specweave 0.21.1 → 0.21.3

package/plugins/specweave/iac-templates/azure-functions/README.md.hbs

@@ -0,0 +1,315 @@
+# {{projectName}} - Azure Functions Infrastructure
+
+🚀 Generated by **SpecWeave Serverless Intelligence**
+
+## Overview
+
+This Terraform configuration deploys a serverless application on Azure Functions with the following components:
+
+- **Function App**: `{{functionName}}` ({{#if runtime}}{{runtime}}{{else}}Node.js{{/if}})
+- **Managed Identity**: No hardcoded credentials{{#if databaseName}}
+- **Cosmos DB**: NoSQL database with geo-replication{{/if}}
+- **Storage Account**: HTTPS-only with blob versioning
+- **Application Insights**: Real-time monitoring and analytics
+- **Service Plan**: {{#if (eq environment "prod")}}Premium (EP1){{else if (eq environment "staging")}}Basic (B1){{else}}Consumption (Y1){{/if}}
+
+## Architecture
+
+```
+{{#if databaseName}}
+Internet → Function App (HTTPS) → Cosmos DB
+                ↓
+         Application Insights
+{{else}}
+Internet → Function App (HTTPS)
+                ↓
+         Application Insights
+{{/if}}
+```
+
+## Prerequisites
+
+1. **Azure Account** with active subscription
+2. **Azure CLI** installed and logged in
+3. **Terraform** >= 1.0 installed
+4. **Function deployment package** ready
+
+## Quick Start
+
+### 1. Login to Azure
+
+```bash
+az login
+az account set --subscription "YOUR_SUBSCRIPTION_ID"
+```
+
+### 2. Initialize Terraform
+
+```bash
+terraform init
+```
+
+### 3. Review Plan
+
+```bash
+terraform plan
+```
+
+### 4. Deploy
+
+```bash
+terraform apply
+```
+
+### 5. Deploy Function Code
+
+```bash
+# Get Function App name
+FUNCTION_APP=$(terraform output -raw function_app_name)
+
+# Deploy using Azure CLI
+az functionapp deployment source config-zip \
+  -g $(terraform output -raw resource_group_name) \
+  -n $FUNCTION_APP \
+  --src {{functionName}}.zip
+```
+
+### 6. Test Deployment
+
+```bash
+# Get Function URL
+FUNCTION_URL=$(terraform output -raw function_app_url)
+
+# Test function
+curl $FUNCTION_URL/api/your-function-name
+```
+
+## Configuration
+
+### Variables
+
+Edit `terraform.tfvars` to customize:
+
+```hcl
+project_name       = "{{projectName}}"
+environment        = "{{environment}}"
+function_name      = "{{functionName}}"
+location           = "{{#if location}}{{location}}{{else}}eastus{{/if}}"
+runtime            = "{{#if runtime}}{{runtime}}{{else}}node{{/if}}"
+{{#if databaseName}}
+database_name      = "{{databaseName}}"
+{{/if}}
+```
+
+### Environment Variables
+
+The Function App has these environment variables:
+
+- `ENVIRONMENT`: `{{environment}}`{{#if databaseName}}
+- `COSMOSDB_ENDPOINT`: Cosmos DB endpoint
+- `COSMOSDB_DATABASE`: Database name{{/if}}
+- `FUNCTIONS_WORKER_RUNTIME`: `{{#if runtime}}{{runtime}}{{else}}node{{/if}}`
+
+## Outputs
+
+After deployment, Terraform provides these outputs:
+
+- `function_app_name`: Function App name
+- `function_app_url`: HTTPS endpoint
+- `function_identity_principal_id`: Managed identity for IAM{{#if databaseName}}
+- `cosmosdb_endpoint`: Cosmos DB endpoint{{/if}}
+
+## Resource Details
+
+### Function App
+
+- **Runtime**: {{#if runtime}}{{runtime}}{{else}}Node.js{{/if}}
+- **Plan**: {{#if (eq environment "prod")}}Premium EP1 (always-on, VNet integration){{else if (eq environment "staging")}}Basic B1 (cost-effective){{else}}Consumption Y1 (pay-per-execution){{/if}}
+- **HTTPS Only**: Enforced
+- **Managed Identity**: System-assigned (no credentials in code)
+- **CORS**: {{#if (eq environment "prod")}}Restricted to production domain{{else}}Allow all origins (dev/staging){{/if}}
+
+{{#if databaseName}}
+### Cosmos DB
+
+- **Name**: `{{databaseName}}-{{environment}}`
+- **API**: SQL (Core)
+- **Consistency**: {{#if (eq environment "prod")}}Session{{else}}Eventual{{/if}}
+- **Geo-Replication**: {{#if (eq environment "prod")}}Multi-region (primary + secondary){{else}}Single region{{/if}}
+- **Backup**: {{#if (eq environment "prod")}}Continuous (point-in-time restore){{else}}Periodic (every 4 hours){{/if}}
+- **Throughput**: {{#if (eq environment "prod")}}Provisioned (400 RU/s){{else}}Serverless (pay-per-request){{/if}}
+
+**Cost Optimization**: Serverless mode is ideal for dev/staging with variable workloads.
+{{/if}}
+
+### Storage Account
+
+- **Replication**: {{#if (eq environment "prod")}}GRS (geo-redundant){{else}}LRS (locally redundant){{/if}}
+- **HTTPS Only**: Enforced
+- **Blob Versioning**: {{#if (eq environment "prod")}}Enabled{{else}}Disabled{{/if}}
+- **Soft Delete**: {{#if (eq environment "prod")}}30 days{{else}}7 days{{/if}}
+
+## Security Best Practices
+
+✅ **Implemented**:
+- Managed Identity (no hardcoded credentials)
