Submodules

Submodules

Every variable and output of the ten submodules under modules/, read from each module's variables.tf and outputs.tf. The root module calls all of them and supplies their inputs, so this page matters when you read main.tf, change the wiring, add a root output, or call a submodule directly. For the inputs you set on a normal deployment, see Inputs; for the root outputs, see Outputs.

The "Root module sets it to" column shows the expression main.tf passes, and "not set (default)" means the root module leaves the submodule default in place. key_vault and functions are called with count, so their outputs are addressed as module.key_vault[0].<output> and module.functions[0].<output>; networking is also counted and exists only when enable_custom_domain is true and custom_domain_name is non-empty. Descriptions follow the ones written in the module files; where a description and the code disagree, the code is described under Where descriptions and code differ.

auth

Called from the root module as module.auth.

Variables

Name	Type	Default	Root module sets it to	Description
app_display_name	string	ReportMate	ReportMate${var.environment != "prod" ? " (${title(var.environment)})" : ""}	Display name for the Entra ID application
app_identifier_uri	string	reportmate-web	not set (default)	Identifier URI for the application Declared but not referenced by any resource in this module.
homepage_url	string	required	var.enable_custom_domain && var.custom_domain_name != "" ? "https://${var.custom_domain_name}" : module.containers.frontend_url	Homepage URL for the application
logout_url	string	required	var.enable_custom_domain && var.custom_domain_name != "" ? "https://${var.custom_domain_name}/auth/signout" : "${module.containers.frontend_url}/auth/signout"	Logout URL for the application
redirect_uris	list(string)	[]	long expression; see main.tf	List of redirect URIs for OAuth flows
sign_in_audience	string	AzureADMyOrg	var.auth_sign_in_audience	Who can sign in to the application
app_role_assignment_required	bool	true	var.environment == "prod" ? true : false	Whether users must be assigned to the app to access it
client_secret_expiry	string	null	var.auth_client_secret_expiry	Expiry date for the client secret (RFC3339 format)
grant_admin_consent	bool	false	var.environment == "dev" ? true : false	Whether to automatically grant admin consent for required permissions
app_owners	list(string)	[]	var.app_owners	List of additional owner email addresses for the Entra ID application
enable_key_vault	bool	false	var.enable_key_vault	Whether to store secrets in Key Vault
key_vault_id	string	null	var.enable_key_vault ? module.key_vault[0].key_vault_id : null	ID of the Key Vault to store secrets in (optional)
environment	string	dev	var.environment	Environment name (dev, staging, prod) Declared but not referenced by any resource in this module.
tags	map(string)	{}	var.tags	Tags to apply to resources
azuread_tags	list(string)	["ReportMate", "Authentication"]	[ReportMate, Authentication, Environment:${var.environment}]	Tags for Entra ID resources (as list of strings)
app_roles	list(object({allowed_member_types = list(string), description = string, display_name = string, enabled = bool, id = string, value = string}))	long value; see variables.tf	not set (default)	Application roles to create
allowed_domains	list(string)	["example.com"]	var.allowed_auth_domains	List of allowed email domains for authentication
require_email_verification	bool	false	var.require_email_verification	Whether to require email verification for certain providers
auth_providers	list(string)	["azure-ad"]	var.auth_providers	List of enabled authentication providers
default_auth_provider	string	azure-ad	var.default_auth_provider	Default authentication provider
authorized_groups	list(string)	[]	var.authorized_groups	List of Entra ID group IDs that are authorized to sign in to the application
admin_principal_ids	list(string)	[]	var.admin_principal_ids	List of Entra ID principal object IDs (users or groups) to assign the Administrator app role. Members can hard-delete devices and perform other privileged operations in the web app.
enable_oidc_api	bool	false	var.enable_oidc_api	Create the ReportMate API app registration (protected resource) for OIDC bearer authentication. No-op when false; enabling it is what creates the Entra objects.
oidc_reader_principal_ids	list(string)	[]	var.oidc_reader_principal_ids	Entra object IDs (users, groups, or service principals) granted the ReportMate.Read API role.
oidc_ingest_principal_ids	list(string)	[]	var.oidc_ingest_principal_ids	Entra object IDs granted the ReportMate.Ingest API role (telemetry submission — e.g. a device/service principal).
oidc_admin_principal_ids	list(string)	[]	var.oidc_admin_principal_ids	Entra object IDs granted the ReportMate.Admin API role (full access).

