chore: tear down application services and simplify the remaining container application (#3975)

Author: jgravois

.env.sample

@@ -9,13 +9,7 @@ DJANGO_DB_FIXTURES="benefits/core/migrations/local_fixtures.json"
 DJANGO_DEBUG_TOOLBAR=false
 # DJANGO_LOCAL_PORT=
 
-USE_POSTGRES=false
-
-# Django Database settings (SQLite)
-DJANGO_DB_FILE=django.db
-DJANGO_DB_RESET=true
-
-# Django Database settings (Postgres)
+# Django Database settings
 DJANGO_DB_NAME=django
 DJANGO_DB_USER=django
 DJANGO_DB_PASSWORD=django_password

.github/workflows/deploy.yml

@@ -149,14 +149,6 @@ jobs:
           push: true
           tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
 
-      # deploy application service
-      - name: Deploy to Azure Web App
-        uses: azure/webapps-deploy@v2
-        with:
-          app-name: ${{ vars.AZURE_WEBAPP_NAME }}
-          images: ghcr.io/${{ github.repository }}:${{ github.sha }}
-          publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}
-
       # begin setup to deploy container app
       - name: Log in to azure using federated identity credentials
         uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3
@@ -178,7 +170,6 @@ jobs:
         working-directory: terraform
         env:
           TF_VAR_CONTAINER_TAG: ${{ github.sha }}
-          TF_VAR_DEVSECOPS_OBJECT_ID: ${{ secrets.TF_VAR_DEVSECOPS_OBJECT_ID }}
           TF_VAR_ENGINEERING_GROUP_OBJECT_ID: ${{ secrets.TF_VAR_ENGINEERING_GROUP_OBJECT_ID }}
           TF_VAR_sp_apply_object_id: ${{ secrets.AZURE_SP_OBJECT_ID }}
           TF_VAR_sp_plan_object_id: ${{ secrets.AZURE_SP_PLAN_OBJECT_ID }}

.github/workflows/terraform-plan.yml

@@ -49,7 +49,6 @@ jobs:
       - name: Terraform Plan
         env:
           TF_VAR_CONTAINER_TAG: ${{ steps.get_main_sha.outputs.sha }}
-          TF_VAR_DEVSECOPS_OBJECT_ID: ${{ secrets.TF_VAR_DEVSECOPS_OBJECT_ID }}
           TF_VAR_ENGINEERING_GROUP_OBJECT_ID: ${{ secrets.TF_VAR_ENGINEERING_GROUP_OBJECT_ID }}
           TF_VAR_sp_apply_object_id: ${{ secrets.AZURE_SP_DEV_OBJECT_ID }}
           TF_VAR_sp_plan_object_id: ${{ secrets.AZURE_SP_PLAN_OBJECT_ID }}

.github/workflows/tests-pytest.yml

@@ -12,12 +12,13 @@ on:
 jobs:
   pytest:
     runs-on: ubuntu-latest
+
     permissions:
       # Gives the action the necessary permissions for publishing new
       # comments in pull requests.
       pull-requests: write
       # Gives the action the necessary permissions for pushing data to the
-      # python-coverage-comment-action branch, and for editing existing
+      # python-coverage-comment-action-data branch, and for editing existing
       # comments (to avoid publishing multiple comments in the same PR)
       contents: write
     steps:
@@ -40,7 +41,7 @@ jobs:
 
       - name: Run setup
         run: |
-          python manage.py migrate
+          python manage.py migrate --settings=tests.pytest.settings
           python manage.py compilemessages
           python manage.py collectstatic --no-input
 

appcontainer/nginx.conf

@@ -74,7 +74,7 @@ http {
 
     # path for uploaded files
     location /media/ {
-      alias /home/calitp/app/data/uploads/;
+      alias /calitp/app/data/uploads/;
       expires 1y;
       add_header Cache-Control public;
     }

benefits/settings.py

@@ -195,40 +195,32 @@ def RUNTIME_ENVIRONMENT():
 WSGI_APPLICATION = "benefits.wsgi.application"
 
