NovaTrek Adventures — Azure Implementation Plan¶

@startuml novatrek-azure-deployment
!include <C4/C4_Deployment>

title NovaTrek Adventures — Azure Deployment Architecture
caption Unified deployment topology for all 22 microservices

Deployment_Node(cf, "Cloudflare", "DNS + CDN") {
  Deployment_Node(cf_dns, "DNS Zone", "novatrek.cc") {
    Container(dns_portal, "architecture.novatrek.cc", "CNAME → Azure SWA")
    Container(dns_api, "api.novatrek.cc", "CNAME → ACA Environment")
  }
}

Deployment_Node(az, "Azure Subscription", "Pay-as-you-go") {

  Deployment_Node(rg, "Resource Group", "rg-novatrek-{env}") {

    Deployment_Node(acr_node, "Azure Container Registry", "Basic SKU — $5/mo") {
      Container(acr, "crnovatrek{env}", "Docker Images", "22 service images\nTrivy-scanned\nTagged by git SHA")
    }

    Deployment_Node(aca_env, "Container Apps Environment", "Consumption plan — $0 base") {
      Deployment_Node(envoy, "Built-in Envoy Proxy", "Ingress — free") {
        Container(ingress, "HTTPS Ingress", "TLS 1.2+, managed certs\nPath-based routing\nmTLS between services")
      }

      Deployment_Node(svc_group_ops, "Operations Domain", "") {
        Container(svc_checkin, "ca-svc-check-in", "Spring Boot 3 / Java 21", "Scale: 0-5 replicas\nPort 8080\nDapr sidecar")
        Container(svc_sched, "ca-svc-scheduling-orchestrator", "Spring Boot 3 / Java 21", "Scale: 0-5 replicas\nPort 8080\nDapr sidecar")
      }

      Deployment_Node(svc_group_booking, "Booking Domain", "") {
        Container(svc_res, "ca-svc-reservations", "Spring Boot 3 / Java 21", "Scale: 0-5 replicas\nPort 8080\nDapr sidecar")
        Container(svc_pay, "ca-svc-payments", "Spring Boot 3 / Java 21", "Scale: 0-3 replicas\nPort 8080\nPCI isolated — no Dapr")
      }

      Deployment_Node(svc_group_other, "All Other Domains", "18 more services") {
        Container(svc_n, "ca-svc-{name}", "Spring Boot 3 / Java 21", "Scale: 0-N replicas\nPort 8080\nDapr sidecar")
      }
    }

    Deployment_Node(data, "Data Layer", "") {
      Deployment_Node(psql_node, "PostgreSQL Flexible Server", "Burstable B1ms/B2s") {
        ContainerDb(psql_main, "psql-novatrek-{env}", "PostgreSQL 15", "Schemas per service:\ncheckin, reservations,\nguests, catalog, trails,\nscheduling, safety, payments ...\nPostGIS extensions\nAzure AD auth (managed identity)")
      }

      Deployment_Node(redis_node, "Azure Cache for Redis", "Basic C0 — $13/mo") {
        ContainerDb(redis, "redis-novatrek-{env}", "Redis 6", "Schedule locks (Valkey)\nSession cache\nRate limiting")
      }

      Deployment_Node(blob_node, "Azure Blob Storage", "Hot LRS — ~$0.02/GB") {
        ContainerDb(blob, "stnovatrek{env}", "Blob Containers", "Media assets\nDB backups\nLifecycle: Hot→Cool→Archive")
      }
    }

    Deployment_Node(messaging, "Messaging Layer", "") {
      Deployment_Node(sb_node, "Azure Service Bus", "Basic/Standard") {
        Container(sb, "sb-novatrek-{env}", "Topics + Subscriptions", "8 event topics:\ncheckin.completed\nreservation.created\nreservation.status-changed\npayment.processed\nguest.updated\nwaiver.signed\nemergency.activated\nwildlife.sighted")
      }
    }

    Deployment_Node(security, "Security Layer", "") {
      Deployment_Node(kv_node, "Azure Key Vault", "Standard — ~$0.03/10K ops") {
        Container(kv, "kv-novatrek-{env}", "Secrets", "DB connection strings\nJWT signing keys\nAPI keys\nService Bus connection")
      }

      Deployment_Node(mi_node, "Managed Identities", "Free") {
        Container(mi, "User-Assigned MI", "Per-service identity", "RBAC: AcrPull\nRBAC: KV Secrets User\nRBAC: SB Data Sender/Receiver\nAzure AD auth for PostgreSQL")
      }
    }

    Deployment_Node(observability, "Observability", "") {
      Deployment_Node(log_node, "Log Analytics Workspace", "PerGB2018") {
        Container(logs, "log-novatrek-{env}", "Container Logs", "Retention: 30d dev / 90d prod\nKQL queries\nACA system + app logs")
      }

