Operations
Azure Pipelines, Helm, Service Bus topology, and deployment for the template service.
The template service has a full .azure/ deployment package — the pattern later services should
copy once they need AKS.
Pipeline
services/template/.azure/azure-pipelines.yml triggers on develop / master
changes under services/template.
Stages (via services/template/.azure/build-deploy-goapp-template.yml):
- GetSecrets — decrypt SOPS secrets on the macOS agent
- PrepareDockerImage — build from repo root using services/template/Dockerfile
- BusPlan —
busctl planagainst the namespace declared inbus.<env>.yaml. Exit 0 is no changes, 2 is additive (success), 3 is destructive and gates the next stage. - BusApprove — manual validation when the plan is destructive
- BusApply — apply the saved plan through Azure Resource Manager
- PushHelmPackage —
helm upgrade --installfor each chart
Service Bus topology
Fanout topics and subscriber queues are declared in services/template/.azure/bus/topology.yaml:
| Domain | Topic | Subscriber queues |
|---|---|---|
domain1 | template-domain1-fanout | template-domain1-queue-listener |
domain2 | template-domain2-fanout | template-domain2-queue-listener |
Each domain has its own fanout. domain1Listener and domain2Listener are the
consumers. Only name a subscriber that has a reader — a queue nobody consumes
fills until its messages dead-letter. Every subscriber listed on that domain
receives every core event from that domain's outbox; append another name under
subscribers to add a queue. There is no PII topic yet — neither sample domain
declares a PII event type.
Environment namespace and per-domain fanout/queue settings:
services/template/.azure/bus/bus.dev.yaml. Each domain
declares its own fanout and queue properties — there is no service-wide
defaults block.
The publisher embeds the same definition via
services/template/messageBus/topology_gen.go (generated by
make generate). PII event types require containsPII: true or declared piiSubscribers; per-queue authorization
rules enforce ADR 0005.
Non-secret runtime config (SERVICEBUS_NAMESPACE) lives in
services/template/.azure/env/config.dev.yaml.
SERVICEBUS_CONNECTION_STRING belongs in the SOPS secrets file.
One image, several releases
| Helm release | Binary | Chart |
|---|---|---|
template-api | /service (default) | k8s/ |
template-flowstate | /flowstate | k8s/ |
template-domain1listener | /domain1Listener | k8s/ |
template-domain2listener | /domain2Listener | k8s/ |
Dev API ingress: dev-template.apps-and-services.com (see
services/template/.azure/k8s/values/api.dev.yaml).
Migrations
Helm pre-upgrade Job runs the API binary with -migrate. Secrets arrive as a ConfigMap at deploy
time — never baked into the image.
Env layout: services/template/.azure/env/readme.md.
Accounting
The accounting service has no .azure/ package yet. It runs locally and in CI only.