host-containerapp.bicept

{{define "host-containerapp.bicep" -}}
param name string
param location string = resourceGroup().location
param tags object = {}

param identityName string
param containerRegistryName string
param containerAppsEnvironmentName string
param applicationInsightsName string
{{- if .DbCosmosMongo}}
@secure()
param cosmosDbConnectionString string
{{- end}}
{{- if .DbPostgres}}
param databaseHost string
param databaseUser string
param databaseName string
@secure()
param databasePassword string
{{- end}}
{{- if (and .Frontend .Frontend.Backends)}}
param apiUrls array
{{- end}}
{{- if (and .Backend .Backend.Frontends)}}
param allowedOrigins array
{{- end}}
param exists bool
@secure()
param appDefinition object

var appSettingsArray = filter(array(appDefinition.settings), i => i.name != '')
var secrets = map(filter(appSettingsArray, i => i.?secret != null), i => {
  name: i.name
  value: i.value
  secretRef: i.?secretRef ?? take(replace(replace(toLower(i.name), '_', '-'), '.', '-'), 32)
})
var env = map(filter(appSettingsArray, i => i.?secret == null), i => {
  name: i.name
  value: i.value
})

resource identity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
  name: identityName
  location: location
}

resource containerRegistry 'Microsoft.ContainerRegistry/registries@2022-02-01-preview' existing = {
  name: containerRegistryName
}

resource containerAppsEnvironment 'Microsoft.App/managedEnvironments@2023-04-01-preview' existing = {
  name: containerAppsEnvironmentName
}

resource applicationInsights 'Microsoft.Insights/components@2020-02-02' existing = {
  name: applicationInsightsName
}

resource acrPullRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: containerRegistry
  name: guid(subscription().id, resourceGroup().id, identity.id, 'acrPullRole')
  properties: {
    roleDefinitionId:  subscriptionResourceId(
      'Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')
    principalType: 'ServicePrincipal'
    principalId: identity.properties.principalId
  }
}

module fetchLatestImage '../modules/fetch-container-image.bicep' = {
  name: '${name}-fetch-image'
  params: {
    exists: exists
    name: name
  }
}

resource app 'Microsoft.App/containerApps@2023-04-01-preview' = {
  name: name
  location: location
  tags: union(tags, {'azd-service-name':  '{{.Name}}' })
  dependsOn: [ acrPullRole ]
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: { '${identity.id}': {} }
  }
  properties: {
    managedEnvironmentId: containerAppsEnvironment.id
    configuration: {
      {{- if ne .Port 0}}
      ingress:  {
        external: true
        targetPort: {{.Port}}
        transport: 'auto'
        {{- if (and .Backend .Backend.Frontends)}}
        corsPolicy: {
          allowedOrigins: union(allowedOrigins, [
            // define additional allowed origins here
          ])
        }
        {{- end}}
      }
      {{- end}}
      registries: [
        {
          server: '${containerRegistryName}.azurecr.io'
          identity: identity.id
        }
      ]
      secrets: union([
        {{- if .DbCosmosMongo}}
        {
          name: 'azure-cosmos-connection-string'
          value: cosmosDbConnectionString
        }
        {{- end}}
        {{- if .DbPostgres}}
        {
          name: 'db-pass'
          value: databasePassword
        }
        {{- end}}
      ],
      map(secrets, secret => {
        name: secret.secretRef
        value: secret.value
      }))
    }
    template: {
      containers: [
        {
          image: fetchLatestImage.outputs.?containers[?0].?image ?? 'mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
          name: 'main'
          env: union([
            {
              name: 'APPLICATIONINSIGHTS_CONNECTION_STRING'
              value: applicationInsights.properties.ConnectionString
            }
            {{- if .DbCosmosMongo}}
            {
              name: 'AZURE_COSMOS_MONGODB_CONNECTION_STRING'
              secretRef: 'azure-cosmos-connection-string'
            }
            {{- end}}
            {{- if .DbPostgres}}
            {
              name: 'DB_HOST'
              value: databaseHost
            }
            {
              name: 'DB_USER'
              value: databaseUser
            }
            {
              name: 'DB_NAME'
              value: databaseName
            }
            {
              name: 'DB_PASS'
              secretRef: 'db-pass'
            }
            {
              name: 'DB_PORT'
              value: '5432'
            }
            {{- end}}
            {{- if .Frontend}}
            {{- range $i, $e := .Frontend.Backends}}
            {
              name: '{{upper .Name}}_BASE_URL'
              value: apiUrls[{{$i}}]
            }
            {{- end}}
            {{- end}}
            {{- if ne .Port 0}}
            {
              name: 'PORT'
              value: '{{ .Port }}'
            }
            {{- end}}
          ],
          env,
          map(secrets, secret => {
            name: secret.name
            secretRef: secret.secretRef
          }))
          resources: {
            cpu: json('1.0')
            memory: '2.0Gi'
          }
        }
      ]
      scale: {
        minReplicas: 1
        maxReplicas: 10
      }
    }
  }
}

output defaultDomain string = containerAppsEnvironment.properties.defaultDomain
output name string = app.name
output uri string = 'https://${app.properties.configuration.ingress.fqdn}'
output id string = app.id
{{ end}}