Skip to content

Commit 4ea178b

Browse files
paulyukpaulyuk
committed
Updating appservice* config for @secure. Fixes #9
Signed-off-by: Paul Yuknewicz <[email protected]>
1 parent be33d10 commit 4ea178b

File tree

4 files changed

+163
-6
lines changed

4 files changed

+163
-6
lines changed

‎infra/core/host/appservice-appsettings.bicep

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
metadata description = 'Updates app settings for an Azure App Service.'
2+
@description('The name of the app service resource within the current resource group scope')
3+
param name string
4+
5+
@description('The app settings to be applied to the app service')
6+
@secure()
7+
param appSettings object
8+
9+
resource appService 'Microsoft.Web/sites@2022-03-01' existing = {
10+
name: name
11+
}
12+
13+
resource settings 'Microsoft.Web/sites/config@2022-03-01' = {
14+
name: 'appsettings'
15+
parent: appService
16+
properties: appSettings
17+
}

‎infra/core/host/appservice.bicep

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
metadata description = 'Creates an Azure App Service in an existing Azure App Service plan.'
2+
param name string
3+
param location string = resourceGroup().location
4+
param tags object = {}
5+
6+
// Reference Properties
7+
param applicationInsightsName string = ''
8+
param appServicePlanId string
9+
param keyVaultName string = ''
10+
param managedIdentity bool = !empty(keyVaultName)
11+
12+
// Runtime Properties
13+
@allowed([
14+
'dotnet', 'dotnetcore', 'dotnet-isolated', 'node', 'python', 'java', 'powershell', 'custom'
15+
])
16+
param runtimeName string
17+
param runtimeNameAndVersion string = '${runtimeName}|${runtimeVersion}'
18+
param runtimeVersion string
19+
20+
// Microsoft.Web/sites Properties
21+
param kind string = 'app,linux'
22+
23+
// Microsoft.Web/sites/config
24+
param allowedOrigins array = []
25+
param alwaysOn bool = true
26+
param appCommandLine string = ''
27+
@secure()
28+
param appSettings object = {}
29+
param clientAffinityEnabled bool = false
30+
param enableOryxBuild bool = contains(kind, 'linux')
31+
param functionAppScaleLimit int = -1
32+
param linuxFxVersion string = runtimeNameAndVersion
33+
param minimumElasticInstanceCount int = -1
34+
param numberOfWorkers int = -1
35+
param scmDoBuildDuringDeployment bool = false
36+
param use32BitWorkerProcess bool = false
37+
param ftpsState string = 'FtpsOnly'
38+
param healthCheckPath string = ''
39+
param virtualNetworkSubnetId string = ''
40+
41+
resource appService 'Microsoft.Web/sites@2022-03-01' = {
42+
name: name
43+
location: location
44+
tags: tags
45+
kind: kind
46+
properties: {
47+
serverFarmId: appServicePlanId
48+
siteConfig: {
49+
linuxFxVersion: linuxFxVersion
50+
alwaysOn: alwaysOn
51+
ftpsState: ftpsState
52+
minTlsVersion: '1.2'
53+
appCommandLine: appCommandLine
54+
numberOfWorkers: numberOfWorkers != -1 ? numberOfWorkers : null
55+
minimumElasticInstanceCount: minimumElasticInstanceCount != -1 ? minimumElasticInstanceCount : null
56+
use32BitWorkerProcess: use32BitWorkerProcess
57+
functionAppScaleLimit: functionAppScaleLimit != -1 ? functionAppScaleLimit : null
58+
healthCheckPath: healthCheckPath
59+
cors: {
60+
allowedOrigins: union([ 'https://portal.azure.com', 'https://ms.portal.azure.com' ], allowedOrigins)
61+
}
62+
}
63+
clientAffinityEnabled: clientAffinityEnabled
64+
httpsOnly: true
65+
virtualNetworkSubnetId: !empty(virtualNetworkSubnetId) ? virtualNetworkSubnetId : null
66+
}
67+
68+
identity: { type: managedIdentity ? 'SystemAssigned' : 'None' }
69+
70+
resource basicPublishingCredentialsPoliciesFtp 'basicPublishingCredentialsPolicies' = {
71+
name: 'ftp'
72+
properties: {
73+
allow: false
74+
}
75+
}
76+
77+
resource basicPublishingCredentialsPoliciesScm 'basicPublishingCredentialsPolicies' = {
78+
name: 'scm'
79+
properties: {
80+
allow: false
81+
}
82+
}
83+
}
84+
85+
// Updates to the single Microsoft.sites/web/config resources that need to be performed sequentially
86+
// sites/web/config 'appsettings'
87+
module configAppSettings 'appservice-appsettings.bicep' = {
88+
name: '${name}-appSettings'
89+
params: {
90+
name: appService.name
91+
appSettings: union(appSettings,
92+
{
93+
SCM_DO_BUILD_DURING_DEPLOYMENT: string(scmDoBuildDuringDeployment)
94+
ENABLE_ORYX_BUILD: string(enableOryxBuild)
95+
},
96+
runtimeName == 'python' && appCommandLine == '' ? { PYTHON_ENABLE_GUNICORN_MULTIWORKERS: 'true'} : {},
97+
!empty(applicationInsightsName) ? { APPLICATIONINSIGHTS_CONNECTION_STRING: applicationInsights.properties.ConnectionString } : {},
98+
!empty(keyVaultName) ? { AZURE_KEY_VAULT_ENDPOINT: keyVault.properties.vaultUri } : {})
99+
}
100+
}
101+
102+
// sites/web/config 'logs'
103+
resource configLogs 'Microsoft.Web/sites/config@2022-03-01' = {
104+
name: 'logs'
105+
parent: appService
106+
properties: {
107+
applicationLogs: { fileSystem: { level: 'Verbose' } }
108+
detailedErrorMessages: { enabled: true }
109+
failedRequestsTracing: { enabled: true }
110+
httpLogs: { fileSystem: { enabled: true, retentionInDays: 1, retentionInMb: 35 } }
111+
}
112+
dependsOn: [configAppSettings]
113+
}
114+
115+
resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = if (!(empty(keyVaultName))) {
116+
name: keyVaultName
117+
}
118+
119+
resource applicationInsights 'Microsoft.Insights/components@2020-02-02' existing = if (!empty(applicationInsightsName)) {
120+
name: applicationInsightsName
121+
}
122+
123+
output identityPrincipalId string = managedIdentity ? appService.identity.principalId : ''
124+
output name string = appService.name
125+
output uri string = 'https://${appService.properties.defaultHostName}'

