Deployment Architecture Guide

// infra/main.bicep
@description('Environment name (dev, staging, prod)')
param environment string = 'dev'

@description('Primary location for resources')
param location string = resourceGroup().location

@description('Application name prefix')
param appName string = 'travel-agents'

// Variables
var containerAppName = '${appName}-${environment}'
var resourcePrefix = 'rg-${appName}-${environment}'

// Modules
module containerApps 'modules/container-apps.bicep' = {
  name: 'containerApps'
  params: {
    location: location
    environment: environment
    appName: appName
    containerRegistryName: containerRegistry.outputs.name
    keyVaultName: security.outputs.keyVaultName
    managedIdentityId: security.outputs.managedIdentityId
  }
}

module monitoring 'modules/monitoring.bicep' = {
  name: 'monitoring'
  params: {
    location: location
    environment: environment
    appName: appName
  }
}

module security 'modules/security.bicep' = {
  name: 'security'
  params: {
    location: location
    environment: environment
    appName: appName
  }
}

module aiServices 'modules/ai-services.bicep' = {
  name: 'aiServices'
  params: {
    location: location
    environment: environment
    appName: appName
    keyVaultName: security.outputs.keyVaultName
  }
}

// Container Registry
resource containerRegistry 'Microsoft.ContainerRegistry/registries@2023-07-01' = {
  name: 'acr${appName}${environment}${uniqueString(resourceGroup().id)}'
  location: location
  sku: {
    name: environment == 'prod' ? 'Premium' : 'Standard'
  }
  properties: {
    adminUserEnabled: false
    policies: {
      trustPolicy: {
        type: 'Notary'
        status: 'enabled'
      }
      retentionPolicy: {
        status: 'enabled'
        days: environment == 'prod' ? 30 : 7
      }
    }
  }
}

// Outputs
output containerAppsEnvironmentFqdn string = containerApps.outputs.environmentFqdn
output uiAppUrl string = containerApps.outputs.uiAppUrl
output apiAppUrl string = containerApps.outputs.apiAppUrl

// infra/modules/container-apps.bicep
@description('Location for resources')
param location string

@description('Environment name')
param environment string

@description('Application name')
param appName string

@description('Container registry name')
param containerRegistryName string

@description('Key Vault name')
param keyVaultName string

@description('Managed identity resource ID')
param managedIdentityId string

// Container Apps Environment
resource containerAppsEnvironment 'Microsoft.App/managedEnvironments@2023-05-01' = {
  name: 'cae-${appName}-${environment}'
  location: location
  properties: {
    appLogsConfiguration: {
      destination: 'log-analytics'
      logAnalyticsConfiguration: {
        customerId: logAnalyticsWorkspace.properties.customerId
        sharedKey: logAnalyticsWorkspace.listKeys().primarySharedKey
      }
    }
    zoneRedundant: environment == 'prod'
    workloadProfiles: [
      {
        name: 'Consumption'
        workloadProfileType: 'Consumption'
      }
      {
        name: 'Dedicated-D4'
        workloadProfileType: 'D4'
        minimumCount: environment == 'prod' ? 1 : 0
        maximumCount: 3
      }
    ]
  }
}

// UI Container App
resource uiApp 'Microsoft.App/containerApps@2023-05-01' = {
  name: 'ca-${appName}-ui-${environment}'
  location: location
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${managedIdentityId}': {}
    }
  }
  properties: {
    environmentId: containerAppsEnvironment.id
    workloadProfileName: 'Consumption'
    configuration: {
      ingress: {
        external: true
        targetPort: 4200
        allowInsecure: false
        traffic: [
          {
            weight: 100
            latestRevision: true
          }
        ]
      }
      registries: [
        {
          server: '${containerRegistryName}.azurecr.io'
          identity: managedIdentityId
        }
      ]
    }
    template: {
      containers: [
        {
          name: 'ui'
          image: '${containerRegistryName}.azurecr.io/${appName}-ui:latest'
          resources: {
            cpu: json('0.25')
            memory: '0.5Gi'
          }
          env: [
            {
              name: 'NG_API_URL'
              value: 'https://${apiApp.properties.configuration.ingress.fqdn}'
            }
          ]
        }
      ]
      scale: {
        minReplicas: environment == 'prod' ? 2 : 1
        maxReplicas: environment == 'prod' ? 10 : 3
        rules: [
          {
            name: 'http-scaling'
            http: {
              metadata: {
                concurrentRequests: '100'
              }
            }
          }
        ]
      }
    }
  }
}

// API Container App (similar structure)
resource apiApp 'Microsoft.App/containerApps@2023-05-01' = {
  // ... detailed configuration
}

// MCP Server Container Apps
resource mcpServers 'Microsoft.App/containerApps@2023-05-01' = [for server in mcpServerConfigs: {
  name: 'ca-${appName}-${server.name}-${environment}'
  location: location
  // ... configuration for each MCP server
}]

// Outputs
output environmentFqdn string = containerAppsEnvironment.properties.defaultDomain
output uiAppUrl string = 'https://${uiApp.properties.configuration.ingress.fqdn}'
output apiAppUrl string = 'https://${apiApp.properties.configuration.ingress.fqdn}'

// infra/modules/monitoring.bicep
resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: 'law-${appName}-${environment}'
  location: location
  properties: {
    sku: {
      name: 'PerGB2018'
    }
    retentionInDays: environment == 'prod' ? 90 : 30
    features: {
      enableLogAccessUsingOnlyResourcePermissions: true
    }
  }
}

resource applicationInsights 'Microsoft.Insights/components@2020-02-02' = {
  name: 'ai-${appName}-${environment}'
  location: location
  kind: 'web'
  properties: {
    Application_Type: 'web'
    WorkspaceResourceId: logAnalyticsWorkspace.id
    IngestionMode: 'LogAnalytics'
  }
}

