GitHub

Dev Windows VM

Spin up a temporary Windows dev box on GCP for building and debugging HealthAlign PMS apps. The image comes pre-loaded with the build toolchain — Visual Studio, the .NET SDK, SQL Server (+ SSMS) — plus the Claude Code CLI, git, GitHub CLI, and gcloud, so you can clone, build, and debug without setting anything up.

Run the commands below from an infrahive checkout. Project prj-bu1-d-homealign-infra-3789, default zone us-central1-a. Full option list: src/scripts/gcp_dev_win_vm/README.md (in the repo, not rendered in this docs site).

Prerequisites: gcloud auth login; membership in sg-developers@thehelperbees.com (grants compute + IAP-tunnel access); read access to the CrowdStrike secrets in prj-c-secrets-a7cc.

Spin up a VM

./zig/zig build scripts -- gcp_dev_win_vm

Clones the newest machine image in the project (fast — the toolchain is already baked in), installs CrowdStrike on first boot, and prints ready-to-paste SSH/RDP commands with the VM’s name.

  • Temporary by design. Every VM gets an expiration label, 12 hours out by default, and a scheduled job tears down expired VMs automatically. Need it longer? Set the window when you create (hours; max 3 months; 0 = the maximum): 
    ./zig/zig build scripts -- gcp_dev_win_vm --expiration 48
    Tear it down yourself when you’re done rather than leaving it for the reaper (see below).
  • Log in with your own credentials. The image has no personal logins baked in. Once connected, authenticate as yourself: 
    gh auth login          # GitHub
claude login           # Claude Code CLI  (or set $env:ANTHROPIC_API_KEY)

Connect

SSH and RDP both go over an IAP tunnel — the reliable path (no firewall/IP setup needed).

SSH (shared team key)

Start the tunnel in one shell:

gcloud compute start-iap-tunnel <vm-name> 22 --local-host-port=localhost:2222 \
  --zone us-central1-a --project prj-bu1-d-homealign-infra-3789

In another shell, pull the shared team key into a temporary file, SSH, then delete it — don’t leave the shared private key sitting on disk:

key=$(mktemp)                                          # 0600 by default
(umask 077; gcloud secrets versions access latest --secret terraform_ssh_private_key \
  --project prj-bu1-d-homealign-infra-3789 > "$key")
ssh -i "$key" -p 2222 gcpdevadmin@localhost
rm -f "$key"

Remote Desktop

gcloud compute start-iap-tunnel <vm-name> 3389 --local-host-port=localhost:13389 \
  --zone us-central1-a --project prj-bu1-d-homealign-infra-3789

Point your RDP client at localhost:13389 and log in as gcpdevadmin — the shared image account. Read its username + password from Secret Manager in the GCP Console (don’t print the shared secret to your terminal):

Secret Manager → gcp-dev-win-vm-admin-user → latest version → View secret value, in project prj-bu1-d-homealign-infra-3789 (console.cloud.google.com/security/secret-manager/secret/gcp-dev-win-vm-admin-user/versions?project=prj-bu1-d-homealign-infra-3789).

Alternatively, generate your own per-user Windows login (no shared secret): gcloud compute reset-windows-password <vm-name> --user=<you> --zone us-central1-a --project prj-bu1-d-homealign-infra-3789.

Tear down when done

./zig/zig build scripts -- gcp_dev_win_vm --teardown <vm-name>

Expired VMs are reaped automatically by a scheduled job, but tear yours down as soon as you’re finished — it frees a slot (there’s a 5-VM cap) and stops the clock.

Build a new base image

When the toolchain needs refreshing (newer Visual Studio / SQL Server / SDK, or more pre-installed software), build a fresh base VM and capture it — future spin-ups pick up the newest image automatically.

  1. Create a clean base VM, without CrowdStrike: 
    ./zig/zig build scripts -- gcp_dev_win_vm --create-vm --no-crowdstrike
    --create-vm provisions from the stock Windows image (not a clone). --no-crowdstrike keeps the Falcon sensor off the image on purpose: a sensor carries a unique Agent ID (AID), so if it were baked in, every clone would report as the same host in Falcon. Leaving it out means each clone installs its own sensor on first boot and gets a unique AID.
  2. Customize it. RDP/SSH in and install what you need (Visual Studio, SQL Server, SSMS, …). Do not sign into personal accounts (gh, gcloud, GitHub Desktop, Claude) — those tokens would be baked into the image for every teammate.
  3. Stop it (for a clean disk snapshot), then capture: 
    gcloud compute instances stop <base-vm> --zone us-central1-a --project prj-bu1-d-homealign-infra-3789
./zig/zig build scripts -- gcp_dev_win_vm --save-image dev-win-buildbox-YYYY-MM-DD --from-vm <base-vm>
  4. Use it. A plain spin-up now clones this newest image, or target it explicitly: 
    ./zig/zig build scripts -- gcp_dev_win_vm --from-image dev-win-buildbox-YYYY-MM-DD
Edit this page