Inputs

Inputs

Every input variable declared in the root module's variables.tf, grouped the way the file groups them. A variable with no default is required — there are eleven of those.

Submodules have their own variables; the ones the root module does not pass through are noted at the bottom, and every submodule variable is listed on Submodules.

Required

Name	Type	Description
resource_group_name	string	Name of the Azure resource group. Read with a data source — the module does not create it
location	string	Azure region. Declared but not referenced anywhere in main.tf; every submodule takes its location from the resource group data source
db_password	string, sensitive	PostgreSQL administrator password
container_registry_name	string	Name of the Azure Container Registry. Only created when use_custom_registry is true, but required regardless
existing_registry_server	string	Registry server URL used when use_custom_registry is false
allowed_domains	string	Comma-separated email domains permitted to sign in, e.g. example.edu,alumni.example.edu. No default on purpose: the application treats an empty allow-list as "permit every domain"
api_internal_secret	string, sensitive	Shared secret for dashboard-to-API calls inside the Container Apps environment
key_vault_name	string	Key Vault name. Globally unique; Azure allows 3–24 letters, digits and hyphens. The module does not validate it
azure_ad_client_id	string	Entra ID application (client) ID
azure_ad_tenant_id	string	Entra ID tenant (directory) ID
devops_resource_infrasec_group_object_id	string	Object ID of the group granted Key Vault Administrator

Subscription

Name	Type	Default	Description
subscription_id	string	null	Azure subscription ID. Left null the provider falls back to ARM_SUBSCRIPTION_ID or the CLI context

Database

Name	Type	Default	Description
postgres_server_name	string	""	PostgreSQL server name. Empty generates reportmate-database-<random hex>
db_username	string	"reportmate"	PostgreSQL administrator username
db_name	string	"reportmate"	Database name
db_sku_name	string	"B_Standard_B1ms"	PostgreSQL SKU
db_max_connections	number	250	Server max_connections. Must cover api_db_pool_max * api_max_replicas plus the containers module's connection reserve, or the plan fails. Static parameter — raising it restarts the server
db_storage_mb	number	262144	Storage floor in MB. Only applies at create time; auto-grow owns it afterwards and the resource ignores later changes
db_backup_retention_days	number	35	Point-in-time restore window. Validated to 7–35
db_geo_redundant_backup	bool	false	Replicate backups to the paired region. Create-time only — flipping it on an existing server is a rebuild
allowed_ips	list(string)	[]	Extra client addresses allowed to reach the database, on top of the always-present Azure-services rule. Each entry becomes a single-address rule: the module keeps only the part before /, so 203.0.113.0/24 admits 203.0.113.0 alone. "0.0.0.0/0" creates an allow-all rule

API scaling and connection pool

Name	Type	Default	Description
api_db_pool_max	number	40	Max pooled Postgres connections per API replica (DB_POOL_MAX). Also used as the HTTP scale rule's concurrent-request threshold
api_db_pool_min	number	2	Warm pooled connections per API replica (DB_POOL_MIN)
api_min_replicas	number	1	Replicas the API is never scaled below. A warm replica bills continuously
api_max_replicas	number	5	Max API replicas

Storage

Name	Type	Default	Description
storage_account_name	string	"reportmatestorage"	Storage account name. The root passes use_exact_name = true, so the name is used verbatim and must be globally unique
storage_tier	string	"Standard"	Storage account tier
storage_replication	string	"LRS"	Replication type

Monitoring

Name	Type	Default	Description
app_insights_name	string	"reportmate-app-insights"	Application Insights instance name
log_analytics_name	string	"reportmate-logs"	Log Analytics workspace name
log_retention_days	number	30	Workspace log retention
log_daily_quota_gb	number	2	Daily ingestion cap. Ingestion pauses for the rest of the UTC day once reached. -1 disables it; the module validates the value as -1 or at least 0.1
app_insights_daily_cap	number	1	Application Insights daily data cap in GB

Functions

Everything here is inert unless enable_functions is true.

