Most “AI app” demos skip the parts that make a product real: who is this user, whose data is this, and where does the model key live.
I got tired of that shortcut. So I built Lumen — a private Personal Gemini Journal — and deployed it on Cloud Run for the Google Cloud Gen AI Academy APAC Cohort 3 Ideathon track: Build a User-Authenticated AI Application with Custom Instructions on Google AI Studio & Cloud Run.
#AccelerateAIwithCloudRun
Live: lumen-journal on Cloud Run
Code: github.com/krabhi75/lumen-journal
The product problem
A journal is a bad place for a shared chat toy.
If two people can read the same “private” thread, the product is lying. If the Gemini key sits in a Vite env file, the product is also lying — just more quietly, until the first scrape.
The job was not “wrap Gemini in a pretty box.” The job was:
- Prove who you are.
- Keep every page under that identity.
- Call Gemini from a service you control.
- Put the key somewhere the browser never sees.
That is table stakes for any AI feature I would actually ship at work. The Ideathon just forced the stack into the open: Firebase Authentication, Cloud Firestore, Secret Manager, Gemini API, Cloud Run.
What Lumen is
You tap Continue with Google. There is no email/password form in the app. Google holds the credentials. Firebase issues an ID token.
Then you write. Free write if you need a blank page. Guided if you want questions. Decision journal if you are stuck on a call. Weekly review if you want the week named honestly.
Gemini answers in a multi-turn thread. It titles the page, tags it, and can pull a short insight. Mood and energy sit on the page as a check-in, not as a fake wellness score. On the sidebar, a mood trail shows what you actually logged — still only yours.
You can set a Gemini voice: compassionate companion, Socratic, Stoic, editor, or a custom instruction stored under your uid. That is the “custom instructions” part of the track, done as product, not as a one-off prompt in AI Studio.
Weekly Compass is the extra I cared about as a PM. Once a week, Gemini reads your titles, tags, and insights — not the internet, not other users — and returns patterns. A digest is only useful if isolation still holds.
How it is built (so judges can verify)
Browser → Google Sign-In → Firebase Auth
Browser → Firestore reads/writes at users/{uid}/interactions/{id} (rules: request.auth.uid == userId)
Browser → Cloud Run with the Firebase ID token
Cloud Run → verify ID token (Firebase Admin + ADC)
Cloud Run → Gemini API, with GEMINI_API_KEY from Secret Manager
The model path is a fallback ladder, not a single hardcoded name: 3.6 Flash → 3.1 Flash-Lite → gemini-flash-latest → 3.7 Flash → 2.5 Flash. If one model is down, the journal still tries to save a turn.
The Cloud Run service is public, labelled dev-tutorial=cloud-run-ai-challenge, region asia-south1:
https://lumen-journal-170828396338.asia-south1.run.app
Firebase Auth authorised domains include asia-south1.run.app, so Google sign-in works from that hostname. Subdomains of an authorised parent are allowed.
What never ships to the client: the Gemini API key. The browser only gets Firebase web config (apiKey here is a client identifier, not the model secret).
What I would not ship without
Owner-bound rules. Firestore security rules are the product, not a later hardening ticket. A journal that relies on “the UI hides other users” is not a journal.
JWT on the server. Every Gemini call checks the Firebase ID token. An unauthenticated /api hit should fail. That is the difference between a prototype and something you can put on a resume without wincing.
Secret Manager. Keys in Git are how demo week becomes incident week. Cloud Run injects GEMINI_API_KEY as an env var from Secret Manager. The repo’s .env is gitignored.
Rituals instead of a generic chat box. A blank composer with “chat with AI” is not a journal. The four rituals force a job-to-be-done: dump, be questioned, decide, or review. PMs should recognise that as scope control.
Walkthrough (two minutes)
- Open the live app.
- Continue with Google.
- Start a Guided entry. Write two honest sentences. Nothing confidential.
- Hit Reflect. Wait for the reply, title, and tags.
- Refresh. The thread is still there — Firestore, not localStorage theatre.
- Open Weekly Compass if you have enough of your own pages.
Source, Dockerfile, Firestore rules, and deploy scripts: krabhi75/lumen-journal.
Why this belongs on a PM blog
I am in this Academy to learn production paths, not prompt tricks.
The coffee-shop labs taught agents on Cloud Run. This Ideathon track asked for the layer those labs often leave implicit: identity, isolation, and secrets. That is the layer that decides whether an AI feature is a demo or a product.
Lumen is my answer for this sprint. PathSetu (the student mentor) is a different local problem. Same cloud habit: do not hand a model the whole internet and call it “help.”
What I would watch next, if this were a real roadmap: cold-start time on Cloud Run, sign-in popup blockers (redirect fallback), and whether Weekly Compass stays useful after twenty entries or turns into generic cheerleading. Those are product questions. The stack is already honest enough to ask them.
#AccelerateAIwithCloudRun #Firebase #Gemini #GoogleCloud