@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/infra-templates/modules/azure-monitor/main.tf

@@ -0,0 +1,29 @@
+resource "azurerm_log_analytics_workspace" "this" {
+  name                = "${var.project_name}-law"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  sku                 = "PerGB2018"
+  retention_in_days   = var.retention_days
+}
+
+resource "azurerm_application_insights" "this" {
+  name                 = "${var.project_name}-appi"
+  resource_group_name  = var.resource_group_name
+  location             = var.location
+  application_type     = "web"
+  workspace_id         = azurerm_log_analytics_workspace.this.id
+  daily_data_cap_in_gb = var.daily_data_cap_gb
+  retention_in_days    = var.retention_days
+}
+
+resource "azurerm_portal_dashboard" "this" {
+  count               = var.dashboard_count
+  name                = "${var.project_name}-dashboard-${count.index + 1}"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+
+  dashboard_properties = jsonencode({
+    lenses   = {}
+    metadata = {}
+  })
+}

package/dist/infra-templates/modules/azure-monitor/outputs.tf

@@ -0,0 +1,17 @@
+output "log_analytics_workspace_id" {
+  value = azurerm_log_analytics_workspace.this.id
+}
+
+output "instrumentation_key" {
+  value     = azurerm_application_insights.this.instrumentation_key
+  sensitive = true
+}
+
+output "connection_string" {
+  value     = azurerm_application_insights.this.connection_string
+  sensitive = true
+}
+
+output "app_insights_id" {
+  value = azurerm_application_insights.this.id
+}

package/dist/infra-templates/modules/azure-monitor/variables.tf

@@ -0,0 +1,32 @@
+variable "project_name" {
+  type        = string
+  description = "Project name, used to derive resource names"
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group where the monitoring resources are created"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+}
+
+variable "daily_data_cap_gb" {
+  type        = number
+  description = "Daily data ingestion cap in GB for Application Insights"
+  default     = 1
+}
+
+variable "retention_days" {
+  type        = number
+  description = "Data retention in days"
+  default     = 90
+}
+
+variable "dashboard_count" {
+  type        = number
+  description = "Number of portal dashboards to create"
+  default     = 0
+}

