Edi Wang

Update Files in Azure File Share on Schedule with Azure Container App Jobs

2026-02-23T10:54:25Z

Problem

I have a containerized app that relies on a data file mounted at runtime, an IP lookup API that reads qqwry.dat file. I deploy the App on Azure Container Apps, and use Azure File Share to mount the data directory for the app to use. One problem remains: How to keep the file updated automatically? e.g., to check for updates daily without manual replacing the file on Azure Storage Account.

In this post, I will introduce how to use Azure Container Apps Jobs to run a small "updater container" on a schedule. The updater downloads the latest file and writes it into the mounted file share, while the main API container reads the file from the same mount path.

Solution

1. Build an updater container image

The updater's only job is to download the latest database and atomically replace the file in /data.

For this example, the source is a fixed URL with no auth: https://github.com/metowolf/qqwry.dat/releases/latest/download/qqwry.dat

update.sh

#!/usr/bin/env bash
set -euo pipefail

# Fixed download URL (can also be overridden via environment variable)
QQWRY_URL="${QQWRY_URL:-https://github.com/metowolf/qqwry.dat/releases/latest/download/qqwry.dat}"

DATA_DIR="${DATA_DIR:-/data}"
TARGET_NAME="${TARGET_NAME:-qqwry.dat}"
USER_AGENT="${USER_AGENT:-qqwry-updater/1.0}"
LOCK_FILE="${LOCK_FILE:-$DATA_DIR/.update.lock}"

mkdir -p "$DATA_DIR"

TARGET_PATH="$DATA_DIR/$TARGET_NAME"
TMP_DIR="$(mktemp -d)"
cleanup() { rm -rf "$TMP_DIR"; }
trap cleanup EXIT

log() { echo "[$(date -u +'%Y-%m-%dT%H:%M:%SZ')] $*"; }

sha256_file() {
  sha256sum "$1" | awk '{print $1}'
}

# Use a lock to prevent concurrent writes from corrupting the file
exec 200>"$LOCK_FILE"
flock -n 200 || { log "Another update is running, exit."; exit 0; }

log "Downloading: $QQWRY_URL"
RAW="$TMP_DIR/qqwry.dat"
curl -fsSL --retry 5 --retry-delay 2 -A "$USER_AGENT" "$QQWRY_URL" -o "$RAW"

# Basic validation: non-empty and reasonable size (qqwry database is generally much larger than 100KB)
SIZE=$(stat -c%s "$RAW" 2>/dev/null || stat -f%z "$RAW")
if [[ "$SIZE" -lt 102400 ]]; then
  log "ERROR: downloaded file too small ($SIZE bytes), abort."
  exit 3
fi

NEW_SHA="$(sha256_file "$RAW")"
log "New sha256=$NEW_SHA size=$SIZE"

# If the existing file exists and has the same hash, skip replacement
if [[ -f "$TARGET_PATH" ]]; then
  OLD_SHA="$(sha256_file "$TARGET_PATH" || true)"
  if [[ "$OLD_SHA" == "$NEW_SHA" ]]; then
    log "No change (sha256 same)."
    date -u +'%Y-%m-%dT%H:%M:%SZ' > "$DATA_DIR/$TARGET_NAME.updated_at"
    echo "$NEW_SHA" > "$DATA_DIR/$TARGET_NAME.sha256"
    echo "${NEW_SHA:0:12}" > "$DATA_DIR/$TARGET_NAME.version"
    exit 0
  fi
fi

# Atomic replacement (write to a temp file first, then mv)
TMP_TARGET="$DATA_DIR/.${TARGET_NAME}.tmp"
cp -f "$RAW" "$TMP_TARGET"
sync || true
mv -f "$TMP_TARGET" "$TARGET_PATH"

date -u +'%Y-%m-%dT%H:%M:%SZ' > "$DATA_DIR/$TARGET_NAME.updated_at"
echo "$NEW_SHA" > "$DATA_DIR/$TARGET_NAME.sha256"
echo "${NEW_SHA:0:12}" > "$DATA_DIR/$TARGET_NAME.version"

log "Update done. replaced $TARGET_PATH"

Dockerfile

FROM alpine:3.20

RUN apk add --no-cache bash curl ca-certificates coreutils util-linux

WORKDIR /app
COPY update.sh /app/update.sh
RUN chmod +x /app/update.sh

ENTRYPOINT ["/app/update.sh"]

When running locally:

docker run --rm -v ./data:/data ediwang/ipinfo-updater

You can see the output like this:

Now, you can push it to any container registry you like, in my case, Docker Hub.

2. Setup Azure Container App Jobs

Next, create a new Azure Container App Job.

Set trigger to Scheduled
Set CRON expression as you need. In my case, at 00:00 UTC every day, which is 0 0 * * *

In the container configuration, set the server and image to the location of your registry.

Next, go to the Volumes blade, and add the volume you configured with Azure File Share. This post won't explain the details as I assume you already done that.

If you don't know what it is, please read my previous blog post: Deploy Open WebUI with Azure OpenAI on Azure Container Apps, that post explains in detail how to setup a File Share as volume mount.

Next, go to Containers tab, and click into the container.

In Volume mounts tab, mount the volume as "/data", in my case.

Finally, you can test the Job in Overview blade by clicking "Run now" button, and observe the history.

This log indicates our Job has successfully completed.

Conclusion

We can update files in Azure File Share with Azure Container App Jobs. The Azure Container App Job is just a simple container that can be setup to run on schedule using CRON expression.

This can be helpful if you already has a main workload running in Azure Container App and will use the file.

Modernizing My Azure Deployment Script with PowerShell and Bicep

2026-02-08T07:34:39Z

Background

For a long time, my Moonglade blog had a single, fairly long PowerShell script that did everything from prompting for subscription and region, to generate random names and passwords, then create App Service Plan, Web App, SQL Server, SQL Database, Storage Account, and finally configure connection strings and app settings.

It worked. But it was also doing two very different jobs in one place.

In this post, I’ll walk through how I refactored that into a PowerShell script focused on orchestration and UX, and a Bicep template that declaratively defines the Azure resources.

What Changed

Before: One big PowerShell script

The original script did everything through Azure CLI calls:

az group create
az appservice plan create
az sql server create
az sql db create
az storage account create
az webapp create
az webapp config ...
az sql server firewall-rule create

All resource definitions were embedded in PowerShell functions like Create-SqlServer, Create-SqlDatabase, Create-StorageAccount, Create-WebApp, etc.

It also did the interactive part. Like checking if az is installed, logging in / listing subscriptions, asking for region and web app name, etc.

Everything was imperative and driven by CLI operations.

After: PowerShell orchestration + Bicep deployment

The new approach splits responsibilities. PowerShell script still handles these tasks:

Azure CLI check + login
Subscription selection
Region selection (now with a nice arrow-key menu)
Web app name validation
Random name/password generation
Confirmation
Creates only the resource group with az group create
Then calls az deployment group create with main.bicep

After Bicep finishes, PowerShell:

Reads Bicep outputs (webAppUrl, sqlServerFqdn)
Builds the SQL connection string
Retrieves the storage connection string
Configures web app connection strings and app settings
Restarts the Web App

Bicep template (main.bicep) defines:

App Service Plan
SQL Server
SQL Database
SQL firewall rule
Storage Account
Web App (with Docker image and basic app settings)
Returns webAppUrl and sqlServerFqdn

Why I Did This

There are three main reasons.

1. Declarative infrastructure is easier to reason about

In the original script, if you wanted to know what was being deployed, you had to read through multiple PowerShell functions and CLI calls like this:

function Create-SqlServer($sqlServerName, $rsgName, $regionName, $sqlServerUsername, $sqlServerPassword) {
    $sqlServerCheck = az sql server list --query "[?name=='$sqlServerName']" | ConvertFrom-Json
    $sqlServerExists = $sqlServerCheck.Length -gt 0
    if (!$sqlServerExists) {
        az sql server create --name $sqlServerName --resource-group $rsgName --location $regionName --admin-user $sqlServerUsername --admin-password $sqlServerPassword | Out-Null
        az sql server firewall-rule create --resource-group $rsgName --server $sqlServerName --name AllowAllIps --start-ip-address 0.0.0.0 --end-ip-address 0.0.0.0 | Out-Null
    }
}

The actual desired state (one SQL Server + default firewall rule) was buried in logic and conditionals. But with Bicep, the same thing becomes declarative:

resource sqlServer 'Microsoft.Sql/servers@2022-05-01-preview' = {
  name: sqlServerName
  location: location
  properties: {
    administratorLogin: sqlAdminUsername
    administratorLoginPassword: sqlAdminPassword
    version: '12.0'
  }
}

resource sqlFirewallRule 'Microsoft.Sql/servers/firewallRules@2022-05-01-preview' = {
  parent: sqlServer
  name: 'AllowAllAzureIps'
  properties: {
    startIpAddress: '0.0.0.0'
    endIpAddress: '0.0.0.0'
  }
}

No "check if exists", no imperative flow. I simply declare what I want, and Bicep/ARM handles how to get there. This makes it easier to review, diff, and maintain over time.

2. Separation of concerns and better tooling

Splitting responsibilities gives some nice benefits.

UX logic stays in PowerShell, like arrow-key menu for regions, input validation for web app name, and confirmation prompts.

While infrastructure is in Bicep, it has strongly-typed resources, IntelliSense in VS Code, parameter validation (@minLength, @maxLength) and ARM deployment history in the portal.

For example, Bicep now validates name constraints right in the template:

@description('The name of the Storage Account')
@minLength(3)
@maxLength(24)
param storageAccountName string

And I still get to keep a nice interactive installer in PowerShell, now improved with a small arrow-key menu:

$azureRegions = @(
    "Australia Central",
    "Australia East",
    ...
    "West US 3"
)

$defaultIndex = [array]::IndexOf($azureRegions, $defaultRegion)
if ($defaultIndex -eq -1) { $defaultIndex = 0 }

$regionName = Show-Menu -Title "Select Azure Region:" -Options $azureRegions -DefaultIndex $defaultIndex
Write-Host "Selected region: $regionName" -ForegroundColor Cyan

3. Reusability and portability

With Bicep, I can deploy the same infrastructure using just a simple command:

az deployment group create \
  --resource-group my-rg \
  --template-file main.bicep \
  --parameters webAppName=... ...

I can plug this into GitHub Actions, Azure DevOps and Other CI/CD pipelines. The PowerShell script is now just one client of the Bicep template.

