Skip to content

Azure

Azure

Azure plays two distinct roles in devhome: a small, deliberately-scoped Terraform footprint for DNS and offsite backup storage (terraform/azure/), and a larger hybrid architecture (Hub VNet, Azure Arc, private AKS, ACR) reached over the IPsec VPN tunnel — see Architecture Overview for where that sits in the overall topology.

What's actually in terraform/azure/

This directory is intentionally small — it owns exactly two things:

DNS zone (devhome.cloud)

resource "azurerm_dns_zone" "devhome_dns_zone" {
  name                = "devhome.cloud"
  resource_group_name = azurerm_resource_group.dns.name
}

Azure Public DNS is authoritative for devhome.cloud (name servers delegated from the registrar). This is also the zone pfSense's ACME package validates against via DNS-01 — see ACME Certificates.

One dynamic A record lives here: openvpn.devhome.cloud, pointed at the home connection's public IP. Since that IP isn't static, it's kept current by an Azure DevOps pipeline (see Pipelines) that looks up the current public IP and calls az network dns record-set a add-record on a schedule — the same public-IP lookup pattern (dig +short myip.opendns.com @resolver1.opendns.com) is reused directly in terraform/azure/plan.sh so a manual terraform plan always has the current address too.

Offsite backup storage account

A single storage account (devhomesa<random-suffix> — storage account names must be globally unique across all of Azure, hence the random suffix) with two purposes:

  • backups container — offsite copies of config backups produced by ansible/backup-playbook.yml, written as backups/devhome_backup_<YYYY-MM-DD>/<file>. A lifecycle management policy prunes anything older than 30 days, scoped specifically to that prefix so it can never touch anything else in the account.
  • cloudshell file share — Azure Cloud Shell's persistent $HOME, sized to Cloud Shell's own 5 GiB default so it can be selected as the existing share during Cloud Shell's setup wizard rather than provisioning a second one.

Credentials

terraform/azure authenticates purely from Vault — devhome/azure (arm_subscription_id/arm_client_id/arm_client_secret/arm_tenant_id), read via a vault_kv_secret_v2 data source, same pattern as every other Terraform stack (see Vault Consumers). The backup storage account/container names are themselves stored back into devhome/azure by terraform/vault's state — this directory only ever reads that secret, never writes it, so there's exactly one owner of that value.

The hybrid pieces (Hub VNet, Arc, AKS, ACR)

The Hub Resource Group side of the architecture — Virtual Network Gateway, Hub VNet (172.16.0.0/16), Azure DNS Resolver, Arc-connected Kubernetes/Machines, private AKS, and private ACR — is reached from the lab via the IPsec tunnel (see VPN) and pfSense's Domain Overrides for the private-link DNS zones. This is not managed from terraform/azure/ in this repo.