@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/infra-templates/modules/azure-container-app/main.tf

@@ -0,0 +1,124 @@
+# NOTE on `registry` + identity auth: a resource cannot reference its own
+# computed attributes (e.g. azurerm_container_app.this.identity[0].principal_id)
+# from within its own configuration - that's a circular reference and won't
+# plan. `registry.identity = "System"` is the documented way to tell the
+# platform "use this container app's own system-assigned identity" (same
+# convention as `secret.identity`). The ACR pull role assignment (created by
+# the parent template, against this module's `principal_id` output) necessarily
+# happens AFTER this resource exists (it needs the identity's principal ID).
+# Configuring `registry` here anyway made Container Apps try to validate that
+# credential during the very first create, before the role assignment exists —
+# the provisioning call hangs and times out ("Operation expired") regardless of
+# which image is actually being pulled. So: no `registry` block here at all: CI
+# wires it up with `az containerapp registry set` once the role assignment is
+# already in place (see build_and_deploy.yml), and ignore_changes below stops
+# `tofu apply` from ever trying to remove what CI configured.
+locals {
+  # Container App secret names must be lowercase alphanumeric + '-'; env var names keep
+  # the caller's original casing (e.g. STRIPE_SECRET_KEY) via secret_name lookup below.
+  secret_names = { for k, v in var.secrets : k => lower(replace(k, "_", "-")) }
+}
+
+resource "azurerm_container_app" "this" {
+  name                         = var.name
+  resource_group_name          = var.resource_group_name
+  container_app_environment_id = var.container_app_environment_id
+  revision_mode                = "Single"
+  # Matches the "Consumption" profile module.azure-container-apps-environment always declares —
+  # explicit so `plan` doesn't perpetually diff against what Azure reports back.
+  workload_profile_name = "Consumption"
+
+  identity {
+    type = "SystemAssigned"
+  }
+
+  template {
+    min_replicas = var.min_replicas
+    max_replicas = var.max_replicas
+
+    container {
+      name   = var.name
+      image  = var.image
+      cpu    = var.cpu
+      memory = var.memory
+
+      dynamic "env" {
+        for_each = var.env_vars
+        content {
+          name  = env.key
+          value = env.value
+        }
+      }
+
+      dynamic "env" {
+        for_each = var.secrets
+        content {
+          name        = env.key
+          secret_name = local.secret_names[env.key]
+        }
+      }
+    }
+
+    # HTTP concurrency-based autoscaling only makes sense for apps that
+    # actually receive ingress traffic; workers have no ingress to scale on.
+    dynamic "http_scale_rule" {
+      for_each = var.external_ingress ? [1] : []
+      content {
+        name                = "${var.name}-http-scale"
+        concurrent_requests = var.concurrent_requests
+      }
+    }
+  }
+
+  dynamic "secret" {
+    for_each = var.secrets
+    content {
+      name  = local.secret_names[secret.key]
+      value = secret.value
+    }
+  }
+
+  # Workers (external_ingress = false) get no ingress block at all.
+  dynamic "ingress" {
+    for_each = var.external_ingress ? [1] : []
+    content {
+      external_enabled = true
+      target_port      = var.target_port
+
+      traffic_weight {
+        latest_revision = true
+        percentage      = 100
+      }
+
+      # Every public app is fronted by Front Door (custom domain + eventually WAF) — direct
+      # hits to the *.azurecontainerapps.io hostname would bypass it entirely. Restrict inbound
+      # to Front Door's published backend range (Microsoft's documented pattern for this;
+      # resolved to real CIDRs by the caller since this field validates as strict CIDR, not a
+      # service tag name). Doesn't stop another tenant's Front Door from proxying through (same
+      # shared IP range) — the app itself should also check the X-Azure-FDID header against
+      # this project's Front Door ID for that.
+      dynamic "ip_security_restriction" {
+        for_each = var.front_door_backend_cidrs
+        content {
+          name             = "allow-front-door-${replace(ip_security_restriction.value, "/", "-")}"
+          action           = "Allow"
+          ip_address_range = ip_security_restriction.value
+        }
+      }
+    }
+  }
+
+  # var.image is only ever meaningful on the very first create — the ACR tag it
+  # points at doesn't exist yet (the CI pipeline that pushes it depends on this same
+  # apply having already created the GitHub OIDC identity/repo secrets). Ignore drift
+  # on it so a later `az containerapp update` (done by CI once it has a real image)
+  # never gets clobbered back by a subsequent `tofu apply`/`--regenerate`.
+  lifecycle {
+    ignore_changes = [template[0].container[0].image, registry]
+
+    precondition {
+      condition     = !var.external_ingress || length(var.front_door_backend_cidrs) > 0
+      error_message = "front_door_backend_cidrs must not be empty when external_ingress is true — an empty list removes every ip_security_restriction rule, exposing this Container App directly to the internet instead of only through Front Door."
+    }
+  }
+}

