# Creating Automated Microsoft Bicep Application Infrastructure from GitHub in the Azure Cloud
## Appendix B Full Azure Container App Bicep Module for Secure Deployment  
The following template defines a complete Azure Container App deployment using Bicep. It includes identity binding, environment variable injection, secrets, and integration with PostgreSQL and Azure Search. The module is intended for production-grade deployments and supports parameterized reuse across environments. ```
param containerAppName string param location string param containerAppImage string param environmentId string param managedIdentityId string param managedIdentityClientId string @secure() param postgresAdminUser string @secure() param postgresAdminPassword string param postgresServerName string param searchServiceEndpoint string param acrLoginServer string resource containerApp 'Microsoft.App/containerApps@2024-10-02-preview' = { name: containerAppName location: location identity: { type: 'UserAssigned' userAssignedIdentities: { '${managedIdentityId}': {} } } properties: { template: { containers: [ { name: 'app-container' image: containerAppImage resources: { cpu: 32 memory: '256 Gi' } env: [ { name: 'PG_USER' secretRef: 'postgres-username' } } { name: 'PG_PASSWORD' secretRef: 'postgres-password' } } { name: 'PG_HOST' value: '${postgresServerName}.postgres.database.azure.com' } }
```
```
name:PG_DB' value:\"llm_database' } { name:PG_PORT' value:'5432' } { name:'AZURE_MI_ID' value:managedIdentityClientId } { name:'AZURE_SEARCH_ENDPOINT' value:searchServiceEndpoint } { name:'AZURE_SEARCH_INDEX_NAME' value:\"llm-index' } } } } } } } } } } }
``` { configuration:{ ingress:{ external:true targetPort:80 transport:'auto' } registries:[ { identity:managedIdentityId server:acrLoginServer } } } } } } ```
secrets:[ { name:'postgres-username' value:postgresAdminUser } { name:'postgres-password' value:postgresAdminPassword } } } } } }
```

environmentId: environmentId

## Appendix C Secure PostgreSQL Flexible Server Deployment Template (Bicep)

This appendix provides a full Bicep template for deploying a PostgreSQL Flexible Server with enhanced security features. The configuration disables public access, leverages delegated subnets for VNet integration, and uses a Private DNS Zone. It is suitable for production and development environments where database isolation is critical. ```
param location string param postgresServerName string param postgresAdminUser string @secure() param postgresAdminPassword string param dnsZonePsqlId string param psqlDelegatedSubnetId string resource flexibleServer 'Microsoft.DBforPostgreSQL_flexibleServers@2022-12-01' = name: postgresServerName location: location properties: { administratorLogin: postgresAdminUser administratorLoginPassword: postgresAdminPassword version: '13' availabilityZone: '1' storage: {storageSizeGB: 128 } network: { publicNetworkAccess: 'Disabled' delegatedSubnetResourceId: psqlDelegatedSubnetId privateDnsZoneArmResourceId: dnsZonePsqlId } sku: { name: 'Standard_D2s_v3' tier: 'GeneralPurpose' } resource postgresDatabase 'Microsoft.DBforPostgreSQL/flexibleServers/databases@2022-12-01' = name: 'environment-db' parent: flexibleServer properties: {} } outputpostgresServerId string = flexibleServer.id
```

## Appendix D Private Azure Cognitive Search Deployment (Bicep)

This appendix provides the full Bicep deployment template for provisioning an Azure Cognitive Search service with private network connectivity. Public access is disabled, and the resource is connected to a private subnet and DNS Zone, ensuring internal-only access. The configuration supports integration in highly secure environments such as enterprise-grade APIs or internal LLM applications.