Series · 16 parts
One Shop, Every Shape
DevMentors built the same e-commerce shop twice - once as a monolith, once as nine services - with two gateways and two frontends. This series reads the whole estate as one artefact.
Topic
Azure & DevOps
77 articles filed under this topic.
Series in Azure & DevOps
Series · 15 parts
Terraform Module Catalog
Opening the Terraform Module Catalog with the library's flagship: how an App Service module bundles VNet integration, dual managed identities and Key Vault TLS into a surface app teams can fill in but not opt out of.
Series · 12 parts
Terraform on Azure
The conventions that let one Terraform sample library serve hundreds of Azure deployments - a five-file layout, workspace-indexed environments, pinned golden modules and pipeline-first delivery. Part 1 of a series on Terraform for the Azure estate.
Series · 18 parts
The Database Is the Message Bus
Five executables, zero queues - how an attendance platform coordinated a web app, three Azure Functions and a console job through one SQL database, and what that choice bought and cost. Part 1 of the series.
Series · 15 parts
Two Gateways and a Nervous System
Thirteen repositories, one umbrella that runs twelve of them, two interchangeable API gateways and a service that watches everything - the Pacco estate read as a system of systems, and the fifteen-part series it earns.
Standalone articles
Deploying ASP.NET Core to Azure App Service with GitHub Actions
A practical walkthrough of the pipeline that ships this very website: from push to production on Azure App Service, with secrets kept out of the repository and zero manual steps.
APIM API Provisioning: Governance as Code, One for_each at a Time
The catalog's finale: three child modules fanned out over locals maps turn AAD groups, APIM products and OpenAPI-imported APIs into reviewable code, map keys double as URL routing taxonomy, and policy XML gets environment-templated by a blunt string replace - plus a retrospective on what fifteen modules taught. Part 15 of the Terraform Module Catalog.
Private DNS: Anatomy of a Half-Finished Template
The catalog's cautionary tale: an empty variables.tf, no platform JSON, UPDATE placeholders for every value, one pvars file for four declared workspaces, a subscription ID hardcoded into the provider, and a pipeline with a leftover debug step - what shipping a half-finished golden template does to the two hundred copies made from it, and a checklist for done. Part 14 of the Terraform Module Catalog.
DNS Zone: One Module, Many Optional Shapes
The public DNS template exposes every record type - A, AAAA, CAA, CNAME, MX, PTR, SRV, TXT - as an optional object list on a single module, and its twelve-kilobyte README quietly becomes the reference manual. When one module with optional shapes beats fifteen micro-modules, and when it stops being true. Part 13 of the Terraform Module Catalog.
Front Door: Edge TLS, WAF Links and Two Instructive Defects
The classic Front Door template does global entry properly - custom domains behind WAF policies, Key Vault TLS, HTTP-to-HTTPS redirect rules - and then teaches by counterexample: a hardcoded ARM resource ID where a lookup map should be, and a missing environment key silently swallowed by a forgiving default. Part 12 of the Terraform Module Catalog.
Application Gateway: When Every Input Is a List of Objects
Inside the module with the biggest surface in the catalog: listener, pool, settings and probe objects cross-referenced by name, Key Vault TLS through a user-assigned identity, a private-by-default frontend - and a deliberately invalid placeholder IP that turns an unfilled template into a loud failure. Part 11 of the Terraform Module Catalog.
What Two Hundred Copies Teach You
The honest retrospective that closes the series - how template scaffolding metastasizes mistakes, why version pinning without governance curates a museum, what secrets in locals really cost, and the upgrade list I would run on this estate today. Part 12 of the Terraform on Azure series.
The AKS Module: The Wrapper That Broke the Conventions
The catalog's most divergent template - a different module-source depth, extra pipeline-fed variables, a computed cluster name, CMK from a second Key Vault and a renamed provider alias - and what its dated Kubernetes pins say about version governance. Part 10 of the Terraform Module Catalog.
Migrating Live Databases with Log Replay Service
Three manually-run pipelines, one JSON config bag and a TDE certificate wrinkle - how live SQL Server databases moved into Azure SQL Managed Instance with LRS, and why all the project risk compresses into the sixty seconds around cutover. Part 11 of the Terraform on Azure series.
The Cognitive Search Module and the Accidental Required Field
A search template that ships with "TBD" where partition and replica counts belong - so it cannot apply until someone makes a sizing decision - plus a three-way diagnostics choice documented entirely in commented-out code. Part 9 of the Terraform Module Catalog.