The Complete Code

Old PowerShell Script

param(
    [string] $defaultRegion = "West US",
    [switch] $preRelease = $false
)
function Get-UrlStatusCode([string] $Url) {
    try {
        [System.Net.WebRequest]::Create($Url).GetResponse().StatusCode
    }
    catch [Net.WebException] {
        [int]$_.Exception.Response.StatusCode
    }
}
function Check-Command($cmdname) {
    return [bool](Get-Command -Name $cmdname -ErrorAction SilentlyContinue)
}
function Get-RandomCharacters($length, $characters) {
    $random = 1..$length | ForEach-Object { Get-Random -Maximum $characters.length }
    $private:ofs = ""
    return [String]$characters[$random]
}
function Scramble-String([string]$inputString) {     
    $characterArray = $inputString.ToCharArray()   
    $scrambledStringArray = $characterArray | Get-Random -Count $characterArray.Length     
    $outputString = -join $scrambledStringArray
    return $outputString 
}
function Create-ResourceGroup($rsgName, $regionName) {
    $rsgExists = az group exists -n $rsgName
    if ($rsgExists -eq 'false') {
        Write-Host "Creating Resource Group"
        az group create -l $regionName -n $rsgName | Out-Null
    }
}
function Create-AppServicePlan($aspName, $rsgName, $regionName) {
    $planCheck = az appservice plan list --query "[?name=='$aspName']" | ConvertFrom-Json
    $planExists = $planCheck.Length -gt 0
    if (!$planExists) {
        az appservice plan create -n $aspName -g $rsgName --is-linux --sku P0V3 --location $regionName | Out-Null
    }
}
function Create-SqlServer($sqlServerName, $rsgName, $regionName, $sqlServerUsername, $sqlServerPassword) {
    $sqlServerCheck = az sql server list --query "[?name=='$sqlServerName']" | ConvertFrom-Json
    $sqlServerExists = $sqlServerCheck.Length -gt 0
    if (!$sqlServerExists) {
        Write-Host "Creating SQL Server"
        az sql server create --name $sqlServerName --resource-group $rsgName --location $regionName --admin-user $sqlServerUsername --admin-password $sqlServerPassword | Out-Null
        Write-Host "SQL Server Password: $sqlServerPassword" -ForegroundColor Yellow
        Write-Host "Setting Firewall to Allow Azure Connection"
        az sql server firewall-rule create --resource-group $rsgName --server $sqlServerName --name AllowAllIps --start-ip-address 0.0.0.0 --end-ip-address 0.0.0.0 | Out-Null
    }
}
function Create-SqlDatabase($sqlDatabaseName, $rsgName, $sqlServerName) {
    $sqlDbCheck = az sql db list --resource-group $rsgName --server $sqlServerName --query "[?name=='$sqlDatabaseName']" | ConvertFrom-Json
    $sqlDbExists = $sqlDbCheck.Length -gt 0
    if (!$sqlDbExists) {
        Write-Host "Creating SQL Database"
        az sql db create --resource-group $rsgName --server $sqlServerName --name $sqlDatabaseName --service-objective S0 --backup-storage-redundancy Local | Out-Null
    }
}
function Create-StorageAccount($storageAccountName, $rsgName, $regionName) {
    $storageAccountCheck = az storage account list --query "[?name=='$storageAccountName']" | ConvertFrom-Json
    $storageAccountExists = $storageAccountCheck.Length -gt 0
    if (!$storageAccountExists) {
        Write-Host "Creating Storage Account"
        az storage account create --name $storageAccountName --resource-group $rsgName --location $regionName --sku Standard_LRS --kind StorageV2 --allow-blob-public-access true | Out-Null
    }
}
function Create-WebApp($webAppName, $rsgName, $aspName, $dockerImageName) {
    $appCheck = az webapp list --query "[?name=='$webAppName']" | ConvertFrom-Json
    $appExists = $appCheck.Length -gt 0
    if (!$appExists) {
        Write-Host "Creating Web App"
        Write-Host "Using Linux Plan with Docker image from '$dockerImageName'."
        az webapp create -g $rsgName -p $aspName -n $webAppName --container-image-name $dockerImageName | Out-Null
        az webapp config set -g $rsgName -n $webAppName --always-on true --use-32bit-worker-process false --http20-enabled true | Out-Null
    }
}
function Update-WebAppConfig($webAppName, $rsgName, $sqlConnStr, $storageConn) {
    Write-Host "Updating Configuration" -ForegroundColor Green
    Write-Host "Setting SQL Database Connection String"
    az webapp config connection-string set -g $rsgName -n $webAppName -t SQLAzure --settings MoongladeDatabase=$sqlConnStr
    Write-Host "Adding Blob Storage Connection String"
    $scon = $storageConn.connectionString
    az webapp config appsettings set -g $rsgName -n $webAppName --settings ImageStorage__Provider=azurestorage  | Out-Null
    az webapp config appsettings set -g $rsgName -n $webAppName --settings ImageStorage__AzureStorageSettings__ConnectionString=$scon | Out-Null
    az webapp config appsettings set -g $rsgName -n $webAppName --settings ASPNETCORE_FORWARDEDHEADERS_ENABLED=true | Out-Null
}
# Main script starts here
[Console]::ResetColor()
if (-not (Check-Command -cmdname 'az')) {
    Invoke-WebRequest -Uri https://aka.ms/installazurecliwindows -OutFile .\AzureCLI.msi
    Start-Process msiexec.exe -Wait -ArgumentList '/I AzureCLI.msi /quiet'
    Write-Host "Please run 'az-login' and re-execute this script"
    return
}
# Login and select subscription
$output = az account show -o json | ConvertFrom-Json
$subscriptionList = az account list -o json | ConvertFrom-Json 
$subscriptionList | Format-Table name, id, tenantId -AutoSize
$subscriptionName = $output.name
Write-Host "Currently logged in to subscription """$output.name.Trim()""" in tenant " $output.tenantId
$subscriptionName = Read-Host "Enter subscription Id ("$output.id")"
$subscriptionName = $subscriptionName.Trim()
if ([string]::IsNullOrWhiteSpace($subscriptionName)) {
    $subscriptionName = $output.id
}
else {
    Write-Host "Changed to subscription ("$subscriptionName")"
}
# Select region
$regionName = Read-Host "Enter region name (default: $defaultRegion)"
if ([string]::IsNullOrWhiteSpace($regionName)) {
    $regionName = $defaultRegion
}
else {
    $regionName = $regionName.Trim()
}
# Select web app name
while ($true) {
    $webAppName = Read-Host -Prompt "Enter webapp name"
    $webAppName = $webAppName.Trim()
    $keywords = @("xbox", "windows", "login", "microsoft")
    if ($keywords -contains $webAppName.ToLower()) {
        Write-Host "Webapp name cannot have keywords xbox, windows, login, microsoft"
        continue
    }
    $HTTP_Status = Get-UrlStatusCode('https://' + $webAppName + '.azurewebsites.net')
    if ($HTTP_Status -eq 0) {
        break
    }
    else {
        Write-Host "Webapp name taken"
    }
}
# Generate random names and passwords
$rndNumber = Get-Random -Minimum 1000 -Maximum 9999
$rsgName = "moongladersg$rndNumber"
$aspName = "moongladeplan$rndNumber"
$storageAccountName = "moongladestorage$rndNumber"
$sqlServerUsername = "moonglade"
$sqlServerName = "moongladesql$rndNumber"
$sqlDatabaseName = "moongladedb$rndNumber"
$password = Get-RandomCharacters -length 5 -characters 'abcdefghiklmnoprstuvwxyz'
$password += Get-RandomCharacters -length 1 -characters 'ABCDEFGHKLMNOPRSTUVWXYZ'
$password += Get-RandomCharacters -length 1 -characters '1234567890'
$password += Get-RandomCharacters -length 1 -characters '!$%@#'
$password = Scramble-String $password
$sqlServerPassword = "m$password"
# Set docker image name based on pre-release flag
if ($preRelease) {
    $dockerImageName = "ediwang/moonglade:preview"
}
else {
    $dockerImageName = "ediwang/moonglade"
}
# Confirmation
Clear-Host
Write-Host "Your Moonglade will be deployed to [$rsgName] in [$regionName] under Azure subscription [$subscriptionName]. Please confirm before continuing." -ForegroundColor Green
Write-Host "+ Linux App Service Plan with Docker" -ForegroundColor Cyan
Read-Host -Prompt "Press [ENTER] to continue, [CTRL + C] to cancel"
# Set subscription
az account set --subscription $subscriptionName
Write-Host "Selected Azure Subscription: " $subscriptionName -ForegroundColor Cyan
# Create resources
Create-ResourceGroup $rsgName $regionName
Create-AppServicePlan $aspName $rsgName $regionName
Create-SqlServer $sqlServerName $rsgName $regionName $sqlServerUsername $sqlServerPassword
Create-SqlDatabase $sqlDatabaseName $rsgName $sqlServerName
Create-StorageAccount $storageAccountName $rsgName $regionName
$storageConn = az storage account show-connection-string -g $rsgName -n $storageAccountName | ConvertFrom-Json
Create-WebApp $webAppName $rsgName $aspName $dockerImageName
$createdApp = az webapp list --query "[?name=='$webAppName']" | ConvertFrom-Json
$createdExists = $createdApp.Length -gt 0
if ($createdExists) {
    $webAppUrl = "https://" + $createdApp.defaultHostName
    Write-Host "Web App URL: $webAppUrl"
}
# Update configuration
$sqlConnStrTemplate = az sql db show-connection-string -s $sqlServerName -n $sqlDatabaseName -c ado.net --auth-type SqlPassword
$sqlConnStr = $sqlConnStrTemplate.Replace("<username>", $sqlServerUsername).Replace("<password>", $sqlServerPassword)
Update-WebAppConfig $webAppName $rsgName $sqlConnStr $storageConn
az webapp restart --name $webAppName --resource-group $rsgName | Out-Null
Write-Host "Warming up the container..."
Start-Sleep -Seconds 20
Read-Host -Prompt "Setup is done, you should be able to run Moonglade on '$webAppUrl' now, if you get a 502 error, please try restarting Moonglade from Azure App Service blade. Press [ENTER] to exit."

New PowerShell Script

param(
    [string] $defaultRegion = "West US",
    [switch] $preRelease = $false
)
function Get-UrlStatusCode([string] $Url) {
    try {
        [System.Net.WebRequest]::Create($Url).GetResponse().StatusCode
    }
    catch [Net.WebException] {
        [int]$_.Exception.Response.StatusCode
    }
}
function Check-Command($cmdname) {
    return [bool](Get-Command -Name $cmdname -ErrorAction SilentlyContinue)
}
function Get-RandomCharacters($length, $characters) {
    $random = 1..$length | ForEach-Object { Get-Random -Maximum $characters.length }
    $private:ofs = ""
    return [String]$characters[$random]
}
function Scramble-String([string]$inputString) {     
    $characterArray = $inputString.ToCharArray()   
    $scrambledStringArray = $characterArray | Get-Random -Count $characterArray.Length     
    $outputString = -join $scrambledStringArray
    return $outputString 
}
function Show-Menu {
    param (
        [string]$Title,
        [string[]]$Options,
        [int]$DefaultIndex = 0
    )
    
    $selectedIndex = $DefaultIndex
    $cursorVisible = [Console]::CursorVisible
    [Console]::CursorVisible = $false
    
    try {
        while ($true) {
            Clear-Host
            Write-Host $Title -ForegroundColor Green
            Write-Host ""
            
            for ($i = 0; $i -lt $Options.Length; $i++) {
                if ($i -eq $selectedIndex) {
                    Write-Host "  > $($Options[$i])" -ForegroundColor Cyan
                } else {
                    Write-Host "    $($Options[$i])"
                }
            }
            
            Write-Host ""
            Write-Host "Use arrow keys to select, press Enter to confirm" -ForegroundColor Gray
            
            $key = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
            
            switch ($key.VirtualKeyCode) {
                38 { # Up arrow
                    $selectedIndex = [Math]::Max(0, $selectedIndex - 1)
                }
                40 { # Down arrow
                    $selectedIndex = [Math]::Min($Options.Length - 1, $selectedIndex + 1)
                }
                13 { # Enter
                    return $Options[$selectedIndex]
                }
            }
        }
    }
    finally {
        [Console]::CursorVisible = $cursorVisible
    }
}
# Main script starts here
[Console]::ResetColor()
if (-not (Check-Command -cmdname 'az')) {
    Invoke-WebRequest -Uri https://aka.ms/installazurecliwindows -OutFile .\AzureCLI.msi
    Start-Process msiexec.exe -Wait -ArgumentList '/I AzureCLI.msi /quiet'
    Write-Host "Please run 'az-login' and re-execute this script"
    return
}
# Login and select subscription
$output = az account show -o json | ConvertFrom-Json
$subscriptionList = az account list -o json | ConvertFrom-Json 
$subscriptionList | Format-Table name, id, tenantId -AutoSize
$subscriptionName = $output.name
Write-Host "Currently logged in to subscription """$output.name.Trim()""" in tenant " $output.tenantId
$subscriptionName = Read-Host "Enter subscription Id ("$output.id")"
$subscriptionName = $subscriptionName.Trim()
if ([string]::IsNullOrWhiteSpace($subscriptionName)) {
    $subscriptionName = $output.id
}
else {
    Write-Host "Changed to subscription ("$subscriptionName")"
}
# Select region
$azureRegions = @(
    "Australia Central",
    "Australia East",
    "Australia Southeast",
    "Brazil South",
    "Canada Central",
    "Canada East",
    "Central India",
    "Central US",
    "East Asia",
    "East US",
    "East US 2",
    "France Central",
    "Germany West Central",
    "Japan East",
    "Japan West",
    "Korea Central",
    "Korea South",
    "North Central US",
    "North Europe",
    "Norway East",
    "South Central US",
    "South India",
    "Southeast Asia",
    "Switzerland North",
    "UK South",
    "UK West",
    "West Central US",
    "West Europe",
    "West India",
    "West US",
    "West US 2",
    "West US 3"
)
$defaultIndex = [array]::IndexOf($azureRegions, $defaultRegion)
if ($defaultIndex -eq -1) { $defaultIndex = 0 }
$regionName = Show-Menu -Title "Select Azure Region:" -Options $azureRegions -DefaultIndex $defaultIndex
Write-Host "Selected region: $regionName" -ForegroundColor Cyan
Start-Sleep -Seconds 1
# Select web app name
while ($true) {
    $webAppName = Read-Host -Prompt "Enter webapp name"
    $webAppName = $webAppName.Trim()
    $keywords = @("xbox", "windows", "login", "microsoft")
    if ($keywords -contains $webAppName.ToLower()) {
        Write-Host "Webapp name cannot have keywords xbox, windows, login, microsoft"
        continue
    }
    $HTTP_Status = Get-UrlStatusCode('https://' + $webAppName + '.azurewebsites.net')
    if ($HTTP_Status -eq 0) {
        break
    }
    else {
        Write-Host "Webapp name taken"
    }
}
# Generate random names and passwords
$rndNumber = Get-Random -Minimum 1000 -Maximum 9999
$rsgName = "moongladersg$rndNumber"
$aspName = "moongladeplan$rndNumber"
$storageAccountName = "moongladestorage$rndNumber"
$sqlServerUsername = "moonglade"
$sqlServerName = "moongladesql$rndNumber"
$sqlDatabaseName = "moongladedb$rndNumber"
$password = Get-RandomCharacters -length 5 -characters 'abcdefghiklmnoprstuvwxyz'
$password += Get-RandomCharacters -length 1 -characters 'ABCDEFGHKLMNOPRSTUVWXYZ'
$password += Get-RandomCharacters -length 1 -characters '1234567890'
$password += Get-RandomCharacters -length 1 -characters '!$%@#'
$password = Scramble-String $password
$sqlServerPassword = "m$password"
# Set docker image name based on pre-release flag
if ($preRelease) {
    $dockerImageName = "ediwang/moonglade:preview"
}
else {
    $dockerImageName = "ediwang/moonglade"
}
# Confirmation
Clear-Host
Write-Host "Your Moonglade will be deployed to [$rsgName] in [$regionName] under Azure subscription [$subscriptionName]. Please confirm before continuing." -ForegroundColor Green
Write-Host "+ Linux App Service Plan with Docker" -ForegroundColor Cyan
Read-Host -Prompt "Press [ENTER] to continue, [CTRL + C] to cancel"
# Set subscription
az account set --subscription $subscriptionName
Write-Host "Selected Azure Subscription: " $subscriptionName -ForegroundColor Cyan
# Create Resource Group
Write-Host "Creating Resource Group: $rsgName" -ForegroundColor Green
$rsgExists = az group exists -n $rsgName
if ($rsgExists -eq 'false') {
    az group create -l $regionName -n $rsgName | Out-Null
}
# Get Bicep file path
$bicepFilePath = Join-Path $PSScriptRoot "main.bicep"
# Deploy using Bicep
Write-Host "Deploying Azure resources using Bicep..." -ForegroundColor Green
Write-Host "SQL Server Password: $sqlServerPassword" -ForegroundColor Yellow
$deploymentName = "moonglade-deployment-$(Get-Date -Format 'yyyyMMddHHmmss')"
$deploymentOutput = az deployment group create `
    --resource-group $rsgName `
    --name $deploymentName `
    --template-file $bicepFilePath `
    --parameters `
        webAppName=$webAppName `
        appServicePlanName=$aspName `
        sqlServerName=$sqlServerName `
        sqlDatabaseName=$sqlDatabaseName `
        storageAccountName=$storageAccountName `
        sqlAdminUsername=$sqlServerUsername `
        sqlAdminPassword=$sqlServerPassword `
        dockerImageName=$dockerImageName `
        location=$regionName `
    --output json | ConvertFrom-Json
if ($null -eq $deploymentOutput) {
    Write-Host "Deployment failed. Please check the error messages above." -ForegroundColor Red
    return
}
Write-Host "Deployment completed successfully!" -ForegroundColor Green
# Get outputs from Bicep deployment
$webAppUrl = $deploymentOutput.properties.outputs.webAppUrl.value
$sqlServerFqdn = $deploymentOutput.properties.outputs.sqlServerFqdn.value
# Build SQL connection string from known variables
$sqlConnStr = "Server=tcp:${sqlServerFqdn},1433;Initial Catalog=${sqlDatabaseName};Persist Security Info=False;User ID=${sqlServerUsername};Password=${sqlServerPassword};MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
# Retrieve storage connection string securely
$storageConnStr = az storage account show-connection-string -g $rsgName -n $storageAccountName --query connectionString -o tsv
Write-Host "Web App URL: $webAppUrl" -ForegroundColor Cyan
# Update Web App Configuration
Write-Host "Updating Web App Configuration..." -ForegroundColor Green
Write-Host "Setting SQL Database Connection String"
az webapp config connection-string set -g $rsgName -n $webAppName -t SQLAzure --settings MoongladeDatabase=$sqlConnStr | Out-Null
Write-Host "Adding Blob Storage Connection String and other settings"
az webapp config appsettings set -g $rsgName -n $webAppName --settings `
    ImageStorage__Provider=azurestorage `
    ImageStorage__AzureStorageSettings__ConnectionString=$storageConnStr `
    ASPNETCORE_FORWARDEDHEADERS_ENABLED=true | Out-Null
# Restart Web App
Write-Host "Restarting Web App..." -ForegroundColor Green
az webapp restart --name $webAppName --resource-group $rsgName | Out-Null
Write-Host "Warming up the container..."
Start-Sleep -Seconds 20
Read-Host -Prompt "Setup is done, you should be able to run Moonglade on '$webAppUrl' now, if you get a 502 error, please try restarting Moonglade from Azure App Service blade. Press [ENTER] to exit."

