@aifabrix/builder 2.56.0 → 2.57.0

package/templates/marketplace/main.json

@@ -0,0 +1,4087 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.47.16.16243",
+      "templateHash": "12207364571048202485"
+    }
+  },
+  "parameters": {
+    "infrastructureNameOverride": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Non-Marketplace override only. Empty → resourceGroup().name (managed RG SSOT). Do not map from createUiDefinition — Marketplace resolves template params in customer RG context."
+      }
+    },
+    "location": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "Azure region for deployment. Default is the managed resource group location; portal may override via createUiDefinition."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "defaultValue": {
+        "CreatedBy": "AI Fabrix Miso",
+        "Environment": "miso",
+        "ServiceName": "aifabrix-miso",
+        "Application": "AI Fabrix",
+        "Tier": "Infrastructure",
+        "CostCenter": "Platform",
+        "Owner": "Platform Team"
+      },
+      "metadata": {
+        "description": "Resource tags to apply to all resources"
+      }
+    },
+    "enableAppInsights": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Create Application Insights for Keycloak. Default false — no ai_*_managed companion RG."
+      }
+    },
+    "enableAzureOpenAI": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "When true, create Azure OpenAI in Phase-1 (same name TA uses) so Complete mode does not delete it."
+      }
+    },
+    "enablePartnerCenterAttribution": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Partner Center customer usage attribution (PID). Default true for MP; Service Catalog build sets false."
+      }
+    },
+    "enablePostgresPublicAccess": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Enable public network access for PostgreSQL (developer / evaluation default; use private+VNet in hardened deployments)"
+      }
+    },
+    "allowedIPs": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "PostgreSQL firewall rules when enablePostgresPublicAccess is true (CI/CD deploy passes via @file)."
+      }
+    },
+    "adminPassword": {
+      "type": "securestring",
+      "metadata": {
+        "description": "Initial AI Fabrix platform administrator password (user admin). Not used for PostgreSQL, Keycloak internal admin, or encryption."
+      }
+    },
+    "deploymentEnvironment": {
+      "type": "string",
+      "defaultValue": "evaluation",
+      "allowedValues": ["prod", "nonprod", "evaluation"],
+      "metadata": {
+        "description": "Deployment environment used for app runtime defaults. MP UI hardcodes evaluation for now."
+      }
+    },
+    "keycloakVerifyAudience": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Enable Keycloak access-token audience validation in controller"
+      }
+    },
+    "encryptionKey": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional encryption key override. Empty → install-unique generated key in Key Vault (no PLACEHOLDER)."
+      }
+    },
+    "acrLoginServer": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional registry login server. Empty (default) derives it from acrResourceId (<registry><cloud acrLoginServer suffix>)."
+      }
+    },
+    "acrAdminUsername": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional registry username. Used only together with a non-empty acrAdminPassword (legacy/local registry credential); empty derives the registry name from acrResourceId. Azure image pull uses managed identity."
+      }
+    },
+    "acrAdminPassword": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional registry pull password/token. Empty (default) → no DOCKER_REGISTRY_SERVER_PASSWORD setting and no Key Vault registry secret; Azure image pull uses the web app managed identity (AcrPull)."
+      }
+    },
+    "acrResourceId": {
+      "type": "string",
+      "minLength": 1,
+      "metadata": {
+        "description": "Required full ARM resource ID of the container registry that serves the Miso and Keycloak images. Both web app managed identities receive AcrPull on it through an ARM role assignment in the resource group of the registry; the deploying principal needs roleAssignments/write on the registry. No default: the deployer (Builder or the Marketplace package) supplies it."
+      }
+    },
+    "deployRoleAssignments": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "When false, skip ARM role assignments (CI/CD redeploy without roleAssignments/write). RBAC must already exist."
+      }
+    },
+    "moriBaseUrl": {
+      "type": "string",
+      "defaultValue": "https://aifabrix-pro-miso-mori.azurewebsites.net",
+      "metadata": {
+        "description": "Mori base URL for controller tenant activation and Entra handoff (no trailing slash)"
+      }
+    },
+    "moriCallbackApiKey": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional shared secret for Mori → controller callback. Configure through the Miso installation/application contract."
+      }
+    },
+    "entraCallbackStateSecret": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional shared HMAC secret for Entra consent OAuth state. Configure through the Miso installation contract."
+      }
+    },
+    "entraIdClientId": {
+      "type": "string",
+      "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
+      "metadata": {
+        "description": "Vendor Entra multi-tenant app client ID. Default matches vendor miso-controller .env (not in createUiDefinition)."
+      }
+    },
+    "entraIdClientSecret": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional vendor Entra app client secret. Configure through the Miso installation contract."
+      }
+    },
+    "entraIdTenantId": {
+      "type": "string",
+      "defaultValue": "09aff594-ba37-4af2-bf40-b773b654c563",
+      "metadata": {
+        "description": "Publisher/home tenant for vendor Entra app (ENTRA_ID_TENANT_ID). TENANT_ID uses subscription().tenantId at deploy. Default matches vendor miso-controller .env (not in createUiDefinition)."
+      }
+    },
+    "misoImageTag": {
+      "type": "string",
+      "defaultValue": "latest",
+      "metadata": {
+        "description": "MISO controller image tag on publisher ACR (not in createUiDefinition). MP/managed-app default is latest (Sweden cicd retags on pro promote); Service Catalog publish may override."
+      }
+    },
+    "keycloakImageTag": {
+      "type": "string",
+      "defaultValue": "latest",
+      "metadata": {
+        "description": "Keycloak image tag on publisher ACR (not in createUiDefinition). MP/managed-app default is latest (Sweden cicd retags on pro promote); Service Catalog publish may override."
+      }
+    },
+    "licenseEdition": {
+      "type": "string",
+      "defaultValue": "COMMUNITY",
+      "metadata": {
+        "description": "License the installation requests from Mori during tenant activation: an edition name (COMMUNITY, STANDARD, ENTERPRISE) or an Azure Marketplace subscription ID (UUID). Plain string — Miso validates it. Emitted as LICENSE_EDITION."
+      }
+    },
+    "onboardingMode": {
+      "type": "string",
+      "defaultValue": "customerOwned",
+      "allowedValues": ["customerOwned", "saasDirect"],
+      "metadata": {
+        "description": "Tenant onboarding mode for Miso (ONBOARDING_MODE). customerOwned = portal/Marketplace wizard; saasDirect = Builder SaaS installation. Not exposed in createUiDefinition."
+      }
+    }
+  },
+  "variables": {
+    "infrastructureName": "[if(not(empty(parameters('infrastructureNameOverride'))), parameters('infrastructureNameOverride'), resourceGroup().name)]",
+    "deploymentLocation": "[parameters('location')]",
+    "appInsightsLocation": "[if(equals(variables('deploymentLocation'), 'norwaywest'), 'norwayeast', variables('deploymentLocation'))]",
+    "openAiLocationKnown": "[contains(createArray('australiaeast', 'brazilsouth', 'canadaeast', 'eastus', 'eastus2', 'francecentral', 'japaneast', 'koreacentral', 'northcentralus', 'norwayeast', 'polandcentral', 'southafricanorth', 'southcentralus', 'southindia', 'swedencentral', 'switzerlandnorth', 'uksouth', 'westeurope', 'westus', 'westus3'), variables('deploymentLocation'))]",
+    "openAiLocation": "[if(variables('openAiLocationKnown'), variables('deploymentLocation'), 'swedencentral')]",
+    "subnetBase": "[add(20, mod(length(variables('infrastructureName')), 230))]",
+    "registryPasswordConfigured": "[not(empty(parameters('acrAdminPassword')))]",
+    "acrRegistryName": "[toLower(last(split(parameters('acrResourceId'), '/')))]",
+    "effectiveAcrLoginServer": "[if(empty(parameters('acrLoginServer')), format('{0}{1}', variables('acrRegistryName'), environment().suffixes.acrLoginServer), parameters('acrLoginServer'))]",
+    "registryUsername": "[if(variables('registryPasswordConfigured'), if(empty(parameters('acrAdminUsername')), variables('acrRegistryName'), parameters('acrAdminUsername')), '')]",
+    "keycloakContainerImage": "[format('{0}/aifabrix/keycloak:{1}', variables('effectiveAcrLoginServer'), parameters('keycloakImageTag'))]",
+    "misoControllerContainerImage": "[format('{0}/aifabrix/miso-controller:{1}', variables('effectiveAcrLoginServer'), parameters('misoImageTag'))]",
+    "keycloakVdirPublic": "/auth",
+    "acrResourceIdSegments": "[split(parameters('acrResourceId'), '/')]"
+  },
+  "resources": [
+    {
+      "condition": "[parameters('enablePartnerCenterAttribution')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-06-01",
+      "name": "pid-ca58d4ea-1339-4201-8971-9dcd4c2619b8-partnercenter",
+      "properties": {
+        "mode": "Incremental",
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "resources": []
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "network",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[variables('deploymentLocation')]"
+          },
+          "prefix": {
+            "value": "[variables('infrastructureName')]"
+          },
+          "vnetAddressSpace": {
+            "value": "[format('10.{0}.0.0/21', variables('subnetBase'))]"
+          },
+          "webappSubnetCidr": {
+            "value": "[format('10.{0}.1.0/24', variables('subnetBase'))]"
+          },
+          "privateEndpointSubnetCidr": {
+            "value": "[format('10.{0}.2.0/24', variables('subnetBase'))]"
+          },
+          "postgresSubnetCidr": {
+            "value": "[format('10.{0}.3.0/27', variables('subnetBase'))]"
+          },
+          "deploymentScriptSubnetCidr": {
+            "value": "[format('10.{0}.4.0/27', variables('subnetBase'))]"
+          },
+          "linkPostgresPrivateDnsToVnet": {
+            "value": "[not(parameters('enablePostgresPublicAccess'))]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "2748258731732394782"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region"
+              }
+            },
+            "prefix": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource name prefix (used in VNet, subnets, DNS zones)"
+              }
+            },
+            "vnetAddressSpace": {
+              "type": "string",
+              "defaultValue": "10.20.0.0/16",
+              "metadata": {
+                "description": "VNet address space"
+              }
+            },
+            "webappSubnetCidr": {
+              "type": "string",
+              "defaultValue": "10.20.1.0/24",
+              "metadata": {
+                "description": "Subnet CIDR for App Service VNet integration (Swift). Must not overlap with others."
+              }
+            },
+            "privateEndpointSubnetCidr": {
+              "type": "string",
+              "defaultValue": "10.20.2.0/24",
+              "metadata": {
+                "description": "Subnet CIDR for Private Endpoints. Must not overlap with others."
+              }
+            },
+            "postgresSubnetCidr": {
+              "type": "string",
+              "defaultValue": "10.20.3.0/27",
+              "metadata": {
+                "description": "Subnet CIDR for PostgreSQL Flexible Server. Must not overlap with others."
+              }
+            },
+            "deploymentScriptSubnetCidr": {
+              "type": "string",
+              "defaultValue": "10.20.4.0/27",
+              "metadata": {
+                "description": "Subnet CIDR for Deployment Scripts. Must not overlap with others."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional tags applied to all resources created by this module"
+              }
+            },
+            "linkPostgresPrivateDnsToVnet": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Link privatelink.postgres.database.azure.com to the VNet. Set false when PostgreSQL uses public access only (avoids empty-zone DNS hijack for App Service)."
