Install on Azure

The Azure template (main.bicep in your AIOE release) builds a complete AIOE in one resource group: the API and console on Azure Container Apps, Azure Database for PostgreSQL Flexible Server, Azure Managed Redis, a container registry, a managed identity that pulls from it, and a Log Analytics workspace. It runs the same images as the Helm chart.

The deployment has two phases, because a container app cannot start before its image is in the registry: first the infrastructure, then the apps.

What it createsCopy Anchor Link

Names start with aioe-<env>, where env is a parameter (for example prod).

Before you startCopy Anchor Link

• The Azure CLI, signed in, with rights to create resources and role assignments in a resource group.
• Your two app registrations, from Connect your identity provider.
• Access to the aioe-api and aioe-console images for your release. The console image has the API's public address built into it, so it must be built for your API host. Ask Mojo Up if your release does not include one.
• The two host names you will use, for example aioe.example.com and console.aioe.example.com, and access to their DNS zone.
• A Key Vault, or another secret store, for the database password and the platform's keys.

ParametersCopy Anchor Link

How to make the keys is in Platform keys and rotation.

DeployCopy Anchor Link

RG=rg-aioe
az group create -n $RG -l australiaeast
PW=$(openssl rand -base64 24)
# Store $PW in your Key Vault now; every later deployment needs it.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "env": { "value": "prod" },
    "imageTag": { "value": "<release tag>" },
    "apiHost": { "value": "aioe.example.com" },
    "consoleHost": { "value": "console.aioe.example.com" },
    "entraTenantId": { "value": "<tenant-id>" },
    "entraApiAudience": { "value": "<API registration client ID>" },
    "entraPublicClientId": { "value": "<client registration client ID>" },
    "entraApiScope": { "value": "api://aioe.example.com/access" },
    "tenantSlug": { "value": "example" },
    "tenantOrganisation": { "value": "Example Pty Ltd" },
    "tenantDomains": { "value": "example.com" }
  }
}

az deployment group create -g $RG -n aioe-phase1 \
  --template-file main.bicep --parameters @parameters.json \
  --parameters deployApps=false postgresAdminPassword="$PW"

ACR=$(az deployment group show -g $RG -n aioe-phase1 \
  --query properties.outputs.acrLoginServer.value -o tsv)

az acr import -n ${ACR%%.*} --source <source registry>/aioe-api:<release tag> --image aioe-api:<release tag>
az acr import -n ${ACR%%.*} --source <source registry>/aioe-console:<release tag> --image aioe-console:<release tag>

az deployment group create -g $RG -n aioe-phase2 \
  --template-file main.bicep --parameters @parameters.json \
  --parameters deployApps=true postgresAdminPassword="$PW" \
  signingKey="$SIGNING_KEY" secretsKey="$SECRETS_KEY"

az deployment group show -g $RG -n aioe-phase2 --query properties.outputs -o json

Add your host namesCopy Anchor Link

Container Apps needs two records per host name: a CNAME to the app's default host name, and a TXT record asuid.<host> carrying the environment's verification ID.

az containerapp env show -g $RG -n aioe-prod-cae \
  --query properties.customDomainConfiguration.customDomainVerificationId -o tsv

The environment domain is the environmentDomain output. Then bind a managed certificate to each host name:

az containerapp hostname add  -g $RG -n aioe-prod-api --hostname aioe.example.com
az containerapp hostname bind -g $RG -n aioe-prod-api --hostname aioe.example.com \
  --environment aioe-prod-cae --validation-method CNAME
az containerapp hostname add  -g $RG -n aioe-prod-console --hostname console.aioe.example.com
az containerapp hostname bind -g $RG -n aioe-prod-console --hostname console.aioe.example.com \
  --environment aioe-prod-cae --validation-method CNAME

Find the certificate names the binding created (az containerapp env certificate list -g $RG -n aioe-prod-cae --managed-certificates-only -o table) and add them to your parameters file as apiCertificateName and consoleCertificateName.

LogsCopy Anchor Link

Container logs, including the API's JSON log lines, go to the Log Analytics workspace aioe-<env>-logs. For traces and metrics, set OTEL_EXPORTER_OTLP_ENDPOINT on the API app: see Observability.

Next stepsCopy Anchor Link

• Publish the discovery record on each email domain.
• Upgrade to a new release by running phase 2 again with a new imageTag.
• Add the overlay with deployMesh=true.