New Bicep File

@description('The name of the web app')
param webAppName string
@description('The name of the App Service Plan')
param appServicePlanName string
@description('The name of the SQL Server')
@minLength(1)
@maxLength(63)
param sqlServerName string
@description('The name of the SQL Database')
param sqlDatabaseName string
@description('The name of the Storage Account')
@minLength(3)
@maxLength(24)
param storageAccountName string
@description('SQL Server admin username')
param sqlAdminUsername string
@description('SQL Server admin password')
@secure()
param sqlAdminPassword string
@description('Docker image name')
param dockerImageName string
@description('Location for all resources')
param location string = resourceGroup().location
// App Service Plan
resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' = {
  name: appServicePlanName
  location: location
  sku: {
    name: 'P0v3'
    tier: 'Premium0V3'
  }
  kind: 'linux'
  properties: {
    reserved: true
  }
}
// SQL Server
resource sqlServer 'Microsoft.Sql/servers@2022-05-01-preview' = {
  name: sqlServerName
  location: location
  properties: {
    administratorLogin: sqlAdminUsername
    administratorLoginPassword: sqlAdminPassword
    version: '12.0'
  }
}
// SQL Database
resource sqlDatabase 'Microsoft.Sql/servers/databases@2022-05-01-preview' = {
  parent: sqlServer
  name: sqlDatabaseName
  location: location
  sku: {
    name: 'S0'
    tier: 'Standard'
  }
  properties: {
    collation: 'SQL_Latin1_General_CP1_CI_AS'
    requestedBackupStorageRedundancy: 'Local'
  }
}
// SQL Firewall Rule - Allow Azure Services
resource sqlFirewallRule 'Microsoft.Sql/servers/firewallRules@2022-05-01-preview' = {
  parent: sqlServer
  name: 'AllowAllAzureIps'
  properties: {
    startIpAddress: '0.0.0.0'
    endIpAddress: '0.0.0.0'
  }
}
// Storage Account
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    allowBlobPublicAccess: true
    supportsHttpsTrafficOnly: true
  }
}
// Web App
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
  name: webAppName
  location: location
  properties: {
    serverFarmId: appServicePlan.id
    siteConfig: {
      linuxFxVersion: 'DOCKER|${dockerImageName}'
      alwaysOn: true
      use32BitWorkerProcess: false
      http20Enabled: true
      appSettings: [
        {
          name: 'WEBSITES_ENABLE_APP_SERVICE_STORAGE'
          value: 'false'
        }
        {
          name: 'DOCKER_REGISTRY_SERVER_URL'
          value: 'https://index.docker.io'
        }
      ]
    }
    httpsOnly: true
  }
}
// Outputs
output webAppUrl string = 'https://${webApp.properties.defaultHostName}'
output sqlServerFqdn string = sqlServer.properties.fullyQualifiedDomainName

Conclusion

I refactored my Azure deployment script with Bicep. The changes are:

Moved resource creation from imperative Azure CLI calls in PowerShell into a Bicep template.
Kept user experience, validation, and orchestration in PowerShell.
Used Bicep outputs to wire up connection strings and URLs in PowerShell.

This pattern (PowerShell/Bash for orchestration + Bicep for infrastructure) scales much better than a single giant script, especially as you add more resources, environments, or CI/CD!

PowerShell Script to Check Azure App Service SSL Certificate Expiration

2025-08-18T04:48:11Z

Problem

When you have a lot of App Service instances running in your Azure subscription, managing their SSL certificate status could be a problem. Azure portal itself does have certain monitoring and advising feature to visualize the certificate status and warn you before a certificate expires. However, in some cases, we prefer this to be done in command line environment. That's why I put together this handy PowerShell script that uses Azure CLI to keep tabs on all your App Service SSL certificates.

Solution

On Windows machines, just run this command in your PowerShell 5.1/7.x:

irm https://scripts.edi.wang/Check-AppServiceCertificates.ps1 | iex

The script is pretty straightforward, it crawls through all your Azure resource groups, finds SSL certificates, and tells you which ones are about to expire (or already have).

Key Steps

1. Get All Your Resource Groups

az group list

First, we need to get every resource group in your subscription. Because SSL certificates live at the resource group level, so we need to check them one by one. By iterating through resource groups, we catch certificates bound to multiple apps, certificates that exist but aren't currently bound and certificates in resource groups we might have forgotten about.

2. Check SSL Certificates in Each Resource Group

az webapp config ssl list --resource-group <resource-group-name>

This is the core command! For each resource group, we ask Azure CLI to show us all the SSL certificates. You will get JSON like this:

{
  "expirationDate": "2025-12-31T23:59:59+00:00",
  "issueDate": "2024-01-01T00:00:00+00:00",
  "subjectName": "CN=yourdomain.com",
  "thumbprint": "ABC123...",
  "selfSigned": false,
  "issuer": "Let's Encrypt Authority X3"
}

3. Parse the Certificate Data

The script takes the JSON response and then extract the information:

Subject name (your domain)
Expiration date
Thumbprint
Whether it's self-signed

The Azure CLI response doesn't include which resource group the certificate came from. Since we're aggregating certificates from multiple resource groups, we need to track the source for proper reporting.

$certWithRG = $cert | Add-Member -NotePropertyName "resourceGroupName" -NotePropertyValue $rg.name -PassThru

4. Calculate Days Until Expiration

$daysToExpiry = [Math]::Round(($expiryDate - $currentDate).TotalDays, 0)

Compare the certificate's expiration date with today's date to see how much time it has left. PowerShell's TimeSpan object gives us precise calculations including fractional days. We round to whole days.

Complete Code

#!/usr/bin/env pwsh

<#
.SYNOPSIS
    Checks the SSL certificate status of Azure App Services using Azure CLI
.DESCRIPTION
    This script retrieves all App Service SSL certificates and groups them by expiration status.
    It highlights certificates that are expired or about to expire within a specified threshold.
.PARAMETER DaysThreshold
    Number of days to consider as "about to expire" (default: 30)
.PARAMETER SubscriptionId
    Azure subscription ID (optional - uses current subscription if not specified)
.PARAMETER Debug
    Enable detailed debugging output
#>

param(
    [int]$DaysThreshold = 30,
    [string]$SubscriptionId = $null,
    [switch]$Debug
)

# Function to write colored output
function Write-ColorOutput {
    param(
        [string]$Message,
        [string]$Color = "White"
    )
    
    switch ($Color) {
        "Red" { Write-Host $Message -ForegroundColor Red }
        "Yellow" { Write-Host $Message -ForegroundColor Yellow }
        "Green" { Write-Host $Message -ForegroundColor Green }
        "Cyan" { Write-Host $Message -ForegroundColor Cyan }
        "Magenta" { Write-Host $Message -ForegroundColor Magenta }
        "Gray" { Write-Host $Message -ForegroundColor Gray }
        default { Write-Host $Message }
    }
}

# Function to write debug output
function Write-DebugOutput {
    param([string]$Message)
    if ($Debug) {
        Write-ColorOutput "DEBUG: $Message" "Gray"
    }
}

# Function to execute Azure CLI command with error capture
function Invoke-AzCommand {
    param(
        [string]$Command,
        [string]$Description
    )
    
    Write-DebugOutput "Executing: $Command"
    
    # Capture both stdout and stderr
    $tempFile = [System.IO.Path]::GetTempFileName()
    $errorFile = [System.IO.Path]::GetTempFileName()
    
    try {
        # Execute command and capture output
        $process = Start-Process -FilePath "az" -ArgumentList $Command.Split(' ', [StringSplitOptions]::RemoveEmptyEntries)[1..($Command.Split(' ').Length - 1)] -RedirectStandardOutput $tempFile -RedirectStandardError $errorFile -Wait -PassThru -NoNewWindow
        
        $output = Get-Content $tempFile -Raw -ErrorAction SilentlyContinue
        $errorOutput = Get-Content $errorFile -Raw -ErrorAction SilentlyContinue
        
        Write-DebugOutput "Exit code: $($process.ExitCode)"
        
        if ($process.ExitCode -ne 0) {
            Write-ColorOutput "FAILED to execute: $Description" "Red"
            Write-ColorOutput "Command: $Command" "Red"
            Write-ColorOutput "Exit Code: $($process.ExitCode)" "Red"
            
            if ($errorOutput) {
                Write-ColorOutput "Error Output:" "Red"
                Write-ColorOutput $errorOutput "Red"
            }
            
            if ($output) {
                Write-ColorOutput "Standard Output:" "Yellow"
                Write-ColorOutput $output "Yellow"
            }
            
            return $null
        }
        
        Write-DebugOutput "Command succeeded"
        if ($Debug -and $output) {
            Write-DebugOutput "Output length: $($output.Length) characters"
        }
        
        return $output
    }
    finally {
        # Cleanup temp files
        if (Test-Path $tempFile) { Remove-Item $tempFile -Force -ErrorAction SilentlyContinue }
        if (Test-Path $errorFile) { Remove-Item $errorFile -Force -ErrorAction SilentlyContinue }
    }
}

# Function to format certificate info
function Format-CertificateInfo {
    param($cert, $webAppName, $resourceGroup, $status, $daysToExpiry)
    
    $expiryDate = if ($cert.expirationDate) { 
        [DateTime]::Parse($cert.expirationDate).ToString("yyyy-MM-dd HH:mm:ss UTC") 
    }
    else { 
        "Unknown" 
    }
    
    $issueDate = if ($cert.issueDate) { 
        [DateTime]::Parse($cert.issueDate).ToString("yyyy-MM-dd") 
    }
    else { 
        "Unknown" 
    }
    
    return [PSCustomObject]@{
        WebApp         = $webAppName
        ResourceGroup  = $resourceGroup
        SubjectName    = $cert.subjectName
        Thumbprint     = $cert.thumbprint
        IssueDate      = $issueDate
        ExpirationDate = $expiryDate
        DaysToExpiry   = $daysToExpiry
        Status         = $status
        Issuer         = $cert.issuer
        SelfSigned     = $cert.selfSigned
    }
}

try {
    Write-ColorOutput "Azure App Service SSL Certificate Status Checker" "Cyan"
    Write-ColorOutput "===================================================" "Cyan"
    Write-Host ""

