# variables.tf — generated by `autumn release init --target azure-container-apps`
variable "app_name" {
description = "Name used to prefix every provisioned Azure resource."
type = string
default = "{{project_name}}"
}
variable "subscription_id" {
description = "Azure subscription ID to deploy into — required by AzureRM v4 even under `az login` CLI auth. Find yours with `az account show --query id -o tsv`."
type = string
}
variable "location" {
description = "Azure region for all resources."
type = string
default = "eastus"
}
variable "image_tag" {
description = "Tag of the {{project_name}} image in Azure Container Registry to deploy. Documents the tag scheme used by `az containerapp update`/CI after bootstrap — Terraform itself only ever sets `bootstrap_image` (see below) and never manages the image after the first apply."
type = string
default = "latest"
}
# Container Apps must pull an image to create the app's (and the migration
# job's) first revision, but a brand-new ACR has none yet — so Terraform
# points both at this public placeholder on the first apply, then ignores
# further image drift (see the `lifecycle.ignore_changes` blocks in main.tf)
# once `az containerapp update`/the migration job start in azure-deploy.yml
# take over managing the real image. Keep min_replicas at 0 until after the
# first real deploy so the placeholder app container is never started with
# production secret refs or a Key Vault-capable managed identity.
variable "bootstrap_image" {
description = "Public placeholder image Terraform uses only to create inactive first revisions before any real image has been pushed to ACR. Keep min_replicas at 0 until after the first real deploy so this image never starts with production secrets."
type = string
default = "mcr.microsoft.com/k8se/quickstart:latest"
}
variable "db_sku" {
description = "SKU name for the Postgres Flexible Server (e.g. B_Standard_B1ms for dev, GP_Standard_D2s_v3 for production)."
type = string
default = "B_Standard_B1ms"
}
# ── Scale config defaults ────────────────────────────────────────────────────
# Min replicas: 0, Max: 10. Keep the default at 0 for the initial Terraform
# apply: the first revision uses the public bootstrap image, and scaling it up
# before the real image is deployed would start that placeholder with
# production secret refs and the app's managed identity. Raise this after the
# first real deploy if you do not want scale-to-zero.
variable "min_replicas" {
description = "Minimum number of Container App replicas kept running."
type = number
default = 0
}
variable "max_replicas" {
description = "Maximum number of Container App replicas under load."
type = number
default = 10
}
variable "enable_redis_cache" {
description = "Provision an optional Azure Redis Cache and wire its URL into the app. Infrastructure only: your app must ALSO depend on the autumn-cache-redis crate and register RedisCachePlugin in main.rs for this to take effect — see docs/guide/cloud-native.md. Off by default to avoid the extra cost."
type = bool
default = false
}
# ── Secrets — no default. Supply via TF_VAR_* env vars or your CI's secret
# store. Never commit real values in terraform.tfvars. ──────────────────────
#
# Note: there is no `database_url` variable. A single `terraform apply` must
# succeed without a second, targeted apply to fill in a value that depends on
# a resource the same apply is about to create — so main.tf derives the full
# connection string from `azurerm_postgresql_flexible_server.this`'s FQDN and
# this password, rather than requiring the operator to pre-compute it.
variable "database_admin_password" {
description = "Administrator password for the Postgres Flexible Server."
type = string
sensitive = true
}
variable "signing_secret" {
description = "Signing secret stored in Key Vault as AUTUMN_SECURITY__SIGNING_SECRET; generate with `openssl rand -hex 32`."
type = string
sensitive = true
}