DevOps Commander — Infrastructure

Provisions the Azure-native pieces that back the AI agent fleet:

Resource	Purpose
Resource Group	rg-devops-commander-prod
Storage Account	Required by the Function App runtime
Log Analytics + App Insights	Captures every alert payload + agent trace
Linux App Service Plan	Y1 Consumption — free for our volume
Linux Function App	Hosts the alert receiver (POST /api/alert) — Python 3.11

Future steps will add: Azure AI Foundry project + GPT-4o deployment, agent endpoints, Key Vault.

Layout

infra/azure/
  provider.tf
  variables.tf
  locals.tf
  main.tf
  outputs.tf
  environments/
    prod.tfvars
.github/workflows/
  provision-prod.yml      # workflow_dispatch — calls reusable terraform.yml

Workflow

provision-prod.yml reuses the same PixelTech-Solutions/Terraform/.github/workflows/terraform.yml@main workflow that ERP_Infra uses, with secrets: inherit.

State path: devops-commander/alert-receiver/prod/terraform.tfstate (Azure storage backend stpixeltechstate).

Outputs to capture after first apply

After the workflow finishes, copy these into the DevOps-Commander (code repo) as repository Variables:

Output	Becomes repo Variable
function_app_name	FUNCTION_APP_NAME
resource_group_name	FUNCTION_APP_RG
alert_endpoint_url	(paste into Datadog + Grafana)

The shared secret used by Datadog/Grafana headers is generated by Terraform and stored as the ALERT_SHARED_SECRET app setting on the Function App. Retrieve it from: Azure Portal → Function App → Settings → Environment variables → ALERT_SHARED_SECRET → Show value.