    # Check PowerShell version
    Write-DebugOutput "PowerShell Version: $($PSVersionTable.PSVersion)"
    Write-DebugOutput "OS: $($PSVersionTable.OS)"

    # Check if Azure CLI is installed and get version
    Write-ColorOutput "Checking Azure CLI..." "Yellow"
    $azVersionOutput = Invoke-AzCommand "az version" "Getting Azure CLI version"
    
    if (-not $azVersionOutput) {
        Write-ColorOutput "Azure CLI is not installed or not accessible" "Red"
        Write-ColorOutput "Please install Azure CLI: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli" "Red"
        exit 1
    }

    try {
        $azVersionJson = $azVersionOutput | ConvertFrom-Json
        Write-ColorOutput "Azure CLI Version: $($azVersionJson.'azure-cli')" "Green"
        Write-DebugOutput "Full version info: $azVersionOutput"
    }
    catch {
        Write-ColorOutput "Azure CLI is installed (version parsing failed)" "Green"
        Write-DebugOutput "Raw version output: $azVersionOutput"
    }

    # Check if logged in
    Write-ColorOutput "Checking authentication..." "Yellow"
    $accountOutput = Invoke-AzCommand "az account show" "Getting current account"
    
    if (-not $accountOutput) {
        Write-ColorOutput "Not logged in to Azure CLI" "Red"
        Write-ColorOutput "Please run 'az login' first" "Red"
        exit 1
    }

    try {
        $account = $accountOutput | ConvertFrom-Json
        Write-ColorOutput "Logged in as: $($account.user.name)" "Green"
        Write-DebugOutput "Account type: $($account.user.type)"
        Write-DebugOutput "Tenant ID: $($account.tenantId)"
    }
    catch {
        Write-ColorOutput "Failed to parse account information" "Red"
        Write-ColorOutput "Raw output: $accountOutput" "Red"
        exit 1
    }
    
    # Set subscription if provided
    if ($SubscriptionId) {
        Write-ColorOutput "Setting subscription to: $SubscriptionId" "Yellow"
        $setSubOutput = Invoke-AzCommand "az account set --subscription $SubscriptionId" "Setting subscription"
        if (-not $setSubOutput -and $setSubOutput -ne "") {
            Write-ColorOutput "Failed to set subscription" "Red"
            exit 1
        }
    }

    # Get current subscription details
    $currentSubscriptionOutput = Invoke-AzCommand "az account show" "Getting current subscription"
    if (-not $currentSubscriptionOutput) {
        Write-ColorOutput "Failed to get current subscription" "Red"
        exit 1
    }

    try {
        $currentSubscription = $currentSubscriptionOutput | ConvertFrom-Json
        Write-ColorOutput "Current subscription: $($currentSubscription.name) ($($currentSubscription.id))" "Green"
        Write-DebugOutput "Subscription state: $($currentSubscription.state)"
    }
    catch {
        Write-ColorOutput "Failed to parse subscription information" "Red"
        exit 1
    }

    Write-Host ""

    # First, let's try to get all SSL certificates at once
    Write-ColorOutput "Retrieving all SSL certificates..." "Yellow"
    
    # Method 1: Try to get all certificates from all resource groups
    $allCertificates = @()
    
    # Get all resource groups
    $resourceGroupsOutput = Invoke-AzCommand "az group list" "Getting resource groups"
    
    if ($resourceGroupsOutput) {
        try {
            $resourceGroups = $resourceGroupsOutput | ConvertFrom-Json
            Write-ColorOutput "Found $($resourceGroups.Count) resource group(s)" "Green"
            Write-DebugOutput "Resource groups: $($resourceGroups.name -join ', ')"
            
            # Check SSL certificates in each resource group
            foreach ($rg in $resourceGroups) {
                Write-ColorOutput "Checking SSL certificates in resource group: $($rg.name)" "Yellow"
                Write-DebugOutput "Resource group: $($rg.name), Location: $($rg.location)"
                
                $sslOutput = Invoke-AzCommand "az webapp config ssl list --resource-group $($rg.name)" "Getting SSL certificates for resource group $($rg.name)"
                
                if ($sslOutput) {
                    try {
                        $sslCerts = $sslOutput | ConvertFrom-Json
                        
                        if ($sslCerts -and $sslCerts.Count -gt 0) {
                            Write-ColorOutput "Found $($sslCerts.Count) SSL certificate(s) in $($rg.name)" "Green"
                            Write-DebugOutput "Certificates in $($rg.name): $($sslCerts.subjectName -join ', ')"
                            
                            foreach ($cert in $sslCerts) {
                                # Add resource group info to certificate
                                $certWithRG = $cert | Add-Member -NotePropertyName "resourceGroupName" -NotePropertyValue $rg.name -PassThru
                                $allCertificates += $certWithRG
                            }
                        }
                        else {
                            Write-DebugOutput "No SSL certificates found in resource group: $($rg.name)"
                        }
                    }
                    catch {
                        Write-DebugOutput "Failed to parse SSL certificates for resource group $($rg.name): $($_.Exception.Message)"
                        if ($Debug) {
                            Write-DebugOutput "Raw SSL output for $($rg.name): $($sslOutput.Substring(0, [Math]::Min(200, $sslOutput.Length)))"
                        }
                    }
                }
                else {
                    Write-DebugOutput "No SSL certificates found in resource group: $($rg.name) or command failed"
                }
            }
        }
        catch {
            Write-ColorOutput "Failed to parse resource groups" "Red"
            exit 1
        }
    }
    else {
        Write-ColorOutput "Failed to get resource groups" "Red"
        exit 1
    }

    Write-Host ""
    
    if (-not $allCertificates -or $allCertificates.Count -eq 0) {
        Write-ColorOutput "No SSL certificates found across all resource groups" "Yellow"
        Write-ColorOutput "This could mean:" "White"
        Write-ColorOutput "• No custom SSL certificates are configured" "White"
        Write-ColorOutput "• All web apps are using default *.azurewebsites.net certificates" "White"
        Write-ColorOutput "• You don't have permissions to view SSL configurations" "White"
        Write-ColorOutput "• SSL certificates are managed through Azure Key Vault or other services" "White"
        Write-Host ""
        
        # Let's also try to check if there are any web apps
        Write-ColorOutput "Checking for web apps in subscription..." "Yellow"
        $webAppsOutput = Invoke-AzCommand "az webapp list" "Getting web apps"
        
        if ($webAppsOutput) {
            try {
                $webApps = $webAppsOutput | ConvertFrom-Json
                if ($webApps -and $webApps.Count -gt 0) {
                    Write-ColorOutput "Found $($webApps.Count) web app(s) in subscription:" "Green"
                    foreach ($app in $webApps) {
                        Write-ColorOutput "   • $($app.name) (Resource Group: $($app.resourceGroup))" "White"
                    }
                    Write-Host ""
                    Write-ColorOutput "These web apps might be using:" "Cyan"
                    Write-ColorOutput "   • Default *.azurewebsites.net certificates (free)" "White"
                    Write-ColorOutput "   • App Service Managed Certificates" "White"
                    Write-ColorOutput "   • Certificates from Azure Key Vault" "White"
                }
                else {
                    Write-ColorOutput "No web apps found in subscription" "Yellow"
                }
            }
            catch {
                Write-DebugOutput "Failed to parse web apps output"
            }
        }
        
        exit 0
    }

    Write-ColorOutput "Found $($allCertificates.Count) SSL certificate(s) across all resource groups" "Green"
    
    if ($Debug) {
        Write-DebugOutput "Certificate summary:"
        foreach ($cert in $allCertificates) {
            Write-DebugOutput "  - $($cert.subjectName) in RG: $($cert.resourceGroupName)"
        }
    }

    # Current date for comparison
    $currentDate = Get-Date
    Write-DebugOutput "Current date: $currentDate"
    
    # Arrays to store categorized certificates
    $expiredCerts = @()
    $aboutToExpireCerts = @()
    $validCerts = @()

    # Process each certificate
    foreach ($cert in $allCertificates) {
        Write-DebugOutput "Processing certificate: $($cert.subjectName) in RG: $($cert.resourceGroupName)"
        
        if ($cert.expirationDate) {
            try {
                $expiryDate = [DateTime]::Parse($cert.expirationDate)
                $daysToExpiry = [Math]::Round(($expiryDate - $currentDate).TotalDays, 0)
                
                Write-DebugOutput "Certificate $($cert.subjectName) expires on $expiryDate (in $daysToExpiry days)"
                
                if ($daysToExpiry -lt 0) {
                    $expiredCerts += Format-CertificateInfo $cert "Multiple/Unknown" $cert.resourceGroupName "EXPIRED" $daysToExpiry
                }
                elseif ($daysToExpiry -le $DaysThreshold) {
                    $aboutToExpireCerts += Format-CertificateInfo $cert "Multiple/Unknown" $cert.resourceGroupName "EXPIRING SOON" $daysToExpiry
                }
                else {
                    $validCerts += Format-CertificateInfo $cert "Multiple/Unknown" $cert.resourceGroupName "VALID" $daysToExpiry
                }
            }
            catch {
                Write-DebugOutput "Failed to parse expiration date for $($cert.subjectName): $($cert.expirationDate)"
                $validCerts += Format-CertificateInfo $cert "Multiple/Unknown" $cert.resourceGroupName "UNKNOWN" "N/A"
            }
        }
        else {
            Write-DebugOutput "Certificate $($cert.subjectName) has no expiration date"
            $validCerts += Format-CertificateInfo $cert "Multiple/Unknown" $cert.resourceGroupName "UNKNOWN" "N/A"
        }
    }

    # Display results
    Write-ColorOutput "SSL CERTIFICATE STATUS SUMMARY" "Cyan"
    Write-ColorOutput "==================================" "Cyan"
    Write-ColorOutput "• Expired: $($expiredCerts.Count)" "Red"
    Write-ColorOutput "• Expiring Soon (≤$DaysThreshold days): $($aboutToExpireCerts.Count)" "Yellow"
    Write-ColorOutput "• Valid: $($validCerts.Count)" "Green"
    Write-Host ""

    # Display expired certificates
    if ($expiredCerts.Count -gt 0) {
        Write-ColorOutput "EXPIRED CERTIFICATES" "Red"
        Write-ColorOutput "========================" "Red"
        $expiredCerts | Sort-Object DaysToExpiry | Format-Table -Property ResourceGroup, SubjectName, ExpirationDate, DaysToExpiry, SelfSigned, Thumbprint -AutoSize
        Write-Host ""
    }

    # Display certificates about to expire
    if ($aboutToExpireCerts.Count -gt 0) {
        Write-ColorOutput "CERTIFICATES EXPIRING SOON (≤$DaysThreshold days)" "Yellow"
        Write-ColorOutput "================================================" "Yellow"
        $aboutToExpireCerts | Sort-Object DaysToExpiry | Format-Table -Property ResourceGroup, SubjectName, ExpirationDate, DaysToExpiry, SelfSigned, Thumbprint -AutoSize
        Write-Host ""
    }

    # Display valid certificates
    if ($validCerts.Count -gt 0) {
        Write-ColorOutput "VALID CERTIFICATES" "Green"
        Write-ColorOutput "=====================" "Green"
        $validCerts | Sort-Object DaysToExpiry | Format-Table -Property ResourceGroup, SubjectName, ExpirationDate, DaysToExpiry, SelfSigned, Thumbprint -AutoSize
        Write-Host ""
    }

    # Summary recommendations
    Write-ColorOutput "RECOMMENDATIONS" "Cyan"
    Write-ColorOutput "==================" "Cyan"
    
    if ($expiredCerts.Count -gt 0) {
        Write-ColorOutput "URGENT: $($expiredCerts.Count) certificate(s) have already expired and need immediate attention!" "Red"
    }
    
    if ($aboutToExpireCerts.Count -gt 0) {
        Write-ColorOutput "WARNING: $($aboutToExpireCerts.Count) certificate(s) will expire within $DaysThreshold days. Plan renewal soon." "Yellow"
    }
    
    if ($expiredCerts.Count -eq 0 -and $aboutToExpireCerts.Count -eq 0) {
        Write-ColorOutput "All certificates are valid and not expiring soon. Great job!" "Green"
    }

    Write-Host ""
    Write-ColorOutput "To manage SSL certificates:" "Cyan"
    Write-ColorOutput " • Azure Portal: App Services > [Your App] > TLS/SSL settings" "White"
    Write-ColorOutput " • Azure CLI: az webapp config ssl --help" "White"
    Write-ColorOutput " • List certificates by resource group: az webapp config ssl list --resource-group <rg-name>" "White"

}
catch {
    Write-ColorOutput "An unexpected error occurred: $($_.Exception.Message)" "Red"
    Write-ColorOutput "Stack trace: $($_.ScriptStackTrace)" "Red"
    exit 1
}

Tips

You can use the -Debug flag if something blows up
If you're getting errors about commands not being recognized, double-check you're using the right Azure CLI syntax. The Azure CLI team loves to keep us on our toes with command changes!

Automating Deployment of Open WebUI on Azure Container Apps with Bicep

2025-07-24T05:20:05Z

In my previous blog post, I introduced how to deploy Open WebUI with Azure OpenAI on Azure Container Apps in Azure Portal manually. However, manual deployment usually makes people work 996. In this post, I will show you how to automate everything using Bicep. If you’re new to Bicep, think of it as a friendlier way to define Azure resources as code compared to raw ARM templates. I’ll walk you through my Bicep file, explaining how each block helps set up a scalable, persistent, and easy-to-manage Open Web UI deployment.