 STORAGE_DIR = os.environ.get("DJANGO_STORAGE_DIR", BASE_DIR)
-USE_POSTGRES = os.environ.get("USE_POSTGRES", "false").lower() == "true"
 
 sslmode = os.environ.get("POSTGRES_SSLMODE", "verify-full")
 sslrootcert = "/etc/ssl/certs/ca-certificates.crt" if sslmode == "verify-full" else None
 
-if USE_POSTGRES:
-    DATABASES = {
-        "default": {
-            "ENGINE": "django.db.backends.postgresql",
-            "NAME": os.environ.get("DJANGO_DB_NAME", "django"),
-            "USER": os.environ.get("DJANGO_DB_USER", "django"),
-            "PASSWORD": os.environ.get("DJANGO_DB_PASSWORD"),
-            "HOST": os.environ.get("POSTGRES_HOSTNAME", "postgres"),
-            "PORT": os.environ.get("POSTGRES_PORT", "5432"),
-            "OPTIONS": {
-                "sslmode": sslmode,
-                "sslrootcert": sslrootcert,
-                # add these lines to enable TCP keepalives --
-                # tiny network packets that keep the connection active and prevent
-                # network hardware or the database server from thinking it's idle
-                "keepalives": 1,
-                "keepalives_idle": 60,
-                "keepalives_interval": 10,
-                "keepalives_count": 5,
-            },
-        }
-    }
-else:
-    DATABASES = {
-        "default": {
-            "ENGINE": "django.db.backends.sqlite3",
-            "NAME": os.path.join(STORAGE_DIR, os.environ.get("DJANGO_DB_FILE", "django.db")),
-        }
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.postgresql",
+        "NAME": os.environ.get("DJANGO_DB_NAME", "django"),
+        "USER": os.environ.get("DJANGO_DB_USER", "django"),
+        "PASSWORD": os.environ.get("DJANGO_DB_PASSWORD"),
+        "HOST": os.environ.get("POSTGRES_HOSTNAME", "postgres"),
+        "PORT": os.environ.get("POSTGRES_PORT", "5432"),
+        "OPTIONS": {
+            "sslmode": sslmode,
+            "sslrootcert": sslrootcert,
+            # add these lines to enable TCP keepalives --
+            # tiny network packets that keep the connection active and prevent
+            # network hardware or the database server from thinking it's idle
+            "keepalives": 1,
+            "keepalives_idle": 60,
+            "keepalives_interval": 10,
+            "keepalives_count": 5,
+        },
     }
+}
+
 
 # Password handling
 

bin/setup.sh

@@ -1,46 +1,13 @@
 #!/usr/bin/env bash
 set -ex
 
-USE_POSTGRES="${USE_POSTGRES:-false}"
-
-if [[ $USE_POSTGRES == "true" ]]; then
-    # Ensure databases, users, migrations, and superuser are set up
-    should_reset=${REMOTE_CONTAINERS:-false}
-    if [[ $should_reset == "true" ]]; then
-        # running in a devcontainer, reset the DB
-        python manage.py ensure_db --reset
-    else
-        python manage.py ensure_db
-    fi
+ # Ensure databases, users, migrations, and superuser are set up
+should_reset=${REMOTE_CONTAINERS:-false}
+if [[ $should_reset == "true" ]]; then
+    # running in a devcontainer, reset the DB
+    python manage.py ensure_db --reset
 else
-    # construct the path to the database file from environment or default
-    DB_DIR="${DJANGO_STORAGE_DIR:-.}"
-    DB_FILE="${DJANGO_DB_FILE:-django.db}"
-    DB_PATH="${DB_DIR}/${DB_FILE}"
-
-    if ! [[ -f "${DB_PATH}" ]]; then
-        # definitely reset if the database file is not found
-        DB_RESET=true
-    else
-        # use the DJANGO_DB_RESET env var or default to false
-        DB_RESET="${DJANGO_DB_RESET:-false}"
-    fi
-
-    if [[ $DB_RESET = true ]]; then
-        echo "DB_RESET is true, deleting existing DB (if present)"
-        rm -f "${DB_PATH}"
-
-        # run database migrations
-        python manage.py migrate
-
-        # create a superuser account for backend admin access
-        # set username, email, and password using environment variables
-        # DJANGO_SUPERUSER_USERNAME, DJANGO_SUPERUSER_EMAIL, and DJANGO_SUPERUSER_PASSWORD
-        python manage.py createsuperuser --no-input
-    else
-        echo "DB_RESET is false, migrating existing database"
-        python manage.py migrate
-    fi
+    python manage.py ensure_db
 fi
 