+              }
+            }
+          },
+          "variables": {
+            "vnetName": "[format('{0}-vnet', parameters('prefix'))]",
+            "webappSubnetName": "snet-webapp",
+            "peSubnetName": "snet-private-endpoints",
+            "pgSubnetName": "snet-postgres",
+            "deploymentSubnetName": "snet-deployments",
+            "zonePostgres": "privatelink.postgres.database.azure.com",
+            "zoneStorageBlob": "[format('privatelink.blob.{0}', environment().suffixes.storage)]",
+            "zoneKeyVault": "privatelink.vaultcore.azure.net",
+            "zoneStorageFile": "[format('privatelink.file.{0}', environment().suffixes.storage)]",
+            "zoneAppService": "privatelink.azurewebsites.net"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Network/virtualNetworks",
+              "apiVersion": "2024-03-01",
+              "name": "[variables('vnetName')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "addressSpace": {
+                  "addressPrefixes": ["[parameters('vnetAddressSpace')]"]
+                },
+                "subnets": [
+                  {
+                    "name": "[variables('webappSubnetName')]",
+                    "properties": {
+                      "addressPrefix": "[parameters('webappSubnetCidr')]",
+                      "delegations": [
+                        {
+                          "name": "delegation-appservice",
+                          "properties": {
+                            "serviceName": "Microsoft.Web/serverFarms"
+                          }
+                        }
+                      ],
+                      "privateEndpointNetworkPolicies": "Enabled",
+                      "privateLinkServiceNetworkPolicies": "Enabled"
+                    }
+                  },
+                  {
+                    "name": "[variables('peSubnetName')]",
+                    "properties": {
+                      "addressPrefix": "[parameters('privateEndpointSubnetCidr')]",
+                      "privateEndpointNetworkPolicies": "Disabled",
+                      "privateLinkServiceNetworkPolicies": "Enabled",
+                      "serviceEndpoints": [
+                        {
+                          "service": "Microsoft.Storage"
+                        },
+                        {
+                          "service": "Microsoft.KeyVault"
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "name": "[variables('pgSubnetName')]",
+                    "properties": {
+                      "addressPrefix": "[parameters('postgresSubnetCidr')]",
+                      "delegations": [
+                        {
+                          "name": "delegation-postgres",
+                          "properties": {
+                            "serviceName": "Microsoft.DBforPostgreSQL/flexibleServers"
+                          }
+                        }
+                      ],
+                      "privateEndpointNetworkPolicies": "Enabled",
+                      "privateLinkServiceNetworkPolicies": "Enabled"
+                    }
+                  },
+                  {
+                    "name": "[variables('deploymentSubnetName')]",
+                    "properties": {
+                      "addressPrefix": "[parameters('deploymentScriptSubnetCidr')]",
+                      "delegations": [
+                        {
+                          "name": "delegation-aci",
+                          "properties": {
+                            "serviceName": "Microsoft.ContainerInstance/containerGroups"
+                          }
+                        }
+                      ],
+                      "privateEndpointNetworkPolicies": "Enabled",
+                      "privateLinkServiceNetworkPolicies": "Enabled"
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2020-06-01",
+              "name": "[variables('zonePostgres')]",
+              "location": "global",
+              "tags": "[parameters('tags')]"
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2020-06-01",
+              "name": "[variables('zoneStorageBlob')]",
+              "location": "global",
+              "tags": "[parameters('tags')]"
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2020-06-01",
+              "name": "[variables('zoneStorageFile')]",
+              "location": "global",
+              "tags": "[parameters('tags')]"
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2020-06-01",
+              "name": "[variables('zoneKeyVault')]",
+              "location": "global",
+              "tags": "[parameters('tags')]"
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2020-06-01",
+              "name": "[variables('zoneAppService')]",
+              "location": "global",
+              "tags": "[parameters('tags')]"
+            },
+            {
+              "condition": "[parameters('linkPostgresPrivateDnsToVnet')]",
+              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+              "apiVersion": "2020-06-01",
+              "name": "[format('{0}/{1}', variables('zonePostgres'), format('{0}-postgres-vnet-link', parameters('prefix')))]",
+              "location": "global",
+              "properties": {
+                "registrationEnabled": false,
+                "virtualNetwork": {
+                  "id": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateDnsZones', variables('zonePostgres'))]",
+                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+              "apiVersion": "2020-06-01",
+              "name": "[format('{0}/{1}', variables('zoneStorageBlob'), format('{0}-stgblob-vnet-link', parameters('prefix')))]",
+              "location": "global",
+              "properties": {
+                "registrationEnabled": false,
+                "virtualNetwork": {
+                  "id": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneStorageBlob'))]",
+                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+              "apiVersion": "2020-06-01",
+              "name": "[format('{0}/{1}', variables('zoneStorageFile'), format('{0}-stgfile-vnet-link', parameters('prefix')))]",
+              "location": "global",
+              "properties": {
+                "registrationEnabled": false,
+                "virtualNetwork": {
+                  "id": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneStorageFile'))]",
+                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+              "apiVersion": "2020-06-01",
+              "name": "[format('{0}/{1}', variables('zoneKeyVault'), format('{0}-keyvault-vnet-link', parameters('prefix')))]",
+              "location": "global",
+              "properties": {
+                "registrationEnabled": false,
+                "virtualNetwork": {
+                  "id": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneKeyVault'))]",
+                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+              "apiVersion": "2020-06-01",
+              "name": "[format('{0}/{1}', variables('zoneAppService'), format('{0}-appsvc-vnet-link', parameters('prefix')))]",
+              "location": "global",
+              "properties": {
+                "registrationEnabled": false,
+                "virtualNetwork": {
+                  "id": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneAppService'))]",
+                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "vnetId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
+            },
+            "webappSubnetId": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), '2024-03-01').subnets[0].id]"
+            },
+            "privateEndpointSubnetId": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), '2024-03-01').subnets[1].id]"
+            },
+            "postgresSubnetId": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), '2024-03-01').subnets[2].id]"
+            },
+            "deploymentScriptSubnetId": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), '2024-03-01').subnets[3].id]"
+            },
+            "postgresPrivateDnsZoneId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zonePostgres'))]"
+            },
+            "storageBlobPrivateDnsZoneId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneStorageBlob'))]"
+            },
+            "storageFilePrivateDnsZoneId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneStorageFile'))]"
+            },
+            "keyVaultPrivateDnsZoneId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneKeyVault'))]"
+            },
+            "appServicePrivateDnsZoneId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneAppService'))]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "managedIdentity",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[variables('deploymentLocation')]"
+          },
+          "name": {
+            "value": "[format('{0}-miso-mi', variables('infrastructureName'))]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "13683008133608886333"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region"
+              }
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed identity name"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional tags applied to all resources created by this module"
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+              "apiVersion": "2023-01-31",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]"
+            }
+          ],
+          "outputs": {
+            "managedIdentityId": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity ID"
+              },
+              "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
+            },
+            "managedIdentityName": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity name"
+              },
+              "value": "[parameters('name')]"
+            },
+            "principalId": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity principal ID"
+              },
+              "value": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), '2023-01-31').principalId]"
+            },
+            "clientId": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity client ID (for IMDS token requests)"
+              },
+              "value": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), '2023-01-31').clientId]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "keyVault",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[variables('deploymentLocation')]"
+          },
+          "name": {
+            "value": "[format('{0}-miso-kv', variables('infrastructureName'))]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "privateEndpointSubnetId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.privateEndpointSubnetId.value]"
+          },
+          "privateDnsZoneId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.keyVaultPrivateDnsZoneId.value]"
+          },
+          "allowedIPs": {
+            "value": ["*"]
+          },
+          "currentUserObjectId": {
+            "value": ""
+          },
+          "deploymentIdentityObjectIds": {
+            "value": [
+              "[reference(resourceId('Microsoft.Resources/deployments', 'managedIdentity'), '2025-04-01').outputs.principalId.value]"
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "132634503198212442"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region (defaults to the resource group location)"
+              }
+            },
+            "name": {
+              "type": "string",
+              "minLength": 3,
+              "maxLength": 24,
+              "metadata": {
+                "description": "Key Vault name"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional tags applied to all resources created by this module"
+              }
+            },
+            "privateEndpointSubnetId": {
+              "type": "string",
+              "metadata": {
+                "description": "Subnet resource ID for the Private Endpoint (must be dedicated for PE use)"
+              }
+            },
+            "privateDnsZoneId": {
+              "type": "string",
+              "metadata": {
+                "description": "Private DNS Zone ID for privatelink.vaultcore.azure.net"
+              }
+            },
+            "allowedIPs": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Array of allowed IP addresses/CIDR blocks for Key Vault access. Use [\"*\"] for public access."
+              }
+            },
+            "currentUserObjectId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Current user object ID for temporary access during deployment"
+              }
+            },
+            "deploymentIdentityObjectIds": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Additional object IDs that require Key Vault secrets get/list/set (applied additively)"
+              }
+            },
+            "sku": {
+              "type": "string",
+              "defaultValue": "standard",
+              "allowedValues": ["standard", "premium"],
+              "metadata": {
+                "description": "Key Vault SKU (standard or premium)"
+              }
+            },
+            "enablePublicAccessForKeyVaultReferences": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable public network access for App Service Key Vault references. Required when using @Microsoft.KeyVault() in app settings."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "deploymentIdentityPolicies",
+                "count": "[length(parameters('deploymentIdentityObjectIds'))]",
+                "input": {
+                  "tenantId": "[subscription().tenantId]",
+                  "objectId": "[parameters('deploymentIdentityObjectIds')[copyIndex('deploymentIdentityPolicies')]]",
+                  "permissions": {
+                    "secrets": ["get", "list", "set"],
+                    "keys": [],
+                    "certificates": [],
+                    "storage": []
+                  }
+                }
+              },
+              {
+                "name": "allowedIPsRules",
+                "count": "[length(parameters('allowedIPs'))]",
+                "input": {
+                  "value": "[parameters('allowedIPs')[copyIndex('allowedIPsRules')]]"
+                }
+              }
+            ],
+            "isPublicAccess": "[contains(parameters('allowedIPs'), '*')]",
+            "isPrivateOnly": "[contains(parameters('allowedIPs'), '-')]",
+            "emptyObjectId": "00000000-0000-0000-0000-000000000000",
+            "shouldGrantCurrentUserPolicy": "[and(not(empty(parameters('currentUserObjectId'))), not(equals(toLower(parameters('currentUserObjectId')), variables('emptyObjectId'))))]",
+            "currentUserPolicy": "[if(variables('shouldGrantCurrentUserPolicy'), createArray(createObject('tenantId', subscription().tenantId, 'objectId', parameters('currentUserObjectId'), 'permissions', createObject('secrets', createArray('set', 'get', 'list'), 'keys', createArray(), 'certificates', createArray(), 'storage', createArray()))), createArray())]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.KeyVault/vaults",
+              "apiVersion": "2023-02-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "enableSoftDelete": true,
+                "enablePurgeProtection": true,
+                "enableRbacAuthorization": false,
+                "tenantId": "[subscription().tenantId]",
+                "sku": {
+                  "family": "A",
+                  "name": "[parameters('sku')]"
+                },
+                "accessPolicies": [],
+                "networkAcls": {
+                  "bypass": "AzureServices",
+                  "defaultAction": "[if(variables('isPublicAccess'), 'Allow', 'Deny')]",
+                  "virtualNetworkRules": [],
+                  "ipRules": "[if(variables('isPublicAccess'), createArray(), if(variables('isPrivateOnly'), createArray(), variables('allowedIPsRules')))]"
+                },
+                "publicNetworkAccess": "[if(or(variables('isPublicAccess'), parameters('enablePublicAccessForKeyVaultReferences')), 'Enabled', if(variables('isPrivateOnly'), 'Disabled', if(greater(length(variables('allowedIPsRules')), 0), 'Enabled', 'Disabled')))]"
+              }
+            },
+            {
+              "condition": "[and(variables('shouldGrantCurrentUserPolicy'), empty(variables('deploymentIdentityPolicies')))]",
+              "type": "Microsoft.KeyVault/vaults/accessPolicies",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'add')]",
+              "properties": {
+                "accessPolicies": "[variables('currentUserPolicy')]"
+              },
+              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
+            },
+            {
+              "condition": "[and(not(empty(variables('deploymentIdentityPolicies'))), not(variables('shouldGrantCurrentUserPolicy')))]",
+              "type": "Microsoft.KeyVault/vaults/accessPolicies",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'add')]",
+              "properties": {
+                "accessPolicies": "[variables('deploymentIdentityPolicies')]"
+              },
+              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
+            },
+            {
+              "condition": "[and(variables('shouldGrantCurrentUserPolicy'), not(empty(variables('deploymentIdentityPolicies'))))]",
+              "type": "Microsoft.KeyVault/vaults/accessPolicies",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'add')]",
+              "properties": {
+                "accessPolicies": "[concat(variables('currentUserPolicy'), variables('deploymentIdentityPolicies'))]"
+              },
+              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
+            },
+            {
+              "type": "Microsoft.Network/privateEndpoints",
+              "apiVersion": "2023-05-01",
+              "name": "[format('{0}-pe', parameters('name'))]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "subnet": {
+                  "id": "[parameters('privateEndpointSubnetId')]"
+                },
+                "customNetworkInterfaceName": "[format('{0}-nic', parameters('name'))]",
+                "privateLinkServiceConnections": [
+                  {
+                    "name": "kv-pls",
+                    "properties": {
+                      "privateLinkServiceId": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]",
+                      "groupIds": ["vault"]
+                    }
+                  }
+                ]
+              },
+              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
+            },
+            {
+              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+              "apiVersion": "2023-05-01",
+              "name": "[format('{0}/{1}', format('{0}-pe', parameters('name')), 'kv-dns')]",
+              "properties": {
+                "privateDnsZoneConfigs": [
+                  {
+                    "name": "vault-dns-zone",
+                    "properties": {
+                      "privateDnsZoneId": "[parameters('privateDnsZoneId')]"
+                    }
+                  }
+                ]
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateEndpoints', format('{0}-pe', parameters('name')))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "keyVaultId": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault ID"
+              },
+              "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
+            },
+            "keyVaultName": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault name"
+              },
+              "value": "[parameters('name')]"
+            },
+            "keyVaultUri": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault URI"
+              },
+              "value": "[reference(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '2023-02-01').vaultUri]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'managedIdentity')]",
+        "[resourceId('Microsoft.Resources/deployments', 'network')]"
+      ]
+    },
+    {
+      "condition": "[parameters('enableAzureOpenAI')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "azureOpenAI",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "infrastructureName": {
+            "value": "[variables('infrastructureName')]"
+          },
+          "location": {
+            "value": "[variables('openAiLocation')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "keyVaultName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultName.value]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "11131379543865133238"
+            }
+          },
+          "parameters": {
+            "infrastructureName": {
+              "type": "string",
+              "metadata": {
+                "description": "Infrastructure name prefix (e.g. aifabrix9)"
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the OpenAI account"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Resource tags"
+              }
+            },
+            "keyVaultName": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault name to store endpoint and API key secrets"
+              }
+            }
+          },
+          "variables": {
+            "accountName": "[format('{0}misoopenai', replace(parameters('infrastructureName'), '-', ''))]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.CognitiveServices/accounts",
+              "apiVersion": "2023-05-01",
+              "name": "[variables('accountName')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "OpenAI",
+              "sku": {
+                "name": "S0"
+              },
+              "properties": {
+                "customSubDomainName": "[variables('accountName')]",
+                "publicNetworkAccess": "Enabled"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'azureopenai-endpoint')]",
+              "properties": {
+                "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', variables('accountName')), '2023-05-01').endpoint]"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.CognitiveServices/accounts', variables('accountName'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'azureopenai-apikey')]",
+              "properties": {
+                "value": "[listKeys(resourceId('Microsoft.CognitiveServices/accounts', variables('accountName')), '2023-05-01').key1]"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.CognitiveServices/accounts', variables('accountName'))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "accountName": {
+              "type": "string",
+              "value": "[variables('accountName')]"
+            },
+            "endpoint": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', variables('accountName')), '2023-05-01').endpoint]"
+            }
+          }
+        }
+      },
+      "dependsOn": ["[resourceId('Microsoft.Resources/deployments', 'keyVault')]"]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "storage",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[variables('deploymentLocation')]"
+          },
+          "name": {
+            "value": "[format('{0}misostg', replace(variables('infrastructureName'), '-', ''))]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "keyVaultId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultId.value]"
+          },
+          "privateEndpointSubnetId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.privateEndpointSubnetId.value]"
+          },
+          "privateDnsZoneId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.storageBlobPrivateDnsZoneId.value]"
+          },
+          "filePrivateDnsZoneId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.storageFilePrivateDnsZoneId.value]"
+          },
+          "allowedIPs": {
+            "value": []
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "7520721023259261582"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region (defaults to the resource group location)"
+              }
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Storage resource name"
+              }
+            },
+            "sku": {
+              "type": "string",
+              "defaultValue": "Standard_LRS",
+              "allowedValues": ["Standard_LRS", "Standard_GRS", "Standard_RAGRS", "Premium_LRS"],
+              "metadata": {
+                "description": "Storage account SKU (e.g., Standard_LRS, Standard_GRS, Premium_LRS)"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional tags applied to all resources created by this module"
+              }
+            },
+            "keyVaultId": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault resource ID to store the Redis primary key"
+              }
+            },
+            "logsContainerName": {
+              "type": "string",
+              "defaultValue": "scriptlogs",
+              "metadata": {
+                "description": "Blob container name for deploymentScripts logs."