Outputs

Name	Value	Description
application_id	azuread_application.reportmate_web.client_id	The Application (Client) ID of the Entra ID app
application_object_id	azuread_application.reportmate_web.object_id	The Object ID of the Entra ID application
service_principal_id	azuread_service_principal.reportmate_web.object_id	The Object ID of the service principal
service_principal_application_id	azuread_service_principal.reportmate_web.client_id	The Application ID of the service principal
tenant_id	data.azuread_client_config.current.tenant_id	The Entra ID Tenant ID
client_secret_id	azuread_application_password.reportmate_web.key_id	The ID of the client secret
client_secret_value	azuread_application_password.reportmate_web.value	The client secret value (sensitive)
nextauth_secret	random_password.nextauth_secret.result	Generated NextAuth secret (sensitive)
application_homepage_url	var.homepage_url	The homepage URL of the application
application_logout_url	var.logout_url	The logout URL of the application
redirect_uris	var.redirect_uris	List of configured redirect URIs
environment_variables	computed; see outputs.tf	Environment variables needed for the web application (sensitive)
key_vault_secret_names	computed; see outputs.tf	Names of secrets stored in Key Vault
app_roles	{for role in var.app_roles : role.value => {id = role.id, display_name = role.display_name, description = role.description}}	Configured application roles
oidc_api_client_id	var.enable_oidc_api ? azuread_application.reportmate_api[0].client_id : null	Client (application) ID of the ReportMate API app registration, or null when disabled.
oidc_issuer	https://login.microsoftonline.com/${data.azuread_client_config.current.tenant_id}/v2.0	v2.0 token issuer for this tenant (OIDC_ISSUERS for the API).
oidc_api_audience	computed; see outputs.tf	Accepted audience values for API bearer tokens (App ID URI and bare client id), comma-separated. Empty when disabled.
oauth_configuration	computed; see outputs.tf	OAuth configuration details for documentation
container_app_env_vars	computed; see outputs.tf	Environment variables formatted for Azure Container App
setup_instructions	computed; see outputs.tf	Instructions for completing the setup

containers

Called from the root module as module.containers.

