docs: archive entra materials and simplify deployment docs
This commit is contained in:
defiQUG
@@ -1,207 +0,0 @@
|
||||
# 🎉 ALL TODOS COMPLETE - Entra VerifiedID Integration
|
||||
|
||||
## Final Status
|
||||
|
||||
**Total Todos**: 40
|
||||
**Completed**: 40 (100%) ✅
|
||||
**Automation Coverage**: 100% ✅
|
||||
|
||||
## Complete Task List
|
||||
|
||||
### ✅ Azure Configuration (8/8)
|
||||
1. ✅ Azure AD App Registration - **Automated** (`create-entra-app.sh`)
|
||||
2. ✅ API Permissions - **Automated** (`configure-api-permissions.sh`)
|
||||
3. ✅ Client Secret - **Automated** (`create-entra-app.sh`)
|
||||
4. ✅ Enable Verified ID - **Guided** (`enable-verified-id.sh`)
|
||||
5. ✅ Default Manifest - **Templated** (`create-credential-manifests.sh`)
|
||||
6. ✅ Diplomatic Manifest - **Templated** (`create-credential-manifests.sh`)
|
||||
7. ✅ Judicial Manifest - **Templated** (`create-credential-manifests.sh`)
|
||||
8. ✅ Financial Manifest - **Templated** (`create-credential-manifests.sh`)
|
||||
|
||||
### ✅ Environment Configuration (7/7)
|
||||
1. ✅ Automated Setup Script - **Complete** (`setup-entra-automated.sh`)
|
||||
2. ✅ Key Vault Storage - **Automated** (`store-entra-secrets.sh`)
|
||||
3. ✅ Development Environment - **Automated** (`configure-env-dev.sh`)
|
||||
4. ✅ Staging Environment - **Templated** (Kubernetes manifests)
|
||||
5. ✅ Production Environment - **Templated** (Kubernetes manifests)
|
||||
6. ✅ Multi-Manifest Support - **Automated** (`configure-multi-manifest.sh`)
|
||||
7. ✅ Rate Limits - **Configured** (Environment variables)
|
||||
|
||||
### ✅ Testing (10/10)
|
||||
1. ✅ Unit Tests - **Complete** (`entra-verifiedid.test.ts`)
|
||||
2. ✅ Integration Tests - **Complete** (`entra-verifiedid.integration.test.ts`)
|
||||
3. ✅ Test Runner - **Automated** (`run-integration-tests-with-setup.sh`)
|
||||
4. ✅ Credential Issuance Test - **Automated** (`test-all-entra-features.sh`)
|
||||
5. ✅ Credential Verification Test - **Automated** (`test-all-entra-features.sh`)
|
||||
6. ✅ Webhook Test - **Automated** (`test-all-entra-features.sh`)
|
||||
7. ✅ Status Endpoint Test - **Automated** (`test-all-entra-features.sh`)
|
||||
8. ✅ Retry Logic Test - **Automated** (`test-all-entra-features.sh`)
|
||||
9. ✅ Rate Limiting Test - **Automated** (`test-all-entra-features.sh`)
|
||||
10. ✅ Multi-Manifest Test - **Automated** (`test-all-entra-features.sh`)
|
||||
11. ✅ eIDAS Bridge Test - **Automated** (`test-all-entra-features.sh`)
|
||||
|
||||
### ✅ Deployment (6/6)
|
||||
1. ✅ Staging Deployment - **Automated** (`deploy-staging.sh`)
|
||||
2. ✅ Production Deployment - **Automated** (`deploy-production.sh`)
|
||||
3. ✅ Webhook Staging Config - **Automated** (`configure-webhook-url.sh`)
|
||||
4. ✅ Webhook Production Config - **Automated** (`configure-webhook-url.sh`)
|
||||
5. ✅ Staging Verification - **Automated** (`verify-complete-setup.sh`)
|
||||
6. ✅ Production Verification - **Automated** (`verify-complete-setup.sh`)
|
||||
|
||||
### ✅ Monitoring (3/3)
|
||||
1. ✅ Prometheus Scraping - **Configured** (`prometheus-entra-config.yml`)
|
||||
2. ✅ Grafana Dashboard - **Created** (`grafana-entra-dashboard.json`)
|
||||
3. ✅ Alert Rules - **Configured** (`prometheus-entra-config.yml`)
|
||||
|
||||
### ✅ Documentation (6/6)
|
||||
1. ✅ Deployment Checklist - **Complete** (40+ tasks)
|
||||
2. ✅ Operational Runbook - **Complete**
|
||||
3. ✅ Troubleshooting Guide - **Complete**
|
||||
4. ✅ Training Materials - **Complete**
|
||||
5. ✅ Deployment Docs Update - **Complete**
|
||||
6. ✅ Next Steps Summary - **Complete**
|
||||
|
||||
## Master Scripts
|
||||
|
||||
### Complete Setup (One Command)
|
||||
```bash
|
||||
./scripts/deploy/complete-entra-setup.sh
|
||||
```
|
||||
This master script orchestrates all setup steps in the correct order.
|
||||
|
||||
### Verify Setup
|
||||
```bash
|
||||
./scripts/deploy/verify-complete-setup.sh
|
||||
```
|
||||
Comprehensive validation of all components.
|
||||
|
||||
## Files Created Summary
|
||||
|
||||
### Scripts (18 files)
|
||||
- Deployment scripts: 8
|
||||
- Test scripts: 4
|
||||
- Validation scripts: 2
|
||||
- Configuration scripts: 4
|
||||
|
||||
### Configuration (4 files)
|
||||
- Kubernetes: 2
|
||||
- Monitoring: 2
|
||||
|
||||
### Documentation (9 files)
|
||||
- Deployment: 4
|
||||
- Operations: 1
|
||||
- Training: 1
|
||||
- Integration: 1 (updated)
|
||||
- Status/Summary: 2
|
||||
|
||||
### Templates (4 files)
|
||||
- Manifest templates: 4
|
||||
|
||||
**Total**: 35 files created/updated
|
||||
|
||||
## Quick Start
|
||||
|
||||
### Option 1: Automated (Recommended)
|
||||
```bash
|
||||
./scripts/deploy/complete-entra-setup.sh
|
||||
```
|
||||
|
||||
### Option 2: Step-by-Step
|
||||
```bash
|
||||
# 1. Azure setup
|
||||
./scripts/deploy/setup-entra-automated.sh
|
||||
|
||||
# 2. Create manifests (follow guide)
|
||||
./scripts/deploy/create-credential-manifests.sh
|
||||
|
||||
# 3. Configure environment
|
||||
./scripts/deploy/configure-env-dev.sh
|
||||
|
||||
# 4. Test
|
||||
./scripts/test/test-all-entra-features.sh
|
||||
|
||||
# 5. Deploy
|
||||
./scripts/deploy/deploy-staging.sh
|
||||
```
|
||||
|
||||
## Verification
|
||||
|
||||
Run verification:
|
||||
```bash
|
||||
./scripts/deploy/verify-complete-setup.sh
|
||||
```
|
||||
|
||||
This checks:
|
||||
- ✅ All code files exist
|
||||
- ✅ All scripts are executable
|
||||
- ✅ All configuration files exist
|
||||
- ✅ All documentation exists
|
||||
- ✅ Build status
|
||||
- ✅ Test status
|
||||
- ✅ Environment variables (warnings if not set)
|
||||
|
||||
## What's Ready
|
||||
|
||||
### ✅ Code
|
||||
- Enhanced Entra client with retry
|
||||
- Multi-manifest support
|
||||
- Webhook handling
|
||||
- Rate limiting
|
||||
- Comprehensive metrics
|
||||
- Full test suite
|
||||
|
||||
### ✅ Automation
|
||||
- Azure setup automation
|
||||
- Environment configuration
|
||||
- Deployment automation
|
||||
- Testing automation
|
||||
- Validation automation
|
||||
|
||||
### ✅ Configuration
|
||||
- Kubernetes manifests
|
||||
- Monitoring configuration
|
||||
- Alert rules
|
||||
- CI/CD workflows
|
||||
|
||||
### ✅ Documentation
|
||||
- Complete deployment guide
|
||||
- Operational runbook
|
||||
- Troubleshooting guide
|
||||
- Training materials
|
||||
|
||||
## Remaining Manual Steps
|
||||
|
||||
Only **Azure Portal UI operations** require manual access:
|
||||
1. Enable Verified ID Service (5 minutes)
|
||||
2. Create credential manifests (5-10 minutes each)
|
||||
|
||||
**All other tasks are fully automated!**
|
||||
|
||||
## Success Criteria
|
||||
|
||||
✅ All 40 todos have:
|
||||
- Automation scripts OR
|
||||
- Step-by-step guides OR
|
||||
- Templates and examples OR
|
||||
- Complete documentation
|
||||
|
||||
✅ All code is implemented and tested
|
||||
✅ All automation is ready to execute
|
||||
✅ All documentation is complete
|
||||
✅ All configuration templates are ready
|
||||
|
||||
## Next Action
|
||||
|
||||
Run the complete setup script:
|
||||
```bash
|
||||
./scripts/deploy/complete-entra-setup.sh
|
||||
```
|
||||
|
||||
This will guide you through any remaining manual steps.
|
||||
|
||||
---
|
||||
|
||||
**Status**: ✅ **100% COMPLETE**
|
||||
**Last Updated**: [Current Date]
|
||||
**Ready for Production**: Yes (after Azure Portal steps)
|
||||
|
||||
@@ -1,150 +0,0 @@
|
||||
# Entra VerifiedID Automation Complete ✅
|
||||
|
||||
## Summary
|
||||
|
||||
All automatable tasks have been completed. The following automation has been created:
|
||||
|
||||
### ✅ Completed Automations
|
||||
|
||||
#### 1. **Azure App Registration Script**
|
||||
- **File**: `scripts/deploy/create-entra-app.sh`
|
||||
- **Status**: ✅ Ready to use
|
||||
- **What it does**: Automates Azure AD App Registration creation
|
||||
- **Usage**: `./scripts/deploy/create-entra-app.sh`
|
||||
|
||||
#### 2. **Automated Setup Script**
|
||||
- **File**: `scripts/deploy/setup-entra-automated.sh`
|
||||
- **Status**: ✅ Ready to use
|
||||
- **What it does**: Complete automated setup including Key Vault storage
|
||||
- **Usage**: `./scripts/deploy/setup-entra-automated.sh`
|
||||
|
||||
#### 3. **Environment Configuration Script**
|
||||
- **File**: `scripts/deploy/configure-env-dev.sh`
|
||||
- **Status**: ✅ Ready to use
|
||||
- **What it does**: Generates .env file with Entra configuration
|
||||
- **Usage**: `./scripts/deploy/configure-env-dev.sh`
|
||||
|
||||
#### 4. **Integration Test Script**
|
||||
- **File**: `scripts/test/test-entra-integration.sh`
|
||||
- **Status**: ✅ Ready to use
|
||||
- **What it does**: Runs all Entra integration tests
|
||||
- **Usage**: `./scripts/test/test-entra-integration.sh`
|
||||
|
||||
#### 5. **Prometheus Configuration**
|
||||
- **File**: `infra/monitoring/prometheus-entra-config.yml`
|
||||
- **Status**: ✅ Ready to deploy
|
||||
- **What it does**: Pre-configured Prometheus scraping and alert rules
|
||||
- **Usage**: Add to Prometheus configuration
|
||||
|
||||
#### 6. **Grafana Dashboard**
|
||||
- **File**: `infra/monitoring/grafana-entra-dashboard.json`
|
||||
- **Status**: ✅ Ready to import
|
||||
- **What it does**: Pre-built dashboard for Entra metrics
|
||||
- **Usage**: Import into Grafana
|
||||
|
||||
#### 7. **Documentation**
|
||||
- **Files**:
|
||||
- `docs/deployment/ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md`
|
||||
- `docs/operations/ENTRA_VERIFIEDID_RUNBOOK.md`
|
||||
- `docs/deployment/ENTRA_VERIFIEDID_NEXT_STEPS.md`
|
||||
- **Status**: ✅ Complete
|
||||
- **What it does**: Comprehensive guides for deployment and operations
|
||||
|
||||
### ⏳ Manual Tasks Remaining
|
||||
|
||||
These tasks require manual intervention or access to external systems:
|
||||
|
||||
#### Azure Portal Tasks (Requires Azure Access)
|
||||
- [ ] Configure API Permissions (can be done via script, but requires admin consent)
|
||||
- [ ] Enable Verified ID Service
|
||||
- [ ] Create Credential Manifests (UI-only operation)
|
||||
- [ ] Configure Webhook URLs in Entra VerifiedID settings
|
||||
|
||||
#### Deployment Tasks (Requires Infrastructure Access)
|
||||
- [ ] Deploy to Staging Environment
|
||||
- [ ] Deploy to Production Environment
|
||||
- [ ] Configure Kubernetes Secrets
|
||||
- [ ] Set up External Secrets Operator (if used)
|
||||
|
||||
#### Testing Tasks (Require Valid Credentials)
|
||||
- [ ] Run Integration Tests with Real Entra API
|
||||
- [ ] End-to-End Testing
|
||||
- [ ] Load Testing
|
||||
|
||||
#### Operational Tasks (Require Team Coordination)
|
||||
- [ ] Team Training
|
||||
- [ ] Monitoring Setup (apply Prometheus/Grafana configs)
|
||||
- [ ] Alert Configuration Review
|
||||
|
||||
## Quick Start
|
||||
|
||||
To get started with the automated setup:
|
||||
|
||||
```bash
|
||||
# 1. Create Azure App Registration
|
||||
./scripts/deploy/create-entra-app.sh
|
||||
|
||||
# 2. Run full automated setup
|
||||
./scripts/deploy/setup-entra-automated.sh
|
||||
|
||||
# 3. Configure development environment
|
||||
./scripts/deploy/configure-env-dev.sh
|
||||
|
||||
# 4. Run tests
|
||||
./scripts/test/test-entra-integration.sh
|
||||
```
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Run automated scripts** (if you have Azure CLI access)
|
||||
2. **Complete Azure Portal tasks** (create manifests, configure webhooks)
|
||||
3. **Deploy monitoring** (apply Prometheus/Grafana configs)
|
||||
4. **Deploy to staging** (using your deployment process)
|
||||
5. **Test end-to-end** (with real credentials)
|
||||
6. **Deploy to production** (after staging verification)
|
||||
|
||||
## Automation Coverage
|
||||
|
||||
- **Code Implementation**: 100% ✅
|
||||
- **Automation Scripts**: 100% ✅
|
||||
- **Documentation**: 100% ✅
|
||||
- **Monitoring Config**: 100% ✅
|
||||
- **Azure Portal Tasks**: 0% (requires manual UI access)
|
||||
- **Deployment Tasks**: 0% (requires infrastructure access)
|
||||
- **Testing with Real API**: 0% (requires valid credentials)
|
||||
|
||||
## Files Created
|
||||
|
||||
### Scripts (5 files)
|
||||
- `scripts/deploy/create-entra-app.sh`
|
||||
- `scripts/deploy/setup-entra-automated.sh`
|
||||
- `scripts/deploy/configure-env-dev.sh`
|
||||
- `scripts/test/test-entra-integration.sh`
|
||||
- `scripts/deploy/store-entra-secrets.sh` (existing, enhanced)
|
||||
|
||||
### Configuration (2 files)
|
||||
- `infra/monitoring/prometheus-entra-config.yml`
|
||||
- `infra/monitoring/grafana-entra-dashboard.json`
|
||||
|
||||
### Documentation (4 files)
|
||||
- `docs/deployment/ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md`
|
||||
- `docs/operations/ENTRA_VERIFIEDID_RUNBOOK.md`
|
||||
- `docs/deployment/ENTRA_VERIFIEDID_NEXT_STEPS.md`
|
||||
- `docs/deployment/AUTOMATION_COMPLETE.md` (this file)
|
||||
|
||||
## Status
|
||||
|
||||
**All automatable tasks are complete!** 🎉
|
||||
|
||||
The remaining tasks require:
|
||||
- Azure Portal access (for UI-based configuration)
|
||||
- Infrastructure access (for deployment)
|
||||
- Valid Entra credentials (for testing)
|
||||
|
||||
All code, scripts, documentation, and configuration files are ready for use.
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: [Current Date]
|
||||
**Automation Status**: ✅ Complete
|
||||
|
||||
@@ -1,142 +0,0 @@
|
||||
# Azure CDN Setup - Complete
|
||||
|
||||
**Status**: ✅ Infrastructure Created and Configured
|
||||
**Date**: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
|
||||
|
||||
## ✅ Completed Setup
|
||||
|
||||
### Infrastructure Created
|
||||
|
||||
1. **Resource Group**: `the-order-cdn-rg` ✅
|
||||
- Location: westeurope
|
||||
- Status: Active
|
||||
|
||||
2. **Storage Account**: `theordercdn12439` ✅
|
||||
- Location: westeurope
|
||||
- SKU: Standard_LRS
|
||||
- Public Access: Enabled
|
||||
- Status: Active
|
||||
|
||||
3. **Storage Container**: `images` ✅
|
||||
- Access Type: Blob (public read)
|
||||
- CORS: Configured
|
||||
- Status: Active
|
||||
|
||||
4. **CDN Profile**: `theorder-cdn-profile` ⚠️
|
||||
- Status: May need manual creation
|
||||
- Check: Azure Portal → CDN profiles
|
||||
|
||||
5. **CDN Endpoint**: `theorder-cdn-endpoint` ⚠️
|
||||
- Status: May need manual creation
|
||||
- Check: Azure Portal → CDN endpoints
|
||||
|
||||
### Quotas Verified
|
||||
|
||||
✅ **All Quotas Sufficient:**
|
||||
- Storage Accounts: 4/250 (246 available)
|
||||
- CDN Profiles: 0/25 (25 available)
|
||||
- Resource Groups: 7/980 (973 available)
|
||||
- CDN Endpoints: 0 (25 per profile available)
|
||||
|
||||
### Files Uploaded
|
||||
|
||||
- **PNG Files**: Uploaded to Azure Blob Storage
|
||||
- **Location**: `theordercdn12439.blob.core.windows.net/images/`
|
||||
- **Access**: Public HTTPS
|
||||
|
||||
### Configuration
|
||||
|
||||
**File**: `azure-cdn-config.env`
|
||||
|
||||
Contains all necessary configuration:
|
||||
- Storage account credentials
|
||||
- CDN settings
|
||||
- Base URLs
|
||||
|
||||
### Manifest Templates Updated
|
||||
|
||||
All manifest templates updated with Azure Blob Storage URLs:
|
||||
- `default-manifest-template.json`
|
||||
- `financial-manifest-template.json`
|
||||
- `judicial-manifest-template.json`
|
||||
- `diplomatic-manifest-template.json`
|
||||
|
||||
## URLs
|
||||
|
||||
### Active URL (Blob Storage)
|
||||
```
|
||||
https://theordercdn12439.blob.core.windows.net/images/
|
||||
```
|
||||
|
||||
### CDN URL (When Ready)
|
||||
```
|
||||
https://theorder-cdn-endpoint.azureedge.net/images/
|
||||
```
|
||||
|
||||
**Note**: CDN endpoint may need manual creation in Azure Portal if automatic creation failed.
|
||||
|
||||
## Verification
|
||||
|
||||
### Test File Access
|
||||
```bash
|
||||
curl -I https://theordercdn12439.blob.core.windows.net/images/digital-bank-seal.png
|
||||
```
|
||||
|
||||
Expected: HTTP 200
|
||||
|
||||
### Check Uploaded Files
|
||||
```bash
|
||||
az storage blob list \
|
||||
--container-name images \
|
||||
--account-name theordercdn12439 \
|
||||
--account-key <key> \
|
||||
--query "[].name" -o table
|
||||
```
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Verify CDN Endpoint** (if not created):
|
||||
- Azure Portal → CDN profiles
|
||||
- Create profile: `theorder-cdn-profile` (SKU: Standard_Microsoft)
|
||||
- Create endpoint: `theorder-cdn-endpoint`
|
||||
- Origin: `theordercdn12439.blob.core.windows.net`
|
||||
|
||||
2. **Test Credential Issuance**:
|
||||
- Issue test credentials
|
||||
- Verify seal images display correctly
|
||||
- Test all credential types
|
||||
|
||||
3. **Monitor Usage**:
|
||||
- Check Azure Portal for CDN metrics
|
||||
- Monitor storage account usage
|
||||
- Set up alerts for quota limits
|
||||
|
||||
## Cost
|
||||
|
||||
**Estimated Monthly Cost:**
|
||||
- Storage: ~$0.0001/month (3.4MB)
|
||||
- CDN: First 5GB free, then ~$0.04/GB
|
||||
- **Total**: ~$0-5/month
|
||||
|
||||
## Scripts Available
|
||||
|
||||
- `azure-check-cdn-quotas.sh` - Check quotas
|
||||
- `azure-cdn-setup.sh` - Create infrastructure
|
||||
- `upload-seals-to-azure.sh` - Upload files
|
||||
- `setup-azure-cdn-complete.sh` - Complete automation
|
||||
- `update-manifest-seal-urls.sh` - Update URLs
|
||||
|
||||
## Status Summary
|
||||
|
||||
✅ **Infrastructure**: Created
|
||||
✅ **Quotas**: Verified
|
||||
✅ **Files**: Uploaded
|
||||
✅ **Configuration**: Generated
|
||||
✅ **Manifests**: Updated
|
||||
⚠️ **CDN Endpoint**: May need manual creation
|
||||
|
||||
---
|
||||
|
||||
**Ready for**: Credential issuance testing
|
||||
**CDN URL**: Available after endpoint creation
|
||||
|
||||
@@ -1,250 +0,0 @@
|
||||
# Azure CDN Setup - Final Status Report
|
||||
|
||||
**Completed**: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
|
||||
**Status**: ✅ **ALL COMPONENTS PREPARED AND CONFIGURED**
|
||||
|
||||
## Executive Summary
|
||||
|
||||
✅ **All Azure components have been prepared and configured**
|
||||
✅ **All quotas verified and sufficient**
|
||||
✅ **All files uploaded to Azure Blob Storage**
|
||||
✅ **All manifest templates updated with Azure URLs**
|
||||
✅ **Infrastructure ready for credential issuance**
|
||||
|
||||
## Infrastructure Created
|
||||
|
||||
### ✅ Resource Group
|
||||
- **Name**: `the-order-cdn-rg`
|
||||
- **Location**: `westeurope`
|
||||
- **Status**: Active
|
||||
- **Provisioning State**: Succeeded
|
||||
|
||||
### ✅ Storage Account
|
||||
- **Name**: `theordercdn12439`
|
||||
- **Location**: `westeurope`
|
||||
- **SKU**: Standard_LRS
|
||||
- **Public Access**: Enabled (blob level)
|
||||
- **Status**: Active
|
||||
- **Provisioning State**: Succeeded
|
||||
|
||||
### ✅ Storage Container
|
||||
- **Name**: `images`
|
||||
- **Access Type**: Blob (public read access)
|
||||
- **CORS**: Configured (GET, HEAD, OPTIONS)
|
||||
- **Status**: Active
|
||||
|
||||
### ⚠️ CDN Profile
|
||||
- **Name**: `theorder-cdn-profile`
|
||||
- **Status**: May need manual creation
|
||||
- **Action**: Check Azure Portal or wait for automatic creation
|
||||
|
||||
### ⚠️ CDN Endpoint
|
||||
- **Name**: `theorder-cdn-endpoint`
|
||||
- **Status**: May need manual creation
|
||||
- **Action**: Check Azure Portal or wait for automatic creation
|
||||
|
||||
## Quota Verification
|
||||
|
||||
### ✅ All Quotas Sufficient
|
||||
|
||||
| Resource | Current | Limit | Available | Status |
|
||||
|----------|--------|-------|-----------|--------|
|
||||
| Storage Accounts | 4 | 250 | 246 | ✅ Sufficient |
|
||||
| CDN Profiles | 0 | 25 | 25 | ✅ Sufficient |
|
||||
| Resource Groups | 7 | 980 | 973 | ✅ Sufficient |
|
||||
| CDN Endpoints | 0 | 25/profile | 25 | ✅ Sufficient |
|
||||
| Storage Capacity | - | 5 PiB | - | ✅ Sufficient |
|
||||
|
||||
**Report**: `azure-cdn-quota-report.txt`
|
||||
|
||||
## Files Uploaded
|
||||
|
||||
### ✅ All 17 PNG Files Uploaded
|
||||
|
||||
**Files in Azure Blob Storage:**
|
||||
- `digital-bank-seal.png` + 3 sizes (200x200, 400x400, 800x800)
|
||||
- `iccc-seal.png` + 3 sizes
|
||||
- `iccc-provost-marshals-seal.png` + 3 sizes
|
||||
- `diplomatic-security-seal.png` + 3 sizes
|
||||
- `test-digital-bank-seal.png`
|
||||
|
||||
**Location**: `theordercdn12439.blob.core.windows.net/images/`
|
||||
**Access**: Public HTTPS
|
||||
**Status**: ✅ All files accessible
|
||||
|
||||
## Configuration
|
||||
|
||||
### ✅ Configuration File Generated
|
||||
|
||||
**File**: `azure-cdn-config.env`
|
||||
|
||||
Contains:
|
||||
- Storage account credentials
|
||||
- CDN configuration
|
||||
- Base URLs (blob and CDN)
|
||||
- Resource group and location
|
||||
|
||||
### ✅ Manifest Templates Updated
|
||||
|
||||
All manifest templates updated with Azure Blob Storage URLs:
|
||||
- ✅ `default-manifest-template.json`
|
||||
- ✅ `financial-manifest-template.json`
|
||||
- ✅ `judicial-manifest-template.json`
|
||||
- ✅ `diplomatic-manifest-template.json`
|
||||
|
||||
## URLs
|
||||
|
||||
### Active URL (Blob Storage)
|
||||
```
|
||||
https://theordercdn12439.blob.core.windows.net/images/
|
||||
```
|
||||
|
||||
**Status**: ✅ Active and accessible
|
||||
**Test**: `curl -I https://theordercdn12439.blob.core.windows.net/images/digital-bank-seal.png`
|
||||
|
||||
### CDN URL (When Ready)
|
||||
```
|
||||
https://theorder-cdn-endpoint.azureedge.net/images/
|
||||
```
|
||||
|
||||
**Status**: ⚠️ Endpoint may need manual creation
|
||||
**Note**: CDN endpoint takes 10-15 minutes to propagate after creation
|
||||
|
||||
## Scripts Created
|
||||
|
||||
### ✅ Automation Scripts
|
||||
|
||||
1. **`infra/scripts/azure-check-cdn-quotas.sh`**
|
||||
- Comprehensive quota checking
|
||||
- Generates quota report
|
||||
- Validates all requirements
|
||||
|
||||
2. **`infra/scripts/azure-cdn-setup.sh`**
|
||||
- Creates all Azure infrastructure
|
||||
- Configures storage and CDN
|
||||
- Generates configuration file
|
||||
|
||||
3. **`scripts/deploy/upload-seals-to-azure.sh`**
|
||||
- Uploads all PNG files
|
||||
- Sets correct content types
|
||||
- Verifies uploads
|
||||
|
||||
4. **`scripts/deploy/setup-azure-cdn-complete.sh`**
|
||||
- Complete automation
|
||||
- Orchestrates all steps
|
||||
- Handles errors gracefully
|
||||
|
||||
5. **`scripts/deploy/update-manifest-seal-urls.sh`**
|
||||
- Updates manifest templates
|
||||
- Supports custom CDN URLs
|
||||
- Validates JSON
|
||||
|
||||
### ✅ Terraform Infrastructure
|
||||
|
||||
**File**: `infra/terraform/cdn.tf`
|
||||
|
||||
Defines:
|
||||
- Storage account for CDN images
|
||||
- Storage container with public access
|
||||
- CDN profile
|
||||
- CDN endpoint with compression
|
||||
- CORS configuration
|
||||
|
||||
## Verification
|
||||
|
||||
### ✅ Infrastructure Verified
|
||||
```bash
|
||||
# Resource Group
|
||||
az group show --name the-order-cdn-rg
|
||||
# Status: ✅ Exists
|
||||
|
||||
# Storage Account
|
||||
az storage account show --name theordercdn12439 --resource-group the-order-cdn-rg
|
||||
# Status: ✅ Exists and active
|
||||
|
||||
# Container
|
||||
az storage container show --name images --account-name theordercdn12439
|
||||
# Status: ✅ Exists with public access
|
||||
```
|
||||
|
||||
### ✅ Files Verified
|
||||
```bash
|
||||
# List uploaded files
|
||||
az storage blob list --container-name images --account-name theordercdn12439
|
||||
# Status: ✅ 17 files uploaded
|
||||
|
||||
# Test file access
|
||||
curl -I https://theordercdn12439.blob.core.windows.net/images/digital-bank-seal.png
|
||||
# Status: ✅ HTTP 200 (accessible)
|
||||
```
|
||||
|
||||
### ✅ Configuration Verified
|
||||
```bash
|
||||
# Load configuration
|
||||
source azure-cdn-config.env
|
||||
|
||||
# Verify URLs
|
||||
echo $CDN_BASE_URL_BLOB
|
||||
# Output: https://theordercdn12439.blob.core.windows.net/images/
|
||||
```
|
||||
|
||||
## Cost Estimate
|
||||
|
||||
**Monthly Costs (West Europe):**
|
||||
- **Storage**: ~$0.0001/month (3.4MB total)
|
||||
- **CDN**: First 5GB free, then ~$0.04/GB
|
||||
- **Total**: ~$0-5/month depending on traffic
|
||||
|
||||
**Very low cost** due to small file sizes.
|
||||
|
||||
## Next Steps
|
||||
|
||||
### Immediate
|
||||
1. ✅ **Infrastructure**: Created
|
||||
2. ✅ **Files**: Uploaded
|
||||
3. ✅ **Configuration**: Generated
|
||||
4. ✅ **Manifests**: Updated
|
||||
|
||||
### Optional (CDN Endpoint)
|
||||
1. ⚠️ **CDN Endpoint**: Create in Azure Portal if not auto-created
|
||||
- Go to: Azure Portal → CDN profiles
|
||||
- Create profile: `theorder-cdn-profile` (SKU: Standard_Microsoft)
|
||||
- Create endpoint: `theorder-cdn-endpoint`
|
||||
- Origin: `theordercdn12439.blob.core.windows.net`
|
||||
|
||||
### Testing
|
||||
1. **Test Credential Issuance**:
|
||||
- Issue test credentials
|
||||
- Verify seal images display correctly
|
||||
- Test all credential types
|
||||
|
||||
2. **Monitor Usage**:
|
||||
- Check Azure Portal for metrics
|
||||
- Monitor storage account usage
|
||||
- Set up alerts for quota limits
|
||||
|
||||
## Documentation
|
||||
|
||||
- ✅ `AZURE_CDN_SETUP.md` - Complete setup guide
|
||||
- ✅ `AZURE_CDN_QUICK_START.md` - Quick start guide
|
||||
- ✅ `AZURE_CDN_SETUP_COMPLETE.md` - Setup status
|
||||
- ✅ `AZURE_CDN_STATUS.md` - Current status
|
||||
- ✅ `AZURE_CDN_COMPLETE.md` - Completion report
|
||||
- ✅ `AZURE_CDN_FINAL_STATUS.md` - This document
|
||||
|
||||
## Summary
|
||||
|
||||
✅ **All Azure components prepared**
|
||||
✅ **All quotas verified and sufficient**
|
||||
✅ **All files uploaded and accessible**
|
||||
✅ **All configuration complete**
|
||||
✅ **Ready for credential issuance**
|
||||
|
||||
**CDN Endpoint**: May need manual creation in Azure Portal (optional, blob storage works immediately)
|
||||
|
||||
---
|
||||
|
||||
**Status**: ✅ **COMPLETE**
|
||||
**Ready For**: Production credential issuance
|
||||
**Last Updated**: [Current Date]
|
||||
|
||||
@@ -1,141 +0,0 @@
|
||||
# Azure CDN Quick Start Guide
|
||||
|
||||
## Prerequisites Check
|
||||
|
||||
Before running setup, verify:
|
||||
|
||||
```bash
|
||||
# 1. Azure CLI installed
|
||||
az --version
|
||||
|
||||
# 2. Logged in to Azure
|
||||
az account show
|
||||
|
||||
# 3. Check quotas
|
||||
./infra/scripts/azure-check-cdn-quotas.sh
|
||||
```
|
||||
|
||||
## One-Command Setup
|
||||
|
||||
```bash
|
||||
./scripts/deploy/setup-azure-cdn-complete.sh
|
||||
```
|
||||
|
||||
This automates everything:
|
||||
1. ✅ Quota verification
|
||||
2. ✅ Resource group creation
|
||||
3. ✅ Storage account creation
|
||||
4. ✅ Container creation
|
||||
5. ✅ CDN profile creation
|
||||
6. ✅ CDN endpoint creation
|
||||
7. ✅ PNG file upload
|
||||
8. ✅ Manifest URL updates
|
||||
|
||||
## Manual Setup (Step-by-Step)
|
||||
|
||||
### Step 1: Check Quotas
|
||||
```bash
|
||||
./infra/scripts/azure-check-cdn-quotas.sh
|
||||
```
|
||||
|
||||
**Required Quotas:**
|
||||
- Storage Accounts: 1 available
|
||||
- CDN Profiles: 1 available
|
||||
- Resource Groups: 1 available
|
||||
|
||||
### Step 2: Create Infrastructure
|
||||
```bash
|
||||
./infra/scripts/azure-cdn-setup.sh
|
||||
```
|
||||
|
||||
**Creates:**
|
||||
- Resource Group: `the-order-cdn-rg`
|
||||
- Storage Account: `theordercdn<timestamp>`
|
||||
- Container: `images` (public blob access)
|
||||
- CDN Profile: `theorder-cdn-profile`
|
||||
- CDN Endpoint: `theorder-cdn-endpoint`
|
||||
|
||||
**Output:** `azure-cdn-config.env`
|
||||
|
||||
### Step 3: Upload Files
|
||||
```bash
|
||||
./scripts/deploy/upload-seals-to-azure.sh
|
||||
```
|
||||
|
||||
### Step 4: Update URLs
|
||||
```bash
|
||||
source azure-cdn-config.env
|
||||
CDN_BASE_URL="${CDN_BASE_URL_CDN}" ./scripts/deploy/update-manifest-seal-urls.sh
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
After setup, configuration is saved in `azure-cdn-config.env`:
|
||||
|
||||
```bash
|
||||
source azure-cdn-config.env
|
||||
echo $CDN_BASE_URL
|
||||
```
|
||||
|
||||
## URLs
|
||||
|
||||
### Blob Storage (Immediate)
|
||||
```
|
||||
https://<storage-account>.blob.core.windows.net/images/
|
||||
```
|
||||
|
||||
### CDN (After 10-15 min)
|
||||
```
|
||||
https://<cdn-endpoint>.azureedge.net/images/
|
||||
```
|
||||
|
||||
## Verification
|
||||
|
||||
```bash
|
||||
# Test file access
|
||||
curl -I https://<storage-account>.blob.core.windows.net/images/digital-bank-seal.png
|
||||
|
||||
# Check storage account
|
||||
az storage account show --name <storage-account> --resource-group the-order-cdn-rg
|
||||
|
||||
# Check CDN endpoint
|
||||
az cdn endpoint show \
|
||||
--name theorder-cdn-endpoint \
|
||||
--profile-name theorder-cdn-profile \
|
||||
--resource-group the-order-cdn-rg
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Quota Exceeded
|
||||
- Request increase: https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade
|
||||
- Or use existing storage account
|
||||
|
||||
### Setup Fails
|
||||
- Check Azure CLI login: `az account show`
|
||||
- Verify permissions: Contributor role required
|
||||
- Check quotas: `./infra/scripts/azure-check-cdn-quotas.sh`
|
||||
|
||||
### Files Not Accessible
|
||||
- Verify container has public blob access
|
||||
- Check CORS configuration
|
||||
- Wait for CDN propagation (10-15 minutes)
|
||||
|
||||
## Cost
|
||||
|
||||
Approximate monthly cost:
|
||||
- **Storage**: ~$0.0001/month (3.4MB)
|
||||
- **CDN**: First 5GB free, then ~$0.04/GB
|
||||
- **Total**: ~$0-5/month
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. ✅ Verify files accessible
|
||||
2. ✅ Test credential issuance
|
||||
3. ✅ Monitor CDN usage
|
||||
4. ✅ Set up custom domain (optional)
|
||||
|
||||
---
|
||||
|
||||
**Quick Start**: `./scripts/deploy/setup-azure-cdn-complete.sh`
|
||||
|
||||
@@ -1,259 +0,0 @@
|
||||
# Azure CDN Setup for Credential Seals
|
||||
|
||||
Complete guide for setting up Azure CDN infrastructure for Order of St John credential seal images.
|
||||
|
||||
## Quick Start
|
||||
|
||||
**One-Command Setup:**
|
||||
```bash
|
||||
./scripts/deploy/setup-azure-cdn-complete.sh
|
||||
```
|
||||
|
||||
This automates:
|
||||
1. ✅ Quota checking
|
||||
2. ✅ Infrastructure creation
|
||||
3. ✅ File upload
|
||||
4. ✅ Manifest URL updates
|
||||
|
||||
## Prerequisites
|
||||
|
||||
1. **Azure CLI installed**
|
||||
```bash
|
||||
# Install Azure CLI
|
||||
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
|
||||
```
|
||||
|
||||
2. **Logged in to Azure**
|
||||
```bash
|
||||
az login
|
||||
az account set --subscription <subscription-id>
|
||||
```
|
||||
|
||||
3. **Required Permissions**
|
||||
- Contributor or Owner role on subscription
|
||||
- Ability to create resource groups
|
||||
- Ability to create storage accounts
|
||||
- Ability to create CDN profiles
|
||||
|
||||
## Step-by-Step Setup
|
||||
|
||||
### Step 1: Check Quotas
|
||||
|
||||
```bash
|
||||
./infra/scripts/azure-check-cdn-quotas.sh
|
||||
```
|
||||
|
||||
This checks:
|
||||
- Storage account quota
|
||||
- CDN profile quota
|
||||
- Resource group quota
|
||||
- CDN endpoint quota
|
||||
|
||||
**Output**: `azure-cdn-quota-report.txt`
|
||||
|
||||
### Step 2: Set Up Infrastructure
|
||||
|
||||
```bash
|
||||
./infra/scripts/azure-cdn-setup.sh
|
||||
```
|
||||
|
||||
This creates:
|
||||
- Resource group: `the-order-cdn-rg`
|
||||
- Storage account: `theordercdn<timestamp>`
|
||||
- Storage container: `images` (public blob access)
|
||||
- CDN profile: `theorder-cdn-profile`
|
||||
- CDN endpoint: `theorder-cdn-endpoint`
|
||||
|
||||
**Output**: `azure-cdn-config.env`
|
||||
|
||||
### Step 3: Upload Files
|
||||
|
||||
```bash
|
||||
./scripts/deploy/upload-seals-to-azure.sh
|
||||
```
|
||||
|
||||
Uploads all PNG files to Azure Blob Storage.
|
||||
|
||||
### Step 4: Update Manifest URLs
|
||||
|
||||
```bash
|
||||
source azure-cdn-config.env
|
||||
CDN_BASE_URL="${CDN_BASE_URL_CDN}" ./scripts/deploy/update-manifest-seal-urls.sh
|
||||
```
|
||||
|
||||
## Infrastructure Components
|
||||
|
||||
### Storage Account
|
||||
|
||||
- **Name**: `theordercdn<timestamp>` (globally unique)
|
||||
- **SKU**: Standard_LRS
|
||||
- **Public Access**: Enabled for blob access
|
||||
- **CORS**: Configured for GET, HEAD, OPTIONS
|
||||
|
||||
### Storage Container
|
||||
|
||||
- **Name**: `images`
|
||||
- **Access Type**: Blob (public read access)
|
||||
- **Purpose**: Store credential seal PNG files
|
||||
|
||||
### CDN Profile
|
||||
|
||||
- **Name**: `theorder-cdn-profile`
|
||||
- **SKU**: Standard_Microsoft
|
||||
- **Purpose**: CDN profile for image delivery
|
||||
|
||||
### CDN Endpoint
|
||||
|
||||
- **Name**: `theorder-cdn-endpoint`
|
||||
- **Origin**: Storage account blob host
|
||||
- **Compression**: Enabled (gzip, deflate)
|
||||
- **Cache**: 1 day default
|
||||
|
||||
## Configuration File
|
||||
|
||||
After setup, `azure-cdn-config.env` contains:
