Reference
Deployment
This page is deliberately short: the canonical deployment documentation lives in the repo, next to the code it deploys, and this site does not duplicate it (a runbook copied into a docs site is a runbook that drifts).
| Document | Path in the repo | What it is |
|---|---|---|
| Azure portal runbook | infra/deploy-azure.md |
The complete first-time deployment, step by step, through the Azure Portal UI — identity, Postgres, Service Bus, Key Vault, Container Apps, ADO wiring, smoke tests, operations |
| Infrastructure as code | infra/ (infra/README.md) |
Bicep modules codifying the same resources for repeatable deployments |
The two paths
Portal runbook (infra/deploy-azure.md) — the reference for what each
resource is and why. It walks through: the Entra service principal that is
both the ADO reviewer identity and the Service Bus principal; PostgreSQL
Flexible Server + migrations; a Service Bus namespace with a
sessions-enabled queue (the checkbox that is immutable after creation);
Key Vault holding every secret; two Container Apps (always-on ingress,
KEDA-scaled worker) from the single Argus image; the three ADO service hooks;
branch policy; and the four smoke tests that define Phase-1 acceptance.
It also carries the operations material: pause/resume, DLQ inspection, KQL
log queries, credential rotation, migration-on-upgrade.
Bicep (infra/) — the "next releases" path: one
az deployment group create instead of an afternoon of clicking. It codifies
the resources but not the steps ARM cannot reach — Entra app registration,
ADO-side wiring (users, permissions, service hooks, branch policy), image
build/push, migrations, and the rules publish all stay manual;
infra/README.md gives the exact ordering, including the two-pass bootstrap a
brand-new stack needs for Key Vault references.
What deployment amounts to
One immutable container image (tagged semver and git sha — never
latest) runs every component by CMD override:
node bin/dist/argus-ingress.js # webhook front door (default CMD)
node bin/dist/argus-worker.js # queue consumer
node bin/dist/argus-migrate.js # DB migrations (one-off)
node bin/dist/argus-rules.js … # rules publish / drift
node bin/dist/argus-evals.js # eval harness
node bin/dist/argus-docs.js # this documentation site
Secrets live in Key Vault and reach the apps as env vars via managed-identity secret references; every env var name is grounded in the configuration reference — if it is not there, the code does not read it.
Deploying this docs site
The site you are reading deploys from the same image: an optional third
Container App with CMD overridden to node bin/dist/argus-docs.js, target
port 4100, ingress internal-only (or external if you want it public), no
secrets and no configuration required — see the "docs site" subsection in
infra/deploy-azure.md (step 7f). It is portal-only for now: the Bicep
modules codify the ingress and worker apps, not this optional one. Locally,
docker compose up serves it on port 4100 alongside the mock loop.