azuredeploy.json

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "sqlServerName": {
            "type": "string",
            "defaultValue": "devopsAzSqlSrv",
            "metadata": {
                "description": "Name for the SQL server"
            }
        },
        "sqlAdminUsername": {
            "type": "string",
            "defaultValue": "adm-jsmith",
            "metadata": {
                "description": "Traditional SQL Server admin username"
            }
        },
        "sqlAdminPassword": {
            "type": "securestring",
            "metadata": {
                "description": "Password for SQL Server sqlAdminUsername"
            }
        },
        "sqlAADAdminUsername": {
            "type": "string",
            "defaultValue": "<username>@<domainname>.onmicrosoft.us",
            "metadata": {
                "description": "The Azure Active Directory user whom will be the admin of the Azure SQL Server.  Can also be an Azure Active Directory security group.  Must be an Azure Active Directory user or group."
            }
        },
        "sqlAADAdminObjectID": {
            "type": "string",
            "metadata": {
                "description": "The object ID of the 'AAD Admin Login' as displayed when viwing the user in Azure Active Directory.  1)  Log into the portal 2)  Open Azure Active Directory 3) Select 'Users' or 'Groups' 4)  Select the appropriate user or group 5)  Copy 'Object ID' and use for this value.  Example: 'c020032e-1f04-47c9-a537-87a2f548c48a'Example: '3450ced5-e71b-41c6-b4d9-0562e3ebfdc3'"
            }
        },
        "keyVaultSQLAADAdmin": {
            "type": "string",
            "defaultValue": "keyVaultName",
            "metadata": {
                "description": "The Azure Key Vault which contains the secret named 'AzDevOpsSqlPass'.  The secret value should contain the password of the user object defined in 'sqlAADAdminUsername'.  Please ensure the Key Vault is enabled for template deployments."
            }
        },
        "databaseNames": {
            "type": "array",
            "defaultValue": [
                "AzureDevOps_Configuration",
                "AzureDevOps_DefaultCollection"
            ],
            "metadata": {
                "description": "Array of names for the SQL databases. The default values are mandataory for Azure DevOps Server 2019"
            }
        },
        "virtualMachineName": {
            "type": "String",
            "defaultValue": "devOpsSrv2020",
            "metadata": {
                "description": "The name of the virtual machine where Azure DevOps Server 2019 will be installed as part of this deployment"
            }
        },
        "localVMAdminUsername": {
            "type": "String",
            "defaultValue": "adm-jsmith",
            "metadata": {
                "description": "The name of the local administrator account on the virtual machine where Azure DevOps Server 2019 is being installed."
            }
        },
        "localVMAdminPassword": {
            "type": "SecureString",
            "metadata": {
                "description": "The password of the local admin account where Azure DevOps Server 2019 is being installed."
            }
        },
        "domainUsername": {
            "type": "string",
            "defaultValue": "adm-jsmith",
            "metadata": {
                "description": "Used to join the Azure DevOps Server virtual machine to your on-prem domain.  Must have permission to join computers to your on-prem Active Directory domain."
            }
        },
        "domainPassword": {
            "type": "securestring",
            "metadata": {
                "description": "The password for the domain user account which is used to join the Azure DevOps Server virtual machine to your on-prem domain.  Must have permission to join computers to your on-prem Active Directory domain."
            }
        },
        "domainToJoin": {
            "type": "string",
            "defaultValue": "contoso.com",
            "metadata": {
                "description": "Used to join the Azure DevOps Server virtual machine to your on-prem domain.  Must have permission to join computers to your on-prem Active Directory domain."
            }
        },
        "vmManagedIdentity": {
            "type": "string",
            "defaultValue": "devOpsSrv_Identity",
            "metadata": {
                "description": "The name of the user-assigned managed identity that will function as the identity of the Virtual Machine when connecting to Azure SQL"
            }
        },
        "vmManagedIdentityResourceGroup": {
            "type": "string",
            "defaultValue": "devOps",
            "metadata": {
                "description": "The name of the resource group where the VM Managed Identity lives."
            }
        },
        "vmDevOpsImageName": {
            "type": "string",
            "defaultValue": "devOpsSrv_Image",
            "metadata": {
                "description": "The name of the image you have created which has the DevOps Server binaries installed"
            }
        },
        "vmDevOpsImageResourceGroup": {
            "type": "string",
            "defaultValue": "devOpsSrv_Image_ResourceGroup",
            "metadata": {
                "description": "The name of the resource group where the VM Image for your DevOps Server deployment resides."
            }
        },
        "fileUris": {
            "type": "string",
            "defaultValue": "https://deploystor.blob.core.usgovcloudapi.net/deploydevopssrv/configureSQL.ps1",
            "metadata": {
                "description": "The powershell script which the Azure DevOps Server runs to configure permissions on Azure SQL.   URI is secured using VNET Service Endpoints and Subnet ACL's.  It is only accesible from the assigned subnet designated below"
            }
        },
        "virtualNetworkName": {
            "type": "string",
            "defaultValue": "asdfnow1-vnet",
            "metadata": {
                "description": "The target virtual network you are deploying too.  Should contain an Active Directory domain controller or provide addess to on-prem domain services."