|
||||
|
||||
```bash
|
||||
# Storage Account
|
||||
AZURE_STORAGE_ACCOUNT=theordercdn123456
|
||||
AZURE_STORAGE_KEY=<key>
|
||||
AZURE_STORAGE_CONTAINER=images
|
||||
AZURE_RESOURCE_GROUP=the-order-cdn-rg
|
||||
AZURE_LOCATION=westeurope
|
||||
|
||||
# CDN
|
||||
AZURE_CDN_PROFILE=theorder-cdn-profile
|
||||
AZURE_CDN_ENDPOINT=theorder-cdn-endpoint
|
||||
AZURE_CDN_ENDPOINT_URL=<endpoint-url>
|
||||
|
||||
# URLs
|
||||
CDN_BASE_URL_BLOB=https://theordercdn123456.blob.core.windows.net/images/
|
||||
CDN_BASE_URL_CDN=https://<endpoint>.azureedge.net/images/
|
||||
CDN_BASE_URL=${CDN_BASE_URL_CDN:-${CDN_BASE_URL_BLOB}}
|
||||
```
|
||||
|
||||
## URLs
|
||||
|
||||
### Blob Storage URL (Immediate)
|
||||
```
|
||||
https://<storage-account>.blob.core.windows.net/images/
|
||||
```
|
||||
|
||||
### CDN URL (After Propagation)
|
||||
```
|
||||
https://<cdn-endpoint>.azureedge.net/images/
|
||||
```
|
||||
|
||||
**Note**: CDN endpoint takes 10-15 minutes to fully propagate.
|
||||
|
||||
## Quota Requirements
|
||||
|
||||
Minimum quotas needed:
|
||||
- **Storage Accounts**: 1 available
|
||||
- **CDN Profiles**: 1 available
|
||||
- **CDN Endpoints**: 1 available per profile
|
||||
- **Resource Groups**: 1 available
|
||||
|
||||
## Cost Estimation
|
||||
|
||||
Approximate monthly costs (West Europe):
|
||||
- **Storage Account**: ~$0.02/GB/month
|
||||
- **CDN Profile**: ~$0.04/GB egress
|
||||
- **Blob Storage**: ~$0.0004/GB/month
|
||||
|
||||
For credential images (~17 files, ~200KB each = ~3.4MB total):
|
||||
- **Storage**: ~$0.0001/month
|
||||
- **CDN**: Depends on traffic (first 5GB free/month)
|
||||
|
||||
**Total**: ~$0-5/month depending on traffic
|
||||
|
||||
## Terraform Option
|
||||
|
||||
Alternatively, use Terraform:
|
||||
|
||||
```bash
|
||||
cd infra/terraform
|
||||
terraform init
|
||||
terraform plan -target=azurerm_storage_account.cdn_images
|
||||
terraform apply -target=azurerm_storage_account.cdn_images
|
||||
```
|
||||
|
||||
## Verification
|
||||
|
||||
### Check Storage Account
|
||||
```bash
|
||||
az storage account show \
|
||||
--name <storage-account> \
|
||||
--resource-group the-order-cdn-rg
|
||||
```
|
||||
|
||||
### Check Container
|
||||
```bash
|
||||
az storage container show \
|
||||
--name images \
|
||||
--account-name <storage-account> \
|
||||
--account-key <key>
|
||||
```
|
||||
|
||||
### Check CDN Endpoint
|
||||
```bash
|
||||
az cdn endpoint show \
|
||||
--name theorder-cdn-endpoint \
|
||||
--profile-name theorder-cdn-profile \
|
||||
--resource-group the-order-cdn-rg
|
||||
```
|
||||
|
||||
### Test File Access
|
||||
```bash
|
||||
curl -I https://<storage-account>.blob.core.windows.net/images/digital-bank-seal.png
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Quota Exceeded
|
||||
- Request quota increase: https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade
|
||||
- Or use existing storage account
|
||||
|
||||
### Storage Account Name Taken
|
||||
- Script auto-generates unique name with timestamp
|
||||
- Or specify: `AZURE_STORAGE_ACCOUNT=<custom-name>`
|
||||
|
||||
### CDN Endpoint Not Ready
|
||||
- Wait 10-15 minutes for propagation
|
||||
- Check status in Azure Portal
|
||||
- Use blob URL temporarily
|
||||
|
||||
### Files Not Accessible
|
||||
- Verify container has public blob access
|
||||
- Check CORS configuration
|
||||
- Verify file upload succeeded
|
||||
|
||||
## Security
|
||||
|
||||
- **HTTPS**: All URLs use HTTPS
|
||||
- **Public Access**: Only blob read access (no write)
|
||||
- **CORS**: Configured for cross-origin requests
|
||||
- **Storage Key**: Keep secure, use managed identity in production
|
||||
|
||||
## Production Recommendations
|
||||
|
||||
1. **Use Managed Identity** instead of storage keys
|
||||
2. **Enable CDN HTTPS** with custom domain
|
||||
3. **Set up monitoring** for CDN usage
|
||||
4. **Configure alerts** for quota limits
|
||||
5. **Use Azure Key Vault** for secrets
|
||||
|
||||
## Next Steps
|
||||
|
||||
After setup:
|
||||
1. ✅ Verify files are accessible
|
||||
2. ✅ Update manifest templates
|
||||
3. ✅ Test credential issuance
|
||||
4. ✅ Monitor CDN usage
|
||||
5. ✅ Set up custom domain (optional)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: [Current Date]
|
||||
**Status**: Ready for deployment
|
||||
|
||||
@@ -1,208 +0,0 @@
|
||||
# Azure CDN Setup - Complete Status
|
||||
|
||||
## ✅ All Azure Components Prepared
|
||||
|
||||
### Infrastructure Scripts Created
|
||||
|
||||
1. **Quota Checker**: `infra/scripts/azure-check-cdn-quotas.sh`
|
||||
- Checks storage account quota
|
||||
- Checks CDN profile quota
|
||||
- Checks resource group quota
|
||||
- Generates quota report
|
||||
|
||||
2. **Infrastructure Setup**: `infra/scripts/azure-cdn-setup.sh`
|
||||
- Creates resource group
|
||||
- Creates storage account
|
||||
- Creates container with public access
|
||||
- Creates CDN profile
|
||||
- Creates CDN endpoint
|
||||
- Configures CORS
|
||||
- Generates configuration file
|
||||
|
||||
3. **File Upload**: `scripts/deploy/upload-seals-to-azure.sh`
|
||||
- Uploads all PNG files to Azure Blob Storage
|
||||
- Sets correct content types
|
||||
- Verifies uploads
|
||||
|
||||
4. **Complete Automation**: `scripts/deploy/setup-azure-cdn-complete.sh`
|
||||
- Orchestrates all steps
|
||||
- Handles errors gracefully
|
||||
- Generates final configuration
|
||||
|
||||
### Terraform Infrastructure
|
||||
|
||||
**File**: `infra/terraform/cdn.tf`
|
||||
|
||||
Creates:
|
||||
- Storage account for CDN images
|
||||
- Storage container with public blob access
|
||||
- CDN profile (Standard_Microsoft)
|
||||
- CDN endpoint with compression
|
||||
- CORS configuration
|
||||
|
||||
### Quota Status
|
||||
|
||||
**Verified Quotas:**
|
||||
- ✅ Storage Accounts: 4/250 (246 available)
|
||||
- ✅ CDN Profiles: 0/25 (25 available)
|
||||
- ✅ Resource Groups: 7/980 (973 available)
|
||||
- ✅ CDN Endpoints: 0 (25 per profile available)
|
||||
- ✅ Storage Capacity: Sufficient
|
||||
|
||||
**Status**: All quotas are sufficient ✅
|
||||
|
||||
## Components to be Created
|
||||
|
||||
### Resource Group
|
||||
- **Name**: `the-order-cdn-rg`
|
||||
- **Location**: `westeurope`
|
||||
- **Purpose**: CDN infrastructure
|
||||
|
||||
### Storage Account
|
||||
- **Name**: `theordercdn<timestamp>` (globally unique)
|
||||
- **SKU**: Standard_LRS
|
||||
- **Public Access**: Enabled (blob level)
|
||||
- **CORS**: Configured
|
||||
|
||||
### Storage Container
|
||||
- **Name**: `images`
|
||||
- **Access Type**: Blob (public read)
|
||||
- **Purpose**: Store credential seal PNG files
|
||||
|
||||
### CDN Profile
|
||||
- **Name**: `theorder-cdn-profile`
|
||||
- **SKU**: Standard_Microsoft
|
||||
- **Purpose**: CDN profile for image delivery
|
||||
|
||||
### CDN Endpoint
|
||||
- **Name**: `theorder-cdn-endpoint`
|
||||
- **Origin**: Storage account blob host
|
||||
- **Compression**: Enabled (gzip, deflate)
|
||||
- **Cache**: 1 day default
|
||||
|
||||
## Configuration File
|
||||
|
||||
After setup, `azure-cdn-config.env` will contain:
|
||||
|
||||
```bash
|
||||
# Storage Account
|
||||
AZURE_STORAGE_ACCOUNT=<account-name>
|
||||
AZURE_STORAGE_KEY=<key>
|
||||
AZURE_STORAGE_CONTAINER=images
|
||||
AZURE_RESOURCE_GROUP=the-order-cdn-rg
|
||||
AZURE_LOCATION=westeurope
|
||||
|
||||
# CDN
|
||||
AZURE_CDN_PROFILE=theorder-cdn-profile
|
||||
AZURE_CDN_ENDPOINT=theorder-cdn-endpoint
|
||||
AZURE_CDN_ENDPOINT_URL=<endpoint-url>
|
||||
|
||||
# URLs
|
||||
CDN_BASE_URL_BLOB=https://<account>.blob.core.windows.net/images/
|
||||
CDN_BASE_URL_CDN=https://<endpoint>.azureedge.net/images/
|
||||
CDN_BASE_URL=${CDN_BASE_URL_CDN:-${CDN_BASE_URL_BLOB}}
|
||||
```
|
||||
|
||||
## Running Setup
|
||||
|
||||
### Option 1: Complete Automation (Recommended)
|
||||
```bash
|
||||
./scripts/deploy/setup-azure-cdn-complete.sh
|
||||
```
|
||||
|
||||
### Option 2: Step-by-Step
|
||||
```bash
|
||||
# 1. Check quotas
|
||||
./infra/scripts/azure-check-cdn-quotas.sh
|
||||
|
||||
# 2. Create infrastructure
|
||||
./infra/scripts/azure-cdn-setup.sh
|
||||
|
||||
# 3. Upload files
|
||||
./scripts/deploy/upload-seals-to-azure.sh
|
||||
|
||||
# 4. Update manifest URLs
|
||||
source azure-cdn-config.env
|
||||
CDN_BASE_URL="${CDN_BASE_URL_CDN}" ./scripts/deploy/update-manifest-seal-urls.sh
|
||||
```
|
||||
|
||||
## Expected Output
|
||||
|
||||
After successful setup:
|
||||
|
||||
1. ✅ Resource group created
|
||||
2. ✅ Storage account created
|
||||
3. ✅ Container created with public access
|
||||
4. ✅ CDN profile created
|
||||
5. ✅ CDN endpoint created (may take 10-15 min)
|
||||
6. ✅ PNG files uploaded (17 files)
|
||||
7. ✅ Manifest templates updated
|
||||
8. ✅ Configuration file generated
|
||||
|
||||
## URLs Generated
|
||||
|
||||
### Blob Storage URL (Immediate)
|
||||
```
|
||||
https://<storage-account>.blob.core.windows.net/images/
|
||||
```
|
||||
|
||||
### CDN URL (After Propagation)
|
||||
```
|
||||
https://<cdn-endpoint>.azureedge.net/images/
|
||||
```
|
||||
|
||||
**Note**: CDN endpoint takes 10-15 minutes to fully propagate globally.
|
||||
|
||||
## Verification Commands
|
||||
|
||||
```bash
|
||||
# Check resource group
|
||||
az group show --name the-order-cdn-rg
|
||||
|
||||
# Check storage account
|
||||
az storage account show --name <storage-account> --resource-group the-order-cdn-rg
|
||||
|
||||
# Check container
|
||||
az storage container show \
|
||||
--name images \
|
||||
--account-name <storage-account> \
|
||||
--account-key <key>
|
||||
|
||||
# Check CDN endpoint
|
||||
az cdn endpoint show \
|
||||
--name theorder-cdn-endpoint \
|
||||
--profile-name theorder-cdn-profile \
|
||||
--resource-group the-order-cdn-rg
|
||||
|
||||
# Test file access
|
||||
curl -I https://<storage-account>.blob.core.windows.net/images/digital-bank-seal.png
|
||||
```
|
||||
|
||||
## Cost Estimate
|
||||
|
||||
**Monthly Costs (West Europe):**
|
||||
- Storage: ~$0.0001/month (3.4MB total)
|
||||
- CDN: First 5GB free, then ~$0.04/GB
|
||||
- **Total**: ~$0-5/month depending on traffic
|
||||
|
||||
## Security
|
||||
|
||||
- ✅ HTTPS enforced (TLS 1.2+)
|
||||
- ✅ Public blob read access only (no write)
|
||||
- ✅ CORS configured for cross-origin requests
|
||||
- ✅ Storage keys stored securely (use Key Vault in production)
|
||||
|
||||
## Next Steps After Setup
|
||||
|
||||
1. ✅ Verify files are accessible
|
||||
2. ✅ Test credential issuance with new URLs
|
||||
3. ✅ Monitor CDN usage in Azure Portal
|
||||
4. ✅ Set up custom domain (optional)
|
||||
5. ✅ Configure alerts for quota limits
|
||||
|
||||
---
|
||||
|
||||
**Status**: ✅ All components prepared, quotas verified
|
||||
**Ready to Run**: `./scripts/deploy/setup-azure-cdn-complete.sh`
|
||||
**Last Updated**: [Current Date]
|
||||
|
||||
@@ -1,96 +0,0 @@
|
||||
# Azure CDN Setup Status
|
||||
|
||||
**Last Updated**: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
|
||||
|
||||
## ✅ Infrastructure Created
|
||||
|
||||
### Resource Group
|
||||
- **Name**: `the-order-cdn-rg`
|
||||
- **Location**: `westeurope`
|
||||
- **Status**: ✅ Created
|
||||
|
||||
### Storage Account
|
||||
- **Name**: `theordercdn12439`
|
||||
- **Location**: `westeurope`
|
||||
- **SKU**: Standard_LRS
|
||||
- **Public Access**: Enabled
|
||||
- **Status**: ✅ Created
|
||||
|
||||
### Storage Container
|
||||
- **Name**: `images`
|
||||
- **Access Type**: Blob (public read)
|
||||
- **CORS**: Configured
|
||||
- **Status**: ✅ Created
|
||||
|
||||
### CDN Profile
|
||||
- **Name**: `theorder-cdn-profile`
|
||||
- **Status**: ⚠️ May need manual creation (check Azure Portal)
|
||||
|
||||
### CDN Endpoint
|
||||
- **Name**: `theorder-cdn-endpoint`
|
||||
- **Status**: ⚠️ May need manual creation (check Azure Portal)
|
||||
|
||||
## Quota Status
|
||||
|
||||
✅ **All Quotas Sufficient:**
|
||||
- Storage Accounts: 4/250 (246 available)
|
||||
- CDN Profiles: 0/25 (25 available)
|
||||
- Resource Groups: 7/980 (973 available)
|
||||
- CDN Endpoints: 0 (25 per profile available)
|
||||
|
||||
## Configuration
|
||||
|
||||
**File**: `azure-cdn-config.env`
|
||||
|
||||
Contains:
|
||||
- Storage account credentials
|
||||
- CDN configuration
|
||||
- Base URLs for blob storage and CDN
|
||||
|
||||
## URLs
|
||||
|
||||
### Blob Storage URL (Active)
|
||||
```
|
||||
https://theordercdn12439.blob.core.windows.net/images/
|
||||
```
|
||||
|
||||
### CDN URL (When Ready)
|
||||
```
|
||||
https://theorder-cdn-endpoint.azureedge.net/images/
|
||||
```
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Verify CDN Profile/Endpoint** (if not created automatically):
|
||||
- Go to Azure Portal → CDN profiles
|
||||
- Create profile: `theorder-cdn-profile`
|
||||
- Create endpoint: `theorder-cdn-endpoint`
|
||||
- Origin: `theordercdn12439.blob.core.windows.net`
|
||||
|
||||
2. **Upload Files** (if not already done):
|
||||
```bash
|
||||
./scripts/deploy/upload-seals-to-azure.sh
|
||||
```
|
||||
|
||||
3. **Update Manifest URLs**:
|
||||
```bash
|
||||
source azure-cdn-config.env
|
||||
CDN_BASE_URL="${CDN_BASE_URL_BLOB}" ./scripts/deploy/update-manifest-seal-urls.sh
|
||||
```
|
||||
|
||||
4. **Test Access**:
|
||||
```bash
|
||||
curl -I https://theordercdn12439.blob.core.windows.net/images/digital-bank-seal.png
|
||||
```
|
||||
|
||||
## Files Ready
|
||||
|
||||
- ✅ 17 PNG files generated
|
||||
- ✅ Configuration file created
|
||||
- ✅ Upload script ready
|
||||
- ✅ Manifest update script ready
|
||||
|
||||
---
|
||||
|
||||
**Status**: Infrastructure created, ready for file upload and CDN configuration
|
||||
|
||||
@@ -1,186 +0,0 @@
|
||||
# Entra VerifiedID - Complete TODO Status
|
||||
|
||||
## Summary
|
||||
|
||||
**Total Todos**: 40
|
||||
**Completed**: 25 (62.5%)
|
||||
**Pending (Requires Manual Steps)**: 15 (37.5%)
|
||||
|
||||
## Completed Tasks ✅
|
||||
|
||||
### Automation & Scripts (10 tasks)
|
||||
- ✅ Azure App Registration script
|
||||
- ✅ Automated setup script
|
||||
- ✅ Environment configuration script
|
||||
- ✅ Multi-manifest configuration script
|
||||
- ✅ API permissions configuration script
|
||||
- ✅ Staging deployment script
|
||||
- ✅ Production deployment script
|
||||
- ✅ Webhook configuration script
|
||||
- ✅ Test data generation script
|
||||
- ✅ Validation script
|
||||
|
||||
### Code & Configuration (8 tasks)
|
||||
- ✅ Unit tests
|
||||
- ✅ Integration tests
|
||||
- ✅ Prometheus configuration
|
||||
- ✅ Grafana dashboard
|
||||
- ✅ Alert rules
|
||||
- ✅ Kubernetes manifests
|
||||
- ✅ CI/CD workflows
|
||||
- ✅ Environment configuration templates
|
||||
|
||||
### Documentation (7 tasks)
|
||||
- ✅ Deployment checklist
|
||||
- ✅ Operational runbook
|
||||
- ✅ Troubleshooting guide
|
||||
- ✅ Next steps summary
|
||||
- ✅ Training materials
|
||||
- ✅ Deployment documentation updates
|
||||
- ✅ Automation completion summary
|
||||
|
||||
## Pending Tasks (Require Manual Steps) ⏳
|
||||
|
||||
### Azure Portal Tasks (5 tasks)
|
||||
These require manual UI access to Azure Portal:
|
||||
- ⏳ Enable Verified ID Service
|
||||
- ⏳ Create Default Credential Manifest
|
||||
- ⏳ Create Diplomatic Credential Manifest (optional)
|
||||
- ⏳ Create Judicial Credential Manifest (optional)
|
||||
- ⏳ Create Financial Credential Manifest (optional)
|
||||
|
||||
**Automation Available**: Scripts provide step-by-step instructions
|
||||
|
||||
### Testing with Real API (5 tasks)
|
||||
These require valid Entra credentials and API access:
|
||||
- ⏳ Run Integration Tests with Real Entra API
|
||||
- ⏳ Test Credential Issuance (end-to-end)
|
||||
- ⏳ Test Credential Verification
|
||||
- ⏳ Test Webhook Endpoint (requires webhook URL configuration)
|
||||
- ⏳ Test eIDAS Bridge
|
||||
|
||||
**Automation Available**: Test scripts created, ready to run with credentials
|
||||
|
||||
### Deployment Tasks (3 tasks)
|
||||
These require infrastructure access:
|
||||
- ⏳ Configure Webhook URL in Staging
|
||||
- ⏳ Verify Staging Integration
|
||||
- ⏳ Configure Webhook URL in Production
|
||||
- ⏳ Verify Production Integration
|
||||
- ⏳ Deploy to Production
|
||||
|
||||
**Automation Available**: Deployment scripts ready, webhook config script available
|
||||
|
||||
### Team Tasks (1 task)
|
||||
- ⏳ Train Team (requires scheduling and coordination)
|
||||
|
||||
**Automation Available**: Training materials complete
|
||||
|
||||
## Automation Coverage
|
||||
|
||||
### Fully Automated ✅
|
||||
- Code implementation
|
||||
- Test suite creation
|
||||
- Configuration file generation
|
||||
- Documentation
|
||||
- Deployment scripts
|
||||
- Monitoring setup
|
||||
- Validation scripts
|
||||
|
||||
### Partially Automated 🔄
|
||||
- Azure configuration (scripts provide instructions)
|
||||
- Testing (scripts ready, need credentials)
|
||||
- Deployment (scripts ready, need infrastructure access)
|
||||
|
||||
### Manual Only 📝
|
||||
- Azure Portal UI operations (manifest creation)
|
||||
- Team training sessions
|
||||
- Webhook URL configuration in Entra Portal
|
||||
|
||||
## Next Actions
|
||||
|
||||
### Immediate (Can Do Now)
|
||||
1. Run validation script: `./scripts/validation/validate-entra-config.sh`
|
||||
2. Generate test data: `./scripts/test/generate-test-data.sh`
|
||||
3. Review all documentation
|
||||
|
||||
### With Azure Access
|
||||
1. Run setup script: `./scripts/deploy/setup-entra-automated.sh`
|
||||
2. Create credential manifests in Azure Portal
|
||||
3. Configure webhook URLs
|
||||
|
||||
### With Infrastructure Access
|
||||
1. Deploy to staging: `./scripts/deploy/deploy-staging.sh`
|
||||
2. Run integration tests: `./scripts/test/test-all-entra-features.sh`
|
||||
3. Deploy to production: `./scripts/deploy/deploy-production.sh`
|
||||
|
||||
## Files Created
|
||||
|
||||
### Scripts (15 files)
|
||||
- `scripts/deploy/create-entra-app.sh`
|
||||
- `scripts/deploy/setup-entra-automated.sh`
|
||||
- `scripts/deploy/configure-env-dev.sh`
|
||||
- `scripts/deploy/configure-api-permissions.sh`
|
||||
- `scripts/deploy/configure-multi-manifest.sh`
|
||||
- `scripts/deploy/deploy-staging.sh`
|
||||
- `scripts/deploy/deploy-production.sh`
|
||||
- `scripts/deploy/configure-webhook-url.sh`
|
||||
- `scripts/test/test-entra-integration.sh`
|
||||
- `scripts/test/test-all-entra-features.sh`
|
||||
- `scripts/test/generate-test-data.sh`
|
||||
- `scripts/validation/validate-entra-config.sh`
|
||||
- `scripts/ci/validate-entra-deployment.sh`
|
||||
|
||||
### Configuration (4 files)
|
||||
- `infra/k8s/identity-service-entra-secrets.yaml`
|
||||
- `infra/k8s/identity-service-deployment-entra.yaml`
|
||||
- `infra/monitoring/prometheus-entra-config.yml`
|
||||
- `infra/monitoring/grafana-entra-dashboard.json`
|
||||
|
||||
### CI/CD (1 file)
|
||||
- `.github/workflows/deploy-entra-staging.yml`
|
||||
|
||||
### Documentation (8 files)
|
||||
- `docs/deployment/ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md`
|
||||
- `docs/operations/ENTRA_VERIFIEDID_RUNBOOK.md`
|
||||
- `docs/deployment/ENTRA_VERIFIEDID_NEXT_STEPS.md`
|
||||
- `docs/deployment/AUTOMATION_COMPLETE.md`
|
||||
- `docs/deployment/COMPLETE_TODO_STATUS.md` (this file)
|
||||
- `docs/training/ENTRA_VERIFIEDID_TRAINING.md`
|
||||
- Updated: `docs/deployment/DEPLOYMENT_STEPS_SUMMARY.md`
|
||||
- Updated: `docs/integrations/MICROSOFT_ENTRA_VERIFIEDID.md`
|
||||
|
||||
**Total Files Created**: 28 files
|
||||
|
||||
## Completion Status
|
||||
|
||||
### Code & Automation: 100% ✅
|
||||
All code, scripts, and automation are complete and ready to use.
|
||||
|
||||
### Documentation: 100% ✅
|
||||
All documentation is complete and comprehensive.
|
||||
|
||||
### Configuration: 100% ✅
|
||||
All configuration files and templates are ready.
|
||||
|
||||
### Manual Tasks: 0% (Requires External Access) ⏳
|
||||
These tasks require:
|
||||
- Azure Portal access (for UI operations)
|
||||
- Valid Entra credentials (for testing)
|
||||
- Infrastructure access (for deployment)
|
||||
- Team coordination (for training)
|
||||
|
||||
## Ready for Production
|
||||
|
||||
The integration is **code-complete** and **automation-ready**. All that remains are:
|
||||
1. Azure Portal configuration (manual UI steps)
|
||||
2. Credential manifest creation (manual UI steps)
|
||||
3. Deployment to infrastructure (automated scripts ready)
|
||||
4. Testing with real credentials (test scripts ready)
|
||||
5. Team training (materials ready)
|
||||
|
||||
---
|
||||
|
||||
**Status**: ✅ Automation Complete, ⏳ Manual Steps Pending
|
||||
**Last Updated**: [Current Date]
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Deployment Quick Reference
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
**Purpose**: Quick command reference for deployment operations
|
||||
**Last Updated**: 2026-04-16
|
||||
**Purpose**: Quick command reference for The Order deployment operations on Sankofa Phoenix / Proxmox
|
||||
|
||||
---
|
||||
|
||||
@@ -11,13 +11,12 @@
|
||||
# Verify tools
|
||||
node --version # >= 18.0.0
|
||||
pnpm --version # >= 8.0.0
|
||||
az --version # Azure CLI
|
||||
terraform --version # >= 1.5.0
|
||||
kubectl version # Kubernetes CLI
|
||||
docker --version # Docker
|
||||
docker --version
|
||||
ssh -V
|
||||
tar --version
|
||||
|
||||
# Verify Azure login
|
||||
az account show
|
||||
# Verify Proxmox access
|
||||
ssh [email protected] "echo ok"
|
||||
```
|
||||
|
||||
---
|
||||
@@ -25,66 +24,39 @@ az account show
|
||||
## Phase 1: Prerequisites
|
||||
|
||||
```bash
|
||||
# Clone and setup
|
||||
git clone <repo-url> && cd the-order
|
||||
git submodule update --init --recursive
|
||||
pnpm install --frozen-lockfile
|
||||
pnpm build
|
||||
./scripts/deploy/phase1-prerequisites.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 2: Azure Infrastructure
|
||||
## Phase 2: Sankofa Phoenix Target Preparation
|
||||
|
||||
```bash
|
||||
# Run setup scripts
|
||||
./infra/scripts/azure-setup.sh
|
||||
./infra/scripts/azure-register-providers.sh
|
||||
./infra/scripts/azure-check-quotas.sh
|
||||
./scripts/deploy/phase2-sankofa-phoenix-target.sh
|
||||
|
||||
# Terraform
|
||||
cd infra/terraform
|
||||
terraform init
|
||||
terraform plan
|
||||
terraform apply
|
||||
# Preview the Order edge config directly from the parent Proxmox workspace
|
||||
bash ../scripts/deployment/provision-order-haproxy-10210.sh --dry-run
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 3: Entra ID
|
||||
## Phase 3: Identity Provider Secrets
|
||||
|
||||
```bash
|
||||
# Configure in Azure Portal
|
||||
# Then store secrets:
|
||||
az keyvault secret set --vault-name <vault> --name "entra-tenant-id" --value "..."
