# variables.tf — generated by `autumn release init --target azure-container-apps`
variable "app_name" {
description = "Name used to prefix every provisioned Azure resource."
type = string
default = "{{project_name}}"
}
variable "subscription_id" {
description = "Azure subscription ID to deploy into — required by AzureRM v4 even under `az login` CLI auth. Find yours with `az account show --query id -o tsv`."
type = string
}
variable "location" {
description = "Azure region for all resources."
type = string
default = "eastus"
}
variable "image_tag" {
description = "Tag of the {{project_name}} image in Azure Container Registry to deploy. Documents the tag scheme used by azure-cutover.sh/CI after bootstrap — Terraform itself only ever sets `bootstrap_image` (see below) and never manages the image after the first apply."
type = string
default = "latest"
}
# Container Apps must pull an image to create the app's (and the migration
# job's) first revision, but a brand-new ACR has none yet — so Terraform
# points both at this public placeholder on the first apply, then ignores
# further image drift (see the `lifecycle.ignore_changes` blocks in main.tf).
# After the first deploy, azure-deploy.yml sets the real image on the app and
# the job. The placeholder app gets no identity or secret refs (#2314). Keep
# min_replicas at 0 until after the first real deploy so the placeholder does
# not run.
variable "bootstrap_image" {
description = "Public placeholder image Terraform uses only to create inactive first revisions before any real image has been pushed to ACR. The placeholder app gets no production secrets. The migration job has them, but runs only after CI sets the real image. Keep min_replicas at 0 until after the first real deploy."
type = string
default = "mcr.microsoft.com/k8se/quickstart:latest"
}
variable "db_sku" {
description = "SKU name for the Postgres Flexible Server (e.g. B_Standard_B1ms for dev, GP_Standard_D2s_v3 for production)."
type = string
default = "B_Standard_B1ms"
}
# ── Scale config defaults ────────────────────────────────────────────────────
# Min replicas: 0, Max: 10. Keep the default at 0 for the initial Terraform
# apply: the first revision uses the public bootstrap image, and a higher
# value runs that placeholder for no purpose. Raise this after the first real
# deploy if you do not want scale-to-zero.
variable "min_replicas" {
description = "Minimum number of Container App replicas kept running."
type = number
default = 0
}
variable "max_replicas" {
description = "Maximum number of Container App replicas under load."
type = number
default = 10
}
variable "enable_redis_cache" {
description = "Provision an optional Azure Redis Cache. The cutover (azure-cutover.sh) sets its URL on the app. Infrastructure only: your app must ALSO depend on the autumn-cache-redis crate and register RedisCachePlugin in main.rs for this to take effect — see docs/guide/cloud-native.md. Off by default to avoid the extra cost."
type = bool
default = false
}
# ── Secrets — no default. Supply via TF_VAR_* env vars or your CI's secret
# store. Never commit real values in terraform.tfvars. ──────────────────────
#
# Note: there is no `database_url` variable. A single `terraform apply` must
# succeed without a second, targeted apply to fill in a value that depends on
# a resource the same apply is about to create — so main.tf derives the full
# connection string from `azurerm_postgresql_flexible_server.this`'s FQDN and
# this password, rather than requiring the operator to pre-compute it.
variable "database_admin_password" {
description = "Administrator password for the Postgres Flexible Server."
type = string
sensitive = true
}
variable "signing_secret" {
description = "Signing secret stored in Key Vault as AUTUMN_SECURITY__SIGNING_SECRET; generate with `openssl rand -hex 32`."
type = string
sensitive = true
}