Deploy FeatBit on Azure Container Apps

This Terraform project deploys FeatBit services to Azure Container Apps.

• The latest supported FeatBit version is v5.4.4. All FeatBit container images are pinned to 5.4.4.
• It supports Standalone with PostgreSQL and Standard with PostgreSQL + Redis. MongoDB and Professional deployments are not included.
• It deploys an Azure Container Apps environment and the FeatBit UI, API, Evaluation, and Data Analytics services into an existing Azure resource group. PostgreSQL and Redis are external services supplied by the user.

Prerequisites

• an Azure subscription and an existing resource group;
• an initialized PostgreSQL database reachable from Azure Container Apps;
• a reachable Redis service when using Standard mode;
• Terraform 1.5 or later and an authenticated Azure CLI session.

Before deployment, initialize PostgreSQL with the official FeatBit v5.4.4 PostgreSQL scripts. This project does not include or execute database scripts.

Configuration

From the terraform directory, copy the example configuration.

PowerShell:

Copy-Item terraform.tfvars.example terraform.tfvars

Bash:

cp terraform.tfvars.example terraform.tfvars

Set the target subscription, existing resource group, and PostgreSQL connection details in terraform.tfvars:

subscription_id     = "<azure-subscription-id>"
resource_group_name = "<existing-resource-group>"
location            = "eastus"

postgresql = {
  host     = "postgres.example.com"
  port     = 5432
  username = "featbit"
  database = "featbit"
  ssl_mode = "Require"
}

location selects the Azure region for the Container Apps environment and its services. Set it to null or omit it to use the target resource group's location.

Supply the PostgreSQL password through a protected Terraform input:

$env:TF_VAR_postgresql_password = "<postgres-password>"

JWT signing

The default jwt_algorithm is HS256. Before deployment, provide a stable JWT key containing at least 32 characters.

PowerShell:

$env:TF_VAR_jwt_key = "<stable-random-key-at-least-32-characters>"

Bash:

export TF_VAR_jwt_key="<stable-random-key-at-least-32-characters>"

For other signing algorithms and key-generation instructions, see the FeatBit v5.4.4 JWT configuration.

Standalone

Standalone is the default and does not use Redis:

deployment_tier = "standalone"

Standard with PostgreSQL

Standard uses PostgreSQL as the database and Redis as its message queue and cache:

deployment_tier = "standard"

$env:TF_VAR_redis_connection_string = "<redis-host>:<port>,password=<password>,ssl=True"

Terraform rejects a Standard deployment when the Redis connection string is missing.

Service configuration

Use ui_environment, api_environment, and els_environment in terraform.tfvars to pass additional non-secret environment variables to the corresponding FeatBit services:

ui_environment = {
  DEMO_URL  = "https://featbit-samples.vercel.app"
  BASE_HREF = "/"
}

api_environment = {
  SSOEnabled    = "false"
  Jwt__Issuer   = "featbit"
  Jwt__Audience = "featbit-api"
}

els_environment = {
  Cors__AllowedOrigins          = "https://app.example.com"
  RateLimiting__Enabled         = "true"
  RateLimiting__PermitLimit     = "100"
  RateLimiting__WindowSeconds   = "60"
}

Sensitive API and ELS values use api_secret_environment and els_secret_environment. For example:

$env:TF_VAR_api_secret_environment = '{"OAuthProviders__0__ClientSecret":"<client-secret>"}'

Terraform state contains every supplied secret, including database, Redis, JWT, and custom service values. Use an encrypted remote backend with restricted access.

UI settings cannot be secret because they are sent to the browser. Terraform also prevents custom maps from overriding values it manages, including service URLs, version, database/Redis providers and connections, and JWT key settings.

The DA Server PostgreSQL environment variables are managed from the existing postgresql input and do not require a second database configuration.

Replica ranges are configured separately:

service_scale = {
  ui  = { min_replicas = 1, max_replicas = 3 }
  api = { min_replicas = 1, max_replicas = 3 }
  els = { min_replicas = 1, max_replicas = 3 }
}

See the complete terraform.tfvars.example. For service-specific environment variables supported by FeatBit v5.4.4, refer directly to the corresponding FeatBit module:

• UI configuration
• API configuration
• Evaluation Server configuration
• Data Analytics Server configuration

If a required setting is not documented, contact the FeatBit team through FeatBit Support.

Optional private networking

Private networking is not required. By default, the Container Apps environment uses Azure-managed networking and can connect to public PostgreSQL and Redis endpoints when their firewall rules allow it.

To use private endpoints, provide an existing /21-or-larger subnet delegated to Microsoft.App/environments:

container_apps_infrastructure_subnet_id = "/subscriptions/<subscription-id>/resourceGroups/<network-resource-group>/providers/Microsoft.Network/virtualNetworks/<vnet>/subnets/<aca-subnet>"

The subnet must be in the selected location. This Terraform project does not create the VNet, Private Endpoints, private DNS zones, peering, or routes. Configure those separately so the supplied PostgreSQL and Redis private endpoints are reachable from the Container Apps subnet.

Deploy

Always generate a new Terraform plan after changing this project or its inputs. Do not apply a plan file created before the changes.

Set-Location terraform
terraform init
terraform plan -out featbit.tfplan
terraform apply featbit.tfplan

Retrieve the public endpoints:

terraform output portal_url
terraform output api_url
terraform output evaluation_url

If an older Terraform state still manages a resource group, VNet, PostgreSQL, Redis, or Cosmos DB, review its destroy actions and migrate ownership before applying this configuration.