package/dist/infra-templates/modules/azure-network/main.tf

@@ -0,0 +1,134 @@
+# Keeps every database/cache reachable only from inside this VNet. Container Apps
+# ingress stays public (Front Door needs a public origin) — this only closes off
+# the data-plane services that have no reason to be reachable from the internet.
+resource "azurerm_virtual_network" "this" {
+  name                = "${var.project_name}-vnet"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  address_space       = var.address_space
+}
+
+resource "azurerm_subnet" "container_apps_infra" {
+  name                 = "${var.project_name}-cae-subnet"
+  resource_group_name  = var.resource_group_name
+  virtual_network_name = azurerm_virtual_network.this.name
+  address_prefixes     = var.container_apps_subnet_prefix
+
+  delegation {
+    name = "container-apps-environment"
+    service_delegation {
+      name    = "Microsoft.App/environments"
+      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
+    }
+  }
+}
+
+# A subnet has no reliable outbound internet path of its own once placed in a custom
+# VNet — Azure's "default outbound access" is being retired for newly created resources.
+# Without this, every Container App revision hangs pulling its image (any image, from
+# any registry) until the platform gives up ("Operation expired"). This is Microsoft's
+# own recommended pattern for Container Apps in a BYO VNet.
+resource "azurerm_public_ip" "container_apps_nat" {
+  name                = "${var.project_name}-cae-nat-ip"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  allocation_method   = "Static"
+  sku                 = "Standard"
+}
+
+resource "azurerm_nat_gateway" "container_apps" {
+  name                = "${var.project_name}-cae-nat"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  sku_name            = "Standard"
+}
+
+resource "azurerm_nat_gateway_public_ip_association" "container_apps" {
+  nat_gateway_id       = azurerm_nat_gateway.container_apps.id
+  public_ip_address_id = azurerm_public_ip.container_apps_nat.id
+}
+
+resource "azurerm_subnet_nat_gateway_association" "container_apps" {
+  subnet_id      = azurerm_subnet.container_apps_infra.id
+  nat_gateway_id = azurerm_nat_gateway.container_apps.id
+}
+
+# Postgres Flexible Server's private-access model is VNet integration (delegated_subnet_id
+# + private_dns_zone_id directly on the server resource) rather than a standard Private
+# Endpoint — it needs its own subnet delegated specifically to the Postgres RP.
+resource "azurerm_subnet" "postgres" {
+  count = var.postgres_needed ? 1 : 0
+
+  name                 = "${var.project_name}-postgres-subnet"
+  resource_group_name  = var.resource_group_name
+  virtual_network_name = azurerm_virtual_network.this.name
+  address_prefixes     = var.postgres_subnet_prefix
+
+  delegation {
+    name = "postgres-flexible-server"
+    service_delegation {
+      name    = "Microsoft.DBforPostgreSQL/flexibleServers"
+      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
+    }
+  }
+}
+
+# Azure SQL and Azure Managed Redis use standard Private Link — a plain (non-delegated)
+# subnet with network policies disabled, shared across both.
+resource "azurerm_subnet" "private_endpoints" {
+  count = (var.mssql_needed || var.redis_needed) ? 1 : 0
+
+  name                              = "${var.project_name}-pe-subnet"
+  resource_group_name               = var.resource_group_name
+  virtual_network_name              = azurerm_virtual_network.this.name
+  address_prefixes                  = var.private_endpoints_subnet_prefix
+  private_endpoint_network_policies = "Disabled"
+}
+
+resource "azurerm_private_dns_zone" "postgres" {
+  count = var.postgres_needed ? 1 : 0
+
+  name                = "privatelink.postgres.database.azure.com"
+  resource_group_name = var.resource_group_name
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "postgres" {
+  count = var.postgres_needed ? 1 : 0
+
+  name                  = "${var.project_name}-postgres-link"
+  resource_group_name   = var.resource_group_name
+  private_dns_zone_name = azurerm_private_dns_zone.postgres[0].name
+  virtual_network_id    = azurerm_virtual_network.this.id
+}
+
+resource "azurerm_private_dns_zone" "mssql" {
+  count = var.mssql_needed ? 1 : 0
+
+  name                = "privatelink.database.windows.net"
+  resource_group_name = var.resource_group_name
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "mssql" {
+  count = var.mssql_needed ? 1 : 0
+
+  name                  = "${var.project_name}-mssql-link"
+  resource_group_name   = var.resource_group_name
+  private_dns_zone_name = azurerm_private_dns_zone.mssql[0].name
+  virtual_network_id    = azurerm_virtual_network.this.id
+}
+
+resource "azurerm_private_dns_zone" "redis" {
+  count = var.redis_needed ? 1 : 0
+
+  name                = "privatelink.redis.azure.net"
+  resource_group_name = var.resource_group_name
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "redis" {
+  count = var.redis_needed ? 1 : 0
+
+  name                  = "${var.project_name}-redis-link"
+  resource_group_name   = var.resource_group_name
+  private_dns_zone_name = azurerm_private_dns_zone.redis[0].name
+  virtual_network_id    = azurerm_virtual_network.this.id
+}

package/dist/infra-templates/modules/azure-network/outputs.tf

@@ -0,0 +1,44 @@
+output "vnet_id" {
+  value = azurerm_virtual_network.this.id
+}
+
+output "container_apps_subnet_id" {
+  value = azurerm_subnet.container_apps_infra.id
+}
+
+# Static outbound IP for the Container Apps environment — useful for allowlisting this
+# project's apps against third-party APIs/firewalls that require a fixed source IP.
+output "container_apps_outbound_ip" {
+  value = azurerm_public_ip.container_apps_nat.ip_address
+}
+
+output "postgres_subnet_id" {
+  value = try(azurerm_subnet.postgres[0].id, null)
+}
+
+output "private_endpoints_subnet_id" {
+  value = try(azurerm_subnet.private_endpoints[0].id, null)
+}
+
+output "postgres_dns_zone_id" {
+  value = try(azurerm_private_dns_zone.postgres[0].id, null)
+}
+
+output "mssql_dns_zone_id" {
+  value = try(azurerm_private_dns_zone.mssql[0].id, null)
+}
+
+output "redis_dns_zone_id" {
+  value = try(azurerm_private_dns_zone.redis[0].id, null)
+}
+
+# So callers can `depends_on = [module.network]` and be sure the VNet links (not just the
+# zones) exist before creating a resource that needs private DNS resolution to work.
+# Only includes links for zones actually created (postgres_needed/mssql_needed/redis_needed).
+output "ready" {
+  value = compact([
+    try(azurerm_private_dns_zone_virtual_network_link.postgres[0].id, null),
+    try(azurerm_private_dns_zone_virtual_network_link.mssql[0].id, null),
+    try(azurerm_private_dns_zone_virtual_network_link.redis[0].id, null),
+  ])
+}

