The examples below are partial **Terraform input blocks**, not an application configuration file. Merge them into the shipped v1.7.1 `terraform.tfvars.example` after replacing site-specific values. The first-install staging flags and infrastructure fields are described in [Azure Installation](https://portal.cjcit.io/knowledge-base/message_ops/1.7/deployment/azure/).

## Production browser origin and real brokers

```
api_env_vars = {
  AUTH_MODE               = "oidc"
  SOLACE_ADAPTER          = "real"
  WEB_BASE_URL            = "https://ops.example.com"
  CORS_ALLOWED_ORIGINS    = "https://ops.example.com"
  SSO_CALLBACK_BASE_URL   = "https://ops.example.com/api/v1/auth/sso/callback"
  WEBAUTHN_RP_ID          = "ops.example.com"
  WEBAUTHN_ORIGIN         = "https://ops.example.com"
  WEBAUTHN_RP_NAME        = "Particle Horizon | Message Operations"
  MFA_TOTP_ISSUER         = "Particle Horizon | Message Operations"
  CSRF_PROTECTION_ENABLED = "true"
  MESSAGE_REF_TTL_SECONDS = "3600"
  MAX_BULK_MESSAGES       = "500"
}
worker_env_vars = {
  SOLACE_ADAPTER          = "real"
  MESSAGE_REF_TTL_SECONDS = "3600"
  MAX_BULK_MESSAGES       = "500"
}
disable_delete_operations = false
disable_move_operations   = false
```

The reference module supplies `NODE_ENV`, `DATABASE_URL`, `RUN_MIGRATIONS_ON_BOOT`, API proxy/port settings and Web `API_UPSTREAM`. Do not duplicate those fixed settings in additional maps. Configure `TRUST_PROXY_CIDRS` with your actual ingress/Web subnet ranges after verifying the three-hop path; additional proxies require a new trust assessment.

## Runtime secret references

Replace `example-vault` and the names with your existing vault and secrets. These URLs identify secrets; they contain no secret values. All URIs are versionless.

```
runtime_db_credential_secret_id   = "https://example-vault.vault.azure.net/secrets/message-ops-runtime-db"
runtime_db_credential_secret_name = "message-ops-runtime-db"
api_additional_secrets = {
  SSO_SECRET_ENCRYPTION_KEY_BASE64        = "https://example-vault.vault.azure.net/secrets/message-ops-sso-key"
  MFA_TOTP_SECRET_ENCRYPTION_KEY_BASE64   = "https://example-vault.vault.azure.net/secrets/message-ops-mfa-key"
  CREDENTIAL_SECRET_ENCRYPTION_KEY_BASE64 = "https://example-vault.vault.azure.net/secrets/message-ops-broker-key"
  COMPLIANCE_SIGNING_KEY_BASE64           = "https://example-vault.vault.azure.net/secrets/message-ops-evidence-key"
}
worker_additional_secrets = {
  SSO_SECRET_ENCRYPTION_KEY_BASE64        = "https://example-vault.vault.azure.net/secrets/message-ops-sso-key"
  CREDENTIAL_SECRET_ENCRYPTION_KEY_BASE64 = "https://example-vault.vault.azure.net/secrets/message-ops-broker-key"
}
```

The API and Worker share the same runtime database and ordered SSO/broker encryption-key lists. Keep the migration credential separate. For a private database CA, add `DATABASE_SSL_CA_BASE64` to both runtime secret maps. The shipped migration template does not expose an additional-secret map: provision the same CA setting/mount explicitly on migration/bootstrap jobs before using a private-CA database.

## Contain destructive operations

Set these shared Terraform inputs and redeploy API and Worker:

```
disable_delete_operations = true
disable_move_operations   = true
```

This blocks move/delete at submission and execution checks. It does not stop all work: resubmission and already executing broker requests can still proceed. Use a controlled service maintenance procedure for a full stop. Do not set `deploy_container_apps=false` to pause an installation; it removes workloads.