+              }
+            },
+            "fileShareName": {
+              "type": "string",
+              "defaultValue": "data",
+              "metadata": {
+                "description": "File Share name for application data."
+              }
+            },
+            "privateEndpointSubnetId": {
+              "type": "string",
+              "metadata": {
+                "description": "Subnet resource ID for the Private Endpoint (must be dedicated for PE use)"
+              }
+            },
+            "privateDnsZoneId": {
+              "type": "string",
+              "metadata": {
+                "description": "Private DNS Zone ID for privatelink.blob.core.windows.com"
+              }
+            },
+            "filePrivateDnsZoneId": {
+              "type": "string",
+              "metadata": {
+                "description": "Private DNS Zone ID for privatelink.file.core.windows.xxx"
+              }
+            },
+            "allowedIPs": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Array of allowed IP addresses/CIDR blocks for Storage Account access. Use [\"*\"] for public access."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "allowedIPsRules",
+                "count": "[length(parameters('allowedIPs'))]",
+                "input": {
+                  "value": "[parameters('allowedIPs')[copyIndex('allowedIPsRules')]]"
+                }
+              }
+            ],
+            "isPublicAccess": "[contains(parameters('allowedIPs'), '*')]",
+            "isPrivateOnly": "[contains(parameters('allowedIPs'), '-')]",
+            "storageSecretName": "storage-account-key",
+            "kvName": "[last(split(parameters('keyVaultId'), '/'))]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Storage/storageAccounts",
+              "apiVersion": "2024-01-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "sku": {
+                "name": "[parameters('sku')]"
+              },
+              "kind": "StorageV2",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "allowBlobPublicAccess": false,
+                "minimumTlsVersion": "TLS1_2",
+                "supportsHttpsTrafficOnly": true,
+                "allowSharedKeyAccess": true,
+                "publicNetworkAccess": "[if(variables('isPublicAccess'), 'Enabled', if(variables('isPrivateOnly'), 'Disabled', if(greater(length(variables('allowedIPsRules')), 0), 'Enabled', 'Disabled')))]",
+                "networkAcls": {
+                  "resourceAccessRules": [],
+                  "bypass": "AzureServices",
+                  "virtualNetworkRules": [],
+                  "defaultAction": "[if(variables('isPublicAccess'), 'Allow', 'Deny')]",
+                  "ipRules": "[if(variables('isPublicAccess'), createArray(), if(variables('isPrivateOnly'), createArray(), variables('allowedIPsRules')))]"
+                }
+              }
+            },
+            {
+              "type": "Microsoft.Storage/storageAccounts/blobServices",
+              "apiVersion": "2024-01-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'default')]",
+              "properties": {},
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+            },
+            {
+              "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+              "apiVersion": "2024-01-01",
+              "name": "[format('{0}/default/{1}', parameters('name'), parameters('logsContainerName'))]",
+              "properties": {
+                "publicAccess": "None"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
+                "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('name'), 'default')]"
+              ]
+            },
+            {
+              "type": "Microsoft.Storage/storageAccounts/fileServices",
+              "apiVersion": "2021-04-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'default')]",
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+            },
+            {
+              "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
+              "apiVersion": "2021-04-01",
+              "name": "[format('{0}/{1}/{2}', parameters('name'), 'default', parameters('fileShareName'))]",
+              "properties": {
+                "accessTier": "TransactionOptimized"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('name'), 'default')]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/privateEndpoints",
+              "apiVersion": "2023-05-01",
+              "name": "[format('{0}-pe', parameters('name'))]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "subnet": {
+                  "id": "[parameters('privateEndpointSubnetId')]"
+                },
+                "customNetworkInterfaceName": "[format('{0}-nic', parameters('name'))]",
+                "privateLinkServiceConnections": [
+                  {
+                    "name": "blob-pls",
+                    "properties": {
+                      "privateLinkServiceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
+                      "groupIds": ["blob"]
+                    }
+                  }
+                ]
+              },
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+            },
+            {
+              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+              "apiVersion": "2023-05-01",
+              "name": "[format('{0}/{1}', format('{0}-pe', parameters('name')), 'blob-dns')]",
+              "properties": {
+                "privateDnsZoneConfigs": [
+                  {
+                    "name": "blob-dns-zone",
+                    "properties": {
+                      "privateDnsZoneId": "[parameters('privateDnsZoneId')]"
+                    }
+                  }
+                ]
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateEndpoints', format('{0}-pe', parameters('name')))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/privateEndpoints",
+              "apiVersion": "2023-05-01",
+              "name": "[format('{0}-file-pe', parameters('name'))]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "subnet": {
+                  "id": "[parameters('privateEndpointSubnetId')]"
+                },
+                "customNetworkInterfaceName": "[format('{0}-file-nic', parameters('name'))]",
+                "privateLinkServiceConnections": [
+                  {
+                    "name": "file-pls",
+                    "properties": {
+                      "privateLinkServiceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
+                      "groupIds": ["file"]
+                    }
+                  }
+                ]
+              },
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+            },
+            {
+              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+              "apiVersion": "2023-05-01",
+              "name": "[format('{0}/{1}', format('{0}-file-pe', parameters('name')), 'file-dns')]",
+              "properties": {
+                "privateDnsZoneConfigs": [
+                  {
+                    "name": "file-dns-zone",
+                    "properties": {
+                      "privateDnsZoneId": "[parameters('filePrivateDnsZoneId')]"
+                    }
+                  }
+                ]
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateEndpoints', format('{0}-file-pe', parameters('name')))]"
+              ]
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', variables('kvName'), variables('storageSecretName'))]",
+              "properties": {
+                "value": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2024-01-01').keys[0].value]"
+              },
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+            }
+          ],
+          "outputs": {
+            "scriptStorageAccountName": {
+              "type": "string",
+              "metadata": {
+                "description": "Storage account name for deploymentScripts logs"
+              },
+              "value": "[parameters('name')]"
+            },
+            "scriptLogsContainerName": {
+              "type": "string",
+              "metadata": {
+                "description": "Blob container name for deploymentScripts logs"
+              },
+              "value": "[parameters('logsContainerName')]"
+            },
+            "flowiseFileShareName": {
+              "type": "string",
+              "metadata": {
+                "description": "File share name for Flowise data"
+              },
+              "value": "[parameters('fileShareName')]"
+            },
+            "storageSecretName": {
+              "type": "string",
+              "metadata": {
+                "description": "Storage account key secret name in Key Vault"
+              },
+              "value": "[variables('storageSecretName')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]",
+        "[resourceId('Microsoft.Resources/deployments', 'network')]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "appServicePlan",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[variables('deploymentLocation')]"
+          },
+          "name": {
+            "value": "[format('{0}-miso-asp', variables('infrastructureName'))]"
+          },
+          "skuDisplay": {
+            "value": "B2"
+          },
+          "capacity": {
+            "value": 2
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "4988795866576200937"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region to deploy the App Service Plan, e.g. westeurope"
+              }
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the App Service Plan"
+              }
+            },
+            "skuDisplay": {
+              "type": "string",
+              "allowedValues": [
+                "B1",
+                "B2",
+                "B3",
+                "S1",
+                "S2",
+                "S3",
+                "P1v3",
+                "P2v3",
+                "P3v3",
+                "EP1",
+                "EP2",
+                "EP3"
+              ],
+              "metadata": {
+                "description": "Select a Linux-compatible App Service Plan SKU with details"
+              }
+            },
+            "capacity": {
+              "type": "int",
+              "defaultValue": 1,
+              "minValue": 1,
+              "metadata": {
+                "description": "Number of instances to provision in the App Service Plan"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Resource tags to apply to the App Service Plan"
+              }
+            }
+          },
+          "variables": {
+            "skuCode": "[parameters('skuDisplay')]",
+            "skuTiers": {
+              "B1": "Basic",
+              "B2": "Basic",
+              "B3": "Basic",
+              "S1": "Standard",
+              "S2": "Standard",
+              "S3": "Standard",
+              "P1v3": "PremiumV3",
+              "P2v3": "PremiumV3",
+              "P3v3": "PremiumV3",
+              "EP1": "ElasticPremium",
+              "EP2": "ElasticPremium",
+              "EP3": "ElasticPremium"
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Web/serverfarms",
+              "apiVersion": "2023-12-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[variables('skuCode')]",
+                "tier": "[variables('skuTiers')[variables('skuCode')]]",
+                "size": "[variables('skuCode')]",
+                "capacity": "[parameters('capacity')]"
+              },
+              "kind": "linux",
+              "properties": {
+                "reserved": true
+              }
+            }
+          ],
+          "outputs": {
+            "planId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]"
+            },
+            "planName": {
+              "type": "string",
+              "value": "[parameters('name')]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "condition": "[parameters('enableAppInsights')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "appInsights",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[format('{0}-miso-keycloak', variables('infrastructureName'))]"
+          },
+          "location": {
+            "value": "[variables('appInsightsLocation')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "4160792943473810009"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Application Insights component"
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Resource tags"
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Insights/components",
+              "apiVersion": "2020-02-02",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "kind": "web",
+              "properties": {
+                "Application_Type": "web",
+                "Request_Source": "rest"
+              },
+              "tags": "[parameters('tags')]"
+            }
+          ],
+          "outputs": {
+            "instrumentationKey": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Insights/components', parameters('name')), '2020-02-02').InstrumentationKey]"
+            },
+            "connectionString": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Insights/components', parameters('name')), '2020-02-02').ConnectionString]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "bootstrapSecrets",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "infrastructureName": {
+            "value": "[variables('infrastructureName')]"
+          },
+          "keyVaultName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultName.value]"
+          },
+          "adminPassword": {
+            "value": "[parameters('adminPassword')]"
+          },
+          "encryptionKeyOverride": {
+            "value": "[parameters('encryptionKey')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "8977479852148651255"
+            }
+          },
+          "parameters": {
+            "infrastructureName": {
+              "type": "string",
+              "metadata": {
+                "description": "Infrastructure name prefix (secret names + entropy seed)"
+              }
+            },
+            "keyVaultName": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault name (existing)"
+              }
+            },
+            "adminPassword": {
+              "type": "securestring",
+              "metadata": {
+                "description": "Initial platform administrator password (user-supplied; not used for PG/Keycloak/encryption)"
+              }
+            },
+            "encryptionKeyOverride": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional encryption key override. Empty → generate install-unique key."
