The Atlas MikeOSS.Azure's docs, bound to the code — and to the migration that built it
108 documents

The migration, PRD by PRD

The trail of changes since the upstream fork: the milestone azure-migration issues in order, each paired with the code it produced. How Mike went from hosted-Supabase SaaS to a single-tenant Azure deployment.

Parent docs

docs/infra/001-network-topology.md docs/infra/003-secrets-and-identity.md docs/infra/004-bicep-and-manual-provisioning.md docs/infra/005-container-images-and-observability.md

What to build

Produce the Bicep entry point and all shared infrastructure modules that every other slice depends on. This is the foundation that nothing else can be provisioned without.

Modules to create under infra/modules/:

  • network.bicep — VNet (10.0.0.0/16), three subnets (subnet-cae /23, subnet-pe /27, subnet-natgw /27), NAT Gateway + public IP (parameterised enableNatGateway), Private DNS zones for privatelink.postgres.database.azure.com and privatelink.blob.core.windows.net, VNet links for both zones.
  • keyvault.bicep — Key Vault with RBAC authorisation enabled. Empty at provision time; populated by post-deploy runbook. Secret slots documented: postgres-admin-password, postgrest-jwt-secret, openai-api-key, anthropic-api-key.
  • main.bicep — composes all modules; accepts parameters from main.parameters.dev.json and main.parameters.prod.json.

Historical note: earlier revisions of this slice also provisioned an observability.bicep (Log Analytics + workspace-based Application Insights, connection string in KV). That module was removed; observability is now opt-in and tracked in azure-production-hardening.md.

Parameter set matches docs/infra/004-bicep-and-manual-provisioning.md table exactly: env, location, pgSku, pgStorageGb, pgBackupRetentionDays, backendImage, postgrestImage, enableHa, enableNatGateway, containerRegistry.

The equivalent az CLI runbook steps 0–3 and 6 in docs/infra/004-bicep-and-manual-provisioning.md must stay in sync with the Bicep template.

Acceptance criteria

  • [ ] az deployment group create --template-file infra/main.bicep --parameters infra/main.parameters.dev.json completes without errors in a fresh resource group.
  • [ ] VNet with three subnets exists; NAT Gateway attached to subnet-cae.
  • [ ] Private DNS zones created and linked to the VNet.
  • [ ] Key Vault created with RBAC mode; no secrets populated yet (that is intentional).
  • [ ] enableNatGateway: false parameter skips NAT Gateway without template errors.
  • [ ] Resource naming follows <resource>-mike-<env> convention throughout.

Blocked by

None — can start immediately.

User stories addressed

  • Operator can provision the complete network foundation in a fresh Azure subscription with a single Bicep command.
  • Non-prod environments can omit the NAT Gateway to reduce cost.
  • All resources land in a single parameterised region.