Nanobot — $0 Cost Personal AI
on Google Cloud Free Tier

#!/usr/bin/env bash
# ── Step 0: Identify the Google Cloud project ──────────────────
# Cloud Shell already knows the active project selected in GCP.
# Auto-detecting it avoids copy/paste mistakes with project IDs.
PROJECT_ID="$(gcloud config get-value project 2>/dev/null)"
ZONE="us-central1-a"        # Always Free e2-micro is region-limited; keep this zone.
# ─────────────────────────────────────────────────────

set -uo pipefail  # Keep undefined variables/pipeline errors visible, but continue for readable diagnostics.
VM_NAME="nanobot-vm" ; SA_NAME="nanobot-sa"
FAILED=0

# ── Step 1: Save a Cloud Shell log ─────────────────────────────
# Cloud Shell can disconnect or be closed. This log lives in your
# Cloud Shell home directory, so you can reopen Cloud Shell later
# and inspect what happened.
LOG_DIR="${HOME}/nanobot-logs"
mkdir -p "$LOG_DIR"
LOG_FILE="${LOG_DIR}/gcp-vm-create-$(date +%Y%m%d-%H%M%S).log"
exec > >(tee -a "$LOG_FILE") 2>&1

echo "📍  Project ID: $PROJECT_ID"
echo "📍  Zone:       $ZONE"
echo "🧾  Cloud Shell setup log: $LOG_FILE"
echo "    If Cloud Shell disconnects, reopen it and run:"
echo "    ls -lt ~/nanobot-logs && tail -n 160 ~/nanobot-logs/gcp-vm-create-*.log"
echo ""

# ── Step 2: Enable required GCP APIs ───────────────────────────
# Compute Engine API creates the VM. IAM API creates the service
# account that the VM will run as. Vertex AI API lets the VM use
# Application Default Credentials for Vertex models later.
echo "🔌  Enabling APIs (Compute + IAM + Vertex AI)…"
if ! gcloud services enable compute.googleapis.com iam.googleapis.com aiplatform.googleapis.com --project="$PROJECT_ID" 2>&1; then
  echo "❌ Failed to enable APIs. Check your project ID and billing status." >&2
  FAILED=1
else
  echo "   ↳ APIs confirmed."
fi

# ── Step 3: Create a least-privilege service account ───────────
# The VM uses this identity for Application Default Credentials.
# It receives Vertex AI User only: enough to call Vertex models,
# but not enough to administer Compute, IAM, Storage, or Secrets.
echo "🔐  Creating dedicated service account…"
if gcloud iam service-accounts create "$SA_NAME" \
  --display-name="Nanobot SA — Vertex AI only" \
  --project="$PROJECT_ID" 2>&1; then
  echo "   ↳ Service account created."
else
  echo "   ↳ Service account may already exist; continuing."
fi
SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

if [ $FAILED -eq 0 ]; then
  echo "🎯  Granting Vertex AI User to $SA_EMAIL…"
  if ! gcloud projects add-iam-policy-binding "$PROJECT_ID" \
    --member="serviceAccount:${SA_EMAIL}" \
    --role="roles/aiplatform.user" \
    --condition=None >/dev/null 2>&1; then
    echo "❌ Failed to grant Vertex AI User role." >&2
    FAILED=1
  else
    echo "   ↳ Vertex AI permission confirmed."
  fi
fi

if [ $FAILED -eq 0 ]; then
  # ── Step 4: Prepare first-boot startup script ────────────────
  # The free-tier e2-micro has limited RAM. This script runs once
  # on first boot and adds a 2 GB swap file so installs and small
  # agent workloads are less likely to be killed by low memory.
  echo "🖥️   Creating free-tier VM (with swap auto-configured on first boot)…"

  # Write startup script to temp file (configures 2GB swap on first boot)
  cat > /tmp/startup.sh << 'STARTUP_EOF'
#!/bin/bash
# Persist startup diagnostics on the VM boot disk. This can be read
# later with: sudo tail -n 160 /var/log/nanobot-startup.log
exec > >(tee -a /var/log/nanobot-startup.log) 2>&1
echo "[$(date -Is)] Nanobot VM startup script started"
if [ ! -f /swapfile ]; then
  echo "Creating 2 GB swap file..."
  fallocate -l 2G /swapfile && chmod 600 /swapfile
  mkswap /swapfile && swapon /swapfile
  echo "/swapfile none swap sw 0 0" >> /etc/fstab
  sysctl -w vm.swappiness=10
  echo "vm.swappiness=10" >> /etc/sysctl.conf
else
  echo "Swap file already exists; leaving it unchanged."
fi
free -h || true
echo "[$(date -Is)] Nanobot VM startup script finished"
STARTUP_EOF

  # ── Step 5: Create the VM ────────────────────────────────────
  # e2-micro + Debian + standard 10 GB boot disk are chosen for
  # Google Cloud's free-tier constraints. cloud-platform scope lets
  # Google client libraries request tokens; IAM still restricts the
  # service account to Vertex AI User only. block-project-ssh-keys
  # keeps SSH access scoped to this instance rather than inheriting
  # every project-level SSH key.
  if ! gcloud compute instances create "$VM_NAME" \
    --project="$PROJECT_ID" \
    --zone="$ZONE" \
    --machine-type=e2-micro \
    --image-project=debian-cloud \
    --image-family=debian-12 \
    --boot-disk-size=10GB \
    --boot-disk-type=pd-standard \
    --boot-disk-auto-delete \
    --service-account="$SA_EMAIL" \
    --scopes=https://www.googleapis.com/auth/cloud-platform \
    --metadata=block-project-ssh-keys=true \
    --metadata-from-file=startup-script=/tmp/startup.sh 2>&1; then
    echo "❌ VM creation failed. See error above." >&2
    FAILED=1
  fi

  rm -f /tmp/startup.sh
fi

echo ""
echo "════════════════════════════════════════════"
if [ $FAILED -eq 0 ]; then
  echo "✅  VM ready! 2 GB swap will be live by the time you SSH in."
  echo "════════════════════════════════════════════"
  echo ""
  echo "▶  SSH into your VM:"
  echo "   gcloud compute ssh $VM_NAME --zone=$ZONE --project=$PROJECT_ID"
  echo ""
  echo "▶  VM startup/swap log from Cloud Shell:"
  echo "   gcloud compute instances get-serial-port-output $VM_NAME --zone=$ZONE --project=$PROJECT_ID --port=1 | tail -n 200"
else
  echo "❌  Setup incomplete — review errors above"
  echo "════════════════════════════════════════════"
  echo ""
  echo "Common fixes:"
  echo "  • Wrong PROJECT_ID → verify in GCP Console"
  echo "  • Billing not enabled → console.cloud.google.com/billing"
  echo "  • VM already exists → delete it first or use a different name"
  echo ""
  echo "Cloud Shell will stay open so you can review the errors."
fi
echo ""
echo "▶  Cloud Shell setup log saved at: $LOG_FILE"
echo ""