Name	Type	Default	Description
enable_functions	bool	false	Deploy the Function App, separate from the Container Apps API
function_app_name	string	"reportmate-functions"	Function App name. Globally unique
function_app_sku	string	"Y1"	App Service Plan SKU. The module builds a Flex Consumption function app, which needs FC1 — see Troubleshooting
teams_webhook_url	string, sensitive	""	Default Teams webhook, exposed to functions as TEAMS_WEBHOOK_URL
teams_webhooks	list(string), sensitive	[]	Additional Teams webhooks, exposed as TEAMS_WEBHOOK_1, TEAMS_WEBHOOK_2, … in list order
function_app_external_secret_vault_ids	list(string)	[]	Resource IDs of RBAC-enabled Key Vaults owned outside this deployment whose secrets the Function App identity may read
function_app_additional_settings	map(string)	{}	Extra app settings merged over the ones the module sets. Values may be @Microsoft.KeyVault(SecretUri=...) references. Terraform owns app_settings outright, so a setting added by hand with az is erased on the next apply
api_base_url_override	string	""	Override the API base URL given to the functions instead of using the API container's URL

Identity and pipeline access

Name	Type	Default	Description
managed_identity_name	string	"reportmate-identity"	Name of the user-assigned managed identity
enable_pipeline_permissions	bool	false	Grant a CI/CD service principal Contributor on the resource group
pipeline_service_principal_id	string	""	Object ID of that service principal

Containers

Name	Type	Default	Description
use_custom_registry	bool	false	Create and use an Azure Container Registry instead of pulling from the registry named by existing_registry_server
container_environment_name	string	"reportmate-env"	Container Apps environment name
frontend_container_name	string	"reportmate-web-app-prod"	Dashboard container app name. Also used to build the CORS origin and the internal DNS name
api_container_name	string	"reportmate-functions-api"	API container app name. The dashboard reaches it at http://<this name>
frontend_image_name	string	"reportmate"	Dashboard image name, without registry prefix. The published dashboard image is ghcr.io/reportmate/web, so set web when existing_registry_server is ghcr.io/reportmate
api_image_name	string	"reportmate-api"	API image name, without registry prefix
frontend_image_tag	string	"latest"	Dashboard image tag. Ignored after create — the deploy pipeline owns the running image
api_image_tag	string	"latest"	API image tag, same caveat
container_image	string	"ghcr.io/reportmate/reportmate-app-web:latest"	Passed through to the containers module but only used to derive a local value; the running image is built from the registry, image name and tag inputs above

Environment selection

Name	Type	Default	Description
environment	string	"prod"	dev, prod or both. Validated. Drives the app display name, whether app-role assignment is required, whether admin consent is auto-granted, and whether a localhost:3000 redirect URI is added
deploy_dev	bool	false	Deploy a development container app. No dev container app is currently defined in the containers module
deploy_prod	bool	true	Deploy the dashboard container app. The app is also created whenever environment is prod or both, so false only takes effect with environment = "dev"

Networking

Name	Type	Default	Description
enable_custom_domain	bool	false	Create Azure Front Door in front of the dashboard. The networking module is only instantiated when this is true and custom_domain_name is non-empty
custom_domain_name	string	""	Custom domain for the dashboard, e.g. reportmate.example.com
frontdoor_name	string	"reportmate-frontdoor"	Front Door profile name

Client and viewer authentication

Name	Type	Default	Description
client_passphrases	string, sensitive	""	Comma-separated agent passphrases. Delivered to both containers as REPORTMATE_PASSPHRASE
kiosk_tokens	string, sensitive	""	Comma-separated label:token pairs that /kiosk exchanges for a read-only session. Empty disables kiosk sessions
enable_machine_groups	bool	false	Declared but not referenced anywhere in main.tf
enable_business_units	bool	false	Declared but not referenced anywhere in main.tf

