1// Bicep — App Service Plan + Web App with slots and auto-scale
2resource plan 'Microsoft.Web/serverfarms@2023-01-01' = {
3  name: 'plan-myapp-prod'
4  location: resourceGroup().location
5  sku: {
6    name: 'P1v3'     // Premium v3 — required for VNet integration and deployment slots
7    tier: 'PremiumV3'
8    capacity: 2      // Start with 2 instances; auto-scale will add up to 10
9  }
10  properties: {
11    reserved: true   // Linux
12  }
13}
14
15resource app 'Microsoft.Web/sites@2023-01-01' = {
16  name: 'app-myapp-prod'
17  location: resourceGroup().location
18  properties: {
19    serverFarmId: plan.id
20    siteConfig: {
21      alwaysOn: true                 // REQUIRED on B1+ — not available on F1/D1
22      healthCheckPath: '/health'     // Returns 200; unhealthy instances removed from LB
23      vnetRouteAllEnabled: true      // Route ALL outbound traffic through VNet (not just RFC1918)
24      appSettings: [
25        { name: 'WEBSITE_RUN_FROM_PACKAGE', value: '1' }  // Read-only deployment, faster start
26        { name: 'ASPNETCORE_ENVIRONMENT', value: 'Production' }
27      ]
28      connectionStrings: [
29        {
30          name: 'DefaultConnection'
31          connectionString: '@Microsoft.KeyVault(SecretUri=https://mykv.vault.azure.net/secrets/db-conn)'
32          type: 'SQLAzure'
33          // slotSetting: false  ← DEFAULT — this conn string WILL be swapped with staging!
34          // Set slotSetting: true to make it sticky (not swapped)
35        }
36      ]
37    }
38    virtualNetworkSubnetId: subnetId  // VNet integration for outbound
39  }
40}
41
42// Staging deployment slot
43resource stagingSlot 'Microsoft.Web/sites/slots@2023-01-01' = {
44  name: 'staging'
45  parent: app
46  location: resourceGroup().location
47  properties: {
48    siteConfig: {
49      alwaysOn: true
50      appSettings: [
51        { name: 'ASPNETCORE_ENVIRONMENT', value: 'Staging' }
52        // Slot-sticky settings: slotSetting: true ensures these stay in staging after swap
53      ]
54    }
55  }
56}
57
58// Auto-scale rule — CPU-based scale out
59resource autoScale 'Microsoft.Insights/autoscalesettings@2022-10-01' = {
60  name: 'autoscale-myapp'
61  location: resourceGroup().location
62  properties: {
63    targetResourceUri: plan.id
64    enabled: true
65    profiles: [{
66      name: 'CPU-based'
67      capacity: { minimum: '2', maximum: '10', default: '2' }
68      rules: [
69        {
70          metricTrigger: {
71            metricName: 'CpuPercentage'
72            metricResourceUri: plan.id
73            timeGrain: 'PT1M'
74            statistic: 'Average'
75            timeWindow: 'PT5M'   // 5-min window — too short can cause flapping
76            timeAggregation: 'Average'
77            operator: 'GreaterThan'
78            threshold: 70
79          }
80          scaleAction: { direction: 'Increase', type: 'ChangeCount', value: '1', cooldown: 'PT5M' }
81        },
82        {
83          metricTrigger: {
84            metricName: 'CpuPercentage'
85            metricResourceUri: plan.id
86            timeGrain: 'PT1M'
87            statistic: 'Average'
88            timeWindow: 'PT10M'  // Scale-in window longer than scale-out to avoid flapping
89            timeAggregation: 'Average'
90            operator: 'LessThan'
91            threshold: 30
92          }
93          scaleAction: { direction: 'Decrease', type: 'ChangeCount', value: '1', cooldown: 'PT10M' }
94        }
95      ]
96    }]
97  }
98}