            }

        },
        "virtualNetworkResourceGroup": {
            "type": "string",
            "defaultValue": "devOps",
            "metadata": {
                "description": "The resource group name which contains your target virtual network object"
            }
        },
        "virtualNetworkSubnetName": {
            "type": "string",
            "defaultValue": "adSubnet1",
            "metadata": {
                "description": "The specific subnet name where you are deploying your DevOps Server too.  Must have VNET Service Endpoints enabled for Azure SQL & Azure Storage."
            }
        }
    },
    "variables": {
        "databaseServerName": "[toLower(parameters('sqlServerName'))]",
        "databaseNames": "[parameters('databaseNames')]",
        "databaseServerLocation": "[resourceGroup().location]",
        "databaseServerAdminLogin": "[parameters('sqlAdminUsername')]",
        "databaseServerAdminLoginPassword": "[parameters('sqlAdminPassword')]",
        "location": "[resourceGroup().location]",
        "nicName": "[concat(toLower(parameters('virtualMachineName')), '-nic')]",
        "pipName": "[concat(toLower(parameters('virtualMachineName')), '-pip')]",
        "diagName": "[concat(toLower(parameters('virtualMachineName')), 'diag')]",
        "subnetRef": "[resourceId(parameters('virtualNetworkResourceGroup'), 'Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('virtualNetworkSubnetName'))]",
        "UriFileNamePieces": "[split(parameters('fileUris'), '/')]",
        "firstFileNameString": "[variables('UriFileNamePieces')[sub(length(variables('UriFileNamePieces')), 1)]]",
        "firstFileNameBreakString": "[split(variables('firstFileNameString'), '?')]",
        "firstFileName": "[variables('firstFileNameBreakString')[0]]",
        "arguments": "[concat('-username ',parameters('sqlAADAdminUsername'),' -targetsrv ', parameters('sqlServerName'),' -managedIdentity ', parameters('vmManagedIdentity'), '-keyVaultName ', parameters('keyVaultSQLAADAdmin'))]"
    },
    "resources": [
        {
            "type": "Microsoft.Sql/servers",
            "apiVersion": "2015-05-01-preview",
            "location": "[variables('databaseServerLocation')]",
            "name": "[variables('databaseServerName')]",
            "properties": {
                "administratorLogin": "[variables('databaseServerAdminLogin')]",
                "administratorLoginPassword": "[variables('databaseServerAdminLoginPassword')]",
                "version": "12.0"
            },
            "resources": [
                {
                    "type": "firewallrules",
                    "name": "AllowAllWindowsAzureIps",
                    "apiVersion": "2014-04-01-preview",
                    "location": "[variables('location')]",
                    "properties": {
                        "endIpAddress": "0.0.0.0",
                        "startIpAddress": "0.0.0.0"
                    },

                    "dependsOn": [
                        "[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"
                    ],
                    "condition": false
                },
                {
                    "name": "allowSubnetAccess1",
                    "type": "virtualNetworkRules",
                    "apiVersion": "2015-05-01-preview",
                    "properties": {
                        "virtualNetworkSubnetId": "[variables('subnetRef')]",
                        "ignoreMissingVnetServiceEndpoint": true
                    },
                    "dependsOn": [
                        "[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"
                    ]
                },
                {
                    "type": "administrators",
                    "name": "activeDirectory",
                    "apiVersion": "2014-04-01-preview",
                    "location": "[variables('location')]",
                    "properties": {
                        "administratorType": "ActiveDirectory",
                        "login": "[parameters('sqlAADAdminUsername')]",
                        "sid": "[parameters('sqlAADAdminObjectID')]",
                        "tenantId": "[subscription().tenantid]"
                    },
                    "dependsOn": [
                        "[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"
                    ]
                }
            ]
        },
        {
            "apiVersion": "2017-10-01-preview",
            "type": "Microsoft.Sql/servers/databases",
            "sku": {
                "name": "S4",
                "tier": "Standard"
            },
            "kind": "v12.0,user",
            "location": "[variables('databaseServerLocation')]",
            "name": "[concat(string(variables('databaseServerName')), '/', string(variables('databaseNames')[copyIndex()]))]",
            "dependsOn": [
                "[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"
            ],
            "tags": {
                "DisplayName": "[variables('databaseServerName')]"
            },
            "copy": {
                "name": "databaseCopy",
                "count": "[length(variables('databaseNames'))]"
            },
            "properties": {
            }
        },
        {
            "type": "Microsoft.Network/networkInterfaces",
            "apiVersion": "2018-10-01",
            "name": "[variables('nicName')]",
            "location": "[resourceGroup().location]",
            "dependsOn": [
                "[concat('Microsoft.Network/publicIpAddresses/', variables('pipName'))]"
            ],
            "properties": {
                "enableAcceleratedNetworking": true,
                "ipConfigurations": [
                    {
                        "name": "ipconfig1",
