# Running an app on Cloud Run > Running a Cloud Run app: IAM, secrets, deploys from GitHub, domains, logs and alerts, revisions and rollbacks, backups, budgets, cutover day. These guides cover the work after the first deploy. They explain who may call and deploy a service, where secrets live, how GitHub deploys without keys, how a custom domain and HTTPS are set up, which logs, metrics and alerts to keep, how revisions and rollbacks work, how to back up the database, how to cap the bill and how to run the cutover day. - [Backups and point-in-time recovery on Cloud SQL: the defaults, getting a table back, and settings to check on day one](https://exodus.elim.io/blog/backups-and-point-in-time-recovery-on-cloud-sql.md): What a new Cloud SQL instance backs up by default, the four settings to change, how a restore and a point-in-time clone work, a copy that outlives the instance, and what it costs. - [Connecting Cloud Run to Cloud SQL: the /cloudsql socket, connectors, private IP and the errors of the first deploy](https://exodus.elim.io/blog/connecting-cloud-run-to-cloud-sql.md): Three ways from Cloud Run to Cloud SQL: the /cloudsql socket, a connector library, or a private IP. The commands, the connection string, the cost, and the errors of the first deploy. - [Custom domains and HTTPS on Cloud Run: domain mapping, a load balancer or Firebase Hosting, DNS and the certificate](https://exodus.elim.io/blog/custom-domains-and-https-on-cloud-run.md): Your own domain on Cloud Run through domain mapping, a load balancer or Firebase Hosting: the cost, DNS records, certificate wait and limits of each, and the traps in DNS caches, CAA and proxies. - [Deploying to Cloud Run from GitHub without keys: Workload Identity Federation step by step](https://exodus.elim.io/blog/deploying-from-github-without-keys.md): GitHub Actions can deploy to Cloud Run with a per-run token instead of a JSON key. The pool, provider, deployer account, roles and workflow of Workload Identity Federation, and the errors you meet. - [Health checks on Cloud Run: startup, liveness and readiness probes, and what the default one misses](https://exodus.elim.io/blog/health-checks-and-startup-probes.md): Every Cloud Run service gets one TCP check you never set. What it misses, how startup, liveness and readiness probes work, the endpoint behind them, reading results in logs, and the cost. - [IAM for a Cloud Run app: who may call it, what it may touch, who may deploy it](https://exodus.elim.io/blog/iam-for-a-cloud-run-app.md): IAM decides who may call a Cloud Run service, what its code may touch and who may deploy it. The roles, public or private, service-to-service calls, an account per service, and deploy rights. - [Logs, metrics and alerts for a Cloud Run app: what you get for free and the three alerts to set up](https://exodus.elim.io/blog/logs-metrics-and-alerts-for-a-cloud-run-app.md): Cloud Run sends requests, logs and metrics to Google Cloud with no setup. The log format Google reads, where to look, three alerting policies as files, and what each part costs. - [Moving a Postgres database to Cloud SQL without losing data: rehearse, compare, freeze, copy](https://exodus.elim.io/blog/moving-a-postgres-database-without-losing-data.md): A dump and restore moves a small Postgres in minutes and loses rows written meanwhile unless writes stop. The order that keeps a way back, Cloud SQL's flags, proving both sides match. - [Revisions, traffic splitting and rollbacks on Cloud Run: release to 5% first, go back with one command](https://exodus.elim.io/blog/revisions-traffic-splitting-and-rollbacks.md): Every Cloud Run deploy makes a revision that never changes. Rollbacks without a rebuild, a release to 5% first, tagged test URLs, the trap that leaves a deploy at 0%, and what a rollback misses. - [Secrets on Cloud Run: Secret Manager as variables or files, who can read them, and rotating a key without an outage](https://exodus.elim.io/blog/secrets-on-cloud-run.md): Secret Manager hands secrets to Cloud Run as variables, files or through a client. How each behaves on change, who needs which role, why build arguments leak, rotating a key in five steps. - [The cutover day checklist: moving traffic to Cloud Run with the old app as the way back](https://exodus.elim.io/blog/the-cutover-day-checklist.md): The day traffic moves to Cloud Run, step by step from a week before to a week after: the DNS TTL, freeze, copy, compare and switch, checks from outside, the way back, and the overlap's cost. - [Budget alerts and the billing export](https://exodus.elim.io/blog/budget-alerts-and-the-billing-export.md): Google Cloud has no spending limit unless you set one. How budgets and alerts work, what a Pub/Sub budget message can do, spend caps, and the BigQuery billing export read with three queries. - [Setting up a Google Cloud project for a small team](https://exodus.elim.io/blog/setting-up-a-google-cloud-project-for-a-small-team.md): The first hour on Google Cloud in order: organization, billing account, a project per environment, budget and cap, APIs, group roles, keyless service accounts, contacts. Costs and traps.