Package: pulumi-django-azure
Pulumi Django DeploymentThis project aims to make a simple Django deployment on Azure easier.To have a proper and secure environment, we need these components:Storage account for media and static filesCDN endpoint in front with a domain name of our choosingPostgreSQL serverWebapp with multiple custom host names and managed SSL for the website itselfWebapp running pgAdminInstallationThis package is published on PyPi, so you can just add pulumi-django-azure to your requirements file.To use a specific branch in your project, add to pyproject.toml dependencies:pulumi-django-azure = { git = "git@gitlab.com:MaartenUreel/pulumi-django-azure.git", branch = "dev" }A simple project could look like this:importpulumiimportpulumi_azure_nativeasazurefrompulumi_django_azureimportDjangoDeploymentstack=pulumi.get_stack()config=pulumi.Config()# Create resource grouprg=azure.resources.ResourceGroup(f"rg-{stack}")# Create VNetvnet=azure.network.VirtualNetwork(f"vnet-{stack}",resource_group_name=rg.name,address_space=azure.network.AddressSpaceArgs(address_prefixes=["10.0.0.0/16"],),)# Deploy the website and all its componentsdjango=DjangoDeployment(stack,tenant_id="abc123...",resource_group_name=rg.name,vnet=vnet,pgsql_ip_prefix="10.0.10.0/24",appservice_ip_prefix="10.0.20.0/24",app_service_sku=azure.web.SkuDescriptionArgs(name="B2",tier="Basic",),storage_account_name="mystorageaccount",cdn_host="cdn.example.com",)django.add_django_website(name="web",db_name="mywebsite",repository_url="git@gitlab.com:project/website.git",repository_branch="main",website_hosts=["example.com","www.example.com"],django_settings_module="mywebsite.settings.production",)django.add_database_administrator(object_id="a1b2c3....",user_name="user@example.com",tenant_id="a1b2c3....",)Deployment stepsDeploy without custom hosts (for CDN and websites)Configure the PostgreSQL server (create and grant permissions to role for your websites)Retrieve the deployment SSH key and configure your remote GIT repository with itConfigure your CDN host (add the CNAME record)Configure your custom website domains (add CNAME/A record and TXT validation records)Re-deploy with custom hostsRe-deploy once more to enable HTTPS on website domainsManually activate HTTPS on the CDN hostCustom domain name for CDNWhen deploying the first time, you will get acdn_cnameoutput. You need to create a CNAME to this domain before the deployment of the custom domain will succeed.You can safely deploy with the failing CustomDomain to get the CNAME, create the record and then deploy again.To enable HTTPS, you need to do this manually in the console. This is because of a limitation in the Azure API:https://github.com/Azure/azure-rest-api-specs/issues/17498Custom domain names for web applicationBecause of a circular dependency in custom domain name bindings and certificates that is out of our control, you need to deploy the stack twice.The first time will create the bindings without a certificate.
The second deployment will then create the certificate for the domain (which is only possible if the binding exists), but also set the fingerprint of that certificate on the binding.To make the certificate work, you need to create a TXT record namedasuidpoint to the output of{your_app}_site_domain_verification_id. For example:asuid.mywebsite.com.      TXT  "A1B2C3D4E5..."
asuid.www.mywebsite.com.  TXT  "A1B2C3D4E5..."Database authenticationThe PostgreSQL uses Entra ID authentication only, no passwords.Administrator loginIf you want to log in to the database yourself, you can add yourself as an administrator with theadd_database_administratorfunction.
Your username is your e-mailaddress, a temporary password can be obtained usingaz account get-access-token.You can use this method to log in to pgAdmin.ApplicationRefer to this documentation:https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-manage-azure-ad-users#create-a-role-using-microsoft-entra-object-identifierIn short, run something like this in thepostgresdatabase:SELECT * FROM pgaadauth_create_principal_with_oid('web_managed_identity', 'c8b25b85-d060-4cfc-bad4-b8581cfdf946', 'service', false, false);Replace the GUID of course with the managed identity our web app gets.The name of the role is outputted by{your_app}_site_db_userBe sure to grant this role the correct permissions too.pgAdmin specificspgAdmin will be created with a default login:Login:dbadmin@dbadmin.netPassword: dbadminBest practice is to log in right away, create a user for yourself and delete this default user.Automate deploymentsWhen using a service like GitLab, you can configure a Webhook to fire upon a push to your branch.You need to download the deployment profile to obtain the deployment username and password, and then you can construct a URL like this:https://{user}:{pass}@{appname}.scm.azurewebsites.net/deployhttps://{appname}.scm.azurewebsites.net/api/sshkey?ensurePublicKey=1Be sure to configure the SSH key that Azure will use on GitLab side. You can obtain it using:This would then trigger a redeploy everytime you make a commit to your live branch.Change requestsI created this for internal use but since it took me a while to puzzle all the things together I decided to share it.
Therefore this project is not super generic, but tailored to my needs. I am however open to pull or change requests to improve this project or to make it more usable for others.