@swovohq/fuel 0.2.2-alpha.88 → 0.2.2-alpha.89

package/dist/infra-templates/modules/azure-github-oidc/main.tf

@@ -0,0 +1,48 @@
+resource "azuread_application" "this" {
+  count = var.enabled && var.existing_client_id == null ? 1 : 0
+
+  display_name = "${var.project_name}-github-actions"
+}
+
+resource "azuread_service_principal" "this" {
+  count = var.enabled && var.existing_client_id == null ? 1 : 0
+
+  client_id = azuread_application.this[0].client_id
+}
+
+resource "azuread_application_federated_identity_credential" "this" {
+  for_each = var.enabled && var.existing_client_id == null ? toset(var.branches) : toset([])
+
+  application_id = azuread_application.this[0].id
+  display_name   = "github-${each.value}"
+  audiences      = ["api://AzureADTokenExchange"]
+  issuer         = "https://token.actions.githubusercontent.com"
+  subject        = "repo:${var.github_organization}/${var.github_repo_name}:ref:refs/heads/${each.value}"
+}
+
+# Looked up (not created) when the app/SP/federated credential were set up out-of-band by a
+# tenant admin — see variables.tf for why. Skipped entirely when the caller already supplies
+# existing_principal_id: the lookup needs Directory.Read.All/Application.Read.All on the
+# deploying SP, which a lot of tenants won't grant just to resolve one known object ID.
+data "azuread_service_principal" "existing" {
+  count = var.enabled && var.existing_client_id != null && var.existing_principal_id == null ? 1 : 0
+
+  client_id = var.existing_client_id
+}
+
+locals {
+  # null when disabled — the parent template must guard any reference to outputs on `var.enabled`.
+  principal_id = var.enabled ? (
+    var.existing_principal_id != null ? var.existing_principal_id : (
+      var.existing_client_id == null ? azuread_service_principal.this[0].object_id : data.azuread_service_principal.existing[0].object_id
+    )
+  ) : null
+}
+
+resource "azurerm_role_assignment" "contributor" {
+  count = var.enabled && var.manage_role_assignment ? 1 : 0
+
+  scope                = var.role_assignment_scope
+  role_definition_name = "Contributor"
+  principal_id         = local.principal_id
+}

package/dist/infra-templates/modules/azure-github-oidc/outputs.tf

@@ -0,0 +1,9 @@
+output "client_id" {
+  value       = var.enabled ? (var.existing_client_id != null ? var.existing_client_id : azuread_application.this[0].client_id) : null
+  description = "Client ID of the Azure AD application used by GitHub Actions to authenticate via OIDC. Null when disabled."
+}
+
+output "principal_id" {
+  value       = local.principal_id
+  description = "Object ID of the service principal, used by the parent template to grant additional roles (e.g. AcrPush/AcrPull). Null when disabled."
+}