// Alerts
resource responseTimeAlert 'Microsoft.Insights/metricAlerts@2018-03-01' = {
  name: 'High Response Time Alert'
  location: 'global'
  properties: {
    description: 'Alert when average response time exceeds 5 seconds'
    severity: 2
    enabled: true
    scopes: [
      apiContainerApp.id
    ]
    evaluationFrequency: 'PT1M'
    windowSize: 'PT5M'
    criteria: {
      'odata.type': 'Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria'
      allOf: [
        {
          name: 'HighResponseTime'
          metricName: 'RequestDuration'
          operator: 'GreaterThan'
          threshold: 5000
          timeAggregation: 'Average'
        }
      ]
    }
  }
}

// Managed identity for container apps
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
  name: 'mi-${appName}-${environment}'
  location: location
}

// Key Vault access policy
resource keyVaultAccessPolicy 'Microsoft.KeyVault/vaults/accessPolicies@2023-07-01' = {
  name: 'add'
  parent: keyVault
  properties: {
    accessPolicies: [
      {
        tenantId: tenant().tenantId
        objectId: managedIdentity.properties.principalId
        permissions: {
          secrets: ['get', 'list']
        }
      }
    ]
  }
}

// Container Registry access
resource containerRegistryAccess 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(containerRegistry.id, managedIdentity.id, 'AcrPull')
  scope: containerRegistry
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d') // AcrPull
    principalId: managedIdentity.properties.principalId
    principalType: 'ServicePrincipal'
  }
}

// Virtual network for secure communication
resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-05-01' = if (environment == 'prod') {
  name: 'vnet-${appName}-${environment}'
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: ['10.0.0.0/16']
    }
    subnets: [
      {
        name: 'container-apps-subnet'
        properties: {
          addressPrefix: '10.0.1.0/24'
          delegations: [
            {
              name: 'Microsoft.App.environments'
              properties: {
                serviceName: 'Microsoft.App/environments'
              }
            }
          ]
        }
      }
    ]
  }
}

// Container Apps Environment with VNet integration
resource containerAppsEnvironment 'Microsoft.App/managedEnvironments@2023-05-01' = {
  name: 'cae-${appName}-${environment}'
  location: location
  properties: {
    vnetConfiguration: environment == 'prod' ? {
      infrastructureSubnetId: virtualNetwork.properties.subnets[0].id
      internal: false
    } : null
    // ... other properties
  }
}

// API scaling configuration
template: {
  scale: {
    minReplicas: environment == 'prod' ? 2 : 1
    maxReplicas: environment == 'prod' ? 20 : 5
    rules: [
      {
        name: 'http-scaling-rule'
        http: {
          metadata: {
            concurrentRequests: '50'
          }
        }
      }
      {
        name: 'cpu-scaling-rule'
        custom: {
          type: 'cpu'
          metadata: {
            type: 'Utilization'
            value: '70'
          }
        }
      }
      {
        name: 'memory-scaling-rule'
        custom: {
          type: 'memory'
          metadata: {
            type: 'Utilization'
            value: '80'
          }
        }
      }
    ]
  }
}

// Primary region deployment
module primaryRegion 'main.bicep' = {
  name: 'primaryRegion'
  params: {
    location: 'swedencentral'
    environment: environment
    isPrimary: true
  }
}

// Secondary region deployment (disaster recovery)
module secondaryRegion 'main.bicep' = if (environment == 'prod') {
  name: 'secondaryRegion'
  params: {
    location: 'northeurope'
    environment: environment
    isPrimary: false
    primaryResourceGroup: primaryRegion.outputs.resourceGroupName
  }
}

// Traffic Manager for failover
resource trafficManager 'Microsoft.Network/trafficManagerProfiles@2022-04-01' = if (environment == 'prod') {
  name: 'tm-${appName}-${environment}'
  location: 'global'
  properties: {
    profileStatus: 'Enabled'
    trafficRoutingMethod: 'Priority'
    endpoints: [
      {
        name: 'primary'
        type: 'externalEndpoints'
        properties: {
          target: primaryRegion.outputs.uiAppFqdn
          priority: 1
          endpointStatus: 'Enabled'
        }
      }
      {
        name: 'secondary'
        type: 'externalEndpoints'
        properties: {
          target: secondaryRegion.outputs.uiAppFqdn
          priority: 2
          endpointStatus: 'Enabled'
        }
      }
    ]
  }
}

// Environment-specific cost optimizations
var costOptimizations = {
  dev: {
    // Use consumption pricing for all services
    containerAppsWorkloadProfile: 'Consumption'
    logRetentionDays: 7
    autoShutdown: true
  }
  staging: {
    containerAppsWorkloadProfile: 'Consumption'
    logRetentionDays: 30
    autoShutdown: false
  }
  prod: {
    containerAppsWorkloadProfile: 'Dedicated-D4'
    logRetentionDays: 90
    autoShutdown: false
  }
}

// Auto-shutdown for dev environment
resource autoShutdownScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = if (environment == 'dev') {
  name: 'auto-shutdown-${environment}'
  location: location
  kind: 'AzurePowerShell'
  properties: {
    azPowerShellVersion: '9.0'
    scriptContent: '''
      # Scale down to 0 replicas during off-hours (evenings and weekends)
      $resourceGroup = $env:AZURE_RESOURCE_GROUP
      $containerApps = az containerapp list --resource-group $resourceGroup --query "[].name" -o tsv
      
      foreach ($app in $containerApps) {
        az containerapp update --name $app --resource-group $resourceGroup --min-replicas 0
      }
    '''
    retentionInterval: 'P1D'
  }
}