1# App Service Template Recipes — REFERENCE ONLY
2 
3Composable IaC + source code modules that extend the Web API or Web App base template to support specific Azure service integrations.
4 
5## Architecture
6 
7```
8Base Template (per language/scenario, from AZD gallery)
9       │
10       ├── Source code (REST API or full-stack web app)
11       ├── IaC (App Service Plan, App Service, App Insights, UAMI, RBAC)
12       └── AZD config (azure.yaml, parameters)
13 
14       + Recipe (per integration)
15       │
16       ├── Source code delta (service client, middleware, config)
17       ├── IaC delta (new resource + RBAC + networking modules)
18       └── App settings delta
19       │
20       = Complete deployable project → `azd up`
21```
22 
23## Available Recipes
24 
25| Recipe | IaC Delta? | Source Delta? | Status |
26|--------|-----------|--------------|--------|
27| [sql](sql/README.md) | ✅ SQL Server + DB + firewall + RBAC | ✅ EF Core (.NET), SQLAlchemy (Python), Prisma (Node.js) · ⏳ Spring Data JPA (Java): planned | ✅ Available |
28| [cosmos](cosmos/README.md) | ✅ Cosmos account + DB + container + RBAC + PE | ✅ Cosmos SDK (.NET, Python, Node.js) · ⏳ Spring Data Cosmos (Java): planned | ✅ Available |
29| [auth](auth/README.md) | ✅ App registration + Easy Auth config | ✅ MSAL / Identity middleware (.NET, Python, Node.js) · ⏳ Spring Security (Java): planned | ✅ Available |
30| [redis](redis/README.md) | ✅ Redis cache + RBAC + PE | ✅ Distributed cache client (.NET, Python, Node.js) · ⏳ Spring Session (Java): planned | ✅ Available |
31 
32## How It Works
33 
34### Step 1: Fetch Base Template
35 
36```bash
37# Pick template by language + scenario (see selection.md)
38azd init -t <template> -e "$ENV_NAME" --no-prompt
39```
40 
41### Step 2: Apply Recipe
42 
43The skill reads the recipe's README.md for:
44- **IaC module files** to copy into `infra/`
45- **App settings** to add to web app configuration
46- **RBAC roles** with exact GUIDs (never generated by LLM)
47- **Source code** to add alongside existing application code
48- **Networking** to add private endpoints (conditional on VNET_ENABLED)
49 
50### Step 3: Wire Into Base
51 
52**Bicep:** Add `module` reference in `main.bicep`, pass `appServicePrincipalId`
53**Terraform:** Copy `.tf` file into `infra/`, merge locals into web app settings
54 
55### Step 4: Deploy
56 
57```bash
58azd env set AZURE_LOCATION eastus2
59azd provision --no-prompt
60sleep 60
61azd deploy --no-prompt
62```
63 
64## Design Principles
65 
66| Principle | Why |
67|-----------|-----|
68| **Never synthesize base IaC** | Always use proven AZD template repos |
69| **Never modify base; only extend** | Recipes are additive — no risk of breaking core |
70| **Recipes own their RBAC** | Exact role GUIDs, no LLM guessing |
71| **Managed identity by default** | No passwords or connection strings in app settings |
72| **Health checks required** | Every app must expose `/health` |
73