Skip to content

kommodity_azure_deployment

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

kommodity_azure_deployment

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
tests
tests
 
 
README.md
README.md
 
 
main.tf
main.tf
 
 
output.tf
output.tf
 
 
providers.tf
providers.tf
 
 
variables.tf
variables.tf
 
 

README.md

Kommodity Azure deployment module

Get started

To use this module, call it as follows in your main.tf:

module "kommodity_azure_deployment" {
  source = "github.com/kommodity-io/kommodity//terraform/modules/kommodity_azure_deployment?ref=<tag>"

  providers = {
    azurerm     = azurerm                # subscription hosting the deployment
    azurerm.dns = azurerm.infrastructure # subscription hosting the public DNS zone
    # if the DNS zone lives in the same subscription, use: azurerm.dns = azurerm
  }

  app_url     = "https://kommodity.dev.example.com"

  dns = {
    zone              = "example.com"
    az_resource_group = "infrastructure-dns"
  }

  oidc_configuration = {
    issuer_url  = <issuer_url>
    client_id   = <client_id>
    admin_group = <admin_group>
  }
}

Overview

This Terraform module provisions a complete Azure environment for the Kommodity service, including networking, database, logging, containerized application deployment, and a custom-domain HTTPS endpoint backed by an Azure-managed certificate.

It creates a dedicated resource group with a virtual network and separate subnets for the database and container app. A private DNS zone enables internal name resolution between resources.

The module deploys a PostgreSQL Flexible Server in a private subnet with a randomly generated admin password and no public access by default. It also provisions a Log Analytics Workspace for monitoring and diagnostics.

An Azure Container App is created to host the Kommodity application. Kommodity is configured with environment variables for authentication, logging, and runtime settings.

The module also manages the public DNS records (CNAME + asuid TXT) needed for app_url, binds the custom domain to the Container App, and issues an Azure Container App Environment Managed Certificate (validated via CNAME). The DNS records are protected by CanNotDelete management locks.

The azurerm.dns provider alias is required because the DNS zone typically lives in a different subscription than the deployment itself.

Requirements

Name Version
azapi ~> 2.9
azurerm ~>4.69.0
random ~> 3.9
time ~> 0.14

Providers

Name Version
azapi 2.10.0
azurerm 4.69.0
azurerm.dns 4.69.0
random 3.9.0

Modules

No modules.

Resources

Name Type
azapi_update_resource.bind_cert resource
azurerm_container_app.kommodity-app resource
azurerm_container_app_custom_domain.this resource
azurerm_container_app_environment.kommodity-environment resource
azurerm_container_app_environment_managed_certificate.this resource
azurerm_dns_cname_record.kommodity resource
azurerm_dns_txt_record.verification resource
azurerm_log_analytics_workspace.kommodity-log-analytics resource
azurerm_management_lock.cname_lock resource
azurerm_management_lock.this resource
azurerm_management_lock.txt_lock resource
azurerm_postgresql_flexible_server.kommodity-db resource
azurerm_postgresql_flexible_server_database.this resource
azurerm_private_dns_zone.kommodity-dns resource
azurerm_private_dns_zone_virtual_network_link.kommodity-dns-vnet-link resource
azurerm_resource_group.kommodity-resource-group resource
azurerm_subnet.kommodity-container-sn resource
azurerm_subnet.kommodity-db-sn resource
azurerm_virtual_network.kommodity-vn resource
random_password.database-password resource
azurerm_dns_zone.this data source

Inputs

Name Description Type Default Required
app_url Custom domain URL for the Kommodity Container App (e.g. https://kommodity.dev.example.com). Must be a subdomain of var.dns.zone. string n/a yes
database Database configuration 
object({
    storage_tier                  = optional(string, "P4")
    sku_name                      = optional(string, "B_Standard_B1ms")
    storage_mb                    = optional(number, 32768)
    version                       = optional(string, "15")
    public_network_access_enabled = optional(bool, false)
    ha_enabled                    = optional(bool, false)
    storage_georedundant_enabled  = optional(bool, false)
    collation                     = optional(string, "en_US.utf8")
    add_lock                      = optional(bool, false)
  })
 {} no
database_password Database password configuration 
object({
    length  = number
    special = bool
  })
 
{
  "length": 16,
  "special": false
}
 no
dns DNS configuration for the custom domain. zone = parent DNS zone name; az_resource_group = resource group hosting the zone. 
object({
    zone              = string
    ttl               = optional(number, 300)
    az_resource_group = optional(string, "infrastructure-dns")
  })
 n/a yes
kommodity_container Kommodity container configuration 
object({
    revision_mode                   = optional(string, "Single")
    image_registry                  = optional(string, "ghcr.io/kommodity-io/kommodity")
    image_version                   = optional(string, "latest")
    port                            = optional(number, 5000)
    cpu                             = optional(number, 0.25)
    memory                          = optional(string, "0.5Gi")
    min_replicas                    = optional(number, 1)
    max_replicas                    = optional(number, 1)
    ssl_mode                        = optional(string, "require")
    insecure_disable_authentication = optional(string, "false")
    development_mode                = optional(string, "false")
    kine_uri                        = optional(string, "unix:///tmp/kine.sock")
    log_format                      = optional(string, "console")
    log_level                       = optional(string, "info")
    infrastructure_providers        = optional(string, "") # If env var is empty, Kommodity uses default providers
    garbage_collector_enabled       = optional(string, "true")
    azure_default_credential_secret = optional(string, "")
  })
 {} no
log_analytics Log Analytics workspace configuration 
object({
    workspace_sku       = optional(string, "PerGB2018")
    workspace_retention = optional(number, 30)
  })
 {} no
oidc_configuration OIDC configuration 
object({
    issuer_url     = string
    client_id      = string
    admin_group    = string
    username_claim = optional(string, "")
  })
 n/a yes
resource_group Resource group configuration 
object({
    name     = string
    location = string
  })
 
{
  "location": "North Europe",
  "name": "kommodity"
}
 no
virtual_network Virtual network configuration 
object({
    address_space           = optional(string, "10.0.0.0/16")
    database_subnet_prefix  = optional(string, "10.0.2.0/24")
    container_subnet_prefix = optional(string, "10.0.0.0/23")
  })
 {} no

Outputs

Name Description
app_url The URL of the Kommodity Container App
container_app_environment_id The ID of the Kommodity Container App Environment
container_app_id The ID of the Kommodity Container App
custom_domain_verification_id The Custom Domain Verification ID of the Kommodity Container App