feat: add db access to managed identity

docs/colima-and-docker.md

@@ -0,0 +1,55 @@
+# Colima vs Docker Desktop
+
+## What is Colima?
+
+Colima is an open-source tool for running **containers** and **virtualized environments** on macOS and Linux. It creates lightweight virtual machines (VMs) to run containers, providing a Docker-compatible environment without the overhead of Docker Desktop.
+
+Colima supports both **Docker** and **containerd** runtimes, allowing you to choose the container runtime that best fits your needs.
+
+### Example: Starting Colima with Specific Resources
+
+To start Colima with a specified configuration:
+
+```bash
+colima start --memory 8 --cpu 4 --disk 20
+```
+
+Here, you're allocating 8GB of memory, 4 CPUs, and 20GB of disk space to the virtual machine.
+While Colima manages the virtual environment, it still requires a container runtime (such as Docker, containerd, or Podman) to handle the actual container operations.
+
+## What is Docker Runtime?
+
+The Docker runtime encompasses all the tools necessary to run a Docker container. It operates using a client-server architecture, consisting of:
+
+- **Docker CLI (client)**: Allows users to interact with Docker via commands.
+- **Docker Daemon (dockerd) (server)**: The core service that runs in the background, responsible for managing containers, images, networks, and volumes.
+- **Docker API**: Enables communication between the Docker client and daemon, allowing for remote operations and container management.
+
+The Docker daemon (`dockerd`) is responsible for the container lifecycle (e.g., starting, stopping, restarting containers).
+
+## Docker Engine vs Docker Desktop vs Docker Runtime
+
+- **Docker Engine**: The core runtime responsible for managing containers. It includes the Docker Daemon (`dockerd`) and containerd. Docker Engine can run containers on Linux-based systems natively or through virtualized environments on macOS or Windows.
+
+- **Docker Desktop**: A full suite of tools for running Docker on macOS and Windows. It includes Docker Engine, a GUI, Kubernetes integration, Docker CLI, and other utilities. Docker Desktop simplifies container management on macOS and Windows but has higher resource usage.
+
+- **Docker Runtime**: Refers to the lower-level components that allow containers to run, such as Docker Engine or containerd. It does not include higher-level tools like the Docker CLI or GUI.
+
+## Is Colima a Drop-in Replacement for Docker Desktop?
+
+Colima is an alternative to Docker Desktop, but it’s not a complete drop-in replacement. While it provides a lightweight environment for running containers on macOS and Linux, it lacks the full GUI and Kubernetes integration found in Docker Desktop.
+
+That said, Colima can run containers with Docker CLI, making it a great option for those who prefer the command line or need a more resource-efficient environment.
+
+### Why choose Colima over Docker Desktop?
+
+- **Free and Open-Source**: Colima is entirely open-source, while Docker Desktop requires a paid license for commercial use.
+- **Smaller Footprint**: Colima uses fewer resources compared to Docker Desktop, making it a better option for users looking for a lightweight solution.
+
+## Conclusion
+
+- **Docker Engine** is the core runtime for running containers, while **Docker Desktop** is a suite that includes Docker Engine, a GUI, and other tools.
+- **Colima** provides a resource-efficient alternative for running Docker containers and VMs, but lacks some of the extra features (e.g., GUI) found in Docker Desktop.
+- Colima is a great open-source option if you need a lightweight, cost-effective solution for running containers, especially on macOS or Linux.
+
+For users seeking a more minimal setup without Docker Desktop’s overhead, **Colima** offers a streamlined and efficient choice.

infra/container-api-prod.bicep

@@ -8,14 +8,17 @@ param managedIdentityName string = 'bds-prod-managedidentity'
 param keyVaultName string = 'bds-prod-keyvault'
 
 @description('The name of the container environment.')
-param containerName string = 'bds-prod-containerenv-api'
+param containerEnvName string = 'bds-prod-containerenv-api'
 
 @description('The name of the container app.')
 param containerAppName string = 'bds-prod-containerapp-api'
 
 @description('The name of the Log Analytics workspace.')
 param logAnalyticsWorkspaceName string = 'bds-prod-loganalytics'
 
+@description('The name of the VNet.')
+param vnetName string = 'bds-prod-vnet'
+
 @description('The name of the ACR login server.')
 param acrServer string
 
@@ -30,28 +33,86 @@ param acrPassword string
 param containerImage string
 
 module containerEnv 'modules/containerEnv.bicep' = {
-  name: containerName
+  name: containerEnvName
   params: {
-    containerAppEnvironmentName: containerName
+    vnetName: vnetName
+    containerAppEnvironmentName: containerEnvName
     location: location
     logAnalyticsWorkspaceName: logAnalyticsWorkspaceName
   }
 }
 
