Request path
User → Azure Front Door Premium (WAF) → Private Link → static website (Storage) for /*, Container Apps for /api/* → MySQL, Redis and Azure Files over private endpoints.
Edge and web
Azure Front Door Premium
Global entry point and the only public endpoint.
- Managed TLS certificate, minimum TLS 1.2, HTTP redirected to HTTPS
- WAF in Prevention mode: Microsoft Default Rule Set 2.1 and Bot Manager 1.1
- Rate limit: 1,000 requests per minute per client IP
- Origins reached over Private Link (no public origin exposure)
Azure Storage – static website
Hosts the front-end (this page).
- StorageV2, Hot tier, ZRS (zone-redundant)
- Public network access disabled; private endpoints for web and blob
- Shared-key access disabled (Microsoft Entra ID only), TLS 1.2, infrastructure encryption
- Blob and container soft delete: 30 days
Application and data
Azure Container Apps
Runs the web/API containers.
- Workload-profiles environment in a custom VNet, internal load balancer, public access disabled
- Dedicated D4 profile, 3–6 nodes spread across zones
- Single-revision mode, HTTP autoscaling
- User-assigned managed identity for registry pulls and Key Vault
Azure Container Registry
Private image store.
- Premium SKU, private endpoint, admin user disabled
- Managed-identity pulls only
- Untagged manifests purged after 7 days
Azure Database for MySQL – Flexible Server
Primary relational database.
- MySQL 8.4, General Purpose D2ds_v4, 200 GiB storage
- Zone-redundant high availability (primary and standby in separate zones)
- Backups kept 35 days; geo-redundant backup off for data residency
- Private access only; secure transport required, TLS 1.2+
Azure Managed Redis
Cache and session store.
- Balanced B5 SKU with high availability
- Private endpoint, public access disabled
- Diagnostics streamed to Log Analytics
Azure Files
Shared media storage for the containers.
- Premium FileStorage, ZRS, 500 GiB share mounted over SMB 3.1.1
- Private endpoint, public access disabled, encrypted channel
- Share soft delete: 14 days
Security, networking and operations
Virtual network and private DNS
Private by default.
- One VNet with dedicated subnets for apps, database, private endpoints and CI
- Network security groups with deny-by-default rules
- Private DNS zones for every private endpoint
- NAT gateway for predictable outbound traffic from CI
Azure Key Vault
Secrets and key material.
- Premium SKU, RBAC authorization, private endpoint
- Purge protection on, 90-day soft delete
- Secrets read through managed identities, never stored in code
Monitoring and alerting
Observability for every service.
- Log Analytics workspace with 90-day retention
- Diagnostic settings on supported resources and the subscription activity log
- Alerts for MySQL, Redis, Key Vault, Front Door origin health and role changes, sent by email
Azure Backup
Protection for the Azure Files share.
- Recovery Services vault, daily backup at 02:00 (Singapore time)
- Retention: 30 days, 12 weeks, 12 months
- Instant-restore snapshots kept 7 days
Identity and access
Least privilege.
- Managed identities and Azure RBAC; shared keys disabled everywhere except the Azure Files SMB mount
- Terraform state in Azure Storage, Entra ID authenticated
- Private self-hosted GitHub Actions runner for deployments