HintKeep@next Azure Container Instances Infrastructure - Andrei15193/HintKeep GitHub Wiki

HintKeep aims to deliver secure, scalable, and production-grade hosting—without pricing out indie developers, startups, or personal projects. The core principles driving this are:

• 🧪 Simplicity: Caddy handles HTTPS and cert renewal seamlessly. No complex load balancers or managed gateways required.
• 📦 Lightweight Infra: Only essential services are provisioned—backend, TLS, DNS—avoiding costly extras.
• 🛠️ Reuse and Modularity: The same container, deploy, and DNS pipeline scales from local dev to production.
• 💸 Cost-Conscious Choices:
  • ACR Basic tier keeps container registry costs below ~€5/month
  • Free Netlify hosting (or extremely low cost) for static frontend deployments
  • Azure Blob Storage for cert persistence—cheap, durable, and secure

By blending modern infrastructure best practices with a lean, open-core mindset, HintKeep ensures developers can ship fast, sleep well, and stay on budget—whether they’re crafting a side project or scaling a business.

---

Container	Role
Caddy (Sidecar)	Handles HTTPS termination with automatic TLS via Let’s Encrypt
HintKeep Backend	Your main API/service logic—runs on an internal port, proxied by Caddy

🛡️ TLS Storage:

• Caddy uses Azure Blob Storage as a persistent cert store
• Certs survive container restarts, enable multi-instance resilience

📁 Config Highlights:

• Caddy reads domain (e.g. api.hintkeep.com) from environment config
• Certificates automatically issued and renewed

---

• Managed with Bicep templates
• .bicepparam files define environment-specific configuration
• New or changed .bicepparam triggers environment provisioning (infra as code + GitOps)

Trigger Type	Environment(s)	Behavior
Push to main	dev	Auto-deploy latest build
Create GitHub Release	prod	Triggers deployment using release tag (immutable)
Manual Dispatch	preview, qa, etc	Deploy any SHA/branch/tag via workflow input

📦 Image Tagging:

• SHA-based: hintkeep:<git-sha> for all builds
• Env-tagged: hintkeep:prod, hintkeep:dev for deployed versions

• Frontend deployed per environment, auto-assigned to:
  • dev.hintkeep.com, prod.hintkeep.com, etc.
• Custom domains assigned via Netlify CLI (netlify domains:add)
• Uses Netlify DNS for seamless SSL + subdomain config

• ACR Basic tier for storing backend images
• Tags: SHA + environment
• No versioned tags needed (SHA is source of truth)

---

• Automatically discovers which image is deployed (via :dev, :prod tags)
• Rotates secrets and pushes updated values to GitHub Secrets

• Deletes images that:
  • Are only tagged with a SHA
  • Are older than 90 days
• Retains environment-tagged images for rollback safety

---

Capability	Benefit
Immutable Deploys	Every image and deploy is tied to a Git SHA
Semantic Rollbacks	Easy to redeploy a known-good version by SHA or release tag
TLS with Zero Effort	Caddy sidecar + Azure Blob equals stress-free HTTPS
Lean Registry Hygiene	Smart pruning keeps ACR tidy and low-cost
Declarative Infra	Add .bicepparam, get a new self-contained environment

Heh, I hear you. 😅 You meant the previous full summary we crafted—not just the hosting philosophy one. Got it.

Let me stitch everything together—infra, DevOps, container strategy, hosting philosophy, and cost model—into one clean, comprehensive snapshot for HintKeep:

---

A high-quality, Git-powered hosting platform that’s lean, secure, and developer-budget friendly.

---

Component	Role
HintKeep Backend	The core API app, internal-only port
Caddy (sidecar)	HTTPS reverse proxy with automated TLS via Let’s Encrypt

🔐 Certificates:

• Managed by Caddy using Azure Blob Storage as a persistent backend
• Survive container restarts and scale events
• Configured via environment variables:

  CADDY_STORAGE=azure
  AZURE_STORAGE_ACCOUNT=...
  AZURE_STORAGE_KEY=...

---

Env	Trigger	Behavior
dev	Push to main	Automatic deployment
prod	GitHub Release created	Deploys tagged commit as immutable release
preview, qa, etc	workflow_dispatch	Manual deploy with custom git ref

• Each build is tagged with commit SHA
• Deployed image also tagged with its environment (e.g. hintkeep:prod)
• Enables traceability + environment lookup at any time

---

Included in a monthly scheduled pipeline:

1. 🔐 SAS Tokens:

   • Rotate per environment
   • Uses the deployed environment image tag to map tokens precisely to the active version

2. 🧼 ACR Cleanup:

   • Deletes any image only tagged with a SHA that’s older than 90 days
   • Keeps env-tagged and recently used images for rollbacks

---

• Hosted on hintkeep.com with env subdomains like:
  • dev.hintkeep.com, preview.hintkeep.com, etc.
• Uses Netlify CLI for DNS + domain assignment
• Let’s Encrypt TLS auto-enabled by Netlify DNS

---

• Deployments are commit-anchored
• No version tags needed—SHA is source of truth
• Rollbacks are just new workflow runs with the target commit

---

Service	Plan / Usage (North Europe region)	Estimated Cost (€/month)
Azure Container Registry	Basic Tier, 10 GB included	~€5.00–6.50
Azure Blob Storage	Hot Tier, for Caddy certs (<1 GB)	~€0.02
Azure Table Storage	1–2 GB with moderate operations	~€0.10–0.15
Azure Container Instances	1 vCPU + 1 GB RAM, running 24/7	~€23–25
GitHub	Free Plan (Actions + Packages limits)	€0
Netlify Hosting	Free Tier	€0
Total	—	~€28.50–31.70/month

📅 Estimate captured on: July 5th, 2025, using Azure Pricing Calculator with default public pricing for North Europe and pay-as-you-go rates. Actual costs may vary based on usage patterns, currency fluctuations, or discounts.