‎infra/core/host/appserviceplan.bicep

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
metadata description = 'Creates an Azure App Service plan.'
12
param name string
23
param location string = resourceGroup().location
34
param tags object = {}
@@ -6,7 +7,7 @@ param kind string = ''
67
param reserved bool = true
78
param sku object
89

9-
resource appServicePlan 'Microsoft.Web/serverfarms@2023-12-01' = {
10+
resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' = {
1011
name: name
1112
location: location
1213
tags: tags
@@ -18,3 +19,4 @@ resource appServicePlan 'Microsoft.Web/serverfarms@2023-12-01' = {
1819
}
1920

2021
output id string = appServicePlan.id
22+
output name string = appServicePlan.name

‎infra/core/host/functions-flexconsumption.bicep

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ param virtualNetworkSubnetId string = ''
1111
param identityType string
1212
@description('User assigned identity name')
1313
param identityId string
14+
param keyVaultName string = ''
1415

1516
// Runtime Properties
1617
@allowed([
@@ -26,6 +27,7 @@ param appSettings object = {}
2627
param instanceMemoryMB int = 2048
2728
param maximumInstanceCount int = 100
2829
param deploymentStorageContainerName string
30+
param appCommandLine string = ''
2931

3032
resource stg 'Microsoft.Storage/storageAccounts@2022-09-01' existing = {
3133
name: storageAccountName
@@ -66,18 +68,29 @@ resource functions 'Microsoft.Web/sites@2023-12-01' = {
6668
}
6769
virtualNetworkSubnetId: !empty(virtualNetworkSubnetId) ? virtualNetworkSubnetId : null
6870
}
69-
70-
resource configAppSettings 'config' = {
71-
name: 'appsettings'
72-
properties: union(appSettings,
71+
}
72+
// Updates to the single Microsoft.sites/web/config resources that need to be performed sequentially
73+
// sites/web/config 'appsettings'
74+
module configAppSettings 'appservice-appsettings.bicep' = {
75+
name: '${name}-appSettings'
76+
params: {
77+
name: functions.name
78+
appSettings: union(appSettings,
7379
{
7480
AzureWebJobsStorage__accountName: stg.name
7581
AzureWebJobsStorage__credential : 'managedidentity'
7682
APPLICATIONINSIGHTS_CONNECTION_STRING: applicationInsights.properties.ConnectionString
77-
})
83+
},
84+
runtimeName == 'python' && appCommandLine == '' ? { PYTHON_ENABLE_GUNICORN_MULTIWORKERS: 'true'} : {},
85+
!empty(applicationInsightsName) ? { APPLICATIONINSIGHTS_CONNECTION_STRING: applicationInsights.properties.ConnectionString } : {},
86+
!empty(keyVaultName) ? { AZURE_KEY_VAULT_ENDPOINT: keyVault.properties.vaultUri } : {})
7887
}
7988
}
8089

90+
resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = if (!(empty(keyVaultName))) {
91+
name: keyVaultName
92+
}
93+
8194
resource applicationInsights 'Microsoft.Insights/components@2020-02-02' existing = if (!empty(applicationInsightsName)) {
8295
name: applicationInsightsName
8396
}

0 commit comments

Comments
 (0)