main.bicept

{{define "main.bicep" -}}
targetScope = 'subscription'

@minLength(1)
@maxLength(64)
@description('Name of the environment that can be used as part of naming resource convention')
param environmentName string

@minLength(1)
@description('Primary location for all resources')
param location string
{{range .Parameters}}
{{- if .Secret}}
@secure()
{{- end}}
param {{.Name}} {{.Type}}
{{- end}}

@description('Id of the user or app to assign application roles')
param principalId string

// Tags that should be applied to all resources.
// 
// Note that 'azd-service-name' tags should be applied separately to service host resources.
// Example usage:
//   tags: union(tags, { 'azd-service-name': <service name in azure.yaml> })
var tags = {
  'azd-env-name': environmentName
}

var abbrs = loadJsonContent('./abbreviations.json')
var resourceToken = toLower(uniqueString(subscription().id, environmentName, location))

resource rg 'Microsoft.Resources/resourceGroups@2022-09-01' = {
  name: 'rg-${environmentName}'
  location: location
  tags: tags
}

module monitoring './shared/monitoring.bicep' = {
  name: 'monitoring'
  params: {
    location: location
    tags: tags
    logAnalyticsName: '${abbrs.operationalInsightsWorkspaces}${resourceToken}'
    applicationInsightsName: '${abbrs.insightsComponents}${resourceToken}'
  }
  scope: rg
}

module dashboard './shared/dashboard-web.bicep' = {
  name: 'dashboard'
  params: {
    name: '${abbrs.portalDashboards}${resourceToken}'
    applicationInsightsName: monitoring.outputs.applicationInsightsName
    location: location
    tags: tags
  }
  scope: rg
}

module registry './shared/registry.bicep' = {
  name: 'registry'
  params: {
    location: location
    tags: tags
    name: '${abbrs.containerRegistryRegistries}${resourceToken}'
  }
  scope: rg
}

module keyVault './shared/keyvault.bicep' = {
  name: 'keyvault'
  params: {
    location: location
    tags: tags
    name: '${abbrs.keyVaultVaults}${resourceToken}'
    principalId: principalId
  }
  scope: rg
}

module appsEnv './shared/apps-env.bicep' = {
  name: 'apps-env'
  params: {
    name: '${abbrs.appManagedEnvironments}${resourceToken}'
    location: location
    tags: tags
    applicationInsightsName: monitoring.outputs.applicationInsightsName
    logAnalyticsWorkspaceName: monitoring.outputs.logAnalyticsWorkspaceName
  }
  scope: rg
}
{{- if (or .DbCosmosMongo .DbPostgres)}}

resource vault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
  name: keyVault.outputs.name
  scope: rg
}
{{- end}}
{{- if .DbCosmosMongo}}

module cosmosDb './app/db-cosmos-mongo.bicep' = {
  name: 'cosmosDb'
  params: {
    accountName: '${abbrs.documentDBDatabaseAccounts}${resourceToken}'
    location: location
    tags: tags
    keyVaultName: keyVault.outputs.name
  }
  scope: rg
}
{{- end}}
{{- if .DbPostgres}}

module postgresDb './app/db-postgres.bicep' = {
  name: 'postgresDb'
  params: {
    serverName: '${abbrs.dBforPostgreSQLServers}${resourceToken}'
    location: location
    tags: tags
    databasePassword: databasePassword
    keyVaultName: keyVault.outputs.name
    allowAllIPsFirewall: true
  }
  scope: rg
}
{{- end}}
{{- range .Services}}

module {{bicepName .Name}} './app/{{.Name}}.bicep' = {
  name: '{{.Name}}'
  params: {
    name: '${abbrs.appContainerApps}{{containerAppName .Name}}-${resourceToken}'
    location: location
    tags: tags
    identityName: '${abbrs.managedIdentityUserAssignedIdentities}{{containerAppName .Name}}-${resourceToken}'
    applicationInsightsName: monitoring.outputs.applicationInsightsName
    containerAppsEnvironmentName: appsEnv.outputs.name
    containerRegistryName: registry.outputs.name
    exists: {{bicepName .Name}}Exists
    appDefinition: {{bicepName .Name}}Definition
    {{- if .DbCosmosMongo}}
    cosmosDbConnectionString: vault.getSecret(cosmosDb.outputs.connectionStringKey)
    {{- end}}
    {{- if .DbPostgres}}
    databaseName: postgresDb.outputs.databaseName
    databaseHost: postgresDb.outputs.databaseHost
    databaseUser: postgresDb.outputs.databaseUser
    databasePassword: vault.getSecret(postgresDb.outputs.databaseConnectionKey)
    {{- end}}
    {{- if (and .Frontend .Frontend.Backends)}}
    apiUrls: [
      {{- range .Frontend.Backends}}
      {{bicepName .Name}}.outputs.uri
      {{- end}}
    ]
    {{- end}}
    {{- if (and .Backend .Backend.Frontends)}}
    allowedOrigins: [
      {{- range .Backend.Frontends}}
      'https://${abbrs.appContainerApps}{{containerAppName .Name}}-${resourceToken}.${appsEnv.outputs.domain}'
      {{- end}}
    ]
    {{- end}}
  }
  scope: rg
}
{{- end}}

output AZURE_CONTAINER_REGISTRY_ENDPOINT string = registry.outputs.loginServer
output AZURE_KEY_VAULT_NAME string = keyVault.outputs.name
output AZURE_KEY_VAULT_ENDPOINT string = keyVault.outputs.endpoint
{{ end}}