Keep prod frontend on B1 for custom TLS

[JustAGhosT]

Summary

• keep the prod frontend App Service plan on B1 instead of F1
• document that B1 is required for App Service managed certificates on the custom domain

Context

• convolens.neuralliquid.ai was bound live and now serves HTTPS successfully.
• Azure blocks managed certificate creation on Free/Shared App Service plans, so B1 is the minimum SKU that keeps the custom-domain TLS path working.

Validation

• terraform fmt -recursive infra/terraform/env/prod
• terraform validate in infra/terraform/env/prod
• git diff --check -- infra/terraform/env/prod/main.tf

[github-actions]

Terraform Plan (dev)

Click to expand

Acquiring state lock. This may take a few moments...
data.azurerm_client_config.current: Reading...
azurerm_resource_group.rg: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg]
data.azurerm_client_config.current: Read complete after 0s [id=Y2xpZW50Q29uZmlncy9jbGllbnRJZD04ZjU3YTM0OS1lYjg4LTQwZmQtODFlYi0xMDY1Zjg0ZTY2OGI7b2JqZWN0SWQ9ZDQ4NzYyOWQtMDc1OC00MTkyLWJmMDAtZGZkNGYyMTRhNzM4O3N1YnNjcmlwdGlvbklkPWJiNGUzODgyLTIwNzktNGJhYi04OTc0LTYxMWJjMGI4YmI1ODt0ZW5hbnRJZD05NTMwY2QzMi05ZTMzLTQ3ZjAtOTI0Ny1lZDk2NDczMGI1ODA=]
azurerm_key_vault.kv: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.KeyVault/vaults/nl-dev-convolens-kv]
azurerm_cosmosdb_account.cosmos[0]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.DocumentDB/databaseAccounts/nl-dev-convolens-cosmos]
azurerm_static_web_app.swa[0]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.Web/staticSites/nl-dev-convolens-swa]
azurerm_log_analytics_workspace.law: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.OperationalInsights/workspaces/nl-dev-convolens-law]
azurerm_storage_account.st: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.Storage/storageAccounts/nldevconvolensst]
azurerm_application_insights.ai: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.Insights/components/nl-dev-convolens-appi]
azurerm_container_app_environment.cae[0]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.App/managedEnvironments/nl-dev-convolens-cae]
azurerm_key_vault_access_policy.deployer: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.KeyVault/vaults/nl-dev-convolens-kv/objectId/d487629d-0758-4192-bf00-dfd4f214a738]
azurerm_key_vault_secret.appinsights_connection_string: Refreshing state... [id=https://nl-dev-convolens-kv.vault.azure.net/secrets/appinsights-connection-string/b49878c8df8c451986ff9d02d8905090]
azurerm_cosmosdb_sql_database.db[0]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.DocumentDB/databaseAccounts/nl-dev-convolens-cosmos/sqlDatabases/convolens]
azurerm_key_vault_secret.cosmos_key[0]: Refreshing state... [id=https://nl-dev-convolens-kv.vault.azure.net/secrets/cosmos-db-key/9f5c0fca48b048ff97f93e9099863eb1]
azurerm_key_vault_secret.cosmos_connection_string[0]: Refreshing state... [id=https://nl-dev-convolens-kv.vault.azure.net/secrets/cosmos-db-connection-string/257323432daf46b0bea651cb955280b4]
azurerm_key_vault_secret.cosmos_endpoint[0]: Refreshing state... [id=https://nl-dev-convolens-kv.vault.azure.net/secrets/cosmos-db-endpoint/83825780119644b2bc46d5a75da2b552]
azurerm_cosmosdb_sql_container.containers["users"]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.DocumentDB/databaseAccounts/nl-dev-convolens-cosmos/sqlDatabases/convolens/containers/users]
azurerm_cosmosdb_sql_container.containers["summaries"]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.DocumentDB/databaseAccounts/nl-dev-convolens-cosmos/sqlDatabases/convolens/containers/summaries]
azurerm_cosmosdb_sql_container.containers["chats"]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.DocumentDB/databaseAccounts/nl-dev-convolens-cosmos/sqlDatabases/convolens/containers/chats]
azurerm_key_vault_secret.storage_connection_string: Refreshing state... [id=https://nl-dev-convolens-kv.vault.azure.net/secrets/storage-connection-string/f437ca08a54d46ebbf12b9a39387efa2]
azurerm_storage_container.containers["chat-exports"]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.Storage/storageAccounts/nldevconvolensst/blobServices/default/containers/chat-exports]
azurerm_storage_container.containers["summaries"]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.Storage/storageAccounts/nldevconvolensst/blobServices/default/containers/summaries]
azurerm_storage_container.containers["user-uploads"]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.Storage/storageAccounts/nldevconvolensst/blobServices/default/containers/user-uploads]
azurerm_container_app.api[0]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.App/containerApps/nl-dev-convolens-api]
azurerm_key_vault_access_policy.container_app[0]: Refreshing state... [id=/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.KeyVault/vaults/nl-dev-convolens-kv/objectId/801ba185-32e1-4a45-a385-629c79cb6a4c]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # azurerm_container_app.api[0] will be updated in-place
  ~ resource "azurerm_container_app" "api" {
        id                            = "/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.App/containerApps/nl-dev-convolens-api"
        name                          = "nl-dev-convolens-api"
        tags                          = {
            "costCenter"  = "development"
            "environment" = "dev"
            "managedBy"   = "terraform"
            "org"         = "nl"
            "project"     = "convolens"
        }
        # (10 unchanged attributes hidden)

