terraform-azure-website-factory/app-service.tf at main · code4romania/terraform-azure-website-factory · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
# Create App Service plan to define the capacity and resources to be shared among the app services that will be assigned to that plan
resource "azurerm_service_plan" "app_service_plan" {
  name                = local.app_service.name
  resource_group_name = azurerm_resource_group.resource_group.name
  location            = azurerm_resource_group.resource_group.location
  os_type             = "Linux"
  sku_name            = local.app_service.size

  tags = {
    app = var.project_slug
    env = var.env
  }

  depends_on = [
    azurerm_postgresql_flexible_server_database.db
  ]
}

resource "azurerm_linux_web_app" "app_service" {
  name                = local.app_service.name
  location            = azurerm_resource_group.resource_group.location
  resource_group_name = azurerm_resource_group.resource_group.name
  service_plan_id     = azurerm_service_plan.app_service_plan.id
  https_only          = true

  site_config {
    application_stack {
      docker_image_name   = "${local.app_service.docker_image}:${var.docker_tag}"
      docker_registry_url = "https://index.docker.io"
    }

    health_check_path                 = "/health"
    health_check_eviction_time_in_min = 2

    http2_enabled = true
  }

  app_settings = {
    "APP_URL"                 = "https://${local.hostname}"
    "APP_DEBUG"               = var.debug_mode
    "APP_ENV"                 = var.env
    "APP_KEY"                 = random_password.app_key.result
    "WEBSITE_FACTORY_EDITION" = var.edition
    "DB_CONNECTION"           = "pgsql"
    "DB_HOST"                 = azurerm_private_dns_zone.dns_zone.name
    "DB_PORT"                 = "5432"
    "DB_DATABASE"             = azurerm_postgresql_flexible_server_database.db.name
    "DB_USERNAME"             = local.db_config.admin_db_user
    "DB_PASSWORD"             = local.db_config.admin_db_password
    "FILESYSTEM_DRIVER"       = "azure"
    "FILESYSTEM_CLOUD"        = "azure"
    "AZURE_STORAGE_NAME"      = azurerm_storage_account.storage_account.name
    "AZURE_STORAGE_KEY"       = azurerm_storage_account.storage_account.primary_access_key
    "AZURE_STORAGE_CONTAINER" = azurerm_storage_container.storage_container.name
    "ADMIN_EMAIL"             = var.admin_email
    "ADMIN_PASSWORD"          = random_password.admin_password.result
    "SENTRY_DSN"              = var.sentry_dsn
    "SENTRY_ENVIRONMENT"      = coalesce(var.sentry_environment, var.project_slug)

    "MAIL_MAILER"       = local.mail.mailer
    "MAIL_FROM_ADDRESS" = local.mail.from
    # SMTP
    "MAIL_HOST"       = local.mail.smtp.host
    "MAIL_PORT"       = local.mail.smtp.port
    "MAIL_USERNAME"   = local.mail.smtp.username
    "MAIL_PASSWORD"   = local.mail.smtp.password
    "MAIL_ENCRYPTION" = local.mail.smtp.encryption

    # Azure Communication Services
    "AZURE_MAIL_RESOURCE_NAME" = local.mail.azure.resource_name
    "AZURE_MAIL_KEY"           = local.mail.azure.key
  }

  connection_string {
    name  = "website-factory-db-connection"
    type  = "PostgreSQL"
    value = azurerm_private_dns_zone.dns_zone.name
  }

  tags = {
    app = var.project_slug
    env = var.env
  }
}

# root domain certificate
resource "azurerm_app_service_custom_hostname_binding" "root_hostname_binding" {
  count               = var.hostname == null ? 0 : 1
  hostname            = var.hostname
  app_service_name    = azurerm_linux_web_app.app_service.name
  resource_group_name = azurerm_resource_group.resource_group.name
}

resource "azurerm_app_service_managed_certificate" "root_managed_certificate" {
  count                      = var.hostname == null ? 0 : 1
  custom_hostname_binding_id = azurerm_app_service_custom_hostname_binding.root_hostname_binding[count.index].id

  tags = {
    app = var.project_slug
    env = var.env
  }

  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

resource "azurerm_app_service_certificate_binding" "root_certificate_binding" {
  count               = var.hostname == null ? 0 : 1
  hostname_binding_id = azurerm_app_service_custom_hostname_binding.root_hostname_binding[count.index].id
  certificate_id      = azurerm_app_service_managed_certificate.root_managed_certificate[count.index].id
  ssl_state           = "SniEnabled"
}

# www subdomain certificate
resource "azurerm_app_service_custom_hostname_binding" "www_hostname_binding" {
  count               = var.hostname == null ? 0 : 1
  hostname            = "www.${var.hostname}"
  app_service_name    = azurerm_linux_web_app.app_service.name
  resource_group_name = azurerm_resource_group.resource_group.name
}

resource "azurerm_app_service_managed_certificate" "www_managed_certificate" {
  count                      = var.hostname == null ? 0 : 1
  custom_hostname_binding_id = azurerm_app_service_custom_hostname_binding.www_hostname_binding[count.index].id

  tags = {
    app = var.project_slug
    env = var.env
  }

  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

resource "azurerm_app_service_certificate_binding" "www_certificate_binding" {
  count               = var.hostname == null ? 0 : 1
  hostname_binding_id = azurerm_app_service_custom_hostname_binding.www_hostname_binding[count.index].id
  certificate_id      = azurerm_app_service_managed_certificate.www_managed_certificate[count.index].id
  ssl_state           = "SniEnabled"
}