azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "description": "Deploy PIM Manager to Azure Static Web Apps"
  },
  "parameters": {
    "staticWebAppName": {
      "type": "string",
      "defaultValue": "pim-manager",
      "metadata": {
        "description": "Name of the Azure Static Web App resource"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "westeurope",
      "allowedValues": [
        "westeurope",
        "eastus2",
        "eastasia",
        "westus2",
        "centralus",
        "northeurope"
      ],
      "metadata": {
        "description": "Azure region for the deployment"
      }
    },
    "entraClientId": {
      "type": "string",
      "metadata": {
        "description": "App Registration Client ID from Microsoft Entra ID"
      }
    }
  },
  "variables": {
    "managedIdentityName": "[concat(parameters('staticWebAppName'), '-deploy-id')]",
    "storageAccountName": "[toLower(concat('pimdeploy', uniqueString(resourceGroup().id)))]",
    "deployScriptName": "[concat(parameters('staticWebAppName'), '-deploy-script')]"
  },
  "resources": [
    {
      "type": "Microsoft.Web/staticSites",
      "apiVersion": "2023-01-01",
      "name": "[parameters('staticWebAppName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Free",
        "tier": "Free"
      },
      "properties": {}
    },
    {
      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
      "apiVersion": "2023-01-31",
      "name": "[variables('managedIdentityName')]",
      "location": "[parameters('location')]"
    },
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-01-01",
      "name": "[variables('storageAccountName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2",
      "properties": {
        "minimumTlsVersion": "TLS1_2",
        "allowBlobPublicAccess": false
      }
    },
    {
      "type": "Microsoft.Resources/deploymentScripts",
      "apiVersion": "2023-08-01",
      "name": "[variables('deployScriptName')]",
      "location": "[parameters('location')]",
      "kind": "AzureCLI",
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentities": {
          "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('managedIdentityName'))]": {}
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Web/staticSites', parameters('staticWebAppName'))]",
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('managedIdentityName'))]",
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
      ],
      "properties": {
        "azCliVersion": "2.74.0",
        "storageAccountSettings": {
          "storageAccountName": "[variables('storageAccountName')]",
          "storageAccountKey": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2023-01-01').keys[0].value]"
        },
        "environmentVariables": [
          {
            "name": "CLIENT_ID",
            "value": "[parameters('entraClientId')]"
          },
          {
            "name": "DEPLOYMENT_TOKEN",
            "secureValue": "[listSecrets(resourceId('Microsoft.Web/staticSites', parameters('staticWebAppName')), '2023-01-01').properties.apiKey]"
          }
        ],
        "scriptContent": "#!/bin/bash\nset -e\n\n# azure-cli >= 2.64 ships on Azure Linux (CBL-Mariner, glibc) with the tdnf package manager.\n# StaticSitesClient (the binary behind `swa deploy`) is a self-contained .NET binary. Beyond ICU\n# it needs the rest of the .NET native runtime dependencies (krb5, openssl-libs, zlib) for its\n# networking/TLS during \"Preparing deployment\"; without them it fails with \"An unknown exception\n# has occurred\" / \"missing shared libraries\" / exit code 1 even though ICU alone is installed.\n# Install Node.js/npm plus the full .NET native dep set, unzip and curl so the binary can execute.\ntdnf install -y nodejs npm icu krb5 openssl-libs zlib unzip curl ca-certificates\n\n# Install SWA CLI\nnpm install -g @azure/static-web-apps-cli@2 --silent\n\n# Work on container-local storage, NOT the deployment script's working dir. ARM deployment\n# scripts mount an Azure Files (CIFS/SMB) share at /mnt/azscripts and run from there.\n# StaticSitesClient zips the app artifacts with .NET's ZipFile, which throws a generic\n# \"An unknown exception has occurred\" at the \"Zipping App Artifacts\" step when the source is on\n# that CIFS mount. Doing everything under /tmp (local overlay fs) avoids it.\nexport HOME=/root\nexport TMPDIR=/tmp\nWORKDIR=/tmp/pim-deploy\nmkdir -p \"$WORKDIR\"\ncd \"$WORKDIR\"\n\n# Download latest release\ncurl -sL https://github.com/0125joel/PIM-manager/releases/latest/download/release.zip -o release.zip\nunzip -q release.zip\n\n# Inject Client ID into runtime config\nprintf 'window.__PIM_CONFIG__ = { clientId: \"%s\" };\\n' \"$CLIENT_ID\" > out/env-config.js\n\n# Run StaticSitesClient under globalization-invariant mode. The swa deploy binary is a .NET app;\n# if the azure-cli image's ICU version does not match what it expects, it dies at \"Preparing\n# deployment\" with a generic \"An unknown exception has occurred\". Invariant mode bypasses ICU for\n# the deploy CLI only (it does not affect the deployed site).\nexport DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1\n\n# Deploy to Azure Static Web Apps. The app and this script are created in the same ARM\n# deployment; the SWA's content/deployment endpoint provisions asynchronously, so for a short\n# window right after creation the deployment token is rejected with \"No matching Static Web App\n# was found or the api key was invalid\". Retry with a delay until the endpoint is ready.\ndeployed=0\nfor attempt in 1 2 3 4 5 6 7 8; do\n  echo \"swa deploy attempt $attempt...\"\n  if swa deploy ./out --deployment-token \"$DEPLOYMENT_TOKEN\" --env production; then\n    deployed=1\n    break\n  fi\n  echo \"attempt $attempt failed; the SWA endpoint may not be ready yet, waiting 30s...\"\n  sleep 30\ndone\n\nif [ \"$deployed\" -ne 1 ]; then\n  echo \"=== swa deploy still failing after retries; diagnosing StaticSitesClient ===\"\n  swa deploy ./out --deployment-token \"$DEPLOYMENT_TOKEN\" --env production --verbose=silly || true\n  BIN=$(find /root/.swa -name StaticSitesClient -type f 2>/dev/null | head -1)\n  echo \"StaticSitesClient path: $BIN\"\n  if [ -n \"$BIN\" ]; then\n    echo \"--- ldd ---\"; ldd \"$BIN\" || true\n  fi\n  exit 1\nfi\n",
        "timeout": "PT30M",
        "cleanupPreference": "OnSuccess",
        "retentionInterval": "P1D"
      }
    }
  ],
  "outputs": {
    "staticWebAppUrl": {
      "type": "string",
      "value": "[concat('https://', reference(resourceId('Microsoft.Web/staticSites', parameters('staticWebAppName'))).defaultHostname)]"
    }
  }
}