      ~ template {
            # (6 unchanged attributes hidden)

          ~ container {
              ~ memory            = "1Gi" -> "1.0Gi"
                name              = "api"
                # (5 unchanged attributes hidden)

                # (8 unchanged blocks hidden)
            }

            # (1 unchanged block hidden)
        }

        # (3 unchanged blocks hidden)
    }

  # azurerm_cosmosdb_sql_container.containers["chats"] will be updated in-place
  ~ resource "azurerm_cosmosdb_sql_container" "containers" {
        id                  = "/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.DocumentDB/databaseAccounts/nl-dev-convolens-cosmos/sqlDatabases/convolens/containers/chats"
        name                = "chats"
        # (5 unchanged attributes hidden)

      ~ indexing_policy {
            # (1 unchanged attribute hidden)

          + excluded_path {
              + path = "/\"_etag\"/?"
            }

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # azurerm_cosmosdb_sql_container.containers["summaries"] will be updated in-place
  ~ resource "azurerm_cosmosdb_sql_container" "containers" {
        id                  = "/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.DocumentDB/databaseAccounts/nl-dev-convolens-cosmos/sqlDatabases/convolens/containers/summaries"
        name                = "summaries"
        # (5 unchanged attributes hidden)

      ~ indexing_policy {
            # (1 unchanged attribute hidden)

          + excluded_path {
              + path = "/\"_etag\"/?"
            }

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # azurerm_cosmosdb_sql_container.containers["users"] will be updated in-place
  ~ resource "azurerm_cosmosdb_sql_container" "containers" {
        id                  = "/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.DocumentDB/databaseAccounts/nl-dev-convolens-cosmos/sqlDatabases/convolens/containers/users"
        name                = "users"
        # (5 unchanged attributes hidden)

      ~ indexing_policy {
            # (1 unchanged attribute hidden)

          + excluded_path {
              + path = "/\"_etag\"/?"
            }

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

  # azurerm_storage_account.st will be updated in-place
  ~ resource "azurerm_storage_account" "st" {
        id                                 = "/subscriptions/bb4e3882-2079-4bab-8974-611bc0b8bb58/resourceGroups/nl-dev-convolens-rg/providers/Microsoft.Storage/storageAccounts/nldevconvolensst"
        name                               = "nldevconvolensst"
        tags                               = {
            "costCenter"  = "development"
            "environment" = "dev"
            "managedBy"   = "terraform"
            "org"         = "nl"
            "project"     = "convolens"
        }
        # (97 unchanged attributes hidden)

      + network_rules {
          + bypass                     = [
              + "AzureServices",
            ]
          + default_action             = "Allow"
          + ip_rules                   = (known after apply)
          + virtual_network_subnet_ids = (known after apply)
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 5 to change, 0 to destroy.
Releasing state lock. This may take a few moments...

Run ID: 29617389336