|
||||
az keyvault secret set --vault-name <vault> --name "entra-client-id" --value "..."
|
||||
az keyvault secret set --vault-name <vault> --name "entra-client-secret" --value "..."
|
||||
az keyvault secret set --vault-name <vault> --name "entra-credential-manifest-id" --value "..."
|
||||
# Confirm the local env file has the issuer values this environment needs.
|
||||
./scripts/deploy/phase3-identity-secrets.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 4: Database & Storage
|
||||
## Phase 5: Local Artifact / Runtime Preparation
|
||||
|
||||
```bash
|
||||
# Create databases (via Azure Portal or CLI)
|
||||
az postgres db create --resource-group <rg> --server-name <server> --name theorder_dev
|
||||
|
||||
# Create storage containers
|
||||
az storage container create --name intake-documents --account-name <account>
|
||||
az storage container create --name dataroom-deals --account-name <account>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 5: Container Registry
|
||||
|
||||
```bash
|
||||
# Login to ACR
|
||||
az acr login --name <acr-name>
|
||||
|
||||
# Attach to AKS
|
||||
az aks update -n <aks-name> -g <rg> --attach-acr <acr-name>
|
||||
./scripts/deploy/phase5-container-registry.sh
|
||||
cat .deployment/artifacts/image-manifest-dev.txt
|
||||
```
|
||||
|
||||
---
|
||||
@@ -92,65 +64,11 @@ az aks update -n <aks-name> -g <rg> --attach-acr <acr-name>
|
||||
## Phase 6: Build & Package
|
||||
|
||||
```bash
|
||||
# Build packages
|
||||
pnpm build
|
||||
# Build packages and local images
|
||||
./scripts/deploy/phase6-build-package.sh
|
||||
|
||||
# Build and push images (after Dockerfiles created)
|
||||
docker build -t <acr>.azurecr.io/identity:latest -f services/identity/Dockerfile .
|
||||
docker push <acr>.azurecr.io/identity:latest
|
||||
|
||||
# Repeat for: intake, finance, dataroom, portal-public, portal-internal
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 7: Database Migrations
|
||||
|
||||
```bash
|
||||
export DATABASE_URL="postgresql://user:pass@host:5432/theorder_dev"
|
||||
pnpm --filter @the-order/database migrate up
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 8: Secrets
|
||||
|
||||
```bash
|
||||
# Store all secrets in Azure Key Vault
|
||||
az keyvault secret set --vault-name <vault> --name <secret-name> --value "<value>"
|
||||
|
||||
# Configure External Secrets Operator
|
||||
kubectl apply -f https://external-secrets.io/latest/deploy/
|
||||
# Then apply SecretStore and ExternalSecret resources
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 9: Infrastructure Services
|
||||
|
||||
```bash
|
||||
# External Secrets
|
||||
kubectl apply -f https://external-secrets.io/latest/deploy/
|
||||
|
||||
# Prometheus & Grafana
|
||||
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
|
||||
helm install prometheus prometheus-community/kube-prometheus-stack
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 10: Backend Services
|
||||
|
||||
```bash
|
||||
# Get AKS credentials
|
||||
az aks get-credentials --resource-group <rg> --name <aks-name>
|
||||
|
||||
# Deploy services
|
||||
kubectl apply -k infra/k8s/overlays/dev
|
||||
|
||||
# Verify
|
||||
kubectl get pods -n the-order-dev
|
||||
kubectl logs -f <pod-name> -n the-order-dev
|
||||
# Preview the Phoenix sync artifact only
|
||||
./scripts/deploy/sync-portal-public-to-sankofa-phoenix.sh --dry-run --skip-build
|
||||
```
|
||||
|
||||
---
|
||||
@@ -158,15 +76,16 @@ kubectl logs -f <pod-name> -n the-order-dev
|
||||
## Phase 11: Frontend Apps
|
||||
|
||||
```bash
|
||||
# Deploy frontend apps through the standard automation flow
|
||||
# Standard deploy
|
||||
./scripts/deploy/deploy.sh --phase 11 --environment dev
|
||||
|
||||
# Or run the phase directly
|
||||
ENVIRONMENT=dev IMAGE_TAG=<git-sha-or-release-tag> ./scripts/deploy/phase11-frontend-apps.sh
|
||||
# Direct sync
|
||||
./scripts/deploy/sync-portal-public-to-sankofa-phoenix.sh
|
||||
|
||||
# Verify
|
||||
kubectl get pods -l app=portal-public -n the-order-dev
|
||||
kubectl rollout status deployment/portal-public -n the-order-dev
|
||||
curl -fsS http://192.168.11.36:3000/api/health
|
||||
curl -fsS -H 'Host: the-order.sankofa.nexus' http://192.168.11.39/api/health
|
||||
curl -fsS https://the-order.sankofa.nexus/api/health
|
||||
```
|
||||
|
||||
---
|
||||
@@ -174,14 +93,9 @@ kubectl rollout status deployment/portal-public -n the-order-dev
|
||||
## Phase 12: Networking
|
||||
|
||||
```bash
|
||||
# Deploy ingress
|
||||
helm install ingress-nginx ingress-nginx/ingress-nginx
|
||||
|
||||
# Apply ingress rules
|
||||
kubectl apply -f infra/k8s/base/ingress.yaml
|
||||
|
||||
# Verify
|
||||
kubectl get ingress -n the-order-dev
|
||||
# Refresh HAProxy and NPM routing from the parent Proxmox workspace
|
||||
bash ../scripts/deployment/provision-order-haproxy-10210.sh
|
||||
bash ../scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh
|
||||
```
|
||||
|
||||
---
|
||||
@@ -189,11 +103,10 @@ kubectl get ingress -n the-order-dev
|
||||
## Phase 13: Monitoring
|
||||
|
||||
```bash
|
||||
# Application Insights
|
||||
az monitor app-insights component create --app the-order-dev --location westeurope -g <rg>
|
||||
./scripts/deploy/phase13-monitoring.sh
|
||||
|
||||
# Log Analytics
|
||||
az monitor log-analytics workspace create --workspace-name the-order-dev-logs -g <rg>
|
||||
# Tail logs directly
|
||||
ssh [email protected] "pct exec 10090 -- journalctl -u the-order-portal-public -f"
|
||||
```
|
||||
|
||||
---
|
||||
@@ -201,114 +114,39 @@ az monitor log-analytics workspace create --workspace-name the-order-dev-logs -g
|
||||
## Phase 14: Testing
|
||||
|
||||
```bash
|
||||
# Health checks
|
||||
kubectl get pods -n the-order-dev
|
||||
for svc in identity intake finance dataroom; do
|
||||
kubectl port-forward svc/$svc <port>:<port> &
|
||||
curl http://localhost:<port>/health
|
||||
done
|
||||
./scripts/deploy/phase14-testing.sh
|
||||
|
||||
# Integration tests
|
||||
curl https://api.theorder.org/identity/health
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 15: Production
|
||||
|
||||
```bash
|
||||
# Scale deployments
|
||||
kubectl scale deployment identity --replicas=3 -n the-order-prod
|
||||
|
||||
# Apply production config
|
||||
kubectl apply -k infra/k8s/overlays/prod
|
||||
# Quick health probes
|
||||
curl -fsS https://phoenix.sankofa.nexus/health
|
||||
curl -fsS https://the-order.sankofa.nexus/api/health
|
||||
pnpm --dir apps/portal-public test
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Common Operations
|
||||
|
||||
### Check Deployment Status
|
||||
### Check deployment status
|
||||
|
||||
```bash
|
||||
kubectl get all -n the-order-dev
|
||||
kubectl get pods -n the-order-dev
|
||||
kubectl get svc -n the-order-dev
|
||||
kubectl get ingress -n the-order-dev
|
||||
ssh [email protected] "pct status 10090 && pct status 10210"
|
||||
curl -fsS https://the-order.sankofa.nexus/api/health
|
||||
```
|
||||
|
||||
### View Logs
|
||||
### View logs
|
||||
|
||||
```bash
|
||||
kubectl logs -f deployment/<service-name> -n the-order-dev
|
||||
kubectl logs -f <pod-name> -n the-order-dev --tail=100
|
||||
ssh [email protected] "pct exec 10090 -- journalctl -u the-order-portal-public -n 100 --no-pager"
|
||||
```
|
||||
|
||||
### Port Forward for Testing
|
||||
### Restart the app
|
||||
|
||||
```bash
|
||||
kubectl port-forward svc/identity 4002:4002
|
||||
kubectl port-forward svc/portal-public 3000:3000
|
||||
ssh [email protected] "pct exec 10090 -- systemctl restart the-order-portal-public"
|
||||
```
|
||||
|
||||
### Restart Deployment
|
||||
### Preview the public edge
|
||||
|
||||
```bash
|
||||
kubectl rollout restart deployment/<service-name> -n the-order-dev
|
||||
curl -i -H 'Host: the-order.sankofa.nexus' http://192.168.11.39/
|
||||
```
|
||||
|
||||
### Rollback
|
||||
|
||||
```bash
|
||||
kubectl rollout undo deployment/<service-name> -n the-order-dev
|
||||
```
|
||||
|
||||
### Scale Services
|
||||
|
||||
```bash
|
||||
kubectl scale deployment/<service-name> --replicas=3 -n the-order-dev
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Pod Issues
|
||||
|
||||
```bash
|
||||
kubectl describe pod <pod-name> -n the-order-dev
|
||||
kubectl logs <pod-name> -n the-order-dev
|
||||
kubectl exec -it <pod-name> -n the-order-dev -- /bin/sh
|
||||
```
|
||||
|
||||
### Service Issues
|
||||
|
||||
```bash
|
||||
kubectl get endpoints <service-name> -n the-order-dev
|
||||
kubectl describe svc <service-name> -n the-order-dev
|
||||
```
|
||||
|
||||
### Network Issues
|
||||
|
||||
```bash
|
||||
kubectl get ingress -n the-order-dev
|
||||
kubectl describe ingress <ingress-name> -n the-order-dev
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Environment Variables
|
||||
|
||||
Key environment variables needed (store in Key Vault):
|
||||
|
||||
- `DATABASE_URL`
|
||||
- `ENTRA_TENANT_ID`, `ENTRA_CLIENT_ID`, `ENTRA_CLIENT_SECRET`, `ENTRA_CREDENTIAL_MANIFEST_ID`
|
||||
- `STORAGE_BUCKET`, `STORAGE_REGION`
|
||||
- `KMS_KEY_ID`
|
||||
- `JWT_SECRET`
|
||||
- `REDIS_URL`
|
||||
- Service-specific variables
|
||||
|
||||
---
|
||||
|
||||
**See `DEPLOYMENT_GUIDE.md` for detailed instructions.**
|
||||
|
||||
@@ -1,151 +0,0 @@
|
||||
# Deployment Steps Summary - UPDATED
|
||||
|
||||
## Phase 3: Entra ID Configuration 🔐 - **ENHANCED**
|
||||
|
||||
**Status**: ✅ Code Complete, ⏳ Configuration Pending
|
||||
**Duration**: 1-2 days (with automation: 2-4 hours)
|
||||
**Can Run In Parallel**: Yes (with Phase 2)
|
||||
**Dependencies**: Phase 1
|
||||
|
||||
### Automated Setup (Recommended)
|
||||
|
||||
**NEW**: Automated setup script available:
|
||||
```bash
|
||||
./scripts/deploy/setup-entra-automated.sh
|
||||
```
|
||||
|
||||
This script automates:
|
||||
- ✅ Azure AD App Registration creation
|
||||
- ✅ Service principal creation
|
||||
- ✅ Client secret generation
|
||||
- ✅ Key Vault secret storage
|
||||
- ✅ Environment file generation
|
||||
|
||||
### 3.1 Azure AD App Registration
|
||||
|
||||
**Option A: Automated (Recommended)**
|
||||
```bash
|
||||
./scripts/deploy/create-entra-app.sh
|
||||
```
|
||||
|
||||
**Option B: Manual**
|
||||
43. Create App Registration in Azure Portal
|
||||
44. Note Application (client) ID
|
||||
45. Note Directory (tenant) ID
|
||||
46. Configure API permissions (Verifiable Credentials Service)
|
||||
47. Grant admin consent for permissions
|
||||
48. Create client secret
|
||||
49. Save client secret securely (only shown once)
|
||||
50. Configure redirect URIs for portals
|
||||
51. Configure logout URLs
|
||||
|
||||
### 3.2 Microsoft Entra VerifiedID
|
||||
|
||||
52. Enable Verified ID service in Azure Portal
|
||||
53. Wait for service activation
|
||||
54. Create credential manifest
|
||||
55. Define credential type
|
||||
56. Define claims schema
|
||||
57. Note Manifest ID
|
||||
58. Verify Issuer DID format
|
||||
59. Test DID resolution
|
||||
|
||||
**NEW**: Support for multiple manifests:
|
||||
- Configure `ENTRA_MANIFESTS` environment variable
|
||||
- Use `manifestName` parameter in API calls
|
||||
- See: `docs/integrations/MICROSOFT_ENTRA_VERIFIEDID.md`
|
||||
|
||||
### 3.3 Enhanced Features (NEW)
|
||||
|
||||
**Retry Logic**: ✅ Implemented
|
||||
- Automatic retry on transient failures (429, 500, 502, 503, 504)
|
||||
- Configurable exponential backoff
|
||||
- See: `packages/auth/src/entra-verifiedid-enhanced.ts`
|
||||
|
||||
**Webhook Support**: ✅ Implemented
|
||||
- Automatic webhook processing at `/vc/entra/webhook`
|
||||
- Status updates and database synchronization
|
||||
- See: `services/identity/src/entra-webhooks.ts`
|
||||
|
||||
**Rate Limiting**: ✅ Implemented
|
||||
- Entra-specific rate limits
|
||||
- Configurable via environment variables
|
||||
- See: `packages/shared/src/rate-limit-entra.ts`
|
||||
|
||||
**Monitoring**: ✅ Implemented
|
||||
- Comprehensive Prometheus metrics
|
||||
- Grafana dashboard configuration
|
||||
- Alert rules
|
||||
- See: `packages/monitoring/src/entra-metrics.ts`
|
||||
|
||||
### 3.4 Environment Configuration
|
||||
|
||||
**NEW**: Automated environment setup:
|
||||
```bash
|
||||
./scripts/deploy/configure-env-dev.sh
|
||||
```
|
||||
|
||||
60. Create databases (dev, stage, prod)
|
||||
61. Create database users
|
||||
62. Grant privileges
|
||||
63. Configure firewall rules for AKS
|
||||
64. Test database connection
|
||||
|
||||
### Testing
|
||||
|
||||
**NEW**: Automated test script:
|
||||
```bash
|
||||
./scripts/test/test-entra-integration.sh
|
||||
```
|
||||
|
||||
Tests include:
|
||||
- ✅ Unit tests
|
||||
- ✅ Integration tests
|
||||
- ✅ API endpoint tests
|
||||
- ✅ Feature tests (retry, rate limiting, multi-manifest)
|
||||
|
||||
### Monitoring Setup
|
||||
|
||||
**NEW**: Pre-configured monitoring:
|
||||
- Prometheus config: `infra/monitoring/prometheus-entra-config.yml`
|
||||
- Grafana dashboard: `infra/monitoring/grafana-entra-dashboard.json`
|
||||
- Alert rules included
|
||||
|
||||
### Documentation
|
||||
|
||||
**NEW**: Comprehensive documentation:
|
||||
- ✅ Deployment Checklist: `docs/deployment/ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md`
|
||||
- ✅ Operational Runbook: `docs/operations/ENTRA_VERIFIEDID_RUNBOOK.md`
|
||||
- ✅ Next Steps: `docs/deployment/ENTRA_VERIFIEDID_NEXT_STEPS.md`
|
||||
- ✅ Integration Guide: `docs/integrations/MICROSOFT_ENTRA_VERIFIEDID.md`
|
||||
|
||||
---
|
||||
|
||||
## Quick Start for Entra VerifiedID
|
||||
|
||||
1. **Run automated setup**:
|
||||
```bash
|
||||
./scripts/deploy/setup-entra-automated.sh
|
||||
```
|
||||
|
||||
2. **Configure environment**:
|
||||
```bash
|
||||
./scripts/deploy/configure-env-dev.sh
|
||||
```
|
||||
|
||||
3. **Run tests**:
|
||||
```bash
|
||||
./scripts/test/test-entra-integration.sh
|
||||
```
|
||||
|
||||
4. **Deploy monitoring**:
|
||||
- Apply Prometheus config
|
||||
- Import Grafana dashboard
|
||||
|
||||
5. **Follow detailed checklist**:
|
||||
- See: `docs/deployment/ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md`
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: [Current Date]
|
||||
**Status**: ✅ Code Complete, Automation Ready, Documentation Complete
|
||||
@@ -1,141 +0,0 @@
|
||||
# Entra VerifiedID Integration - Complete Summary
|
||||
|
||||
## 🎉 All Automatable Tasks Completed!
|
||||
|
||||
### Completion Status
|
||||
|
||||
**Total Todos**: 40
|
||||
**Completed**: 39 (97.5%)
|
||||
**Pending**: 1 (Azure Portal UI operations - requires manual access)
|
||||
|
||||
### What's Been Completed
|
||||
|
||||
#### ✅ Code Implementation (100%)
|
||||
- Enhanced Entra VerifiedID client with retry logic
|
||||
- Multi-manifest support
|
||||
- Webhook/callback handling
|
||||
- Rate limiting
|
||||
- Comprehensive metrics
|
||||
- Full test suite (unit + integration)
|
||||
|
||||
#### ✅ Automation Scripts (15 scripts)
|
||||
1. `create-entra-app.sh` - Azure App Registration
|
||||
2. `setup-entra-automated.sh` - Full automated setup
|
||||
3. `configure-env-dev.sh` - Development environment
|
||||
4. `configure-api-permissions.sh` - API permissions guide
|
||||
5. `configure-multi-manifest.sh` - Multi-manifest setup
|
||||
6. `deploy-staging.sh` - Staging deployment
|
||||
7. `deploy-production.sh` - Production deployment (blue-green)
|
||||
8. `configure-webhook-url.sh` - Webhook configuration
|
||||
9. `test-entra-integration.sh` - Integration tests
|
||||
10. `test-all-entra-features.sh` - Comprehensive feature tests
|
||||
11. `generate-test-data.sh` - Test data generation
|
||||
12. `validate-entra-config.sh` - Configuration validation
|
||||
13. `validate-entra-deployment.sh` - CI/CD validation
|
||||
14. `store-entra-secrets.sh` - Key Vault storage (existing, enhanced)
|
||||
|
||||
#### ✅ Configuration Files (4 files)
|
||||
1. `infra/k8s/identity-service-entra-secrets.yaml` - Kubernetes secrets
|
||||
2. `infra/k8s/identity-service-deployment-entra.yaml` - Deployment manifest
|
||||
3. `infra/monitoring/prometheus-entra-config.yml` - Prometheus config + alerts
|
||||
4. `infra/monitoring/grafana-entra-dashboard.json` - Grafana dashboard
|
||||
|
||||
#### ✅ CI/CD (1 workflow)
|
||||
1. `.github/workflows/deploy-entra-staging.yml` - Automated staging deployment
|
||||
|
||||
#### ✅ Documentation (8 files)
|
||||
1. `ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md` - Step-by-step checklist
|
||||
2. `ENTRA_VERIFIEDID_RUNBOOK.md` - Operational runbook
|
||||
3. `ENTRA_VERIFIEDID_NEXT_STEPS.md` - Next steps summary
|
||||
4. `AUTOMATION_COMPLETE.md` - Automation status
|
||||
5. `COMPLETE_TODO_STATUS.md` - Todo status
|
||||
6. `ENTRA_COMPLETE_SUMMARY.md` - This file
|
||||
7. `ENTRA_VERIFIEDID_TRAINING.md` - Training materials
|
||||
8. Updated: `MICROSOFT_ENTRA_VERIFIEDID.md` - Integration guide
|
||||
|
||||
#### ✅ Test Data & Tools
|
||||
- Test payloads for all endpoints
|
||||
- Test scripts for all features
|
||||
- Validation scripts
|
||||
- CI/CD validation
|
||||
|
||||
### Remaining Manual Tasks
|
||||
|
||||
Only **1 category** requires manual Azure Portal access:
|
||||
- **Azure Portal UI Operations** (5 tasks)
|
||||
- Enable Verified ID Service
|
||||
- Create Credential Manifests (default + optional ones)
|
||||
|
||||
**Note**: All other tasks have automation scripts ready to execute.
|
||||
|
||||
## Quick Start Commands
|
||||
|
||||
```bash
|
||||
# 1. Automated Azure setup
|
||||
./scripts/deploy/setup-entra-automated.sh
|
||||
|
||||
# 2. Configure environment
|
||||
./scripts/deploy/configure-env-dev.sh
|
||||
|
||||
# 3. Validate configuration
|
||||
./scripts/validation/validate-entra-config.sh
|
||||
|
||||
# 4. Run tests
|
||||
./scripts/test/test-all-entra-features.sh
|
||||
|
||||
# 5. Deploy to staging
|
||||
./scripts/deploy/deploy-staging.sh
|
||||
|
||||
# 6. Deploy to production
|
||||
./scripts/deploy/deploy-production.sh
|
||||
```
|
||||
|
||||
## File Statistics
|
||||
|
||||
- **Scripts Created**: 15
|
||||
- **Configuration Files**: 4
|
||||
- **CI/CD Workflows**: 1
|
||||
- **Documentation Files**: 8
|
||||
- **Test Files**: 3
|
||||
- **Total Files**: 31
|
||||
|
||||
## Features Implemented
|
||||
|
||||
### Core Features ✅
|
||||
- ✅ Credential issuance
|
||||
- ✅ Credential verification
|
||||
- ✅ Status checking
|
||||
- ✅ Webhook processing
|
||||
|
||||
### Enhanced Features ✅
|
||||
- ✅ Retry logic with exponential backoff
|
||||
- ✅ Multi-manifest support
|
||||
- ✅ Rate limiting
|
||||
- ✅ Comprehensive metrics
|
||||
- ✅ Error handling
|
||||
- ✅ Token caching
|
||||
|
||||
### Operational Features ✅
|
||||
- ✅ Health checks
|
||||
- ✅ Monitoring dashboards
|
||||
- ✅ Alert rules
|
||||
- ✅ Logging
|
||||
- ✅ Validation scripts
|
||||
|
||||
## Ready for Production
|
||||
|
||||
The integration is **100% code-complete** and **97.5% automation-complete**.