 valid_fixtures=$(echo "$DJANGO_DB_FIXTURES" | grep -e fixtures\.json$ || test $? = 1)

docs/explanation/deployment.md

@@ -1,17 +1,17 @@
 # Deployment
 
-The Benefits app is currently deployed into a Microsoft Azure account provided by [California Department of Technology (CDT)'s Office of Enterprise Technology (OET)][oet], a.k.a. the "DevSecOps" team. More specifically, it uses [custom containers][app-service-containers] on [Azure App Service][app-service]. [More about the infrastructure.](infrastructure.md)
+The Benefits app is currently deployed into a Microsoft Azure account provided by [California Department of Technology (CDT)'s Office of Enterprise Technology (OET)][oet], a.k.a. the "DevSecOps" team. More specifically, it uses [Azure Container Apps][container-apps]. [More about the infrastructure.](infrastructure.md)
 
 ## Deployment process
 
 The Django application gets built into a [Docker image][dockerfile] with [NGINX](https://www.nginx.com/) and
 [Gunicorn](https://gunicorn.org/). SQLite is used within that same container to store configuration data; there is no external database.
 
-The application is deployed to an [Azure Web App Container][az-webapp] using three separate environments for `dev`, `test`,
+The application is deployed to an [Azure Container App][container-apps] using three separate environments for `dev`, `test`,
 and `prod`.
 
 The [Deploy][deploy-workflow] workflow is responsible for building that branch's image and pushing to [GitHub Container
-Registry (GHCR)][ghcr]. It also deploys to the Azure Web App, telling Azure to restart the app and pull the latest image.
+Registry (GHCR)][ghcr]. It also deploys to the Azure Container App, telling Azure to restart the app and pull the latest image.
 
 You can view what Git commit is deployed for a given environment by visiting the URL path `/static/sha.txt`.
 
@@ -42,9 +42,9 @@ Build the root [`Dockerfile`][dockerfile], tagging with the SHA from the HEAD co
 
 Push this image:tag into [GHCR][ghcr].
 
-### 4. App Service deploy
+### 4. Container App deploy
 
-Push the new image:tag to the Azure App Service instance.
+Push the new image:tag to the Azure Container App.
 
 ## Configuration
 
@@ -59,10 +59,8 @@ Docker images for each of the deploy branches are available from GitHub Containe
 - Image path: `ghcr.io/cal-itp/benefits`
 
 [oet]: https://techblog.cdt.ca.gov/2020/06/cdt-taking-the-lead-in-digital-transformation/
-[app-service-containers]: https://docs.microsoft.com/en-us/azure/app-service/configure-custom-container
-[app-service]: https://docs.microsoft.com/en-us/azure/app-service/overview
+[container-apps]: https://learn.microsoft.com/en-us/azure/container-apps/overview
 [deploy-workflow]: https://github.com/cal-itp/benefits/blob/main/.github/workflows/deploy.yml
-[az-webapp]: https://azure.microsoft.com/en-us/services/app-service/containers/
 [ghcr]: https://github.com/features/packages
 [deploy]: https://github.com/cal-itp/benefits/blob/main/.github/workflows/deploy.yml
 [dockerfile]: https://github.com/cal-itp/benefits/blob/main/appcontainer/Dockerfile