package/dist/infra-templates/modules/azure-network/variables.tf

@@ -0,0 +1,56 @@
+variable "project_name" {
+  type        = string
+  description = "Used as a naming prefix for the VNet, subnets, and private DNS zones"
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group where networking resources are created"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+}
+
+variable "address_space" {
+  type        = list(string)
+  description = "VNet address space"
+  default     = ["10.20.0.0/16"]
+}
+
+variable "container_apps_subnet_prefix" {
+  type        = list(string)
+  description = "Subnet for the Container Apps environment's infrastructure. /23 minimum (Consumption-only environments require /23; a /27 workload-profile environment would fit too)."
+  default     = ["10.20.0.0/23"]
+}
+
+variable "postgres_subnet_prefix" {
+  type        = list(string)
+  description = "Subnet delegated to Microsoft.DBforPostgreSQL/flexibleServers. Shared by every Postgres flexible server in this project (Azure minimum is /28; sized larger for headroom)."
+  default     = ["10.20.2.0/26"]
+}
+
+variable "private_endpoints_subnet_prefix" {
+  type        = list(string)
+  description = "Subnet for standard Private Link endpoints (Azure SQL, Azure Managed Redis)."
+  default     = ["10.20.3.0/26"]
+}
+
+variable "postgres_needed" {
+  type        = bool
+  description = "Whether any app in this project uses the Postgres engine. Skips the delegated subnet + private DNS zone when false."
+  default     = true
+}
+
+variable "mssql_needed" {
+  type        = bool
+  description = "Whether any app in this project uses the mssql engine. Skips its private DNS zone when false."
+  default     = true
+}
+
+variable "redis_needed" {
+  type        = bool
+  description = "Whether any app in this project has Redis enabled. Skips its private DNS zone when false."
+  default     = true
+}

package/dist/infra-templates/modules/azure-postgresql-flexible/main.tf

@@ -0,0 +1,34 @@
+resource "random_password" "this" {
+  length           = 24
+  special          = true
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+locals {
+  effective_password = var.admin_password != "" ? var.admin_password : random_password.this.result
+}
+
+resource "azurerm_postgresql_flexible_server" "this" {
+  name                   = var.server_name
+  resource_group_name    = var.resource_group_name
+  location               = var.location
+  administrator_login    = var.admin_username
+  administrator_password = local.effective_password
+  sku_name               = var.sku_name
+  storage_mb             = var.storage_mb
+  version                = "16"
+  # zone intentionally not specified — let Azure choose.
+
+  # VNet-integrated instead of public: reachable only from the delegated subnet's VNet
+  # (the Container Apps environment lives there too), no public endpoint at all.
+  delegated_subnet_id           = var.delegated_subnet_id
+  private_dns_zone_id           = var.private_dns_zone_id
+  public_network_access_enabled = false
+}
+
+resource "azurerm_postgresql_flexible_server_database" "this" {
+  server_id = azurerm_postgresql_flexible_server.this.id
+  name      = var.database_name
+  collation = "en_US.utf8"
+  charset   = "UTF8"
+}

package/dist/infra-templates/modules/azure-postgresql-flexible/outputs.tf

@@ -0,0 +1,20 @@
+output "fqdn" {
+  value       = azurerm_postgresql_flexible_server.this.fqdn
+  description = "Fully qualified domain name of the PostgreSQL Flexible Server"
+}
+
+output "database_name" {
+  value       = azurerm_postgresql_flexible_server_database.this.name
+  description = "Name of the PostgreSQL database"
+}
+
+output "admin_username" {
+  value       = var.admin_username
+  description = "Administrator username for the PostgreSQL Flexible Server"
+}
+
+output "admin_password" {
+  value       = local.effective_password
+  sensitive   = true
+  description = "Effective administrator password for the PostgreSQL Flexible Server"
+}