package/dist/infra-templates/modules/azure-github-oidc/variables.tf

@@ -0,0 +1,69 @@
+variable "project_name" {
+  description = "Project name used as prefix for resource names"
+  type        = string
+}
+
+variable "github_organization" {
+  description = "GitHub organization name for the OIDC trust subject"
+  type        = string
+}
+
+variable "github_repo_name" {
+  description = "GitHub repository name for the OIDC trust subject"
+  type        = string
+}
+
+variable "branches" {
+  description = "Branches allowed to assume the Azure AD application via OIDC. One federated credential is created per branch."
+  type        = list(string)
+  default     = ["main"]
+}
+
+variable "role_assignment_scope" {
+  description = "Scope for the Contributor role assignment, typically the resource group ID"
+  type        = string
+}
+
+variable "existing_client_id" {
+  description = <<-EOT
+    Client ID of an app registration + service principal + federated identity credential(s)
+    already created out-of-band by a tenant admin. Set this when the deploying SP lacks the
+    Entra ID "Application Administrator" role (creating an app registration requires it,
+    regardless of subscription-level RBAC) — the module then looks up and reuses that identity
+    instead of creating a new one. The Contributor role assignment is still managed by this
+    module either way, since that only needs "User Access Administrator" on the subscription.
+  EOT
+  type        = string
+  default     = null
+}
+
+variable "existing_principal_id" {
+  description = <<-EOT
+    Object ID (principal ID) of the service principal identified by existing_client_id, when
+    that's already known. Set this to skip looking it up via Microsoft Graph entirely — the
+    lookup (data.azuread_service_principal.existing) needs Directory.Read.All or
+    Application.Read.All on the deploying SP, which many tenant admins won't grant just to
+    resolve one known object. Whoever created the app out-of-band can get this by running
+    `az ad sp show --id <existing_client_id> --query id -o tsv`.
+  EOT
+  type        = string
+  default     = null
+}
+
+variable "manage_role_assignment" {
+  description = <<-EOT
+    Whether Terraform should create/manage the Contributor role assignment for this identity.
+    Set to false when it was already granted out-of-band alongside existing_client_id (e.g. a
+    tenant admin's onboarding runbook already ran `az role assignment create ... --role
+    Contributor`) — otherwise Terraform tries to create it again on every apply and fails with
+    RoleAssignmentExists.
+  EOT
+  type        = bool
+  default     = true
+}
+
+variable "enabled" {
+  description = "Set to false to skip this module entirely (no app, no SP, no role assignment). Use to unblock testing while waiting on a tenant admin for Application Administrator or an existing_client_id."
+  type        = bool
+  default     = true
+}

package/dist/infra-templates/modules/azure-key-vault/main.tf

@@ -0,0 +1,21 @@
+# Application Key Vault (RBAC-based), used by apps to read secrets at runtime.
+# Distinct from the bootstrap vault created by the CLI via SDK.
+resource "azurerm_key_vault" "this" {
+  name                = var.name
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  tenant_id           = var.tenant_id
+  sku_name            = var.sku_name
+
+  rbac_authorization_enabled = true
+  purge_protection_enabled   = false
+  soft_delete_retention_days = 7
+
+  public_network_access_enabled = length(var.ip_rules) > 0 ? true : var.public_network_access_enabled
+
+  network_acls {
+    bypass         = "AzureServices"
+    default_action = var.network_acls_default_action
+    ip_rules       = var.ip_rules
+  }
+}

package/dist/infra-templates/modules/azure-key-vault/outputs.tf

@@ -0,0 +1,11 @@
+output "id" {
+  value = azurerm_key_vault.this.id
+}
+
+output "vault_uri" {
+  value = azurerm_key_vault.this.vault_uri
+}
+
+output "name" {
+  value = azurerm_key_vault.this.name
+}

package/dist/infra-templates/modules/azure-key-vault/variables.tf

@@ -0,0 +1,43 @@
+variable "name" {
+  type        = string
+  description = "Key Vault name"
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group where the Key Vault is created"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+}
+
+variable "tenant_id" {
+  type        = string
+  description = "Azure AD tenant ID"
+}
+
+variable "sku_name" {
+  type        = string
+  description = "Key Vault SKU"
+  default     = "standard"
+}
+
+variable "public_network_access_enabled" {
+  type        = bool
+  description = "Allow access from the public internet. Defaults to false: this vault isn't read by anything at runtime today (no VNet/private-endpoint consumer wired up yet), so there's no reason to expose it publicly."
+  default     = false
+}
+
+variable "network_acls_default_action" {
+  type        = string
+  description = "Default action for requests not matched by an IP/VNet rule. Defaults to \"Deny\" — flip to \"Allow\" (or add a private endpoint) only once something outside the vault's own resource group needs to read from it."
+  default     = "Deny"
+}
+
+variable "ip_rules" {
+  type        = list(string)
+  description = "Public IPs/CIDRs allowed through the firewall (e.g. the operator machine running `tofu apply`, which needs data-plane access to write secrets). Forces public_network_access_enabled on when non-empty, since Azure ignores network_acls entirely while public access is off."
+  default     = []
+}