Variables

Name	Type	Default	Root module sets it to	Description
resource_group_name	string	required	data.azurerm_resource_group.rg.name	Name of the resource group
location	string	required	data.azurerm_resource_group.rg.location	Azure region
container_registry_name	string	required	var.container_registry_name	Name of the Azure Container Registry (will be made globally unique)
use_custom_registry	bool	false	var.use_custom_registry	Whether to use a custom container registry instead of official images
container_image	string	ghcr.io/reportmate/reportmate-app-web:latest	var.container_image	Container image to deploy
environment	string	prod	var.environment	Environment (dev, prod, both)
deploy_dev	bool	false	var.deploy_dev	Deploy development environment Declared but not referenced by any resource in this module.
deploy_prod	bool	true	var.deploy_prod	Deploy production environment
managed_identity_id	string	required	module.identity.managed_identity_id	ID of the managed identity
managed_identity_principal_id	string	required	module.identity.managed_identity_principal_id	Principal ID of the managed identity for role assignments
managed_identity_client_id	string	required	module.identity.managed_identity_client_id	Client ID of the managed identity for Azure SDK authentication
database_url	string (sensitive)	required	postgresql://${var.db_username}:${urlencode(var.db_password)}@${module.database.postgres_fqdn}:5432/${var.db_name}?sslmode=require	Database connection URL
app_insights_connection_string	string (sensitive)	required	module.monitoring.app_insights_connection_string	Application Insights connection string
log_analytics_workspace_id	string	required	module.monitoring.log_analytics_id	Log Analytics workspace ID
key_vault_uri	string	null	var.enable_key_vault ? module.key_vault[0].key_vault_uri : null	Key Vault URI for secret references
auth_secrets	object({nextauth_secret_name = string, client_secret_name = string})	null	var.enable_key_vault ? {nextauth_secret_name = "nextauth-secret", client_secret_name = "auth-client-secret"} : null	Authentication secret names in Key Vault
client_passphrases	string (sensitive)	required	var.client_passphrases	Client authentication passphrases (comma-separated)
api_internal_secret	string (sensitive)	required	var.api_internal_secret	Shared secret for internal container-to-container API authentication (frontend to API)
kiosk_tokens	string (sensitive)	""	var.kiosk_tokens	Comma-separated kiosk viewer tokens for read-only display sessions
enable_custom_domain	bool	false	var.enable_custom_domain	Enable custom domain configuration
custom_domain_name	string	""	var.custom_domain_name	Custom domain name
tags	map(string)	{}	var.tags	Tags to apply to resources
frontend_image_tag	string	latest	var.frontend_image_tag	Frontend container image tag to deploy
api_image_tag	string	latest	var.api_image_tag	API container image tag to deploy
database_host	string	required	module.database.postgres_fqdn	Database hostname
database_name	string	required	var.db_name	Database name
database_username	string	required	var.db_username	Database username
database_password	string (sensitive)	required	var.db_password	Database password
auth_client_id	string	""	var.azure_ad_client_id	Azure AD Client ID
auth_tenant_id	string	""	var.azure_ad_tenant_id	Azure AD Tenant ID
container_environment_name	string	reportmate-env	var.container_environment_name	Name of the Container Apps Environment
existing_registry_server	string	required	var.existing_registry_server	Existing container registry server URL (used when use_custom_registry is false)
frontend_container_name	string	reportmate-web-app-prod	var.frontend_container_name	Name of the frontend container app
api_container_name	string	reportmate-functions-api	var.api_container_name	Name of the API container app
frontend_image_name	string	reportmate	var.frontend_image_name	Name of the frontend container image (without registry prefix)
api_image_name	string	reportmate-api	var.api_image_name	Name of the API container image (without registry prefix)
allowed_domains	string	""	var.allowed_domains	Comma-separated list of allowed email domains for authentication. Must be specified in terraform.tfvars
default_site_url	string	""	not set (default)	Default site URL when custom domain is not enabled (derived from container environment)
enable_oidc_auth	bool	false	var.enable_oidc_api	Enable OIDC bearer authentication on the API container (sets ENABLE_OIDC_AUTH).
oidc_issuers	string	""	module.auth.oidc_issuer	Comma-separated trusted OIDC issuers for API bearer auth (OIDC_ISSUERS).
oidc_audience	string	""	module.auth.oidc_api_audience	Comma-separated accepted audiences for API bearer auth (OIDC_AUDIENCE).
api_db_pool_max	number	6	var.api_db_pool_max	Max pooled Postgres connections held by each API replica (DB_POOL_MAX).
api_db_pool_min	number	1	var.api_db_pool_min	Warm pooled Postgres connections kept per API replica (DB_POOL_MIN).
api_min_replicas	number	1	var.api_min_replicas	Replicas the API is never scaled below. Raising this keeps a warm replica for bursts, at continuous cost.
api_max_replicas	number	5	var.api_max_replicas	Max API container replicas. Bounds total pool demand together with api_db_pool_max.
db_max_connections	number	50	var.db_max_connections	Postgres max_connections on the ReportMate server. Used to bound total pool demand.
db_connection_reserve	number	15	not set (default)	Connections held back from the API pools for superuser, autovacuum, migrations, and ad-hoc admin access.

Outputs

Name	Value	Description
container_registry_login_server	var.use_custom_registry ? azurerm_container_registry.acr[0].login_server : null	Container Registry login server (if using custom registry)
container_app_environment_id	azurerm_container_app_environment.main.id	ID of the Container Apps environment
frontend_dev_url	null	Development frontend URL (if deployed)
frontend_prod_url	length(azurerm_container_app.frontend_prod_main) > 0 ? "https://${azurerm_container_app.frontend_prod_main[0].latest_revision_fqdn}" : null	Production frontend URL (if deployed)
frontend_fqdn	length(azurerm_container_app.frontend_prod_main) > 0 ? azurerm_container_app.frontend_prod_main[0].ingress[0].fqdn : null	Primary frontend FQDN (production)
frontend_url	computed; see outputs.tf	Primary frontend URL (production)
api_fqdn	azurerm_container_app.api_functions.ingress[0].fqdn	API Functions Container App FQDN
api_url	https://${azurerm_container_app.api_functions.ingress[0].fqdn}	API Functions Container App URL
api_container_app_id	azurerm_container_app.api_functions.id	ID of the API Functions Container App
acr_login_server	var.use_custom_registry ? azurerm_container_registry.acr[0].login_server : var.existing_registry_server	ACR login server URL
acr_admin_username	var.use_custom_registry ? azurerm_container_registry.acr[0].admin_username : ""	ACR admin username (sensitive)
acr_admin_password	var.use_custom_registry ? azurerm_container_registry.acr[0].admin_password : ""	ACR admin password (sensitive)

database

Called from the root module as module.database.

