Azure VM Deployment Guide

# Set variables
RESOURCE_GROUP="rg-mop-platform"
VM_NAME="vm-mop-platform"
LOCATION="eastus2"
VNET_NAME="vnet-hub"
SUBNET_NAME="snet-mop-platform"
IMAGE="RedHat:RHEL:9-lvm-gen2:latest"

# Create resource group (if needed)
az group create --name $RESOURCE_GROUP --location $LOCATION

# Create subnet in the Hub VNet (coordinate with network team)
az network vnet subnet create \
    --resource-group $RESOURCE_GROUP \
    --vnet-name $VNET_NAME \
    --name $SUBNET_NAME \
    --address-prefix 10.0.10.0/24

# Create the VM
az vm create \
    --resource-group $RESOURCE_GROUP \
    --name $VM_NAME \
    --image $IMAGE \
    --size Standard_D2s_v3 \
    --vnet-name $VNET_NAME \
    --subnet $SUBNET_NAME \
    --admin-username azureuser \
    --ssh-key-values ~/.ssh/id_rsa.pub \
    --os-disk-size-gb 64 \
    --public-ip-address "" \
    --nsg ""

# Note: No public IP assigned - access via VPN/Bastion/jumpbox

# From the MOP Platform VM, verify connectivity to each spoke
# Replace with actual target host IPs in each region

# Test SSH connectivity to regional targets
ssh -o ConnectTimeout=5 azureuser@10.1.0.10 hostname   # eus2
ssh -o ConnectTimeout=5 azureuser@10.2.0.10 hostname   # wus2
ssh -o ConnectTimeout=5 azureuser@10.3.0.10 hostname   # wus3
ssh -o ConnectTimeout=5 azureuser@10.4.0.10 hostname   # scus
ssh -o ConnectTimeout=5 azureuser@10.5.0.10 hostname   # eus2lea
ssh -o ConnectTimeout=5 azureuser@10.6.0.10 hostname   # wus2lea

# Update system packages
sudo dnf update -y

# Enable EPEL repository (for extra packages)
sudo dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm

# Install required system packages
sudo dnf install -y \
    python3.11 \
    python3.11-pip \
    python3.11-devel \
    git \
    nginx \
    ansible-core \
    sshpass \
    jq \
    cifs-utils \
    nfs-utils \
    unzip \
    tar \
    openssl

# Set Python 3.11 as default (if not already)
sudo alternatives --set python3 /usr/bin/python3.11

# Verify Python version (3.11+ required)
python3 --version

# Verify Ansible is installed
ansible --version

# Enable and start firewalld (RHEL default firewall)
sudo systemctl enable --now firewalld

# Set SELinux to allow Nginx to proxy to backend ports
sudo setsebool -P httpd_can_network_connect 1

# Create application user (optional, recommended for production)
sudo useradd -m -s /bin/bash mopuser
sudo usermod -aG wheel mopuser

# Clone or copy the application to the server
cd /opt
sudo mkdir mop-platform
sudo chown azureuser:azureuser mop-platform
cd mop-platform

# Option 1: Clone from git repository
git clone <your-repo-url> .

# Option 2: SCP the files from your workstation
# scp -r ./mop-platform/* azureuser@<vm-ip>:/opt/mop-platform/

# Create Python virtual environment
python3 -m venv venv
source venv/bin/activate

# Install Python dependencies
pip install --upgrade pip
pip install flask flask-sqlalchemy gunicorn pyyaml jinja2 requests \
    psycopg2-binary email-validator
# Or if a requirements.txt or pyproject.toml is provided:
# pip install -r requirements.txt
# pip install .

