Deploying Your Website with Terraform and GitHub Actions CI/CD Pipeline

provider "azurerm" {
  features {}
}

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.54.0"
    }
  }
}

// Configure the GitHub Provider
provider "github" {
  token = var.github_token
}

variable "rg_name" {
    type        = string
    description = "Name of the resource group"
    default     = "example"
  }
  
  variable "location" {
    type        = string
    description = "Location"
    default     = "example"
  }
  
  variable "sa_name" {
    type        = string
    description = "Storage Account Name"
    default     = "example"
  }
  
  variable "github_token" {
    type        = string
    description = "GitHub personal access token"
    sensitive   = true
  }
  
  variable "asuid_value" {
    description = "ASUID value for TXT record"
    type        = string
  }
  
  

data "azurerm_client_config" "current" {}
data "azuread_client_config" "current" {}
data "azurerm_subscription" "current" {}
  

// Creates a resource group that we store all of our resources inside
resource "azurerm_resource_group" "rg" {
  name     = var.rg_name
  location = var.location
}

// Creates an App Service Plan
resource "azurerm_app_service_plan" "app_service_plan" {
  name                = "example-app-service-plan"
  location            = var.location
  resource_group_name = var.rg_name
  depends_on          = [azurerm_resource_group.rg]

  sku {
    tier = "Basic"
    size = "B1"
  }
}

// Create an App Service
resource "azurerm_app_service" "app_service" {
  name                = "example-app-service"
  location            = var.location
  resource_group_name = var.rg_name
  app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
  depends_on          = [azurerm_resource_group.rg]
}

resource "azuread_application" "main_application" {
  display_name = "example-application"
  owners       = [data.azuread_client_config.current.object_id]
}

resource "azuread_application_federated_identity_credential" "federated_id" {
  application_object_id = azuread_application.main_application.object_id
  display_name          = "GithubActionsFederatedCredential"
  description           = "Federated credential for GitHub Actions"
  audiences             = ["api://AzureADTokenExchange"]
  issuer                = "https://token.actions.githubusercontent.com"
  subject               = "repo:YourOrganization/YourRepository:ref:refs/heads/main"
}

// Create a service principal for the application
resource "azuread_service_principal" "sp" {
  application_id               = azuread_application.main_application.application_id
  app_role_assignment_required = false
  owners                       = [data.azuread_client_config.current.object_id]
}

// Generate a client secret for the service principal
resource "azuread_service_principal_password" "client_secret" {
  service_principal_id = azuread_service_principal.sp.id
  end_date_relative    = "8760h"  # Set the expiration date (e.g., 1 year)
}

resource "azuread_application_password" "client_secret" {
  application_object_id = azuread_application.main_application.object_id
  end_date_relative     = "8760h"  # Set the expiration date (e.g., 1 year)
}

 

// Creates a DNS zone to host the DNS Records for our domain
resource "azurerm_dns_zone" "dnszone" {
  name                = "example.com"
  resource_group_name = var.rg_name
  depends_on          = [azurerm_resource_group.rg]
}

// Creates an A record for the domain name
resource "azurerm_dns_a_record" "a_record" {
  name                = "@"
  zone_name           = azurerm_dns_zone.dnszone.name
  resource_group_name = var.rg_name
  ttl                 = 300
  records             = split(",", azurerm_app_service.app_service.outbound_ip_addresses)
  depends_on          = [azurerm_dns_zone.dnszone, azurerm_app_service.app_service]
}

// Creates a TXT record for the domain name
resource "azurerm_dns_txt_record" "asuid_txt_record" {
  name                = "asuid"
  zone_name           = azurerm_dns_zone.dnszone.name
  resource_group_name = azurerm_resource_group.rg.name
  ttl                 = 300
  record {
    value = "YOUR_ASUID_TXT_RECORD_VALUE"
  }
}

// Binds a custom domain to the Azure App Service.
resource "azurerm_app_service_custom_hostname_binding" "custom_domain" {
  hostname            = "example.com"
  app_service_name    = azurerm_app_service.app_service.name
  resource_group_name = azurerm_resource_group.rg.name
  depends_on          = [azurerm_dns_txt_record.asuid_txt_record]
}

// Creates a managed SSL certificate for the custom domain.
resource "azurerm_app_service_managed_certificate" "ssl_cert" {
  custom_hostname_binding_id = azurerm_app_service_custom_hostname_binding.custom_domain.id
}

// Binds the managed SSL certificate to the custom domain on the App Service, enabling HTTPS.
resource "azurerm_app_service_certificate_binding" "sslcert_binding" {
  hostname_binding_id = azurerm_app_service_custom_hostname_binding.custom_domain.id
  certificate_id      = azurerm_app_service_managed_certificate.ssl_cert.id
  ssl_state           = "SniEnabled"
}