1. Define Parameters

At the very top, we’ve got a few parameters:

@description('Name of the storage account (must be globally unique)')
param storageAccountName string = 'openwebuistorage1069'

@description('Location for all resources')
param location string = resourceGroup().location

@description('Name of the file share')
param fileShareName string = 'owuifileshare'

@description('Name for the Container Apps Environment')
param envName string = 'ca-env'

@description('Name for the Container App')
param containerAppName string = 'openwebui-app'

These are self-explanatory, just names of your resources.

2. Data Storage

Open Web UI needs somewhere to save data so you don’t lose info across restarts. We use Azure Storage Account with file share to help that.

// Storage Account
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
    supportsHttpsTrafficOnly: true
  }
}

// Storage Share
resource fileShare 'Microsoft.Storage/storageAccounts/fileServices/shares@2022-09-01' = {
  name: '${storageAccount.name}/default/${fileShareName}'
  properties: {
    shareQuota: 100 // in GB
    accessTier: 'TransactionOptimized'
  }
}

We:

Create a Storage Account (needs a globally unique name!).
Set up a File Share (100GB quota, TransactionOptimized tier—a good fit for lots of small file activity).

3. Create Log Analytics

This creates a workspace with a 30-day log retention (also adjustable). All logs from Container Apps Environment will show up here.

// Log Analytics for Container Apps Environment
resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: '${envName}-log'
  location: location
  properties: {
    sku: {
      name: 'PerGB2018'
    }
    retentionInDays: 30
  }
}

4. Create Container Apps Environment

A "Managed Environment" is required for any Container App in Azure. We link it to the Log Analytics workspace for log aggregation.

// Container Apps Environment
resource containerAppEnv 'Microsoft.App/managedEnvironments@2023-05-01' = {
  name: envName
  location: location
  properties: {
    appLogsConfiguration: {
      destination: 'log-analytics'
      logAnalyticsConfiguration: {
        customerId: logAnalytics.properties.customerId
        sharedKey: logAnalytics.listKeys().primarySharedKey
      }
    }
  }
}

5. Hooking Up Azure File as a Persistent Volume

We fetch the storage account key, then create an Azure File storage for the Container Apps Environment. This is what enables volume mounting from your container.

// Get Storage Key for mounting File Share
var storageAccountKey = storageAccount.listKeys().keys[0].value

resource meStorage 'Microsoft.App/managedEnvironments/storages@2023-05-01' = {
  parent: containerAppEnv
  name: '${storageAccountName}fileshare'
  properties: {
    azureFile: {
      accountName: storageAccountName
      shareName: fileShareName
      accountKey: storageAccountKey
      accessMode: 'ReadWrite'
    }
  }
}

6. Deploying the Open WebUI Container App

Finally, we can deploy the main web application since all the dependencies are ready.

resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
  name: containerAppName
  location: location
  properties: {
    managedEnvironmentId: containerAppEnv.id
    configuration: {
      ingress: {
        external: true
        targetPort: 8080
        transport: 'auto'
        allowInsecure: false
      }
      secrets: [
        {
          name: 'storage-account-key'
          value: storageAccountKey
        }
      ]
    }
    template: {
      containers: [
        {
          name: 'open-webui'
          image: 'ghcr.io/open-webui/open-webui:main'
          resources: {
            cpu: 2
            memory: '4Gi'
          }
          volumeMounts: [
            {
              volumeName: 'open-webui'
              mountPath: '/app/backend/data'
            }
          ]
        }
      ]
      volumes: [
        {
          name: 'open-webui'
          storageType: 'AzureFile'
          storageName: meStorage.name
          mountOptions: 'nobrl'
        }
      ]
      scale: {
        minReplicas: 1
        maxReplicas: 1
        rules: [
          {
            name: 'http-rule'
            http: {
              metadata: {
                concurrentRequests: '10'
              }
            }
          }
        ]
      }
    }
  }
}

output storageAccountName string = storageAccount.name
output fileShareName string = fileShare.name
output containerAppFqdn string = containerApp.properties.configuration.ingress.fqdn

Usage

Install Azure CLI and Bicep CLI on your computer, and combine the scripts above to main.bicep.

Create a resource group first:

az group create --name openwebui-test996-rg --location japaneast

Then one key deployment!!!

az deployment group create --resource-group openwebui-test996-rg --template-file main.bicep --parameters storageAccountName=openwebuistorage2996

Notice the storage account name must be globally unique. If your deployment blow up, it is very possible that the name is already taken, just change another name.

The final resource group:

Container log:

Finally, your Open WebUI application is now running!

Wrapping Up

With this one Bicep file, you get:

Persistent storage for app data (survives upgrades/restarts!)
A managed container app, easily upgradable by swapping container images.
Centralized, queryable logs.
All-in-one deployment—no clicking around the portal!

Auto Generating Incremental Resource Names in Azure Bicep

2025-05-19T04:41:45Z

Problem

Bicep's syntax is already pretty clean, but sometimes you run into situations like needing to concatenate strings or format names repeatedly, doing small calculations based on input parameters, or having long, messy expressions inside resource definitions. Let’s say you want to automatically generate a series of VM names like web-01, web-02, and so on. Without functions, you’d have to write 'web-${padLeft(string(i+1), 2, '0')}' every time, makes you work 996. Let’s see how to make this easier.

Solution

User-Defined Function

A Bicep function typically looks like this:

@<decorator>(<argument>)
func <user-defined-function-name> (<argument-name> <data-type>, <argument-name> <data-type>, ...) <function-data-type> => <expression>

Functions can take parameters and specify a return type.

In this case, just create a function like below:

func generateVmName(prefix string, index int) string => '${prefix}-${padLeft(string(index + 1), 2, '0')}'

// Usage
resource vms 'Microsoft.Compute/virtualMachines@2022-08-01' = [for i in range(0, vmCount): {
  name: generateVmName('web', i)
  ...
}]

Full Bicep File

This example will deploy a set of Azure Virtual Machines with automatically generated names like web-01, web-02, etc.

func generateVmName(prefix string, index int) string => '${prefix}-${padLeft(string(index + 1), 2, '0')}'

@minLength(1)
param vmPrefix string = 'web'

@minValue(1)
@maxValue(10)
param vmCount int = 2

param location string = resourceGroup().location

@description('The subnet resource ID where all VMs will be deployed')
param subnetId string

@secure()
param adminPassword string

param adminUsername string = 'azureuser'

var vmSize = 'Standard_B1s'
var vmImage = {
  publisher: 'Canonical'
  offer: '0001-com-ubuntu-server-jammy'
  sku: '22_04-lts-gen2'
  version: 'latest'
}

resource vms 'Microsoft.Compute/virtualMachines@2022-08-01' = [
  for i in range(0, vmCount): {
    name: generateVmName(vmPrefix, i)
    location: location
    properties: {
      hardwareProfile: {
        vmSize: vmSize
      }
      storageProfile: {
        imageReference: vmImage
        osDisk: {
          createOption: 'FromImage'
          managedDisk: {
            storageAccountType: 'Standard_LRS'
          }
        }
      }
      osProfile: {
        computerName: generateVmName(vmPrefix, i)
        adminUsername: adminUsername
        adminPassword: adminPassword
        linuxConfiguration: {
          disablePasswordAuthentication: false
        }
      }
      networkProfile: {
        networkInterfaces: [
          {
            id: nicResources[i].id
          }
        ]
      }
    }
  }
]

resource nicResources 'Microsoft.Network/networkInterfaces@2022-09-01' = [
  for i in range(0, vmCount): {
    name: '${generateVmName(vmPrefix, i)}-nic'
    location: location
    properties: {
      ipConfigurations: [
        {
          name: 'ipconfig1'
          properties: {
            subnet: {
              id: subnetId
            }
            privateIPAllocationMethod: 'Dynamic'
          }
        }
      ]
    }
  }
]

output vmNames array = [for i in range(0, vmCount): generateVmName(vmPrefix, i)]
output nicNames array = [for i in range(0, vmCount): '${generateVmName(vmPrefix, i)}-nic']

Run this script:

az deployment group create --resource-group bicep-demo-group --template-file main.bicep --parameters adminPassword=W0rk996S!ickICU

This script will create the network, subnet, NICs, and VMs automatically.

You will get:

Deploying Azure App Service and SQL Server with Bicep

2025-05-18T01:18:46Z

Background

Last week at Microsoft Reactor Shanghai, I addressed a speech "Automating Infrastructure as Code (IaC) Deployment with Azure Bicep". One of the demo was how to use Bicep to deploy a complete Azure web app environment, including an App Service and an Azure SQL Database. I know we didn’t have time to walk through the whole script, so I wanted to break it down here in a blog post.

Let’s walk through this Bicep file together, and see what each part does!

The Bicep File

First, the complete Bicep file is:

@description('Web App Name')
param webAppName string = 'demowebapp${uniqueString(resourceGroup().id)}'

@description('SQL Server administrator username')
param sqlAdminUsername string = 'demoadmin'

@secure()
@description('SQL Server administrator password')
param sqlAdminPassword string

@description('SQL Server Name')
param sqlServerName string = 'sqlserver${uniqueString(resourceGroup().id)}'

@description('SQL Database Name')
param sqlDbName string = 'demodb'

@description('App Service region')
param location string = resourceGroup().location

// Create App Service Plan
resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' = {
  name: 'demoplan'
  location: location
  sku: {
    name: 'S1'
    tier: 'Standard'
    capacity: 1
  }
}

// Create Web App
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
  name: webAppName
  location: location
  properties: {
    serverFarmId: appServicePlan.id
    httpsOnly: true
    siteConfig: {
      appSettings: [
        // Connection string to be added later
      ]
    }
  }
}

// Create SQL Server
resource sqlServer 'Microsoft.Sql/servers@2022-02-01-preview' = {
  name: sqlServerName
  location: location
  properties: {
    administratorLogin: sqlAdminUsername
    administratorLoginPassword: sqlAdminPassword
    version: '12.0'
  }
}

// Create SQL Database
resource sqlDb 'Microsoft.Sql/servers/databases@2022-02-01-preview' = {
  parent: sqlServer
  location: location
  name: sqlDbName
  properties: {
    collation: 'SQL_Latin1_General_CP1_CI_AS'
    maxSizeBytes: 2147483648
    sampleName: 'AdventureWorksLT'
  }
  sku: {
    name: 'S0'
    tier: 'Standard'
    capacity: 10
  }
}

// Allow Azure Services to access SQL Server (firewall rule)
resource allowAzureServices 'Microsoft.Sql/servers/firewallRules@2022-02-01-preview' = {
  name: 'AllowAzureServices'
  parent: sqlServer
  properties: {
    startIpAddress: '0.0.0.0'
    endIpAddress: '0.0.0.0'
  }
}

// Build database connection string
var connectionString = 'Server=tcp:${sqlServer.name}.database.windows.net,1433;Initial Catalog=${sqlDb.name};Persist Security Info=False;User ID=${sqlAdminUsername};Password=${sqlAdminPassword};MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;'

// Add the connection string to the Web App's application settings
resource webAppConnectionString 'Microsoft.Web/sites/config@2022-03-01' = {
  parent: webApp
  name: 'connectionstrings'
  properties: {
    DefaultConnection: {
      value: connectionString
      type: 'SQLAzure'
    }
  }
}

output webAppUrl string = webApp.properties.defaultHostName
output sqlServerName string = sqlServer.name
output sqlDbName string = sqlDb.name

To deploy it, run this command in PowerShell:

az deployment group create --resource-group bicep-demo-group --template-file .\webappsql.bicep --parameters sqlAdminPassword=DemoSQLAdmin123!

The result will be:

Step by Step Explanation

Parameters

At the top, we define a few parameters. These are like variables that let you customize your deployment without editing the code every time.

param webAppName string = 'demowebapp${uniqueString(resourceGroup().id)}'
param sqlAdminUsername string = 'demoadmin'
@secure()
param sqlAdminPassword string
param sqlServerName string = 'sqlserver${uniqueString(resourceGroup().id)}'
param sqlDbName string = 'demodb'
param location string = resourceGroup().location

webAppName: The name of your web app. It default to a unique name so you don’t get name conflicts.
sqlAdminUsername and sqlAdminPassword: The admin login for SQL Server. Note the password is marked as @secure(), so it won’t show up in logs or outputs.
sqlServerName: The name for your SQL Server, also unique.
sqlDbName: The name of your SQL Database.
location: Where all your resources will be (like “westus” or “eastasia”).