package/dist/infra-templates/modules/azure-container-app/outputs.tf

@@ -0,0 +1,24 @@
+output "id" {
+  value       = azurerm_container_app.this.id
+  description = "The ID of the Container App"
+}
+
+output "name" {
+  value       = azurerm_container_app.this.name
+  description = "The name of the Container App"
+}
+
+output "fqdn" {
+  value       = try(azurerm_container_app.this.ingress[0].fqdn, "")
+  description = "The FQDN of the Container App ingress, or an empty string when external_ingress is false"
+}
+
+output "principal_id" {
+  value       = azurerm_container_app.this.identity[0].principal_id
+  description = "Principal ID of the system-assigned managed identity, used by the parent template to grant AcrPull"
+}
+
+output "latest_revision_name" {
+  value       = azurerm_container_app.this.latest_revision_name
+  description = "The name of the latest Container App revision"
+}

package/dist/infra-templates/modules/azure-container-app/variables.tf

@@ -0,0 +1,80 @@
+variable "name" {
+  type        = string
+  description = "Name of the Container App"
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Name of the resource group in which to create the Container App"
+}
+
+variable "container_app_environment_id" {
+  type        = string
+  description = "ID of the (Consumption) Container App Environment this app belongs to"
+}
+
+variable "image" {
+  type        = string
+  description = "Full image reference to run, e.g. \"myacr.azurecr.io/app:latest\""
+}
+
+variable "target_port" {
+  type        = number
+  description = "Port the container listens on"
+  default     = 8080
+}
+
+variable "external_ingress" {
+  type        = bool
+  description = "Whether to expose external ingress. Set to false for workers (no ingress block is created)"
+  default     = true
+}
+
+variable "cpu" {
+  type        = number
+  description = "vCPU allocated to the container"
+  default     = 1
+}
+
+variable "memory" {
+  type        = string
+  description = "Memory allocated to the container, e.g. \"2Gi\""
+  default     = "2Gi"
+}
+
+variable "min_replicas" {
+  type        = number
+  description = "Minimum number of replicas"
+  default     = 0
+}
+
+variable "max_replicas" {
+  type        = number
+  description = "Maximum number of replicas"
+  default     = 3
+}
+
+variable "concurrent_requests" {
+  type        = number
+  description = "Number of concurrent HTTP requests that triggers scaling. Only relevant when external_ingress is true"
+  default     = 20
+}
+
+variable "env_vars" {
+  type        = map(string)
+  description = "Plain (non-secret) environment variables for the container"
+  default     = {}
+}
+
+variable "secrets" {
+  type        = map(string)
+  description = "Name/value pairs exposed as Container App secrets, referenceable via secretRef in env vars"
+  default     = {}
+  sensitive   = true
+}
+
+variable "front_door_backend_cidrs" {
+  type        = list(string)
+  description = "CIDR ranges to allow through ingress (Front Door's backend range) when external_ingress is true. Empty list means no restriction is applied."
+  default     = []
+}