                        "properties": {
                            "subnet": {
                                "id": "[variables('subnetRef')]"
                            },
                            "privateIPAllocationMethod": "Dynamic",
                            "publicIpAddress": {
                                "id": "[resourceId(resourceGroup().name, 'Microsoft.Network/publicIpAddresses', variables('pipName'))]"
                            }
                        }
                    }
                ]
            }
        },
        {
            "type": "Microsoft.Network/publicIpAddresses",
            "apiVersion": "2019-02-01",
            "name": "[variables('pipName')]",
            "location": "[resourceGroup().location]",
            "sku": {
                "name": "Basic"
            },
            "properties": {
                "publicIpAllocationMethod": "Dynamic"
            }
        },
        {
            "type": "Microsoft.Compute/virtualMachines",
            "apiVersion": "2018-10-01",
            "name": "[parameters('virtualMachineName')]",
            "location": "[resourceGroup().location]",
            "identity": {
                "type": "userAssigned",
                "userAssignedIdentities": {
                    "[resourceID(parameters('vmManagedIdentityResourceGroup'),'Microsoft.ManagedIdentity/userAssignedIdentities/',parameters('vmManagedIdentity'))]": {
                    }
                }
            },
            "dependsOn": [
                "[concat('Microsoft.Network/networkInterfaces/', variables('nicName'))]",
                "[concat('Microsoft.Storage/storageAccounts/', variables('diagName'))]"
            ],
            "properties": {
                "hardwareProfile": {
                    "vmSize": "Standard_DS3_v2"
                },
                "networkProfile": {
                    "networkInterfaces": [
                        {
                            "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]"
                        }
                    ]
                },
                "osProfile": {
                    "computerName": "[parameters('virtualMachineName')]",
                    "adminUsername": "[parameters('localVMAdminUsername')]",
                    "adminPassword": "[parameters('localVMAdminPassword')]",
                    "windowsConfiguration": {
                        "enableAutomaticUpdates": true,
                        "provisionVmAgent": true
                    }
                },
                "diagnosticsProfile": {
                    "bootDiagnostics": {
                        "enabled": true,
                        "storageUri": "[concat('https://', variables('diagName'), '.blob.core.usgovcloudapi.net/')]"
                    }
                },
                "storageProfile": {
                    "osDisk": {
                        "createOption": "fromImage",
                        "managedDisk": {
                            "storageAccountType": "Premium_LRS"
                        }
                    },
                    "imageReference": {
                        "id": "[concat('/subscriptions/', subscription().subscriptionId ,'/resourceGroups/',parameters('vmDevOpsImageResourceGroup'),'/providers/Microsoft.Compute/images/',parameters('vmDevOpsImageName'))]"
                    }
                }
            }
        },
        {
            "type": "Microsoft.Storage/storageAccounts",
            "apiVersion": "2019-04-01",
            "name": "[variables('diagName')]",
            "location": "[resourceGroup().location]",
            "sku": {
                "name": "Standard_LRS"
            },
            "kind": "Storage",
            "properties": {
            }
        },
        {
            "apiVersion": "2015-06-15",
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "name": "[concat(parameters('virtualMachineName'),'/joindomain')]",
            "location": "[resourceGroup().location]",
            "dependsOn": [
                "[concat('Microsoft.Compute/virtualMachines/', parameters('virtualMachineName'))]"
            ],
            "properties": {
                "publisher": "Microsoft.Compute",
                "type": "JsonADDomainExtension",
                "typeHandlerVersion": "1.3",
                "autoUpgradeMinorVersion": true,
                "settings": {
                    "Name": "[parameters('domainToJoin')]",
                    "OUPath": "",
                    "User": "[concat(parameters('domainToJoin'), '\\', parameters('domainUsername'))]",
                    "Restart": "true",
                    "Options": 3
                },
                "protectedSettings": {
                    "Password": "[parameters('domainPassword')]"
                }
            }
        },
        {
            "name": "[concat(parameters('virtualMachineName'),'/CustomScriptExtension')]",
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "location": "[resourceGroup().location]",
            "apiVersion": "2015-06-15",
            "properties": {
                "publisher": "Microsoft.Compute",
                "type": "CustomScriptExtension",
                "typeHandlerVersion": "1.9",
                "autoUpgradeMinorVersion": true,
                "settings": {
                    "fileUris": "[split(parameters('fileUris'), ' ')]"
                },
                "protectedSettings": {
                    "commandToExecute": "[concat ('powershell -ExecutionPolicy Unrestricted -File ', variables('firstFileName'), ' ', variables('arguments'))]"
                }
            },
            "dependsOn": [
                "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), 'joindomain')]",
                "databaseCopy"
            ]
        }
    ]
}