Deploying to Azure

Deploying to Azure

🇪🇸 Español

Goliat ships with Bicep templates and PowerShell scripts that create the whole environment in one resource group (rg-goliat-dev by default). Everything is operated from the repository root with goliat.ps1.

What gets created

Component	Initial configuration	Cost
Web	App Service Linux F1, Node.js 24	Free plan, subject to quotas
PostgreSQL	Flexible Server Burstable B1ms, 32 GB, no HA, 7-day backups	Paid compute and storage
Function	Flex Consumption, 512 MB, no always-ready instances, Node.js 22	Per execution, within the monthly grant
Storage	StorageV2 Standard LRS, private containers, Entra ID authentication	Storage and operations
Identities	Managed identities with minimal roles; Entra registrations for login and Function API	—

The complete solution is not free. PostgreSQL does not scale to zero. F1 has 60 CPU minutes per day, no SLA and may suspend the site when quotas are exceeded; use -WebSku B1 for more capacity. No ACR, VMs, Log Analytics, Application Insights, private networking or CDN are created.

Requirements

• PowerShell 5.1+ or PowerShell 7.
• Azure CLI with Bicep.
• Docker Desktop in Linux mode, Node.js 22.12+ and npm (the web is built in Linux before deploying).
• Permissions to create resources and assign roles (Owner, or Contributor + Role Based Access Control Administrator).
• For Entra sign-in and the Function API: permissions to register applications and assign app roles in the tenant. Azure Owner alone does not grant them.

Deploy

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned   # only if scripts are blocked
Copy-Item .\iac\.env.example .\iac\.env                            # then set AZURE_SUBSCRIPTION_ID
az login --tenant '<TENANT_ID>' --use-device-code
az bicep install

.\goliat.ps1 init        # private local configuration; creates no Azure resources
.\goliat.ps1 validate    # compiles Bicep; no login needed
.\goliat.ps1 plan        # what-if preview
.\goliat.ps1 deploy -GrantReader -RunAfterDeploy

• -GrantReader assigns Reader to the Function identity on the subscriptions to inventory.
• -RunAfterDeploy requests a first generation. It does not wait or import it; use Refresh in the dashboard afterwards.

Choose the sign-in mode explicitly and use the same mode for plan and deploy:

.\goliat.ps1 deploy -AuthMode tenant -TenantId '<TENANT_ID>'   # Microsoft Entra ID
.\goliat.ps1 deploy -AuthMode demo                             # user and password

Even with demo login, web → Function calls use an authenticated Entra API.

Commands

Command	What it does
.\goliat.ps1 help	Shows help; needs no configuration or login.
.\goliat.ps1 init	Prepares the private local configuration.
.\goliat.ps1 validate	Compiles the Bicep template without accessing the subscription.
.\goliat.ps1 build	Builds the web in Docker Linux into iac/.azure/<name>.web.zip.
.\goliat.ps1 plan	Previews infrastructure changes.
.\goliat.ps1 deploy	Builds, creates or updates infrastructure, initialises PostgreSQL and publishes web and Function.
.\goliat.ps1 members	Enables the Members view (see Authentication and Roles).
.\goliat.ps1 stop	Stops web, Function and PostgreSQL.
.\goliat.ps1 start	Starts PostgreSQL, Function and web.
.\goliat.ps1 destroy-plan	Shows what destroy would delete.
.\goliat.ps1 destroy	Deletes the whole resource group and its data.

Common options: -Name <env>, -SubscriptionId <id>, -Location <region> (default westeurope), -WebSku F1|B1, -AzPath <path to az>.

Post-deployment configuration

.\iac\configure-administration.ps1 -ObjectIds '<user-object-id>'   # Goliat administrators
.\iac\configure-refresh.ps1                                        # repair the Refresh connection only
.\goliat.ps1 members                                               # optional Members view

FinOps automatically assigns Cost Management Reader to the web identity on the inventory subscriptions. Administration uses two custom roles with minimal permissions, including Goliat Data Metrics Reader (Microsoft.Insights/metrics/read only).

Secrets and local files

Secrets are written only to iac/.env and iac/.azure/*.local.json, both ignored by Git. Do not share them. Deployment outputs in iac/.azure/<name>.json contain endpoints and IDs, never keys or tokens.

Stop or destroy

• stop keeps data. Storage, PostgreSQL storage and backups keep costing money, and Azure restarts a stopped PostgreSQL server after seven days.
• destroy deletes the resource group without an extra prompt. Use destroy-plan first, or -Confirm for an interactive confirmation.
• Entra app registrations, custom role definitions and Reader assignments outside the group are not deleted. Revoke Reader assignments before destroying the identity.

Full reference: iac/COMMANDS.md, iac/PROJECT.md and iac/README.md.