package/dist/infra-templates/modules/azure-monitor/main.tf

@@ -0,0 +1,29 @@
+resource "azurerm_log_analytics_workspace" "this" {
+  name                = "${var.project_name}-law"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  sku                 = "PerGB2018"
+  retention_in_days   = var.retention_days
+}
+
+resource "azurerm_application_insights" "this" {
+  name                 = "${var.project_name}-appi"
+  resource_group_name  = var.resource_group_name
+  location             = var.location
+  application_type     = "web"
+  workspace_id         = azurerm_log_analytics_workspace.this.id
+  daily_data_cap_in_gb = var.daily_data_cap_gb
+  retention_in_days    = var.retention_days
+}
+
+resource "azurerm_portal_dashboard" "this" {
+  count               = var.dashboard_count
+  name                = "${var.project_name}-dashboard-${count.index + 1}"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+
+  dashboard_properties = jsonencode({
+    lenses   = {}
+    metadata = {}
+  })
+}

package/dist/infra-templates/modules/azure-monitor/outputs.tf

@@ -0,0 +1,17 @@
+output "log_analytics_workspace_id" {
+  value = azurerm_log_analytics_workspace.this.id
+}
+
+output "instrumentation_key" {
+  value     = azurerm_application_insights.this.instrumentation_key
+  sensitive = true
+}
+
+output "connection_string" {
+  value     = azurerm_application_insights.this.connection_string
+  sensitive = true
+}
+
+output "app_insights_id" {
+  value = azurerm_application_insights.this.id
+}

package/dist/infra-templates/modules/azure-monitor/variables.tf

@@ -0,0 +1,32 @@
+variable "project_name" {
+  type        = string
+  description = "Project name, used to derive resource names"
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group where the monitoring resources are created"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+}
+
+variable "daily_data_cap_gb" {
+  type        = number
+  description = "Daily data ingestion cap in GB for Application Insights"
+  default     = 1
+}
+
+variable "retention_days" {
+  type        = number
+  description = "Data retention in days"
+  default     = 90
+}
+
+variable "dashboard_count" {
+  type        = number
+  description = "Number of portal dashboards to create"
+  default     = 0
+}

