Microtec DevOps

Appearance

Fooj Azure Infrastructure ​

Section: 17 — Fooj
Last Updated: 2026-05-30
Scope: Fooj Azure subscription, resource groups, ACA setup, shared VNet egress

Overview ​

Fooj runs in a completely separate Azure subscription from the Microtec ERP platform. The two systems share nothing at the subscription level — billing, IAM, networking policies, and quotas are all independent.

Fooj Subscription ID

f2340b90-2a00-4551-aabc-6e1776e82077

Subscription Separation Rationale ​

ConcernERP SubscriptionFooj Subscription
BillingMicrotec ERP budgetFooj project budget
IAMERP team engineersFooj team engineers
Network CIDR space10.0–10.6/16 rangeSeparate CIDR range
ACRmicerpbe{env}acrFooj-specific ACR
Service principalERP pipeline SPFooj pipeline SP

Resource Groups ​

Fooj uses a clean two-tier RG structure per environment:

Resource GroupContains
fooj-{env}-network-rgVNet, subnets, NAT Gateway
fooj-{env}-containers-rgACA environment, container apps
fooj-{env}-storage-rgStorage accounts, CDN
fooj-{env}-shared-rgACR, Key Vault, shared resources

Environments: stg (staging), prod (production).

Networking Architecture ​

Shared VNet Egress ​

The NAT Gateway IP 20.26.0.39 is shared with ERP stage and production environments. This means:

  • Fooj outbound traffic appears as 20.26.0.39 to external services
  • ERP stage and production outbound traffic also appears as 20.26.0.39
  • Any external IP allowlist (e.g., payment gateway, ZATCA sandbox) must include this single IP for all three environments

Egress IP is shared

If a third-party service only allows a single IP, adding 20.26.0.39 covers Fooj staging, Fooj production, ERP staging, and ERP production simultaneously. Confirm with the third-party vendor that this is acceptable before configuring their allowlist.

Azure Container Apps Configuration ​

ACA Environment ​

Each environment has one ACA environment:

PropertyStagingProduction
Namefooj-stg-caefooj-prod-cae
Resource Groupfooj-stg-containers-rgfooj-prod-containers-rg
VNet integrationfooj-stg-vnet/aca-subnetfooj-prod-vnet/aca-subnet
Internal onlyNo (public ingress)No (public ingress)
Zone redundancyNoYes

Container Apps ​

App NamePurposeMin ReplicasMax Replicas
fooj-ssrAngular 18 SSR (Node.js)110
fooj-apiBackend API110

Ingress ​

Fooj container apps use external ingress — they are publicly reachable via the ACA environment's ingress controller. TLS termination happens at the ACA ingress level using Azure-managed certificates.

Container Registry ​

Fooj uses a dedicated ACR in the shared resource group:

PropertyStagingProduction
ACR Namefoojstgacrfoojprodacr
SKUStandardPremium (geo-replication)
AuthUser-assigned managed identityUser-assigned managed identity

Pull authentication uses the same managed-identity pattern as ERP:

bicep
resource acaPullRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(acr.id, containerApp.id, 'acrpull')
  scope: acr
  properties: {
    roleDefinitionId: subscriptionResourceId(
      'Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')
    principalId: containerApp.identity.principalId
    principalType: 'ServicePrincipal'
  }
}

Key Vault ​

Each environment has a dedicated Key Vault:

PropertyStagingProduction
Namefooj-stg-kvfooj-prod-kv
Resource Groupfooj-stg-shared-rgfooj-prod-shared-rg
Access modelRBACRBAC

Container apps reference secrets using keyvaultref: in environment variables — the same pattern as ERP.

Bicep Infrastructure ​

Fooj infrastructure is defined in Bicep under Devops/azure/fooj/:

Devops/azure/fooj/
├── main.bicep              ← Subscription-scoped entry point
├── modules/
│   ├── network.bicep       ← VNet, subnets, NAT GW
│   ├── containerApps.bicep ← ACA environment + apps
│   ├── acr.bicep           ← Container registry
│   └── keyVault.bicep      ← Key Vault + RBAC
└── parameters/
    ├── stg.bicepparam
    └── prod.bicepparam

Deploy:

bash
az deployment sub create \
  --location uksouth \
  --template-file Devops/azure/fooj/main.bicep \
  --parameters Devops/azure/fooj/parameters/stg.bicepparam

Cost Considerations ​

The shared NAT Gateway was chosen to reduce egress costs. A dedicated NAT GW per environment costs approximately £25–30/month per gateway. By sharing a single gateway across Fooj staging, Fooj production, ERP staging, and ERP production, three gateway instances are avoided.

The trade-off is operational coupling: if the shared NAT GW has a fault, all four environments lose deterministic egress. Mitigated by Azure's 99.99% SLA on NAT Gateway.

Internal Documentation — Microtec Platform Team