# App Service Template Recipes — REFERENCE ONLY

Composable IaC + source code modules that extend the Web API or Web App base template to support specific Azure service integrations.

## Architecture

```
Base Template (per language/scenario, from AZD gallery)
       │
       ├── Source code (REST API or full-stack web app)
       ├── IaC (App Service Plan, App Service, App Insights, UAMI, RBAC)
       └── AZD config (azure.yaml, parameters)

       + Recipe (per integration)
       │
       ├── Source code delta (service client, middleware, config)
       ├── IaC delta (new resource + RBAC + networking modules)
       └── App settings delta
       │
       = Complete deployable project → `azd up`
```

## Available Recipes

| Recipe | IaC Delta? | Source Delta? | Status |
|--------|-----------|--------------|--------|
| [sql](sql/README.md) | ✅ SQL Server + DB + firewall + RBAC | ✅ EF Core (.NET), SQLAlchemy (Python), Prisma (Node.js) · ⏳ Spring Data JPA (Java): planned | ✅ Available |
| [cosmos](cosmos/README.md) | ✅ Cosmos account + DB + container + RBAC + PE | ✅ Cosmos SDK (.NET, Python, Node.js) · ⏳ Spring Data Cosmos (Java): planned | ✅ Available |
| [auth](auth/README.md) | ✅ App registration + Easy Auth config | ✅ MSAL / Identity middleware (.NET, Python, Node.js) · ⏳ Spring Security (Java): planned | ✅ Available |
| [redis](redis/README.md) | ✅ Redis cache + RBAC + PE | ✅ Distributed cache client (.NET, Python, Node.js) · ⏳ Spring Session (Java): planned | ✅ Available |

## How It Works

### Step 1: Fetch Base Template

```bash
# Pick template by language + scenario (see selection.md)
azd init -t <template> -e "$ENV_NAME" --no-prompt
```

### Step 2: Apply Recipe

The skill reads the recipe's README.md for:
- **IaC module files** to copy into `infra/`
- **App settings** to add to web app configuration
- **RBAC roles** with exact GUIDs (never generated by LLM)
- **Source code** to add alongside existing application code
- **Networking** to add private endpoints (conditional on VNET_ENABLED)

### Step 3: Wire Into Base

**Bicep:** Add `module` reference in `main.bicep`, pass `appServicePrincipalId`
**Terraform:** Copy `.tf` file into `infra/`, merge locals into web app settings

### Step 4: Deploy

```bash
azd env set AZURE_LOCATION eastus2
azd provision --no-prompt
sleep 60
azd deploy --no-prompt
```

## Design Principles

| Principle | Why |
|-----------|-----|
| **Never synthesize base IaC** | Always use proven AZD template repos |
| **Never modify base; only extend** | Recipes are additive — no risk of breaking core |
| **Recipes own their RBAC** | Exact role GUIDs, no LLM guessing |
| **Managed identity by default** | No passwords or connection strings in app settings |
| **Health checks required** | Every app must expose `/health` |