Repository navigation
Conversation
Provision durable Azure resources with Terraform and serialize maintenance releases around the separate setup job. Document protected state, ownership, recovery, and teardown without changing the devcontainer. Co-authored-by: Ben Thomas <25218250+alliscode@users.noreply.github.com> Co-authored-by: Nishiki <1121087+nshki@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Operators need an Azure installation of the rewrite with durable data and setup before rollout. This is the third layer of #171; application code remains independent of Terraform and Azure deployment.
What changes
Terraform under
infrastructure/azure/provisions Container Apps, private PostgreSQL, authenticated Blob storage, managed identity, logging, and a manual setup job. Operators supply an existing image digest and a separate protected state backend.One release script holds a deployment lock, stops old replicas, runs setup, then starts the same digest. This deliberately uses a maintenance window, not zero-downtime rollout or scale-out. The guide covers ownership, secrets, domains, recovery, and guarded teardown.
Real Azure provisioning, identity access, revision behavior, custom TLS, restore, and teardown remain unverified. This layer stays draft until an authorized tenant exercise supplies that evidence; credential-free checks do not replace it.
Created from a Slack conversation with @alliscode.