<aside> ⚠️

Ready to deploy, not deployed. Templates compile and the package is ready. No Azure resources, Entra registrations, role assignments or secrets exist yet (task P08, due 16 Oct).

</aside>

<aside> 📍

Australia East

default region

</aside>

<aside> 📦

0.5 CPU / 1 GiB

1–3 replicas

</aside>

<aside> 🐘

D2ds_v5 · 128 GiB

private PostgreSQL

</aside>

<aside> 💾

14-day backups

• 30-day Blob soft delete </aside>

🏗️ Target architecture

flowchart LR
    User[Browser] -->|"HTTPS + Entra token"| App["Container Apps: React + API"]
    Entra["Microsoft Entra ID"] --> User
    ACR["Azure Container Registry"] --> App
    App -->|"Restricted DB role / TLS"| PG["Private PostgreSQL 16"]
    App -->|"Managed identity"| Blob["Private document container"]
    App -->|"Managed identity"| KV["Key Vault"]
    Job["One-off migration job"] -->|"Separate identity / admin role"| PG
    Job --> KV
    App --> Logs["Log Analytics"]

No zone-redundancy or multi-region commitment in the initial config.

🚀 Deploy in 4 steps

Prerequisites

• [ ] Azure subscription + dedicated resource group
• [ ] Resource providers registered: App, ContainerRegistry, DBforPostgreSQL, Network, ManagedIdentity, KeyVault, Storage, OperationalInsights
• [ ] Quota and Azure Policy reviewed for region and SKUs
• [ ] Two DB passwords (24+ chars) in the org password vault

Entra

node scripts/entra-manifest.mjs APPLICATION_CLIENT_ID https://APP_HOST > /tmp/steelman-entra-fields.json

Single-tenant registration · access_as_user scope · token v2 · SPA redirect = app origin · 7 app roles · assignment required. No client secret in the browser.

Validate

python3 scripts/deploy.py validate --subscription SUB_ID --resource-group RG --client-id CLIENT_ID --location australiaeast

Review ARM validation and what-if before continuing.

Deploy

python3 scripts/deploy.py deploy --subscription SUB_ID --resource-group RG --client-id CLIENT_ID --location australiaeast

Foundation → image built in ACR → migration job must succeed → app deployed. Production starts empty.

✅ Post-deploy acceptance

• [ ] Record image tag/digest, revision, resource IDs; health/readiness return 200
• [ ] Unauthenticated /api/bootstrap returns 401; demo headers rejected
• [ ] Sign in as each role; test unassigned and other-tenant users
• [ ] Customer → enquiry → quote → accept creates exactly one project
• [ ] Partial/full PO receipt; over-receipt blocked; failed QA blocks dispatch
• [ ] Attachment bytes match; persists after restart; operational role denied commercial docs
• [ ] Revision restart keeps data + audit attribution; DB grants verified
• [ ] PostgreSQL backup + Blob version restored to a coherent point

↩️ Rollback

<aside> 🛑

The schema is the rollback boundary. The app refuses to start unless schema_migrations matches its bundled migrations exactly.

</aside>

• 🟢 Previous release has the same migrations
• 🟠 Current release added migrations