, --group, --budget-account, --budget-amount, --extension-id, --dry-run and --check, with what --check prints.

Source: https://docs.applane.dev/reference/setup-script/

`applane-setup.sh` prepares a GCP project for Applane, or checks one. It is add-only, prints every command before running it, and deletes nothing. Works with bash 3.2 (the macOS default) and `gcloud` 400 or newer. How to use it: [Script](https://docs.applane.dev/gcp-admins/setup/script/).

```text
applane-setup.sh --project <GCP_PROJECT_ID> --group <BUILDERS_GROUP_EMAIL> [options]
applane-setup.sh --check   --project <GCP_PROJECT_ID> --group <BUILDERS_GROUP_EMAIL>
```

| Flag | Required | Meaning |
|---|---|---|
| `--project <id>` | Yes | GCP project in your Workspace organisation. |
| `--group <email>` | Yes | Google Group that may build. Gets `roles/aiplatform.user`. |
| `--budget-account <id>` | No | Billing account `XXXXXX-XXXXXX-XXXXXX`. Creates a budget alert when set. |
| `--budget-amount <n>` | No | Monthly amount for the alert. Default 50, in the billing account's currency; `50EUR` style is also accepted. |
| `--extension-id <id>` | No | The Applane extension id from the console. Only used to print the redirect URIs. Default: the `<APPLANE_EXTENSION_ID>` placeholder. |
| `--dry-run` | No | Print every command without running any. |
| `--check` | No | Verify instead of change: APIs, IAM, billing, and print the manual steps. |
| `-h`, `--help` | No | Usage. |

## What it does

1. `gcloud config set project`.
2. `gcloud services enable` for the [five APIs](https://docs.applane.dev/gcp-admins/apis/). Already-enabled APIs are a no-op.
3. `gcloud projects add-iam-policy-binding` for `roles/aiplatform.user` to `group:<BUILDERS_GROUP_EMAIL>`.
4. With `--budget-account`: enable `billingbudgets.googleapis.com` and create a budget named `applane-vertex-<GCP_PROJECT_ID>` with alerts at 50%, 90% and 100%.
5. Print the two console steps ([consent screen](https://docs.applane.dev/gcp-admins/oauth-consent-screen/), [OAuth client](https://docs.applane.dev/gcp-admins/oauth-client/)) with the redirect URIs.

## What `--check` prints

| Line | Check |
|---|---|
| `PASS API enabled: <api>` | One per API. `FAIL` prints the enable command. |
| `PASS IAM: roles/aiplatform.user -> group:<email>` | The binding exists. `FAIL` prints the binding command. |
| `PASS Billing linked to <project>` | The project has a billing account. |
| `INFO Apps Script API user setting` | Per user; cannot be checked here. [Apps Script API](https://docs.applane.dev/workspace-admins/apps-script-api/) |
| `INFO OAuth consent screen and client` | Google has no API for it. The [console's checker](https://docs.applane.dev/console/setup-checklist/) tests it. |

Exit code is non-zero when any line is `FAIL`.

## Permissions needed

`serviceusage.services.enable` and `resourcemanager.projects.setIamPolicy` on the project (owner or editor). `roles/billing.costsManager` on the billing account for the budget.