+- HTTPS-only enforcement
+- TLS 1.2 minimum
+- Blob versioning and soft delete{{#if (eq environment "prod")}}
+- Geo-redundant storage
+- Continuous backup for Cosmos DB{{/if}}
+
+⚠️ **TODO**:
+- Add Azure Key Vault for secrets management
+- Enable VNet integration for private networking
+- Implement Azure Front Door for global load balancing
+- Add Azure AD authentication
+- Enable Defender for Cloud security monitoring
+
+## Cost Estimation
+
+### Free Tier (First 12 Months)
+
+Azure offers a generous free tier:
+- **Functions**: 1M executions/month (Consumption plan)
+- **Cosmos DB**: 1000 RU/s + 25 GB storage (first 30 days)
+- **Storage**: 5 GB LRS blob storage
+- **Application Insights**: 5 GB data ingestion/month
+
+### Estimated Monthly Cost (After Free Tier)
+
+**Development (Consumption Plan)**:
+- Function App (Y1): $0.00 + $0.20/million executions
+- Storage (LRS): ~$0.10{{#if databaseName}}
+- Cosmos DB (Serverless): ~$0.25/million requests{{/if}}
+- Application Insights: ~$2.00
+- **Total**: ~$2.50/month (10K requests)
+
+**Staging (Basic Plan)**:
+- Function App (B1): ~$13.00/month
+- Storage (LRS): ~$0.10{{#if databaseName}}
+- Cosmos DB (400 RU/s): ~$24.00/month{{/if}}
+- Application Insights: ~$5.00
+- **Total**: ~{{#if databaseName}}$42{{else}}$18{{/if}}/month
+
+**Production (Premium Plan)**:
+- Function App (EP1): ~$150/month
+- Storage (GRS): ~$0.50{{#if databaseName}}
+- Cosmos DB (400 RU/s + geo-replication): ~$48.00/month{{/if}}
+- Application Insights: ~$10.00
+- **Total**: ~{{#if databaseName}}$208{{else}}$160{{/if}}/month
+
+💡 **Tip**: Use Azure Cost Management and set up budget alerts.
+
+## Monitoring
+
+### Application Insights Metrics
+
+- **Request Rate**: Incoming requests per second
+- **Response Time**: P50, P95, P99 latency
+- **Failure Rate**: HTTP 4xx/5xx errors
+- **Dependency Calls**: {{#if databaseName}}Cosmos DB{{/if}} calls and performance
+- **Exceptions**: Unhandled exceptions with stack traces
+
+### Log Analytics
+
+- Function logs: Available in Application Insights
+- Live Metrics Stream: Real-time performance monitoring
+- Transaction Search: Detailed request tracing
+
+### Recommended Alerts
+
+```hcl
+# Add to your Terraform:
+resource "azurerm_monitor_metric_alert" "function_errors" {
+  name                = "{{functionName}}-errors"
+  resource_group_name = azurerm_resource_group.{{snakeCase projectName}}.name
+  scopes              = [azurerm_linux_function_app.{{snakeCase functionName}}.id]
+  description         = "Alert when function error rate exceeds threshold"
+  severity            = 2
+
+  criteria {
+    metric_namespace = "Microsoft.Web/sites"
+    metric_name      = "Http5xx"
+    aggregation      = "Total"
+    operator         = "GreaterThan"
+    threshold        = 5
+  }
+
+  action {
+    action_group_id = azurerm_monitor_action_group.alerts.id
+  }
+}
+```
+
+## Deployment Workflow
+
+### Development
+
+```bash
+terraform workspace new dev
+terraform workspace select dev
+terraform apply -var="environment=dev"
+```
+
+### Staging
+
+```bash
+terraform workspace new staging
+terraform workspace select staging
+terraform apply -var="environment=staging"
+```
+
+### Production
+
+```bash
+terraform workspace new prod
+terraform workspace select prod
+terraform apply -var="environment=prod"
+```
+
+## Cleanup
+
+To destroy all resources:
+
+```bash
+terraform destroy
+```
+
+⚠️ **Warning**: This will permanently delete all data in Cosmos DB!
+
+## Troubleshooting
+
+**Function not starting?**
+1. Check Application Insights for errors
+2. Verify storage account connection
+3. Review function app settings
+
+**Cosmos DB connection issues?**
+1. Verify managed identity role assignment
+2. Check firewall rules
+3. Review connection strings
+
+**Deployment failures?**
+1. Ensure Azure CLI is authenticated
+2. Verify subscription permissions
+3. Check resource name uniqueness
+
+## Next Steps
+
+1. **Add Authentication**: Implement Azure AD or Easy Auth
+2. **Enable VNet**: Secure networking with Virtual Network integration
+3. **Add Key Vault**: Manage secrets securely
+4. **Implement CI/CD**: Use Azure DevOps or GitHub Actions
+5. **Add Custom Domain**: Configure custom domain with SSL
+
+## Resources
+
+- [Azure Functions Documentation](https://docs.microsoft.com/azure/azure-functions/)
+- [Cosmos DB Documentation](https://docs.microsoft.com/azure/cosmos-db/)
+- [Application Insights Documentation](https://docs.microsoft.com/azure/azure-monitor/app/app-insights-overview)
+- [Terraform AzureRM Provider](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs)
+
+---
+
+**Generated by SpecWeave** | [Learn More](https://spec-weave.com)

