Message Ops

The examples below are partial Terraform input blocks, not an application configuration file. Merge them into the shipped v1.7.1 terraform.tfvars.example after replacing site-specific values. The first-install staging flags and infrastructure fields are described in Azure Installation.

Production browser origin and real brokers

api_env_vars = {
  AUTH_MODE               = "oidc"
  SOLACE_ADAPTER          = "real"
  WEB_BASE_URL            = "https://ops.example.com"
  CORS_ALLOWED_ORIGINS    = "https://ops.example.com"
  SSO_CALLBACK_BASE_URL   = "https://ops.example.com/api/v1/auth/sso/callback"
  WEBAUTHN_RP_ID          = "ops.example.com"
  WEBAUTHN_ORIGIN         = "https://ops.example.com"
  WEBAUTHN_RP_NAME        = "Particle Horizon | Message Operations"
  MFA_TOTP_ISSUER         = "Particle Horizon | Message Operations"
  CSRF_PROTECTION_ENABLED = "true"
  MESSAGE_REF_TTL_SECONDS = "3600"
  MAX_BULK_MESSAGES       = "500"
}
worker_env_vars = {
  SOLACE_ADAPTER          = "real"
  MESSAGE_REF_TTL_SECONDS = "3600"
  MAX_BULK_MESSAGES       = "500"
}
disable_delete_operations = false
disable_move_operations   = false

The reference module supplies NODE_ENV, DATABASE_URL, RUN_MIGRATIONS_ON_BOOT, API proxy/port settings and Web API_UPSTREAM. Do not duplicate those fixed settings in additional maps. Configure TRUST_PROXY_CIDRS with your actual ingress/Web subnet ranges after verifying the three-hop path; additional proxies require a new trust assessment.

Runtime secret references

Replace example-vault and the names with your existing vault and secrets. These URLs identify secrets; they contain no secret values. All URIs are versionless.

runtime_db_credential_secret_id   = "https://example-vault.vault.azure.net/secrets/message-ops-runtime-db"
runtime_db_credential_secret_name = "message-ops-runtime-db"
api_additional_secrets = {
  SSO_SECRET_ENCRYPTION_KEY_BASE64        = "https://example-vault.vault.azure.net/secrets/message-ops-sso-key"
  MFA_TOTP_SECRET_ENCRYPTION_KEY_BASE64   = "https://example-vault.vault.azure.net/secrets/message-ops-mfa-key"
  CREDENTIAL_SECRET_ENCRYPTION_KEY_BASE64 = "https://example-vault.vault.azure.net/secrets/message-ops-broker-key"
  COMPLIANCE_SIGNING_KEY_BASE64           = "https://example-vault.vault.azure.net/secrets/message-ops-evidence-key"
}
worker_additional_secrets = {
  SSO_SECRET_ENCRYPTION_KEY_BASE64        = "https://example-vault.vault.azure.net/secrets/message-ops-sso-key"
  CREDENTIAL_SECRET_ENCRYPTION_KEY_BASE64 = "https://example-vault.vault.azure.net/secrets/message-ops-broker-key"
}

The API and Worker share the same runtime database and ordered SSO/broker encryption-key lists. Keep the migration credential separate. For a private database CA, add DATABASE_SSL_CA_BASE64 to both runtime secret maps. The shipped migration template does not expose an additional-secret map: provision the same CA setting/mount explicitly on migration/bootstrap jobs before using a private-CA database.

Contain destructive operations

Set these shared Terraform inputs and redeploy API and Worker:

disable_delete_operations = true
disable_move_operations   = true

This blocks move/delete at submission and execution checks. It does not stop all work: resubmission and already executing broker requests can still proceed. Use a controlled service maintenance procedure for a full stop. Do not set deploy_container_apps=false to pause an installation; it removes workloads.