@swovohq/fuel 0.2.2-alpha.88 → 0.2.2-alpha.89

package/dist/infra-templates/templates/azure/main.tf

@@ -0,0 +1,421 @@
+module "random_key" {
+  source = "../../modules/random-key"
+  name   = "nest_encryption_password"
+}
+
+module "acr" {
+  source              = "../../modules/azure-container-registry"
+  name                = var.acr_name
+  resource_group_name = data.azurerm_resource_group.this.name
+  location            = var.location
+}
+
+module "monitor" {
+  source              = "../../modules/azure-monitor"
+  project_name        = var.project_name
+  resource_group_name = data.azurerm_resource_group.this.name
+  location            = var.location
+  daily_data_cap_gb   = try(local.credentials.monitor.daily_data_cap_gb, 1)
+  retention_days      = try(local.credentials.monitor.retention_days, 90)
+  dashboard_count     = try(local.credentials.monitor.dashboard_count, 0)
+}
+
+module "network" {
+  source              = "../../modules/azure-network"
+  project_name        = var.project_name
+  resource_group_name = data.azurerm_resource_group.this.name
+  location            = var.location
+  postgres_needed     = local.network_needs_postgres
+  mssql_needed        = local.network_needs_mssql
+  redis_needed        = local.network_needs_redis
+}
+
+module "container_env" {
+  source                     = "../../modules/azure-container-apps-environment"
+  name                       = "${var.project_name}-cae"
+  resource_group_name        = data.azurerm_resource_group.this.name
+  location                   = var.location
+  log_analytics_workspace_id = module.monitor.log_analytics_workspace_id
+  infrastructure_subnet_id   = module.network.container_apps_subnet_id
+}
+
+module "github_oidc" {
+  source                 = "../../modules/azure-github-oidc"
+  project_name           = var.project_name
+  github_organization    = var.github_organization
+  github_repo_name       = var.github_repo_name
+  branches               = distinct([for a in local.app_list : a.branch])
+  role_assignment_scope  = data.azurerm_resource_group.this.id
+  existing_client_id     = local.github_oidc_existing_client_id
+  existing_principal_id  = local.github_oidc_existing_principal_id
+  manage_role_assignment = local.github_oidc_manage_role_assignment
+  enabled                = local.github_oidc_enabled
+}
+
+resource "azurerm_role_assignment" "oidc_acr_push" {
+  count = local.github_oidc_enabled && local.github_oidc_manage_role_assignment ? 1 : 0
+
+  scope                = module.acr.id
+  role_definition_name = "AcrPush"
+  principal_id         = module.github_oidc.principal_id
+}
+
+module "storage_account" {
+  source                   = "../../modules/azure-storage-account"
+  name                     = local.storage_account_name
+  resource_group_name      = data.azurerm_resource_group.this.name
+  location                 = var.location
+  account_kind             = try(local.credentials.storage_account.account_kind, "BlockBlobStorage")
+  account_tier             = try(local.credentials.storage_account.account_tier, "Premium")
+  account_replication_type = try(local.credentials.storage_account.account_replication_type, "LRS")
+  access_tier              = try(local.credentials.storage_account.access_tier, "Hot")
+}
+
+module "key_vault" {
+  for_each = { for a in local.app_list : a.app_name => a }
+
+  source              = "../../modules/azure-key-vault"
+  name                = local.app_key_vault_names[each.key]
+  resource_group_name = data.azurerm_resource_group.this.name
+  location            = var.location
+  tenant_id           = var.azure_tenant_id
+  sku_name            = try(local.credentials.key_vault.sku_name, "standard")
+  ip_rules            = [local.tofu_operator_ip_cidr]
+}
+
+# Each app can only read secrets from its own vault — not every app's.
+resource "azurerm_role_assignment" "app_key_vault_secrets_user" {
+  for_each = module.container_app
+
+  scope                = module.key_vault[each.key].id
+  role_definition_name = "Key Vault Secrets User"
+  principal_id         = each.value.principal_id
+}
+
+# object_id of whoever is authenticated to run Tofu — resolved via ARM, not Graph, so it
+# works with a bare service-principal client_id/secret and needs no extra Graph permission
+# (unlike module.github_oidc's existing_principal_id, which looks up ANOTHER principal).
+data "azurerm_client_config" "current" {}
+
+# Public IP of the machine running `tofu apply`, allowlisted on each vault's firewall below —
+# Key Vault ignores network_acls entirely while public access is off, and writing secrets is
+# a data-plane call the ARM-level Contributor role on the resource group doesn't cover.
