Integrating Azure SignalR Service with custom domains and certificates

Question

Pulumi · Accepted Answer

To integrate Azure SignalR Service with custom domains and certificates, you will primarily need to create an Azure SignalR Service instance, configure a custom domain for it, and secure it using a custom SSL certificate. You'll use the following resources from the Azure provider in Pulumi:

- `SignalR`: This is the main resource for Azure SignalR Service, which enables real-time messaging.
- `SignalRCustomDomain`: This resource is used to map a custom domain to the SignalR Service instance.
- `SignalRCustomCertificate`: This resource associates a custom SSL certificate from Azure Key Vault to the custom domain on SignalR Service for enabling secure connections.

Here are the steps to integrate Azure SignalR Service with custom domains and certificates, demonstrated with Pulumi TypeScript code:

1. Create an Azure resource group.
2. Create an Azure SignalR Service instance.
3. Configure a custom domain for Azure SignalR Service.
4. Link the custom SSL certificate from Azure Key Vault to the custom domain.

Here's a complete program illustrating these steps:

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

// Step 1: Create an Azure resource group
const resourceGroup = new azure_native.resources.ResourceGroup("resourceGroup", {
    // Optionally, you can specify `location`, `tags`, etc.
});

// Step 2: Create an Azure SignalR Service instance
const signalRService = new azure_native.signalrservice.SignalR("signalRService", {
    resourceGroupName: resourceGroup.name,
    // Specify the location or use the location of the resource group
    location: resourceGroup.location,
    // Define the SKU for the SignalR service (e.g., Standard_S1, Free_F1)
    sku: {
        name: "Standard_S1",
        capacity: 1, // The unit count of the SignalR service. Adjust as needed.
    },
    // Enabling ServiceMode for Default
    // `serviceMode` could be `Default`, `Serverless`, or `Classic`
    serviceMode: "Default",
    // Any other properties like `features`, `cors`, `tls`, etc.
}, { dependsOn: [resourceGroup] });

// Step 3: Configure a custom domain for Azure SignalR Service
const customDomain = new azure_native.signalrservice.SignalRCustomDomain("customDomain", {
    resourceGroupName: resourceGroup.name,
    resourceName: signalRService.name,
    name: "customDomainName", // Replace with the desired custom domain name
    // The domain name specified here should already be verified and owned by you.
    domainName: "www.example.com",
}, { dependsOn: [signalRService] });

// Step 3a: Ensure that the proper DNS settings are configured for the custom domain
// It's important to set a CNAME record pointing your custom domain
// to the Azure SignalR Service hostname. This step is typically done
// through your DNS provider's management console.

// Step 4: Link a custom SSL certificate from Azure Key Vault to the custom domain
const customCert = new azure_native.signalrservice.SignalRCustomCertificate("customCert", {
    resourceGroupName: resourceGroup.name,
    resourceName: signalRService.name,
    certificateName: "customCertName", // Replace with the name of your certificate
    keyVaultBaseUri: "https://yourkeyvault.vault.azure.net", // Replace with your Key Vault URI
    keyVaultSecretName: "yourSecretName", // Replace with your Key Vault Secret Name
    // Optionally, add the version of the certificate if it's not the latest one.
}, { dependsOn: [customDomain] });

// Export the SignalR endpoint URL and the custom domain name
export const signalREndpoint = signalRService.hostName;
export const customDomainName = customDomain.domainName;
```

### Explanation:

1. **Resource Group**: An Azure container that holds related resources. A resource group must be created first as other resources are dependent on it.
2. **SignalR Service**: This is the Azure SignalR Service instance, which will handle real-time messaging. The `sku` property determines the pricing tier and capacity for the service.
3. **Custom Domain**: It maps the custom domain (e.g., www.example.com) to the SignalR Service. Ensure you have a CNAME DNS record pointing your custom domain to the Azure SignalR Service endpoint.
4. **Custom Certificate**: This is used to secure the custom domain with an SSL certificate stored in Azure Key Vault, providing HTTPS for the custom domain. Replace `yourkeyvault`, `yourSecretName`, and possibly add a certificate version.

Finally, the program exports the Azure SignalR Service endpoint URL and the custom domain name, which you can use to configure your applications to connect to. Make sure to replace placeholders like `yourkeyvault`, `yourSecretName`, and the custom domain-related details with your actual values.