App Service Plan

Before you can run a web app, you need an App Service Plan, it's the host of your app. Here, we’re creating a plan called demoplan, using the Standard S1 tier.

resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' = {
  name: 'demoplan'
  location: location
  sku: {
    name: 'S1'
    tier: 'Standard'
    capacity: 1
  }
}

Web App

Next, we create the Web App itself, using the plan above. It’s set to use HTTPS only. For now, the app settings are empty, we’ll add the database connection string later.

resource webApp 'Microsoft.Web/sites@2022-03-01' = {
  name: webAppName
  location: location
  properties: {
    serverFarmId: appServicePlan.id
    httpsOnly: true
    siteConfig: {
      appSettings: [
        // Connection string to be added later
      ]
    }
  }
}

SQL Server and SQL Database

Create a SQL Server (not a VM, but a logical server in Azure). You set the admin username and password here.

resource sqlServer 'Microsoft.Sql/servers@2022-02-01-preview' = {
  name: sqlServerName
  location: location
  properties: {
    administratorLogin: sqlAdminUsername
    administratorLoginPassword: sqlAdminPassword
    version: '12.0'
  }
}

Next, create a SQL Database inside the server. It uses the AdventureWorksLT sample data (so you get some tables and data to play with right away). The database is set to the Standard S0 tier.

resource sqlDb 'Microsoft.Sql/servers/databases@2022-02-01-preview' = {
  parent: sqlServer
  location: location
  name: sqlDbName
  properties: {
    collation: 'SQL_Latin1_General_CP1_CI_AS'
    maxSizeBytes: 2147483648
    sampleName: 'AdventureWorksLT'
  }
  sku: {
    name: 'S0'
    tier: 'Standard'
    capacity: 10
  }
}

Now, we need to let Azure services access the database, in this case, we are letting the App Service instance access our database.

resource allowAzureServices 'Microsoft.Sql/servers/firewallRules@2022-02-01-preview' = {
  name: 'AllowAzureServices'
  parent: sqlServer
  properties: {
    startIpAddress: '0.0.0.0'
    endIpAddress: '0.0.0.0'
  }
}

Connection String

First, we build the connection string. For demo purpose, I hard code database.windows.net, please use environment() function in real world apps. Then, we set the connection string into the web app’s settings with name DefaultConnection.

// Build database connection string
var connectionString = 'Server=tcp:${sqlServer.name}.database.windows.net,1433;Initial Catalog=${sqlDb.name};Persist Security Info=False;User ID=${sqlAdminUsername};Password=${sqlAdminPassword};MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;'

// Add the connection string to the Web App's application settings
resource webAppConnectionString 'Microsoft.Web/sites/config@2022-03-01' = {
  parent: webApp
  name: 'connectionstrings'
  properties: {
    DefaultConnection: {
      value: connectionString
      type: 'SQLAzure'
    }
  }
}

Outputs

After deployment, you’ll get the URL for your web app, plus the names of your SQL Server and Database.

output webAppUrl string = webApp.properties.defaultHostName
output sqlServerName string = sqlServer.name
output sqlDbName string = sqlDb.name

Wrapping Up

So, in a nutshell, this Bicep file lets you deploy a ready-to-go Web App and SQL database in Azure, all connected and secured, with just a single deployment.

Solving "npm install" ECONNRESET Error on Azure DevOps

2023-08-16T13:34:49Z

Problem

A few months ago, my Angular project on Azure DevOps started to have build failure very often. Error message is "npm ERR! network read ECONNRESET", which indicates npm can't connect to internet. This problem does not happen every time, usually re-run failed jobs several times can produce a good build. But still, this is very annoying. So, I took some time to investigate and solve it.

Root Cause

First, I thought it was a IP rate limit by npm that reject Azure pipeline's agent. So I set up a VM on Azure as a self-host build agent. However, the problem continues.

Then, I setup the same build agent on my laptop, which is outside of Azure environment, the build succeed every time. It seems to be npm rejecting the entire Azure IP address. But I can open https://registry.npmjs.org/ without any problem on my Azure VM, how come the IP limit?

Finally, I added verbose log to the npm install task in my pipeline yaml file like this:

jobs:
- job: Angular
  pool:
    vmImage: 'ubuntu-latest'
  steps:

  - task: Npm@1
    displayName: 'npm install'
    inputs:
      workingDir: '$(System.DefaultWorkingDirectory)/src'
      command: 'install'
      verbose: true

Run the build again, check it's output

The log indicates that some packages are being fetched from Tencent registry instead of the official registry.npmjs.org

Azure has problems communicating with Tencent server, this is why the build will fail very often.

The reason why these packages are going to use Tencent server is because the URLs are written in package-lock.json file. This file is automatically modified when developers run npm install on their machines. A typical developer in China would have setup thier npm to use Tencent or Taobao source, due to the national firewall usually block official npm registry.

npm config set registry https://mirrors.cloud.tencent.com/npm/

And when the developer submit the code, package-lock.json will have this URL inside it.

Fix

First, let all developers in the team use official npm registry.

npm config set registry https://registry.npmjs.org/

Then, delete node_modules folder and package-lock.json under the project directory

Then, run npm install on the dev machine again.

Now, all packages will be updated to use the official npm registry.

Now, submit the code, Azure DevOps now runs npm install without network error!

How I Built This Blog with Azure Services

2019-07-19T10:00:22Z

My website (https://edi.wang) is an open-source blog system written in .NET Core and runs on Microsoft Azure. This article explains why and how the blog benefits from Azure's services.

History of this blog

The history of my blog dates to 2003, and the .NET version of the blog was originally built 10 years ago by the ASP.NET 2.0 WebForm VB and Access database and has been gradually maintained and upgraded to today, using ASP.NET Core MVC and Azure SQL Database.

The current system, codename "Moonglade", is a complete rewrite of the previous .NET Framework version of the blog, which was "Nordrassil". For single-user blogs, this version extremely streamlined, eliminating the previous version of over-designed multi-user rights management, multi-level categories, MetaWeblog interface, article review workflow, and other useless components, and targets cloud-native environment.

This blog is currently deployed in the East Asia region of Microsoft Azure. The average server response time is 6.5ms, while page load time is around 4s, due to the impact of China’s network, I still have plenty of visitors from mainland China, besides these users, the page load time is actually 1.5-2s in a good network connection. In fact, it's not just .NET and SQL code optimization that made this performance, Azure's services are also a key role in success.

Let’s check out how Azure empowered every piece of this blog system to achieve more.

App Service + Azure SQL Database

These two services are at the core services used by the blog and were the only two that the blog system adopted when it first went to the cloud. They can reduce a day or days of work to deploy a VM or on-premises server to ten minutes. And the price is much lower than using VM to deploy a website.

App Service

App Service is a PaaS service on Azure. Compared to traditional virtual machine deployment, App Service provides a fully managed platform where users don't have to worry about installing and configure virtual machines. As for the underlying system patches, website environment, web server configuration, have all been managed by Microsoft. As a result, we no longer need to work 996 and get into ICU just to prepare a web environment. We can now do it in minutes, where traditional methods can take hours or even days.

Disadvantages of VM deployments

Manual patch every month
Manual install runtime and web server (IIS, .NET, Python, etc..)
Manual configure website runtime (environment variables, path, etc..)
Manual connect CI/CD (setup WebDeploy, FTP, etc..)
Manual configure IP addresses, network, staging/prod environments, load balancer
If website went boom, manually RDP to the machine to check logs and crash dump
Difficult to scale

Cloud-Native App Service

Fully managed platform
Rich global regions
Quickly build and scale Apps
Smart monitoring
High performance and security
Low cost

Azure portal provides a complete management interface on the web that can be used for dozens of operations, including deployments (different environments), diagnostics, settings, backups, scaling instances, binding domain names/SSL, and more.

While .NET should be the right choice, Microsoft doesn't just support .NET. You can choose Node.js, PHP, Python, or other languages, and you can use almost all the App Service experience, or even the Linux/Docker platform.

In addition to the basic features like domain name, SSL, that each site will configure, my blog uses some of the additional features of App Service.

Deployment Slots

The purpose of this feature is to create and switch between different environments. For example, my blog has only staging and production environments. The code is automatically published from the continuous integration of Azure DevOps to a staging environment that very close to production, and after testing, the deployment of the production environment is manually triggered.

Azure can seamlessly switch between two environments so that your application is almost zero downtime. Traditionally, if a deployment went wrong, it usually takes a rollback operation, during which time users will surely take screenshots of your website and tweets to celebrate your mistake. So, the reason why my blog has always seemed very stable, it’s not I write correct code every time, but thanks to the staging slot, users won’t know if something has blown up before going to production.

Backup

Doing backup on traditional VM either requires manual operation, or write a complex script, or with the system scheduled task, or purchase third-party products. Anyway, it’s complex. Programmers can easily 996 into ICU for setting up this kind of environment.

Azure App Service, on the other hand, can be configured with scheduled automatic backups just with a few mouse click on the web page, even includes a database that will be packaged together. When the website blows up, you can select the backup file and restore it instantly with one click. You can also download the backup package at any time to restore to your local environment.

Scale-out

Azure App Service makes it easy to configure scaling rules in just a few minutes. For example, when CPU usage reaches an average of more than 70% in 1 minute and lasts 10 minutes, an instance is automatically added.

Advanced Tools

Kudu is a Microsoft open-source tool written in ASP. NET (unfortunately not .NET Core), it's the hero behind App Service. Websites on IIS can be published, managed, and diagnosed using Kudu. Microsoft not only opened the tool for free, but it also integrated it into Azure Portal, where I was able to use advanced features to manage the blog server.

Kudu can view app settings, server environment variables, browse or edit website directory files, view live log streams, check IIS, node, dotnet, and other processes, and download dump files for local debugging. It's a Swiss Army knife for a website application.

Other features of App Service are also useful. For example, you can find Let's Encrypt in "Extensions", which can automatically configure and renew free SSL certificates. You can also run scheduled tasks in Web Jobs. Learn more at https://azure.microsoft.com/en-us/services/app-service/

Azure SQL Database

Like App Service, Azure SQL Database is a fully-managed database service that includes almost all of SQL Server's capabilities and supports My SQL. Using Azure SQL Database means you don't have to worry about installing and configuring your database server environment, like patching your machines or struggle with firewall configurations. All common operations can be done in minutes in the Azure portal.

Azure SQL Database can be managed with tools you're familiar with, such as SSMS and Azure Data Studio.

Azure allows internal services to access the database, while you can disable/enable this setting at any time. But excludes other public IPs. You can add IP whitelists on the web portal, or by SSMS and Azure Data Studio.

Azure also provides data security (including compliance, such as masking sensitive data), performance optimization services, like which SQL Query is the slowest, and give accurate tuning recommendations like where to add indexes. Unfortunately, I am not so familiar with database technology, so I can't give you an in-depth introduction.

Learn more about Azure SQL Database here: https://azure.microsoft.com/en-us/services/sql-database/

DNS

Azure DNS provides domain name resolving services with global ultra-high availability. It is hosted alongside your apps, supports all common DNS record types, and can quickly update DNS records. My blog switched to Azure DNS years ago.

Azure can now provide one-stop service from domain name registration to DNS resolution. However, you don’t have to register a domain name in Azure to use Azure DNS. Just change your NS records to match Azure DNS servers and you are ready to go.

Learn more about Azure DNS here: https://azure.microsoft.com/en-us/services/dns/

CDN

CDN is also one of the services usually used with websites. Thanks to Azure's global footprint, using Azure CDN is a better way to ensure global access to resources. In my blog system, the images of the articles are using CDN to speed up Azure Blob Storage, which helped a lot for users in mainland China.

Azure CDN supports custom domain names and gives away SSL certificates for free! What a conscience does Microsoft have!

In my blog system, the first time the user requests an image, the CDN would go to the corresponding Blob Storage to get the picture and cache it. Subsequent requests no longer need to go through Blob Storage, and you can return the results directly from the cache to increase responsiveness. With CDN, the response speed is significantly improved compared to the turtle speed in mainland China to direct access Blob Storage.

Learn more about Azure CDN: https://azure.microsoft.com/en-us/services/cdn/

Blob Storage

My blog system contains unstructured data such as pictures and is not suitable for saving with SQL Server databases. Azure Blob Storage, on the other hand, is ideal for storing resources such as pictures, files, and more. Its benefits are geo-redundancy, multiple blob types, object mutability, and strong consistency.

Microsoft offers SDK support, including .NET Core, to make it easy for programs to use blobs. For information on how my blog system uploads an image to Azure Blob, see the source code:

https://github.com/EdiWang/Moonglade/tree/master/src/Moonglade.ImageStorage.AzureBlob

Files stored on blobs can be managed on the Azure portal, or by Azure Storage Explorer, Microsoft's official client application.

Learn more about Blob Storage: https://azure.microsoft.com/en-us/services/storage/blobs/

Azure Active Directory

People familiar with Microsoft products may know about Active Directory, which helps companies manage employee accounts. Azure Active Directory is a cloud-based domain service that not only manages accounts within your organization but also invites partners or temporary visitors.

Microsoft's Office 365 also adopts the service. The most useful feature of Azure AD is that it can be easily integrated with your own applications for an SSO (single sign-on) experience. My blog also supports Azure AD single sign-on.

For information on how my blog code integrates Azure AD, see:

https://github.com/EdiWang/Moonglade/tree/master/src/Moonglade.Web.Authentication

Learn more about Azure Active Directory: https://azure.microsoft.com/en-us/services/active-directory/

Azure DevOps

Azure DevOps is not a new thing, but a masterpiece of Microsoft's renaming division. Formerly known as VSTS, or a more familiar name: TFS.

It is a complete set of DevOps tools that cover all functions such as requirements management, code hosting, compilation and deployment, testing, and more. Using Azure DevOps means you no longer need to buy individual products for individual features and then integrate them at the cost of working 996 and get into ICU. And Azure DevOps is free for teams of up to 5 people and open source projects!

The staging and production environments mentioned earlier in this article are configured by Azure DevOps.

Because of the open-source nature, my blog doesn't use all the features of Azure DevOps, but only Pipelines. It provides CI/CD generation, testing, and deployment. You can connect to GitHub or any other Git provider (including, of course, Microsoft's own TFVC).

Learn more about Azure DevOps: https://azure.microsoft.com/en-us/services/devops/

Azure Application Insights

After a website is developed and deployed. Monitoring is important to find problems, optimize performance, and so on. There are no systems without any bugs. Those can quickly find and solve the problem can dominate the market. Azure Application Insights is a powerful APM tool that integrates from front end to backend of your entire web application to provide real-time data.