+data "http" "tofu_operator_ip" {
+  url = "https://api.ipify.org?format=text"
+}
+
+# Data-plane RBAC to write secrets — Contributor (assigned to the deploying SP elsewhere)
+# only covers ARM/control-plane operations on the vault resource itself.
+resource "azurerm_role_assignment" "tofu_key_vault_secrets_officer" {
+  for_each = module.key_vault
+
+  scope                = each.value.id
+  role_definition_name = "Key Vault Secrets Officer"
+  principal_id         = data.azurerm_client_config.current.object_id
+}
+
+# Azure RBAC role assignments take time to propagate — writing the secret in the same apply
+# that grants the role can 403 without this buffer.
+resource "time_sleep" "key_vault_rbac_propagation" {
+  depends_on      = [azurerm_role_assignment.tofu_key_vault_secrets_officer]
+  create_duration = "30s"
+}
+
+# Pre-populates each app's vault with the SAME fully-merged env var set the Container App
+# itself gets (fuel.yml `variables:` + DB creds + Redis + defaults) — mirrors the ECS
+# template's module.secret_manager, which stores local.env_vars (the merged map, not just
+# the raw fuel.yml variables) as one JSON blob per app. Duplicated here rather than shared
+# via a single locals map for the same reason module.container_app computes it inline (see
+# locals.tf note): a shared map can't partially resolve if one app's DB/Redis module errors.
+resource "azurerm_key_vault_secret" "app_variables" {
+  for_each = { for a in local.app_list : a.app_name => a }
+
+  name = "app-variables"
+  value = jsonencode(merge(
+    {
+      APPLICATIONINSIGHTS_CONNECTION_STRING = module.monitor.connection_string
+    },
+
+    each.value.technology == "nest" ? {
+      NODE_TLS_REJECT_UNAUTHORIZED = "0"
+      API_KEY_HEADER               = "x-api-key"
+      ENCRYPTION_PASSWORD          = module.random_key.value
+      HOST_URL                     = try(local.app_variables[each.key].host_url, "https://${each.value.domain}")
+      FRONT_END_URL                = try(local.app_variables[each.key].front_end_url, "https://${each.key}")
+      APP_NAME                     = "Fuel App"
+      APP_COMPANY                  = try(local.app_variables[each.key].app_company, "Swovo")
+    } : {},
+
+    each.value.technology == "react" ? {
+      NEXT_PUBLIC_API_HOST = try(local.app_build_env[each.key]["NEXT_PUBLIC_API_HOST"], "")
+    } : {},
+
+    each.value.redis_enabled ? {
+      REDIS_HOST = module.redis[each.key].hostname
+      REDIS_PORT = module.redis[each.key].ssl_port
+      REDIS_URL  = "rediss://:${module.redis[each.key].primary_access_key}@${module.redis[each.key].hostname}:${module.redis[each.key].ssl_port}/0"
+    } : {},
+
+    each.value.database_enabled && each.value.database_engine == "mssql" ? {
+      DATABASE_HOST     = module.sql_database[each.key].fqdn
+      DATABASE_USERNAME = module.sql_database[each.key].admin_username
+      DATABASE_NAME     = module.sql_database[each.key].database_name
+      DATABASE_PASSWORD = module.sql_database[each.key].admin_password
+      DATABASE_URL      = "sqlserver://${module.sql_database[each.key].fqdn}:1433;database=${module.sql_database[each.key].database_name};user=${module.sql_database[each.key].admin_username};password=${module.sql_database[each.key].admin_password};encrypt=true"
+    } : {},
+
+    each.value.database_enabled && each.value.database_engine == "postgres" ? {
+      DATABASE_HOST     = module.postgres_database[each.key].fqdn
+      DATABASE_USERNAME = module.postgres_database[each.key].admin_username
+      DATABASE_NAME     = module.postgres_database[each.key].database_name
+      DATABASE_PASSWORD = module.postgres_database[each.key].admin_password
+      DATABASE_URL      = "postgresql://${module.postgres_database[each.key].admin_username}:${module.postgres_database[each.key].admin_password}@${module.postgres_database[each.key].fqdn}/${module.postgres_database[each.key].database_name}"
+    } : {},
+
+    length(try(local.app_variables[each.key], {})) > 0 ? {
+      for k, v in local.app_variables[each.key] : upper(k) => v
+    } : {}
+  ))
+  key_vault_id = module.key_vault[each.key].id
+
+  depends_on = [time_sleep.key_vault_rbac_propagation]
+}
+
+module "sql_database" {
+  for_each = { for app in local.app_list : app.app_name => app if app.database_enabled && app.database_engine == "mssql" }
+
+  source                     = "../../modules/azure-sql-database"
+  server_name                = "${var.project_name}-${each.value.app_name}-sql"
+  database_name              = var.db_name
+  resource_group_name        = data.azurerm_resource_group.this.name
+  location                   = var.location
+  sku_name                   = each.value.database_sku
+  min_capacity               = each.value.database_min_capacity
