# Section 1 — Artifact metadata
meta:
  version: "v1"
  source: https://superpowers.frontis.nl/conventions/azure-conventions.yaml
  snapshotDate: 2026-05-21

# Section 2 — Paths to authoritative external files
external_references:
  naming_convention: "https://superpowers.frontis.nl/conventions/naming-convention.yaml"
  project_context: "https://superpowers.frontis.nl/conventions/project-context.yaml"

# Section 3 — Defaults that apply across all resource types
global_defaults:
  location: "germanywestcentral"
  constraint_violation_strategy: "error_reject"
  tags:
    project:
      required: true
      value_source: "computed"
      expression: "{company}.{product}.{component}"
      description: "Canonical project name from project-context tokens"
    environment:
      required: true
      value_source: "project_context_token"
      token: "environment"
      description: "Environment abbreviation from project-context"
    team:
      required: true
      value_source: "project_context_token"
      token: "team"
      description: "Team abbreviation from project-context"
    customer:
      required: true
      value_source: "project_context_token"
      token: "company"
      description: "Company/customer name from project-context"

# Section 4 — OTAP environment definitions
environments:
  dev:
    azure_deployed: false
    description: "Local development only — no Azure resources"
  test:
    azure_deployed: true
    tier: "nonprod"
    description: "Test environment"
  acc:
    azure_deployed: true
    tier: "nonprod"
    description: "Acceptance environment"
  prod:
    azure_deployed: true
    tier: "prod"
    description: "Production environment"

# Section 5 — Tier groupings (nonprod, prod)
environment_tiers:
  nonprod:
    environments: ["test", "acc"]
  prod:
    environments: ["prod"]

# Section 6 — Well-known shared resource identifiers
shared_infrastructure:
  reference_name: "azshared01-2024"
  description: "Well-known identifier for pre-existing shared Azure resources"

# Section 7 — Per-resource-type conventions (main content)
resource_types:
  resource_group:
    display_name: "Resource Group"
    azure_resource_provider: "Microsoft.Resources/resourcegroups"
    naming:
      pattern: "rg-{company}-{product}-{component}-{environment}"
      description: "Resource group name following naming convention"
      azure_constraints:
        min_length: 1
        max_length: 90
        allowed_characters: "^[\\w\\-\\.\\(\\)]+$"
        globally_unique: false
        scope: "subscription"
        additional_restrictions:
          - "Cannot end with a period"
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "create"
    defaults:
      global:
        location: "germanywestcentral"

  storage_account:
    display_name: "Storage Account"
    azure_resource_provider: "Microsoft.Storage/storageAccounts"
    naming:
      pattern: "st{company}{product}{component}{environment}"
      description: "Storage account name — lowercase+numbers only, no hyphens or special chars"
      azure_constraints:
        min_length: 3
        max_length: 24
        allowed_characters: "^[a-z0-9]+$"
        globally_unique: true
        scope: "global"
        additional_restrictions:
          - "No hyphens, underscores, or uppercase letters"
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "create"
    defaults:
      global:
        kind: "StorageV2"
        replication: "LRS"
        access_tier: "Hot"

  blob_container:
    display_name: "Blob Container"
    azure_resource_provider: "Microsoft.Storage/storageAccounts/blobServices/containers"
    naming:
      pattern: "{container_name}"
      description: "Blob container name — lowercase+numbers+hyphens, no consecutive hyphens"
      azure_constraints:
        min_length: 3
        max_length: 63
        allowed_characters: "^[a-z0-9][a-z0-9\\-]*[a-z0-9]$"
        globally_unique: false
        scope: "parent"
        additional_restrictions:
          - "Cannot use consecutive hyphens"
          - "Must start with a lowercase letter or number"
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "create"
    defaults:
      global: {}

  log_analytics_workspace:
    display_name: "Log Analytics Workspace"
    azure_resource_provider: "Microsoft.OperationalInsights/workspaces"
    naming:
      pattern: "log-{company}-{product}-{component}-{environment}"
      description: "Log Analytics workspace name — alphanumerics+hyphens, start/end alphanumeric"
      azure_constraints:
        min_length: 4
        max_length: 63
        allowed_characters: "^[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9]$"
        globally_unique: false
        scope: "resource_group"
        additional_restrictions:
          - "Must start and end with an alphanumeric character"
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "create"
    defaults:
      global:
        retention_days: 30

  application_insights:
    display_name: "Application Insights"
    azure_resource_provider: "Microsoft.Insights/components"
    naming:
      pattern: "appi-{company}-{product}-{component}-{environment}"
      description: "Application Insights name — permissive naming rules"
      azure_constraints:
        min_length: 1
        max_length: 260
        allowed_characters: "^[^%&\\\\\\?/]*$"
        globally_unique: false
        scope: "resource_group"
        additional_restrictions:
          - "Cannot end with a space or period"
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "create"
    defaults:
      global:
        application_type: "web"