I can pin the metrics that I care most to the dashboard. Such as server response time, failed requests, page views, page load time. And I can view more information by clicking into each metric.

For failed requests, I can clearly see what environments and services have gone through all way till the database. What’s the exception, and what SQL query was run, and how much time they took.

Built-in performance analysis tools that support both client and server can help you quickly locate performance bottlenecks, such as which is the slowest requests, where the slowest SQL queries are, and so on.

By the way, Azure Application Insights also comes with an Application Map that can see very intuitively the relationship of the web application.

Azure Application Insights can also be to integrate deeper into your app by using custom events to help get more useful data that more specific to your own application.

Closing

Building a cloud-based blog system with Azure has achieved great performance and developer efficiency compared to traditional approaches. I only used 8 out of hundreds of Azure products so far. My blog may take advantage of other Azure services in the future. For example:

Content moderating with Azure AI
Integrate Bing Search
Use Azure Key Vault to manage secret keys
Use Cosmos DB to store data
Use Web Jobs to run scheduled tasks

I sill have a lot to learn, and I hope you can also achieve more with Microsoft Azure!

How to Pack a .NET Core Class Library and Upload to NuGet

2019-04-24T05:46:32Z

NuGet is the package manager of the. NET world, we can both use official website nuget.org, or build our own corporate and private servers. Now, with . NET Core, it's easier than ever to pack and upload a NuGet package, let's take a look!

NuGet Account

If you want your package to be used by every .NET developers in the world, then you need to have a nuget.org account to upload your own package. Nuget.org can log in directly with Microsoft account.

After logging in, it is recommended that you get a set of API Key. Although this Key is not required in the scope of this article, but if you later want to publish the NuGet package through the NuGet CLI or automation tools, such as Azure DevOps, you will need it.

Create NuGet Package in Visual Studio 2019

Take one of my class library Edi.Blog.Pingback as an example, after the development is complete, right-click on the project file and open the Properties dialog.

On the Package tab, select Generate NuGet package on builds.

And fill in some necessary information. The Package ID is the most important, that is, the ID used when the end user installs your NuGet package. It's not the same as Product. An example is Json.NET, whose Package ID is Newtonsoft.Json, not Json.NET. In general, in order to avoid confusion, I recommend that you keep the Package ID and Product name consistent.

The second is the version number, and Package version is the version that will eventually appear on the Nuget.org page, as well as the version used to specify the installation version through the NuGet CLI. In order to avoid confusion, it is also recommended to be consistent with Assembly/File version.

Additional information can be filled in as needed, the more detailed the better. For example, my package was open source with the MIT protocol in GitHub, and I can fill out the repository address (Repository URL), as well as the Licensing. Even if it is not an open source package, we are advised to fill out the licensing. Otherwise, there will bea a warning after the package is uploaded to nuget.org.

In fact, these operations on the VS interface are ultimately reflected in the project file (Edi.Blog.Pingback.csproj), that is, if you are a VSCode guy, you can also manually edit the project files to complete this series of settings.

<PropertyGroup>
  <TargetFramework>netcoreapp2.2</TargetFramework>
  <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
  <Authors>Edi Wang</Authors>
  <Company>edi.wang</Company>
  <Description>Pingback sender and receiver used in my blog system.</Description>
  <RepositoryUrl>https://github.com/EdiWang/Edi.Blog.Pingback</RepositoryUrl>
  <PackageProjectUrl>https://edi.wang</PackageProjectUrl>
  <AssemblyVersion>10.1.0.0</AssemblyVersion>
  <FileVersion>10.1.0.0</FileVersion>
  <Version>10.1.0</Version>
  <PackageTags>Blog, Pingback</PackageTags>
  <PackageLicenseExpression>MIT</PackageLicenseExpression>
</PropertyGroup>

Next, switch to Release mode to compile your code. You will get a generated nupkg package under the bin\release folder. Release mode is used because the production environment should be used and the end user is expected to use the compiler-optimized DLL.

Upload to nuget.org

The easiest way is to upload it through a Web page. Under buget.org's user menu, select Upload Package.

Then, drag and drop the nupkg file we just created to the upload box to finish upload.

After confirming that all the information is correct, click the Submit button at the bottom of the page.

Next, you'll see the status of the validation. It will be in Validating status, then it will become Listed after it is passed. It's usually 5 minutes.

However, after Listed, there will still be a warning, meaning that the server's index has not been completed, the user can not search the version of the package. But you can specify a specific version number to install through the NuGet CLI or edit the project file to install the package as well.

When the warning disappears, your package will all ready!

Other Recommended Tools

NuGet CLI: https://www.nuget.org/downloads

NuGet Package Explorer: https://www.microsoft.com/store/productId/9WZDNCRDMDM3

Incremental Build Number for .NET Core via Azure DevOps

2019-03-01T08:16:09Z

People familiar with the. NET framework knows that we can let the compiler self-increase the version number by specifying AssemblyVersion as 10.0.*. But. NET core and. NET Standard are not. Even with open-source projects like MSBump, there are certain flaws. Typically, such a requirement happens on a CI/CD server. Let's take a look at how to easily handle it with Azure DevOps.

About Versioning in .NET Core Applications

I have wrote a post on the. NET Core Application Version number: https://edi.wang/post/2018/9/27/get-app-version-net-core

We're going to control Version field this time.

Use dotnet build to compile your application into dll files, and this version will be shown in the property window.

But actually, the build command can have a parameter that sets a specific version number, like this:

dotnet build /p:Version=10.0.8888.1234

Based on this, we can control the build number for a .NET Core application on build servers.

Why Not Use MSBump

You may heard of a project: Msbump, which can also be used to change the version number at compile time. However, it modifies the csproj file at compile time and is a code change. The traditional. NET FX compilation system does not change the code. This is unacceptable to me because it is a kind of uncontrollable factor. It's not a good practice to check in the csproj file that just changed the version number. And instead of generating the version number based on the timestamp, MSBump by default, generates the version by the current version string in the project file. So in a development team, everyone could have inconsistent version of the same csproj file. So I decided to give up MSBump and try to use Microsoft's own technology to solve it's own problem.

Automatically Generate Version Numbers

In a fully automated CI environment, it is not possible for us to manually specify a version number each time. I need a rule and a method to generate it automatically.

The rules I personally use is: [Major].[Minor].[Number of days from January 1, 2000].[Lucky Number]

I use PowerShell to calculate the number of days from 1/1/2000.

$baseDate = [datetime]"01/01/2000"
$currentDate = $(Get-Date)
$interval = NEW-TIMESPAN –Start $baseDate –End $currentDate
$days = $interval.Days

Configure Azure DevOps

We basically need to tell Azure DevOps to calculate the version number, and use /p:Version parameter to build our project.

Environment variables

Add a variable named buildNumber in the build definition.

PowerShell Task

Add a PowerShell Task and put it as the first step in the build pipeline. This PowerShell Task need to calculate the version number and assign it to buildNumber variable

To set value to a variable in Azure DevOps pipeline, use Write-Host as:

##vso[task.setvariable variable=variableName]variableValue

Then, our script will be

Write-Host "Generating Build Number"
$baseDate = [datetime]"01/01/2000"
$currentDate = $(Get-Date)
$interval = NEW-TIMESPAN –Start $baseDate –End $currentDate
$days = $interval.Days

Write-Host "##vso[task.setvariable variable=buildNumber]10.0.$days.1024"

Choose Inline and copy this script to the textarea.

Modify .NET Core Task Parameter

Append this to the Arguments filed of both Build and Publish steps.

/p:Version=$(buildNumber)

Notice: there should be a space [ ] before /p

Compile and Done

Trigger a new build, you can see the version number is being set in the build log

and the application will have an updated version after deployment

Send Email After Release Deployment in Azure DevOps

2019-02-21T07:55:23Z

By default, Azure DevOps sends an email notification to team members after the compilation succeeds or fails. But in a CI/CD environment, we are more concerned about when the deployment is complete and then conducting manual or automated testing. Let's take a look at how to get Azure DevOps to automatically send mail notifications to team members after a successful deployment.

Enter Project settings in the bottom of the left sidebar.

Choose Notifications > New subscription

Click Release > A deployment is completed

The default settings are to send mail to all members of the current project when the deployment is complete. Specific settings can be changed according to your project needs, such as adding filtering criteria, selecting the Role of Notification member, and so on. Then click Finish to complete the configuration.

When you're done, you should be able to see this custom notification rule at the bottom of the list.

Now, trigger a deployment. If all goes well, you should be able to receive a similar email notification. I currently have two environments, and according to the configuration just now, any deployment on both environment will be notified. This is the staging environment:

Fix .NET Core Website Failure After Deployment from Azure DevOps

2019-02-15T13:05:47Z

I met a strange problem recently. After configuring the CI/CD pipeline with Azure DevOps and automatically deploy to Azure App Services, the. NET Core Website failed to start. Let's see how we can solve this problem.

Find the issue

First of all, fortunately, this is a staging environment. I found that the site unexpectedly did not log anything, even log directory cannot be found, which is very strange. So I decided to enable development mode in Azure so that the site can output detailed error messages. If you are familiar with the classic ASP.NET, you may know that changing customError in web.config can show detailed error. But .NET Core doesn't have this thing, how can we do this? There's a small trick:

The settings of .NET Core can be overwritten with environment variables. So we can take advantage of this by adding an environment variable to the settings of Azure App Services:

ASPNETCORE_ENVIRONMENT: Development

It is located in the Application settings page.

How could I know this? Actually, it is from Visual Studio itself:

Now, we can see a detailed error:

I can see that the code that gets executed is not in the root directory of the site. So my code couldn't find the dependency, and it blew up.

What is going on?

I tried to deploy manually from VS, and it blew up, too. Redeploy in Azure DevOps, blew up. Even if I deactivate the CD pipeline, use kudu to build git code directly, also blew up!

Eventually, I deleted the site and created a new App Service instance, published website from VS, and it was good. But once again when I deployed it with the CI/CD pipeline, it blew up again! I compared the settings from the previous good website, and found there's a new setting showing up:

What the heck is this?

I traced it back to a Microsoft Azure announcement: https://github.com/azure/app-service-announcements/issues/84

It says:

Today, App Service supports a number of different techniques to deploy your files: msdeploy (aka WebDeploy), git, FTP, VSTS, ARM and more. But all these techniques have something in common: when all is said and done, your files are deployed under your wwwroot folder (specifically `d:\home\site\wwwroot`).

At that point, the runtime takes over, and it is no longer relevant how the files got there. The runtime can read all those files, and run whatever logic it needs to run based on them.

But with Run From Package, things are very different. There is no longer a deployment step which copies the individual files to wwwroot. Instead, you just point it to a zip file, and the zip gets mounted on wwwroot as a read-only file system.

So this is why my website runtime root directory is changed.

Recover the website

To temporarily recover the website to run, very simple, just delete WEBSITE_RUN_FROM_PACKAGE from setting, restart the site, you can revert to a good pre-deployment version. However, future deployments of Azure DevOps will not work. Because the real wwwroot directory will not be updated.

(website recovered to pre-deployment version 10.0.6980.1000)

But we still need automated deployments

We need to modify the default values for Azure DevOps deployment tasks.

Edit your Release definition, go to Tasks > Deploy Azure App Service

Expand Additional Deployment Options and select Select deployment method and use Web Deploy

Now, issue a new release, wait for it to finish, you will have a good new version deployed at wwwroot directory correctly!

Fix Azure DevOps TF14045 Error When Deploy to Azure

2019-02-13T05:14:53Z

Problem

I encountered an error when I tried to setup CI/CD in Azure DevOps, I tried to deploy a .NET Core application to Azure App Service, but Azure DevOps won't connect to Azure. This is a known issue for Microsoft. Let's see how we can manually set up a connection between Azure DevOps and Azure to work around this issue.

First, the error message I met was:

Failed to get resource ID for resource type 'Microsoft.Web/Sites' and resourcename 'moonglade'. Error: Could not fetch access token for Managed ServicePrincipal. Please configure Managed Service Identity (MSI) for virtual machine'https://aka.ms/azure-msi-docs'.Status code: 400, status message: Bad Request

This is caused by the authentication token is invalid or expired. However, when I try to Authorize a new connection, Azure DevOps blows up:

TF14045: The identity with type 'Microsoft.IdentityModel.Claims.ClaimsIdentity' could not be found.

Microsoft has a known issue for this, but seems not fixed so far: https://developercommunity.visualstudio.com/content/problem/412380/tf14045-the-identity-with-type-microsoftidentitymo-1.html

Solution

Go to Azure Active Directory > App registrations (Preview), Click "+ New registration"

Set a Name, for example: ediwang-AzureDevOps

Choose "Accounts in this organizational directory only"

Set https://VisualStudio/SPN as Redirection URL

Set a Description and choose "Never" Expires.

Copy the VALUE in Client Secrets

And also copy Application (client) ID and Directory (tenant) ID in Overview

Go to Subscription > Access control (IAM) Search for the Name of the App, and Add a role assignment

Set as Owner

Go back to Azure DevOps, click Manage in Azure App Service Deploy

Add an Azure Resource Manager in Service Connections

Choose use the full version of the service connection dialog.