+  storage_account_type       = each.value.database_storage_type
+  pitr_retention_days        = each.value.database_pitr_days
+  ltr_weekly_retention       = each.value.database_ltr
+  admin_username             = var.db_username
+  private_endpoint_subnet_id = module.network.private_endpoints_subnet_id
+  private_dns_zone_id        = module.network.mssql_dns_zone_id
+}
+
+module "postgres_database" {
+  for_each = { for app in local.app_list : app.app_name => app if app.database_enabled && app.database_engine == "postgres" }
+
+  source              = "../../modules/azure-postgresql-flexible"
+  server_name         = "${var.project_name}-${each.value.app_name}-psql"
+  database_name       = var.db_name
+  resource_group_name = data.azurerm_resource_group.this.name
+  location            = var.location
+  storage_mb          = each.value.database_storage_mb
+  admin_username      = var.db_username
+  delegated_subnet_id = module.network.postgres_subnet_id
+  private_dns_zone_id = module.network.postgres_dns_zone_id
+
+  # Postgres Flexible Server's VNet integration requires the private DNS zone to already
+  # be linked to the VNet — depend on the whole network module, not just its outputs.
+  depends_on = [module.network]
+}
+
+module "redis" {
+  for_each = { for app in local.app_list : app.app_name => app if app.redis_enabled }
+
+  source                     = "../../modules/azure-redis-cache"
+  name                       = "${each.value.app_name}-redis"
+  resource_group_name        = data.azurerm_resource_group.this.name
+  location                   = var.location
+  sku_name                   = each.value.redis_sku
+  private_endpoint_subnet_id = module.network.private_endpoints_subnet_id
+  private_dns_zone_id        = module.network.redis_dns_zone_id
+}
+
+module "container_app" {
+  for_each = { for app in local.container_apps : app.app_name => app }
+
+  source                       = "../../modules/azure-container-app"
+  name                         = each.value.app_name
+  resource_group_name          = data.azurerm_resource_group.this.name
+  container_app_environment_id = module.container_env.id
+  image                        = local.bootstrap_container_image
+  target_port                  = each.value.port
+  external_ingress             = true
+  front_door_backend_cidrs     = local.front_door_backend_ipv4_cidrs
+  cpu                          = each.value.cpu
+  memory                       = each.value.memory
+  concurrent_requests          = each.value.concurrent_requests
+  min_replicas                 = each.value.min_replicas
+  max_replicas                 = each.value.max_replicas
+
+  # Computed inline (not via a shared `local.env_vars` map) so this instance's dependency on
+  # module.sql_database/module.redis is scoped to THIS app only — see locals.tf note above.
+  env_vars = merge(
+    {
+      APPLICATIONINSIGHTS_CONNECTION_STRING = module.monitor.connection_string
+      KEY_VAULT_URI                         = module.key_vault[each.key].vault_uri
+    },
+
+    each.value.technology == "nest" ? {
+      NODE_TLS_REJECT_UNAUTHORIZED = "0"
+      API_KEY_HEADER               = "x-api-key"
+      ENCRYPTION_PASSWORD          = module.random_key.value
+      HOST_URL                     = try(local.app_variables[each.key].host_url, "https://${each.value.domain}")
+      FRONT_END_URL                = try(local.app_variables[each.key].front_end_url, "https://${each.key}")
+      APP_NAME                     = "Fuel App"
+      APP_COMPANY                  = try(local.app_variables[each.key].app_company, "Swovo")
+    } : {},
+
+    each.value.technology == "react" ? {
+      NEXT_PUBLIC_API_HOST = try(local.app_build_env[each.key]["NEXT_PUBLIC_API_HOST"], "")
+    } : {},
+
+    each.value.redis_enabled ? {
+      REDIS_HOST = module.redis[each.key].hostname
+      REDIS_PORT = module.redis[each.key].ssl_port
+    } : {},
+
+    each.value.database_enabled && each.value.database_engine == "mssql" ? {
+      DATABASE_HOST     = module.sql_database[each.key].fqdn
+      DATABASE_USERNAME = module.sql_database[each.key].admin_username
+      DATABASE_NAME     = module.sql_database[each.key].database_name
+    } : {},
+
+    each.value.database_enabled && each.value.database_engine == "postgres" ? {
+      DATABASE_HOST     = module.postgres_database[each.key].fqdn
+      DATABASE_USERNAME = module.postgres_database[each.key].admin_username
+      DATABASE_NAME     = module.postgres_database[each.key].database_name
+    } : {},
+
+    length(try(local.app_variables[each.key], {})) > 0 ? {
+      for k, v in local.app_variables[each.key] : upper(k) => v
+    } : {}
+  )
+
+  # DB passwords / Redis keys as Container App secrets (secretRef), never plaintext env values.
