Skip to content

Scope: what this package owns

Use this page when deciding what an agent or developer should attribute to pulumi-django-azure versus the consumer application.

In scope

Pulumi (django_deployment.py)

  • Shared stack resources created by DjangoDeployment(...): storage account, CDN (Azure Front Door), Postgres Flexible Server + private DNS, App Service plan subnet, shared Linux App Service plan, Postgres principal bootstrap Function, optional automated access-block Function (queue + Table Storage + ARM Deny rule manager), pgAdmin Web App.
  • Per-app resources from add_django_website(...): database, media/static blob containers, Key Vault, Web App (system-assigned managed identity, Git source control, health check path), optional Redis sidecar, optional Communication Services, hostname bindings + managed certs, RBAC role assignments.
  • Entra database administrators via add_database_administrator(object_id, user_name).
  • Shared Postgres principal bootstrap Function (user-assigned identity as Entra admin) that creates each app’s {name}_managed_identity role during pulumi up.
  • Stack exports such as cdn_cname, pgsql_host, pgsql_bootstrap_function_url, {name}_site_db_user, {name}_deploy_url, domain verification IDs.

Django runtime

  • Azure-oriented settings when IS_AZURE_ENVIRONMENT=true: secure cookies/HSTS, Entra token as Postgres password, Azure Storage + Collectfasta, CDN URLs, Communication email mailer (MAILERS), optional Redis cache and django-tasks-rq.
  • HealthCheckMiddleware (token rotation + DB probe + Gunicorn self-heal), optional WagtailHostAliasMiddleware, SuspiciousRequestBlockMiddleware, and optional SuspiciousRequestAccessBlockMiddleware (automated App Service IP Deny rules).
  • patch_django_settings_for_azure(...) for apps/middleware/context processors.
  • add_build_info template context from build-info.json.
  • pulumi_django_azure.cron.register_task for RQ cron configs when django_tasks=True (worker uses django_tasks_rq.Job).
  • Management commands: purge_cdn, purge_cache, fix_cache_control, test_redis.

Deploy pipeline (deploy_scripts/)

  • Bootstrap URL https://bootstrap.django-azu.re downloads scripts into the app repo’s cicd/ and utility/ (skips files that already exist).
  • Pre-build: optional npm build, HTML/SVG minify, Tailwind, Poetry export to requirements.txt, build-info.json.
  • Post-build: npm prune --production when applicable.
  • Startup: migrations, background collectstatic + CDN purge, cache purge, supervisord RQ worker (and optional RQ cron scheduler), Gunicorn.

Out of scope

This package does not:

  • Own your Django application code, models, URLs, or migration content.
  • Create your resource group or VNet (you pass those into DjangoDeployment).
  • Manage public DNS records for you (you create CNAME / A / TXT / DKIM / SPF based on Pulumi outputs).
  • Automatically enable HTTPS on a custom CDN hostname (manual step due to Azure API limits).
  • Provide a local Docker Compose or full local Azure emulator; local Django runs with package settings mostly inert unless Azure env vars are set.
  • Re-export Pulumi types from the package root — always import from pulumi_django_azure.django_deployment.

Two-project pattern

Consumer project Depends on Typical imports
Pulumi / infra This package from pulumi_django_azure.django_deployment import DjangoDeployment, HostDefinition
Django app This package pulumi_django_azure.settings, middleware, management commands

They may be the same Git repo or separate ones. Pulumi must not need to import Django settings modules from this package’s settings surface.