Variables

Name	Type	Default	Root module sets it to	Description
resource_group_name	string	required	data.azurerm_resource_group.rg.name	Name of the resource group
location	string	required	data.azurerm_resource_group.rg.location	Azure region
db_username	string	required	var.db_username	PostgreSQL administrator username
db_password	string (sensitive)	required	var.db_password	PostgreSQL administrator password
db_name	string	required	var.db_name	Name of the database
db_sku_name	string	B_Standard_B1ms	var.db_sku_name	PostgreSQL SKU name
db_storage_mb	number	262144	var.db_storage_mb	PostgreSQL storage floor in MB. Only sets the size at create time -- auto-grow owns it afterwards and the resource ignores changes to it. The default matches the live server (256 GB); a lower value would read as an attempt to shrink, which the service rejects.
db_backup_retention_days	number	35	var.db_backup_retention_days	Point-in-time restore window. Seven days is shorter than the feedback loop on most data-quality problems here -- a storage problem can run longer than that from onset to diagnosis -- and shorter than a statutory long weekend plus a slow ticket.
db_geo_redundant_backup	bool	false	var.db_geo_redundant_backup	Replicate backups to the paired region. Costs roughly the backup storage again and can only be set when the server is created, so flipping it on an existing server is a rebuild, not an update.
postgres_server_name	string	""	var.postgres_server_name	Name of the PostgreSQL server (if empty, will generate unique name)
allowed_ips	list(string)	[]	var.allowed_ips	Extra client IP ranges (CIDR) allowed to reach the database, on top of the always-present allow_azure rule that lets Azure-hosted services connect. Empty by default: the database is not reachable from the public internet unless an operator opts in. Passing "0.0.0.0/0" creates an allow_all rule that exposes the server to every address on the internet - only ever do that knowingly, and never in production.
api_endpoint	string	""	not set (default)	API endpoint URL for database initialization Declared but not referenced by any resource in this module.
db_max_connections	number	50	var.db_max_connections	Postgres max_connections. Static parameter: raising it restarts the server. Keep in step with api_db_pool_max * api_max_replicas in the containers module.
tags	map(string)	{}	var.tags	Tags to apply to resources

Outputs

Name	Value	Description
postgres_fqdn	azurerm_postgresql_flexible_server.pg.fqdn	FQDN of the PostgreSQL server
postgres_name	azurerm_postgresql_flexible_server.pg.name	Name of the PostgreSQL server
database_name	azurerm_postgresql_flexible_server_database.db.name	Name of the database
connection_string	postgresql://${var.db_username}:${var.db_password}@${azurerm_postgresql_flexible_server.pg.fqdn}:5432/${var.db_name}?sslmode=require	PostgreSQL connection string (sensitive)

functions

Called from the root module as module.functions.

