Deploying my blog with Hugo

# Connect to tenant
Connect-AzAccount -Tenant "xxxx-xxxx-xxxx-xxxx-xxxx"

# Set some variables
$location = "<deplomentregion>"
$rgName = "<rgname>"
$storageName = "<saname>" # Must be globally unique

# Create the resource Group
New-AzResourceGroup -Name $rgName -Location $location

# Create the storage account
$storage = New-AzStorageAccount -ResourceGroupName $rgName -Name $storageName -SkuName "Standard_LRS" -Location $location -AllowBlobPublicAccess $false -MinimumTlsVersion TLS1_2

# Create the blob storage container
New-AzStorageContainer -Name "tfstate-blog" -Context $storage.Context

# Create the service principal
$app = New-AzADApplication -DisplayName "sp-github-actions-mgmt"
Start-Sleep -Seconds 10
$sp = New-AzADServicePrincipal -ApplicationId $app.AppId

# Grant roles
$subId = (Get-AzContext).Subscription.Id
New-AzRoleAssignment -ApplicationId $app.AppId -RoleDefinitionName "Contributor" -Scope "/subscriptions/$subId"

# Create the OIDC Trust
$fedParams = @{
    Name = "github-actions-blog"
    Issuer = "https://token.actions.githubusercontent.com"
    Subject = "repo:<githubusername>/<githubreponame>:ref:refs/heads/main"
    Description = "OIDC trust for Blog deployment"
    Audience = @("api://AzureADTokenExchange")
}
New-AzADAppFederatedCredential -ApplicationObjectId $app.Id @fedParams

# Output the vars for GitHub secrets
Write-Host "AZURE_CLIENT_ID       : $($app.AppId)"
Write-Host "AZURE_TENANT_ID       : $((Get-AzContext).Tenant.Id)"
Write-Host "AZURE_SUBSCRIPTION_ID : $subId"

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
  backend "azurerm" {
    resource_group_name  = "<rgname>"
    storage_account_name = "<saname>" # Must match Phase 1
    container_name       = "tfstate-blog"
    key                  = "prod.terraform.tfstate"
    use_oidc             = true
  }
}

provider "azurerm" {
  features {}
  use_oidc = true
}

resource "azurerm_resource_group" "blog" {
  name     = "rg-securityblog-prod"
  location = "westeurope"
}

resource "azurerm_static_web_app" "blog_app" {
  name                = "swa-benstalker-tech"
  resource_group_name = azurerm_resource_group.blog.name
  location            = azurerm_resource_group.blog.location
  sku_tier            = "Free"
  sku_size            = "Free"
}

# We output the deployment token so GitHub Actions can use it to push the Hugo site
output "swa_api_key" {
  value     = azurerm_static_web_app.blog_app.api_key
  sensitive = true
}

name: Deploy Infra and Blog

on:
  push:
    branches: ["main"]

# REQUIRED for OIDC Authentication
permissions:
  id-token: write
  contents: read

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0

      - name: Azure Login via OIDC
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Terraform Init & Apply
        id: tf
        working-directory: ./terraform
        run: |
          terraform init
          terraform apply -auto-approve
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_USE_OIDC: true

      - name: Get SWA Deployment Token
        id: get_token
        working-directory: ./terraform
        run: |
          SWA_TOKEN=$(terraform output -raw swa_api_key)
          echo "::add-mask::$SWA_TOKEN"
          echo "swa_token=$SWA_TOKEN" >> $GITHUB_OUTPUT

      - name: Build and Deploy Hugo to Azure Static Web Apps
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ steps.get_token.outputs.swa_token }}
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          action: "upload"
          app_location: "/" 
          output_location: "public"

# Adding CNAME record to static web app
resource "azurerm_static_web_app_custom_domain" "www_domain" {
  static_web_app_id = azurerm_static_web_app.blog_app.id
  domain_name       = "www.benstalker.co.uk"
  validation_type   = "cname-delegation"
}