package/dist/infra-templates/modules/azure-container-apps-environment/main.tf

@@ -0,0 +1,18 @@
+resource "azurerm_container_app_environment" "this" {
+  name                       = var.name
+  resource_group_name        = var.resource_group_name
+  location                   = var.location
+  log_analytics_workspace_id = var.log_analytics_workspace_id
+  infrastructure_subnet_id   = var.infrastructure_subnet_id
+
+  # Azure implicitly attaches this default profile to every environment regardless of what's
+  # declared here (there's no more "Consumption-only, no workload profile at all" environment
+  # type) — leaving it undeclared just meant every plan showed a perpetual diff against the
+  # real state. Declare it explicitly so plan reflects reality. Adding a Dedicated/GP profile
+  # here later doesn't change this app's plan — that's controlled per-app via
+  # azurerm_container_app.workload_profile_name.
+  workload_profile {
+    name                  = "Consumption"
+    workload_profile_type = "Consumption"
+  }
+}

package/dist/infra-templates/modules/azure-container-apps-environment/outputs.tf

@@ -0,0 +1,14 @@
+output "id" {
+  value       = azurerm_container_app_environment.this.id
+  description = "ID of the Container Apps Environment"
+}
+
+output "name" {
+  value       = azurerm_container_app_environment.this.name
+  description = "Name of the Container Apps Environment"
+}
+
+output "default_domain" {
+  value       = azurerm_container_app_environment.this.default_domain
+  description = "Default domain of the Container Apps Environment"
+}

package/dist/infra-templates/modules/azure-container-apps-environment/variables.tf

@@ -0,0 +1,24 @@
+variable "name" {
+  description = "Name of the Container Apps Environment"
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "Name of the resource group where the environment will be created"
+  type        = string
+}
+
+variable "location" {
+  description = "Azure region where the environment will be created"
+  type        = string
+}
+
+variable "log_analytics_workspace_id" {
+  description = "ID of the Log Analytics workspace used for Container Apps diagnostics"
+  type        = string
+}
+
+variable "infrastructure_subnet_id" {
+  description = "Delegated subnet for VNet integration. Egress-only: ingress stays public so Front Door can still reach apps directly."
+  type        = string
+}

package/dist/infra-templates/modules/azure-container-registry/main.tf

@@ -0,0 +1,10 @@
+resource "azurerm_container_registry" "this" {
+  name                = var.name
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  sku                 = var.sku
+
+  # Admin credentials are disabled on purpose: pulls are done via managed
+  # identity + role assignment (AcrPull), configured by the parent template.
+  admin_enabled = false
+}

package/dist/infra-templates/modules/azure-container-registry/outputs.tf

@@ -0,0 +1,14 @@
+output "id" {
+  value       = azurerm_container_registry.this.id
+  description = "The ID of the Container Registry"
+}
+
+output "login_server" {
+  value       = azurerm_container_registry.this.login_server
+  description = "The URL used to log into the Container Registry"
+}
+
+output "name" {
+  value       = azurerm_container_registry.this.name
+  description = "The name of the Container Registry"
+}

package/dist/infra-templates/modules/azure-container-registry/variables.tf

@@ -0,0 +1,20 @@
+variable "name" {
+  type        = string
+  description = "Globally unique name for the Container Registry (5-50 alphanumeric characters). Uniqueness is the caller's responsibility."
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Name of the resource group in which to create the Container Registry"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region in which to create the Container Registry"
+}
+
+variable "sku" {
+  type        = string
+  description = "SKU for the Container Registry"
+  default     = "Basic"
+}