Service pricipal client ID is Application (client) ID

Service pricipal key is the VALUE copied in Client Secrets

Click Verify connection

If nothing goes wrong, you will have a successful connection and deployment

Build .NET Core 2.2 Projects on Azure DevOps

2018-12-13T08:17:41Z

.NET Core 2.2 has been release for couple of weeks. However, the build pipeline is still failing these days. Microsoft has not installed .NET Core 2.2 SDK to the hosted VS2017 agents yet. Let's see how to work around this issue and have a success build for our .NET Core 2.2 apps.

1. Add Task

Edit your build definition, and click the "+" button to add a new task.

2. Add .NET Core SDK Installer

Find the ".NET Core SDK Installer" task in the gallery and click "Add" button.

3. Task Order

Move the ".NET Core SDK Installer" task to the first step of your build pipeline.

4. Edit Task

Set the Version field to "2.2.100", and I recommend to change the "Display name" field to match the version also.

5. Save & queue

6. Result

Now you will have a sucessful build of your .NET Core 2.2 project.

If you want to check the logs for what magic has happend, just click on the task, you can see the install log for the .NET Core 2.2 SDK.

Hope this post can help you out, and have a nice build!

Configure VSTS Build for UWP Apps

2017-10-06T02:41:23Z

UWP Apps usually require a lot of time to compile a "release" package for submitting to Windows Store, and if you are working in a team, TFS/VSTS can help your team ensure that each check-in has a success build, and make it easier for deployment and testing. Let's see a basic example of how to setup a CI build for a UWP App on VSTS.

Important Pre-condition

Before you do that, please ensure that your App is already build and running on your local machine.

If you want the package can be used to upload to the Windows Store, you need to manually associate the App to the store and create App packages and validate the release on your machine for the first time.

VSTS build on host agents can not automatically increase the build number in your App's manifest, you will need to do it manully in each check-in, or you can create a custom agent to do that (not discussed in this article)

Example App

My example App "QRCodeCreator" is under project "Universal-Windows", and there are many other Apps under the same parent directory. Usually in an enterprise, you won't put every App under a same Team Project. But if you do, there will be some different from the default build teamplate, which in this case, you can follow my steps.

Step 1

Go to "Build and Release" under "Universal-Windows", click "+New" button.

Step 2

Choose "Universal Windows Platform" and click "Apply"

Step 3

Set a Name, change Agent queue to "Hosted VS2017", and select the "sln" path for this particular App. This is very important, otherwise VSTS will build every "sln" under "Universal-Windows".

Step 4

In "Get sources", change Server path to this particular App source folder (QRCodeCreator), this is also very important, otherwise VSTS will get all content under "Universal-Windows" even it is only building "QRCodeCreator" solution.

Step 5

Click "Save & queue" button, and test the build definition.

Double check if the environment configuration is correct. In this case, I want the build artifacts can be used to upload to the Windows Store, so I need to use "release" mode on x86, x64 and ARM. You can change this in the build definition settings according to your demands.

Step 6

After the build is queued, click the build number on the message will open the build watcher window.

If everything is correct, you should see the build success after 10-20 minutes depending on your project size. I ususally takes more time to build on VSTS comparing to your local machine.

Step 7

Now, we have validated the build works. Let's configure the CI trigger.

Back to the build definition, click "Triggers", and enable "Continuous Integration" trigger. We also need to change the Path specification to this particular App folder, or every check-in under "Universal Windows" will trigger this build, which is not our intention.

Step 8

The build number by VSTS will not automatically increase like you do it with Visual Studio manully. If you want to upload to the store, the build number must be higher than the old one already in the store. Now we need to go back to Visual Studio, open your project's manifest file, and manully increase the build number.

Step 9

Now when you check-in the App source, a build will be triggered.

After it is done, go to "Artifacts", now you can download or browse the App packages.

Step 10

Upload your wonderful App to Windows Store and change the world!!! You can see the "appxupload" file is successfully recognized by Windows Dev Center.

NOTE FOR CHINESE DEVELOPERS

Downloading artifacts from VSTS is very highly result in broken packages sometimes even with a VPN connection, for example, a 27 MB package will stop at 790 KB / 11 MB or others. Advise to RDP into a oversea VM to download the artifacts. Or you can setup a FTP and configure add build task to upload the artifacts to the FTP server and manually download it.

Appendix

If you have problem when generating App packages for Windows Store, please check the build configuration according to this table:

MSBuild Argument	Value	Description
AppxPackageDir	$(Build.ArtifactStagingDirectory)\AppxPackages	Defines the folder to store the generated artifacts.
AppxBundlePlatforms	$(Build.BuildPlatform)	Allows you to define the platforms to include in the bundle.
AppxBundle	Always	Creates an appxbundle with the appx files for the platform specified.
UapAppxPackageBuildMode	StoreUpload	Defines the kind of appx package to generate. (Not included by default)

Reference: https://docs.microsoft.com/en-us/windows/uwp/packaging/auto-build-package-uwp-apps

Windows 10 UWP: How to Debug OnFileActivated Launch Failure

2017-08-25T02:21:41Z

Today I am working on my Image Portray App, and I get my code blown up. The problem is, when the App is already started, it can open .ink file with double click from a file. But when the App is not launched, opening a .ink file to start the App will make it crash. As other UWP that supports file type association, I also use OnFileActivated event to launch my App.

This kind of problem could not be debugged in a triditional way, because you can not find your App's process because it is not running, and you can't make Visual Studio attach to it. If you try to start your App from Visual Studio, you can not reproduce the problem.

Well, the truth is, Visual Studio acutally can run debug against an App that is not currently started, and VS debugger will hide in the darkness to observe if the App is started, when the App starts, VS will attach to it's process right away.

First, you need to copy the pacakge name of you App. It can be found in your App's manifest file:

Then, choose DEBUG -> Other Debug Targes -> Debug Installed App Package...

In the filter textbox, paste in the package name you just copied, and then you can select your App.

Now, make sure you select "Do not launch, but debug my code when it starts"

Then click "Start" button, Visual Studio will now hide himself in the darkness, you can launch your App now.

For my case, by double clicking a .ink file, Visual Studio will attach to the App process right away, and directly hit the exception point.

That's how it's done!

Remote Deploy and Debug UWP Apps

2017-07-15T02:30:53Z

These days I am developing an App that need to be tested on multiple languages environment. I can set my local dev box to different language, and restart or sign out / sign in to Windows again to test different languages. But this is very inconvenient. I want to setup a Windows 10 virtual machine with Chinese language and let Visual Studio 2017 deploy and debug the App right into the VM.

Back the days in 2013, I've wrote an article about remote debugging Surface RT (Windows 8 RT), it still works today with a few modification.

First, you will need to download "Remote Tools for Visual Studio 2017", the latest version today is 15.2. You can download any language, it doesn't matter.

Then, go to your Windows 10 VM. Open Windows Settings -> Update & Settings -> For developers, enable Developer mode and Network / USB discovery.

Now, install the remote debugging tools on the VM

After installation, run the "Remote Debugger" as administrator

Make sure you select all 3 checkboxes, and click "Configure remote debugging" button.

After the tool launches, you can disable authentication in order to make life easier. Go to Tools -> Options.

Choose "No Authentication" and check "Allow any user to debug".

Now, go back to your dev machine. Open your UWP project, in the debug tool bar, choose "Remote Machine"

If everything goes well, your VM will appear in the list, click "Select" to debug on this VM

Now, your App will be deployed and debugged on the VM!

Configure Continuous Delivery for ASP.NET Core Website on Azure

2017-04-06T08:17:37Z

Today I am trying new DevOps tools in VS2017 and Azure, my goal is to automate the process from development to production for an exsiting ASP.NET Core project. I have encountered some issues, and with the help of Microsoft Support, I was able to solve them and share with you guys.

First, there are two ways to configure CD for Azure Web Apps. I prefer create a website first, then configure it from Azure portal. The pros is that it can configure build and release automatically in your VSTS. But you can also do it from VSTS to Azure, however it will require you to set the build and release configuration by yourself.

1. Convert Your Solution Project to Branch

Azure can only choose branches from a VSTS project. So, make sure you convert or branch your existing folder. Just right click your project folder form VS2017 Team Explorer, and choose "Branching and Merging" "Convert to Branch"

2. Link Your VSTS Account to Azure

In your Azure portal, find "Team Services accounts", and finish linking your VSTS

Azure will find the VSTS account that you have access to. Just link the one you want.

But be aware, your VSTS account shoud only be linked to the same Azure subscription where your target ASP.NET Core website is.

3. Create CD Configuration in Azure Web Apps

Enter your target ASP.NET Core app service.

Click "Continuous Delivery (Preview)" under "DEPLOYMENT" section, anc click "Configure" button.

In the configuration blade, find your VSTS project and the branch that you created in step 1.

Under the "Build" section, make sure you select "ASP.NET Core" or your build will blow up sky high.

For test and deploy, just leave default. Then click "OK" to wait for Azure to create the build and release definations in your VSTS.

4. Fix VSTS Build Defination

Your first CI / CD build will certainlly blow up sky high. This is where I contacted Microsoft Support. Looks like Azure is truly in preview for the CD functionality.

For now, we will need to fix the build ourselves.

The error is that, csproj file for the latest ASP.NET Core tooling will not be recognized. Thus, your build will fail, and there will be no deployment to Azure.

To fix this, you need to edit your build defination. Click "Edit" button from the top right corner of the build tab.

In the "Options" tab, change "Default agent queue" to "Hosted VS2017" and save the build.

Now, make some code changes or try trigger the build. It shoud work. And then it will try deploy to Azure.

5. Fix "Rejected in Production" Error (Optional)

If you find an error in your log looks like this:

It is most likely that the target DLL file is in use. To fix this, stop your website, do the build and it will work!

You can then start the website after the deployment.

It looks like a web deploy bug for ASP.NET Core. If you do the same thing from VS2017, you will sometimes encounter this problem too. The only workround for this is to stop the website, deploy, start the website.

Thank you for reading! Happy coding!

Fix Visual Studio 2015 Razor Editor Blow Up

2015-08-09T14:07:08Z

Visual Studio 2015 has been RTM for one month. However, it blows up very often, such as Razor editor. When I try to open any .cshtml file, it blows up with this error, then the syntax highlight is gone. I tried to uninstall all add-on, even repair install VS2015 can't get it working.

The detailed error message is:

System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.ArgumentException: Item has already been added. Key in dictionary: 'RazorSupportedRuntimeVersion'

Someone has already filed a bug on "connect", and it is active:

https://connect.microsoft.com/VisualStudio/feedback/details/1572978/no-intellisense-in-razor-views-argumentexception-razorsupportedruntimeversion-already-added-to-dictionary

The solution is：

1. Close all instance of VS2015

2. Run cmd as administrator, go to VS2015 setup directory, and run:

devenv /resetuserdata

3. Go to your project folder, delete a hidden folder named ".VS"

4. Restart VS2015, it will work fine!

VS2013 Plug-in Development: How Do I Obtain the Path of a Selected File in Solution Explorer

2014-10-13T05:18:23Z

最近在爆个插件，有个需求就是能够在Solution Explorer中右键点击某个文件然后做一些下流的操作，那么首先就要想办法得到用户选择的文件或者文件们。肿么搞呢。研究了一下WebEssential的代码，总结了一下：

首先，你需要获得DTE2对象，貌似指的是你当前的VS实例。为了方便使用定义成一个静态属性，放到package类里面：

也就是继承Package类的那个类，比如public sealed class ForeverAlonePackage : Package

private static DTE2 _dte;

internal static DTE2 DTE
{
    get
    {
        if (_dte == null)
            _dte = ServiceProvider.GlobalProvider.GetService(typeof(DTE)) as DTE2;

        return _dte;
    }
}

然后就可以写个助手类，用来获得当前选中的文件（们）了：

///<summary>Gets the full paths to the currently selected item(s) in the Solution Explorer.</summary>
public static IEnumerable<string> GetSelectedItemPaths(DTE2 dte = null)
{
    var items = (Array)(dte ?? 你的PACKAGE类.DTE).ToolWindows.SolutionExplorer.SelectedItems;
    foreach (UIHierarchyItem selItem in items)
    {
        var item = selItem.Object as ProjectItem;

        if (item != null && item.Properties != null)
            yield return item.Properties.Item("FullPath").Value.ToString();
    }
}

至于路径，稍微处理一下就行：

///<summary>Gets the paths to all files included in the selection, including files within selected folders.</summary>
public static IEnumerable<string> GetSelectedFilePaths()
{
    return GetSelectedItemPaths()
        .SelectMany(p => Directory.Exists(p)
                         ? Directory.EnumerateFiles(p, "*", SearchOption.AllDirectories)
                         : new[] { p }
                   );
}

另外，如果要获取选中的项目文件，可以这样：

///<summary>Gets the the currently selected project(s) in the Solution Explorer.</summary>
public static IEnumerable<Project> GetSelectedProjects()
{
    var items = (Array)你的PACKAGE类.DTE.ToolWindows.SolutionExplorer.SelectedItems;
    foreach (UIHierarchyItem selItem in items)
    {
        var item = selItem.Object as Project;

        if (item != null)
            yield return item;
    }
}

获取解决方案（sln）的根目录：

///<summary>Gets the directory containing the active solution file.</summary>
public static string GetSolutionFolderPath()
{
    EnvDTE.Solution solution = 你的PACKAGE类.DTE.Solution;

    if (solution == null)
        return null;

    if (string.IsNullOrEmpty(solution.FullName))
        return GetRootFolder();

    return Path.GetDirectoryName(solution.FullName);
}

这些代码在VS2010 SDK里也能用。