      Deployment_Node(appi_node, "Application Insights", "Free tier") {
        Container(appi, "appi-novatrek-{env}", "APM", "Distributed tracing\nLive metrics\nFailure analysis\nApplication map")
      }
    }

    Deployment_Node(docs, "Documentation", "") {
      Deployment_Node(swa_node, "Azure Static Web Apps", "Free SKU") {
        Container(swa, "swa-cap-docs-prod", "MkDocs Material", "Architecture portal\n139 sequence diagrams\nSwagger UI\nPipeline deep links")
      }
    }
  }
}

Deployment_Node(gh, "GitHub", "Source + CI/CD") {
  Deployment_Node(gh_repo, "novatrek/platform", "") {
    Container(src, "Source Code", "22 service repos\nBicep modules\nOpenAPI specs")
    Container(actions, "GitHub Actions", "CI/CD Pipelines", "Reusable workflows\nOIDC auth to Azure\nEphemeral environments")
  }
}

Deployment_Node(ext_auth, "Azure AD B2C", "Guest Authentication") {
  Container(b2c, "B2C Tenant", "OAuth 2.0 + OIDC", "Social login\nSelf-service registration\n50K MAU free tier")
}

Rel(dns_api, ingress, "Routes traffic", "HTTPS")
Rel(dns_portal, swa, "Routes traffic", "HTTPS")
Rel(ingress, svc_checkin, "Forwards requests", "HTTP/2")
Rel(ingress, svc_res, "Forwards requests", "HTTP/2")
Rel(ingress, svc_n, "Forwards requests", "HTTP/2")
Rel(svc_checkin, psql_main, "Reads/writes", "PostgreSQL wire protocol")
Rel(svc_checkin, sb, "Publishes events", "AMQP")
Rel(svc_checkin, kv, "Reads secrets", "HTTPS / managed identity")
Rel(svc_res, psql_main, "Reads/writes", "PostgreSQL wire protocol")
Rel(svc_pay, psql_main, "Reads/writes", "PostgreSQL wire protocol")
Rel(svc_sched, redis, "Lock/cache", "Redis protocol")
Rel(svc_n, psql_main, "Reads/writes", "PostgreSQL wire protocol")
Rel(svc_n, sb, "Pub/sub events", "AMQP")
Rel(sb, svc_n, "Delivers events", "AMQP push")
Rel(acr, svc_checkin, "Pulls images", "Docker pull")
Rel(actions, acr, "Pushes images", "Docker push")
Rel(actions, az, "Deploys infra + apps", "OIDC + az CLI")
Rel(b2c, ingress, "Issues tokens", "OAuth 2.0")
Rel(logs, svc_checkin, "Collects logs", "stdout/stderr")
Rel(appi, svc_checkin, "Collects telemetry", "OpenTelemetry")
Rel(mi, kv, "Authenticates", "Azure AD")
Rel(mi, psql_main, "Authenticates", "Azure AD")
Rel(mi, acr, "Authenticates", "Azure AD")

SKINPARAM backgroundColor #FEFEFE
@enduml

properties: {
  configuration: {
    activeRevisionsMode: 'Single'
    ingress: {
      external: true
      targetPort: 8080
      transport: 'auto'
    }
  }
  template: {
    scale: {
      minReplicas: 0   // <-- CRITICAL: zero when idle
      maxReplicas: 3    // burst capacity
      rules: [
        {
          name: 'http-scaling'
          http: {
            metadata: {
              concurrentRequests: '50'
            }
          }
        }
      ]
    }
  }
}

# Destroy an entire ephemeral environment in one command
az group delete --name rg-novatrek-pr-${PR_NUMBER} --yes --no-wait

# Stop dev databases on Friday evening
az postgres flexible-server stop --resource-group rg-novatrek-dev --name psql-novatrek-dev

# Start dev databases on Monday morning
az postgres flexible-server start --resource-group rg-novatrek-dev --name psql-novatrek-dev

PR Opened → GitHub Actions
  ├── az group create rg-novatrek-pr-{number}
  ├── az deployment group create (Bicep: full stack)
  ├── Run database migrations (Flyway)
  ├── Deploy affected services
  ├── Post PR comment with live URLs
  └── Run smoke tests