package/dist/infra-templates/modules/azure-network/main.tf

@@ -0,0 +1,134 @@
+# Keeps every database/cache reachable only from inside this VNet. Container Apps
+# ingress stays public (Front Door needs a public origin) — this only closes off
+# the data-plane services that have no reason to be reachable from the internet.
+resource "azurerm_virtual_network" "this" {
+  name                = "${var.project_name}-vnet"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  address_space       = var.address_space
+}
+
+resource "azurerm_subnet" "container_apps_infra" {
+  name                 = "${var.project_name}-cae-subnet"
+  resource_group_name  = var.resource_group_name
+  virtual_network_name = azurerm_virtual_network.this.name
+  address_prefixes     = var.container_apps_subnet_prefix
+
+  delegation {
+    name = "container-apps-environment"
+    service_delegation {
+      name    = "Microsoft.App/environments"
+      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
+    }
+  }
+}
+
+# A subnet has no reliable outbound internet path of its own once placed in a custom
+# VNet — Azure's "default outbound access" is being retired for newly created resources.
+# Without this, every Container App revision hangs pulling its image (any image, from
+# any registry) until the platform gives up ("Operation expired"). This is Microsoft's
+# own recommended pattern for Container Apps in a BYO VNet.
+resource "azurerm_public_ip" "container_apps_nat" {
+  name                = "${var.project_name}-cae-nat-ip"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  allocation_method   = "Static"
+  sku                 = "Standard"
+}
+
+resource "azurerm_nat_gateway" "container_apps" {
+  name                = "${var.project_name}-cae-nat"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  sku_name            = "Standard"
+}
+
+resource "azurerm_nat_gateway_public_ip_association" "container_apps" {
+  nat_gateway_id       = azurerm_nat_gateway.container_apps.id
+  public_ip_address_id = azurerm_public_ip.container_apps_nat.id
+}
+
+resource "azurerm_subnet_nat_gateway_association" "container_apps" {
+  subnet_id      = azurerm_subnet.container_apps_infra.id
+  nat_gateway_id = azurerm_nat_gateway.container_apps.id
+}
+
+# Postgres Flexible Server's private-access model is VNet integration (delegated_subnet_id
+# + private_dns_zone_id directly on the server resource) rather than a standard Private
+# Endpoint — it needs its own subnet delegated specifically to the Postgres RP.
+resource "azurerm_subnet" "postgres" {
+  count = var.postgres_needed ? 1 : 0
+
+  name                 = "${var.project_name}-postgres-subnet"
+  resource_group_name  = var.resource_group_name
+  virtual_network_name = azurerm_virtual_network.this.name
+  address_prefixes     = var.postgres_subnet_prefix
+
+  delegation {
+    name = "postgres-flexible-server"
+    service_delegation {
+      name    = "Microsoft.DBforPostgreSQL/flexibleServers"
+      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
+    }
+  }
+}
+
+# Azure SQL and Azure Managed Redis use standard Private Link — a plain (non-delegated)
+# subnet with network policies disabled, shared across both.
+resource "azurerm_subnet" "private_endpoints" {
+  count = (var.mssql_needed || var.redis_needed) ? 1 : 0
+
+  name                              = "${var.project_name}-pe-subnet"
+  resource_group_name               = var.resource_group_name
+  virtual_network_name              = azurerm_virtual_network.this.name
+  address_prefixes                  = var.private_endpoints_subnet_prefix
+  private_endpoint_network_policies = "Disabled"
+}
+
+resource "azurerm_private_dns_zone" "postgres" {
+  count = var.postgres_needed ? 1 : 0
+
+  name                = "privatelink.postgres.database.azure.com"
+  resource_group_name = var.resource_group_name
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "postgres" {
+  count = var.postgres_needed ? 1 : 0
+
+  name                  = "${var.project_name}-postgres-link"
+  resource_group_name   = var.resource_group_name
+  private_dns_zone_name = azurerm_private_dns_zone.postgres[0].name
+  virtual_network_id    = azurerm_virtual_network.this.id
+}
+
+resource "azurerm_private_dns_zone" "mssql" {
+  count = var.mssql_needed ? 1 : 0
+
+  name                = "privatelink.database.windows.net"
+  resource_group_name = var.resource_group_name
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "mssql" {
+  count = var.mssql_needed ? 1 : 0
+
+  name                  = "${var.project_name}-mssql-link"
+  resource_group_name   = var.resource_group_name
+  private_dns_zone_name = azurerm_private_dns_zone.mssql[0].name
+  virtual_network_id    = azurerm_virtual_network.this.id
+}
+
+resource "azurerm_private_dns_zone" "redis" {
+  count = var.redis_needed ? 1 : 0
+
+  name                = "privatelink.redis.azure.net"
+  resource_group_name = var.resource_group_name
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "redis" {
+  count = var.redis_needed ? 1 : 0
+
+  name                  = "${var.project_name}-redis-link"
+  resource_group_name   = var.resource_group_name
+  private_dns_zone_name = azurerm_private_dns_zone.redis[0].name
+  virtual_network_id    = azurerm_virtual_network.this.id
+}

