EvolutionAPI on Google Cloud Run

Evolution API is an open-source Node.js WhatsApp Business API gateway (built on the Baileys library) that provisions WhatsApp instances, sends and receives messages, and exposes a REST API plus a manager UI for wiring WhatsApp into other systems. This module deploys Evolution API on Cloud Run v2 on top of the App_CloudRun foundation, which provisions and manages the shared Google Cloud infrastructure.

This guide focuses on the cloud services Evolution API uses and how to explore and operate them from the Google Cloud Console and the command line. For the mechanics common to every Cloud Run application — service identity, ingress and load balancing, scaling and concurrency, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC Service Controls, backups, and the deployment lifecycle — refer to the App_CloudRun foundation guide rather than repeating them here.

1. Overview

Evolution API runs as a Node.js container on Cloud Run v2. The deployment wires together a focused set of Google Cloud services:

Capability	Google Cloud service	Notes
Compute	Cloud Run v2	Node.js service, 2 vCPU / 4 GiB by default; pinned to a single always-warm instance
Database	Cloud SQL for PostgreSQL 15	Required — Evolution API uses Prisma against PostgreSQL only
Cache	Redis	Enabled by default (`CACHE_REDIS_URI`); caches instance/message state
Object storage	Cloud Storage	A dedicated data bucket provisioned automatically
Secrets	Secret Manager	Auto-generated `AUTHENTICATION_API_KEY`; database password
Ingress	Cloud Run URL / Cloud Load Balancing	Default `run.app` URL (public); optional external HTTPS LB + custom domain

Sensible defaults worth knowing up front:

PostgreSQL 15 is mandatory. The database engine is fixed by the shared application layer; Evolution API uses Prisma and does not support other engines.
The service is pinned to a single instance (min_instance_count = 1, max_instance_count = 1). Evolution API holds live WhatsApp (Baileys) socket sessions in memory, per-instance; those sessions are not shared across replicas, so scaling out fragments live connections and one instance must stay warm. Do not raise max_instance_count.
AUTHENTICATION_API_KEY is generated automatically and stored in Secret Manager. It is Evolution API's global admin key and must never be rotated after first boot — rotating it makes already-provisioned WhatsApp instances unreachable and returns 401 to every client still holding the old key.
Redis is enabled by default (enable_redis = true). Leave redis_host empty to use the NFS server VM's IP as the Redis endpoint (requires enable_nfs = true), or point it at an explicit managed instance.
Public ingress is the default (ingress_settings = "all") so external systems can reach webhook endpoints and the manager UI. Enabling IAP blocks those external calls.
Memory defaults to 4 GiB — Evolution API needs at least 2 GiB for reliable operation.
SERVER_URL is defaulted to the actual service URL at runtime by the container entrypoint, so QR-code and webhook callback URLs reflect the real Cloud Run address.

2. Google Cloud Services & How to Explore Them

All commands assume PROJECT and REGION are set. Service and resource names are reported in the deployment Outputs.

A. Cloud Run — the Evolution API service

Evolution API runs as a Cloud Run v2 service pinned to a single instance. Each deployment creates an immutable revision; traffic can be split across revisions for safe rollouts.

Console: Cloud Run → select the service for revisions, traffic, logs, and metrics.

CLI:

gcloud run services list --project "$PROJECT" --region "$REGION" \
  --filter="metadata.name~evolutionapi"
gcloud run services describe <service-name> --project "$PROJECT" --region "$REGION"
gcloud run revisions list --service <service-name> --project "$PROJECT" --region "$REGION"

See App_CloudRun for scaling, concurrency, execution environment, and traffic splitting.

B. Cloud SQL for PostgreSQL 15

Evolution API stores all application data (WhatsApp instances, contacts, chats, message history) in a managed Cloud SQL for PostgreSQL 15 instance. The service connects privately through the Cloud SQL Auth Proxy over a Unix socket; no public IP is exposed. On first deploy an initialization Job creates the application database and user; Prisma migrations then create the schema on container boot.

Console: SQL → select the instance for connections, backups, flags, metrics.

CLI:

gcloud sql instances list --project "$PROJECT"
gcloud sql instances describe <instance-name> --project "$PROJECT"
gcloud sql connect <instance-name> --user=evolution --database=evolution --project "$PROJECT"

The instance name, database, user, and password secret are in the Outputs. See App_CloudRun for the connection model, backups, and password rotation.

C. Cloud Storage

A dedicated Cloud Storage data bucket is provisioned automatically for Evolution API file storage. Additional buckets can be declared via storage_buckets.

Console: Cloud Storage → Buckets.