+  secrets = merge(
+    each.value.redis_enabled ? {
+      REDIS_URL = "rediss://:${module.redis[each.key].primary_access_key}@${module.redis[each.key].hostname}:${module.redis[each.key].ssl_port}/0"
+    } : {},
+
+    each.value.database_enabled && each.value.database_engine == "mssql" ? {
+      DATABASE_PASSWORD = module.sql_database[each.key].admin_password
+      DATABASE_URL      = "sqlserver://${module.sql_database[each.key].fqdn}:1433;database=${module.sql_database[each.key].database_name};user=${module.sql_database[each.key].admin_username};password=${module.sql_database[each.key].admin_password};encrypt=true"
+    } : {},
+
+    each.value.database_enabled && each.value.database_engine == "postgres" ? {
+      DATABASE_PASSWORD = module.postgres_database[each.key].admin_password
+      DATABASE_URL      = "postgresql://${module.postgres_database[each.key].admin_username}:${module.postgres_database[each.key].admin_password}@${module.postgres_database[each.key].fqdn}/${module.postgres_database[each.key].database_name}"
+    } : {}
+  )
+}
+
+resource "azurerm_role_assignment" "container_app_acr_pull" {
+  for_each = module.container_app
+
+  scope                = module.acr.id
+  role_definition_name = "AcrPull"
+  principal_id         = each.value.principal_id
+}
+
+module "container_app_worker" {
+  for_each = { for w in local.worker_list : w.worker_name => w }
+
+  source                       = "../../modules/azure-container-app"
+  name                         = each.value.worker_name
+  resource_group_name          = data.azurerm_resource_group.this.name
+  container_app_environment_id = module.container_env.id
+  image                        = local.bootstrap_container_image
+  external_ingress             = false
+
+  # Same inline computation as module.container_app above, keyed off the PARENT app's flags
+  # (worker's own each.value only has app_name/dockerfile/worker_name/branch).
+  env_vars = merge(
+    {
+      APPLICATIONINSIGHTS_CONNECTION_STRING = module.monitor.connection_string
+      KEY_VAULT_URI                         = module.key_vault[each.value.app_name].vault_uri
+    },
+
+    local.app_list_by_name[each.value.app_name].technology == "nest" ? {
+      NODE_TLS_REJECT_UNAUTHORIZED = "0"
+      API_KEY_HEADER               = "x-api-key"
+      ENCRYPTION_PASSWORD          = module.random_key.value
+      HOST_URL                     = try(local.app_variables[each.value.app_name].host_url, "https://${local.app_list_by_name[each.value.app_name].domain}")
+      FRONT_END_URL                = try(local.app_variables[each.value.app_name].front_end_url, "https://${each.value.app_name}")
+      APP_NAME                     = "Fuel App"
+      APP_COMPANY                  = try(local.app_variables[each.value.app_name].app_company, "Swovo")
+    } : {},
+
+    local.app_list_by_name[each.value.app_name].technology == "react" ? {
+      NEXT_PUBLIC_API_HOST = try(local.app_build_env[each.value.app_name]["NEXT_PUBLIC_API_HOST"], "")
+    } : {},
+
+    local.app_list_by_name[each.value.app_name].redis_enabled ? {
+      REDIS_HOST = module.redis[each.value.app_name].hostname
+      REDIS_PORT = module.redis[each.value.app_name].ssl_port
+    } : {},
+
+    local.app_list_by_name[each.value.app_name].database_enabled && local.app_list_by_name[each.value.app_name].database_engine == "mssql" ? {
+      DATABASE_HOST     = module.sql_database[each.value.app_name].fqdn
+      DATABASE_USERNAME = module.sql_database[each.value.app_name].admin_username
+      DATABASE_NAME     = module.sql_database[each.value.app_name].database_name
+    } : {},
+
+    local.app_list_by_name[each.value.app_name].database_enabled && local.app_list_by_name[each.value.app_name].database_engine == "postgres" ? {
+      DATABASE_HOST     = module.postgres_database[each.value.app_name].fqdn