PR Merged/Closed → GitHub Actions
  ├── az group delete rg-novatrek-pr-{number} --yes --no-wait
  └── Clean up ACR images tagged with PR number

infra/
├── main.bicep                          # Root orchestrator
├── modules/
│   ├── container-apps-env.bicep        # ACA environment + Log Analytics
│   ├── container-app.bicep             # Generic microservice template
│   ├── postgresql.bicep                # PostgreSQL Flexible Server
│   ├── service-bus.bicep               # Azure Service Bus
│   ├── redis.bicep                     # Azure Cache for Redis
│   ├── key-vault.bicep                 # Azure Key Vault
│   ├── container-registry.bicep        # Azure Container Registry
│   ├── storage-account.bicep           # Blob storage
│   ├── static-web-app.bicep            # SWA (portal)
│   └── monitoring.bicep                # Log Analytics + Application Insights
├── parameters/
│   ├── prod.bicepparam                 # Production parameters
│   ├── dev.bicepparam                  # Development parameters
│   └── ephemeral.bicepparam            # Ephemeral (PR) parameters
├── environments/
│   ├── prod.env.bicep                  # Prod-specific composition
│   ├── dev.env.bicep                   # Dev-specific composition
│   └── ephemeral.env.bicep             # Ephemeral composition (minimal)
└── deploy.sh                           # One-command deploy/teardown

// main.bicep — composes all modules for a given environment
targetScope = 'resourceGroup'

@description('Environment identifier')
@allowed(['prod', 'dev', 'ephemeral'])
param environment string

@description('Azure region')
param location string = resourceGroup().location

@description('Services to deploy (incremental delivery)')
param servicesToDeploy array = []

// ---------------------------------------------------------------------------
// Shared Infrastructure
// ---------------------------------------------------------------------------

module acr 'modules/container-registry.bicep' = {
  name: 'deploy-acr'
  params: {
    name: 'crnovatrek${environment}'
    location: location
    sku: environment == 'prod' ? 'Basic' : 'Basic'
  }
}

module acaEnv 'modules/container-apps-env.bicep' = {
  name: 'deploy-aca-env'
  params: {
    name: 'cae-novatrek-${environment}'
    location: location
    logRetentionDays: environment == 'prod' ? 90 : 30
  }
}

module keyVault 'modules/key-vault.bicep' = {
  name: 'deploy-kv'
  params: {
    name: 'kv-novatrek-${environment}'
    location: location
  }
}

module postgresql 'modules/postgresql.bicep' = {
  name: 'deploy-psql'
  params: {
    name: 'psql-novatrek-${environment}'
    location: location
    skuName: environment == 'prod' ? 'Standard_B2s' : 'Standard_B1ms'
    storageSizeGB: environment == 'prod' ? 64 : 32
    databases: [for svc in servicesToDeploy: svc]
  }
}

module serviceBus 'modules/service-bus.bicep' = {
  name: 'deploy-sb'
  params: {
    name: 'sb-novatrek-${environment}'
    location: location
    sku: environment == 'prod' ? 'Standard' : 'Basic'
    topics: [
      'novatrek.operations.checkin.completed'
      'novatrek.booking.reservation.created'
      'novatrek.booking.reservation.status-changed'
      'novatrek.support.payment.processed'
      'novatrek.identity.guest.updated'
      'novatrek.safety.waiver.signed'
      'novatrek.safety.emergency.activated'
      'novatrek.operations.wildlife.sighted'
    ]
  }
}

// ---------------------------------------------------------------------------
// Microservices (conditionally deployed based on servicesToDeploy)
// ---------------------------------------------------------------------------

module services 'modules/container-app.bicep' = [for svc in servicesToDeploy: {
  name: 'deploy-${svc}'
  params: {
    name: svc
    location: location
    environmentId: acaEnv.outputs.environmentId
    registryServer: acr.outputs.loginServer
    image: '${acr.outputs.loginServer}/${svc}:latest'
    minReplicas: 0
    maxReplicas: environment == 'prod' ? 5 : 2
    env: [
      { name: 'SPRING_PROFILES_ACTIVE', value: environment }
      { name: 'DATABASE_HOST', secretRef: 'db-host' }
      { name: 'DATABASE_NAME', value: replace(svc, '-', '_') }
      { name: 'SERVICE_BUS_CONNECTION', secretRef: 'sb-connection' }
    ]
    keyVaultName: keyVault.outputs.name
    targetPort: 8080
  }
}]

az deployment group what-if \
  --resource-group rg-novatrek-${ENV} \
  --template-file infra/main.bicep \
  --parameters infra/parameters/${ENV}.bicepparam

Configuration Sources (highest priority wins):
  1. Azure Key Vault secrets        ← connection strings, JWT secrets, API keys
  2. Container App environment vars ← injected by Bicep at deploy time
  3. Spring Boot application-{env}.yaml ← environment-specific config
  4. Spring Boot application.yaml   ← shared defaults
  5. Architecture metadata YAML     ← adventure categories, capability mappings