package/dist/infra-templates/modules/azure-front-door/main.tf

@@ -0,0 +1,80 @@
+resource "azurerm_cdn_frontdoor_profile" "this" {
+  name                = var.name
+  resource_group_name = var.resource_group_name
+  sku_name            = var.sku_name
+}
+
+resource "azurerm_cdn_frontdoor_endpoint" "this" {
+  name                     = "${var.name}-endpoint"
+  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.this.id
+}
+
+resource "azurerm_cdn_frontdoor_origin_group" "this" {
+  for_each = var.origins
+
+  name                     = "${each.key}-og"
+  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.this.id
+
+  load_balancing {
+    sample_size                 = 4
+    successful_samples_required = 3
+  }
+
+  health_probe {
+    protocol            = "Https"
+    request_type        = "HEAD"
+    path                = "/"
+    interval_in_seconds = 100
+  }
+}
+
+resource "azurerm_cdn_frontdoor_origin" "this" {
+  for_each = var.origins
+
+  name                          = "${each.key}-origin"
+  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.this[each.key].id
+
+  host_name = each.value.host_name
+  # Without this, Front Door forwards the client's original Host header (the custom domain)
+  # straight through to the origin. Container Apps routes ingress by Host header and has no
+  # idea about the custom domain (only Front Door's custom domain resource knows it) — it
+  # responds "This Container App is stopped or does not exist" for an unrecognized host.
+  # Rewrite to the origin's own *.azurecontainerapps.io hostname so it always matches.
+  origin_host_header             = each.value.host_name
+  certificate_name_check_enabled = true
+  http_port                      = each.value.http_port
+  https_port                     = each.value.https_port
+}
+
+resource "azurerm_cdn_frontdoor_custom_domain" "this" {
+  for_each = { for k, v in var.origins : k => v if v.custom_domain != null }
+
+  name                     = "${each.key}-domain"
+  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.this.id
+  host_name                = each.value.custom_domain
+
+  tls {
+    certificate_type = "ManagedCertificate"
+  }
+}
+
+resource "azurerm_cdn_frontdoor_route" "this" {
+  for_each = var.origins
+
+  name                            = "${each.key}-route"
+  cdn_frontdoor_endpoint_id       = azurerm_cdn_frontdoor_endpoint.this.id
+  cdn_frontdoor_origin_group_id   = azurerm_cdn_frontdoor_origin_group.this[each.key].id
+  cdn_frontdoor_origin_ids        = [azurerm_cdn_frontdoor_origin.this[each.key].id]
+  cdn_frontdoor_custom_domain_ids = each.value.custom_domain != null ? [azurerm_cdn_frontdoor_custom_domain.this[each.key].id] : []
+
+  supported_protocols    = ["Http", "Https"]
+  patterns_to_match      = ["/*"]
+  forwarding_protocol    = "HttpsOnly"
+  https_redirect_enabled = true
+
+  # All routes share one Front Door endpoint/profile — every route linking to the shared
+  # default *.azurefd.net domain with the same "/*" pattern collides the moment a second
+  # app is added ("this combination already exists in Route <other-app>-route"). Only fall
+  # back to the default domain when an app has no custom domain of its own to route on.
+  link_to_default_domain = each.value.custom_domain == null
+}

package/dist/infra-templates/modules/azure-front-door/outputs.tf

@@ -0,0 +1,20 @@
+output "endpoint_hostname" {
+  value       = azurerm_cdn_frontdoor_endpoint.this.host_name
+  description = "Hostname of the Front Door endpoint shared by all apps/origins"
+}
+
+output "profile_id" {
+  value       = azurerm_cdn_frontdoor_profile.this.id
+  description = "ID of the Front Door profile"
+}
+
+output "custom_domain_validation" {
+  description = "Per-domain DNS records the domain owner must create: a TXT record at _dnsauth.<host_name> with value validation_token (proves ownership so Azure can issue the managed certificate), and a CNAME from host_name to the shared endpoint_hostname above."
+  value = {
+    for k, d in azurerm_cdn_frontdoor_custom_domain.this : d.host_name => {
+      txt_record_name  = "_dnsauth.${d.host_name}"
+      txt_record_value = d.validation_token
+      cname_target     = azurerm_cdn_frontdoor_endpoint.this.host_name
+    }
+  }
+}

package/dist/infra-templates/modules/azure-front-door/variables.tf

@@ -0,0 +1,26 @@
+variable "name" {
+  description = "Name of the Front Door profile"
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "Name of the resource group where the Front Door profile will be created"
+  type        = string
+}
+
+variable "sku_name" {
+  description = "SKU for the Front Door profile"
+  type        = string
+  default     = "Standard_AzureFrontDoor"
+}
+
+variable "origins" {
+  description = "Map of apps/origins to expose behind the shared Front Door profile/endpoint. The map key is used as the app name and as a suffix for the origin group/origin/route resources of that app."
+  type = map(object({
+    host_name     = string
+    http_port     = optional(number, 80)
+    https_port    = optional(number, 443)
+    custom_domain = optional(string)
+  }))
+  default = {}
+}