package/dist/infra-templates/modules/azure-postgresql-flexible/variables.tf

@@ -0,0 +1,54 @@
+variable "server_name" {
+  description = "Name of the PostgreSQL Flexible Server. Must be globally unique."
+  type        = string
+}
+
+variable "database_name" {
+  description = "Name of the PostgreSQL database"
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "Name of the resource group where the server will be created"
+  type        = string
+}
+
+variable "location" {
+  description = "Azure region where the server will be created"
+  type        = string
+}
+
+variable "admin_username" {
+  description = "Administrator login for the PostgreSQL Flexible Server"
+  type        = string
+  default     = "pgadmin"
+}
+
+variable "admin_password" {
+  description = "Administrator password for the PostgreSQL Flexible Server. Leave empty to auto-generate."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "sku_name" {
+  description = "SKU name for the PostgreSQL Flexible Server"
+  type        = string
+  default     = "GP_Standard_D4s_v3"
+}
+
+variable "storage_mb" {
+  description = "Max storage allowed for the PostgreSQL Flexible Server, in MB"
+  type        = number
+  default     = 32768
+}
+
+variable "delegated_subnet_id" {
+  description = "Subnet delegated to Microsoft.DBforPostgreSQL/flexibleServers. Postgres Flexible Server's private-access model wires this directly on the server, not via a separate private endpoint."
+  type        = string
+}
+
+variable "private_dns_zone_id" {
+  description = "Private DNS zone (privatelink.postgres.database.azure.com) linked to the same VNet as delegated_subnet_id."
+  type        = string
+}

package/dist/infra-templates/modules/azure-redis-cache/main.tf

@@ -0,0 +1,32 @@
+resource "azurerm_managed_redis" "this" {
+  name                  = var.name
+  resource_group_name   = var.resource_group_name
+  location              = var.location
+  sku_name              = var.sku_name
+  public_network_access = "Disabled"
+
+  default_database {
+    client_protocol   = "Encrypted"
+    clustering_policy = "EnterpriseCluster"
+    eviction_policy   = "VolatileLRU"
+  }
+}
+
+resource "azurerm_private_endpoint" "this" {
+  name                = "${var.name}-pe"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  subnet_id           = var.private_endpoint_subnet_id
+
+  private_service_connection {
+    name                           = "${var.name}-psc"
+    private_connection_resource_id = azurerm_managed_redis.this.id
+    subresource_names              = ["redisEnterprise"]
+    is_manual_connection           = false
+  }
+
+  private_dns_zone_group {
+    name                 = "default"
+    private_dns_zone_ids = [var.private_dns_zone_id]
+  }
+}

package/dist/infra-templates/modules/azure-redis-cache/outputs.tf

@@ -0,0 +1,15 @@
+output "hostname" {
+  value       = azurerm_managed_redis.this.hostname
+  description = "Hostname of the Azure Managed Redis instance"
+}
+
+output "ssl_port" {
+  value       = azurerm_managed_redis.this.default_database[0].port
+  description = "TLS port of the Azure Managed Redis instance"
+}
+
+output "primary_access_key" {
+  value       = azurerm_managed_redis.this.default_database[0].primary_access_key
+  sensitive   = true
+  description = "Primary access key for the Azure Managed Redis default database"
+}

package/dist/infra-templates/modules/azure-redis-cache/variables.tf

@@ -0,0 +1,30 @@
+variable "name" {
+  description = "Name of the Redis Enterprise cluster"
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "Name of the resource group where the Redis Enterprise cluster will be created"
+  type        = string
+}
+
+variable "location" {
+  description = "Azure region where the Redis Enterprise cluster will be created"
+  type        = string
+}
+
+variable "sku_name" {
+  description = "SKU name for the Redis Enterprise cluster (Azure Managed Redis 'Balanced' tier, e.g. Balanced_B0, Balanced_B1, Balanced_B5)"
+  type        = string
+  default     = "Balanced_B0"
+}
+
+variable "private_endpoint_subnet_id" {
+  description = "Subnet for the Private Link endpoint (non-delegated, network policies disabled)"
+  type        = string
+}
+
+variable "private_dns_zone_id" {
+  description = "Private DNS zone (privatelink.redis.azure.net) linked to the same VNet as private_endpoint_subnet_id"
+  type        = string
+}