package/dist/infra-templates/modules/azure-network/outputs.tf

@@ -0,0 +1,44 @@
+output "vnet_id" {
+  value = azurerm_virtual_network.this.id
+}
+
+output "container_apps_subnet_id" {
+  value = azurerm_subnet.container_apps_infra.id
+}
+
+# Static outbound IP for the Container Apps environment — useful for allowlisting this
+# project's apps against third-party APIs/firewalls that require a fixed source IP.
+output "container_apps_outbound_ip" {
+  value = azurerm_public_ip.container_apps_nat.ip_address
+}
+
+output "postgres_subnet_id" {
+  value = try(azurerm_subnet.postgres[0].id, null)
+}
+
+output "private_endpoints_subnet_id" {
+  value = try(azurerm_subnet.private_endpoints[0].id, null)
+}
+
+output "postgres_dns_zone_id" {
+  value = try(azurerm_private_dns_zone.postgres[0].id, null)
+}
+
+output "mssql_dns_zone_id" {
+  value = try(azurerm_private_dns_zone.mssql[0].id, null)
+}
+
+output "redis_dns_zone_id" {
+  value = try(azurerm_private_dns_zone.redis[0].id, null)
+}
+
+# So callers can `depends_on = [module.network]` and be sure the VNet links (not just the
+# zones) exist before creating a resource that needs private DNS resolution to work.
+# Only includes links for zones actually created (postgres_needed/mssql_needed/redis_needed).
+output "ready" {
+  value = compact([
+    try(azurerm_private_dns_zone_virtual_network_link.postgres[0].id, null),
+    try(azurerm_private_dns_zone_virtual_network_link.mssql[0].id, null),
+    try(azurerm_private_dns_zone_virtual_network_link.redis[0].id, null),
+  ])
+}

package/dist/infra-templates/modules/azure-network/variables.tf

@@ -0,0 +1,56 @@
+variable "project_name" {
+  type        = string
+  description = "Used as a naming prefix for the VNet, subnets, and private DNS zones"
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group where networking resources are created"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+}
+
+variable "address_space" {
+  type        = list(string)
+  description = "VNet address space"
+  default     = ["10.20.0.0/16"]
+}
+
+variable "container_apps_subnet_prefix" {
+  type        = list(string)
+  description = "Subnet for the Container Apps environment's infrastructure. /23 minimum (Consumption-only environments require /23; a /27 workload-profile environment would fit too)."
+  default     = ["10.20.0.0/23"]
+}
+
+variable "postgres_subnet_prefix" {
+  type        = list(string)
+  description = "Subnet delegated to Microsoft.DBforPostgreSQL/flexibleServers. Shared by every Postgres flexible server in this project (Azure minimum is /28; sized larger for headroom)."
+  default     = ["10.20.2.0/26"]
+}
+
+variable "private_endpoints_subnet_prefix" {
+  type        = list(string)
+  description = "Subnet for standard Private Link endpoints (Azure SQL, Azure Managed Redis)."
+  default     = ["10.20.3.0/26"]
+}
+
+variable "postgres_needed" {
+  type        = bool
+  description = "Whether any app in this project uses the Postgres engine. Skips the delegated subnet + private DNS zone when false."
+  default     = true
+}
+
+variable "mssql_needed" {
+  type        = bool
+  description = "Whether any app in this project uses the mssql engine. Skips its private DNS zone when false."
+  default     = true
+}
+
+variable "redis_needed" {
+  type        = bool
+  description = "Whether any app in this project has Redis enabled. Skips its private DNS zone when false."
+  default     = true
+}

package/dist/infra-templates/modules/azure-postgresql-flexible/main.tf

@@ -0,0 +1,34 @@
+resource "random_password" "this" {
+  length           = 24
+  special          = true
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+locals {
+  effective_password = var.admin_password != "" ? var.admin_password : random_password.this.result
+}
+
+resource "azurerm_postgresql_flexible_server" "this" {
+  name                   = var.server_name
+  resource_group_name    = var.resource_group_name
+  location               = var.location
+  administrator_login    = var.admin_username
+  administrator_password = local.effective_password
+  sku_name               = var.sku_name
+  storage_mb             = var.storage_mb
+  version                = "16"
+  # zone intentionally not specified — let Azure choose.
+
+  # VNet-integrated instead of public: reachable only from the delegated subnet's VNet
+  # (the Container Apps environment lives there too), no public endpoint at all.
+  delegated_subnet_id           = var.delegated_subnet_id
+  private_dns_zone_id           = var.private_dns_zone_id
+  public_network_access_enabled = false
+}
+
+resource "azurerm_postgresql_flexible_server_database" "this" {
+  server_id = azurerm_postgresql_flexible_server.this.id
+  name      = var.database_name
+  collation = "en_US.utf8"
+  charset   = "UTF8"
+}