SQL as a Governed Blueprint
Azure Blueprints driven from Terraform with forty templated parameters, platform-level delete locks, twelve-hour timeouts and PowerShell bookends on both sides of the apply - how the estate's most dangerous resource got its most governed deployment. Part 10 of the Terraform on Azure series.
The Redis Module: The Floor of a Good Module
The smallest template in the catalog - a hundred lines of Redis cache config - as a study in what even the simplest secure-PaaS wrapper must still carry, and the one pipeline typo that quietly broke environment isolation. Part 8 of the Terraform Module Catalog.
Terraform's Escape Hatches Are Load-Bearing
local-exec key minting, external data sources wrapping PowerShell, and a post-apply ARM PATCH - the imperative seams that held a declarative Azure estate together, and the idempotency, portability and security bills they ran up. Part 9 of the Terraform on Azure series.
Cartography of a Successor
The series retrospective - what fourteen parts of reading Pacco as a system of systems actually taught, the absences the estate confesses when you list them together, how the successor evolved past DShop and where it stopped, and what the MIT licence makes of all of it.
The Message Map and the Wrong Exchange
The estate's full who-publishes-what matrix, built from the source - and the one broken cell in it. Orders' copied ParcelDeleted event declares the deliveries exchange while Parcels publishes on parcels, so Orders never learns a parcel was deleted, and neither the Pact tests nor the hand-maintained registry can catch it.
The Grammar of the Estate
Pacco's naming system is consistent enough to parse - exchanges are bounded contexts, queue names spell their own bindings, commands and events conjugate in snake_case, and every command has a _rejected twin. Reading the estate as a language, including its irregular verbs and the fact that no grammar-checker exists.
The Data Factory Module: Terraform Applies, the Pipeline Finishes
A Data Factory template whose most important code is not HCL - after apply, an Azure CLI step finds the factory and a PowerShell step PATCHes the ARM resource to enable CMK and disable public network access, because the provider couldn't. Part 7 of the Terraform Module Catalog.
Observability With Amnesia
Pacco traces every request, scrapes every service every five seconds and ships every log line to Seq - then forgets all of it on docker-compose down, because the telemetry stores are the containers whose volume blocks are commented out. The wiring is exemplary; the memory is the finding.
The Repo That Runs the Other Twelve
Pacco's umbrella repository contains no code, yet it decides everything about how the estate actually runs - seven compose files in deliberate layers, two PM2 manifests that quietly forget the saga service, a 460-line docker run-book, and a .rest file that is the best onboarding document in the system.
Thirteen Repos and a Floating Version
Pacco is thirteen sibling repositories held together by a solution file of relative paths, clone scripts with a dual-branch habit, and 284 package references that all say 0.4.* - coherence by wildcard, with a name-squatted saga library and a README that forgot a repo along the way.
Identity in Fifteen Files
Pacco's Identity service fits its whole auth machinery - JWT issuance, a refresh-token aggregate, Redis deny-list revocation - in about fifteen files, and most of them are right. The three that aren't teach more - a mapper bug that leaves 202 callers polling forever, a dead password check, and a refresh token that never rotates.
Security Theatre and Security Reality
Pacco names every control - JWT validation, a Vault, a log scrub-list, admin-only routes - and then a sign-up body chooses its own role, the signing key lives in every repo, Vault is off in Docker and anonymous callers pass every ownership check. A governance read of which shortcuts survive copy-paste.
The Correlation Spine
One JSON blob born at Pacco's gateway rides the Correlation-Context HTTP header into services and the message_context AMQP header across the bus, surfacing in SignalR pushes - carried by a class copy-pasted into eleven repos and a broker that forwards exactly one header.
Logic Apps, Four Folders at a Time
Each Logic App in this Azure estate was split across four sibling stacks - runtime, workflows, APIM registration and service discovery - a clean lifecycle separation that quadrupled the folder, pipeline and state count per integration. Part 8 of the Terraform on Azure series.
Two Push Channels, Two Security Models
Pacco's Operations service narrates the estate twice - once over SignalR with a JWT handshake and per-user groups, once over a gRPC stream with no auth, no filtering, a per-call event-handler leak and a blocking Take. Same data, same service, two security models.
The 202 That Names the Future
Pacco's async gateway answers a POST with two names - the ID a resource will have and the operation that tracks whether it ever gets it. Following both through the Redis state machine, the saga header override and the per-user SignalR push, warts and all - a five-minute memory, a 404 with three meanings, and a status API anyone can read.