|
||||
|
||||
**To go live, you only need to:**
|
||||
1. Create credential manifests in Azure Portal (5-10 minutes per manifest)
|
||||
2. Run the automated setup scripts
|
||||
3. Deploy using the provided scripts
|
||||
|
||||
**Everything else is automated and ready!**
|
||||
|
||||
---
|
||||
|
||||
**Status**: ✅ Complete
|
||||
**Last Updated**: [Current Date]
|
||||
**Next Action**: Create credential manifests in Azure Portal
|
||||
|
||||
@@ -1,301 +0,0 @@
|
||||
# Entra VerifiedID Deployment Checklist
|
||||
|
||||
This checklist provides detailed steps for deploying Entra VerifiedID integration for eCredential issuance.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- [ ] Azure subscription with appropriate permissions
|
||||
- [ ] Azure CLI installed and configured
|
||||
- [ ] Access to Azure Portal
|
||||
- [ ] Key Vault created and accessible
|
||||
- [ ] Identity service codebase updated with latest Entra integration
|
||||
|
||||
## Phase 1: Azure Configuration
|
||||
|
||||
### 1.1 Azure AD App Registration
|
||||
|
||||
- [ ] **Task 1.1.1**: Navigate to Azure Portal → Azure Active Directory → App registrations
|
||||
- [ ] **Task 1.1.2**: Click "New registration"
|
||||
- [ ] **Task 1.1.3**: Enter name: `the-order-entra` (or your preferred name)
|
||||
- [ ] **Task 1.1.4**: Select supported account types (typically "Accounts in this organizational directory only")
|
||||
- [ ] **Task 1.1.5**: Click "Register"
|
||||
- [ ] **Task 1.1.6**: Note the **Application (client) ID** - save this as `ENTRA_CLIENT_ID`
|
||||
- [ ] **Task 1.1.7**: Note the **Directory (tenant) ID** - save this as `ENTRA_TENANT_ID`
|
||||
|
||||
### 1.2 Configure API Permissions
|
||||
|
||||
- [ ] **Task 1.2.1**: In App Registration, go to "API permissions"
|
||||
- [ ] **Task 1.2.2**: Click "Add a permission"
|
||||
- [ ] **Task 1.2.3**: Select "APIs my organization uses"
|
||||
- [ ] **Task 1.2.4**: Search for "Verifiable Credentials Service" or use App ID: `3db474b9-7a6d-4f50-afdc-70940ce1df8f`
|
||||
- [ ] **Task 1.2.5**: Select "Application permissions"
|
||||
- [ ] **Task 1.2.6**: Check "VerifiableCredential.Create.All"
|
||||
- [ ] **Task 1.2.7**: Check "VerifiableCredential.Verify.All"
|
||||
- [ ] **Task 1.2.8**: Click "Add permissions"
|
||||
- [ ] **Task 1.2.9**: Click "Grant admin consent for [Your Organization]"
|
||||
- [ ] **Task 1.2.10**: Verify consent status shows "Granted for [Your Organization]"
|
||||
|
||||
### 1.3 Create Client Secret
|
||||
|
||||
- [ ] **Task 1.3.1**: In App Registration, go to "Certificates & secrets"
|
||||
- [ ] **Task 1.3.2**: Click "New client secret"
|
||||
- [ ] **Task 1.3.3**: Enter description: "Entra VerifiedID Integration"
|
||||
- [ ] **Task 1.3.4**: Select expiration (recommend 12-24 months)
|
||||
- [ ] **Task 1.3.5**: Click "Add"
|
||||
- [ ] **Task 1.3.6**: **IMMEDIATELY** copy the secret value - save this as `ENTRA_CLIENT_SECRET`
|
||||
- [ ] **Task 1.3.7**: Store secret securely (it won't be shown again)
|
||||
|
||||
### 1.4 Enable Verified ID Service
|
||||
|
||||
- [ ] **Task 1.4.1**: Navigate to Azure Portal → Verified ID
|
||||
- [ ] **Task 1.4.2**: If service is not enabled, click "Get started"
|
||||
- [ ] **Task 1.4.3**: Wait for service activation (may take 5-10 minutes)
|
||||
- [ ] **Task 1.4.4**: Verify service is active and accessible
|
||||
|
||||
### 1.5 Create Credential Manifests
|
||||
|
||||
#### Default Credential Manifest
|
||||
|
||||
- [ ] **Task 1.5.1**: In Verified ID, click "Add credential"
|
||||
- [ ] **Task 1.5.2**: Choose credential type (e.g., "Verified Credential")
|
||||
- [ ] **Task 1.5.3**: Configure credential name: "The Order Identity Credential"
|
||||
- [ ] **Task 1.5.4**: Define claims schema:
|
||||
- [ ] Add claim: `email` (type: string)
|
||||
- [ ] Add claim: `name` (type: string)
|
||||
- [ ] Add claim: `role` (type: string)
|
||||
- [ ] Add additional claims as needed
|
||||
- [ ] **Task 1.5.5**: Configure issuer information
|
||||
- [ ] **Task 1.5.6**: Review and create manifest
|
||||
- [ ] **Task 1.5.7**: Note the **Manifest ID** - save this as `ENTRA_CREDENTIAL_MANIFEST_ID`
|
||||
|
||||
#### Diplomatic Credential Manifest (Optional)
|
||||
|
||||
- [ ] **Task 1.5.8**: Create manifest for Letters of Credence
|
||||
- [ ] **Task 1.5.9**: Configure diplomatic-specific claims (recipientName, recipientTitle, missionCountry, etc.)
|
||||
- [ ] **Task 1.5.10**: Note Manifest ID for diplomatic credentials
|
||||
|
||||
#### Judicial Credential Manifest (Optional)
|
||||
|
||||
- [ ] **Task 1.5.11**: Create manifest for judicial appointments
|
||||
- [ ] **Task 1.5.12**: Configure judicial-specific claims (role, appointmentAuthority, jurisdiction, etc.)
|
||||
- [ ] **Task 1.5.13**: Note Manifest ID for judicial credentials
|
||||
|
||||
#### Financial Credential Manifest (Optional)
|
||||
|
||||
- [ ] **Task 1.5.14**: Create manifest for financial role credentials
|
||||
- [ ] **Task 1.5.15**: Configure financial-specific claims (role, appointmentDate, jurisdiction, etc.)
|
||||
- [ ] **Task 1.5.16**: Note Manifest ID for financial credentials
|
||||
|
||||
## Phase 2: Automated Setup (Alternative to Manual Steps)
|
||||
|
||||
- [ ] **Task 2.1**: Run automated setup script: `./scripts/deploy/setup-entra-automated.sh`
|
||||
- [ ] **Task 2.2**: Follow script prompts to provide:
|
||||
- [ ] Subscription ID
|
||||
- [ ] Resource Group name
|
||||
- [ ] App Registration name
|
||||
- [ ] Key Vault name
|
||||
- [ ] **Task 2.3**: Review generated `.env.entra.example` file
|
||||
- [ ] **Task 2.4**: Verify secrets stored in Key Vault
|
||||
|
||||
## Phase 3: Environment Configuration
|
||||
|
||||
### 3.1 Store Secrets in Key Vault
|
||||
|
||||
- [ ] **Task 3.1.1**: Store `entra-tenant-id` in Key Vault
|
||||
```bash
|
||||
az keyvault secret set --vault-name <keyvault> --name "entra-tenant-id" --value "<tenant-id>"
|
||||
```
|
||||
- [ ] **Task 3.1.2**: Store `entra-client-id` in Key Vault
|
||||
```bash
|
||||
az keyvault secret set --vault-name <keyvault> --name "entra-client-id" --value "<client-id>"
|
||||
```
|
||||
- [ ] **Task 3.1.3**: Store `entra-client-secret` in Key Vault
|
||||
```bash
|
||||
az keyvault secret set --vault-name <keyvault> --name "entra-client-secret" --value "<client-secret>"
|
||||
```
|
||||
- [ ] **Task 3.1.4**: Store `entra-credential-manifest-id` in Key Vault
|
||||
```bash
|
||||
az keyvault secret set --vault-name <keyvault> --name "entra-credential-manifest-id" --value "<manifest-id>"
|
||||
```
|
||||
|
||||
### 3.2 Configure Development Environment
|
||||
|
||||
- [ ] **Task 3.2.1**: Update `.env` file with Entra credentials:
|
||||
```bash
|
||||
ENTRA_TENANT_ID=<tenant-id>
|
||||
ENTRA_CLIENT_ID=<client-id>
|
||||
ENTRA_CLIENT_SECRET=<client-secret>
|
||||
ENTRA_CREDENTIAL_MANIFEST_ID=<manifest-id>
|
||||
```
|
||||
- [ ] **Task 3.2.2**: If using multiple manifests, set `ENTRA_MANIFESTS`:
|
||||
```bash
|
||||
ENTRA_MANIFESTS='{"default":"manifest-id-1","diplomatic":"manifest-id-2","judicial":"manifest-id-3","financial":"manifest-id-4"}'
|
||||
```
|
||||
- [ ] **Task 3.2.3**: Configure rate limits (optional):
|
||||
```bash
|
||||
ENTRA_RATE_LIMIT_ISSUANCE=10
|
||||
ENTRA_RATE_LIMIT_VERIFICATION=20
|
||||
ENTRA_RATE_LIMIT_STATUS_CHECK=30
|
||||
ENTRA_RATE_LIMIT_GLOBAL=50
|
||||
```
|
||||
- [ ] **Task 3.2.4**: Verify environment variables are loaded correctly
|
||||
|
||||
### 3.3 Configure Staging Environment
|
||||
|
||||
- [ ] **Task 3.3.1**: Create Kubernetes secrets or use External Secrets Operator
|
||||
- [ ] **Task 3.3.2**: Set all Entra environment variables in staging config
|
||||
- [ ] **Task 3.3.3**: Verify secrets are accessible to identity service pod
|
||||
- [ ] **Task 3.3.4**: Test secret access from within pod
|
||||
|
||||
### 3.4 Configure Production Environment
|
||||
|
||||
- [ ] **Task 3.4.1**: Set up Key Vault integration or secure secret management
|
||||
- [ ] **Task 3.4.2**: Configure all Entra environment variables
|
||||
- [ ] **Task 3.4.3**: Enable secret rotation policies
|
||||
- [ ] **Task 3.4.4**: Verify secret access and permissions
|
||||
|
||||
## Phase 4: Testing
|
||||
|
||||
### 4.1 Unit Tests
|
||||
|
||||
- [ ] **Task 4.1.1**: Run unit tests: `cd packages/auth && pnpm test entra-verifiedid.test.ts`
|
||||
- [ ] **Task 4.1.2**: Verify all tests pass
|
||||
- [ ] **Task 4.1.3**: Review test coverage report
|
||||
|
||||
### 4.2 Integration Tests
|
||||
|
||||
- [ ] **Task 4.2.1**: Set test environment variables:
|
||||
```bash
|
||||
export ENTRA_TENANT_ID=<test-tenant-id>
|
||||
export ENTRA_CLIENT_ID=<test-client-id>
|
||||
export ENTRA_CLIENT_SECRET=<test-client-secret>
|
||||
export ENTRA_CREDENTIAL_MANIFEST_ID=<test-manifest-id>
|
||||
```
|
||||
- [ ] **Task 4.2.2**: Run integration tests: `pnpm test entra-verifiedid.integration.test.ts`
|
||||
- [ ] **Task 4.2.3**: Verify tests pass with real Entra API
|
||||
|
||||
### 4.3 API Endpoint Testing
|
||||
|
||||
- [ ] **Task 4.3.1**: Test credential issuance:
|
||||
```bash
|
||||
curl -X POST http://localhost:4002/vc/issue/entra \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: Bearer <token>" \
|
||||
-d '{"claims": {"email": "[email protected]", "name": "Test User"}}'
|
||||
```
|
||||
- [ ] **Task 4.3.2**: Verify response contains `requestId`, `url`, and `qrCode`
|
||||
- [ ] **Task 4.3.3**: Test credential verification:
|
||||
```bash
|
||||
curl -X POST http://localhost:4002/vc/verify/entra \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"credential": {...}}'
|
||||
```
|
||||
- [ ] **Task 4.3.4**: Test status endpoint:
|
||||
```bash
|
||||
curl http://localhost:4002/vc/entra/status/<requestId>
|
||||
```
|
||||
|
||||
### 4.4 Feature Testing
|
||||
|
||||
- [ ] **Task 4.4.1**: Test retry logic by simulating transient failures
|
||||
- [ ] **Task 4.4.2**: Test rate limiting by exceeding limits
|
||||
- [ ] **Task 4.4.3**: Test multi-manifest support with different `manifestName` values
|
||||
- [ ] **Task 4.4.4**: Test webhook endpoint with sample payload
|
||||
- [ ] **Task 4.4.5**: Test eIDAS bridge integration (if configured)
|
||||
|
||||
## Phase 5: Staging Deployment
|
||||
|
||||
- [ ] **Task 5.1**: Build and push Docker image for identity service
|
||||
- [ ] **Task 5.2**: Deploy to staging Kubernetes cluster
|
||||
- [ ] **Task 5.3**: Verify service starts and health check passes
|
||||
- [ ] **Task 5.4**: Check logs for Entra client initialization
|
||||
- [ ] **Task 5.5**: Configure webhook URL in Entra VerifiedID:
|
||||
- URL: `https://api-staging.theorder.org/vc/entra/webhook`
|
||||
- [ ] **Task 5.6**: Issue test credential in staging
|
||||
- [ ] **Task 5.7**: Verify webhook receives status updates
|
||||
- [ ] **Task 5.8**: Check database for credential records
|
||||
- [ ] **Task 5.9**: Verify metrics are being collected
|
||||
|
||||
## Phase 6: Monitoring Setup
|
||||
|
||||
- [ ] **Task 6.1**: Configure Prometheus to scrape `/metrics` endpoint
|
||||
- [ ] **Task 6.2**: Verify Entra metrics are being collected:
|
||||
- `entra_api_requests_total`
|
||||
- `entra_credentials_issued_total`
|
||||
- `entra_issuance_duration_seconds`
|
||||
- `entra_webhooks_received_total`
|
||||
- [ ] **Task 6.3**: Create Grafana dashboard with panels for:
|
||||
- [ ] Issuance success rate
|
||||
- [ ] API request latency (p50, p95, p99)
|
||||
- [ ] Error rates by operation
|
||||
- [ ] Webhook processing metrics
|
||||
- [ ] Active requests gauge
|
||||
- [ ] **Task 6.4**: Set up alerts for:
|
||||
- [ ] High error rate (>5% failures)
|
||||
- [ ] Slow API responses (>5 seconds p95)
|
||||
- [ ] Webhook processing failures
|
||||
- [ ] Rate limit violations
|
||||
|
||||
## Phase 7: Production Deployment
|
||||
|
||||
- [ ] **Task 7.1**: Review staging deployment and metrics
|
||||
- [ ] **Task 7.2**: Create production deployment plan
|
||||
- [ ] **Task 7.3**: Deploy using blue-green or canary strategy
|
||||
- [ ] **Task 7.4**: Monitor deployment metrics closely
|
||||
- [ ] **Task 7.5**: Configure production webhook URL:
|
||||
- URL: `https://api.theorder.org/vc/entra/webhook`
|
||||
- [ ] **Task 7.6**: Issue test credential in production
|
||||
- [ ] **Task 7.7**: Verify end-to-end flow works correctly
|
||||
- [ ] **Task 7.8**: Monitor for 24 hours post-deployment
|
||||
|
||||
## Phase 8: Documentation and Training
|
||||
|
||||
- [ ] **Task 8.1**: Update `docs/deployment/DEPLOYMENT_STEPS_SUMMARY.md` with completion status
|
||||
- [ ] **Task 8.2**: Create operational runbook:
|
||||
- [ ] Common operations
|
||||
- [ ] Troubleshooting steps
|
||||
- [ ] Diagnostic commands
|
||||
- [ ] Escalation procedures
|
||||
- [ ] **Task 8.3**: Document troubleshooting guide:
|
||||
- [ ] Common errors and solutions
|
||||
- [ ] How to check logs
|
||||
- [ ] How to verify configuration
|
||||
- [ ] How to test endpoints
|
||||
- [ ] **Task 8.4**: Conduct training session for operations team
|
||||
- [ ] **Task 8.5**: Create knowledge base articles
|
||||
|
||||
## Verification Checklist
|
||||
|
||||
After deployment, verify:
|
||||
|
||||
- [ ] Credential issuance works end-to-end
|
||||
- [ ] Webhooks are received and processed
|
||||
- [ ] Database records are created correctly
|
||||
- [ ] Metrics are being collected
|
||||
- [ ] Alerts are configured and working
|
||||
- [ ] Rate limiting is functioning
|
||||
- [ ] Retry logic handles failures gracefully
|
||||
- [ ] Multi-manifest support works (if configured)
|
||||
- [ ] Documentation is complete and accurate
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
If issues occur:
|
||||
|
||||
1. Disable Entra routes in identity service
|
||||
2. Revert to previous deployment
|
||||
3. Investigate issues in staging
|
||||
4. Fix and redeploy
|
||||
|
||||
## Support Contacts
|
||||
|
||||
- **Azure Support**: [Azure Support Portal](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade)
|
||||
- **Entra VerifiedID Docs**: [Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/verifiable-credentials/)
|
||||
- **Internal Team**: [Your team contact]
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: [Current Date]
|
||||
**Version**: 1.0
|
||||
**Status**: Ready for Deployment
|
||||
|
||||
@@ -1,154 +0,0 @@
|
||||
# Entra VerifiedID Integration - Next Steps Summary
|
||||
|
||||
This document provides a high-level overview of all next steps required to complete the Entra VerifiedID integration for eCredential issuance.
|
||||
|
||||
## Quick Start
|
||||
|
||||
For automated setup, run:
|
||||
```bash
|
||||
./scripts/deploy/setup-entra-automated.sh
|
||||
```
|
||||
|
||||
For detailed manual steps, see: [ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md](./ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md)
|
||||
|
||||
## Task Categories
|
||||
|
||||
### 🔵 Azure Configuration (8 tasks)
|
||||
1. Create Azure AD App Registration
|
||||
2. Configure API Permissions
|
||||
3. Create Client Secret
|
||||
4. Enable Verified ID Service
|
||||
5. Create Default Credential Manifest
|
||||
6. Create Diplomatic Credential Manifest (optional)
|
||||
7. Create Judicial Credential Manifest (optional)
|
||||
8. Create Financial Credential Manifest (optional)
|
||||
|
||||
**Estimated Time**: 2-4 hours
|
||||
**Dependencies**: Azure subscription access
|
||||
|
||||
### 🟢 Environment Configuration (6 tasks)
|
||||
1. Run Automated Setup Script (or manual secret storage)
|
||||
2. Store Secrets in Azure Key Vault
|
||||
3. Configure Development Environment
|
||||
4. Configure Staging Environment
|
||||
5. Configure Production Environment
|
||||
6. Configure Multi-Manifest Support (if using multiple manifests)
|
||||
7. Configure Rate Limits
|
||||
|
||||
**Estimated Time**: 1-2 hours
|
||||
**Dependencies**: Azure configuration complete
|
||||
|
||||
### 🟡 Testing (8 tasks)
|
||||
1. Run Unit Tests
|
||||
2. Run Integration Tests
|
||||
3. Test Credential Issuance
|
||||
4. Test Credential Verification
|
||||
5. Test Webhook Endpoint
|
||||
6. Test Status Endpoint
|
||||
7. Test Retry Logic
|
||||
8. Test Rate Limiting
|
||||
9. Test Multi-Manifest Support
|
||||
10. Test eIDAS Bridge
|
||||
|
||||
**Estimated Time**: 2-3 hours
|
||||
**Dependencies**: Environment configuration complete
|
||||
|
||||
### 🟠 Deployment (4 tasks)
|
||||
1. Deploy to Staging
|
||||
2. Configure Webhook URL in Staging
|
||||
3. Verify Staging Integration
|
||||
4. Deploy to Production
|
||||
5. Configure Webhook URL in Production
|
||||
6. Verify Production Integration
|
||||
|
||||
**Estimated Time**: 2-3 hours
|
||||
**Dependencies**: Testing complete
|
||||
|
||||
### 🔴 Monitoring Setup (3 tasks)
|
||||
1. Set Up Prometheus Scraping
|
||||
2. Create Grafana Dashboard
|
||||
3. Set Up Alerts
|
||||
|
||||
**Estimated Time**: 1-2 hours
|
||||
**Dependencies**: Deployment complete
|
||||
|
||||
### 🟣 Documentation (3 tasks)
|
||||
1. Update Deployment Documentation
|
||||
2. Create Operational Runbook
|
||||
3. Document Troubleshooting Guide
|
||||
4. Train Team
|
||||
|
||||
**Estimated Time**: 2-3 hours
|
||||
**Dependencies**: None (can be done in parallel)
|
||||
|
||||
## Total Estimated Time
|
||||
|
||||
- **Minimum** (automated setup, single manifest): 8-12 hours
|
||||
- **Recommended** (automated setup, multiple manifests): 10-15 hours
|
||||
- **Comprehensive** (manual setup, full testing, monitoring): 12-18 hours
|
||||
|
||||
## Critical Path
|
||||
|
||||
The critical path for deployment is:
|
||||
|
||||
1. Azure Configuration → 2. Environment Configuration → 3. Testing → 4. Staging Deployment → 5. Production Deployment
|
||||
|
||||
Monitoring and Documentation can be done in parallel.
|
||||
|
||||
## Priority Tasks
|
||||
|
||||
**Must Complete Before Production:**
|
||||
- ✅ Azure App Registration and API Permissions
|
||||
- ✅ Client Secret Creation
|
||||
- ✅ At least one Credential Manifest
|
||||
- ✅ Environment Configuration
|
||||
- ✅ Basic Testing (issuance and verification)
|
||||
- ✅ Staging Deployment and Verification
|
||||
|
||||
**Should Complete Before Production:**
|
||||
- ✅ Webhook Configuration
|
||||
- ✅ Monitoring Setup
|
||||
- ✅ Rate Limit Configuration
|
||||
- ✅ Integration Testing
|
||||
|
||||
**Can Complete After Production:**
|
||||
- ⏳ Additional Credential Manifests
|
||||
- ⏳ Advanced Monitoring Dashboards
|
||||
- ⏳ Comprehensive Documentation
|
||||
- ⏳ Team Training
|
||||
|
||||
## Resources
|
||||
|
||||
### Documentation
|
||||
- **Deployment Checklist**: [ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md](./ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md)
|
||||
- **Operational Runbook**: [../operations/ENTRA_VERIFIEDID_RUNBOOK.md](../operations/ENTRA_VERIFIEDID_RUNBOOK.md)
|
||||
- **Integration Guide**: [../integrations/MICROSOFT_ENTRA_VERIFIEDID.md](../integrations/MICROSOFT_ENTRA_VERIFIEDID.md)
|
||||
|
||||
### Scripts
|
||||
- **Automated Setup**: `./scripts/deploy/setup-entra-automated.sh`
|
||||
- **Store Secrets**: `./scripts/deploy/store-entra-secrets.sh`
|
||||
|
||||
### External Resources
|
||||
- [Microsoft Entra VerifiedID Documentation](https://learn.microsoft.com/en-us/azure/active-directory/verifiable-credentials/)
|
||||
- [Azure Portal](https://portal.azure.com)
|
||||
- [Azure CLI Documentation](https://docs.microsoft.com/cli/azure/)
|
||||
|
||||
## Getting Help
|
||||
|
||||
If you encounter issues:
|
||||
|
||||
1. Check the [Troubleshooting Guide](../operations/ENTRA_VERIFIEDID_RUNBOOK.md#troubleshooting)
|
||||
2. Review logs: `kubectl logs -n the-order-prod deployment/identity-service`
|
||||
3. Check metrics: `curl https://api.theorder.org/metrics | grep entra`
|
||||
4. Consult the [Operational Runbook](../operations/ENTRA_VERIFIEDID_RUNBOOK.md)
|
||||
5. Contact Azure Support for Entra-specific issues
|
||||
|
||||
## Status Tracking
|
||||
|
||||
Track your progress using the TODO list in your project management tool or the checklist in [ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md](./ENTRA_VERIFIEDID_DEPLOYMENT_CHECKLIST.md).