Variables

Name	Type	Default	Root module sets it to	Description
resource_group_name	string	required	data.azurerm_resource_group.rg.name	Name of the resource group
location	string	required	data.azurerm_resource_group.rg.location	Azure region for resources
function_app_name	string	reportmate-functions	var.function_app_name	Name of the Azure Functions App
sku_name	string	FC1	var.function_app_sku	SKU for the App Service Plan (FC1=Flex Consumption, Y1=Consumption, B1=Basic, S1=Standard, P1V2=Premium). FC1 requires the azurerm_function_app_flex_consumption resource.
api_base_url	string	required	var.api_base_url_override != "" ? var.api_base_url_override : module.containers.api_url	Base URL for ReportMate API (for storage alerts function)
client_passphrases	string (sensitive)	required	var.client_passphrases	API passphrase for authentication
teams_webhook_url	string (sensitive)	""	var.teams_webhook_url	Default Microsoft Teams incoming webhook URL for alerts. Exposed to functions as the TEAMS_WEBHOOK_URL env var.
teams_webhooks	list(string) (sensitive)	[]	var.teams_webhooks	Additional Microsoft Teams incoming webhook URLs. Exposed to functions as indexed env vars TEAMS_WEBHOOK_1, TEAMS_WEBHOOK_2, ... in the order they appear in the list. Adopters can add as many as they need and reference them from their function code by index. Keep the assignment (which index serves which purpose) documented privately alongside your function code.
app_insights_connection_string	string (sensitive)	required	module.monitoring.app_insights_connection_string	Application Insights connection string for monitoring
key_vault_id	string	null	var.enable_key_vault ? module.key_vault[0].key_vault_id : null	Optional Key Vault ID for secrets access
additional_app_settings	map(string)	{}	var.function_app_additional_settings	Additional application settings for the Function App
tags	map(string)	{}	var.tags	Tags to apply to all resources
external_secret_vault_ids	list(string)	[]	var.function_app_external_secret_vault_ids	Resource IDs of RBAC-enabled Key Vaults, owned outside this deployment, whose secrets this Function App's identity may read. key_vault_id above grants against the vault this stack creates, and does it with an access policy. A vault someone else owns is typically RBAC-enabled, on which access policies are inert, so it needs a Key Vault Secrets User role assignment instead -- this is that. Pass full resource IDs; the caller is the only one that knows them. The apply principal needs rights to create role assignments at the target scope, which for a vault in another resource group is not implied by owning this one.

Outputs

Name	Value	Description
function_app_id	azurerm_function_app_flex_consumption.main.id	ID of the Azure Functions App
function_app_name	azurerm_function_app_flex_consumption.main.name	Name of the Azure Functions App
function_app_default_hostname	azurerm_function_app_flex_consumption.main.default_hostname	Default hostname of the Functions App
function_app_identity_principal_id	azurerm_function_app_flex_consumption.main.identity[0].principal_id	Principal ID of the Functions App managed identity
function_app_identity_tenant_id	azurerm_function_app_flex_consumption.main.identity[0].tenant_id	Tenant ID of the Functions App managed identity
storage_account_name	azurerm_storage_account.functions.name	Name of the storage account used by Functions App
storage_account_primary_key	azurerm_storage_account.functions.primary_access_key	Primary access key for Functions storage account (sensitive)

identity

Called from the root module as module.identity.

Variables

Name	Type	Default	Root module sets it to	Description
resource_group_name	string	required	data.azurerm_resource_group.rg.name	Name of the resource group
location	string	required	data.azurerm_resource_group.rg.location	Azure region
managed_identity_name	string	required	var.managed_identity_name	Name of the user-assigned managed identity
enable_pipeline_permissions	bool	false	var.enable_pipeline_permissions	Enable RBAC permissions for Azure DevOps pipeline service principal
pipeline_service_principal_id	string	""	var.pipeline_service_principal_id	Object ID of the Azure DevOps pipeline service principal
storage_account_id	string	required	module.storage.storage_account_id	ID of the storage account
app_insights_id	string	required	module.monitoring.app_insights_id	ID of the Application Insights instance
tags	map(string)	{}	var.tags	Tags to apply to resources

Outputs

Name	Value	Description
managed_identity_id	azurerm_user_assigned_identity.main.id	ID of the managed identity
managed_identity_client_id	azurerm_user_assigned_identity.main.client_id	Client ID of the managed identity
managed_identity_principal_id	azurerm_user_assigned_identity.main.principal_id	Principal ID of the managed identity
managed_identity_name	azurerm_user_assigned_identity.main.name	Name of the managed identity

key_vault

Called from the root module as module.key_vault.