// Container App references Key Vault secrets via managed identity
module svcCheckIn 'modules/container-app.bicep' = {
  params: {
    secrets: [
      {
        name: 'db-host'
        keyVaultUrl: '${keyVault.outputs.vaultUri}secrets/psql-host'
        identity: managedIdentity.outputs.id
      }
      {
        name: 'sb-connection'
        keyVaultUrl: '${keyVault.outputs.vaultUri}secrets/sb-connection-string'
        identity: managedIdentity.outputs.id
      }
    ]
  }
}

# application.yaml — shared defaults
spring:
  application:
    name: svc-check-in
  datasource:
    driver-class-name: org.postgresql.Driver
  jpa:
    hibernate:
      ddl-auto: validate  # Never auto-create in any environment
    properties:
      hibernate:
        default_schema: checkin

---
# application-dev.yaml
spring:
  config:
    activate:
      on-profile: dev
  datasource:
    url: jdbc:postgresql://${DATABASE_HOST}:5432/novatrek_dev

logging:
  level:
    com.novatrek: DEBUG

---
# application-prod.yaml
spring:
  config:
    activate:
      on-profile: prod
  datasource:
    url: jdbc:postgresql://${DATABASE_HOST}:5432/novatrek_prod
    hikari:
      maximum-pool-size: 20
      minimum-idle: 5

logging:
  level:
    com.novatrek: INFO

# config/adventure-classification.yaml (deployed as ConfigMap)
adventure_categories:
  hiking_easy:
    pattern: 1  # Basic self-check-in
    safety_level: low
  rock_climbing:
    pattern: 3  # Full Service
    safety_level: high
  # Unknown categories default to Pattern 3 (ADR-005)
  _default:
    pattern: 3
    safety_level: high

.github/workflows/
├── infra-deploy.yml              # Infrastructure pipeline (Bicep)
├── infra-teardown.yml            # Environment teardown (manual trigger)
├── service-ci.yml                # Reusable CI workflow (build, test, scan)
├── service-cd.yml                # Reusable CD workflow (deploy to ACA)
├── service-{name}.yml            # Per-service orchestrator (calls CI + CD)
├── ephemeral-env.yml             # PR-based ephemeral environments
├── db-migrate.yml                # Database migration pipeline (Flyway)
├── docs-deploy.yml               # Architecture portal deploy (existing)
├── validate-solution.yml         # Solution design validation (existing)
├── nightly-stop-dev.yml          # Cost control: stop dev databases at night
├── nightly-start-dev.yml         # Cost control: start dev databases in morning
└── load-test.yml                 # On-demand load testing

# .github/workflows/service-ci.yml — called by each per-service workflow
name: "Service CI (Reusable)"

on:
  workflow_call:
    inputs:
      service-name:
        required: true
        type: string
      java-version:
        required: false
        type: string
        default: '21'
    outputs:
      image-tag:
        description: "Docker image tag"
        value: ${{ jobs.build.outputs.image-tag }}

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: ${{ inputs.java-version }}
          cache: 'gradle'

      - name: Build and test
        working-directory: services/${{ inputs.service-name }}
        run: ./gradlew build test

      - name: Run OWASP dependency check
        working-directory: services/${{ inputs.service-name }}
        run: ./gradlew dependencyCheckAnalyze

      - name: Build Docker image
        id: meta
        run: |
          TAG="${{ github.sha }}"
          IMAGE="${{ secrets.ACR_LOGIN_SERVER }}/${{ inputs.service-name }}:${TAG}"
          docker build -t ${IMAGE} services/${{ inputs.service-name }}
          echo "tags=${IMAGE}" >> $GITHUB_OUTPUT

      - name: Push to ACR
        run: |
          az acr login --name ${{ secrets.ACR_NAME }}
          docker push ${{ steps.meta.outputs.tags }}

      - name: Run Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ steps.meta.outputs.tags }}
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

# .github/workflows/service-cd.yml — deploy a service to Azure Container Apps
name: "Service CD (Reusable)"

on:
  workflow_call:
    inputs:
      service-name:
        required: true
        type: string
      environment:
        required: true
        type: string
      image-tag:
        required: true
        type: string

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@v4

      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Deploy to Container Apps
        run: |
          az containerapp update \
            --name ca-${{ inputs.service-name }} \
            --resource-group rg-novatrek-${{ inputs.environment }} \
            --image ${{ inputs.image-tag }} \
            --set-env-vars "SPRING_PROFILES_ACTIVE=${{ inputs.environment }}"

