{
  "schema_version": 1,
  "diagram_type": "architecture",
  "meta": {
    "title": "KBP Azure Resources",
    "output": "docs/architecture/arc42/assets/kbp-resources-view.html",
    "quality_profile": "showcase",
    "locale": "en",
    "views": [
      {
        "id": "public",
        "label": "Public path",
        "focus": [
          "user",
          "frontdoor",
          "appservice"
        ],
        "note": "Agents reach the App Service only through the shared Front Door; the App Service itself has no public endpoint."
      },
      {
        "id": "private",
        "label": "Private network",
        "focus": [
          "appservice",
          "redis",
          "keyvault",
          "developer",
          "vpn"
        ],
        "note": "VNet-integrated App Service; Redis, Key Vault and App Configuration sit behind private endpoints, reachable by developers over VPN."
      },
      {
        "id": "external",
        "label": "IP-restricted external context",
        "focus": [
          "appservice",
          "apimenbw",
          "sqldb",
          "apimdl",
          "apimscale"
        ],
        "note": "Shared EnBW resources outside the KBP network allow the App Service's outbound addresses."
      }
    ]
  },
  "components": [
    {
      "id": "user",
      "type": "external",
      "label": "Agent",
      "sublabel": "browser",
      "pos": [
        40,
        140
      ],
      "size": [
        150,
        62
      ]
    },
    {
      "id": "developer",
      "type": "external",
      "label": "Developer",
      "sublabel": "workstation",
      "pos": [
        40,
        530
      ],
      "size": [
        150,
        62
      ]
    },
    {
      "id": "frontdoor",
      "type": "cloud",
      "label": "Azure Front Door",
      "sublabel": "fd-enbw-prod · WAF",
      "pos": [
        280,
        140
      ],
      "size": [
        170,
        62
      ],
      "tag": "shared"
    },
    {
      "id": "vpn",
      "type": "security",
      "label": "Dev client VPN",
      "sublabel": "Azure VPN gateway",
      "pos": [
        280,
        530
      ],
      "size": [
        170,
        62
      ]
    },
    {
      "id": "appinsights",
      "type": "cloud",
      "label": "Application Insights",
      "sublabel": "telemetry · alerts",
      "pos": [
        560,
        30
      ],
      "size": [
        190,
        62
      ],
      "tag": "rg-kbp-prod"
    },
    {
      "id": "appservice",
      "type": "backend",
      "label": "App Service KBP",
      "sublabel": "web-kbp-prod · staging slot",
      "pos": [
        560,
        270
      ],
      "size": [
        190,
        70
      ],
      "tag": "rg-kbp-prod"
    },
    {
      "id": "redis",
      "type": "database",
      "label": "Redis Cache",
      "sublabel": "private endpoint",
      "pos": [
        480,
        440
      ],
      "size": [
        170,
        62
      ]
    },
    {
      "id": "keyvault",
      "type": "security",
      "label": "Key Vault · App Config",
      "sublabel": "private endpoints",
      "pos": [
        700,
        440
      ],
      "size": [
        170,
        62
      ]
    },
    {
      "id": "apimenbw",
      "type": "cloud",
      "label": "APIM enbw",
      "sublabel": "api.enbw.com",
      "pos": [
        1000,
        140
      ],
      "size": [
        170,
        62
      ],
      "tag": "shared"
    },
    {
      "id": "sqldb",
      "type": "database",
      "label": "Account DB",
      "sublabel": "Azure SQL · YelloData",
      "pos": [
        1000,
        270
      ],
      "size": [
        170,
        62
      ],
      "tag": "shared"
    },
    {
      "id": "apimdl",
      "type": "messagebus",
      "label": "APIM dlapiprod",
      "sublabel": "outgoing events",
      "pos": [
        1000,
        400
      ],
      "size": [
        170,
        62
      ],
      "tag": "shared"
    },
    {
      "id": "apimscale",
      "type": "security",
      "label": "APIM scale",
      "sublabel": "CIAM",
      "pos": [
        1000,
        530
      ],
      "size": [
        170,
        62
      ],
      "tag": "scale tenant"
    }
  ],
  "boundaries": [
    {
      "kind": "region",
      "label": "VNet KBP",
      "wraps": [
        "appservice",
        "redis",
        "keyvault"
      ],
      "pad": 26
    },
    {
      "kind": "security-group",
      "label": "VNet integration subnet",
      "wraps": [
        "appservice"
      ],
      "pad": 10
    },
    {
      "kind": "security-group",
      "label": "Private endpoint subnet",
      "wraps": [
        "redis",
        "keyvault"
      ],
      "pad": 10
    },
    {
      "kind": "region",
      "label": "External context · IP-restricted",
      "wraps": [
        "apimenbw",
        "sqldb",
        "apimdl"
      ],
      "pad": 16
    },
    {
      "kind": "region",
      "label": "Azure scale tenant",
      "wraps": [
        "apimscale"
      ],
      "pad": 14
    }
  ],
  "connections": [
    {
      "from": "user",
      "to": "frontdoor",
      "label": "HTTPS",
      "variant": "emphasis"
    },
    {
      "from": "frontdoor",
      "to": "appservice",
      "label": "Private Link",
      "variant": "security"
    },
    {
      "from": "developer",
      "to": "vpn",
      "variant": "security"
    },
    {
      "from": "vpn",
      "to": "keyvault",
      "label": "App Config access",
      "variant": "dashed",
      "labelAt": [
        676,
        525
      ]
    },
    {
      "from": "appservice",
      "to": "appinsights",
      "label": "telemetry",
      "variant": "dashed",
      "labelAt": [
        700,
        180
      ]
    },
    {
      "from": "appservice",
      "to": "redis",
      "fromSide": "bottom",
      "toSide": "top",
      "route": "orthogonal-v"
    },
    {
      "from": "appservice",
      "to": "keyvault",
      "fromSide": "bottom",
      "toSide": "top",
      "route": "orthogonal-v"
    },
    {
      "from": "appservice",
      "to": "apimenbw",
      "label": "REST",
      "variant": "emphasis"
    },
    {
      "from": "appservice",
      "to": "sqldb",
      "label": "SQL",
      "labelAt": [
        940,
        315
      ]
    },
    {
      "from": "appservice",
      "to": "apimdl",
      "label": "events",
      "variant": "dashed",
      "labelAt": [
        940,
        420
      ]
    },
    {
      "from": "appservice",
      "to": "apimscale",
      "label": "CIAM",
      "variant": "security",
      "labelAt": [
        940,
        550
      ]
    }
  ],
  "cards": [
    {
      "dot": "cyan",
      "title": "Ingress",
      "items": [
        "Front Door with WAF is the only public entry; the App Service is a private origin",
        "The staging slot is used for deployment swaps"
      ]
    },
    {
      "dot": "emerald",
      "title": "Private network",
      "items": [
        "Redis, Key Vault and App Configuration expose private endpoints only",
        "Developers reach App Configuration over the client VPN"
      ]
    },
    {
      "dot": "rose",
      "title": "Ownership",
      "items": [
        "rg-kbp-prod and rg-kbp-test are fully owned by iac/ bicep",
        "Front Door, API Management, Account DB and CIAM are shared EnBW resources"
      ]
    }
  ]
}