package/dist/infra-templates/modules/azure-github-oidc/main.tf

@@ -0,0 +1,48 @@
+resource "azuread_application" "this" {
+  count = var.enabled && var.existing_client_id == null ? 1 : 0
+
+  display_name = "${var.project_name}-github-actions"
+}
+
+resource "azuread_service_principal" "this" {
+  count = var.enabled && var.existing_client_id == null ? 1 : 0
+
+  client_id = azuread_application.this[0].client_id
+}
+
+resource "azuread_application_federated_identity_credential" "this" {
+  for_each = var.enabled && var.existing_client_id == null ? toset(var.branches) : toset([])
+
+  application_id = azuread_application.this[0].id
+  display_name   = "github-${each.value}"
+  audiences      = ["api://AzureADTokenExchange"]
+  issuer         = "https://token.actions.githubusercontent.com"
+  subject        = "repo:${var.github_organization}/${var.github_repo_name}:ref:refs/heads/${each.value}"
+}
+
+# Looked up (not created) when the app/SP/federated credential were set up out-of-band by a
+# tenant admin — see variables.tf for why. Skipped entirely when the caller already supplies
+# existing_principal_id: the lookup needs Directory.Read.All/Application.Read.All on the
+# deploying SP, which a lot of tenants won't grant just to resolve one known object ID.
+data "azuread_service_principal" "existing" {
+  count = var.enabled && var.existing_client_id != null && var.existing_principal_id == null ? 1 : 0
+
+  client_id = var.existing_client_id
+}
+
+locals {
+  # null when disabled — the parent template must guard any reference to outputs on `var.enabled`.
+  principal_id = var.enabled ? (
+    var.existing_principal_id != null ? var.existing_principal_id : (
+      var.existing_client_id == null ? azuread_service_principal.this[0].object_id : data.azuread_service_principal.existing[0].object_id
+    )
+  ) : null
+}
+
+resource "azurerm_role_assignment" "contributor" {
+  count = var.enabled && var.manage_role_assignment ? 1 : 0
+
+  scope                = var.role_assignment_scope
+  role_definition_name = "Contributor"
+  principal_id         = local.principal_id
+}

package/dist/infra-templates/modules/azure-github-oidc/outputs.tf

@@ -0,0 +1,9 @@
+output "client_id" {
+  value       = var.enabled ? (var.existing_client_id != null ? var.existing_client_id : azuread_application.this[0].client_id) : null
+  description = "Client ID of the Azure AD application used by GitHub Actions to authenticate via OIDC. Null when disabled."
+}
+
+output "principal_id" {
+  value       = local.principal_id
+  description = "Object ID of the service principal, used by the parent template to grant additional roles (e.g. AcrPush/AcrPull). Null when disabled."
+}