      - name: Verify deployment health
        run: |
          FQDN=$(az containerapp show \
            --name ca-${{ inputs.service-name }} \
            --resource-group rg-novatrek-${{ inputs.environment }} \
            --query "properties.configuration.ingress.fqdn" -o tsv)

          for i in {1..30}; do
            STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://${FQDN}/actuator/health" || true)
            if [ "$STATUS" = "200" ]; then
              echo "Service healthy"
              exit 0
            fi
            echo "Waiting for health check... (attempt $i/30)"
            sleep 10
          done
          echo "Health check failed after 5 minutes"
          exit 1

# .github/workflows/service-svc-check-in.yml
name: "svc-check-in"

on:
  push:
    branches: [main]
    paths:
      - 'services/svc-check-in/**'
      - 'config/adventure-classification.yaml'
  pull_request:
    paths:
      - 'services/svc-check-in/**'

jobs:
  ci:
    uses: ./.github/workflows/service-ci.yml
    with:
      service-name: svc-check-in
    secrets: inherit

  cd-dev:
    needs: ci
    if: github.ref == 'refs/heads/main'
    uses: ./.github/workflows/service-cd.yml
    with:
      service-name: svc-check-in
      environment: dev
      image-tag: ${{ needs.ci.outputs.image-tag }}
    secrets: inherit

  cd-prod:
    needs: cd-dev
    if: github.ref == 'refs/heads/main'
    uses: ./.github/workflows/service-cd.yml
    with:
      service-name: svc-check-in
      environment: prod
      image-tag: ${{ needs.ci.outputs.image-tag }}
    secrets: inherit

# .github/workflows/db-migrate.yml
name: "Database Migrations (Flyway)"

on:
  workflow_call:
    inputs:
      service-name:
        required: true
        type: string
      environment:
        required: true
        type: string

jobs:
  migrate:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@v4

      - name: Run Flyway migrations
        uses: flyway/flyway-action@master
        with:
          url: jdbc:postgresql://${{ secrets.DB_HOST }}:5432/${{ secrets.DB_NAME }}
          user: ${{ secrets.DB_USER }}
          password: ${{ secrets.DB_PASSWORD }}
          locations: filesystem:services/${{ inputs.service-name }}/src/main/resources/db/migration

# .github/workflows/nightly-stop-dev.yml — Stop dev resources at 8 PM UTC
name: "Nightly Stop Dev"

on:
  schedule:
    - cron: '0 20 * * 1-5'  # 8 PM UTC weekdays
  workflow_dispatch:         # Manual trigger

jobs:
  stop:
    runs-on: ubuntu-latest
    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Stop PostgreSQL
        run: |
          az postgres flexible-server stop \
            --resource-group rg-novatrek-dev \
            --name psql-novatrek-dev

      - name: Scale services to zero
        run: |
          for APP in $(az containerapp list -g rg-novatrek-dev --query "[].name" -o tsv); do
            az containerapp update -n $APP -g rg-novatrek-dev \
              --min-replicas 0 --max-replicas 0
          done

# .github/workflows/nightly-start-dev.yml — Start dev resources at 7 AM UTC
name: "Nightly Start Dev"

on:
  schedule:
    - cron: '0 13 * * 1-5'  # 1 PM UTC = 8 AM EST weekdays
  workflow_dispatch:

jobs:
  start:
    runs-on: ubuntu-latest
    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Start PostgreSQL
        run: |
          az postgres flexible-server start \
            --resource-group rg-novatrek-dev \
            --name psql-novatrek-dev

      - name: Restore service scaling
        run: |
          for APP in $(az containerapp list -g rg-novatrek-dev --query "[].name" -o tsv); do
            az containerapp update -n $APP -g rg-novatrek-dev \
              --min-replicas 0 --max-replicas 2
          done

# .github/workflows/infra-deploy.yml
name: "Infrastructure Deploy"

on:
  push:
    branches: [main]
    paths:
      - 'infra/**'
  pull_request:
    paths:
      - 'infra/**'
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        type: choice
        options: [dev, prod]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Lint Bicep
        run: az bicep build --file infra/main.bicep --stdout > /dev/null

      - name: What-If Preview
        run: |
          ENV=${{ inputs.environment || 'dev' }}
          az deployment group what-if \
            --resource-group rg-novatrek-${ENV} \
            --template-file infra/main.bicep \
            --parameters infra/parameters/${ENV}.bicepparam

  deploy:
    needs: validate
    if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment || 'dev' }}
    steps:
      - uses: actions/checkout@v4

      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Deploy Infrastructure
        run: |
          ENV=${{ inputs.environment || 'dev' }}
          az deployment group create \
            --resource-group rg-novatrek-${ENV} \
            --template-file infra/main.bicep \
            --parameters infra/parameters/${ENV}.bicepparam \
            --name "deploy-$(date +%Y%m%d-%H%M%S)"