Variables

Name	Type	Default	Root module sets it to	Description
key_vault_name	string	required	var.key_vault_name	Name of the Key Vault
location	string	required	data.azurerm_resource_group.rg.location	Azure region for the Key Vault
resource_group_name	string	required	data.azurerm_resource_group.rg.name	Name of the resource group
environment	string	dev	var.environment	Environment name Declared but not referenced by any resource in this module.
sku_name	string	standard	not set (default)	Key Vault SKU name
default_network_action	string	Allow	not set (default)	Default network access action
allowed_ips	list(string)	[]	not set (default)	List of allowed IP addresses
enable_purge_protection	bool	true	not set (default)	Enable purge protection
soft_delete_retention_days	number	7	not set (default)	Soft delete retention period in days
managed_identity_principal_id	string	null	module.identity.managed_identity_principal_id	Principal ID of the managed identity to grant access
devops_resource_infrasec_group_object_id	string	null	var.devops_resource_infrasec_group_object_id	Object ID of the DevOps Resource InfraSec group for Key Vault access
tags	map(string)	{}	var.tags	Tags to apply to resources
db_password	string (sensitive)	required	var.db_password	PostgreSQL database password to store in Key Vault
postgres_server_name	string	required	var.postgres_server_name	PostgreSQL server name to store in Key Vault
db_username	string	required	var.db_username	PostgreSQL database username to store in Key Vault
db_name	string	required	var.db_name	PostgreSQL database name to store in Key Vault
azure_ad_client_id	string (sensitive)	required	var.azure_ad_client_id	Azure AD application client ID to store in Key Vault
azure_ad_tenant_id	string (sensitive)	required	var.azure_ad_tenant_id	Azure AD tenant ID to store in Key Vault
client_passphrases	string (sensitive)	required	var.client_passphrases	Client authentication passphrase to store in Key Vault
custom_domain_name	string	required	var.custom_domain_name	Custom domain name to store in Key Vault
nextauth_secret	string (sensitive)	null	var.nextauth_secret	NextAuth session encryption secret (optional - will be generated if not provided)
storage_connection_string	string (sensitive)	null	module.storage.storage_connection_string	Azure Storage Account connection string (optional)
app_insights_connection_string	string (sensitive)	null	module.monitoring.app_insights_connection_string	Application Insights connection string (optional)
api_base_url	string	null	not set (default)	FastAPI container base URL (optional)
frontend_url	string	null	not set (default)	Frontend container URL (optional)
macdev_team_id	string	""	not set (default)	macOS Team ID for code signing (optional)
macdev_signing_identity_app	string	""	not set (default)	macOS Developer ID Application for code signing (optional)
macdev_signing_identity_installer	string	""	not set (default)	macOS Developer ID Installer for PKG signing (optional)
macdev_notarization_apple_id	string (sensitive)	""	not set (default)	Apple ID email for notarization (optional)
macdev_notarization_password	string (sensitive)	""	not set (default)	App-specific password for Apple notarization (optional)
auth_client_id	string (sensitive)	""	not set (default)	Azure AD application (client) ID for authentication
auth_client_secret	string (sensitive)	""	not set (default)	Azure AD client secret for authentication
auth_tenant_id	string (sensitive)	""	not set (default)	Azure AD tenant ID for authentication
ssh_password	string (sensitive)	""	not set (default)	SSH password for remote access
api_internal_secret	string (sensitive)	""	var.api_internal_secret	Shared secret for internal container-to-container API authentication (frontend to API)
kiosk_tokens	string (sensitive)	""	var.kiosk_tokens	Comma-separated kiosk viewer tokens for read-only display sessions

Outputs

Name	Value	Description
key_vault_id	azurerm_key_vault.reportmate.id	ID of the Key Vault
key_vault_name	azurerm_key_vault.reportmate.name	Name of the Key Vault
key_vault_uri	azurerm_key_vault.reportmate.vault_uri	URI of the Key Vault
db_password_secret_id	azurerm_key_vault_secret.db_password.id	Key Vault secret ID for database password (sensitive)
postgres_server_name_secret_id	azurerm_key_vault_secret.postgres_server_name.id	Key Vault secret ID for PostgreSQL server name
db_username_secret_id	azurerm_key_vault_secret.db_username.id	Key Vault secret ID for database username
db_name_secret_id	azurerm_key_vault_secret.db_name.id	Key Vault secret ID for database name
azure_ad_client_id_secret_id	azurerm_key_vault_secret.azure_ad_client_id.id	Key Vault secret ID for Azure AD client ID (sensitive)
azure_ad_tenant_id_secret_id	azurerm_key_vault_secret.azure_ad_tenant_id.id	Key Vault secret ID for Azure AD tenant ID (sensitive)
client_passphrase_secret_id	azurerm_key_vault_secret.client_passphrase.id	Key Vault secret ID for client passphrase (sensitive)
devops_group_object_id_secret_id	azurerm_key_vault_secret.devops_group_object_id.id	Key Vault secret ID for DevOps group object ID (sensitive)
custom_domain_name_secret_id	azurerm_key_vault_secret.custom_domain_name.id	Key Vault secret ID for custom domain name
nextauth_secret_id	azurerm_key_vault_secret.nextauth_secret.id	Key Vault secret ID for NextAuth secret (sensitive)
secret_names	computed; see outputs.tf	Map of secret names in Key Vault

maintenance

Called from the root module as module.maintenance.