+              }
+            }
+          },
+          "variables": {
+            "seed": "[uniqueString(resourceGroup().id, parameters('infrastructureName'), 'mp-bootstrap-secrets-v1')]",
+            "postgresPassword": "[format('Pg!9{0}{1}', take(replace(guid(variables('seed'), 'pg-a'), '-', ''), 16), take(replace(guid(variables('seed'), 'pg-b'), '-', ''), 16))]",
+            "keycloakPassword": "[format('Kc!9{0}{1}', take(replace(guid(variables('seed'), 'kc-a'), '-', ''), 16), take(replace(guid(variables('seed'), 'kc-b'), '-', ''), 16))]",
+            "generatedEncryptionKey": "[take(format('{0}{1}{2}', replace(guid(variables('seed'), 'enc-a'), '-', ''), replace(guid(variables('seed'), 'enc-b'), '-', ''), replace(guid(variables('seed'), 'enc-c'), '-', '')), 64)]",
+            "encryptionKey": "[if(not(empty(parameters('encryptionKeyOverride'))), parameters('encryptionKeyOverride'), variables('generatedEncryptionKey'))]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), format('{0}-onboarding-admin-password', parameters('infrastructureName')))]",
+              "properties": {
+                "value": "[parameters('adminPassword')]"
+              }
+            }
+          ],
+          "outputs": {
+            "postgresPassword": {
+              "type": "string",
+              "value": "[variables('postgresPassword')]"
+            },
+            "keycloakPassword": {
+              "type": "string",
+              "value": "[variables('keycloakPassword')]"
+            },
+            "encryptionKey": {
+              "type": "string",
+              "value": "[variables('encryptionKey')]"
+            },
+            "onboardingAdminPasswordSecretName": {
+              "type": "string",
+              "value": "[format('{0}-onboarding-admin-password', parameters('infrastructureName'))]"
+            }
+          }
+        }
+      },
+      "dependsOn": ["[resourceId('Microsoft.Resources/deployments', 'keyVault')]"]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "postgresql",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[format('{0}-miso-pg', variables('infrastructureName'))]"
+          },
+          "location": {
+            "value": "[variables('deploymentLocation')]"
+          },
+          "administratorLogin": {
+            "value": "aifabrixadmin"
+          },
+          "administratorLoginPassword": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.postgresPassword.value]"
+          },
+          "version": {
+            "value": "15"
+          },
+          "skuName": {
+            "value": "Standard_B2ms"
+          },
+          "skuTier": {
+            "value": "Burstable"
+          },
+          "storageSizeGB": {
+            "value": 64
+          },
+          "subnetId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.postgresSubnetId.value]"
+          },
+          "privateDnsZoneId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.postgresPrivateDnsZoneId.value]"
+          },
+          "keyVaultId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultId.value]"
+          },
+          "secretPrefix": {
+            "value": "[variables('infrastructureName')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enablePublicAccess": {
+            "value": "[parameters('enablePostgresPublicAccess')]"
+          },
+          "allowedPublicIPs": {
+            "value": "[parameters('allowedIPs')]"
+          },
+          "prismaMainConnectionLimit": {
+            "value": 5
+          },
+          "prismaMainPoolTimeout": {
+            "value": 20
+          },
+          "prismaLogsConnectionLimit": {
+            "value": 5
+          },
+          "prismaLogsPoolTimeout": {
+            "value": 20
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "15798309166903375415"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "PostgreSQL Flexible Server name"
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region for the PostgreSQL server"
+              }
+            },
+            "administratorLogin": {
+              "type": "string",
+              "defaultValue": "aifabrixadmin",
+              "metadata": {
+                "description": "PostgreSQL administrator login username"
+              }
+            },
+            "administratorLoginPassword": {
+              "type": "securestring",
+              "metadata": {
+                "description": "PostgreSQL administrator login password (stored in Key Vault)"
+              }
+            },
+            "version": {
+              "type": "string",
+              "defaultValue": "15",
+              "metadata": {
+                "description": "PostgreSQL version"
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "Standard_B1ms",
+              "metadata": {
+                "description": "SKU name (e.g., Standard_B1ms)"
+              }
+            },
+            "skuTier": {
+              "type": "string",
+              "defaultValue": "Burstable",
+              "allowedValues": ["Burstable", "GeneralPurpose", "MemoryOptimized"],
+              "metadata": {
+                "description": "SKU tier for PostgreSQL Flexible Server"
+              }
+            },
+            "storageSizeGB": {
+              "type": "int",
+              "defaultValue": 32,
+              "metadata": {
+                "description": "Storage size in GB"
+              }
+            },
+            "subnetId": {
+              "type": "string",
+              "metadata": {
+                "description": "VNet subnet resource ID for PostgreSQL"
+              }
+            },
+            "privateDnsZoneId": {
+              "type": "string",
+              "metadata": {
+                "description": "Private DNS zone ARM resource ID for PostgreSQL (privatelink.postgres.database.azure.com)"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Resource tags to apply to PostgreSQL"
+              }
+            },
+            "keyVaultId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Key Vault resource ID for storing DATABASE_URL secret"
+              }
+            },
+            "secretPrefix": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Prefix for Key Vault secret naming (e.g., infrastructure name)"
+              }
+            },
+            "enablePublicAccess": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable public network access for developer access (default: false for security)"
+              }
+            },
+            "allowedPublicIPs": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "List of public IP addresses allowed to access PostgreSQL (CIDR format, e.g., [\"1.2.3.4/32\", \"5.6.7.8/32\"])"
+              }
+            },
+            "prismaMainConnectionLimit": {
+              "type": "int",
+              "defaultValue": 5,
+              "metadata": {
+                "description": "Prisma main database connection limit appended to DATABASE_URL"
+              }
+            },
+            "prismaMainPoolTimeout": {
+              "type": "int",
+              "defaultValue": 20,
+              "metadata": {
+                "description": "Prisma main database pool timeout (seconds) appended to DATABASE_URL"
+              }
+            },
+            "prismaLogsConnectionLimit": {
+              "type": "int",
+              "defaultValue": 5,
+              "metadata": {
+                "description": "Prisma logs database connection limit appended to DATABASELOG_URL"
+              }
+            },
+            "prismaLogsPoolTimeout": {
+              "type": "int",
+              "defaultValue": 20,
+              "metadata": {
+                "description": "Prisma logs database pool timeout (seconds) appended to DATABASELOG_URL"
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.DBforPostgreSQL/flexibleServers",
+              "apiVersion": "2023-06-01-preview",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[parameters('skuName')]",
+                "tier": "[parameters('skuTier')]"
+              },
+              "properties": {
+                "version": "[parameters('version')]",
+                "administratorLogin": "[parameters('administratorLogin')]",
+                "administratorLoginPassword": "[parameters('administratorLoginPassword')]",
+                "storage": {
+                  "storageSizeGB": "[parameters('storageSizeGB')]"
+                },
+                "network": "[if(parameters('enablePublicAccess'), createObject('publicNetworkAccess', 'Enabled'), createObject('publicNetworkAccess', 'Disabled', 'delegatedSubnetResourceId', parameters('subnetId'), 'privateDnsZoneArmResourceId', parameters('privateDnsZoneId')))]",
+                "backup": {
+                  "backupRetentionDays": 7,
+                  "geoRedundantBackup": "Disabled"
+                },
+                "highAvailability": {
+                  "mode": "Disabled"
+                },
+                "maintenanceWindow": {
+                  "customWindow": "Disabled",
+                  "dayOfWeek": 0,
+                  "startHour": 0,
+                  "startMinute": 0
+                }
+              }
+            },
+            {
+              "copy": {
+                "name": "firewallRules",
+                "count": "[length(parameters('allowedPublicIPs'))]",
+                "mode": "serial",
+                "batchSize": 1
+              },
+              "condition": "[parameters('enablePublicAccess')]",
+              "type": "Microsoft.DBforPostgreSQL/flexibleServers/firewallRules",
+              "apiVersion": "2023-06-01-preview",
+              "name": "[format('{0}/{1}', parameters('name'), format('AllowDevIP_{0}', replace(replace(parameters('allowedPublicIPs')[copyIndex()], '.', '_'), '/', '_')))]",
+              "properties": {
+                "startIpAddress": "[split(parameters('allowedPublicIPs')[copyIndex()], '/')[0]]",
+                "endIpAddress": "[split(parameters('allowedPublicIPs')[copyIndex()], '/')[0]]"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name'))]"
+              ]
+            },
+            {
+              "condition": "[parameters('enablePublicAccess')]",
+              "type": "Microsoft.DBforPostgreSQL/flexibleServers/firewallRules",
+              "apiVersion": "2023-06-01-preview",
+              "name": "[format('{0}/{1}', parameters('name'), 'AllowAzureServices')]",
+              "properties": {
+                "startIpAddress": "0.0.0.0",
+                "endIpAddress": "0.0.0.0"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.DBforPostgreSQL/flexibleServers/databases",
+              "apiVersion": "2023-06-01-preview",
+              "name": "[format('{0}/{1}', parameters('name'), 'miso')]",
+              "properties": {
+                "charset": "UTF8",
+                "collation": "en_US.utf8"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.DBforPostgreSQL/flexibleServers/databases",
+              "apiVersion": "2023-06-01-preview",
+              "name": "[format('{0}/{1}', parameters('name'), 'miso-logs')]",
+              "properties": {
+                "charset": "UTF8",
+                "collation": "en_US.utf8"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.DBforPostgreSQL/flexibleServers/databases",
+              "apiVersion": "2023-06-01-preview",
+              "name": "[format('{0}/{1}', parameters('name'), 'keycloak')]",
+              "properties": {
+                "charset": "UTF8",
+                "collation": "en_US.utf8"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name'))]"
+              ]
+            },
+            {
+              "condition": "[and(not(empty(parameters('keyVaultId'))), not(empty(parameters('secretPrefix'))))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', last(split(parameters('keyVaultId'), '/')), format('{0}-databases-0-urlKeyVault', parameters('secretPrefix')))]",
+              "properties": {
+                "value": "[if(not(empty(parameters('keyVaultId'))), format('postgresql://{0}:{1}@{2}:5432/{3}?sslmode=require&connection_limit={4}&pool_timeout={5}', parameters('administratorLogin'), parameters('administratorLoginPassword'), reference(resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name')), '2023-06-01-preview').fullyQualifiedDomainName, 'miso', parameters('prismaMainConnectionLimit'), parameters('prismaMainPoolTimeout')), '')]"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers/databases', parameters('name'), 'miso')]",
+                "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name'))]"
+              ]
+            },
+            {
+              "condition": "[and(not(empty(parameters('keyVaultId'))), not(empty(parameters('secretPrefix'))))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', last(split(parameters('keyVaultId'), '/')), format('{0}-databases-1-urlKeyVault', parameters('secretPrefix')))]",
+              "properties": {
+                "value": "[if(not(empty(parameters('keyVaultId'))), format('postgresql://{0}:{1}@{2}:5432/{3}?sslmode=require&connection_limit={4}&pool_timeout={5}', parameters('administratorLogin'), parameters('administratorLoginPassword'), reference(resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name')), '2023-06-01-preview').fullyQualifiedDomainName, 'miso-logs', parameters('prismaLogsConnectionLimit'), parameters('prismaLogsPoolTimeout')), '')]"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers/databases', parameters('name'), 'miso-logs')]",
+                "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name'))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "serverId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name'))]"
+            },
+            "serverName": {
+              "type": "string",
+              "value": "[parameters('name')]"
+            },
+            "serverFqdn": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name')), '2023-06-01-preview').fullyQualifiedDomainName]"
+            },
+            "administratorLogin": {
+              "type": "string",
+              "value": "[parameters('administratorLogin')]"
+            },
+            "misoDatabaseName": {
+              "type": "string",
+              "value": "miso"
+            },
+            "logsDatabaseName": {
+              "type": "string",
+              "value": "miso-logs"
+            },
+            "keycloakDatabaseName": {
+              "type": "string",
+              "value": "keycloak"
+            },
+            "databaseUrlSecretUriWithVersion": {
+              "type": "string",
+              "value": "[if(and(not(empty(parameters('keyVaultId'))), not(empty(parameters('secretPrefix')))), reference(resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-databases-0-urlKeyVault', parameters('secretPrefix'))), '2023-07-01').secretUriWithVersion, '')]"
+            },
+            "databaseLogUrlSecretUriWithVersion": {
+              "type": "string",
+              "value": "[if(and(not(empty(parameters('keyVaultId'))), not(empty(parameters('secretPrefix')))), reference(resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-databases-1-urlKeyVault', parameters('secretPrefix'))), '2023-07-01').secretUriWithVersion, '')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]",
+        "[resourceId('Microsoft.Resources/deployments', 'network')]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "keycloakWebApp",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[format('{0}-miso-keycloak', variables('infrastructureName'))]"
+          },
+          "location": {
+            "value": "[variables('deploymentLocation')]"
+          },
+          "planId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'appServicePlan'), '2025-04-01').outputs.planId.value]"
+          },
+          "keyVaultId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultId.value]"
+          },
+          "image": {
+            "value": "[variables('keycloakContainerImage')]"
+          },
+          "acrLoginServer": {
+            "value": "[variables('effectiveAcrLoginServer')]"
+          },
+          "acrAdminUsername": {
+            "value": "[variables('registryUsername')]"
+          },
+          "acrAdminPassword": {
+            "value": "[parameters('acrAdminPassword')]"
+          },
+          "prefix": {
+            "value": "[variables('infrastructureName')]"
+          },
+          "postgresServerFqdn": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.serverFqdn.value]"
+          },
+          "postgresAdminLogin": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.administratorLogin.value]"
+          },
+          "postgresDatabaseName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.keycloakDatabaseName.value]"
+          },
+          "postgresAdminPassword": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.postgresPassword.value]"
+          },
+          "keycloakAdminUser": {
+            "value": "admin"
+          },
+          "keycloakAdminPassword": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.keycloakPassword.value]"
+          },
+          "keycloakVdirPublic": {
+            "value": "[variables('keycloakVdirPublic')]"
+          },
+          "vnetSubnetId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.webappSubnetId.value]"
+          },
+          "appInsightsInstrumentationKey": "[if(parameters('enableAppInsights'), createObject('value', reference(resourceId('Microsoft.Resources/deployments', 'appInsights'), '2025-04-01').outputs.instrumentationKey.value), createObject('value', ''))]",
+          "enablePostgresPublicAccess": {
+            "value": "[parameters('enablePostgresPublicAccess')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "6101318472045983896"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Keycloak web app"
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region for the web app"
+              }
+            },
+            "planId": {
+              "type": "string",
+              "metadata": {
+                "description": "App Service Plan resource ID"
+              }
+            },
+            "keyVaultId": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault resource ID"
+              }
+            },
+            "image": {
+              "type": "string",
+              "defaultValue": "quay.io/keycloak/keycloak:latest",
+              "metadata": {
+                "description": "Docker image for Keycloak (use ACR path when pulling from private registry, e.g. myacr.azurecr.io/aifabrix/keycloak:latest)"
+              }
+            },
+            "acrLoginServer": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "ACR login server (e.g. myacr.azurecr.io). Image pull uses the web app managed identity; registry credentials below are applied only when acrAdminPassword is supplied."