# .github/workflows/ephemeral-env.yml
name: "Ephemeral Environment"

on:
  pull_request:
    types: [opened, synchronize, reopened, closed]
    paths:
      - 'services/**'
      - 'infra/**'

jobs:
  deploy-ephemeral:
    if: github.event.action != 'closed'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Create ephemeral resource group
        run: |
          az group create \
            --name rg-novatrek-pr-${{ github.event.pull_request.number }} \
            --location eastus2 \
            --tags "pr=${{ github.event.pull_request.number }}" "ephemeral=true"

      - name: Deploy minimal infrastructure
        run: |
          az deployment group create \
            --resource-group rg-novatrek-pr-${{ github.event.pull_request.number }} \
            --template-file infra/main.bicep \
            --parameters infra/parameters/ephemeral.bicepparam \
            --parameters environment=pr-${{ github.event.pull_request.number }}

      - name: Post PR comment with URLs
        uses: actions/github-script@v7
        with:
          script: |
            const prNum = context.payload.pull_request.number;
            const body = `## Ephemeral Environment Deployed

            | Service | URL |
            |---------|-----|
            | API Gateway | \`https://cae-novatrek-pr-${prNum}.eastus2.azurecontainerapps.io\` |
            | Portal | PR staging via Azure Static Web Apps |

            This environment will be automatically destroyed when this PR is closed.`;

            github.rest.issues.createComment({
              ...context.repo,
              issue_number: prNum,
              body
            });

  teardown-ephemeral:
    if: github.event.action == 'closed'
    runs-on: ubuntu-latest
    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Destroy ephemeral environment
        run: |
          az group delete \
            --name rg-novatrek-pr-${{ github.event.pull_request.number }} \
            --yes --no-wait

# .github/workflows/infra-teardown.yml
name: "Infrastructure Teardown"

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to tear down'
        required: true
        type: choice
        options: [dev, ephemeral-all]
      confirmation:
        description: 'Type DESTROY to confirm'
        required: true
        type: string

jobs:
  teardown:
    if: inputs.confirmation == 'DESTROY'
    runs-on: ubuntu-latest
    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Teardown dev
        if: inputs.environment == 'dev'
        run: az group delete --name rg-novatrek-dev --yes --no-wait

      - name: Teardown all ephemeral
        if: inputs.environment == 'ephemeral-all'
        run: |
          for RG in $(az group list --query "[?tags.ephemeral=='true'].name" -o tsv); do
            echo "Deleting $RG..."
            az group delete --name $RG --yes --no-wait
          done

# architecture/metadata/delivery-status.yaml
services:
  svc-check-in:
    wave: 3
    stages:
      bicep-module: completed     # infra/modules/container-app.bicep parameterized
      db-schema: completed        # Flyway migrations created
      ci-pipeline: completed      # .github/workflows/service-svc-check-in.yml
      cd-pipeline: completed      # Reusable CD workflow configured
      deployed-dev: completed     # Running in rg-novatrek-dev
      smoke-tested: completed     # Health check + basic API test passing
      deployed-prod: not-started  # Awaiting Wave 3 completion
    links:
      ci-pipeline: https://github.com/novatrek/platform/actions/workflows/service-svc-check-in.yml
      cd-pipeline: https://github.com/novatrek/platform/actions/workflows/service-cd.yml
      infra-module: infra/modules/container-app.bicep
      openapi-spec: architecture/specs/svc-check-in.yaml
      portal-page: https://architecture.novatrek.cc/microservices/svc-check-in/

## Pipelines and Infrastructure

| Resource | Link |
|----------|------|
| CI Pipeline | [Build & Test](https://github.com/{org}/{repo}/actions/workflows/service-svc-check-in.yml) |
| CD Pipeline (Dev) | [Deploy to Dev](https://github.com/{org}/{repo}/actions/workflows/service-cd.yml) |
| CD Pipeline (Prod) | [Deploy to Prod](https://github.com/{org}/{repo}/actions/workflows/service-cd.yml) |
| Infrastructure Module | [Bicep Module](https://github.com/{org}/{repo}/blob/main/infra/modules/container-app.bicep) |
| Database Migrations | [Flyway Scripts](https://github.com/{org}/{repo}/tree/main/services/svc-check-in/src/main/resources/db/migration) |
| Dockerfile | [Container Build](https://github.com/{org}/{repo}/blob/main/services/svc-check-in/Dockerfile) |
| OpenAPI Spec | [svc-check-in.yaml](https://architecture.novatrek.cc/specs/svc-check-in.yaml) |
| Swagger UI | [Try it out](https://architecture.novatrek.cc/services/api/svc-check-in/) |
| Source Code | [GitHub](https://github.com/{org}/{repo}/tree/main/services/svc-check-in) |
| Azure Portal | [Container App](https://portal.azure.com/#@/resource/subscriptions/{sub}/resourceGroups/rg-novatrek-prod/providers/Microsoft.App/containerApps/ca-svc-check-in) |
| Container Logs | [Log Analytics](https://portal.azure.com/#@/resource/subscriptions/{sub}/resourceGroups/rg-novatrek-prod/providers/Microsoft.OperationalInsights/workspaces/log-novatrek-prod/logs) |