Variables

Name	Type	Default	Root module sets it to	Description
resource_prefix	string	reportmate	not set (default)	Prefix for all resource names
resource_group_name	string	required	data.azurerm_resource_group.rg.name	Name of the resource group
location	string	required	data.azurerm_resource_group.rg.location	Azure region for resources
container_app_environment_id	string	required	module.containers.container_app_environment_id	ID of the Container App Environment
acr_login_server	string	required	module.containers.acr_login_server	ACR login server URL
acr_admin_username	string	required	module.containers.acr_admin_username	ACR admin username
acr_admin_password	string (sensitive)	required	module.containers.acr_admin_password	ACR admin password Declared but not referenced by any resource in this module.
db_host	string	required	module.database.postgres_fqdn	PostgreSQL database host
db_name	string	reportmate	not set (default)	PostgreSQL database name
db_user	string	reportmate	not set (default)	PostgreSQL database user
db_password	string (sensitive)	required	var.db_password	PostgreSQL database password
event_retention_days	number	30	30	Number of days to retain events
schedule_cron	string	0 2 * * *	0 2 * * *	Cron expression for maintenance schedule (default: 2 AM UTC daily)
job_name	string	reportmate-db-maintenance	not set (default)	Name of the database maintenance container app job.

Outputs

Name	Value	Description
job_id	azurerm_container_app_job.maintenance.id	ID of the Container App Job
job_name	azurerm_container_app_job.maintenance.name	Name of the Container App Job
schedule	var.schedule_cron	Cron schedule for maintenance job

monitoring

Called from the root module as module.monitoring.

Variables

Name	Type	Default	Root module sets it to	Description
resource_group_name	string	required	data.azurerm_resource_group.rg.name	Name of the resource group
location	string	required	data.azurerm_resource_group.rg.location	Azure region
app_insights_name	string	required	var.app_insights_name	Name of the Application Insights instance
log_analytics_name	string	required	var.log_analytics_name	Name of the Log Analytics workspace
log_retention_days	number	30	var.log_retention_days	Log retention period in days
log_daily_quota_gb	number	2	var.log_daily_quota_gb	Daily ingestion cap in GB for the Log Analytics workspace. Ingestion pauses for the remainder of the UTC day once reached, so size it above normal volume: this is a runaway backstop, not a shaping tool. -1 disables the cap.
app_insights_daily_cap	number	1	var.app_insights_daily_cap	Application Insights daily data cap in GB
tags	map(string)	{}	var.tags	Tags to apply to resources

Outputs

Name	Value	Description
app_insights_id	azurerm_application_insights.main.id	ID of the Application Insights instance
app_insights_key	azurerm_application_insights.main.instrumentation_key	Instrumentation key of the Application Insights instance (sensitive)
app_insights_connection_string	azurerm_application_insights.main.connection_string	Connection string of the Application Insights instance (sensitive)
log_analytics_workspace_id	azurerm_log_analytics_workspace.main.workspace_id	Workspace ID of the Log Analytics workspace
log_analytics_workspace_key	azurerm_log_analytics_workspace.main.primary_shared_key	Primary shared key of the Log Analytics workspace (sensitive)
log_analytics_id	azurerm_log_analytics_workspace.main.id	ID of the Log Analytics workspace
app_insights_name	azurerm_application_insights.main.name	Name of the Application Insights instance
log_analytics_workspace_name	azurerm_log_analytics_workspace.main.name	Name of the Log Analytics workspace

networking

Called from the root module as module.networking.

