/restro

A RESTful API deployed to Azure

Primary LanguageHCLMIT LicenseMIT

restro

Backend CI Backend CD

logo

A simple restaurant recommendation system.

This project helped me transition my AWS knowledge to Azure, which I've written about in the JOURNEY.md file.

Demo on YouTube

Architecture

Click to expand/collapse

Architecture

Requirements

Setup

One-time setup steps to prepare the environment.

Azure

  1. Clone the repository
  2. Copy env to .env and update the values 
    cp env .env
  3. Login to Azure 
    make azure-login
  4. Create a remote state storage in Azure 
    make azure-remote-state-init

Azure Service Principal

This setup creates an Azure Service Principal so GitHub Actions can authenticate with Azure.

  1. Login to Azure

    make azure-login

  2. List available subscriptions

    make azure-service-principal-list

    Sample output

    Name           CloudName    SubscriptionId                        TenantId                              State    IsDefault
-------------  -----------  ------------------------------------  ------------------------------------  -------  -----------
Pay-As-You-Go  AzureCloud   00000000-0000-0000-0000-000000000000  12345678-0000-0000-0000-000000000000  Enabled  True

  3. Copy SubscriptionId and set it in .env

    SUBSCRIPTION_ID=00000000-0000-0000-0000-000000000000

  4. Create the Service Principal

    make azure-service-principal-create

  5. Copy the output JSON and save it in a safe place

  6. Add the service principal as a GitHub secret

  7. The app is now ready to be deployed with GitHub Actions to Azure

Getting Started

Infra

  1. Login to Azure

    make azure-login

  2. Initialize Terraform

    make infra-init

  3. Modify the infrastructure

  4. Plan the infra

    make infra-plan

  5. Apply the infra

    make infra-apply

    NOTE: For the first time, it will probably fail due to missing TXT record in Cloudflare. Add the TXT record to Cloudflare and make infra-plan followed by make infra-apply again.

Cloudflare

Cloudflare is used to protect the website with a custom password. The site is accessible only by users with the custom password in the header. If you wish to strengthen the security, you can add more rules to the WAF, like "Rate Limiting".

Cloudflare requires a one-time setup, which should be done after deploying the infrastructure for the first time, as it relies on the output of the infrastructure deployment.

CNAME DNS Record

This step is required to route traffic from Cloudflare to the Azure app.

  1. Navigate to Cloudflare dashboard
  2. Websites > Select website > DNS > + Add record
  3. Add the following record:
    • Type > CNAME
    • Name > restro
    • Target > restro-{random_integer}.azurewebsites.net (output of infra)
    • TTL > Auto
    • Proxy Status > Proxied

Check assets/cloudflare.dns.png to see what it should look like on Cloudflare.

Security WAF Custom Rule

This step is optional, as it protects the app with a custom password in the header. I do recommend adding it to avoid unwanted access to the app.

  1. Navigate to Cloudflare dashboard
  2. Websites > Select website > Security > WAF > Custom rules > + Create rule
  3. Edit expression > Set to the below expression, replace restro.meirg.co.il with your domain, my-custom-header-name with your custom header name, and my_cuStOm_passw0rd with your custom password. 
    (http.host eq "restro.meirg.co.il" and all(http.request.headers["my-custom-header-name"][*] ne "my_cuStOm_passw0rd"))
    • Action > Block
    • With response type > Default Cloudflare WAF block page

Backend

This section is about building and deploying the backend application to Azure.

  1. Login to Azure 
    make azure-login
  2. Build and Package the app 
    make backend-build
  3. Push Docker image 
    make backend-push
  4. Deploy the app to Azure 
    make backend-deploy

Local Development

  1. Prepare the backend environment 
    make backend-prepare
  2. Install requirements 
    make backend-install
  3. Run services locally - mongo and mongo-express 
    make services-up
  4. Run the app locally - access http://127.0.0.1:5000 
    make backend-run

Authors

Created and maintained by Meir Gabay

License

This project is licensed under the MIT License - see the LICENSE file for details