# GCP Terraform Debian recipe

This recipe provisions a Debian VM and persists Terraform state in
`/lemc/private`. Its cookbook source is [cookbook.yaml](cookbook.yaml).

The cookbook declares `GOOGLE_CREDENTIALS` by name only. The immutable
Cookbook author stores its write-only value on the Web **User > Secrets** page.
Run the recipe through the authenticated server path. Local `lemcli dev run`
refuses this secret-bearing recipe.

Build the local image with `make build`. For remote publication, create a
cookbook, set `COOKBOOK_UUID`, and run `make publish`. This uses the LEMC
registry front door and rewrites the recipe to an immutable managed digest.