package/plugins/specweave/iac-templates/azure-functions/defaults.json

@@ -0,0 +1,65 @@
+{
+  "platform": "azure-functions",
+  "location": "eastus",
+  "secondaryLocation": "westus",
+  "runtime": "node",
+  "nodeVersion": "18",
+  "pythonVersion": "3.11",
+  "dotnetVersion": "7.0",
+  "planSku": {
+    "dev": "Y1",
+    "staging": "B1",
+    "prod": "EP1"
+  },
+  "storage": {
+    "replication": {
+      "dev": "LRS",
+      "staging": "LRS",
+      "prod": "GRS"
+    },
+    "versioning": {
+      "dev": false,
+      "staging": false,
+      "prod": true
+    },
+    "softDeleteDays": {
+      "dev": 7,
+      "staging": 7,
+      "prod": 30
+    }
+  },
+  "cosmosDb": {
+    "consistencyLevel": {
+      "dev": "Eventual",
+      "staging": "Session",
+      "prod": "Session"
+    },
+    "backupType": {
+      "dev": "Periodic",
+      "staging": "Periodic",
+      "prod": "Continuous"
+    },
+    "throughput": {
+      "dev": "serverless",
+      "staging": 400,
+      "prod": 400
+    },
+    "geoReplication": {
+      "dev": false,
+      "staging": false,
+      "prod": true
+    }
+  },
+  "monitoring": {
+    "retentionDays": {
+      "dev": 30,
+      "staging": 60,
+      "prod": 90
+    }
+  },
+  "security": {
+    "httpsOnly": true,
+    "minTlsVersion": "TLS1_2",
+    "managedIdentity": true
+  }
+}

package/plugins/specweave/iac-templates/azure-functions/environments/dev.defaults.json