package/dist/infra-templates/modules/azure-resource-group/main.tf

@@ -0,0 +1,5 @@
+resource "azurerm_resource_group" "this" {
+  name     = var.name
+  location = var.location
+  tags     = var.tags
+}

package/dist/infra-templates/modules/azure-resource-group/outputs.tf

@@ -0,0 +1,11 @@
+output "name" {
+  value = azurerm_resource_group.this.name
+}
+
+output "id" {
+  value = azurerm_resource_group.this.id
+}
+
+output "location" {
+  value = azurerm_resource_group.this.location
+}

package/dist/infra-templates/modules/azure-resource-group/variables.tf

@@ -0,0 +1,16 @@
+variable "name" {
+  type        = string
+  description = "Resource group name"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+  default     = "eastus"
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Tags applied to the resource group"
+  default     = {}
+}

package/dist/infra-templates/modules/azure-sql-database/main.tf

@@ -0,0 +1,63 @@
+resource "random_password" "this" {
+  length           = 24
+  special          = true
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+locals {
+  effective_password = var.admin_password != "" ? var.admin_password : random_password.this.result
+}
+
+resource "azurerm_mssql_server" "this" {
+  name                         = var.server_name
+  resource_group_name          = var.resource_group_name
+  location                     = var.location
+  administrator_login          = var.admin_username
+  administrator_login_password = local.effective_password
+  version                      = "12.0"
+  minimum_tls_version          = "1.2"
+
+  public_network_access_enabled = false
+}
+
+resource "azurerm_private_endpoint" "this" {
+  name                = "${var.server_name}-pe"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  subnet_id           = var.private_endpoint_subnet_id
+
+  private_service_connection {
+    name                           = "${var.server_name}-psc"
+    private_connection_resource_id = azurerm_mssql_server.this.id
+    subresource_names              = ["sqlServer"]
+    is_manual_connection           = false
+  }
+
+  private_dns_zone_group {
+    name                 = "default"
+    private_dns_zone_ids = [var.private_dns_zone_id]
+  }
+}
+
+resource "azurerm_mssql_database" "this" {
+  name                        = var.database_name
+  server_id                   = azurerm_mssql_server.this.id
+  sku_name                    = var.sku_name
+  min_capacity                = var.min_capacity
+  auto_pause_delay_in_minutes = var.auto_pause_delay_in_minutes
+  storage_account_type        = var.storage_account_type
+
+  short_term_retention_policy {
+    retention_days = var.pitr_retention_days
+  }
+
+  # Azure rejects long-term retention on a serverless database while auto-pause is
+  # enabled (LtrConfigPolicyUnsupportedIfAutoPauseEnabled) — only apply LTR once
+  # auto-pause is explicitly disabled (-1), e.g. for provisioned prod databases.
+  dynamic "long_term_retention_policy" {
+    for_each = var.auto_pause_delay_in_minutes == -1 ? [1] : []
+    content {
+      weekly_retention = var.ltr_weekly_retention
+    }
+  }
+}

package/dist/infra-templates/modules/azure-sql-database/outputs.tf

@@ -0,0 +1,20 @@
+output "fqdn" {
+  value       = azurerm_mssql_server.this.fully_qualified_domain_name
+  description = "Fully qualified domain name of the SQL Server"
+}
+
+output "database_name" {
+  value       = azurerm_mssql_database.this.name
+  description = "Name of the SQL database"
+}
+
+output "admin_username" {
+  value       = var.admin_username
+  description = "Administrator username for the SQL Server"
+}
+
+output "admin_password" {
+  value       = local.effective_password
+  sensitive   = true
+  description = "Effective administrator password for the SQL Server"
+}