[dsghi]

Summary

A brand-new azd provision of DevBrain 2.0 can't finish: the Container App sits in "InProgress" for 20 minutes and fails with ContainerAppOperationError: … Operation expired. Deploying into a new tenant turned up two independent causes, plus a broken README snippet. This PR fixes all three and adds opt-in options that new tenants are likely to need.

Fixes

• AcrPull deadlock on first provision. The Container App pulled from ACR with its system-assigned identity, but that identity only exists once the app does, so its AcrPull role assignment depended on the app. The first revision retried Failed to construct registry secret … Ensure the managed identity 'system' has the correct permissions until the operation expired. Image pulls now use the existing user-assigned identity, which is granted AcrPull before the app is created. The old system-identity assignment is left in place so existing deployments see no churn.
• Placeholder image on the wrong port. containerapps-helloworld listens on port 80, while ingress and the /healthz startup, readiness, and liveness probes target port 8080, so the placeholder revision could never become healthy. It's replaced with mcr.microsoft.com/dotnet/samples:aspnetapp, which listens on 8080 and serves /healthz.
• README app-role snippet. ConvertTo-Json -AsArray @(@{…}) wraps the array a second time and truncates it at the default depth of 2, so az ad app update --app-roles fails with 'list' object has no attribute 'get'. It now pipes the array with -Depth 5.

New opt-in options (all default off; existing deployments are unchanged)

azd value	Effect
COSMOS_SERVERLESS	Creates the Cosmos account in serverless mode, for subscriptions whose single free-tier Cosmos account is already taken
CUSTOM_DOMAIN_NAME	Drives OAuth__BaseUrl, AllowedHosts, and the OAUTH_REDIRECT_URI output, replacing the README's "edit main.bicep" instruction
FRONT_DOOR_PROFILE_NAME / _RESOURCE_GROUP / _SKU	Publishes through an existing Front Door Standard/Premium profile. It adds a dedicated endpoint, route, origin (health probes off so scale-to-zero still works), a managed-cert custom domain, and a custom-rule WAF policy. Nothing already on the profile is modified.
DNS_ZONE_NAME / _RESOURCE_GROUP	Writes the CNAME and _dnsauth TXT validation records into an existing Azure DNS zone
FRONT_DOOR_ALLOWED_COUNTRIES	Optional country allow list in the WAF

The WAF policy has these rules: a path allow list (/mcp, /.well-known/*, /register, /authorize, /callback, /token, /healthz); 30 requests per minute per IP on the OAuth endpoints (/register is open by design under RFC 7591); and 1,000 requests per 5 minutes per IP overall.

App change: a new opt-in FrontDoor:Id setting. When it's set, the server rejects requests whose X-Azure-FDID header doesn't contain this profile's ID, except /healthz, which Container Apps probes reach directly. This follows Microsoft's origin-lockdown guidance and stops the *.azurecontainerapps.io host name from bypassing the WAF. Provisioning sets it automatically when Front Door is enabled.

New outputs: DEVBRAIN_PUBLIC_URL and DEVBRAIN_MCP_URL. The README's verify step now uses them, because with the origin check the platform host name returns 403 for everything except /healthz.

Testing

• dotnet test devbrain.slnx: 162 passed, including new server tests for the Front Door check (missing header, wrong ID, comma-separated chain, and /healthz exemption).
• Real deployment into a new tenant (serverless Cosmos, existing Front Door Standard profile and Azure DNS zone):
  • Through Front Door: /healthz and both /.well-known metadata documents return 200; POST /mcp without a token returns 401 with the correct resource_metadata; /, /wp-login.php, /.env, and /mcpfoo return 403 from the WAF; /.well-known/oauth-protected-resource/mcp passes the WAF and gets the app's 404, which MCP clients rely on for discovery fallback; HTTP redirects to HTTPS; the OAuth rate limit returns 403 after the threshold while other paths stay reachable.
  • Directly on *.azurecontainerapps.io: /healthz returns 200, and every other path returns 403.
  • az deployment group what-if showed only creates on the shared Front Door profile and DNS zone, with no modifications or deletes to existing routes, WAF policies, or security policies.
• Gap: the user-assigned-identity pull path was validated by re-provisioning over a Container App left behind by the failed first provision. A from-scratch provision with this exact template hasn't been run end to end yet.

🤖 Generated with Claude Code