Setting Up Server-Side GTM Container
Using Google Cloud Platform
RAIN can complete the majority of this setup for you. The only steps that must be completed on your side are:
-
Setting up Google Cloud Platform billing account with payment information
-
Adding a DNS record in your domain management account to create a custom subdomain
Once those are done, share access with RAIN and we handle the rest.
Overview
Automatically provisioning a server in Google Cloud Platform (GCP) is comprised of 6 parts:
How Long Will This Take?
With all accesses ready, setup can be completed in one session:
-
Part 1: 10-15 min — New GTM Container
-
Part 2: 10-15 min — GCP billing and server
-
Part 3: 15-20 min — Custom domain in Cloud Run
-
Part 4: 10 min — DNS records
-
Part 5: 5 min — Share GTM container with RAIN
-
Part 6: 10 min — Production configuration
Total: 45-60 minutes active work
DNS Note: SSL certificate provisioning typically completes within 15 minutes to 2 hours after DNS propagation; in rare cases up to 24 hours.
Accesses Needed
-
Google account with admin access to the GTM container associated with your GA4 account. This should be the same account used to set up client-side GTM, GA4, etc.
-
DNS registrar account access to add DNS records
-
Company credit card for Google Cloud Platform billing account
Part 1 — Establish a GTM Container for Server-Side Tracking
-
Navigate to tagmanager.google.com and ensure login with correct Google account (same account that manages client-side GTM and GA4).
-
Find the existing account where your GTM web container exists, and click the ⋯ menu button, then click Create Container.
-
a. Container Name: Use your website URL (e.g., yourcompanydomain.com).
-
b. Target Platform: Select Server.
-
If you don't see an existing account, create a new one by clicking Create Account:
-
a. Account Name: Use format "Your Company – Server-Side"
-
b. Country: United States
-
c. Data Sharing: Leave box unchecked
-
d. Container Name: yourcompanydomain.com
-
e. Target Platform: Select Server
-
Click Create and accept the data processing agreement.
-
Your Server-Side Google Tag Manager container is now created. The first pop-up will ask you to set up a tagging server. Select Automatically provision tagging server.
Part 2 — Set Up a Tagging Server in Google Cloud Platform
To proceed, you'll need a billing account. If you already have one, it may be automatically selected. Once verified it has correct payment information, select it, click Select billing account and create server, then proceed to Part 3.
Steps to Create a Billing Account
-
If you need to create a new billing account, agree to the terms, add your payment information, then click Submit. After creating a billing account, you should be returned to the screen where you originally clicked Automatically provision tagging server.
If you don't see the billing account yet, Google may just need a minute — try refreshing the page.
-
If everything looks good, click Select billing account and create server. Once clicked and your server has been created, proceed to Part 3.
If You Weren't Returned to the Right Screen
Navigate back using these steps:
-
From tagmanager.google.com, find the GTM Container with type "Server" you just created, and click on it.
-
Click on the Admin tab.
-
Click on Container Settings at the top of the list on the right.
-
Click on Set up your tagging server.
-
Click Automatically provision tagging server.
-
Select your billing account from the drop-down, and finally, click Select billing account and create server.
Finally, Google will create your server. (It will likely take a few minutes)
Part 3 — Configure and Verify a Custom Domain
Important: Setting up a custom domain is essential for maximizing the benefits of server-side tagging. A custom domain ensures cookies are classified as first-party instead of third-party, improving data accuracy, persistence, and tracking reliability.
-
Navigate back to Container Settings (in the Admin tab).
-
Under the "Google Cloud Platform Project ID" section, click the outbound link icon to go to the Google Cloud Server (console.cloud.google.com) associated with the Server-Side Tag Manager.
-
Click on the 3 horizontal lines (☰) in the top left and select Cloud Run from the Products menu.
-
You will see two servers. Find and click on the live server (named without a suffix, or with a "prod" or "live" suffix; will NOT have a "preview" or "debug" suffix).
-
Once you open the live server instance, click the INTEGRATIONS tab, then click + ADD INTEGRATIONS, then finally click Custom domains - Google Cloud Load Balancing.
-
If you see an error message about permissions, click GRANT ALL.
-
If you see a notification that some APIs must be enabled, click ENABLE.