+      DATABASE_USERNAME = module.postgres_database[each.value.app_name].admin_username
+      DATABASE_NAME     = module.postgres_database[each.value.app_name].database_name
+    } : {},
+
+    length(try(local.app_variables[each.value.app_name], {})) > 0 ? {
+      for k, v in local.app_variables[each.value.app_name] : upper(k) => v
+    } : {}
+  )
+
+  secrets = merge(
+    local.app_list_by_name[each.value.app_name].redis_enabled ? {
+      REDIS_URL = "rediss://:${module.redis[each.value.app_name].primary_access_key}@${module.redis[each.value.app_name].hostname}:${module.redis[each.value.app_name].ssl_port}/0"
+    } : {},
+
+    local.app_list_by_name[each.value.app_name].database_enabled && local.app_list_by_name[each.value.app_name].database_engine == "mssql" ? {
+      DATABASE_PASSWORD = module.sql_database[each.value.app_name].admin_password
+      DATABASE_URL      = "sqlserver://${module.sql_database[each.value.app_name].fqdn}:1433;database=${module.sql_database[each.value.app_name].database_name};user=${module.sql_database[each.value.app_name].admin_username};password=${module.sql_database[each.value.app_name].admin_password};encrypt=true"
+    } : {},
+
+    local.app_list_by_name[each.value.app_name].database_enabled && local.app_list_by_name[each.value.app_name].database_engine == "postgres" ? {
+      DATABASE_PASSWORD = module.postgres_database[each.value.app_name].admin_password
+      DATABASE_URL      = "postgresql://${module.postgres_database[each.value.app_name].admin_username}:${module.postgres_database[each.value.app_name].admin_password}@${module.postgres_database[each.value.app_name].fqdn}/${module.postgres_database[each.value.app_name].database_name}"
+    } : {}
+  )
+}
+
+resource "azurerm_role_assignment" "worker_acr_pull" {
+  for_each = module.container_app_worker
+
+  scope                = module.acr.id
+  role_definition_name = "AcrPull"
+  principal_id         = each.value.principal_id
+}
+
+# Worker has its own identity (distinct from its parent app's) — reads from the same
+# per-app vault as its parent, since it's the same logical app.
+resource "azurerm_role_assignment" "worker_key_vault_secrets_user" {
+  for_each = module.container_app_worker
+
+  scope                = module.key_vault[local.worker_list_by_name[each.key].app_name].id
+  role_definition_name = "Key Vault Secrets User"
+  principal_id         = each.value.principal_id
+}
+
+
+module "front_door" {
+  source              = "../../modules/azure-front-door"
+  name                = "${var.project_name}-fd"
+  resource_group_name = data.azurerm_resource_group.this.name
+  sku_name            = try(local.credentials.front_door.sku_name, "Standard_AzureFrontDoor")
+
+  origins = {
+    for app in local.container_apps : app.app_name => {
+      host_name     = module.container_app[app.app_name].fqdn
+      custom_domain = app.domain
+    }
+  }
+}

package/dist/infra-templates/templates/azure/outputs.tf

@@ -0,0 +1,40 @@
+output "github_oidc_client_id" {
+  value = module.github_oidc.client_id
+}
+
+output "acr_login_server" {
+  value = module.acr.login_server
+}
+
+output "front_door_endpoint_hostname" {
+  value = module.front_door.endpoint_hostname
+}
+
+output "custom_domain_validation" {
+  description = "DNS records to create at the domain's own DNS provider so Azure can validate ownership and issue the managed TLS certificate."
+  value       = module.front_door.custom_domain_validation
+}
+
+output "github_http_repo_url" {
+  value     = "https://github.com/${var.github_organization}/${var.github_repo_name}.git"
+  sensitive = true
+}
+
+output "resource_group_name" {
+  value = data.azurerm_resource_group.this.name
+}
+
+output "container_apps_outbound_ip" {
+  description = "Static outbound IP for all Container Apps in this project — use for allowlisting against third-party APIs/firewalls."