package/dist/infra-templates/modules/azure-github-oidc/variables.tf

@@ -0,0 +1,69 @@
+variable "project_name" {
+  description = "Project name used as prefix for resource names"
+  type        = string
+}
+
+variable "github_organization" {
+  description = "GitHub organization name for the OIDC trust subject"
+  type        = string
+}
+
+variable "github_repo_name" {
+  description = "GitHub repository name for the OIDC trust subject"
+  type        = string
+}
+
+variable "branches" {
+  description = "Branches allowed to assume the Azure AD application via OIDC. One federated credential is created per branch."
+  type        = list(string)
+  default     = ["main"]
+}
+
+variable "role_assignment_scope" {
+  description = "Scope for the Contributor role assignment, typically the resource group ID"
+  type        = string
+}
+
+variable "existing_client_id" {
+  description = <<-EOT
+    Client ID of an app registration + service principal + federated identity credential(s)
+    already created out-of-band by a tenant admin. Set this when the deploying SP lacks the
+    Entra ID "Application Administrator" role (creating an app registration requires it,
+    regardless of subscription-level RBAC) — the module then looks up and reuses that identity
+    instead of creating a new one. The Contributor role assignment is still managed by this
+    module either way, since that only needs "User Access Administrator" on the subscription.
+  EOT
+  type        = string
+  default     = null
+}
+
+variable "existing_principal_id" {
+  description = <<-EOT
+    Object ID (principal ID) of the service principal identified by existing_client_id, when
+    that's already known. Set this to skip looking it up via Microsoft Graph entirely — the
+    lookup (data.azuread_service_principal.existing) needs Directory.Read.All or
+    Application.Read.All on the deploying SP, which many tenant admins won't grant just to
+    resolve one known object. Whoever created the app out-of-band can get this by running
+    `az ad sp show --id <existing_client_id> --query id -o tsv`.
+  EOT
+  type        = string
+  default     = null
+}
+
+variable "manage_role_assignment" {
+  description = <<-EOT
+    Whether Terraform should create/manage the Contributor role assignment for this identity.
+    Set to false when it was already granted out-of-band alongside existing_client_id (e.g. a
+    tenant admin's onboarding runbook already ran `az role assignment create ... --role
+    Contributor`) — otherwise Terraform tries to create it again on every apply and fails with
+    RoleAssignmentExists.
+  EOT
+  type        = bool
+  default     = true
+}
+
+variable "enabled" {
+  description = "Set to false to skip this module entirely (no app, no SP, no role assignment). Use to unblock testing while waiting on a tenant admin for Application Administrator or an existing_client_id."
+  type        = bool
+  default     = true
+}

package/dist/infra-templates/modules/azure-key-vault/main.tf

@@ -0,0 +1,21 @@
+# Application Key Vault (RBAC-based), used by apps to read secrets at runtime.
+# Distinct from the bootstrap vault created by the CLI via SDK.
+resource "azurerm_key_vault" "this" {
+  name                = var.name
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  tenant_id           = var.tenant_id
+  sku_name            = var.sku_name
+
+  rbac_authorization_enabled = true
+  purge_protection_enabled   = false
+  soft_delete_retention_days = 7
+
+  public_network_access_enabled = length(var.ip_rules) > 0 ? true : var.public_network_access_enabled
+
+  network_acls {
+    bypass         = "AzureServices"
+    default_action = var.network_acls_default_action
+    ip_rules       = var.ip_rules
+  }
+}

package/dist/infra-templates/modules/azure-key-vault/outputs.tf

@@ -0,0 +1,11 @@
+output "id" {
+  value = azurerm_key_vault.this.id
+}
+
+output "vault_uri" {
+  value = azurerm_key_vault.this.vault_uri
+}
+
+output "name" {
+  value = azurerm_key_vault.this.name
+}

package/dist/infra-templates/modules/azure-key-vault/variables.tf

@@ -0,0 +1,43 @@
+variable "name" {
+  type        = string
+  description = "Key Vault name"
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group where the Key Vault is created"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+}
+
+variable "tenant_id" {
+  type        = string
+  description = "Azure AD tenant ID"
+}
+
+variable "sku_name" {
+  type        = string
+  description = "Key Vault SKU"
+  default     = "standard"
+}
+
+variable "public_network_access_enabled" {
+  type        = bool
+  description = "Allow access from the public internet. Defaults to false: this vault isn't read by anything at runtime today (no VNet/private-endpoint consumer wired up yet), so there's no reason to expose it publicly."
+  default     = false
+}
+
+variable "network_acls_default_action" {
+  type        = string
+  description = "Default action for requests not matched by an IP/VNet rule. Defaults to \"Deny\" — flip to \"Allow\" (or add a private endpoint) only once something outside the vault's own resource group needs to read from it."
+  default     = "Deny"
+}
+
+variable "ip_rules" {
+  type        = list(string)
+  description = "Public IPs/CIDRs allowed through the firewall (e.g. the operator machine running `tofu apply`, which needs data-plane access to write secrets). Forces public_network_access_enabled on when non-empty, since Azure ignores network_acls entirely while public access is off."
+  default     = []
+}