package/dist/infra-templates/modules/azure-postgresql-flexible/outputs.tf

@@ -0,0 +1,20 @@
+output "fqdn" {
+  value       = azurerm_postgresql_flexible_server.this.fqdn
+  description = "Fully qualified domain name of the PostgreSQL Flexible Server"
+}
+
+output "database_name" {
+  value       = azurerm_postgresql_flexible_server_database.this.name
+  description = "Name of the PostgreSQL database"
+}
+
+output "admin_username" {
+  value       = var.admin_username
+  description = "Administrator username for the PostgreSQL Flexible Server"
+}
+
+output "admin_password" {
+  value       = local.effective_password
+  sensitive   = true
+  description = "Effective administrator password for the PostgreSQL Flexible Server"
+}

package/dist/infra-templates/modules/azure-postgresql-flexible/variables.tf

@@ -0,0 +1,54 @@
+variable "server_name" {
+  description = "Name of the PostgreSQL Flexible Server. Must be globally unique."
+  type        = string
+}
+
+variable "database_name" {
+  description = "Name of the PostgreSQL database"
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "Name of the resource group where the server will be created"
+  type        = string
+}
+
+variable "location" {
+  description = "Azure region where the server will be created"
+  type        = string
+}
+
+variable "admin_username" {
+  description = "Administrator login for the PostgreSQL Flexible Server"
+  type        = string
+  default     = "pgadmin"
+}
+
+variable "admin_password" {
+  description = "Administrator password for the PostgreSQL Flexible Server. Leave empty to auto-generate."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "sku_name" {
+  description = "SKU name for the PostgreSQL Flexible Server"
+  type        = string
+  default     = "GP_Standard_D4s_v3"
+}
+
+variable "storage_mb" {
+  description = "Max storage allowed for the PostgreSQL Flexible Server, in MB"
+  type        = number
+  default     = 32768
+}
+
+variable "delegated_subnet_id" {
+  description = "Subnet delegated to Microsoft.DBforPostgreSQL/flexibleServers. Postgres Flexible Server's private-access model wires this directly on the server, not via a separate private endpoint."
+  type        = string
+}
+
+variable "private_dns_zone_id" {
+  description = "Private DNS zone (privatelink.postgres.database.azure.com) linked to the same VNet as delegated_subnet_id."
+  type        = string
+}

package/dist/infra-templates/modules/azure-redis-cache/main.tf

@@ -0,0 +1,32 @@
+resource "azurerm_managed_redis" "this" {
+  name                  = var.name
+  resource_group_name   = var.resource_group_name
+  location              = var.location
+  sku_name              = var.sku_name
+  public_network_access = "Disabled"
+
+  default_database {
+    client_protocol   = "Encrypted"
+    clustering_policy = "EnterpriseCluster"
+    eviction_policy   = "VolatileLRU"
+  }
+}
+
+resource "azurerm_private_endpoint" "this" {
+  name                = "${var.name}-pe"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  subnet_id           = var.private_endpoint_subnet_id
+
+  private_service_connection {
+    name                           = "${var.name}-psc"
+    private_connection_resource_id = azurerm_managed_redis.this.id
+    subresource_names              = ["redisEnterprise"]
+    is_manual_connection           = false
+  }
+
+  private_dns_zone_group {
+    name                 = "default"
+    private_dns_zone_ids = [var.private_dns_zone_id]
+  }
+}