+              }
+            },
+            "acrAdminUsername": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "ACR admin username (typically the registry name) when using admin credentials for image pull"
+              }
+            },
+            "acrAdminPassword": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional private-registry pull token/password. When non-empty it is stored as Key Vault {prefix}-acr-registry-password for Keycloak and Miso; when empty no registry secret or DOCKER_REGISTRY_SERVER_USERNAME/PASSWORD setting is created."
+              }
+            },
+            "prefix": {
+              "type": "string",
+              "metadata": {
+                "description": "Prefix for naming and Key Vault secrets"
+              }
+            },
+            "postgresServerFqdn": {
+              "type": "string",
+              "metadata": {
+                "description": "PostgreSQL server FQDN"
+              }
+            },
+            "postgresAdminLogin": {
+              "type": "string",
+              "metadata": {
+                "description": "PostgreSQL administrator login"
+              }
+            },
+            "postgresDatabaseName": {
+              "type": "string",
+              "metadata": {
+                "description": "PostgreSQL database name for Keycloak"
+              }
+            },
+            "postgresAdminPassword": {
+              "type": "securestring",
+              "metadata": {
+                "description": "PostgreSQL administrator password (will be stored in Key Vault)"
+              }
+            },
+            "keycloakAdminUser": {
+              "type": "string",
+              "defaultValue": "admin",
+              "metadata": {
+                "description": "Keycloak admin username"
+              }
+            },
+            "keycloakAdminPassword": {
+              "type": "securestring",
+              "metadata": {
+                "description": "Keycloak admin password (stored in Key Vault)"
+              }
+            },
+            "vnetSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "VNet subnet resource ID for App Service VNet integration"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Resource tags to apply to the Web App"
+              }
+            },
+            "appInsightsInstrumentationKey": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Application Insights instrumentation key (optional)"
+              }
+            },
+            "enablePostgresPublicAccess": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable public access for PostgreSQL (affects WEBSITE_VNET_ROUTE_ALL setting)"
+              }
+            },
+            "keycloakVdirPublic": {
+              "type": "string",
+              "defaultValue": "/auth",
+              "metadata": {
+                "description": "HTTP relative path for Keycloak (e.g. /auth when Front Door routes /auth/*)"
+              }
+            }
+          },
+          "variables": {
+            "registryPasswordConfigured": "[and(not(empty(parameters('acrLoginServer'))), not(empty(parameters('acrAdminPassword'))))]",
+            "appInsightsAppSettings": "[if(empty(parameters('appInsightsInstrumentationKey')), createArray(), createArray(createObject('name', 'APPINSIGHTS_INSTRUMENTATIONKEY', 'value', parameters('appInsightsInstrumentationKey')), createObject('name', 'APPLICATIONINSIGHTS_CONNECTION_STRING', 'value', format('InstrumentationKey={0}', parameters('appInsightsInstrumentationKey')))))]",
+            "acrRegistryUrlAppSettings": "[if(not(empty(parameters('acrLoginServer'))), createArray(createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', format('https://{0}', parameters('acrLoginServer')))), createArray())]",
+            "acrRegistryCredentialAppSettings": "[if(variables('registryPasswordConfigured'), createArray(createObject('name', 'DOCKER_REGISTRY_SERVER_USERNAME', 'value', parameters('acrAdminUsername')), createObject('name', 'DOCKER_REGISTRY_SERVER_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-acr-registry-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))), createArray())]",
+            "keycloakVdirSegment": "[if(or(equals(parameters('keycloakVdirPublic'), ''), equals(parameters('keycloakVdirPublic'), '/')), '', if(startsWith(parameters('keycloakVdirPublic'), '/'), parameters('keycloakVdirPublic'), format('/{0}', parameters('keycloakVdirPublic'))))]",
+            "keycloakHttpRelativePath": "[if(empty(variables('keycloakVdirSegment')), '/', variables('keycloakVdirSegment'))]",
+            "keycloakHealthCheckPath": "[if(empty(variables('keycloakVdirSegment')), '/health/ready', format('{0}/health/ready', variables('keycloakVdirSegment')))]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', last(split(parameters('keyVaultId'), '/')), format('{0}-postgres-admin-password', parameters('prefix')))]",
+              "properties": {
+                "value": "[parameters('postgresAdminPassword')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', last(split(parameters('keyVaultId'), '/')), format('{0}-keycloak-admin-password', parameters('prefix')))]",
+              "properties": {
+                "value": "[parameters('keycloakAdminPassword')]"
+              }
+            },
+            {
+              "condition": "[variables('registryPasswordConfigured')]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', last(split(parameters('keyVaultId'), '/')), format('{0}-acr-registry-password', parameters('prefix')))]",
+              "properties": {
+                "value": "[parameters('acrAdminPassword')]"
+              }
+            },
+            {
+              "type": "Microsoft.Web/sites",
+              "apiVersion": "2023-01-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "app,linux,container",
+              "identity": {
+                "type": "SystemAssigned"
+              },
+              "properties": {
+                "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', last(split(parameters('planId'), '/')))]",
+                "httpsOnly": true,
+                "keyVaultReferenceIdentity": "SystemAssigned",
+                "vnetImagePullEnabled": "[not(empty(parameters('vnetSubnetId')))]",
+                "virtualNetworkSubnetId": "[if(not(empty(parameters('vnetSubnetId'))), parameters('vnetSubnetId'), null())]",
+                "siteConfig": {
+                  "linuxFxVersion": "[format('DOCKER|{0}', parameters('image'))]",
+                  "acrUseManagedIdentityCreds": true,
+                  "appCommandLine": "start --optimized=false",
+                  "healthCheckPath": "[variables('keycloakHealthCheckPath')]",
+                  "alwaysOn": true,
+                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_PORT', 'value', '8080'), createObject('name', 'KEYCLOAK_ADMIN', 'value', parameters('keycloakAdminUser')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(SecretUri={0})', reference(resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-keycloak-admin-password', parameters('prefix'))), '2023-07-01').secretUriWithVersion)), createObject('name', 'KC_DB', 'value', 'postgres'), createObject('name', 'KC_DB_URL_HOST', 'value', parameters('postgresServerFqdn')), createObject('name', 'KC_DB_URL_DATABASE', 'value', parameters('postgresDatabaseName')), createObject('name', 'KC_DB_URL_PORT', 'value', '5432'), createObject('name', 'KC_DB_URL', 'value', format('jdbc:postgresql://{0}:5432/{1}', parameters('postgresServerFqdn'), parameters('postgresDatabaseName'))), createObject('name', 'KC_DB_USERNAME', 'value', parameters('postgresAdminLogin')), createObject('name', 'KC_DB_PASSWORD', 'value', format('@Microsoft.KeyVault(SecretUri={0})', reference(resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-postgres-admin-password', parameters('prefix'))), '2023-07-01').secretUriWithVersion)), createObject('name', 'KC_HOSTNAME', 'value', format('{0}.azurewebsites.net', parameters('name'))), createObject('name', 'KC_HOSTNAME_URL', 'value', format('https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'KC_HOSTNAME_ADMIN_URL', 'value', format('https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'KC_HOSTNAME_STRICT', 'value', 'false'), createObject('name', 'KC_HOSTNAME_STRICT_BACKEND', 'value', 'false'), createObject('name', 'KC_HOSTNAME_STRICT_HTTPS', 'value', 'false'), createObject('name', 'KC_HTTP_ENABLED', 'value', 'true'), createObject('name', 'KC_HTTP_RELATIVE_PATH', 'value', variables('keycloakHttpRelativePath')), createObject('name', 'KC_HTTP_MANAGEMENT_ENABLED', 'value', 'true'), createObject('name', 'KC_HTTP_MANAGEMENT_PORT', 'value', '9000'), createObject('name', 'KC_HTTP_MANAGEMENT_HEALTH_ENABLED', 'value', 'false'), createObject('name', 'KC_PROXY', 'value', 'edge'), createObject('name', 'KC_PROXY_HEADERS', 'value', 'xforwarded'), createObject('name', 'KC_PROXY_HEADERS_FORWARDED', 'value', 'true'), createObject('name', 'KC_HEALTH_ENABLED', 'value', 'true'), createObject('name', 'KC_CACHE', 'value', 'local'), createObject('name', 'KC_FEATURES', 'value', 'preview,cimd'), createObject('name', 'KC_SPI_EMAIL_SENDER__PROVIDER', 'value', 'mori'), createObject('name', 'KC_METRICS_ENABLED', 'value', 'true'), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'KC_LOG', 'value', 'console'), createObject('name', 'KC_LOG_LEVEL', 'value', 'INFO')), variables('appInsightsAppSettings'), variables('acrRegistryUrlAppSettings'), variables('acrRegistryCredentialAppSettings'))]",
+                  "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
+                },
+                "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-acr-registry-password', parameters('prefix')))]",
+                "[resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-keycloak-admin-password', parameters('prefix')))]",
+                "[resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-postgres-admin-password', parameters('prefix')))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Web/sites/config",
+              "apiVersion": "2023-01-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+              "properties": {
+                "applicationLogs": {
+                  "fileSystem": {
+                    "level": "Information"
+                  }
+                },
+                "httpLogs": {
+                  "fileSystem": {
+                    "enabled": true,
+                    "retentionInDays": 7,
+                    "retentionInMb": 100
+                  }
+                },
+                "detailedErrorMessages": {
+                  "enabled": true
+                },
+                "failedRequestsTracing": {
+                  "enabled": true
+                }
+              },
+              "dependsOn": ["[resourceId('Microsoft.Web/sites', parameters('name'))]"]
+            }
+          ],
+          "outputs": {
+            "webAppName": {
+              "type": "string",
+              "value": "[parameters('name')]"
+            },
+            "webAppUrl": {
+              "type": "string",
+              "value": "[format('https://{0}', reference(resourceId('Microsoft.Web/sites', parameters('name')), '2023-01-01').defaultHostName)]"
+            },
+            "webAppId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+            },
+            "keycloakAdminUser": {
+              "type": "string",
+              "value": "[parameters('keycloakAdminUser')]"
+            },
+            "keycloakRealmUrl": {
+              "type": "string",
+              "value": "[if(empty(variables('keycloakVdirSegment')), format('https://{0}/realms/aifabrix', reference(resourceId('Microsoft.Web/sites', parameters('name')), '2023-01-01').defaultHostName), format('https://{0}{1}/realms/aifabrix', reference(resourceId('Microsoft.Web/sites', parameters('name')), '2023-01-01').defaultHostName, variables('keycloakVdirSegment')))]"
+            },
+            "principalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned managed identity object id (for Key Vault access policies)"
+              },
+              "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2023-01-01', 'full').identity.principalId]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'appInsights')]",
+        "[resourceId('Microsoft.Resources/deployments', 'appServicePlan')]",
+        "[resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]",
+        "[resourceId('Microsoft.Resources/deployments', 'network')]",
+        "[resourceId('Microsoft.Resources/deployments', 'postgresql')]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "keyVaultSecretsPhase1",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "keyVaultName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultName.value]"
+          },
+          "prefix": {
+            "value": "[variables('infrastructureName')]"
+          },
+          "keycloakWebAppUrl": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.webAppUrl.value]"
+          },
+          "keycloakVdirPublic": {
+            "value": "[variables('keycloakVdirPublic')]"
+          },
+          "misoWebAppUrl": {
+            "value": "[format('https://{0}-miso-miso.azurewebsites.net', variables('infrastructureName'))]"
+          },
+          "misoVdirPublic": {
+            "value": "/miso"
+          },
+          "encryptionKey": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "9394845529752045254"
+            }
+          },
+          "parameters": {
+            "keyVaultName": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault name"
+              }
+            },
+            "prefix": {
+              "type": "string",
+              "metadata": {
+                "description": "Prefix for secret naming"
+              }
+            },
+            "keycloakWebAppUrl": {
+              "type": "string",
+              "metadata": {
+                "description": "Keycloak web app origin URL (App Service hostname, no virtual-directory suffix)"
+              }
+            },
+            "keycloakVdirPublic": {
+              "type": "string",
+              "defaultValue": "/auth",
+              "metadata": {
+                "description": "Public virtual-directory path for Keycloak (e.g. /auth from /auth/* Front Door route)"
+              }
+            },
+            "misoWebAppUrl": {
+              "type": "string",
+              "metadata": {
+                "description": "MISO Controller web app origin URL (App Service hostname, no virtual-directory suffix)"
+              }
+            },
+            "misoVdirPublic": {
+              "type": "string",
+              "defaultValue": "/miso",
+              "metadata": {
+                "description": "Public virtual-directory path for MISO behind Front Door (e.g. /miso from /miso/*)"
+              }
+            },
+            "encryptionKey": {
+              "type": "securestring",
+              "metadata": {
+                "description": "Encryption key for MISO Controller"