-
Under "Routes," fill in Domain 1 with the full URL of the subdomain you'd like to use (e.g., gtmss.yourcompanydomain.com). Leave the "Path 1" and "Service 1" fields as they were.
Subdomain recommendation: You could use "gtmss", "ss", "ssgtm", or any other subdomain you'd like. This URL will potentially be visible, at least momentarily, to customers in some situations/browsers.
-
Click Submit at the very bottom of the page. It will take a few minutes to complete the setup.
Part 4 — Edit Your Website's DNS Records
Caution: DNS settings control core website functionality. Done correctly, this change adds server-side tagging capability with no other impact on your site. Many clients prefer to complete this step with a member of their IT team who is experienced with DNS management.
After a few minutes, you will see the DNS records you need to add in your website's DNS provider. They'll be at the bottom of the "Integration Details" screen in the "Connect to Custom Domain" section.
-
Log in to your domain registrar and create a new DNS record.
Here are the DNS record specifics to use (these items will be different for you — copy from your Cloud Run Integration Details screen):
|
Field |
Value |
Notes |
|---|---|---|
|
Type |
A |
|
|
Host or Name |
Subdomain only (e.g., gtmss) |
Not the full URL |
|
Value / Points To / IPv4 address |
IP from Cloud Run (e.g., 34.120.224.52) |
Copy exactly from Cloud Run |
|
TTL |
Auto or Default |
No need to change to 3600 |
|
Proxy Status |
Disable (OFF) |
If field not visible, it is disabled by default |
SSL certificate provisioning typically takes 15 minutes to 2 hours, but can take up to 24 hours in rare cases. Once the domain is completely added and verified, you'll see the SSL Certificate field turn "Deployed" under the Integration Details.
Part 5 — Configure GTM Container and Grant RAIN Access
Add Custom Domain to Container
-
Navigate to tagmanager.google.com (ensure you are logged in with the correct Google account).
-
Navigate to your Container Settings (Click container → Admin tab → Container Settings).
-
Click Add URL, paste in the custom domain you just set up (adding "https://" to the beginning), and click Save.
Share Access with RAIN
Note: Skip this section if the server container was created in a pre-existing GTM account where RAIN already has admin access.
-
Navigate back to tagmanager.google.com.
-
Click on your Server-Side Container → Admin → User Management
-
Click the blue ➕ icon in the top right and select Add Users.
-
Enter "support@rainlocal.com" and "analytics@rainlocal.com" into the Email addresses field.
-
Check the box for Administrator access, then click Invite. (Alternatively, you may select 'User' rather than Admin, but in this case, you will need to click Container Permissions and select Publish.)
Please notify RAIN once these steps are complete so we can verify the setup and proceed with tag configuration.
Part 6 — Production Server Configuration
Important: This step is required for production deployment. The default setup may experience delays due to cold starts and limited scalability. Adjusting the configuration ensures stability and reliability during traffic spikes.
-
Browse to the Cloud Run page (console.cloud.google.com → ☰ menu → Cloud Run) and click your production server in the list of services.
-
Click EDIT & DEPLOY NEW REVISION.
-
Scroll down to the Auto-scaling section. Set minimum instances to 2 and maximum instances to 10.
Minimum of 2 prevents cold boot times and resource exhaustion. Maximum of 10 means that's the upper limit your setup might scale to if enough traffic comes in. You'll only pay for the instances that are actually in use.
-
Scroll all the way down and click the Deploy button to create a new revision and update the deployment.
The deployment is done so that traffic is diverted to the new revision only after it's up and running. This means there should be no downtime at all for your server endpoint.
Important Notes
Content Security Policy (CSP)
If your website has a Content Security Policy enabled, additional configuration is required. RAIN will audit your CSP settings and provide specific DNS and security directive updates. This is included in the implementation scope.
If you need to share requirements with your IT or security team directly, the following directives need updates:
|
Requirement |
Directive(s) |
Notes |
|---|---|---|
|
Add server endpoint as trusted source |
connect-src, script-src |
Add your custom subdomain |
|
GTM client-side scripts |
script-src |
Include analytics.js and gtag.js |
|
Inline scripts (if used) |
script-src |
Use nonces or hashes for custom JS in GTM |
Questions? RAIN is familiar with these configurations and available to troubleshoot any specific cases. Contact your account team or reach us at support@rainlocal.com.