Deployment Overview
All services deploy via Azure DevOps pipelines. Backends run as Docker containers on Azure Container Apps; frontends and static sites deploy to Cloudflare Pages.
Deployment targets at a glance
Section titled “Deployment targets at a glance”| Service | CI trigger | Deploy target | Notes |
|---|---|---|---|
| Cloud Backend | Push to Backend/ | Azure Container Apps (cloud + worker) | Docker → ACR → ACA |
| Cloud Frontend | Push to Frontend/ | Cloudflare Pages | Vite build artifact |
| Management Backend | Push to Management/management-backend/ | Azure Container Apps | Docker → ACR → ACA |
| Management Frontend | Push to Management/management-frontend/ | Cloudflare Pages | Vite build artifact |
| Ingestor | Push to ingestor/ | Azure Container Apps | Docker → ACR → ACA |
| Marketing Website | Push to Website/ | Cloudflare Pages | Astro build |
| Contact Form API | Push to WebsiteContactApi/ | Cloudflare Workers | Wrangler deploy |
| Internal Docs | Push to Internal-Documentation/ | Cloudflare Pages | Astro build |
Deploy order for a new environment
Section titled “Deploy order for a new environment”When setting up a fresh environment (dev/staging/prod), deploy in this order:
- Provision Azure infrastructure — SQL Server, Container Apps, Key Vaults, ACR, ACS Email (see Azure Infrastructure)
- DNS — Cloudflare app hostnames (
setup_cloudflare_dns.py) and ACS email domain verification (setup_acs_email_dns.py) - Write shared secrets to both
kv-mz-cloud-*andkv-mz-manage-* - Run Flyway migrations on both Cloud and Management databases
- Deploy Management Backend and Cloud Backend simultaneously (shared secrets must be in KV first)
- Deploy frontends (Cloud SPA, Management SPA)
- Smoke test: Create a tenant in Management → activate license → log in to Cloud SPA