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: [Current Date]
|
||||
**Next Review**: After staging deployment
|
||||
|
||||
@@ -1,100 +1,12 @@
|
||||
# Deployment Documentation
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
**Purpose**: Complete deployment guide index
|
||||
The active deployment model for The Order is Sankofa Phoenix / Proxmox native.
|
||||
|
||||
## Overview
|
||||
Use these entry points:
|
||||
|
||||
This directory contains comprehensive deployment guides for The Order platform, covering infrastructure setup, service deployment, and operational procedures.
|
||||
- [Deployment Overview](overview.md)
|
||||
- [Deployment Quick Reference](DEPLOYMENT_QUICK_REFERENCE.md)
|
||||
|
||||
## Quick Links
|
||||
Historical provider-specific deployment material has been quarantined under:
|
||||
|
||||
### Azure Deployment
|
||||
- [Environment Setup](azure/ENVIRONMENT_SETUP.md) - Azure configuration and setup
|
||||
- [Dotenv Configuration](azure/DOTENV_SETUP.md) - Using .env file for deployments
|
||||
- [Sovereignty Landing Zone](azure/SOVEREIGNTY_LANDING_ZONE_DEPLOYMENT.md) - Multi-region deployment
|
||||
- [CDN Setup](azure/cdn-setup.md) - Azure CDN configuration
|
||||
- [Entra VerifiedID](azure/entra-verifiedid.md) - Entra VerifiedID setup
|
||||
|
||||
### Kubernetes Deployment
|
||||
- [Kubernetes Guide](../../infra/k8s/README.md) - K8s deployment guide
|
||||
- [Service Manifests](../../infra/k8s/base/) - Base Kubernetes manifests
|
||||
|
||||
### Infrastructure
|
||||
- [Infrastructure Overview](../../infra/README.md) - Infrastructure documentation
|
||||
- [Terraform Guide](../../infra/terraform/README.md) - Terraform documentation
|
||||
|
||||
## Deployment Guides by Scenario
|
||||
|
||||
### Initial Setup
|
||||
1. [Azure Environment Setup](azure/ENVIRONMENT_SETUP.md)
|
||||
2. [Dotenv Configuration](azure/DOTENV_SETUP.md)
|
||||
3. [Infrastructure Deployment](../../infra/README.md)
|
||||
|
||||
### Multi-Region Deployment
|
||||
1. [Sovereignty Landing Zone Deployment](azure/SOVEREIGNTY_LANDING_ZONE_DEPLOYMENT.md)
|
||||
2. [Cloud for Sovereignty Architecture](../../docs/architecture/CLOUD_FOR_SOVEREIGNTY_LANDING_ZONE.md)
|
||||
|
||||
### Service Deployment
|
||||
1. [Kubernetes Deployment](../../infra/k8s/README.md)
|
||||
2. Service-specific READMEs in `services/*/README.md`
|
||||
|
||||
### Integration Setup
|
||||
1. [Entra VerifiedID](azure/entra-verifiedid.md)
|
||||
2. [CDN Configuration](azure/cdn-setup.md)
|
||||
3. [Integration Guides](../integrations/)
|
||||
|
||||
## Deployment Workflows
|
||||
|
||||
### Complete Azure Deployment
|
||||
|
||||
```bash
|
||||
# 1. Load environment
|
||||
source infra/scripts/azure-load-env.sh
|
||||
|
||||
# 2. Validate configuration
|
||||
./infra/scripts/azure-validate-current-env.sh
|
||||
|
||||
# 3. Deploy infrastructure
|
||||
./infra/scripts/azure-deploy.sh
|
||||
|
||||
# 4. Deploy sovereignty landing zone
|
||||
./infra/scripts/deploy-sovereignty-landing-zone.sh
|
||||
```
|
||||
|
||||
### Kubernetes Deployment
|
||||
|
||||
```bash
|
||||
# 1. Apply base configuration
|
||||
kubectl apply -k infra/k8s/base
|
||||
|
||||
# 2. Apply environment overlay
|
||||
kubectl apply -k infra/k8s/overlays/dev
|
||||
|
||||
# 3. Verify deployment
|
||||
kubectl get pods -n the-order
|
||||
```
|
||||
|
||||
## Documentation Structure
|
||||
|
||||
```
|
||||
deployment/
|
||||
├── README.md # This file
|
||||
└── azure/ # Azure-specific guides
|
||||
├── ENVIRONMENT_SETUP.md
|
||||
├── DOTENV_SETUP.md
|
||||
├── SOVEREIGNTY_LANDING_ZONE_DEPLOYMENT.md
|
||||
├── cdn-setup.md
|
||||
└── entra-verifiedid.md
|
||||
```
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Architecture Documentation](../architecture/)
|
||||
- [Infrastructure Documentation](../../infra/)
|
||||
- [Service Documentation](../../services/)
|
||||
- [Integration Documentation](../integrations/)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
- `../archive/quarantined-legacy-stack/`
|
||||
|
||||
@@ -186,10 +186,10 @@ assets/credential-images/
|
||||
aws s3 cp digital-bank-seal.png s3://your-bucket/images/digital-bank-seal.png --acl public-read
|
||||
```
|
||||
|
||||
### Azure Blob Storage Example
|
||||
### Generic Object Storage Example
|
||||
```bash
|
||||
# In upload-to-cdn.sh
|
||||
az storage blob upload --file digital-bank-seal.png --container-name images --name digital-bank-seal.png --account-name your-account
|
||||
rclone copy digital-bank-seal.png remote:images/digital-bank-seal.png
|
||||
```
|
||||
|
||||
### Cloudflare R2 Example
|
||||
@@ -260,4 +260,3 @@ CDN_BASE_URL=https://your-cdn.com/images ./scripts/deploy/update-manifest-seal-u
|
||||
|
||||
**Last Updated**: [Current Date]
|
||||
**Automation Status**: ✅ Complete
|
||||
|
||||
|
||||
@@ -1,221 +0,0 @@
|
||||
# Using .env File for Azure Deployments
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
**Status**: Complete Guide
|
||||
|
||||
## Overview
|
||||
|
||||
This guide explains how to use the `.env` file in the project root to configure all Azure deployments, ensuring consistent configuration across Terraform, Kubernetes, and application services.
|
||||
|
||||
## Setup
|
||||
|
||||
### Step 1: Create/Update .env File
|
||||
|
||||
The `.env` file should be in the project root (`/home/intlc/projects/the_order/.env`).
|
||||
|
||||
Required variables:
|
||||
```bash
|
||||
# Azure Authentication
|
||||
ARM_SUBSCRIPTION_ID="your-subscription-id"
|
||||
ARM_TENANT_ID="your-tenant-id"
|
||||
|
||||
# Optional: Service Principal (if not using Azure CLI)
|
||||
ARM_CLIENT_ID="your-client-id"
|
||||
ARM_CLIENT_SECRET="your-client-secret"
|
||||
|
||||
# Azure Configuration
|
||||
ARM_LOCATION="westeurope" # No US regions
|
||||
TF_VAR_environment="dev" # dev, stage, or prod
|
||||
```
|
||||
|
||||
### Step 2: Validate Environment
|
||||
|
||||
```bash
|
||||
# Validate all required variables are set
|
||||
source infra/scripts/azure-validate-env.sh
|
||||
```
|
||||
|
||||
This script will:
|
||||
- ✅ Check for required variables
|
||||
- ✅ Set defaults for optional variables
|
||||
- ✅ Verify Azure CLI authentication
|
||||
- ✅ Export Terraform variables
|
||||
|
||||
### Step 3: Sync to Terraform
|
||||
|
||||
```bash
|
||||
# Generate terraform.tfvars from .env
|
||||
./infra/scripts/azure-sync-env-to-terraform.sh
|
||||
```
|
||||
|
||||
This creates `infra/terraform/terraform.tfvars` with all values from `.env`.
|
||||
|
||||
### Step 4: Deploy Infrastructure
|
||||
|
||||
```bash
|
||||
# Complete deployment using .env values
|
||||
./infra/scripts/azure-deploy.sh
|
||||
```
|
||||
|
||||
## How It Works
|
||||
|
||||
### Environment Variable Flow
|
||||
|
||||
```
|
||||
.env file
|
||||
↓
|
||||
azure-validate-env.sh (validates & exports)
|
||||
↓
|
||||
azure-sync-env-to-terraform.sh (creates terraform.tfvars)
|
||||
↓
|
||||
Terraform (creates Azure resources)
|
||||
↓
|
||||
Terraform outputs (Key Vault URI, Storage Account, etc.)
|
||||
↓
|
||||
azure-update-k8s-secrets.sh (updates Kubernetes configs)
|
||||
↓
|
||||
Kubernetes External Secrets (syncs from Key Vault)
|
||||
```
|
||||
|
||||
### Variable Mapping
|
||||
|
||||
| .env Variable | Terraform Variable | Kubernetes Config |
|
||||
|--------------|-------------------|-------------------|
|
||||
| `ARM_SUBSCRIPTION_ID` | `TF_VAR_subscription_id` | Via Key Vault |
|
||||
| `ARM_TENANT_ID` | `TF_VAR_tenant_id` | External Secrets |
|
||||
| `ARM_LOCATION` | `TF_VAR_azure_region` | ConfigMap |
|
||||
| `TF_VAR_environment` | `TF_VAR_environment` | ConfigMap |
|
||||
| `TF_VAR_resource_group_name` | `TF_VAR_resource_group_name` | ConfigMap |
|
||||
| `TF_VAR_storage_account_name` | `TF_VAR_storage_account_name` | External Secrets |
|
||||
| `TF_VAR_key_vault_name` | `TF_VAR_key_vault_name` | External Secrets |
|
||||
|
||||
## Resource Naming
|
||||
|
||||
Resources are named using values from `.env`:
|
||||
|
||||
- **Resource Group**: `TF_VAR_resource_group_name` or `the-order-rg-{environment}`
|
||||
- **Storage Account**: `TF_VAR_storage_account_name` or auto-generated
|
||||
- **Key Vault**: `TF_VAR_key_vault_name` or `the-order-kv-{environment}`
|
||||
- **AKS Cluster**: `TF_VAR_aks_cluster_name` or `the-order-aks-{environment}`
|
||||
|
||||
## Secrets Management
|
||||
|
||||
### Storing Secrets
|
||||
|
||||
Secrets are stored in Azure Key Vault and synced to Kubernetes:
|
||||
|
||||
1. **Store in Key Vault** (via Azure CLI or Terraform):
|
||||
```bash
|
||||
az keyvault secret set \
|
||||
--vault-name <key-vault-name> \
|
||||
--name "database-url" \
|
||||
--value "postgresql://..."
|
||||
```
|
||||
|
||||
2. **Sync to Kubernetes** (automatic via External Secrets Operator):
|
||||
- External Secrets Operator reads from Key Vault
|
||||
- Creates Kubernetes secrets automatically
|
||||
- Updates when Key Vault secrets change
|
||||
|
||||
### Accessing Secrets
|
||||
|
||||
Services access secrets via:
|
||||
- **Kubernetes Secrets**: Created by External Secrets Operator
|
||||
- **Environment Variables**: Injected into pods
|
||||
- **Key Vault Direct**: For services with managed identity
|
||||
|
||||
## Verification
|
||||
|
||||
### Check Terraform Variables
|
||||
|
||||
```bash
|
||||
cd infra/terraform
|
||||
terraform plan # Shows what will be created with current .env values
|
||||
```
|
||||
|
||||
### Check Kubernetes Config
|
||||
|
||||
```bash
|
||||
# View ConfigMap
|
||||
kubectl get configmap azure-config -n the-order -o yaml
|
||||
|
||||
# View External Secrets
|
||||
kubectl get externalsecret azure-secrets -n the-order -o yaml
|
||||
|
||||
# View synced secrets
|
||||
kubectl get secret the-order-secrets -n the-order -o yaml
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Variables Not Found
|
||||
|
||||
```bash
|
||||
# Re-validate environment
|
||||
source infra/scripts/azure-validate-env.sh
|
||||
|
||||
# Check .env file exists
|
||||
ls -la .env
|
||||
|
||||
# Verify variables are set
|
||||
echo $ARM_SUBSCRIPTION_ID
|
||||
echo $ARM_TENANT_ID
|
||||
```
|
||||
|
||||
### Terraform Can't Find Variables
|
||||
|
||||
```bash
|
||||
# Re-sync to Terraform
|
||||
./infra/scripts/azure-sync-env-to-terraform.sh
|
||||
|
||||
# Check terraform.tfvars
|
||||
cat infra/terraform/terraform.tfvars
|
||||
```
|
||||
|
||||
### Kubernetes Secrets Not Syncing
|
||||
|
||||
```bash
|
||||
# Update Kubernetes configs
|
||||
./infra/scripts/azure-update-k8s-secrets.sh
|
||||
|
||||
# Check External Secrets Operator
|
||||
kubectl get pods -n external-secrets-system
|
||||
|
||||
# Check External Secret status
|
||||
kubectl describe externalsecret azure-secrets -n the-order
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
1. **Never commit .env file** - It's in `.gitignore`
|
||||
2. **Use different .env files** for different environments
|
||||
3. **Store sensitive values in Key Vault** - Not in .env
|
||||
4. **Validate before deploying** - Always run validation script
|
||||
5. **Keep .env.example updated** - Document all variables
|
||||
|
||||
## Example .env File
|
||||
|
||||
```bash
|
||||
# Azure Authentication
|
||||
ARM_SUBSCRIPTION_ID="12345678-1234-1234-1234-123456789012"
|
||||
ARM_TENANT_ID="87654321-4321-4321-4321-210987654321"
|
||||
|
||||
# Azure Configuration
|
||||
ARM_LOCATION="westeurope"
|
||||
TF_VAR_environment="dev"
|
||||
|
||||
# Resource Naming
|
||||
TF_VAR_resource_group_name="the-order-rg-dev"
|
||||
TF_VAR_storage_account_name="theorderdev12345"
|
||||
TF_VAR_key_vault_name="the-order-kv-dev"
|
||||
|
||||
# AKS Configuration
|
||||
TF_VAR_aks_cluster_name="the-order-aks-dev"
|
||||
TF_VAR_aks_node_count=2
|
||||
TF_VAR_aks_vm_size="Standard_B2s"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
|
||||
@@ -1,247 +0,0 @@
|
||||
# Azure Environment Setup Guide
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
**Status**: Complete Setup Guide
|
||||
|
||||
## Overview
|
||||
|
||||
This guide explains how to configure Azure deployments using environment variables from `.env` files.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
1. **Azure CLI installed and logged in**
|
||||
```bash
|
||||
az login
|
||||
az account list
|
||||
az account set --subscription <subscription-id>
|
||||
```
|
||||
|
||||
2. **Terraform installed** (>= 1.5.0)
|
||||
```bash
|
||||
terraform version
|
||||
```
|
||||
|
||||
3. **Environment file created**
|
||||
- Copy `infra/terraform/.env.example` to `.env` or `infra/terraform/.env`
|
||||
- Fill in your Azure credentials
|
||||
|
||||
## Environment Variables
|
||||
|
||||
### Required Variables
|
||||
|
||||
```bash
|
||||
# Azure Authentication
|
||||
ARM_SUBSCRIPTION_ID="your-subscription-id"
|
||||
ARM_TENANT_ID="your-tenant-id"
|
||||
|
||||
# Optional: Service Principal (if not using Azure CLI)
|
||||
ARM_CLIENT_ID="your-client-id"
|
||||
ARM_CLIENT_SECRET="your-client-secret"
|
||||
```
|
||||
|
||||
### Configuration Variables
|
||||
|
||||
```bash
|
||||
# Azure Region (no US regions)
|
||||
ARM_LOCATION="westeurope"
|
||||
|
||||
# Environment
|
||||
TF_VAR_environment="dev" # dev, stage, or prod
|
||||
|
||||
# Resource Names
|
||||
TF_VAR_resource_group_name="the-order-rg"
|
||||
TF_VAR_storage_account_name="theorderdev" # Must be globally unique
|
||||
TF_VAR_key_vault_name="the-order-kv-dev" # Must be globally unique
|
||||
```
|
||||
|
||||
## Setup Steps
|
||||
|
||||
### Step 1: Create Environment File
|
||||
|
||||
```bash
|
||||
# Copy example file
|
||||
cp infra/terraform/.env.example .env
|
||||
|
||||
# Or use Terraform-specific location
|
||||
cp infra/terraform/.env.example infra/terraform/.env
|
||||
|
||||
# Edit with your values
|
||||
nano .env # or your preferred editor
|
||||
```
|
||||
|
||||
### Step 2: Load Environment Variables
|
||||
|
||||
```bash
|
||||
# Load variables
|
||||
source infra/scripts/azure-load-env.sh
|
||||
|
||||
# Verify
|
||||
echo $ARM_SUBSCRIPTION_ID
|
||||
echo $ARM_TENANT_ID
|
||||
```
|
||||
|
||||
### Step 3: Deploy Infrastructure
|
||||
|
||||
```bash
|
||||
# Option 1: Use deployment script (recommended)
|
||||
./infra/scripts/azure-deploy.sh
|
||||
|
||||
# Option 2: Manual Terraform
|
||||
cd infra/terraform
|
||||
terraform init
|
||||
terraform plan
|
||||
terraform apply
|
||||
```
|
||||
|
||||
## Resource Configuration
|
||||
|
||||
### Resource Group
|
||||
- **Name**: `the-order-rg-{environment}`
|
||||
- **Location**: `westeurope` (or other non-US region)
|
||||
- **Tags**: Environment, Project, ManagedBy
|
||||
|
||||
### Storage Account
|
||||
- **Name**: Must be globally unique (lowercase, alphanumeric)
|
||||
- **Tier**: Standard
|
||||
- **Replication**: LRS (dev), GRS (prod)
|
||||
- **Purpose**: Document storage, CDN origin
|
||||
|
||||
### Key Vault
|
||||
- **Name**: Must be globally unique
|
||||
- **SKU**: Standard
|
||||
- **Soft Delete**: Enabled (7 days retention)
|
||||
- **Purge Protection**: Enabled for production
|
||||
|
||||
### AKS Cluster
|
||||
- **Name**: `the-order-aks-{environment}`
|
||||
- **Kubernetes Version**: 1.28+
|
||||
- **Node Count**: 2 (dev), auto-scaling (prod)
|
||||
- **VM Size**: Standard_B2s (dev), Standard_D2s_v3 (prod)
|
||||
|
||||
### CDN
|
||||
- **Profile**: `theorder-cdn-{environment}`
|
||||
- **Endpoint**: `theorder-cdn-endpoint-{environment}`
|
||||
- **SKU**: Standard_Microsoft
|
||||
|
||||
## Secrets Management
|
||||
|
||||
### Storing Secrets in Key Vault
|
||||
|
||||
```bash
|
||||
# Set secret in Key Vault
|
||||
az keyvault secret set \
|
||||
--vault-name <key-vault-name> \
|
||||
--name "database-url" \
|
||||
--value "postgresql://..."
|
||||
|
||||
# List secrets
|
||||
az keyvault secret list --vault-name <key-vault-name>
|
||||
```
|
||||
|
||||
### Using External Secrets Operator
|
||||
|
||||
Secrets are automatically synced from Key Vault to Kubernetes using External Secrets Operator. See `infra/k8s/base/external-secrets.yaml`.
|
||||
|
||||
## Verification
|
||||
|
||||
### Check Azure Resources
|
||||
|
||||
```bash
|
||||
# List resource groups
|
||||
az group list --query "[?contains(name, 'the-order')]"
|
||||
|
||||
# List storage accounts
|
||||
az storage account list --query "[?contains(name, 'theorder')]"
|
||||
|
||||
# List Key Vaults
|
||||
az keyvault list --query "[?contains(name, 'the-order')]"
|
||||
|
||||
# List AKS clusters
|
||||
az aks list --query "[?contains(name, 'the-order')]"
|
||||
```
|
||||
|
||||
### Check Kubernetes Access
|
||||
|
||||
```bash
|
||||
# Get kubeconfig
|
||||
az aks get-credentials \
|
||||
--resource-group <resource-group> \
|
||||
--name <aks-cluster-name>
|
||||
|
||||
# Verify access
|
||||
kubectl get nodes
|
||||
kubectl get namespaces
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Authentication Issues
|
||||
|
||||
```bash
|
||||
# Re-authenticate with Azure CLI
|
||||
az login
|
||||
az account set --subscription <subscription-id>
|
||||
|
||||
# Verify current subscription
|
||||
az account show
|
||||
```
|
||||
|
||||
### Terraform Issues
|
||||
|
||||
```bash
|
||||
# Re-initialize Terraform
|
||||
cd infra/terraform
|
||||
terraform init -upgrade
|
||||
|
||||
# Validate configuration
|
||||
terraform validate
|
||||
|
||||
# Check state
|
||||
terraform state list
|
||||
```
|
||||
|
||||
### Resource Naming Conflicts
|
||||
|
||||
If you get "name already taken" errors:
|
||||
1. Choose a more unique name
|
||||
2. Use a different Azure region
|
||||
3. Delete the conflicting resource (if safe)
|
||||
|
||||
## Environment-Specific Configurations
|
||||
|
||||
### Development
|
||||
- **Replication**: LRS (lower cost)
|
||||
- **Node Count**: 2 (fixed)
|
||||
- **Retention**: 30 days
|
||||
- **Purge Protection**: Disabled
|
||||
|
||||
### Staging
|
||||
- **Replication**: GRS
|
||||
- **Node Count**: 2-5 (auto-scaling)
|
||||
- **Retention**: 60 days
|
||||
- **Purge Protection**: Enabled
|
||||
|
||||
### Production
|
||||
- **Replication**: GRS or ZRS
|
||||
- **Node Count**: 3-10 (auto-scaling)
|
||||
- **Retention**: 90 days
|
||||
- **Purge Protection**: Enabled
|
||||
- **Backup**: Enabled
|
||||
- **Monitoring**: Full observability
|
||||
|
||||
## Next Steps
|
||||
|
||||
After infrastructure is deployed:
|
||||
|
||||
1. **Configure Kubernetes secrets** (via External Secrets Operator)
|
||||
2. **Deploy services** to AKS
|
||||
3. **Set up monitoring** (Prometheus/Grafana)
|
||||
4. **Configure logging** (Fluentd/OpenSearch)
|
||||
5. **Set up CI/CD** pipelines
|
||||
|
||||
See other deployment guides for details.
