feat(infra): manage sluice.phoenixvc.tech custom domain in Terraform#129
Merged
Conversation
Backport the out-of-band custom-domain binding (created 2026-07-03 via az containerapp hostname add + hostname bind) into the sluice_aca module so subsequent applies adopt it instead of flagging drift. - sluice_aca module: new custom_domains variable + azurerm_container_app_custom_domain resource with ignore_changes on the managed-cert attributes (azurerm cannot manage managed certs) - env/prod: pass-through variable, tfvars entry, and an import block adopting the live binding (expect 1 to import, 0 to add/change/destroy) - DNS (CNAME + asuid TXT) stays in the org-owned phoenixvc.tech zone in mys-global-shared-rg (different subscription) — intentionally out of scope here Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughAdds a ChangesCustom Domain Support
Estimated code review effort: 2 (Simple) | ~15 minutes Related PRs: None identified. Suggested labels: infra, terraform Suggested reviewers: None identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR backports the existing (manually created) sluice.phoenixvc.tech custom-domain binding on the prod Azure Container App into Terraform, so future applies adopt the binding instead of treating it as drift.
Changes:
- Adds a
custom_domainsinput to thesluice_acamodule and wires it throughinfra/env/prod. - Manages custom-domain bindings via
azurerm_container_app_custom_domainwithignore_changesfor managed-cert fields. - Adds a one-time
import {}block in prod to adopt the existing binding into state.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| infra/modules/sluice_aca/variables.tf | Adds custom_domains module input for pre-verified hostnames. |
| infra/modules/sluice_aca/main.tf | Creates per-domain azurerm_container_app_custom_domain resources with lifecycle ignores for managed cert fields. |
| infra/modules/sluice_aca/outputs.tf | Exposes the configured/bound custom domains from the module. |
| infra/env/prod/variables.tf | Adds custom_domains variable to prod environment. |
| infra/env/prod/main.tf | Passes custom_domains to the module and imports the existing prod binding into state. |
| infra/env/prod/terraform.tfvars | Configures custom_domains = ["sluice.phoenixvc.tech"] for prod. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+322
to
+326
| variable "custom_domains" { | ||
| type = list(string) | ||
| description = "Pre-verified custom hostnames to bind to the gateway Container App. Each hostname must already have DNS in place (CNAME + asuid TXT in the owning zone) and an Azure-managed certificate provisioned out-of-band via `az containerapp hostname add` + `az containerapp hostname bind` before being listed here." | ||
| default = [] | ||
| } |
Comment on lines
+1039
to
+1041
| lifecycle { | ||
| ignore_changes = [certificate_binding_type, container_app_environment_certificate_id] | ||
| } |
|
|
||
| output "custom_domain_fqdns" { | ||
| description = "Custom hostnames bound to the gateway Container App (empty when none configured)." | ||
| value = [for d in azurerm_container_app_custom_domain.custom : d.name] |
JustAGhosT
added a commit
that referenced
this pull request
Jul 3, 2026
…phoenixvc.tech (#130) Lane partition ratified 2026-07-03: Codex owns release/prod, Claude owns backend/security/infra. Merge authority follows the lane owner; cross-lane coordination via PR comments. Consumer base-URL examples now use the custom domain bound in PR #129 — the raw azurecontainerapps.io FQDN still works but changes if the CAE is rebuilt. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Backports the out-of-band
sluice.phoenixvc.techcustom-domain binding on Container Apppvc-prod-sluice-ca(RGpvc-prod-sluice-rg) into Terraform, so the next apply adopts it instead of flagging or undoing it as drift.Background — what was created out-of-band
On 2026-07-03 the hostname was bound manually:
az containerapp hostname add+az containerapp hostname bind --validation-method CNAMEmc-pvc-prod-sluic-sluice-phoenixvc-1673https://sluice.phoenixvc.tech/health/livelinessChanges
infra/modules/sluice_aca/variables.tfcustom_domains(list(string), default[])infra/modules/sluice_aca/main.tfazurerm_container_app_custom_domain.custom(for_each)infra/modules/sluice_aca/outputs.tfcustom_domain_fqdnsoutputinfra/env/prod/variables.tfcustom_domainsvariableinfra/env/prod/main.tfmodule "sluice"+import {}blockinfra/env/prod/terraform.tfvarscustom_domains = ["sluice.phoenixvc.tech"]Import block — adoption semantics
The
import {}block ininfra/env/prod/main.tfadopts the existing live binding on the next apply. Expected plan for this resource: 1 to import, 0 to add, 0 to change, 0 to destroy. Once the binding is in state the block is a no-op and can be removed in a follow-up.Import ID (note
containerAppscapital A — the azurerm v4 ID parser is case-sensitive on static segments and rejects the all-lowercase form thataz containerapp show --query idreturns; casing verified against the format string embedded in the azurerm v4.70.0 provider binary):Managed-cert
ignore_changesrationaleThe certificate is an Azure-managed cert provisioned by
az containerapp hostname bind— the azurerm provider cannot manage managed certificates on this resource directly. Per the provider docs,certificate_binding_typeandcontainer_app_environment_certificate_idmust be inlifecycle.ignore_changes, otherwise every plan tries to unbind the certificate.DNS intentionally out of scope
The
CNAMEandasuid.sluiceTXT records live in the org-ownedphoenixvc.techzone inmys-global-shared-rg— a different subscription/ownership boundary than sluice. DNS stays out of this stack; this is documented in a code comment on the resource.Validation
terraform fmt -recursive— clean, no reformatsterraform init -backend=false+terraform validateininfra/env/prod— Success! The configuration is valid. (azurerm v4.70.0, random v3.8.1)Baton task:
5dc28591🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Chores