+              }
+            },
+            "jwtSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "JWT secret for MISO Controller (auto-generated if not provided)"
+              }
+            },
+            "misoClientId": {
+              "type": "string",
+              "defaultValue": "miso-controller-miso-miso-controller",
+              "metadata": {
+                "description": "MISO Client ID - Format: {controllerKey}-{environmentKey}-{applicationKey}"
+              }
+            },
+            "misoClientSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "MISO Client Secret (auto-generated if not provided)"
+              }
+            }
+          },
+          "variables": {
+            "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
+            "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
+            "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
+            "misoVdirSecretValue": "[if(empty(variables('misoVdirSegment')), '/', variables('misoVdirSegment'))]",
+            "keycloakWebAppOrigin": "[if(endsWith(parameters('keycloakWebAppUrl'), '/'), substring(parameters('keycloakWebAppUrl'), 0, max(0, sub(length(parameters('keycloakWebAppUrl')), 1))), parameters('keycloakWebAppUrl'))]",
+            "keycloakVdirSegment": "[if(or(equals(parameters('keycloakVdirPublic'), ''), equals(parameters('keycloakVdirPublic'), '/')), '', if(startsWith(parameters('keycloakVdirPublic'), '/'), parameters('keycloakVdirPublic'), format('/{0}', parameters('keycloakVdirPublic'))))]",
+            "keycloakServerPublicUrl": "[if(empty(variables('keycloakVdirSegment')), variables('keycloakWebAppOrigin'), format('{0}{1}', variables('keycloakWebAppOrigin'), variables('keycloakVdirSegment')))]",
+            "keycloakVdirSecretValue": "[if(empty(variables('keycloakVdirSegment')), '/', variables('keycloakVdirSegment'))]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'keycloak-vdir-public')]",
+              "properties": {
+                "value": "[variables('keycloakVdirSecretValue')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'keycloak-web-server-url')]",
+              "properties": {
+                "value": "[variables('keycloakServerPublicUrl')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'keycloak-internal-server-url')]",
+              "properties": {
+                "value": "[variables('keycloakServerPublicUrl')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'miso-controller-vdir-public')]",
+              "properties": {
+                "value": "[variables('misoVdirSecretValue')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'miso-controller-web-server-url')]",
+              "properties": {
+                "value": "[variables('misoWebServerPublicUrl')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'miso-controller-internal-server-urlKeyVault')]",
+              "properties": {
+                "value": "[parameters('misoWebAppUrl')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), format('{0}-encryption-keyKeyVault', parameters('prefix')))]",
+              "properties": {
+                "value": "[parameters('encryptionKey')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), format('{0}-secrets-jwtKeyVault', parameters('prefix')))]",
+              "properties": {
+                "value": "[if(not(empty(parameters('jwtSecret'))), parameters('jwtSecret'), format('PLACEHOLDER_JWT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), format('{0}-miso-clientIdKeyVault', parameters('prefix')))]",
+              "properties": {
+                "value": "[parameters('misoClientId')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'miso-controller-client-secretKeyVault')]",
+              "properties": {
+                "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keycloakWebApp')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "misoWebApp",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[format('{0}-miso-miso', variables('infrastructureName'))]"
+          },
+          "location": {
+            "value": "[variables('deploymentLocation')]"
+          },
+          "planId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'appServicePlan'), '2025-04-01').outputs.planId.value]"
+          },
+          "keyVaultId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultId.value]"
+          },
+          "image": {
+            "value": "[variables('misoControllerContainerImage')]"
+          },
+          "vnetSubnetId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.webappSubnetId.value]"
+          },
+          "prefix": {
+            "value": "[variables('infrastructureName')]"
+          },
+          "storageAccountName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'storage'), '2025-04-01').outputs.scriptStorageAccountName.value]"
+          },
+          "fileShareName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'storage'), '2025-04-01').outputs.flowiseFileShareName.value]"
+          },
+          "keycloakWebAppUrl": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.webAppUrl.value]"
+          },
+          "keycloakRealm": {
+            "value": "aifabrix"
+          },
+          "keycloakClientId": {
+            "value": "miso-controller"
+          },
+          "keycloakAdminUsername": {
+            "value": "admin"
+          },
+          "autoCreateTables": {
+            "value": true
+          },
+          "misoControllerUrl": {
+            "value": "[format('https://{0}-miso-miso.azurewebsites.net', variables('infrastructureName'))]"
+          },
+          "acrResourceId": {
+            "value": "[parameters('acrResourceId')]"
+          },
+          "acrLoginServer": {
+            "value": "[variables('effectiveAcrLoginServer')]"
+          },
+          "acrAdminUsername": {
+            "value": "[variables('registryUsername')]"
+          },
+          "registryPasswordConfigured": {
+            "value": "[variables('registryPasswordConfigured')]"
+          },
+          "databaseUrlSecretUriWithVersion": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.databaseUrlSecretUriWithVersion.value]"
+          },
+          "databaseLogUrlSecretUriWithVersion": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.databaseLogUrlSecretUriWithVersion.value]"
+          },
+          "enablePostgresPublicAccess": {
+            "value": "[parameters('enablePostgresPublicAccess')]"
+          },
+          "deploymentEnvironment": {
+            "value": "[parameters('deploymentEnvironment')]"
+          },
+          "keycloakVerifyAudience": {
+            "value": "[parameters('keycloakVerifyAudience')]"
+          },
+          "moriBaseUrl": {
+            "value": "[parameters('moriBaseUrl')]"
+          },
+          "moriCallbackApiKey": {
+            "value": "[parameters('moriCallbackApiKey')]"
+          },
+          "entraCallbackStateSecret": {
+            "value": "[parameters('entraCallbackStateSecret')]"
+          },
+          "entraIdClientId": {
+            "value": "[parameters('entraIdClientId')]"
+          },
+          "entraIdClientSecret": {
+            "value": "[parameters('entraIdClientSecret')]"
+          },
+          "entraIdTenantId": {
+            "value": "[parameters('entraIdTenantId')]"
+          },
+          "licenseEdition": {
+            "value": "[parameters('licenseEdition')]"
+          },
+          "onboardingMode": {
+            "value": "[parameters('onboardingMode')]"
+          },
+          "resourceGroupName": {
+            "value": "[resourceGroup().name]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "3326510661393380434"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the web app"
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region for the web app"
+              }
+            },
+            "planId": {
+              "type": "string",
+              "metadata": {
+                "description": "App Service Plan resource ID"
+              }
+            },
+            "keyVaultId": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault resource ID"
+              }
+            },
+            "image": {
+              "type": "string",
+              "defaultValue": "flowise/flowise:latest",
+              "metadata": {
+                "description": "Docker image name"
+              }
+            },
+            "prefix": {
+              "type": "string",
+              "metadata": {
+                "description": "Prefix for naming"
+              }
+            },
+            "databaseUrlSecretUriWithVersion": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "When set, DATABASE_URL uses @Microsoft.KeyVault(SecretUri=...) with this versioned URI (from PostgreSQL module output). Avoids stale App Service resolution after DB password rotation."
+              }
+            },
+            "databaseLogUrlSecretUriWithVersion": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "When set, DATABASELOG_URL uses @Microsoft.KeyVault(SecretUri=...) with this versioned URI (from PostgreSQL module output)."
+              }
+            },
+            "storageAccountName": {
+              "type": "string",
+              "metadata": {
+                "description": "Storage account name for file share mapping"
+              }
+            },
+            "fileShareName": {
+              "type": "string",
+              "defaultValue": "data",
+              "metadata": {
+                "description": "File share name"
+              }
+            },
+            "vnetSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "VNet subnet resource ID for App Service VNet integration"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Resource tags to apply to the Web App"
+              }
+            },
+            "acrResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "ACR resource ID for role assignment (optional - requires Owner/User Access Administrator)"
+              }
+            },
+            "acrLoginServer": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "ACR login server URL (e.g., myacr.azurecr.io) - required if using admin credentials"
+              }
+            },
+            "acrAdminUsername": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional registry username. Emitted as DOCKER_REGISTRY_SERVER_USERNAME only when registryPasswordConfigured is true."
+              }
+            },
+            "registryPasswordConfigured": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "True when a registry password was supplied (stored by the Keycloak module as {prefix}-acr-registry-password). False → no DOCKER_REGISTRY_SERVER_USERNAME/PASSWORD settings; image pull uses the managed identity."
+              }
+            },
+            "keycloakWebAppUrl": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Keycloak web app URL (for KEYCLOAK_* settings)"
+              }
+            },
+            "keycloakRealm": {
+              "type": "string",
+              "defaultValue": "aifabrix",
+              "metadata": {
+                "description": "Keycloak realm name"
+              }
+            },
+            "keycloakClientId": {
+              "type": "string",
+              "defaultValue": "miso-controller",
+              "metadata": {
+                "description": "Keycloak client ID for miso-controller"
+              }
+            },
+            "keycloakAdminUsername": {
+              "type": "string",
+              "defaultValue": "admin",
+              "metadata": {
+                "description": "Keycloak admin username"
+              }
+            },
+            "autoCreateTables": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Auto-create database tables on startup"
+              }
+            },
+            "misoControllerUrl": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "MISO controller web app URL (for MISO_WEB_SERVER_URL)"
+              }
+            },
+            "enablePostgresPublicAccess": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable public access for PostgreSQL (affects WEBSITE_VNET_ROUTE_ALL setting)"
+              }
+            },
+            "deploymentEnvironment": {
+              "type": "string",
+              "defaultValue": "nonprod",
+              "allowedValues": ["prod", "nonprod", "evaluation"],
+              "metadata": {
+                "description": "Deployment environment. Use prod for production; non-prod disables API rate limiting by default"
+              }
+            },
+            "keycloakVerifyAudience": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable Keycloak access-token audience validation in controller"
+              }
+            },
+            "moriBaseUrl": {
+              "type": "string",
+              "defaultValue": "https://aifabrix-pro-miso-mori.azurewebsites.net",
+              "metadata": {
+                "description": "Mori base URL (no trailing slash); used for tenant activation / handoff"
+              }
+            },
+            "moriCallbackApiKey": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional shared secret for Mori → controller callback, supplied through the Miso installation/application contract."
+              }
+            },
+            "entraCallbackStateSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional shared HMAC secret for Entra consent OAuth state, supplied through the Miso installation contract."
+              }
+            },
+            "entraIdClientId": {
+              "type": "string",
+              "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
+              "metadata": {
+                "description": "Vendor multi-tenant Entra app client ID."
+              }
+            },
+            "entraIdClientSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional vendor Entra app client secret, supplied through the Miso installation contract."
+              }
+            },
+            "entraIdTenantId": {
+              "type": "string",
+              "defaultValue": "09aff594-ba37-4af2-bf40-b773b654c563",
+              "metadata": {
+                "description": "Publisher/home tenant for vendor Entra app (ENTRA_ID_TENANT_ID). TENANT_ID uses subscription().tenantId at deploy. Default matches vendor miso-controller .env (not in createUiDefinition)."
+              }
+            },
+            "licenseEdition": {
+              "type": "string",
+              "defaultValue": "COMMUNITY",
+              "metadata": {
+                "description": "Requested license: edition name (COMMUNITY, STANDARD, ENTERPRISE) or Azure Marketplace subscription ID (UUID). Validated by Miso. Emitted as LICENSE_EDITION."
+              }
+            },
+            "onboardingMode": {
+              "type": "string",
+              "defaultValue": "customerOwned",
+              "allowedValues": ["customerOwned", "saasDirect"],
+              "metadata": {
+                "description": "Tenant onboarding mode (ONBOARDING_MODE)."