@@ -0,0 +1,30 @@
+{
+  "environment": "dev",
+  "location": "eastus",
+  "planSku": "Y1",
+  "alwaysOn": false,
+  "storage": {
+    "replication": "LRS",
+    "versioning": false,
+    "softDeleteDays": 7
+  },
+  "cosmosDb": {
+    "mode": "serverless",
+    "consistencyLevel": "Eventual",
+    "backupType": "Periodic",
+    "backupIntervalMinutes": 240,
+    "backupRetentionHours": 8,
+    "geoReplication": false
+  },
+  "monitoring": {
+    "retentionDays": 30
+  },
+  "cors": {
+    "allowedOrigins": ["*"]
+  },
+  "costOptimization": {
+    "description": "Free tier optimized - Consumption plan + Serverless Cosmos DB",
+    "estimatedMonthlyCost": "$2-5",
+    "freeTierEligible": true
+  }
+}

package/plugins/specweave/iac-templates/azure-functions/environments/prod.defaults.json

@@ -0,0 +1,34 @@
+{
+  "environment": "prod",
+  "location": "eastus",
+  "secondaryLocation": "westus",
+  "planSku": "EP1",
+  "alwaysOn": true,
+  "storage": {
+    "replication": "GRS",
+    "versioning": true,
+    "softDeleteDays": 30
+  },
+  "cosmosDb": {
+    "mode": "provisioned",
+    "throughput": 400,
+    "consistencyLevel": "Session",
+    "backupType": "Continuous",
+    "geoReplication": true
+  },
+  "monitoring": {
+    "retentionDays": 90
+  },
+  "cors": {
+    "allowedOrigins": ["https://*.example.com"]
+  },
+  "security": {
+    "preventResourceGroupDeletion": true,
+    "enableAdvancedThreatProtection": true
+  },
+  "costOptimization": {
+    "description": "Production-ready - Premium plan + Geo-replicated Cosmos DB",
+    "estimatedMonthlyCost": "$200-250",
+    "freeTierEligible": false
+  }
+}

package/plugins/specweave/iac-templates/azure-functions/environments/staging.defaults.json

@@ -0,0 +1,31 @@
+{
+  "environment": "staging",
+  "location": "eastus",
+  "planSku": "B1",
+  "alwaysOn": false,
+  "storage": {
+    "replication": "LRS",
+    "versioning": false,
+    "softDeleteDays": 7
+  },
+  "cosmosDb": {
+    "mode": "provisioned",
+    "throughput": 400,
+    "consistencyLevel": "Session",
+    "backupType": "Periodic",
+    "backupIntervalMinutes": 240,
+    "backupRetentionHours": 8,
+    "geoReplication": false
+  },
+  "monitoring": {
+    "retentionDays": 60
+  },
+  "cors": {
+    "allowedOrigins": ["*"]
+  },
+  "costOptimization": {
+    "description": "Cost-effective for testing - Basic plan + Provisioned Cosmos DB",
+    "estimatedMonthlyCost": "$40-50",
+    "freeTierEligible": false
+  }
+}

package/plugins/specweave/iac-templates/azure-functions/iam.tf.hbs

@@ -0,0 +1,34 @@
+# IAM Roles and Permissions for Azure Functions
+# Project: {{projectName}}
+
+{{#if databaseName}}
+###############################
+# Cosmos DB Access for Function App
+###############################
+
+# Grant Function App managed identity access to Cosmos DB
+resource "azurerm_cosmosdb_sql_role_assignment" "{{snakeCase functionName}}" {
+  resource_group_name = azurerm_resource_group.{{snakeCase projectName}}.name
+  account_name        = azurerm_cosmosdb_account.{{snakeCase databaseName}}.name
+  role_definition_id  = "${azurerm_cosmosdb_account.{{snakeCase databaseName}}.id}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002"
+  principal_id        = azurerm_linux_function_app.{{snakeCase functionName}}.identity[0].principal_id
+  scope               = azurerm_cosmosdb_account.{{snakeCase databaseName}}.id
+}
+{{/if}}
+
+###############################
+# Storage Account Access
+###############################
+
+# Function App already has built-in access via storage account key
+# For Key Vault secrets (future enhancement):
+# resource "azurerm_key_vault_access_policy" "function_app" {
+#   key_vault_id = azurerm_key_vault.main.id
+#   tenant_id    = data.azurerm_client_config.current.tenant_id
+#   object_id    = azurerm_linux_function_app.{{snakeCase functionName}}.identity[0].principal_id
+#
+#   secret_permissions = [
+#     "Get",
+#     "List"
+#   ]
+# }