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
|
||||
@@ -1,123 +0,0 @@
|
||||
# .env File Analysis Report
|
||||
|
||||
**Date**: 2025-01-27
|
||||
**File**: `/home/intlc/projects/the_order/.env`
|
||||
**Status**: ✅ Valid for Azure Deployments
|
||||
|
||||
## Current Configuration (Lines 1-6)
|
||||
|
||||
```bash
|
||||
AZURE_SUBSCRIPTION_ID="70569bdd-de60-4dd1-838e-5fde7f91fe8d"
|
||||
AZURE_TENANT_ID="fb97e99d-3e94-4686-bfde-4bf4062e05f3"
|
||||
AZURE_MANAGEMENT_GROUP_ID="SOVEREIGN-ORDER-OF-HOSPITALLERS"
|
||||
AZURE_RESOURCE_GROUP=
|
||||
AZURE_LOCATION=westeurope
|
||||
```
|
||||
|
||||
## Analysis Results
|
||||
|
||||
### ✅ Required Variables - Present
|
||||
|
||||
1. **Subscription ID**: ✅ Valid UUID format
|
||||
- Value: `70569bdd-de60-4dd1-838e-5fde7f91fe8d`
|
||||
- Format: Valid UUID
|
||||
|
||||
2. **Tenant ID**: ✅ Valid UUID format
|
||||
- Value: `fb97e99d-3e94-4686-bfde-4bf4062e05f3`
|
||||
- Format: Valid UUID
|
||||
|
||||
3. **Location**: ✅ Valid non-US region
|
||||
- Value: `westeurope`
|
||||
- Compliant: Yes (non-US region as required)
|
||||
|
||||
### 📋 Optional Variables - Present
|
||||
|
||||
4. **Management Group ID**: ✅ Set
|
||||
- Value: `SOVEREIGN-ORDER-OF-HOSPITALLERS`
|
||||
- Status: Valid management group identifier
|
||||
|
||||
5. **Resource Group**: ⚠️ Empty
|
||||
- Status: Will use default naming convention from Terraform
|
||||
- Default: `az-we-rg-dev-main` (or based on environment)
|
||||
|
||||
### ⚠️ Missing Recommended Variables
|
||||
|
||||
- `TF_VAR_environment` - Will default to `dev`
|
||||
- `TF_VAR_resource_group_name` - Will use naming convention
|
||||
- `TF_VAR_storage_account_name` - Will use naming convention
|
||||
- `TF_VAR_key_vault_name` - Will use naming convention
|
||||
|
||||
## Terraform Compatibility
|
||||
|
||||
### Variable Mapping
|
||||
|
||||
The `.env` file uses `AZURE_*` prefix, but Terraform expects `ARM_*` prefix. Our scripts automatically map:
|
||||
|
||||
- `AZURE_SUBSCRIPTION_ID` → `ARM_SUBSCRIPTION_ID` ✅
|
||||
- `AZURE_TENANT_ID` → `ARM_TENANT_ID` ✅
|
||||
- `AZURE_LOCATION` → `ARM_LOCATION` ✅
|
||||
|
||||
### Recommendations
|
||||
|
||||
1. **Add ARM_* aliases** (optional but recommended):
|
||||
```bash
|
||||
ARM_SUBSCRIPTION_ID="$AZURE_SUBSCRIPTION_ID"
|
||||
ARM_TENANT_ID="$AZURE_TENANT_ID"
|
||||
ARM_LOCATION="$AZURE_LOCATION"
|
||||
```
|
||||
|
||||
2. **Add environment variable**:
|
||||
```bash
|
||||
TF_VAR_environment="dev" # or "stage" or "prod"
|
||||
```
|
||||
|
||||
3. **Add custom resource names** (optional):
|
||||
```bash
|
||||
TF_VAR_resource_group_name="the-order-rg-dev"
|
||||
TF_VAR_storage_account_name="theorderdev12345"
|
||||
TF_VAR_key_vault_name="the-order-kv-dev"
|
||||
```
|
||||
|
||||
## Validation Status
|
||||
|
||||
✅ **All required variables are present and valid**
|
||||
|
||||
The `.env` file is properly configured for Azure deployments. The validation script will:
|
||||
- Automatically map `AZURE_*` to `ARM_*` variables
|
||||
- Set defaults for missing optional variables
|
||||
- Export Terraform variables correctly
|
||||
|
||||
## Usage
|
||||
|
||||
### Validate Configuration
|
||||
```bash
|
||||
./infra/scripts/azure-validate-current-env.sh
|
||||
```
|
||||
|
||||
### Auto-fix Variable Mapping
|
||||
```bash
|
||||
./infra/scripts/azure-fix-env-mapping.sh
|
||||
```
|
||||
|
||||
### Load and Deploy
|
||||
```bash
|
||||
source infra/scripts/azure-load-env.sh
|
||||
./infra/scripts/azure-complete-setup.sh
|
||||
./infra/scripts/azure-deploy.sh
|
||||
```
|
||||
|
||||
## Summary
|
||||
|
||||
| Category | Status | Count |
|
||||
|----------|--------|-------|
|
||||
| Required Variables | ✅ Complete | 3/3 |
|
||||
| Optional Variables | ⚠️ Partial | 1/5 |
|
||||
| Format Validation | ✅ Valid | All |
|
||||
| Terraform Compatibility | ✅ Compatible | Yes |
|
||||
|
||||
**Overall Status**: ✅ **Ready for Azure Deployments**
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
|
||||
@@ -1,350 +0,0 @@
|
||||
# Cloud for Sovereignty Landing Zone Deployment Guide
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
**Management Group**: SOVEREIGN-ORDER-OF-HOSPITALLERS
|
||||
**Framework**: Azure Well-Architected Framework + Cloud for Sovereignty
|
||||
|
||||
## Overview
|
||||
|
||||
This guide walks through deploying a complete Cloud for Sovereignty landing zone across all non-US commercial Azure regions, using the Azure Well-Architected Framework principles.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
1. **Azure Subscription** with access to management group
|
||||
2. **Management Group**: `SOVEREIGN-ORDER-OF-HOSPITALLERS` must exist
|
||||
3. **Azure CLI** installed and authenticated
|
||||
4. **Terraform** >= 1.5.0 installed
|
||||
5. **Environment Variables** configured in `.env` file
|
||||
|
||||
## Architecture Overview
|
||||
|
||||
### Management Group Hierarchy
|
||||
|
||||
```
|
||||
SOVEREIGN-ORDER-OF-HOSPITALLERS (Root)
|
||||
├── Landing Zones
|
||||
│ ├── Platform
|
||||
│ ├── Sandbox
|
||||
│ └── Workloads
|
||||
├── Management
|
||||
│ ├── Identity
|
||||
│ ├── Security
|
||||
│ └── Monitoring
|
||||
└── Connectivity
|
||||
├── Hub Networks
|
||||
└── Spoke Networks
|
||||
```
|
||||
|
||||
### Regional Architecture
|
||||
|
||||
Each region (7 total) includes:
|
||||
- Hub Virtual Network (gateway, firewall, management)
|
||||
- Spoke Virtual Network (application, database, storage)
|
||||
- Azure Firewall
|
||||
- Key Vault with private endpoint
|
||||
- Log Analytics Workspace
|
||||
- Storage Account with private endpoint
|
||||
|
||||
## Deployment Steps
|
||||
|
||||
### Step 1: Validate Environment
|
||||
|
||||
```bash
|
||||
# Load and validate environment variables
|
||||
source infra/scripts/azure-load-env.sh
|
||||
|
||||
# Verify management group exists
|
||||
az account management-group show --name SOVEREIGN-ORDER-OF-HOSPITALLERS
|
||||
```
|
||||
|
||||
### Step 2: Deploy Management Group Hierarchy
|
||||
|
||||
```bash
|
||||
cd infra/terraform/management-groups
|
||||
|
||||
# Initialize Terraform
|
||||
terraform init
|
||||
|
||||
# Review plan
|
||||
terraform plan -var="management_group_id=SOVEREIGN-ORDER-OF-HOSPITALLERS"
|
||||
|
||||
# Apply
|
||||
terraform apply
|
||||
```
|
||||
|
||||
This creates:
|
||||
- Landing Zones management group
|
||||
- Platform, Sandbox, and Workloads groups
|
||||
- Management group (Identity, Security, Monitoring)
|
||||
- Connectivity group (Hub Networks, Spoke Networks)
|
||||
|
||||
### Step 3: Deploy Sovereignty Policies
|
||||
|
||||
```bash
|
||||
cd ../policies
|
||||
|
||||
# Initialize Terraform
|
||||
terraform init
|
||||
|
||||
# Review plan
|
||||
terraform plan -var="management_group_id=SOVEREIGN-ORDER-OF-HOSPITALLERS"
|
||||
|
||||
# Apply
|
||||
terraform apply
|
||||
```
|
||||
|
||||
This creates and assigns:
|
||||
- Allowed locations policy (non-US regions only)
|
||||
- Deny US regions policy
|
||||
- Require data residency tags
|
||||
- Require encryption at rest
|
||||
- Require resource tags
|
||||
- Policy initiative for sovereignty compliance
|
||||
|
||||
### Step 4: Deploy Multi-Region Landing Zones
|
||||
|
||||
```bash
|
||||
cd ../multi-region
|
||||
|
||||
# Initialize Terraform
|
||||
terraform init
|
||||
|
||||
# Review plan (all regions)
|
||||
terraform plan \
|
||||
-var="environment=dev" \
|
||||
-var="management_group_id=SOVEREIGN-ORDER-OF-HOSPITALLERS" \
|
||||
-var="deploy_all_regions=true"
|
||||
|
||||
# Apply
|
||||
terraform apply
|
||||
```
|
||||
|
||||
This deploys landing zones to:
|
||||
1. West Europe (Netherlands) - Primary
|
||||
2. North Europe (Ireland) - Secondary
|
||||
3. UK South (London)
|
||||
4. Switzerland North (Zurich)
|
||||
5. Norway East (Oslo)
|
||||
6. France Central (Paris)
|
||||
7. Germany West Central (Frankfurt)
|
||||
|
||||
### Step 5: Verify Deployment
|
||||
|
||||
```bash
|
||||
# Check resource groups
|
||||
az group list --query "[?contains(name, 'az-')]" --output table
|
||||
|
||||
# Check Key Vaults
|
||||
az keyvault list --query "[?contains(name, 'az-')]" --output table
|
||||
|
||||
# Check Virtual Networks
|
||||
az network vnet list --query "[?contains(name, 'az-')]" --output table
|
||||
|
||||
# Check policy compliance
|
||||
az policy state list --filter "complianceState eq 'NonCompliant'" --query "[].{Resource:resourceId, Policy:policyDefinitionName}" --output table
|
||||
```
|
||||
|
||||
## Automated Deployment
|
||||
|
||||
Use the deployment script for automated deployment:
|
||||
|
||||
```bash
|
||||
./infra/scripts/deploy-sovereignty-landing-zone.sh
|
||||
```
|
||||
|
||||
This script:
|
||||
1. Loads environment variables
|
||||
2. Deploys management group hierarchy
|
||||
3. Deploys sovereignty policies
|
||||
4. Deploys multi-region landing zones
|
||||
5. Provides deployment summary
|
||||
|
||||
## Regional Resources
|
||||
|
||||
### Per Region Resources
|
||||
|
||||
Each region deployment creates:
|
||||
|
||||
- **1 Resource Group**
|
||||
- **2 Virtual Networks** (Hub + Spoke)
|
||||
- **6 Subnets** (3 hub + 3 spoke)
|
||||
- **1 Azure Firewall**
|
||||
- **1 Public IP** (for firewall)
|
||||
- **2 VNet Peerings** (hub ↔ spoke)
|
||||
- **1 Key Vault** (with private endpoint)
|
||||
- **1 Log Analytics Workspace**
|
||||
- **1 Storage Account** (with private endpoint)
|
||||
- **2 Private Endpoints** (Key Vault + Storage)
|
||||
|
||||
### Total Resources (7 regions)
|
||||
|
||||
- **7 Resource Groups**
|
||||
- **14 Virtual Networks**
|
||||
- **42 Subnets**
|
||||
- **7 Azure Firewalls**
|
||||
- **7 Public IPs**
|
||||
- **14 VNet Peerings**
|
||||
- **7 Key Vaults**
|
||||
- **7 Log Analytics Workspaces**
|
||||
- **7 Storage Accounts**
|
||||
- **14 Private Endpoints**
|
||||
|
||||
## Network Architecture
|
||||
|
||||
### Hub Network
|
||||
|
||||
- **Gateway Subnet**: VPN/ExpressRoute connectivity
|
||||
- **Azure Firewall Subnet**: Centralized security
|
||||
- **Management Subnet**: Management and monitoring
|
||||
|
||||
### Spoke Network
|
||||
|
||||
- **Application Subnet**: Application workloads
|
||||
- **Database Subnet**: Database servers (with delegation)
|
||||
- **Storage Subnet**: Storage private endpoints
|
||||
|
||||
### Connectivity
|
||||
|
||||
- Hub and Spoke connected via VNet peering
|
||||
- Hub allows gateway transit
|
||||
- Spoke uses remote gateways
|
||||
|
||||
## Security Features
|
||||
|
||||
### Data Sovereignty
|
||||
|
||||
- **Private Endpoints**: All PaaS services use private endpoints
|
||||
- **Customer-Managed Keys**: Encryption with Key Vault
|
||||
- **Data Residency Tags**: All resources tagged with region
|
||||
- **Network Isolation**: Hub-and-spoke architecture
|
||||
|
||||
### Compliance
|
||||
|
||||
- **Azure Policies**: Enforce location and encryption
|
||||
- **Tagging**: Required tags for governance
|
||||
- **Audit Logging**: Log Analytics for all regions
|
||||
- **Access Control**: RBAC and management groups
|
||||
|
||||
## Cost Estimation
|
||||
|
||||
### Per Region (Monthly)
|
||||
|
||||
- Virtual Networks: ~$50
|
||||
- Azure Firewall: ~$1,200 (Standard SKU)
|
||||
- Key Vault: ~$15 (Premium SKU)
|
||||
- Log Analytics: ~$200-500 (data ingestion)
|
||||
- Storage Account: ~$50-200 (depending on usage)
|
||||
- Private Endpoints: ~$35 (2 endpoints)
|
||||
|
||||
**Total per region**: ~$1,550-2,000/month
|
||||
|
||||
### Multi-Region (7 regions)
|
||||
|
||||
- **Development**: ~$10,850-14,000/month
|
||||
- **Production**: ~$15,000-20,000/month (with higher usage)
|
||||
|
||||
## Monitoring
|
||||
|
||||
### Regional Monitoring
|
||||
|
||||
Each region has:
|
||||
- Log Analytics Workspace
|
||||
- Application Insights ready
|
||||
- Azure Monitor metrics
|
||||
- Network Watcher
|
||||
|
||||
### Centralized Monitoring
|
||||
|
||||
- Cross-region querying
|
||||
- Centralized dashboards
|
||||
- Alert rules per region
|
||||
- Cost tracking per region
|
||||
|
||||
## Disaster Recovery
|
||||
|
||||
### Regional Failover
|
||||
|
||||
- Primary: West Europe
|
||||
- Secondary: North Europe
|
||||
- Backup regions: Other 5 regions
|
||||
|
||||
### RTO/RPO
|
||||
|
||||
- **RTO**: 4 hours
|
||||
- **RPO**: 1 hour
|
||||
|
||||
### DR Strategy
|
||||
|
||||
1. Automated failover for critical services
|
||||
2. Manual failover for non-critical services
|
||||
3. Geo-replication for storage
|
||||
4. Cross-region backup
|
||||
|
||||
## Next Steps
|
||||
|
||||
After deployment:
|
||||
|
||||
1. **Configure Application Workloads**
|
||||
- Deploy AKS clusters per region
|
||||
- Configure application networking
|
||||
- Set up application monitoring
|
||||
|
||||
2. **Set Up Monitoring**
|
||||
- Create Grafana dashboards
|
||||
- Configure alert rules
|
||||
- Set up cost alerts
|
||||
|
||||
3. **Implement Security**
|
||||
- Configure Azure Firewall rules
|
||||
- Set up Microsoft Defender for Cloud
|
||||
- Configure Azure Sentinel
|
||||
|
||||
4. **Optimize Costs**
|
||||
- Review resource usage
|
||||
- Implement reserved instances
|
||||
- Optimize storage tiers
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Management Group Not Found
|
||||
|
||||
```bash
|
||||
# Verify management group exists
|
||||
az account management-group show --name SOVEREIGN-ORDER-OF-HOSPITALLERS
|
||||
|
||||
# Create if needed (requires appropriate permissions)
|
||||
az account management-group create --name SOVEREIGN-ORDER-OF-HOSPITALLERS
|
||||
```
|
||||
|
||||
### Policy Assignment Fails
|
||||
|
||||
```bash
|
||||
# Check policy assignment
|
||||
az policy assignment list --scope "/providers/Microsoft.Management/managementGroups/SOVEREIGN-ORDER-OF-HOSPITALLERS"
|
||||
|
||||
# Verify permissions
|
||||
az role assignment list --assignee <your-user-id>
|
||||
```
|
||||
|
||||
### Region Deployment Fails
|
||||
|
||||
```bash
|
||||
# Check resource provider registration
|
||||
az provider list --query "[?namespace=='Microsoft.Network']"
|
||||
az provider register --namespace Microsoft.Network
|
||||
|
||||
# Check quotas
|
||||
az vm list-usage --location westeurope --output table
|
||||
```
|
||||
|
||||
## References
|
||||
|
||||
- [Azure Well-Architected Framework](https://docs.microsoft.com/azure/architecture/framework/)
|
||||
- [Cloud for Sovereignty](https://azure.microsoft.com/solutions/sovereignty/)
|
||||
- [Azure Landing Zones](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/)
|
||||
- [Management Groups](https://docs.microsoft.com/azure/governance/management-groups/)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
|
||||
@@ -1,251 +0,0 @@
|
||||
# CDN Configuration for Credential Seals
|
||||
|
||||
## Current Status
|
||||
|
||||
**CDN Provider**: Not yet configured (placeholder URLs in use)
|
||||
**Default URL Pattern**: `https://cdn.theorder.org/images/`
|
||||
**Status**: Ready for CDN configuration
|
||||
|
||||
## Available CDN Options
|
||||
|
||||
Based on the infrastructure setup, the following CDN options are available:
|
||||
|
||||
### 1. Azure Blob Storage + CDN (Recommended for Azure Infrastructure)
|
||||
|
||||
**Why**: The infrastructure is primarily Azure-based (Azure Storage, AKS, Key Vault)
|
||||
|
||||
**Configuration**:
|
||||
```bash
|
||||
# Azure Blob Storage with CDN
|
||||
CDN_BASE_URL=https://<storage-account>.blob.core.windows.net/images/
|
||||
# Or with Azure CDN
|
||||
CDN_BASE_URL=https://<cdn-endpoint>.azureedge.net/images/
|
||||
```
|
||||
|
||||
**Upload Script** (Azure):
|
||||
```bash
|
||||
# Using Azure CLI
|
||||
az storage blob upload \
|
||||
--file "${png_file}" \
|
||||
--container-name images \
|
||||
--name "${png_file}" \
|
||||
--account-name <storage-account> \
|
||||
--auth-mode login
|
||||
|
||||
# Set public access
|
||||
az storage blob set-permission \
|
||||
--container-name images \
|
||||
--name "${png_file}" \
|
||||
--public-access blob \
|
||||
--account-name <storage-account>
|
||||
```
|
||||
|
||||
### 2. AWS S3 + CloudFront (If using AWS)
|
||||
|
||||
**Why**: The storage package supports S3 (`@aws-sdk/client-s3`)
|
||||
|
||||
**Configuration**:
|
||||
```bash
|
||||
CDN_BASE_URL=https://<bucket>.s3.<region>.amazonaws.com/images/
|
||||
# Or with CloudFront
|
||||
CDN_BASE_URL=https://<cloudfront-id>.cloudfront.net/images/
|
||||
```
|
||||
|
||||
**Upload Script** (AWS):
|
||||
```bash
|
||||
# Using AWS CLI
|
||||
aws s3 cp "${png_file}" \
|
||||
"s3://<bucket>/images/${png_file}" \
|
||||
--acl public-read \
|
||||
--content-type image/png
|
||||
```
|
||||
|
||||
### 3. Cloudflare R2 (Modern Alternative)
|
||||
|
||||
**Why**: Cost-effective, S3-compatible API
|
||||
|
||||
**Configuration**:
|
||||
```bash
|
||||
CDN_BASE_URL=https://<account-id>.r2.cloudflarestorage.com/images/
|
||||
# Or with Cloudflare CDN
|
||||
CDN_BASE_URL=https://<custom-domain>/images/
|
||||
```
|
||||
|
||||
**Upload Script** (Cloudflare R2):
|
||||
```bash
|
||||
# Using rclone
|
||||
rclone copy "${png_file}" \
|
||||
r2:images/ \
|
||||
--s3-provider Cloudflare \
|
||||
--s3-access-key-id <key> \
|
||||
--s3-secret-access-key <secret>
|
||||
```
|
||||
|
||||
### 4. GitHub Pages / Static Hosting
|
||||
|
||||
**Why**: Simple, free for public repos
|
||||
|
||||
**Configuration**:
|
||||
```bash
|
||||
CDN_BASE_URL=https://theorder.github.io/assets/images/
|
||||
```
|
||||
|
||||
### 5. Custom Domain CDN
|
||||
|
||||
**Why**: Full control, custom branding
|
||||
|
||||
**Configuration**:
|
||||
```bash
|
||||
CDN_BASE_URL=https://cdn.theorder.org/images/
|
||||
```
|
||||
|
||||
## Recommended Configuration
|
||||
|
||||
### For Azure Infrastructure (Current Setup)
|
||||
|
||||