-module containerApp 'modules/containerApp.bicep' = {
+resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
+  name: managedIdentityName
+}
+
+resource containerApp 'Microsoft.App/containerApps@2023-08-01-preview' = {
   name: containerAppName
-  params: {
-    location: location
-    managedIdentityName: managedIdentityName
-    keyVaultName: keyVaultName
-    containerAppName: containerAppName
-    containerAppEnvironmentId: containerEnv.outputs.id
-    acrLoginServer: acrServer
-    acrUsername: acrUsername
-    acrPassword: acrPassword
-    containerImage: containerImage
-    targetPort: 5001
+  location: location
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: {
+      '${managedIdentity.id}': {}
+    }
+  }
+  properties: {
+    managedEnvironmentId: containerEnv.outputs.id
+    configuration: {
+      activeRevisionsMode: 'Multiple'
+      ingress: {
+        external: true
+        targetPort: 5001
+        allowInsecure: false
+        customDomains: [
+          {
+            bindingType: 'SniEnabled'
+            certificateId: 'surveyapi.bouvetapps.io-bds-prod-250120104816'
+            name: 'surveyapi.bouvetapps.io'
+          }
+        ]
+      }
+      registries: [
+        {
+          server: acrServer
+          passwordSecretRef: 'container-registry-password'
+          username: acrUsername
+        }
+      ]
+      secrets: [
+        {
+          name: 'container-registry-password'
+          value: acrPassword
+        }
+        {
+          name: 'sql-server-connection-string' // github workflow will fail if this does not exist.
+          keyVaultUrl: 'https://${keyVaultName}.vault.azure.net/secrets/sql-server-connection-string'
+          identity: managedIdentity.id
+        }
+      ]
+    }
+    template: {
+      containers: [
+        {
+          name: containerAppName
+          image: '${acrServer}/backend-image:${containerImage}'
+          resources: {
+            cpu: json('0.5')
+            memory: '1Gi'
+          }
+          env: [
+            {
+              name: 'ConnectionString'
+              secretRef: 'sql-server-connection-string'
+            }
+          ]
+        }
+      ]
+      scale: {
+        minReplicas: 0
+        maxReplicas: 2
+      }
+    }
   }
 }
 
-output fqdn string = containerApp.outputs.fqdn
+output fqdn string = containerApp.properties.configuration.ingress.fqdn

infra/container-api-test.bicep

@@ -16,6 +16,9 @@ param containerAppName string = 'bds-test-containerapp-api'
 @description('The name of the Log Analytics workspace.')
 param logAnalyticsWorkspaceName string = 'bds-test-loganalytics'
 
+@description('The name of the VNet.')
+param vnetName string = 'bds-test-vnet'
+
 @description('The name of the ACR login server.')
 param acrServer string
 
@@ -32,6 +35,7 @@ param containerImage string
 module containerEnv 'modules/containerEnv.bicep' = {
   name: containerName
   params: {
+    vnetName: vnetName
     containerAppEnvironmentName: containerName
     location: location
     logAnalyticsWorkspaceName: logAnalyticsWorkspaceName

infra/container-frontend-prod.bicep

@@ -16,6 +16,9 @@ param acrServer string
 @description('The name of the ACR username.')
 param acrUsername string
 
+@description('The name of the VNet.')
+param vnetName string = 'bds-prod-vnet'
+
 @secure()
 @description('The name of the ACR password.')
 param acrPassword string
@@ -26,24 +29,63 @@ param containerImage string
 module containerEnv 'modules/containerEnv.bicep' = {
   name: containerName
   params: {
+    vnetName: vnetName
     containerAppEnvironmentName: containerName
     location: location
     logAnalyticsWorkspaceName: logAnalyticsWorkspaceName
   }
 }
 
-module containerApp 'modules/containerAppFrontend.bicep' = {
+resource containerApp 'Microsoft.App/containerApps@2023-08-01-preview' = {
   name: containerAppName
-  params: {
-    location: location
-    containerAppName: containerAppName
-    containerAppEnvironmentId: containerEnv.outputs.id
-    acrLoginServer: acrServer
-    acrUsername: acrUsername
-    acrPassword: acrPassword
-    containerImage: containerImage
-    targetPort: 3000
+  location: location
+  properties: {
+    managedEnvironmentId: containerEnv.outputs.id
+    configuration: {
+      activeRevisionsMode: 'Multiple'
+      ingress: {
+        external: true
+        targetPort: 3000
+        allowInsecure: false
+        customDomains: [
+          {
+            bindingType: 'SniEnabled'
+            certificateId: 'survey.bouvetapps.io-bds-prod-250120105916'
+            name: 'survey.bouvetapps.io'
+          }
+        ]
+      }
+      secrets: [
+        {
+          name: 'container-registry-password'
+          value: acrPassword
+        }
+      ]
+      registries: [
+        {
+          server: acrServer
+          passwordSecretRef: 'container-registry-password'
+          username: acrUsername
+        }
+      ]
+    }
+    template: {
+      containers: [
+        {
+          name: containerAppName
+          image: containerImage
+          resources: {
+            cpu: json('0.5')
+            memory: '1Gi'
+          }
+        }
+      ]
+      scale: {
+        minReplicas: 0
+        maxReplicas: 2
+      }
+    }
   }
 }
 