# Create required directories
mkdir -p logs vars playbooks uploads/gz mops rendered prerendered configs archive

# Generate a secret key and save it
SECRET_KEY=$(python3 -c "import secrets; print(secrets.token_hex(32))")
echo "SESSION_SECRET=\"${SECRET_KEY}\"" | sudo tee -a /etc/environment

# Load into current session
export SESSION_SECRET="${SECRET_KEY}"

# Test the application starts (Flask backend on port 5000)
gunicorn --bind 127.0.0.1:5000 --workers 3 main:app
# Press Ctrl+C to stop after verifying

# Note: Next.js frontend runs on port 3000
# Nginx reverse-proxies both: /api/* → 5000, / → 3000

# Generate SSH key for Ansible (if not using existing key)
ssh-keygen -t rsa -b 4096 -f ~/.ssh/azure_rsa -N "" -C "mop-platform-ansible"

# Distribute the public key to all target hosts in each region
# This must be done for every host Ansible will manage
for HOST in 10.1.0.10 10.2.0.10 10.3.0.10 10.4.0.10 10.5.0.10 10.6.0.10; do
    ssh-copy-id -i ~/.ssh/azure_rsa.pub azureuser@$HOST
done

# Test passwordless SSH
ansible all -i inventory/azure_regions.yml -m ping

# Create /opt/mop-platform/ansible.cfg
cat <<'EOF' > /opt/mop-platform/ansible.cfg
[defaults]
inventory = inventory/azure_regions.yml
remote_user = azureuser
private_key_file = ~/.ssh/azure_rsa
host_key_checking = False
timeout = 300
forks = 5
stdout_callback = json
retry_files_enabled = False
log_path = logs/ansible/ansible.log

[privilege_escalation]
become = True
become_method = sudo

[ssh_connection]
pipelining = True
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no
EOF

# Create inventory/azure_regions.yml
# Update host IPs and connection details for your environment
cat <<'EOF' > inventory/azure_regions.yml
all:
  children:
    eus2:
      hosts:
        eus2-host-01:
          ansible_host: 10.1.0.10
        eus2-host-02:
          ansible_host: 10.1.0.11
      vars:
        azure_region: eastus2
        ado_org: eus2

    wus2:
      hosts:
        wus2-host-01:
          ansible_host: 10.2.0.10
      vars:
        azure_region: westus2
        ado_org: wus2

    wus3:
      hosts:
        wus3-host-01:
          ansible_host: 10.3.0.10
      vars:
        azure_region: westus3
        ado_org: wus3

    scus:
      hosts:
        scus-host-01:
          ansible_host: 10.4.0.10
      vars:
        azure_region: southcentralus
        ado_org: scus

    eus2lea:
      hosts:
        eus2lea-host-01:
          ansible_host: 10.5.0.10
      vars:
        azure_region: eastus2
        ado_org: eus2lea
        is_lea: true

    wus2lea:
      hosts:
        wus2lea-host-01:
          ansible_host: 10.6.0.10
      vars:
        azure_region: westus2
        ado_org: wus2lea
        is_lea: true
EOF

# Create the mount point directory
sudo mkdir -p /mnt/mopsets

# Create credentials file for Azure Files
sudo mkdir -p /etc/smbcredentials
cat <<EOF | sudo tee /etc/smbcredentials/mopfiles.cred
username=<storage-account-name>
password=<storage-account-key>
EOF
sudo chmod 600 /etc/smbcredentials/mopfiles.cred

# Add to /etc/fstab for persistent mount
echo "//<storage-account>.file.core.windows.net/<share-name> /mnt/mopsets cifs nofail,credentials=/etc/smbcredentials/mopfiles.cred,dir_mode=0777,file_mode=0777,serverino,nosharesock,actimeo=30" | sudo tee -a /etc/fstab

# Mount immediately
sudo mount -a

# Verify mount
df -h /mnt/mopsets
ls -la /mnt/mopsets

# Create mount point
sudo mkdir -p /mnt/mopsets

# Add NFS mount to fstab
echo "<nfs-server-ip>:/exported/path /mnt/mopsets nfs defaults,nofail 0 0" | sudo tee -a /etc/fstab

# Mount
sudo mount -a
df -h /mnt/mopsets

# Create the systemd service file
sudo cat <<'EOF' > /etc/systemd/system/mop-platform.service
[Unit]
Description=MOP Automation Platform
After=network.target
Wants=network-online.target