## Operations

| Pipeline | Purpose | Link |
|----------|---------|------|
| Infrastructure Deploy | Provision/update Azure resources | [Run](https://github.com/{org}/{repo}/actions/workflows/infra-deploy.yml) |
| Infrastructure Teardown | Destroy non-prod environments | [Run](https://github.com/{org}/{repo}/actions/workflows/infra-teardown.yml) |
| Architecture Portal Deploy | Build and publish this site | [Run](https://github.com/{org}/{repo}/actions/workflows/docs-deploy.yml) |
| Nightly Stop Dev | Pause dev resources at night | [Run](https://github.com/{org}/{repo}/actions/workflows/nightly-stop-dev.yml) |
| Nightly Start Dev | Resume dev resources in morning | [Run](https://github.com/{org}/{repo}/actions/workflows/nightly-start-dev.yml) |
| Ephemeral Environments | PR-based preview environments | [View](https://github.com/{org}/{repo}/actions/workflows/ephemeral-env.yml) |
| Database Migrations | Run Flyway migrations | [Run](https://github.com/{org}/{repo}/actions/workflows/db-migrate.yml) |
| Solution Validation | Validate architecture solutions | [View](https://github.com/{org}/{repo}/actions/workflows/validate-solution.yml) |
| Confluence Drift Check | Monitor Confluence mirror | [View](https://github.com/{org}/{repo}/actions/workflows/confluence-drift-check.yml) |

## Integration Pipelines

| Producer/Consumer | CI Pipeline | CD Pipeline |
|-------------------|-------------|-------------|
| **svc-check-in** (producer) | [Build](https://github.com/.../.../actions/workflows/service-svc-check-in.yml) | [Deploy](https://github.com/.../.../actions/workflows/service-cd.yml) |
| **svc-analytics** (consumer) | [Build](https://github.com/.../.../actions/workflows/service-svc-analytics.yml) | [Deploy](https://github.com/.../.../actions/workflows/service-cd.yml) |
| **svc-notifications** (consumer) | [Build](https://github.com/.../.../actions/workflows/service-svc-notifications.yml) | [Deploy](https://github.com/.../.../actions/workflows/service-cd.yml) |

## Delivery Status

| Service | Wave | CI | CD | Status |
|---------|------|----|----|--------|
| svc-check-in | 3 | [pipeline](link) | [pipeline](link) | Deployed to Dev |
| svc-guest-profiles | 1 | [pipeline](link) | [pipeline](link) | Deployed to Prod |

# architecture/metadata/pipeline-registry.yaml
repository:
  org: novatrek
  repo: platform
  base_url: https://github.com/novatrek/platform

pipelines:
  global:
    infra-deploy:
      workflow: infra-deploy.yml
      description: Provision/update Azure resources
    infra-teardown:
      workflow: infra-teardown.yml
      description: Destroy non-prod environments
    docs-deploy:
      workflow: docs-deploy.yml
      description: Build and publish architecture portal
    ephemeral-env:
      workflow: ephemeral-env.yml
      description: PR-based preview environments
    db-migrate:
      workflow: db-migrate.yml
      description: Database migrations (Flyway)
    nightly-stop-dev:
      workflow: nightly-stop-dev.yml
      description: Stop dev resources at night
    nightly-start-dev:
      workflow: nightly-start-dev.yml
      description: Start dev resources in morning

  per-service:
    ci-workflow-pattern: "service-{service-name}.yml"
    cd-workflow: "service-cd.yml"
    source-path-pattern: "services/{service-name}"
    dockerfile-pattern: "services/{service-name}/Dockerfile"
    migration-path-pattern: "services/{service-name}/src/main/resources/db/migration"
    infra-module: "infra/modules/container-app.bicep"

azure:
  subscription_id: "{subscription-id}"
  resource_groups:
    prod: rg-novatrek-prod
    dev: rg-novatrek-dev
  container_app_pattern: "ca-{service-name}"
  log_analytics:
    prod: log-novatrek-prod
    dev: log-novatrek-dev

// modules/monitoring.bicep
resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  name: 'log-novatrek-${environment}'
  location: location
  properties: {
    sku: { name: 'PerGB2018' }
    retentionInDays: environment == 'prod' ? 90 : 30
  }
}

resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
  name: 'appi-novatrek-${environment}'
  location: location
  kind: 'web'
  properties: {
    Application_Type: 'web'
    WorkspaceResourceId: logAnalytics.id
  }
}