+  value       = module.network.container_apps_outbound_ip
+}
+
+output "apps" {
+  value     = local.app_list
+  sensitive = true
+}
+
+output "workers" {
+  value     = local.worker_list
+  sensitive = true
+}

package/dist/infra-templates/templates/azure/providers.tf

@@ -0,0 +1,65 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    azurerm = {
+      source = "hashicorp/azurerm"
+      # >= 4.0 required for resource_provider_registrations/resource_providers_to_register below.
+      # < 5.0 pinned: v5 renames/removes arguments on several resources (e.g.
+      # azurerm_private_dns_zone_virtual_network_link) this template set hasn't been migrated to yet.
+      version = ">= 4.0.0, < 5.0.0"
+    }
+    azuread = {
+      source  = "hashicorp/azuread"
+      version = ">= 2.53.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.5.1"
+    }
+    http = {
+      source  = "hashicorp/http"
+      version = ">= 3.4.0"
+    }
+    time = {
+      source  = "hashicorp/time"
+      version = ">= 0.11.0"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {}
+  subscription_id = var.azure_subscription_id
+  tenant_id       = var.azure_tenant_id
+  client_id       = var.azure_client_id
+  client_secret   = var.azure_client_secret
+
+  # azurerm v4 only auto-registers a curated "core" set of resource providers before
+  # apply — Microsoft.App (Container Apps) isn't in it, which surfaces as a 409
+  # MissingSubscriptionRegistration on a subscription that has never used that
+  # namespace before. Register everything this template set actually provisions,
+  # explicitly, so `tofu apply` is self-sufficient (no external registration step,
+  # CLI or otherwise, has to run first).
+  resource_provider_registrations = "none"
+  resource_providers_to_register = [
+    "Microsoft.App",
+    "Microsoft.Sql",
+    "Microsoft.DBforPostgreSQL",
+    "Microsoft.Cache",
+    "Microsoft.ContainerRegistry",
+    "Microsoft.KeyVault",
+    "Microsoft.Network",
+    "Microsoft.Cdn",
+    "Microsoft.Storage",
+    "Microsoft.OperationalInsights",
+    "Microsoft.Insights",
+    "Microsoft.Portal",
+    "Microsoft.Authorization",
+  ]
+}
+
+provider "azuread" {
+  tenant_id     = var.azure_tenant_id
+  client_id     = var.azure_client_id
+  client_secret = var.azure_client_secret
+}

package/dist/infra-templates/templates/azure/variables.tf

@@ -0,0 +1,69 @@
+variable "project_name" {
+  description = "A unique name for your project. Used as part of most resource names."
+  default     = ""
+}
+
+variable "location" {
+  description = "Azure region for all resources"
+  default     = "eastus"
+}
+
+variable "resource_group_name" {
+  description = "Name of the resource group (created by the CLI before `tofu init`)"
+  default     = ""
+}
+
+variable "key_vault_name" {
+  description = "Name of the bootstrap Key Vault holding the fuel.yml infrastructure secret (created by the CLI)"
+  default     = ""
+}
+
+variable "acr_name" {
+  description = "Globally unique name for the Azure Container Registry"
+  default     = ""
+}
+
+variable "github_organization" {
+  description = "GitHub organization where the repository is created"
+  default     = ""
+}
+
+variable "github_repo_name" {
+  description = "Name of the GitHub repository (created by the CLI)"
+  type        = string
+  default     = ""
+}
+
+variable "azure_subscription_id" {
+  description = "Azure subscription ID"
+  default     = ""
+  sensitive   = true
+}
+
+variable "azure_tenant_id" {
+  description = "Azure AD tenant ID"
+  default     = ""
+  sensitive   = true
+}
+
+variable "azure_client_id" {
+  description = "Client ID of the service principal used to run Tofu"
+  default     = ""
+  sensitive   = true
+}
+
+variable "azure_client_secret" {
+  description = "Client secret of the service principal used to run Tofu"
+  default     = ""
+  sensitive   = true
+}
+
+variable "db_username" {
+  description = "Administrator username for provisioned databases"
+  default     = ""
+}
+
+variable "db_name" {
+  description = "Database name for provisioned databases"
+  default     = ""
+}