docs/explanation/infrastructure.md

@@ -59,11 +59,9 @@ flowchart LR
     subgraph Azure
         frontdoor --> NGINX
 
-        subgraph App Service
-            subgraph Custom container
-                direction TB
-                NGINX --> django
-            end
+        subgraph Container App
+            direction TB
+            NGINX --> django
         end
     end
 ```
@@ -123,23 +121,23 @@ The DevSecOps team sets the following naming convention for Resources:
 ### Sample Names
 
 - `RG-CDT-PUB-VIP-BNSCN-E-D-001`
-- `ASP-CDT-PUB-VIP-BNSCN-EL-P-001`
-- `AS-CDT-PUB-VIP-BNSCN-EL-D-001`
+- `CAE-CDT-PUB-VIP-BNSCN-EL-P-001`
+- `CA-CDT-PUB-VIP-BNSCN-EL-D-001`
 
 ### Resource Types
 
 Use the following shorthand for conveying the Resource Type as part of the Resource Name:
 
-| Resource         | Convention |
-| ---------------- | ---------- |
-| App Service      | `AS`       |
-| App Service Plan | `ASP`      |
-| Virtual Network  | `VNET`     |
-| Resource Group   | `RG`       |
-| Virtual Machine  | `VM`       |
-| Database         | `DB`       |
-| Subnet           | `SNET`     |
-| Front Door       | `FD`       |
+| Resource                   | Convention |
+| -------------------------- | ---------- |
+| Container Apps Environment | `CAE`      |
+| Container App              | `CA`       |
+| Virtual Network            | `VNET`     |
+| Resource Group             | `RG`       |
+| Virtual Machine            | `VM`       |
+| Database                   | `DB`       |
+| Subnet                     | `SNET`     |
+| Front Door                 | `FD`       |
 
 ## Making changes
 
@@ -199,6 +197,6 @@ These steps were followed when setting up our Azure deployment for the first tim
 - CDT team creates the [resources that they own](#ownership)
 - `terraform apply`
 - Set up Slack notifications by [creating a Slack email](https://slack.com/help/articles/206819278-Send-emails-to-Slack) for the [#notify-benefits](https://cal-itp.slack.com/archives/C022HHSEE3F) channel, then [setting it as a Secret in the Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-portal#add-a-secret-to-key-vault) named `slack-benefits-notify-email`
-- Set required [App Service configuration](../reference/environment-variables.md) and [configuration](../tutorials/load-sample-data.md) by setting values in Key Vault (the mapping is defined in [app_service.tf](https://github.com/cal-itp/benefits/blob/main/terraform/app_service.tf))
+- Set required [Container App configuration](../reference/environment-variables.md) and [configuration](../tutorials/load-sample-data.md) by setting values in Key Vault (the mapping is defined in [app_service.tf](https://github.com/cal-itp/benefits/blob/main/terraform/app_service.tf))
 
 This is not a complete step-by-step guide; more a list of things to remember. This may be useful as part of [incident response](https://docs.google.com/document/d/1qtev8qItPiTB4Tp9FQ87XsLtWZ4HlNXqoe9vF2VuGcY/edit#).

docs/guides/getting-started.md

@@ -128,11 +128,11 @@ Compiler developers, be sure to follow the instructions in the [Django Admin upd
 
 If you have a need to maintain some test data that you've added via the Django Admin across multiple development sessions:
 
-1. Set `DJANGO_DB_RESET=false` in your `.env` file
 1. Create a new set of temporary fixtures:
    ```bash
    python manage.py dumpdata --indent 2 --output benefits/core/migrations/temp_fixtures.json
    ```
+
    - It's important that the filename end in `fixtures.json` so that it's ignored by Git.
 1. Set `DJANGO_DB_FIXTURES` to the path of the new file you just created in `.env`
 1. Rebuild the devcontainer