[Service]
Type=exec
User=azureuser
Group=azureuser
WorkingDirectory=/opt/mop-platform
Environment="PATH=/opt/mop-platform/venv/bin:/usr/local/bin:/usr/bin:/bin"
Environment="SESSION_SECRET=<your-generated-secret-key>"
ExecStart=/opt/mop-platform/venv/bin/gunicorn \
    --bind 127.0.0.1:5000 \
    --workers 3 \
    --timeout 300 \
    --access-logfile logs/access.log \
    --error-logfile logs/error.log \
    --capture-output \
    main:app
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

# Reload systemd, enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable mop-platform
sudo systemctl start mop-platform

# Check status
sudo systemctl status mop-platform

# View logs
sudo journalctl -u mop-platform -f

# RHEL 9 uses /etc/nginx/conf.d/ (not sites-available)
# Remove the default config if present
sudo rm -f /etc/nginx/conf.d/default.conf

# Create Nginx site configuration
sudo cat <<'EOF' > /etc/nginx/conf.d/mop-platform.conf
upstream frontend {
    server 127.0.0.1:3000;
}

upstream backend {
    server 127.0.0.1:5000;
}

server {
    listen 80;
    server_name mop-platform.internal.yourcompany.com;

    # Redirect HTTP to HTTPS (uncomment when SSL is configured)
    # return 301 https://$server_name$request_uri;

    # Support large GZ file uploads
    client_max_body_size 500M;

    # Next.js frontend routes (port 3000)
    # Add specific Next.js page paths here as the frontend grows
    location /_next/ {
        proxy_pass http://frontend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /nextjs/ {
        proxy_pass http://frontend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Static files served directly by Nginx
    location /static {
        alias /opt/mop-platform/static;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # Flask backend - catch-all (port 5000)
    # All routes go to Flask by default: /admin, /mops, /logs,
    # /execute, /api, /releases, /scheduler, /deployment-guide, etc.
    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 300;
        proxy_connect_timeout 300;
        proxy_send_timeout 300;
    }
}
EOF

# Test nginx configuration
sudo nginx -t

# Enable and restart nginx
sudo systemctl enable --now nginx
sudo systemctl restart nginx

# Place your certificate files
sudo mkdir -p /etc/nginx/ssl
sudo cp your-cert.pem /etc/nginx/ssl/mop-platform.crt
sudo cp your-key.pem /etc/nginx/ssl/mop-platform.key
sudo chmod 600 /etc/nginx/ssl/mop-platform.key

# Update Nginx config - add SSL server block
# Edit /etc/nginx/conf.d/mop-platform.conf
# Replace the listen 80 server block with:
sudo cat <<'EOF' > /etc/nginx/conf.d/mop-platform-ssl.conf
server {
    listen 80;
    server_name mop-platform.internal.yourcompany.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name mop-platform.internal.yourcompany.com;

    ssl_certificate /etc/nginx/ssl/mop-platform.crt;
    ssl_certificate_key /etc/nginx/ssl/mop-platform.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    client_max_body_size 500M;

    # Next.js frontend routes (port 3000)
    location /_next/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /nextjs/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /static {
        alias /opt/mop-platform/static;
        expires 7d;
    }

    # Flask backend - catch-all (port 5000)
    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 300;
    }
}
EOF

# Remove the HTTP-only config if using SSL
sudo rm -f /etc/nginx/conf.d/mop-platform.conf
sudo nginx -t && sudo systemctl reload nginx

# Regular OS updates (schedule monthly)
sudo dnf update -y

# Rotate the SESSION_SECRET periodically
export NEW_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(32))")
# Update in /etc/systemd/system/mop-platform.service
sudo systemctl daemon-reload && sudo systemctl restart mop-platform

# Rotate SSH keys annually
ssh-keygen -t rsa -b 4096 -f ~/.ssh/azure_rsa_new -N ""
# Distribute new key to all target hosts, then remove old key

# Review Ansible Vault passwords
# Rotate Azure DevOps PAT tokens before expiry