Variables

Name	Type	Default	Root module sets it to	Description
resource_group_name	string	required	data.azurerm_resource_group.rg.name	Name of the resource group
location	string	required	data.azurerm_resource_group.rg.location	Azure region Declared but not referenced by any resource in this module.
frontdoor_name	string	reportmate-frontdoor	var.frontdoor_name	Name of the Front Door profile
custom_domain_name	string	required	var.custom_domain_name	Custom domain name for the application
enable_custom_domain	bool	true	not set (default)	Enable custom domain with SSL certificate Declared but not referenced by any resource in this module.
environment	string	prod	var.environment	Environment name Declared but not referenced by any resource in this module.
frontend_fqdn	string	required	module.containers.frontend_fqdn	FQDN of the frontend container app
api_app_hostname	string	required	module.containers.api_fqdn	Hostname of the Container App API Declared but not referenced by any resource in this module.
tags	map(string)	{}	var.tags	Tags to apply to resources
enable_auto_sso	bool	true	not set (default)	Enable automatic SSO redirect for unauthenticated users Declared but not referenced by any resource in this module.
endpoint_name	string	reportmate-endpoint	not set (default)	Name of the Front Door endpoint.

Outputs

Name	Value	Description
front_door_endpoint	https://${azurerm_cdn_frontdoor_endpoint.main.host_name}	Front Door endpoint URL
front_door_profile_name	azurerm_cdn_frontdoor_profile.main.name	Name of the Front Door profile
custom_domain_validation_token	azurerm_cdn_frontdoor_custom_domain.main.validation_token	Custom domain validation token
ssl_certificate_setup	computed; see outputs.tf

storage

Called from the root module as module.storage.

Variables

Name	Type	Default	Root module sets it to	Description
resource_group_name	string	required	data.azurerm_resource_group.rg.name	Name of the resource group
location	string	required	data.azurerm_resource_group.rg.location	Azure region
storage_account_name	string	required	var.storage_account_name	Base name of the storage account (will be made globally unique)
storage_tier	string	Standard	var.storage_tier	Storage account tier
storage_replication	string	LRS	var.storage_replication	Storage account replication type
use_exact_name	bool	false	true	Use exact storage account name without suffix (for existing accounts)
tags	map(string)	{}	var.tags	Tags to apply to resources

Outputs

Name	Value	Description
storage_account_id	azurerm_storage_account.main.id	ID of the storage account
storage_account_name	azurerm_storage_account.main.name	Name of the storage account
storage_account_access_key	azurerm_storage_account.main.primary_access_key	Primary access key of the storage account (sensitive)
storage_connection_string	azurerm_storage_account.main.primary_connection_string	Primary connection string of the storage account (sensitive)
queue_name	azurerm_storage_queue.ingest.name	Name of the ingestion queue

Where descriptions and code differ

• containers submodule defaults for api_db_pool_max (6), api_db_pool_min (1) and db_max_connections (50), and the database default for db_max_connections (50), never apply through the root module, which always passes its own values (40, 2 and 250 by default).
• containers.auth_secrets names the Key Vault secrets the dashboard reads as NEXTAUTH_SECRET and AZURE_AD_CLIENT_SECRET. The root sets it only when enable_key_vault is true; nextauth-secret is written by key_vault and auth-client-secret by auth.
• containers.deploy_dev is accepted but no development container app exists, and frontend_dev_url is always null.
• auth.allowed_domains (root allowed_auth_domains) and auth.auth_providers only shape the environment_variables and container_app_env_vars outputs. The dashboard container gets ALLOWED_DOMAINS from the root allowed_domains string, AUTH_PROVIDERS and DEFAULT_AUTH_PROVIDER are fixed to azure-ad, and REQUIRE_EMAIL_VERIFICATION is fixed to false in the containers module.
• maintenance.db_name and maintenance.db_user are not passed by the root, so the job always connects as reportmate to reportmate. job_name is the name of the container inside the job; the job resource itself is named <resource_prefix>-db-maintenance. acr_admin_password is accepted but unused.
• functions.sku_name lists Y1, B1, S1 and P1V2 as options, but the module always builds a Flex Consumption app, which needs FC1. The root default function_app_sku = "Y1" fails at create time; see Troubleshooting.
• functions.key_vault_id grants access with an access policy, which an RBAC-authorised vault (the one key_vault creates) ignores. See Troubleshooting.
• networking.enable_auto_sso, networking.enable_custom_domain, networking.api_app_hostname, networking.location and networking.environment are accepted but unused. The Front Door origin is the dashboard only.
• storage.storage_account_name says the name is made globally unique. The root passes use_exact_name = true, so the name is used verbatim.