Tags

Name	Type	Default	Description
tags	map(string)	{ Environment = "production", Project = "ReportMate", ManagedBy = "Terraform" }	Tags applied to created resources

Sign-in configuration

Name	Type	Default	Description
auth_sign_in_audience	string	"AzureADMyOrg"	Validated against AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount
auth_providers	list(string)	["azure-ad"]	Each entry validated against azure-ad, google, credentials
default_auth_provider	string	"azure-ad"	Default provider
allowed_auth_domains	list(string)	[]	Allowed email domains passed to the auth module. Distinct from allowed_domains, which is the comma-separated string handed to the dashboard container
require_email_verification	bool	false	Require email verification for providers that support it
auth_client_secret_expiry	string	null	RFC3339 expiry for the generated client secret. Null lets the provider default apply
nextauth_secret	string, sensitive	null	Session encryption secret. Generated if not supplied
enable_key_vault	bool	true	Create the Key Vault and route the dashboard's auth secrets through it. When false, the dashboard gets no NEXTAUTH_SECRET or AZURE_AD_CLIENT_SECRET

auth_providers, default_auth_provider, allowed_auth_domains and require_email_verification reach only the auth module's environment_variables and container_app_env_vars outputs. The dashboard container itself is given AUTH_PROVIDERS=azure-ad, DEFAULT_AUTH_PROVIDER=azure-ad, REQUIRE_EMAIL_VERIFICATION=false, and ALLOWED_DOMAINS from allowed_domains. See Architecture for the full container environment.

App ownership and authorization

Name	Type	Default	Description
app_owners	list(string)	[]	User principal names to add as owners of the Entra application
authorized_groups	list(string)	[]	Entra group object IDs assigned the user app role
admin_principal_ids	list(string)	[]	Entra principal object IDs assigned the admin app role. Required for destructive actions in the dashboard, such as deleting a device

OIDC API bearer auth

Off by default. Enabling it creates Entra objects.

Name	Type	Default	Description
enable_oidc_api	bool	false	Create the ReportMate API app registration and set ENABLE_OIDC_AUTH, OIDC_ISSUERS and OIDC_AUDIENCE on the API container
oidc_reader_principal_ids	list(string)	[]	Principals granted the ReportMate.Read role
oidc_ingest_principal_ids	list(string)	[]	Principals granted the ReportMate.Ingest role
oidc_admin_principal_ids	list(string)	[]	Principals granted the ReportMate.Admin role

Submodule variables not exposed at the root

These exist in a submodule and are left at their default because the root module never passes them. Changing them means editing the submodule or the module call in main.tf.

Module	Variable	Default	Effect
containers	db_connection_reserve	15	Connections held back from the API pools in the plan-time precondition
containers	default_site_url	""	Overrides the derived site hostname
maintenance	event_retention_days	passed as 30 by the root	Days of events the cleanup job keeps
maintenance	schedule_cron	passed as 0 2 * * * by the root	Cleanup schedule
maintenance	db_name, db_user, job_name, resource_prefix	reportmate, reportmate, reportmate-db-maintenance, reportmate	The job connects as db_user to db_name regardless of the root db_username and db_name, so a deployment that changes either must also change these
key_vault	api_base_url, frontend_url	null	Optional URL secrets; the root leaves them unset to avoid a dependency cycle
database	api_endpoint	""	Declared but unused
key_vault	sku_name, enable_purge_protection, soft_delete_retention_days, default_network_action, allowed_ips	standard, true, 7, Allow, []	Vault SKU, protection and network posture
key_vault	macdev_*, ssh_password, auth_*	""	Optional extra secrets the vault will store if given values
networking	endpoint_name, enable_auto_sso	reportmate-endpoint, true	Front Door endpoint name; the auto-SSO variable is currently unused (auto-sso.tf is empty)
auth	app_roles, app_identifier_uri	five roles, reportmate-web	The app role definitions and identifier URI