Skip to content

Scope: what this package owns

Use this page when deciding what an agent or developer should attribute to pulumi-django-azure versus the consumer application.

In scope

Pulumi (django_deployment.py)

  • Shared stack resources created by DjangoDeployment(...): storage account, CDN (Azure Front Door), Postgres Flexible Server + private DNS, App Service plan subnet, shared Linux App Service plan, pgAdmin Web App.
  • Per-app resources from add_django_website(...): database, media/static blob containers, Key Vault, Web App (system-assigned managed identity, Git source control, health check path), optional Redis sidecar, optional Communication Services, hostname bindings + managed certs, RBAC role assignments.
  • Entra database administrators via add_database_administrator(object_id, user_name).
  • Stack exports such as cdn_cname, pgsql_host, {name}_site_db_user, {name}_deploy_url, domain verification IDs.

Django runtime

  • Azure-oriented settings when IS_AZURE_ENVIRONMENT=true: secure cookies/HSTS, Entra token as Postgres password, Azure Storage + Collectfasta, CDN URLs, Communication email backend, optional Redis cache and django-tasks-rq.
  • HealthCheckMiddleware (token rotation + DB probe + Gunicorn self-heal) and optional WagtailHostAliasMiddleware.
  • patch_django_settings_for_azure(...) for apps/middleware/context processors.
  • add_build_info template context from build-info.json.
  • Management commands: purge_cdn, purge_cache, fix_cache_control, test_redis.

Deploy pipeline (deploy_scripts/)

  • Bootstrap URL https://bootstrap.django-azu.re downloads scripts into the app repo’s cicd/ and utility/ (skips files that already exist).
  • Pre-build: optional npm build, HTML/SVG minify, Tailwind, Poetry export to requirements.txt, build-info.json.
  • Post-build: npm prune --production when applicable.
  • Startup: migrations, background collectstatic + CDN purge, cache purge, supervisord RQ worker, Gunicorn.

Out of scope

This package does not:

  • Own your Django application code, models, URLs, or migration content.
  • Create your resource group or VNet (you pass those into DjangoDeployment).
  • Manage public DNS records for you (you create CNAME / A / TXT / DKIM / SPF based on Pulumi outputs).
  • Create the Entra Postgres principal for the app’s managed identity (you run pgaadauth_create_principal_with_oid once and grant DB rights).
  • Automatically enable HTTPS on a custom CDN hostname (manual step due to Azure API limits).
  • Provide a local Docker Compose or full local Azure emulator; local Django runs with package settings mostly inert unless Azure env vars are set.
  • Re-export Pulumi types from the package root — always import from pulumi_django_azure.django_deployment.

Two-project pattern

Consumer project Depends on Typical imports
Pulumi / infra This package from pulumi_django_azure.django_deployment import DjangoDeployment, HostDefinition
Django app This package pulumi_django_azure.settings, middleware, management commands

They may be the same Git repo or separate ones. Pulumi must not need to import Django settings modules from this package’s settings surface.