# Azure Deployment

Deploy Monetarie PIX on Microsoft Azure using AKS, Azure Database for PostgreSQL, Azure Cache for Redis, and NATS on VMs.

## Prerequisites

- Azure subscription with appropriate permissions
- Azure CLI (`az`) configured
- `kubectl` configured
- Domain with DNS configured

## Architecture

```mermaid
graph TB
    FD[Azure Front Door] --> AKS[AKS Cluster<br/>3 nodes]

    subgraph VNET [Virtual Network]
        AKS --> PG[(Azure PostgreSQL<br/>Flexible Server)]
        AKS --> REDIS[(Azure Cache<br/>Redis 7)]
        AKS --> NATS[NATS VMs<br/>3-node cluster]
    end

    AKS -->|Outbound| BACEN[BACEN RSFN]
```

## Infrastructure Setup

### Resource Group

```bash
az group create --name monetarie-pix --location brazilsouth
```

### AKS Cluster

```bash
az aks create \
  --resource-group monetarie-pix \
  --name monetarie-pix-aks \
  --location brazilsouth \
  --node-count 3 \
  --node-vm-size Standard_D8s_v3 \
  --enable-managed-identity \
  --network-plugin azure \
  --vnet-subnet-id /subscriptions/.../subnets/aks-nodes
```

### Azure Database for PostgreSQL

```bash
az postgres flexible-server create \
  --resource-group monetarie-pix \
  --name monetarie-pix-db \
  --location brazilsouth \
  --sku-name Standard_D8s_v3 \
  --storage-size 512 \
  --version 16 \
  --admin-user monetarie_prod \
  --admin-password "SECURE_PASSWORD" \
  --vnet monetarie-vnet \
  --subnet db-subnet
```

Configure:
- `max_connections`: 6000
- `shared_buffers`: 8 GB
- High availability: Zone-redundant

### Azure Cache for Redis

```bash
az redis create \
  --resource-group monetarie-pix \
  --name monetarie-pix-redis \
  --location brazilsouth \
  --sku Premium \
  --vm-size P1 \
  --enable-non-ssl-port
```

### NATS on Virtual Machines

```bash
for i in 1 2 3; do
  az vm create \
    --resource-group monetarie-pix \
    --name nats-$i \
    --image Ubuntu2204 \
    --size Standard_D4s_v3 \
    --vnet-name monetarie-vnet \
    --subnet nats-subnet
done
```

## Application Deployment

### Container Registry

```bash
az acr create --resource-group monetarie-pix --name monetariepix --sku Standard

# Build and push
az acr build --registry monetariepix --image pix-backend:latest backend/
az acr build --registry monetariepix --image pix-frontend:latest frontend/admin/
```

### Key Vault Secrets

```bash
az keyvault create --name monetarie-pix-kv --resource-group monetarie-pix

az keyvault secret set --vault-name monetarie-pix-kv \
  --name database-url \
  --value "postgres://monetarie_prod:PASS@server.postgres.database.azure.com:5432/monetarie"
```

Use Azure Key Vault Provider for Secrets Store CSI Driver to mount secrets into pods.

### Deploy to AKS

```bash
kubectl create namespace pix
kubectl apply -f deploy/backend.yaml
kubectl apply -f deploy/admin-frontend.yaml

# Migrate
kubectl exec -n pix deployment/pix-backend -- bin/monetarie_pix eval "Shared.Release.migrate()"
```

## Cost Estimate (Brazil South)

| Resource | Spec | Monthly (USD) |
|----------|------|---------------|
| AKS | 3x Standard_D8s_v3 | ~$900 |
| PostgreSQL Flexible | Standard_D8s_v3, HA | ~$800 |
| Redis Premium | P1 | ~$400 |
| NATS VMs (3x) | Standard_D4s_v3 | ~$400 |
| Front Door | Standard | ~$50 |
| **Total** | | **~$2,550** |

## Expected Outcome

After completing this deployment:

- AKS cluster running in Brazil South with 3 nodes
- Azure PostgreSQL Flexible Server with zone-redundant HA
- Azure Cache for Redis with premium tier
- NATS 3-node cluster on Azure VMs
- All services healthy with Ingress TLS termination