​

Azure App Service FlexDeploy Architecture

• SaaS - Data storage limits
• Hybrid connections in Azure App Service
• Flexagon SaaS Certifications
• FlexDeploy SaaS Email Integration
• Customer Data and Information in Flexagon platform
• Flexagon SaaS Single Tenant Model
• Flexagon SaaS upgrade process

​

Architecture Overview

​

Details of Architecture

• Each customer will have
• Global security settings like TLS and encryption settings

​

NAT Gateway

• Simplifies outbound internet connectivity for virtual networks
• When configured for a subnet, all outbound connectivity uses the NAT gateway’s static public IP addresses

​

Virtual Network

• Enables Azure resources to communicate with each other, the internet, and on-premises networks
• can leverage other components to enable VPN, routing, and network filters among others

​

DDOS Protection

​

WAF (Web Application Firewall)

​

App Service Plan

• Operating system specified (Linux vs Windows)
• Hardware specifications including:
  • Number of virtual CPUs
  • Amount of memory
  • Number instances (number of VMs)
• Capability to scale up the size of an instance
• Capability to scale out the number of instances

​

App Service / Web App for Containers

• Tied to an App Service plan to provide hardware footprint
• Slots to deployment a custom FlexDeploy docker container
• Up to 100 slots are available in a given App Service plan
• Configuration / Application settings
  • Allows definition of specific properties that are passed to the container
  • Includes PostgreSQL URL and database credentials
  • Includes InfluxDB properties
  • Determines what port is exposed for the application
  • Credentials can be stored in an Azure Key vault
• Configuration / General Settings
  • Allows for container specific HTTP and TLS settings
  • Allows for container specific SSL certificate handling settings
  • Allows for an optional startup command to run with the container startup
• Configuration / Path mappings
  • Allows for external Azure Storage Mounts to be added to the container
  • Azure Files storage will be mounted to provide for storage of artifacts, InfluxDB data, and other customer data to make it external to the actual FlexDeploy container
• Authentication
  • Provides capabilities to force application to authenticate with things like Google/Azure Active Directory/Twitter/Facebook among others.
  • Azure Active Directory would allow for limiting access to launching the URL to only users defined in AD for example.
• Application Insights provides application level monitoring and alerting capabilities
• Identity provides capabilities to define an Azure AD identity that would allow you to provide access to a specific secret in an Azure Key Vault for example.
• Custom Domains provides ability to customize the domain name of the application. Custom domains can be purchased and added here.
• Certificates allow for the adding and maintaining of SSL certificates
• Networking / Access restrictions allows for restricting access to the web site by things like IP address or HTTP header

​

PostgreSQL Flexible Server

• A PostgreSQL flexible server instance is provisioned for each custom
• FlexDeploy database is created and the schema with related objects is created in that instance
• Configuration setting in the App Service are configured to point to the PostgreSQL instance
• Compute, memory, and storage definitions are defined at creation but can be changed after deployment
• Default networking configuration only allows connectivity to the database from within Azure
• Data is encrypted in the database

​

Azure File Share

• Created within an Azure storage account that is provisioned with a maximum size
• Individual file share is created within that storage account’s maximum size with a defined quota
• File share is mounted to App Service container using the configuration path mapping feature