-output fqdn string = containerApp.outputs.fqdn
+output fqdn string = containerApp.properties.configuration.ingress.fqdn

infra/container-frontend-test.bicep

@@ -10,12 +10,16 @@ param containerAppName string = 'bds-test-containerapp-frontend'
 @description('The name of the Log Analytics workspace.')
 param logAnalyticsWorkspaceName string = 'bds-test-loganalytics'
 
+@description('The name of the VNet.')
+param vnetName string = 'bds-test-vnet'
+
 @description('The name of the ACR login server.')
 param acrServer string
 
 @description('The name of the ACR username.')
 param acrUsername string
 
+
 @secure()
 @description('The name of the ACR password.')
 param acrPassword string
@@ -26,6 +30,7 @@ param containerImage string
 module containerEnv 'modules/containerEnv.bicep' = {
   name: containerName
   params: {
+    vnetName: vnetName
     containerAppEnvironmentName: containerName
     location: location
     logAnalyticsWorkspaceName: logAnalyticsWorkspaceName

infra/main-prod.bicep

@@ -19,6 +19,18 @@ param sqlDBName string = 'bds-prod-sqldb'
 @description('The username for the SQL Server.')
 param sqlServerUsername string = 'bdsadmin'
 
+@description('The name of the VNet')
+param vnetName string = 'bds-prod-vnet'
+
+@description('The name of the subnet')
+param subnetName string = 'bds-prod-subnet'
+
+@description('The name of the private endpoint')
+param sqlPrivateEndpointName string = 'bds-prod-privateendpoint-sqlserver'
+
+@description('The name of the private endpoint connection')
+param sqlServerConnectionName string = 'bds-prod-sqlserver-connection'
+
 @secure()
 @description('The administrator password used for the sql server instance created.')
 param sqlServerPassword string
@@ -43,6 +55,10 @@ module keyVault 'modules/keyVault.bicep' = {
 module sqlServer 'modules/sqlServer.bicep' = {
   name: serverName
   params: {
+    vnetName: vnetName
+    subnetName: subnetName
+    sqlPrivateEndpointName: sqlPrivateEndpointName
+    sqlServerConnectionName: sqlServerConnectionName
     serverName: serverName
     sqlDBName: sqlDBName
     location: location

infra/main-test.bicep

@@ -19,6 +19,18 @@ param sqlDBName string = 'bds-test-sqldb'
 @description('The username for the SQL Server.')
 param sqlServerUsername string = 'bdsadmin'
 
+@description('The name of the VNet')
+param vnetName string = 'bds-test-vnet'
+
+@description('The name of the subnet')
+param subnetName string = 'bds-test-subnet'
+
+@description('The name of the private endpoint')
+param sqlPrivateEndpointName string = 'bds-test-privateendpoint-sqlserver'
+
+@description('The name of the private endpoint connection')
+param sqlServerConnectionName string = 'bds-test-sqlserver-connection'
+
 @secure()
 @description('The administrator password used for the sql server instance created.')
 param sqlServerPassword string
@@ -43,6 +55,10 @@ module keyVault 'modules/keyVault.bicep' = {
 module sqlServer 'modules/sqlServer.bicep' = {
   name: serverName
   params: {
+    vnetName: vnetName
+    subnetName: subnetName
+    sqlPrivateEndpointName: sqlPrivateEndpointName
+    sqlServerConnectionName: sqlServerConnectionName
     serverName: serverName
     sqlDBName: sqlDBName
     location: location

infra/modules/containerAppFrontend.bicep

@@ -61,8 +61,8 @@ resource containerApp 'Microsoft.App/containerApps@2023-08-01-preview' = {
         }
       ]
       scale: {
-        minReplicas: 1
-        maxReplicas: 3
+        minReplicas: 0
+        maxReplicas: 2
       }
     }
   }

infra/modules/containerEnv.bicep

@@ -7,6 +7,13 @@ param location string
 @description('Log analytics workspace name')
 param logAnalyticsWorkspaceName string
 
+@description('The name of the VNet')
+param vnetName string
+
+resource vnet 'Microsoft.Network/virtualNetworks@2023-04-01' existing = {
+  name: vnetName
+}
+
 resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
   name: logAnalyticsWorkspaceName
   location: location
@@ -21,6 +28,9 @@ resource env 'Microsoft.App/managedEnvironments@2023-08-01-preview' = {
   name: containerAppEnvironmentName
   location: location
   properties: {
+    vnetConfiguration: {
+      infrastructureSubnetId: vnet.properties.subnets[0].id
+    }
     appLogsConfiguration: {
       destination: 'log-analytics'
       logAnalyticsConfiguration: {