+              }
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().name]",
+              "metadata": {
+                "description": "Resource group that contains the installation (AZURE_RESOURCE_GROUP_NAME)."
+              }
+            },
+            "licenseJwt": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori license JWT for controller. Empty uses Mori subscription validation. DEVELOPMENT is ignored when DEPLOYMENT=azure."
+              }
+            }
+          },
+          "variables": {
+            "shouldDisableRateLimit": "[if(equals(parameters('deploymentEnvironment'), 'prod'), 'false', 'true')]",
+            "databaseUrlAppSettingValue": "[if(not(empty(parameters('databaseUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-0-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
+            "databaseLogUrlAppSettingValue": "[if(not(empty(parameters('databaseLogUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseLogUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-1-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
+            "moriBaseNormalized": "[if(and(greater(length(parameters('moriBaseUrl')), 1), endsWith(parameters('moriBaseUrl'), '/')), substring(parameters('moriBaseUrl'), 0, max(0, sub(length(parameters('moriBaseUrl')), 1))), parameters('moriBaseUrl'))]",
+            "moriEntraGraphDelegatedRedirectUri": "[format('{0}/entra-graph-delegated/callback', variables('moriBaseNormalized'))]",
+            "moriEntraCentralCallbackUri": "[format('{0}/entra-id-concent/callback', variables('moriBaseNormalized'))]",
+            "registryCredentialAppSettings": "[if(and(parameters('registryPasswordConfigured'), not(empty(parameters('acrLoginServer')))), createArray(createObject('name', 'DOCKER_REGISTRY_SERVER_USERNAME', 'value', parameters('acrAdminUsername')), createObject('name', 'DOCKER_REGISTRY_SERVER_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-acr-registry-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))), createArray())]"
+          },
+          "resources": [
+            {
+              "condition": "[not(empty(parameters('acrLoginServer')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', last(split(parameters('keyVaultId'), '/')), 'acr-server')]",
+              "properties": {
+                "value": "[parameters('acrLoginServer')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('acrAdminUsername')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', last(split(parameters('keyVaultId'), '/')), 'acr-username')]",
+              "properties": {
+                "value": "[parameters('acrAdminUsername')]"
+              }
+            },
+            {
+              "type": "Microsoft.Web/sites",
+              "apiVersion": "2023-01-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "app,linux,container",
+              "identity": {
+                "type": "SystemAssigned"
+              },
+              "properties": {
+                "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', last(split(parameters('planId'), '/')))]",
+                "httpsOnly": true,
+                "keyVaultReferenceIdentity": "SystemAssigned",
+                "vnetImagePullEnabled": "[not(empty(parameters('vnetSubnetId')))]",
+                "virtualNetworkSubnetId": "[if(not(empty(parameters('vnetSubnetId'))), parameters('vnetSubnetId'), null())]",
+                "siteConfig": {
+                  "linuxFxVersion": "[format('DOCKER|{0}', parameters('image'))]",
+                  "acrUseManagedIdentityCreds": true,
+                  "healthCheckPath": "/health",
+                  "alwaysOn": true,
+                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'CORS_ORIGINS', 'value', format('https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=keycloak-web-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=keycloak-internal-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-web-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MISO_CONTROLLER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-internal-server-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MISO_RELATIVE_PATH', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-vdir-public)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_CLIENT_ID', 'value', parameters('entraIdClientId')), createObject('name', 'ENTRA_ID_CLIENT_SECRET', 'value', parameters('entraIdClientSecret')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', variables('moriBaseNormalized')), createObject('name', 'MORI_CALLBACK_API_KEY', 'value', parameters('moriCallbackApiKey')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'ENTRA_CALLBACK_STATE_SECRET', 'value', parameters('entraCallbackStateSecret')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode'))), variables('registryCredentialAppSettings'))]",
+                  "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
+                },
+                "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
+              }
+            },
+            {
+              "type": "Microsoft.Web/sites/config",
+              "apiVersion": "2023-01-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+              "properties": {
+                "applicationLogs": {
+                  "fileSystem": {
+                    "level": "Information"
+                  }
+                },
+                "httpLogs": {
+                  "fileSystem": {
+                    "enabled": true,
+                    "retentionInDays": 7,
+                    "retentionInMb": 100
+                  }
+                },
+                "detailedErrorMessages": {
+                  "enabled": true
+                },
+                "failedRequestsTracing": {
+                  "enabled": true
+                }
+              },
+              "dependsOn": ["[resourceId('Microsoft.Web/sites', parameters('name'))]"]
+            },
+            {
+              "type": "Microsoft.Web/sites/config",
+              "apiVersion": "2023-01-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'azurestorageaccounts')]",
+              "properties": {
+                "[format('{0}', parameters('storageAccountName'))]": {
+                  "type": "AzureFiles",
+                  "accountName": "[parameters('storageAccountName')]",
+                  "shareName": "[parameters('fileShareName')]",
+                  "accessKey": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2024-01-01').keys[0].value]",
+                  "mountPath": "/data"
+                }
+              },
+              "dependsOn": ["[resourceId('Microsoft.Web/sites', parameters('name'))]"]
+            }
+          ],
+          "outputs": {
+            "webAppName": {
+              "type": "string",
+              "value": "[parameters('name')]"
+            },
+            "webAppUrl": {
+              "type": "string",
+              "value": "[format('https://{0}', reference(resourceId('Microsoft.Web/sites', parameters('name')), '2023-01-01').defaultHostName)]"
+            },
+            "webAppId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+            },
+            "principalId": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2023-01-01', 'full').identity.principalId]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'appServicePlan')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keycloakWebApp')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keyVaultSecretsPhase1')]",
+        "[resourceId('Microsoft.Resources/deployments', 'network')]",
+        "[resourceId('Microsoft.Resources/deployments', 'postgresql')]",
+        "[resourceId('Microsoft.Resources/deployments', 'storage')]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "keyVaultWebAppAccessPolicies",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "keyVaultId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultId.value]"
+          },
+          "webAppPrincipalIds": {
+            "value": [
+              "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.principalId.value]",
+              "[reference(resourceId('Microsoft.Resources/deployments', 'misoWebApp'), '2025-04-01').outputs.principalId.value]"
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "1560535279661158869"
+            }
+          },
+          "parameters": {
+            "keyVaultId": {
+              "type": "string",
+              "metadata": {
+                "description": "Existing Key Vault resource id (same resource group as web apps)"
+              }
+            },
+            "webAppPrincipalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "metadata": {
+                "description": "Object IDs (principalId) of web apps that use Key Vault references"
+              }
+            }
+          },
+          "resources": {
+            "kv": {
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults",
+              "apiVersion": "2023-07-01",
+              "name": "[last(split(parameters('keyVaultId'), '/'))]"
+            },
+            "kvWebAppAccessPolicies": {
+              "type": "Microsoft.KeyVault/vaults/accessPolicies",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', last(split(parameters('keyVaultId'), '/')), 'add')]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "accessPolicies",
+                    "count": "[length(parameters('webAppPrincipalIds'))]",
+                    "input": {
+                      "tenantId": "[subscription().tenantId]",
+                      "objectId": "[parameters('webAppPrincipalIds')[copyIndex('accessPolicies')]]",
+                      "permissions": {
+                        "secrets": ["get", "list", "set"],
+                        "keys": [],
+                        "certificates": [],
+                        "storage": []
+                      }
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'keycloakWebApp')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]",
+        "[resourceId('Microsoft.Resources/deployments', 'misoWebApp')]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "webAppPostKvPolicyRestart",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "keycloakWebAppName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.webAppName.value]"
+          },
+          "misoWebAppName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'misoWebApp'), '2025-04-01').outputs.webAppName.value]"
+          },
+          "readyStamp": {
+            "value": "[format('{0}-{1}', deployment().name, uniqueString(deployment().name, resourceGroup().id))]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "16977137676176830260"
+            }
+          },
+          "parameters": {
+            "keycloakWebAppName": {
+              "type": "string",
+              "metadata": {
+                "description": "Keycloak web app name"
+              }
+            },
+            "misoWebAppName": {
+              "type": "string",
+              "metadata": {
+                "description": "MISO Controller web app name"
+              }
+            },
+            "readyStamp": {
+              "type": "string",
+              "metadata": {
+                "description": "Stamp written into AIFABRIX_KV_ACCESS_READY (forces setting change / recycle)"
+              }
+            }
+          },
+          "variables": {
+            "readySetting": {
+              "AIFABRIX_KV_ACCESS_READY": "[parameters('readyStamp')]"
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "keycloakPostKvAppSettings",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "webAppName": {
+                    "value": "[parameters('keycloakWebAppName')]"
+                  },
+                  "appSettings": {
+                    "value": "[union(list(resourceId('Microsoft.Web/sites/config', parameters('keycloakWebAppName'), 'appsettings'), '2022-03-01').properties, variables('readySetting'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.47.16.16243",
+                      "templateHash": "6721372499638722047"
+                    }
+                  },
+                  "parameters": {
+                    "webAppName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Web app name"
+                      }
+                    },
+                    "appSettings": {
+                      "type": "object",
+                      "metadata": {
+                        "description": "Full app settings object to apply (existing + merges)"
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2022-03-01",
+                      "name": "[format('{0}/{1}', parameters('webAppName'), 'appsettings')]",
+                      "properties": "[parameters('appSettings')]"
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "misoPostKvAppSettings",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "webAppName": {
+                    "value": "[parameters('misoWebAppName')]"
+                  },
+                  "appSettings": {
+                    "value": "[union(list(resourceId('Microsoft.Web/sites/config', parameters('misoWebAppName'), 'appsettings'), '2022-03-01').properties, variables('readySetting'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.47.16.16243",
+                      "templateHash": "6721372499638722047"
+                    }
+                  },
+                  "parameters": {
+                    "webAppName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Web app name"
+                      }
+                    },
+                    "appSettings": {
+                      "type": "object",
+                      "metadata": {
+                        "description": "Full app settings object to apply (existing + merges)"
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2022-03-01",
+                      "name": "[format('{0}/{1}', parameters('webAppName'), 'appsettings')]",
+                      "properties": "[parameters('appSettings')]"
+                    }
+                  ]
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "keycloakReadyStamp": {
+              "type": "string",
+              "value": "[parameters('readyStamp')]"
+            },
+            "misoReadyStamp": {
+              "type": "string",
+              "value": "[parameters('readyStamp')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'keycloakWebApp')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keyVaultWebAppAccessPolicies')]",
+        "[resourceId('Microsoft.Resources/deployments', 'misoWebApp')]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "keyVaultSecretsPhase2",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "keyVaultName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultName.value]"
+          },
+          "prefix": {
+            "value": "[variables('infrastructureName')]"
+          },
+          "keycloakWebAppUrl": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.webAppUrl.value]"
+          },
+          "keycloakVdirPublic": {
+            "value": "[variables('keycloakVdirPublic')]"
+          },
+          "misoWebAppUrl": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'misoWebApp'), '2025-04-01').outputs.webAppUrl.value]"
+          },
+          "misoVdirPublic": {
+            "value": "/miso"
+          },
+          "encryptionKey": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "9394845529752045254"
+            }
+          },
+          "parameters": {
+            "keyVaultName": {
+              "type": "string",
+              "metadata": {
+                "description": "Key Vault name"
+              }
+            },
+            "prefix": {
+              "type": "string",
+              "metadata": {
+                "description": "Prefix for secret naming"
+              }
+            },
+            "keycloakWebAppUrl": {
+              "type": "string",
+              "metadata": {
+                "description": "Keycloak web app origin URL (App Service hostname, no virtual-directory suffix)"
+              }
+            },
+            "keycloakVdirPublic": {
+              "type": "string",
+              "defaultValue": "/auth",
+              "metadata": {
+                "description": "Public virtual-directory path for Keycloak (e.g. /auth from /auth/* Front Door route)"
+              }
+            },
+            "misoWebAppUrl": {
+              "type": "string",
+              "metadata": {
+                "description": "MISO Controller web app origin URL (App Service hostname, no virtual-directory suffix)"
+              }
+            },
+            "misoVdirPublic": {
+              "type": "string",
+              "defaultValue": "/miso",
+              "metadata": {
+                "description": "Public virtual-directory path for MISO behind Front Door (e.g. /miso from /miso/*)"
+              }
+            },
+            "encryptionKey": {
+              "type": "securestring",
+              "metadata": {
+                "description": "Encryption key for MISO Controller"
+              }
+            },
+            "jwtSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "JWT secret for MISO Controller (auto-generated if not provided)"
+              }
+            },
+            "misoClientId": {
+              "type": "string",
+              "defaultValue": "miso-controller-miso-miso-controller",
+              "metadata": {
+                "description": "MISO Client ID - Format: {controllerKey}-{environmentKey}-{applicationKey}"