  app_service:
    display_name: "App Service"
    azure_resource_provider: "Microsoft.Web/sites"
    naming:
      pattern: "app-{company}-{product}-{component}-{environment}"
      description: "App Service name — globally unique via .azurewebsites.net"
      azure_constraints:
        min_length: 2
        max_length: 60
        allowed_characters: "^[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9]$"
        globally_unique: true
        scope: "global"
        additional_restrictions:
          - "Cannot start or end with a hyphen"
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "create"
    defaults:
      global:
        kind: "app,linux"
    deployment_slots:
      enabled_environments: ["prod"]
      slot_names: ["preproduction"]
      hosting_models: ["dedicated"]

  app_service_plan:
    display_name: "App Service Plan"
    azure_resource_provider: "Microsoft.Web/serverfarms"
    naming:
      pattern: "plan-{company}-{product}-{component}-{environment}"
      description: "App Service Plan name"
      azure_constraints:
        min_length: 1
        max_length: 60
        allowed_characters: "^[a-zA-Z0-9\\-]+$"
        globally_unique: false
        scope: "resource_group"
        additional_restrictions: []
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "reference_existing"
        reference_name_source: "shared_infrastructure"
    defaults:
      global: {}
      environments:
        test:
          tier: "Basic"
          sku: "B1"
        acc:
          tier: "Basic"
          sku: "B1"
        prod:
          tier: "Premium0V3"
          sku: "P0V3"

  sql_server:
    display_name: "SQL Server"
    azure_resource_provider: "Microsoft.Sql/servers"
    naming:
      pattern: "sql-{company}-{product}-{component}-{environment}"
      description: "Azure SQL logical server name — globally unique via .database.windows.net"
      azure_constraints:
        min_length: 1
        max_length: 63
        allowed_characters: "^[a-z0-9][a-z0-9\\-]*[a-z0-9]$"
        globally_unique: true
        scope: "global"
        additional_restrictions:
          - "Cannot start or end with a hyphen"
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "reference_existing"
        reference_name_source: "shared_infrastructure"
    defaults:
      global:
        ad_admin_group_pattern: "sg-sql-{company}-{product}-{env_tier}"
      environments:
        test:
          ad_admin_group_tier: "nonprod"
        acc:
          ad_admin_group_tier: "nonprod"
        prod:
          ad_admin_group_tier: "prod"

  sql_database:
    display_name: "SQL Database"
    azure_resource_provider: "Microsoft.Sql/servers/databases"
    naming:
      pattern: "sqldb-{company}-{product}-{component}-{environment}"
      description: "Azure SQL Database name"
      azure_constraints:
        min_length: 1
        max_length: 128
        allowed_characters: "^[^<>*%&:\\\\\\?/]*$"
        globally_unique: false
        scope: "parent"
        additional_restrictions:
          - "Cannot end with a period or space"
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "create"
    defaults:
      global: {}
      environments:
        test:
          tier: "Standard"
          sku: "S0"
        acc:
          tier: "Standard"
          sku: "S0"
        prod:
          tier: "Standard"
          sku: "S2"
      hosting_overrides:
        shared:
          environments:
            prod:
              tier: "Standard"
              sku: "S0"

  sql_firewall_rule:
    display_name: "SQL Firewall Rule"
    azure_resource_provider: "Microsoft.Sql/servers/firewallRules"
    naming:
      pattern: "sqlfw-{company}-{product}-{component}-{environment}-{rule_name}"
      description: "SQL Server firewall rule name"
      azure_constraints:
        min_length: 1
        max_length: 128
        allowed_characters: "^[^<>*%&:;\\\\\\?/]*$"
        globally_unique: false
        scope: "parent"
        additional_restrictions:
          - "Cannot end with a period"
    hosting:
      dedicated:
        provisioning: "create"
      shared:
        provisioning: "create"
    defaults:
      global: {}

# Section 8 — Five-tier resolution order
precedence:
  - tier: 1
    name: "azure_platform_constraints"
    description: "Character limits, uniqueness, casing restrictions from Azure platform"
  - tier: 2
    name: "explicit_exceptions"
    description: "Documented deviations from general rules"
  - tier: 3
    name: "environment_overrides"
    description: "Per-environment value overrides (e.g., SKU per environment)"
  - tier: 4
    name: "hosting_type_defaults"
    description: "Dedicated or shared hosting defaults"
  - tier: 5
    name: "global_defaults"
    description: "Fallback values when no higher-tier rule applies"

# Section 9 — Documented deviations from rules
exceptions: []

# Section 10 — Explicit exclusions
out_of_scope:
  - category: "Key Vaults"
    description: "Not governed by this convention file"
  - category: "Virtual Networks"
    description: "Not governed by this convention file"
  - category: "Front Doors"
    description: "Not governed by this convention file"
  - category: "Container Registries"
    description: "Not governed by this convention file"
  - category: "Deployment Pipelines"
    description: "Pipeline content and stages are not in scope"
  - category: "Build Pipeline Generation"
    description: "This file must not be used for build/release pipeline guidance"
