az_create_resources

• Azure CLI installed, and authenticated (az login) as an identity that can create resources and assign roles — the script grants each web app AcrPull on the registry.
• Either psql (the PostgreSQL command-line client) on your PATH, or Python with the psycopg package installed — used to load sql/metals-db.sql into the new database.
• The Microsoft.ContainerRegistry resource provider registered on the subscription. If it isn't, registry creation fails with MissingSubscriptionRegistration — see Common errors.
• Docker is not required — this script creates infrastructure and never builds an image.

if (-not $ClientIp) {
    $ClientIp = ([string](Invoke-RestMethod -Uri 'https://api4.ipify.org' -TimeoutSec 15)).Trim()
}

Calls a public “what's my IP” service so the script knows which address to open the database firewall for later. The same idea as the client_ip variable in Terraform — pass -ClientIp explicitly if you're behind a VPN or proxy with a different egress address.

az group create --name $resourceGroup --location $Location

The same purpose as main.tf's azurerm_resource_group — the container every other resource below gets placed into.

az postgres flexible-server create `
    --resource-group $resourceGroup `
    --name $dbServer `
    --location $Location `
    --admin-user metalsadmin `
    --admin-password $dbPassword `
    --tier Burstable `
    --sku-name Standard_B1ms `
    --storage-size 32 `
    --storage-auto-grow Disabled `
    --backup-retention 7 `
    --geo-redundant-backup Disabled `
    --version 16 `
    --public-access 0.0.0.0 `
    --tags Environment=Development

az postgres flexible-server db create `
    --resource-group $resourceGroup --server-name $dbServer --name metals

Every flag here has a direct match in database.tf's azurerm_postgresql_flexible_server resource — same Burstable tier, same 32 GB storage, same PostgreSQL version 16, same 0.0.0.0 special-case meaning “allow Azure services.” Reading these two forms side by side is one of the fastest ways to see what Terraform is actually doing underneath its declarative syntax.

$dbPassword is the value you were prompted for, converted from the SecureString only at the moment it's needed.

az postgres flexible-server firewall-rule create `
    --resource-group $resourceGroup --server-name $dbServer `
    --name "LocalClient-$($ClientIp.Replace('.', '-'))" `
    --start-ip-address $ClientIp --end-ip-address $ClientIp

The manual equivalent of database.tf's local_client firewall rule — without it, the next step (loading data from your own machine) can't reach the server at all.

First it counts the existing tables. If any are found it prints Existing database tables found; preserving schema and data and skips loading entirely — so rerunning the script can't wipe a database you've been using. On an empty database it runs sql/metals-db.sql, using psql if available or a small inline Python script with psycopg if not.

This step has no Terraform equivalent — Terraform only creates the empty database; loading starting data is handled separately by terraform/scripts/initialize_database.py.

az acr create --name $RegistryName --resource-group $resourceGroup `
    --location $Location --sku Basic --admin-enabled false `
    --role-assignment-mode rbac

Creates the private registry every image will be pushed to. Two details matter: --admin-enabled false disables the registry's built-in username/password account entirely, and --role-assignment-mode rbac selects classic role-based access so the AcrPull grant in the next step behaves as expected.

Registry names are globally unique across all of Azure and may contain only letters and digits — hence the generated expeditors<user>metalsacr form, with hyphens stripped. Pass -RegistryName if the generated one is taken.

az appservice plan create --name $planName --resource-group $resourceGroup `
    --sku B1 --is-linux --location $Location

# ...then, for each of the API, the UI, and the tutorial site:
az webapp create --name $name --resource-group $resourceGroup `
    --plan $planName --container-image-name $image `
    --assign-identity '[system]' --acr-use-identity --acr-identity '[system]'

All three apps share the single B1 plan — App Service bills per plan instance, not per app, so the UI and tutorial site cost nothing extra to host. Each app gets a system-assigned managed identity (--assign-identity '[system]') and is told to use that identity when pulling from the registry, which is why no registry credentials are ever stored.

The image doesn't exist yet at this point, and that's fine — the app is created, just not serving until az_deploy builds and pushes one.

$principalId = az webapp identity assign --name $name `
    --resource-group $resourceGroup --query principalId --output tsv

az role assignment create --assignee-object-id $principalId `
    --assignee-principal-type ServicePrincipal --scope $registry.id `
    --role AcrPull

An identity with no roles can't do anything. AcrPull, scoped to this one registry, is the minimum needed to download image layers — the app can't push, delete, or read anything else. Matching Terraform resources are the api_acr_pull and ui_acr_pull assignments in app_service.tf.

az webapp config container set --name $name --resource-group $resourceGroup `
    --container-image-name $image `
    --container-registry-url "https://$($registry.loginServer)"

# generic-configurations, as JSON:
#   acrUseManagedIdentityCreds = true
#   appCommandLine  = ''          # use the image's own CMD
#   alwaysOn        = true
#   healthCheckPath = '/health'

az webapp update --name $name --resource-group $resourceGroup --https-only true

appCommandLine = '' is deliberate: it clears any startup command so the image's own CMD runs — Gunicorn for the API, Nginx for the UI. healthCheckPath points Azure's probe at the same /health endpoint the containers use themselves, and https-only redirects plain HTTP.

-SkipProvisioning skips creating the resource group, PostgreSQL server, and database — the three things that fail loudly if they already exist. Everything after that still runs: the firewall rule, the registry, the plan, both web apps, all role assignments, and every application setting.

Supply the existing administrator password when prompted. The switch does not reset it, and the API's DB_PASSWORD setting is written from whatever you type.

Resuming still rewrites configuration and re-applies role assignments. To merely inspect a deployment without changing it, use the read-only az ... show and list commands in utility_scripts/README.md instead. For routine code updates, use az_deploy — not this script.