// In container-app module
probes: [
  {
    type: 'Liveness'
    httpGet: {
      path: '/actuator/health/liveness'
      port: 8080
    }
    initialDelaySeconds: 30
    periodSeconds: 10
  }
  {
    type: 'Readiness'
    httpGet: {
      path: '/actuator/health/readiness'
      port: 8080
    }
    initialDelaySeconds: 15
    periodSeconds: 5
  }
]

// Workload Identity Federation — GitHub Actions authenticates without secrets
resource federatedCredential 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2023-01-31' = {
  name: 'github-actions-${environment}'
  parent: deploymentIdentity
  properties: {
    issuer: 'https://token.actions.githubusercontent.com'
    subject: 'repo:novatrek/platform:environment:${environment}'
    audiences: ['api://AzureADTokenExchange']
  }
}

# Point-in-time restore for prod
az postgres flexible-server restore \
  --resource-group rg-novatrek-prod \
  --name psql-novatrek-prod-restored \
  --source-server psql-novatrek-prod \
  --restore-time "2026-03-10T14:00:00Z"

// Budget alert in main.bicep
resource budget 'Microsoft.Consumption/budgets@2023-11-01' = {
  name: 'budget-novatrek-${environment}'
  properties: {
    category: 'Cost'
    amount: environment == 'prod' ? 200 : 50
    timeGrain: 'Monthly'
    timePeriod: {
      startDate: '2026-04-01'
    }
    notifications: {
      actual80: {
        enabled: true
        operator: 'GreaterThanOrEqualTo'
        threshold: 80
        contactEmails: ['architect@novatrek.example.com']
      }
      actual100: {
        enabled: true
        operator: 'GreaterThanOrEqualTo'
        threshold: 100
        contactEmails: ['architect@novatrek.example.com']
      }
    }
  }
}

# Stand up everything from scratch
./infra/deploy.sh dev

# Tear down a dev environment completely
az group delete --name rg-novatrek-dev --yes --no-wait

# Stop dev to save money (keep data)
az postgres flexible-server stop -g rg-novatrek-dev -n psql-novatrek-dev

# Resume dev
az postgres flexible-server start -g rg-novatrek-dev -n psql-novatrek-dev

# Deploy a single service
az containerapp update -n ca-svc-check-in -g rg-novatrek-dev \
  --image crnovatrekdev.azurecr.io/svc-check-in:$(git rev-parse --short HEAD)

# Check service health
curl https://ca-svc-check-in.cae-novatrek-dev.eastus2.azurecontainerapps.io/actuator/health

# View service logs
az containerapp logs show -n ca-svc-check-in -g rg-novatrek-dev --follow

# What-if preview before deploying
az deployment group what-if -g rg-novatrek-dev -f infra/main.bicep -p infra/parameters/dev.bicepparam

# List all Container Apps in an environment
az containerapp list -g rg-novatrek-dev -o table

# Check which services are running (replica count > 0)
az containerapp list -g rg-novatrek-dev --query "[].{name:name, replicas:properties.runningStatus.replicas}" -o table

# View deployment history
az deployment group list -g rg-novatrek-dev -o table

# Cost analysis for current month
az consumption usage list -g rg-novatrek-dev --start-date 2026-03-01 --end-date 2026-03-31 -o table

# Connect to dev database
az postgres flexible-server connect -n psql-novatrek-dev -g rg-novatrek-dev -u adminuser -d novatrek_dev --interactive

# Run Flyway migrations for a service
flyway -url=jdbc:postgresql://psql-novatrek-dev.postgres.database.azure.com:5432/novatrek_dev \
  -schemas=checkin \
  -locations=filesystem:services/svc-check-in/src/main/resources/db/migration \
  migrate

# List all schemas
az postgres flexible-server execute -n psql-novatrek-dev -g rg-novatrek-dev -u adminuser -d novatrek_dev \
  -q "SELECT schema_name FROM information_schema.schemata WHERE schema_name NOT LIKE 'pg_%'"

# Login to ACR
az acr login --name crnovatrekdev

# Build and push a service image
docker build -t crnovatrekdev.azurecr.io/svc-check-in:latest services/svc-check-in/
docker push crnovatrekdev.azurecr.io/svc-check-in:latest

# List images
az acr repository list --name crnovatrekdev -o table

# Clean up old images (keep last 5 tags per service)
az acr run --registry crnovatrekdev --cmd "acr purge --filter 'svc-check-in:.*' --keep 5 --ago 30d" /dev/null