CLI:

gcloud storage buckets list --project "$PROJECT"
gcloud storage ls gs://<data-bucket>/        # bucket name is in the Outputs

See App_CloudRun for GCS Fuse and CMEK options.

D. Redis (cache)

Redis is enabled by default (enable_redis = true). Evolution API uses it for instance/message caching (CACHE_REDIS_URI, Redis DB index 6). When redis_host is left empty and enable_nfs = true, the NFS server VM's IP is used as the Redis endpoint; the container entrypoint assembles the URI at runtime.

Console: Memorystore → Redis (if using a managed instance).

CLI:

redis-cli -h <redis-host> ping
redis-cli -h <redis-host> info keyspace
# Confirm the cache URI is set in the running revision:
gcloud run services describe <service-name> --region "$REGION" \
  --format='value(spec.template.spec.containers[0].env)'

E. Secret Manager

One cryptographic secret is generated automatically and stored in Secret Manager: AUTHENTICATION_API_KEY — Evolution API's global admin API key, injected as a secret env var. The database password is managed separately by the foundation.

Console: Security → Secret Manager.

CLI:

gcloud secrets list --project "$PROJECT" --filter="name~api-key"
gcloud secrets versions access latest --secret=<secret-name> --project "$PROJECT"

See App_CloudRun for injection and rotation details.

F. Networking & ingress

The service is reachable at its run.app URL by default, which allows the public access required for WhatsApp webhook callbacks and the manager UI. An external HTTPS load balancer with a custom domain, Cloud CDN, and Cloud Armor can be layered on; ingress settings and VPC egress control connectivity.

Console: Cloud Run (service URL); Network services → Load balancing.

CLI:

gcloud run services describe <service-name> --region "$REGION" --format='value(status.url)'
gcloud compute addresses list --project "$PROJECT"

See App_CloudRun.

G. Cloud Logging & Monitoring

Container logs flow to Cloud Logging; Cloud Run and Cloud SQL metrics flow to Cloud Monitoring, with optional uptime checks and alert policies. The entrypoint emits [cloud-entrypoint] markers that confirm the resolved DB/Redis/URL config on boot.

Console: Logging → Logs Explorer; Monitoring → Dashboards / Alerting.

CLI:

gcloud run services logs read <service-name> --project "$PROJECT" --region "$REGION" --limit 50

3. EvolutionAPI Application Behaviour

First-deploy database setup. An initialization Job runs db-init.sh using postgres:15-alpine. It connects through the Cloud SQL Auth Proxy and idempotently creates the evolution database and role, grants privileges, and makes the app user the owner of the public schema. The job is safe to re-run.
Prisma migrations on start. Evolution API runs prisma migrate deploy on every container boot (via the wrapped deploy_database.sh), so upgrading the application version applies schema changes without a separate migration step. The entrypoint waits for the Cloud SQL socket before this runs and executes the migrate script as a subprocess so a transient failure cannot prevent the server from starting.
AUTHENTICATION_API_KEY is immutable after first boot. The global admin key is generated once and written to Secret Manager. Rotating it makes all already-provisioned WhatsApp instances unreachable and returns 401 to every client still holding the old key. Only rotate during a planned migration.
Single-instance by design. WhatsApp (Baileys) socket sessions live in the instance's memory and are not shared across replicas. min_instance_count = 1 keeps one warm; max_instance_count = 1 prevents fragmenting live connections. Do not scale out.
Webhook / QR callback URL. The entrypoint defaults SERVER_URL to the injected CLOUDRUN_SERVICE_URL, so QR-code and webhook callback URLs use the real service address. Verify the running service URL:
```
gcloud run services describe <service-name> \
  --region "$REGION" --project "$PROJECT" --format='value(status.url)'
```
First-run setup. After deploy, retrieve AUTHENTICATION_API_KEY from Secret Manager and use it (as the apikey header) to reach the manager UI at /manager, create a WhatsApp instance (POST /instance/create), then scan the returned QR code from WhatsApp on your phone to connect the number.
Health path. Startup and liveness probes target the root / — an unauthenticated status endpoint that responds once the server is up. Allow ~7 minutes on first boot (the startup probe gives a 60-second initial delay plus a 30-retry window while Prisma migrates).

Inspect job execution:

gcloud run jobs list --project "$PROJECT" --region "$REGION"
gcloud run jobs executions list --job <job-name> --project "$PROJECT" --region "$REGION"

4. Configuration Variables

Variables are grouped exactly as they appear on the deployment platform. Only settings specific to or notable for Evolution API are listed; every other input is inherited from App_CloudRun with its standard behaviour.