+              }
+            },
+            "misoClientSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "MISO Client Secret (auto-generated if not provided)"
+              }
+            }
+          },
+          "variables": {
+            "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
+            "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
+            "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
+            "misoVdirSecretValue": "[if(empty(variables('misoVdirSegment')), '/', variables('misoVdirSegment'))]",
+            "keycloakWebAppOrigin": "[if(endsWith(parameters('keycloakWebAppUrl'), '/'), substring(parameters('keycloakWebAppUrl'), 0, max(0, sub(length(parameters('keycloakWebAppUrl')), 1))), parameters('keycloakWebAppUrl'))]",
+            "keycloakVdirSegment": "[if(or(equals(parameters('keycloakVdirPublic'), ''), equals(parameters('keycloakVdirPublic'), '/')), '', if(startsWith(parameters('keycloakVdirPublic'), '/'), parameters('keycloakVdirPublic'), format('/{0}', parameters('keycloakVdirPublic'))))]",
+            "keycloakServerPublicUrl": "[if(empty(variables('keycloakVdirSegment')), variables('keycloakWebAppOrigin'), format('{0}{1}', variables('keycloakWebAppOrigin'), variables('keycloakVdirSegment')))]",
+            "keycloakVdirSecretValue": "[if(empty(variables('keycloakVdirSegment')), '/', variables('keycloakVdirSegment'))]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'keycloak-vdir-public')]",
+              "properties": {
+                "value": "[variables('keycloakVdirSecretValue')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'keycloak-web-server-url')]",
+              "properties": {
+                "value": "[variables('keycloakServerPublicUrl')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'keycloak-internal-server-url')]",
+              "properties": {
+                "value": "[variables('keycloakServerPublicUrl')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'miso-controller-vdir-public')]",
+              "properties": {
+                "value": "[variables('misoVdirSecretValue')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'miso-controller-web-server-url')]",
+              "properties": {
+                "value": "[variables('misoWebServerPublicUrl')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'miso-controller-internal-server-urlKeyVault')]",
+              "properties": {
+                "value": "[parameters('misoWebAppUrl')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), format('{0}-encryption-keyKeyVault', parameters('prefix')))]",
+              "properties": {
+                "value": "[parameters('encryptionKey')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), format('{0}-secrets-jwtKeyVault', parameters('prefix')))]",
+              "properties": {
+                "value": "[if(not(empty(parameters('jwtSecret'))), parameters('jwtSecret'), format('PLACEHOLDER_JWT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), format('{0}-miso-clientIdKeyVault', parameters('prefix')))]",
+              "properties": {
+                "value": "[parameters('misoClientId')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'miso-controller-client-secretKeyVault')]",
+              "properties": {
+                "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keycloakWebApp')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]",
+        "[resourceId('Microsoft.Resources/deployments', 'misoWebApp')]"
+      ]
+    },
+    {
+      "condition": "[parameters('deployRoleAssignments')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "roleAssignment",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "managedIdentityId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'managedIdentity'), '2025-04-01').outputs.managedIdentityId.value]"
+          },
+          "principalId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'managedIdentity'), '2025-04-01').outputs.principalId.value]"
+          },
+          "resourceGroupId": {
+            "value": "[resourceGroup().id]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "17283107409340257409"
+            }
+          },
+          "parameters": {
+            "managedIdentityId": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity resource ID"
+              }
+            },
+            "principalId": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity principal ID"
+              }
+            },
+            "resourceGroupId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource Group ID"
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "name": "[guid(parameters('resourceGroupId'), parameters('managedIdentityId'), 'Contributor')]",
+              "properties": {
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                "principalId": "[parameters('principalId')]",
+                "principalType": "ServicePrincipal"
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'keyVaultSecretsPhase2')]",
+        "[resourceId('Microsoft.Resources/deployments', 'managedIdentity')]"
+      ]
+    },
+    {
+      "condition": "[parameters('deployRoleAssignments')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "misoControllerManagedRgContributor",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "misoControllerPrincipalId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'misoWebApp'), '2025-04-01').outputs.principalId.value]"
+          },
+          "resourceGroupId": {
+            "value": "[resourceGroup().id]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "11111042069715569690"
+            }
+          },
+          "parameters": {
+            "misoControllerPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "MISO Controller web app system-assigned managed identity principal object id"
+              }
+            },
+            "resourceGroupId": {
+              "type": "string",
+              "metadata": {
+                "description": "ARM resource id of this resource group (stable input for role assignment name)"
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "name": "[guid(parameters('resourceGroupId'), parameters('misoControllerPrincipalId'), 'MisoControllerManagedRgContributor')]",
+              "properties": {
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                "principalId": "[parameters('misoControllerPrincipalId')]",
+                "principalType": "ServicePrincipal"
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'keyVaultSecretsPhase2')]",
+        "[resourceId('Microsoft.Resources/deployments', 'misoWebApp')]"
+      ]
+    },
+    {
+      "condition": "[parameters('deployRoleAssignments')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "acrPullRoleAssignment",
+      "subscriptionId": "[variables('acrResourceIdSegments')[2]]",
+      "resourceGroup": "[variables('acrResourceIdSegments')[4]]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "registryName": {
+            "value": "[last(variables('acrResourceIdSegments'))]"
+          },
+          "principalIds": {
+            "value": [
+              "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.principalId.value]",
+              "[reference(resourceId('Microsoft.Resources/deployments', 'misoWebApp'), '2025-04-01').outputs.principalId.value]"
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "1882530004456299732"
+            }
+          },
+          "parameters": {
+            "registryName": {
+              "type": "string",
+              "minLength": 5,
+              "metadata": {
+                "description": "Container registry name in this resource group"
+              }
+            },
+            "principalIds": {
+              "type": "array",
+              "minLength": 1,
+              "metadata": {
+                "description": "Object IDs of the web app system-assigned identities that pull images"
+              }
+            }
+          },
+          "variables": {
+            "acrPullRoleDefinitionId": "7f951dda-4ed3-4680-a7ca-43b17298f9ac"
+          },
+          "resources": [
+            {
+              "copy": {
+                "name": "acrPull",
+                "count": "[length(parameters('principalIds'))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('registryName'))]",
+              "name": "[guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('registryName')), parameters('principalIds')[copyIndex()], variables('acrPullRoleDefinitionId'))]",
+              "properties": {
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('acrPullRoleDefinitionId'))]",
+                "principalId": "[parameters('principalIds')[copyIndex()]]",
+                "principalType": "ServicePrincipal"
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'keycloakWebApp')]",
+        "[resourceId('Microsoft.Resources/deployments', 'misoWebApp')]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "vnetIntegrationScript",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "infrastructureName": {
+            "value": "[variables('infrastructureName')]"
+          },
+          "location": {
+            "value": "[variables('deploymentLocation')]"
+          },
+          "managedIdentityId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'managedIdentity'), '2025-04-01').outputs.managedIdentityId.value]"
+          },
+          "keycloakWebAppName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.webAppName.value]"
+          },
+          "misoWebAppName": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'misoWebApp'), '2025-04-01').outputs.webAppName.value]"
+          },
+          "vnetName": {
+            "value": "[last(split(reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.vnetId.value, '/'))]"
+          },
+          "resourceGroupName": {
+            "value": "[resourceGroup().name]"
+          },
+          "enablePostgresPublicAccess": {
+            "value": "[parameters('enablePostgresPublicAccess')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.47.16.16243",
+              "templateHash": "14727918554068505017"
+            }
+          },
+          "parameters": {
+            "infrastructureName": {
+              "type": "string",
+              "metadata": {
+                "description": "Infrastructure name prefix"
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region"
+              }
+            },
+            "keycloakWebAppName": {
+              "type": "string",
+              "metadata": {
+                "description": "Keycloak web app name"
+              }
+            },
+            "misoWebAppName": {
+              "type": "string",
+              "metadata": {
+                "description": "MISO Controller web app name"
+              }
+            },
+            "vnetName": {
+              "type": "string",
+              "metadata": {
+                "description": "Virtual Network name"
+              }
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource Group name"
+              }
+            },
+            "managedIdentityId": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity resource ID for Deployment Script"
+              }
+            },
+            "enablePostgresPublicAccess": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Desired PostgreSQL public network access mode from main deployment"
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deploymentScripts",
+              "apiVersion": "2023-08-01",
+              "name": "[format('{0}-vnet-integration', parameters('infrastructureName'))]",
+              "location": "[parameters('location')]",
+              "kind": "AzureCLI",
+              "identity": {
+                "type": "UserAssigned",
+                "userAssignedIdentities": {
+                  "[format('{0}', parameters('managedIdentityId'))]": {}
+                }
+              },
+              "properties": {
+                "azCliVersion": "2.53.0",
+                "retentionInterval": "PT1H",
+                "forceUpdateTag": "[format('{0}-arm-owned-v1', parameters('infrastructureName'))]",
+                "environmentVariables": [
+                  {
+                    "name": "KEYCLOAK_APP",
+                    "value": "[parameters('keycloakWebAppName')]"
+                  },
+                  {
+                    "name": "MISO_APP",
+                    "value": "[parameters('misoWebAppName')]"
+                  },
+                  {
+                    "name": "RG",
+                    "value": "[parameters('resourceGroupName')]"
+                  },
+                  {
+                    "name": "VNET",
+                    "value": "[parameters('vnetName')]"
+                  },
+                  {
+                    "name": "DESIRED_DB_PUBLIC",
+                    "value": "[string(parameters('enablePostgresPublicAccess'))]"
+                  }
+                ],
+                "scriptContent": "      set -euo pipefail\n\n      echo \"==========================================\"\n      echo \"Post-Deployment: VNet / network (ARM-owned)\"\n      echo \"==========================================\"\n      echo \"Resource Group: $RG\"\n      echo \"VNet: $VNET\"\n      echo \"Keycloak: $KEYCLOAK_APP\"\n      echo \"MISO: $MISO_APP\"\n      echo \"enablePostgresPublicAccess: $DESIRED_DB_PUBLIC\"\n      echo \"\"\n      echo \"Skipping az webapp / VNet CLI (broken under Marketplace MI tenant account).\"\n      echo \"Expected from Bicep/ARM:\"\n      echo \"  - virtualNetworkSubnetId -> snet-webapp (05_miso / 07_keycloak)\"\n      echo \"  - WEBSITE_VNET_ROUTE_ALL = 0 if Postgres public, else 1\"\n      echo \"  - Postgres public/firewall/private DNS from 06_postgresql + network\"\n      echo \"\"\n      echo \"VNet integration marker complete (always succeed).\"\n      echo \"==========================================\"\n    "
+              }
+            }
+          ],
+          "outputs": {
+            "scriptName": {
+              "type": "string",
+              "value": "[format('{0}-vnet-integration', parameters('infrastructureName'))]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('acrResourceIdSegments')[2], variables('acrResourceIdSegments')[4]), 'Microsoft.Resources/deployments', 'acrPullRoleAssignment')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keycloakWebApp')]",
+        "[resourceId('Microsoft.Resources/deployments', 'keyVaultSecretsPhase2')]",
+        "[resourceId('Microsoft.Resources/deployments', 'managedIdentity')]",
+        "[resourceId('Microsoft.Resources/deployments', 'misoWebApp')]",
+        "[resourceId('Microsoft.Resources/deployments', 'network')]",
+        "[resourceId('Microsoft.Resources/deployments', 'postgresql')]",
+        "[resourceId('Microsoft.Resources/deployments', 'webAppPostKvPolicyRestart')]"
+      ]
+    }
+  ],
+  "outputs": {
+    "resourceGroupName": {
+      "type": "string",
+      "value": "[resourceGroup().name]"
+    },
+    "vnetId": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.vnetId.value]"
+    },
+    "keyVaultName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keyVault'), '2025-04-01').outputs.keyVaultName.value]"
+    },
+    "scriptStorageAccountName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'storage'), '2025-04-01').outputs.scriptStorageAccountName.value]"
+    },
+    "flowiseFileShareName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'storage'), '2025-04-01').outputs.flowiseFileShareName.value]"
+    },
+    "managedIdentityName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'managedIdentity'), '2025-04-01').outputs.managedIdentityName.value]"
+    },
+    "appServicePlanName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'appServicePlan'), '2025-04-01').outputs.planName.value]"
+    },
+    "webAppName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'misoWebApp'), '2025-04-01').outputs.webAppName.value]"
+    },
+    "webAppUrl": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'misoWebApp'), '2025-04-01').outputs.webAppUrl.value]"
+    },
+    "postgresServerName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.serverName.value]"
+    },
+    "postgresServerFqdn": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.serverFqdn.value]"
+    },
+    "postgresMisoDatabaseName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.misoDatabaseName.value]"
+    },
+    "postgresLogsDatabaseName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.logsDatabaseName.value]"
+    },
+    "postgresKeycloakDatabaseName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'postgresql'), '2025-04-01').outputs.keycloakDatabaseName.value]"
+    },
+    "keycloakWebAppName": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.webAppName.value]"
+    },
+    "keycloakWebAppUrl": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.webAppUrl.value]"
+    },
+    "keycloakRealmUrl": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.keycloakRealmUrl.value]"
+    },
+    "keycloakAdminUser": {
+      "type": "string",
+      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.keycloakAdminUser.value]"
+    },
+    "portalUrl": {
+      "type": "string",
+      "value": "[format('https://portal.azure.com/#@{0}/resource/subscriptions/{1}/resourceGroups/{2}', subscription().tenantId, subscription().subscriptionId, resourceGroup().name)]"
+    }
+  }
+}