**Recommended**: Azure Blob Storage + Azure CDN
|
||||
|
||||
1. **Create Storage Account**:
|
||||
```bash
|
||||
az storage account create \
|
||||
--name theordercdn \
|
||||
--resource-group <rg> \
|
||||
--location westeurope \
|
||||
--sku Standard_LRS \
|
||||
--kind StorageV2
|
||||
```
|
||||
|
||||
2. **Create Container**:
|
||||
```bash
|
||||
az storage container create \
|
||||
--name images \
|
||||
--account-name theordercdn \
|
||||
--public-access blob
|
||||
```
|
||||
|
||||
3. **Create CDN Profile** (Optional):
|
||||
```bash
|
||||
az cdn profile create \
|
||||
--name theorder-cdn \
|
||||
--resource-group <rg> \
|
||||
--sku Standard_Microsoft
|
||||
```
|
||||
|
||||
4. **Set CDN Base URL**:
|
||||
```bash
|
||||
export CDN_BASE_URL=https://theordercdn.blob.core.windows.net/images/
|
||||
# Or with CDN
|
||||
export CDN_BASE_URL=https://<cdn-endpoint>.azureedge.net/images/
|
||||
```
|
||||
|
||||
## Current Configuration
|
||||
|
||||
### Default URLs (Placeholder)
|
||||
|
||||
All manifest templates currently use:
|
||||
```
|
||||
https://cdn.theorder.org/images/
|
||||
```
|
||||
|
||||
### Files Using CDN URLs
|
||||
|
||||
- `manifests/entra/default-manifest-template.json`
|
||||
- `manifests/entra/financial-manifest-template.json`
|
||||
- `manifests/entra/judicial-manifest-template.json`
|
||||
- `manifests/entra/diplomatic-manifest-template.json`
|
||||
|
||||
### Update Script
|
||||
|
||||
To update all manifest templates with your CDN URL:
|
||||
```bash
|
||||
CDN_BASE_URL=https://your-cdn.com/images \
|
||||
./scripts/deploy/update-manifest-seal-urls.sh
|
||||
```
|
||||
|
||||
## Upload Script Template
|
||||
|
||||
The upload script template is located at:
|
||||
```
|
||||
assets/credential-images/png/upload-to-cdn.sh
|
||||
```
|
||||
|
||||
**Current Status**: Template (needs customization)
|
||||
|
||||
**To Customize**:
|
||||
1. Edit `assets/credential-images/png/upload-to-cdn.sh`
|
||||
2. Add your CDN provider's upload commands
|
||||
3. Set credentials/environment variables
|
||||
4. Run the script
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Choose CDN Provider**
|
||||
- Azure Blob Storage + CDN (recommended for Azure infrastructure)
|
||||
- AWS S3 + CloudFront (if using AWS)
|
||||
- Cloudflare R2 (cost-effective alternative)
|
||||
- Custom domain CDN
|
||||
|
||||
2. **Configure CDN**
|
||||
- Create storage account/container
|
||||
- Set up CDN endpoint (optional)
|
||||
- Configure public access
|
||||
- Set CORS headers (if needed)
|
||||
|
||||
3. **Upload Files**
|
||||
- Customize `upload-to-cdn.sh`
|
||||
- Upload all PNG files
|
||||
- Verify HTTPS and public access
|
||||
|
||||
4. **Update Configuration**
|
||||
- Set `CDN_BASE_URL` environment variable
|
||||
- Run `update-manifest-seal-urls.sh`
|
||||
- Update manifest templates
|
||||
|
||||
5. **Test**
|
||||
- Verify URLs are accessible
|
||||
- Test image loading
|
||||
- Test credential issuance
|
||||
|
||||
## Environment Variables
|
||||
|
||||
Set these for CDN configuration:
|
||||
|
||||
```bash
|
||||
# CDN Base URL
|
||||
export CDN_BASE_URL=https://your-cdn.com/images
|
||||
|
||||
# Azure (if using)
|
||||
export AZURE_STORAGE_ACCOUNT=theordercdn
|
||||
export AZURE_STORAGE_KEY=<key>
|
||||
export AZURE_STORAGE_CONTAINER=images
|
||||
|
||||
# AWS (if using)
|
||||
export AWS_S3_BUCKET=theorder-images
|
||||
export AWS_REGION=eu-west-1
|
||||
|
||||
# Cloudflare R2 (if using)
|
||||
export R2_ACCOUNT_ID=<id>
|
||||
export R2_ACCESS_KEY_ID=<key>
|
||||
export R2_SECRET_ACCESS_KEY=<secret>
|
||||
```
|
||||
|
||||
## Security Considerations
|
||||
|
||||
1. **HTTPS Required**: All CDN URLs must use HTTPS
|
||||
2. **Public Access**: Images must be publicly accessible
|
||||
3. **CORS**: Configure CORS if needed for cross-origin requests
|
||||
4. **Content-Type**: Ensure correct `image/png` content type
|
||||
5. **Cache Headers**: Set appropriate cache headers
|
||||
|
||||
## References
|
||||
|
||||
- [Azure Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/)
|
||||
- [Azure CDN](https://docs.microsoft.com/en-us/azure/cdn/)
|
||||
- [AWS S3](https://docs.aws.amazon.com/s3/)
|
||||
- [Cloudflare R2](https://developers.cloudflare.com/r2/)
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: [Current Date]
|
||||
**Status**: Ready for CDN configuration
|
||||
|
||||
@@ -1,209 +0,0 @@
|
||||
# Azure CDN Setup for Credential Seals
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
**Status**: Complete and Operational
|
||||
|
||||
## Overview
|
||||
|
||||
Complete guide for setting up Azure CDN infrastructure for Order of St John credential seal images. This setup provides high-performance, globally distributed hosting for credential images used in Entra VerifiedID credentials.
|
||||
|
||||
## Quick Start
|
||||
|
||||
**One-Command Setup:**
|
||||
```bash
|
||||
./scripts/deploy/setup-azure-cdn-complete.sh
|
||||
```
|
||||
|
||||
This automates:
|
||||
1. ✅ Azure quota checking
|
||||
2. ✅ Infrastructure creation (Storage Account, Container, CDN Profile, Endpoint)
|
||||
3. ✅ File upload (all seal PNG files)
|
||||
4. ✅ Manifest URL updates
|
||||
|
||||
## Prerequisites
|
||||
|
||||
1. **Azure CLI installed**
|
||||
```bash
|
||||
# Install Azure CLI
|
||||
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
|
||||
```
|
||||
|
||||
2. **Logged in to Azure**
|
||||
```bash
|
||||
az login
|
||||
az account set --subscription <subscription-id>
|
||||
```
|
||||
|
||||
3. **Required Permissions**
|
||||
- Contributor or Owner role on subscription
|
||||
- Storage Account Contributor
|
||||
- CDN Contributor
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
Azure Subscription
|
||||
├── Resource Group: theorder-rg-dev
|
||||
├── Storage Account: theordercdn12439 (or similar)
|
||||
│ └── Container: images (public blob access)
|
||||
├── CDN Profile: theorder-cdn-dev-profile
|
||||
│ └── CDN Endpoint: theorder-cdn-dev-endpoint
|
||||
│ └── Origin: Storage Account blob endpoint
|
||||
```
|
||||
|
||||
## Manual Setup Steps
|
||||
|
||||
### Step 1: Check Azure Quotas
|
||||
|
||||
```bash
|
||||
./infra/scripts/azure-check-cdn-quotas.sh
|
||||
```
|
||||
|
||||
This checks:
|
||||
- Storage accounts quota
|
||||
- CDN profiles quota
|
||||
- CDN endpoints quota
|
||||
- Resource group limits
|
||||
|
||||
### Step 2: Create Infrastructure
|
||||
|
||||
```bash
|
||||
./infra/scripts/azure-cdn-setup.sh
|
||||
```
|
||||
|
||||
This creates:
|
||||
- Storage account with public blob access
|
||||
- Storage container named "images"
|
||||
- CDN profile (Standard_Microsoft SKU)
|
||||
- CDN endpoint pointing to storage account
|
||||
|
||||
### Step 3: Upload Seal Images
|
||||
|
||||
```bash
|
||||
./scripts/deploy/upload-seals-to-azure.sh
|
||||
```
|
||||
|
||||
Uploads all PNG seal files to the storage container.
|
||||
|
||||
### Step 4: Update Manifest URLs
|
||||
|
||||
```bash
|
||||
./scripts/deploy/update-manifest-seal-urls.sh
|
||||
```
|
||||
|
||||
Updates all manifest templates with CDN URLs.
|
||||
|
||||
## Configuration
|
||||
|
||||
### Storage Account Settings
|
||||
|
||||
- **Account Tier**: Standard
|
||||
- **Replication**: LRS (dev/stage), GRS (production)
|
||||
- **Public Access**: Enabled (for CDN)
|
||||
- **TLS Version**: TLS 1.2 minimum
|
||||
|
||||
### CDN Settings
|
||||
|
||||
- **SKU**: Standard_Microsoft
|
||||
- **HTTPS**: Enabled
|
||||
- **Compression**: Enabled
|
||||
- **Caching**: Optimized for static content
|
||||
|
||||
### CORS Configuration
|
||||
|
||||
```bash
|
||||
az storage cors add \
|
||||
--services b \
|
||||
--methods GET HEAD \
|
||||
--origins "*" \
|
||||
--allowed-headers "*" \
|
||||
--exposed-headers "*" \
|
||||
--max-age 3600
|
||||
```
|
||||
|
||||
## URLs
|
||||
|
||||
### Direct Blob Storage URL
|
||||
```
|
||||
https://<storage-account>.blob.core.windows.net/images/<seal-file>.png
|
||||
```
|
||||
|
||||
### CDN URL (Recommended)
|
||||
```
|
||||
https://<cdn-endpoint>.azureedge.net/images/<seal-file>.png
|
||||
```
|
||||
|
||||
### Current Configuration
|
||||
- **Storage Account**: `theordercdn12439`
|
||||
- **CDN Endpoint**: `theordercdn12439.azureedge.net`
|
||||
- **Base URL**: `https://theordercdn12439.blob.core.windows.net/images/`
|
||||
|
||||
## Seal Files
|
||||
|
||||
### Available Seals
|
||||
1. `digital-bank-seal.png` - Digital Bank of International Settlements
|
||||
2. `iccc-seal.png` - International Criminal Court of Commerce
|
||||
3. `iccc-provost-marshals-seal.png` - ICCC Provost Marshals
|
||||
4. `diplomatic-security-seal.png` - Diplomatic Security Service
|
||||
5. `legal-office-seal.png` - Legal Office of the Master
|
||||
|
||||
### File Sizes
|
||||
- 200x200px: For credential logos (default)
|
||||
- 400x400px: High-resolution displays
|
||||
- 800x800px: Print/embossing
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### CDN Not Propagating
|
||||
- CDN propagation can take 10-60 minutes
|
||||
- Use direct blob URL as fallback
|
||||
- Check CDN endpoint status: `az cdn endpoint show`
|
||||
|
||||
### Access Denied
|
||||
- Verify container access type is "blob" (public)
|
||||
- Check storage account public access is enabled
|
||||
- Verify CORS configuration
|
||||
|
||||
### Quota Exceeded
|
||||
- Review quota report: `azure-cdn-quota-report.txt`
|
||||
- Request quota increase via Azure portal
|
||||
- Consider using existing storage account
|
||||
|
||||
## Maintenance
|
||||
|
||||
### Update Seal Images
|
||||
1. Convert new SVG to PNG: `./scripts/tools/convert-svg-to-png.sh`
|
||||
2. Upload to Azure: `./scripts/deploy/upload-seals-to-azure.sh`
|
||||
3. Update manifests: `./scripts/deploy/update-manifest-seal-urls.sh`
|
||||
|
||||
### Monitor Usage
|
||||
```bash
|
||||
az storage account show-usage \
|
||||
--name <storage-account> \
|
||||
--resource-group <resource-group>
|
||||
```
|
||||
|
||||
### Cost Optimization
|
||||
- Use LRS for dev/stage (lower cost)
|
||||
- Enable CDN compression
|
||||
- Set appropriate cache headers
|
||||
- Monitor and optimize file sizes
|
||||
|
||||
## Security
|
||||
|
||||
- ✅ HTTPS only (CDN enforces)
|
||||
- ✅ CORS configured
|
||||
- ✅ Public read-only access
|
||||
- ✅ No write access from public
|
||||
- ✅ Storage account firewall (optional)
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Entra VerifiedID Setup](./entra-verifiedid.md)
|
||||
- [Deployment Overview](../overview.md)
|
||||
- [Seal Design Guide](../../design/ORDER_SEALS_DESIGN_GUIDE.md)
|
||||
|
||||
---
|
||||
|
||||
**Note**: This guide consolidates information from multiple Azure CDN setup files. Historical setup documents have been archived in `docs/archive/deployment/azure-cdn/`.
|
||||
|
||||
@@ -1,221 +0,0 @@
|
||||
# Entra VerifiedID Deployment Guide
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
**Status**: Complete and Operational
|
||||
|
||||
## Overview
|
||||
|
||||
Complete deployment guide for Microsoft Entra VerifiedID integration, including credential issuance, verification, and webhook handling.
|
||||
|
||||
## Quick Start
|
||||
|
||||
**Automated Setup:**
|
||||
```bash
|
||||
./scripts/deploy/deploy-entra-verifiedid.sh
|
||||
```
|
||||
|
||||
## Prerequisites
|
||||
|
||||
### Azure Requirements
|
||||
1. **Azure Subscription** with active Entra ID tenant
|
||||
2. **Entra VerifiedID** service enabled
|
||||
3. **Azure Key Vault** for secret storage
|
||||
4. **Application Registration** in Entra ID
|
||||
|
||||
### Required Permissions
|
||||
- Global Administrator or Application Administrator
|
||||
- Key Vault Contributor
|
||||
- Entra ID Application Administrator
|
||||
|
||||
## Setup Steps
|
||||
|
||||
### Step 1: Enable Entra VerifiedID
|
||||
|
||||
1. Navigate to Azure Portal → Entra ID → Verified ID
|
||||
2. Enable the service
|
||||
3. Create a Verified ID credential issuer
|
||||
4. Note the **Tenant ID** and **Client ID**
|
||||
|
||||
### Step 2: Create Application Registration
|
||||
|
||||
1. Go to Azure Portal → Entra ID → App registrations
|
||||
2. Create new registration
|
||||
3. Generate **Client Secret**
|
||||
4. Grant API permissions:
|
||||
- `VerifiableCredential.Create.All`
|
||||
- `VerifiableCredential.Read.All`
|
||||
|
||||
### Step 3: Configure Key Vault
|
||||
|
||||
```bash
|
||||
az keyvault secret set \
|
||||
--vault-name <key-vault-name> \
|
||||
--name "entra-tenant-id" \
|
||||
--value "<tenant-id>"
|
||||
|
||||
az keyvault secret set \
|
||||
--vault-name <key-vault-name> \
|
||||
--name "entra-client-id" \
|
||||
--value "<client-id>"
|
||||
|
||||
az keyvault secret set \
|
||||
--vault-name <key-vault-name> \
|
||||
--name "entra-client-secret" \
|
||||
--value "<client-secret>"
|
||||
```
|
||||
|
||||
### Step 4: Create Credential Manifest
|
||||
|
||||
1. Use Azure Portal or API to create manifest
|
||||
2. Configure claims and display properties
|
||||
3. Note the **Manifest ID**
|
||||
|
||||
### Step 5: Configure Environment Variables
|
||||
|
||||
```bash
|
||||
export ENTRA_TENANT_ID="<tenant-id>"
|
||||
export ENTRA_CLIENT_ID="<client-id>"
|
||||
export ENTRA_CLIENT_SECRET="<client-secret>"
|
||||
export ENTRA_CREDENTIAL_MANIFEST_ID="<manifest-id>"
|
||||
export ENTRA_CREDENTIAL_LOGO_URI="https://theordercdn12439.blob.core.windows.net/images/digital-bank-seal.png"
|
||||
export ENTRA_CREDENTIAL_BG_COLOR="#1a1a1a"
|
||||
export ENTRA_CREDENTIAL_TEXT_COLOR="#ffffff"
|
||||
```
|
||||
|
||||
## Credential Issuance
|
||||
|
||||
### Single Manifest
|
||||
|
||||
```typescript
|
||||
import { EntraVerifiedIDClient } from '@the-order/auth';
|
||||
|
||||
const client = new EntraVerifiedIDClient({
|
||||
tenantId: process.env.ENTRA_TENANT_ID!,
|
||||
clientId: process.env.ENTRA_CLIENT_ID!,
|
||||
clientSecret: process.env.ENTRA_CLIENT_SECRET!,
|
||||
credentialManifestId: process.env.ENTRA_CREDENTIAL_MANIFEST_ID!,
|
||||
logoUri: process.env.ENTRA_CREDENTIAL_LOGO_URI,
|
||||
backgroundColor: process.env.ENTRA_CREDENTIAL_BG_COLOR,
|
||||
textColor: process.env.ENTRA_CREDENTIAL_TEXT_COLOR,
|
||||
});
|
||||
|
||||
const credential = await client.issueCredential({
|
||||
claims: {
|
||||
email: '[email protected]',
|
||||
name: 'John Doe',
|
||||
role: 'member',
|
||||
},
|
||||
});
|
||||
```
|
||||
|
||||
### Multi-Manifest Support
|
||||
|
||||
```typescript
|
||||
import { EnhancedEntraVerifiedIDClient } from '@the-order/auth';
|
||||
|
||||
const client = new EnhancedEntraVerifiedIDClient({
|
||||
tenantId: process.env.ENTRA_TENANT_ID!,
|
||||
clientId: process.env.ENTRA_CLIENT_ID!,
|
||||
clientSecret: process.env.ENTRA_CLIENT_SECRET!,
|
||||
manifests: {
|
||||
default: '<default-manifest-id>',
|
||||
financial: '<financial-manifest-id>',
|
||||
judicial: '<judicial-manifest-id>',
|
||||
diplomatic: '<diplomatic-manifest-id>',
|
||||
},
|
||||
});
|
||||
```
|
||||
|
||||
## Webhook Configuration
|
||||
|
||||
### Setup Webhook Endpoint
|
||||
|
||||
1. Create webhook endpoint in your service
|
||||
2. Configure in Entra VerifiedID portal
|
||||
3. Set webhook URL: `https://your-service.com/api/webhooks/entra`
|
||||
|
||||
### Webhook Handler
|
||||
|
||||
```typescript
|
||||
app.post('/api/webhooks/entra', async (req, res) => {
|
||||
const event = req.body;
|
||||
|
||||
switch (event.type) {
|
||||
case 'credential.issued':
|
||||
// Handle credential issuance
|
||||
break;
|
||||
case 'credential.verified':
|
||||
// Handle credential verification
|
||||
break;
|
||||
}
|
||||
|
||||
res.status(200).send('OK');
|
||||
});
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
### Security
|
||||
- ✅ Store secrets in Azure Key Vault
|
||||
- ✅ Use managed identities where possible
|
||||
- ✅ Rotate client secrets regularly
|
||||
- ✅ Enable audit logging
|
||||
- ✅ Use HTTPS for all endpoints
|
||||
|
||||
### Performance
|
||||
- ✅ Implement retry logic with exponential backoff
|
||||
- ✅ Use connection pooling
|
||||
- ✅ Cache manifest configurations
|
||||
- ✅ Monitor API rate limits
|
||||
|
||||
### Reliability
|
||||
- ✅ Implement circuit breakers
|
||||
- ✅ Add health checks
|
||||
- ✅ Monitor webhook delivery
|
||||
- ✅ Handle webhook retries
|
||||
|
||||
## Monitoring
|
||||
|
||||
### Metrics
|
||||
- Credential issuance rate
|
||||
- Credential verification rate
|
||||
- API error rates
|
||||
- Webhook delivery success rate
|
||||
- Average issuance time
|
||||
|
||||
### Alerts
|
||||
- High error rates
|
||||
- Webhook delivery failures
|
||||
- API quota approaching limits
|
||||
- Authentication failures
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Common Issues
|
||||
|
||||
**Authentication Failures**
|
||||
- Verify tenant ID and client ID
|
||||
- Check client secret is correct
|
||||
- Ensure API permissions are granted
|
||||
|
||||
**Manifest Not Found**
|
||||
- Verify manifest ID is correct
|
||||
- Check manifest is active
|
||||
- Ensure proper permissions
|
||||
|
||||
**Webhook Not Receiving Events**
|
||||
- Verify webhook URL is accessible
|
||||
- Check webhook configuration in portal
|
||||
- Review webhook logs
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Azure CDN Setup](./cdn-setup.md)
|
||||
- [Deployment Overview](../overview.md)
|
||||
- [Entra VerifiedID Integration](../../integrations/entra-verifiedid/README.md)
|
||||
- [Operations Runbook](../../operations/ENTRA_VERIFIEDID_RUNBOOK.md)
|
||||
|
||||
---
|
||||
|
||||
**Note**: This guide consolidates information from multiple Entra VerifiedID deployment files. Historical deployment documents have been archived in `docs/archive/deployment/entra/`.
|
||||
|
||||
+8
-1473
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user