Reach out to [email protected] for a terraform script for automated deployment of convier and supporting services below.

Default inventory (Azure)

<suffix> is a string provided by user during deployment.

1. Compute

Shared Linux App Service Plan
- convier-<suffix>-plan
- P1v3, one worker.
- Production and staging share compute capacity.
Production App Service
- convier-prod-<suffix>
- Image: convier:stable
- Own system-assigned managed identity.
Staging App Service
- convier-staging-<suffix>
- Image: convier:stable-staging
- Own system-assigned managed identity.
Configuration databases
- Separate SQLite database per application: /home/convier.db.
- Persistent App Service storage enabled.
- No external database server or explicit backup automation.

Production Entra registration and enterprise application
- Human roles: Task.Read, Task.Manage, Task.Audit.
- Application-only role: Task.Orchestrate.
Staging Entra registration and enterprise application
- Human roles: Task.Read, Task.Manage, Task.Audit.
- Granted production’s Task.Orchestrate permission.
Administrator assignments
- Terraform-authenticated user receives Task.Manage in both applications by default.
- Optional input assignments can override or extend these.
Authentication
- Single-tenant registrations; assignment required.
- Separate OIDC client secrets.
- Graph delegated User.Read declared; consent handled separately.
Runtime permissions
- Each managed identity accesses its own storage containers and active secrets.
- Both can ingest audit events and access shared Foundry.

Resource group
- convier-<suffix>-rg, Norway East.
Shared virtual network
- 10.42.0.0/16
- App Service integration subnet: 10.42.1.0/26.
- Private endpoint subnet: 10.42.2.0/24.
Private endpoints and DNS
- Production and staging App Services.
- Production and staging Blob storage.
- Production and staging Key Vaults.
- Shared Foundry account.
Azure Front Door Premium
- Separate production/staging endpoints, routes, origins, and health probes.
- HTTPS forwarding over Private Link.
- HTTP-to-HTTPS redirect; caching disabled.
- Health probe: /convier/ping.
Shared WAF policy
- Prevention mode
- Request-body inspection disabled (Convier submits too complex requests from frontend to backend for request body check to be enabled)
- Microsoft Default Rule Set 2.1 and Bot Manager 1.1.
- No custom exclusions or overrides.
Network boundaries
- App Service origins are private.
- Direct private access bypasses Front Door WAF, but not Convier authentication.
- No Azure Firewall, NSGs, VPN, or ExpressRoute is created.

Production Key Vault
- cvkv<suffix>
- Production encryption key and OIDC secret.
- Production identity has access only to its two designated secrets.
- JDBC metadata secret and legacy staging secrets retained without configured runtime access.
Staging Key Vault
- cvkvstg<suffix>
- Separate staging encryption key and OIDC secret.
- Staging identity has vault-wide secret-read access to this vault.
Both vaults
- Private access and RBAC authorization.
- Purge protection; 90-day soft-delete retention.
Registry credentials
Terraform state