WordPress on Azure Container Apps

A complete, production-ready WordPress deployment on Azure Container Apps with automated updates, monitoring, and backup capabilities.

🚀 Features

• Azure Container Apps: Cost-effective hosting without jump host VMs
• Automated Updates: WordPress core, plugins, and themes via GitHub Actions
• High Availability: Auto-scaling and load balancing
• Security: Azure Key Vault integration, SSL/TLS, and security best practices
• Monitoring: Application Insights, Log Analytics, and custom dashboards
• Backup & Recovery: Automated backups with cross-region replication
• Performance: Redis caching and optimized PHP configuration

📋 Prerequisites

• Azure subscription with appropriate permissions
• GitHub repository with Actions enabled
• Azure CLI installed and configured
• Docker (for local testing)
• PowerShell 5.0+ with required Azure modules

PowerShell Module Installation

Before running any deployment scripts, install the required Azure PowerShell modules:

# Automated installation (recommended)
.\Install-RequiredModules.ps1

# Manual installation
Install-Module -Name Az.Accounts, Az.Resources, Az.ContainerRegistry, Az.KeyVault, Az.Storage, Az.ContainerInstance -Force -AllowClobber -Scope CurrentUser

Azure Authentication

Before running any deployment scripts, authenticate with Azure:

# Automated authentication (recommended)
.\Connect-Azure.ps1

# Manual authentication
Connect-AzAccount

# With specific subscription
.\Connect-Azure.ps1 -SubscriptionId "your-subscription-id"

🏗️ Architecture

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   GitHub        │    │   Azure          │    │   Monitoring    │
│   Actions       │───▶│   Container Apps │───▶│   & Alerts      │
│   (CI/CD)       │    │   (WordPress)    │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘
                                │
                                ▼
┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   Azure Key     │    │   MySQL          │    │   Azure         │
│   Vault         │◀───│   Flexible       │    │   Storage       │
│   (Secrets)     │    │   Server         │    │   (Files)       │
└─────────────────┘    └──────────────────┘    └─────────────────┘

🚀 Quick Start

1. Clone and Setup

git clone <your-repo-url>
cd wordpress-deployment

2. Deploy Infrastructure

Option A: Key Vault Deployment (Recommended)

# Complete deployment with Key Vault integration (handles everything automatically)
.\deploy-with-keyvault.ps1 -ResourceGroupName "rg-wordpress-prod" -WpAdminUser "admin" -WpAdminPassword (ConvertTo-SecureString "SecurePass123!" -AsPlainText -Force) -WpAdminEmail "admin@yourdomain.com" -DbPassword (ConvertTo-SecureString "SecureDBPass123!" -AsPlainText -Force) -DeployMonitoring -DeployBackup

Option B: Direct Deployment (Development Only)

⚠️ WARNING: Only use this for development/testing!

# Deploy with plain text passwords (NOT RECOMMENDED for production)
.\deploy.ps1 -ResourceGroupName "rg-wordpress-prod" -WpAdminUser "admin" -WpAdminPassword (ConvertTo-SecureString "SecurePass123!" -AsPlainText -Force) -WpAdminEmail "admin@yourdomain.com" -DbPassword (ConvertTo-SecureString "SecureDBPass123!" -AsPlainText -Force) -DeployMonitoring -DeployBackup

3. Configure GitHub Actions

1. Set up GitHub Secrets:

   • AZURE_CREDENTIALS: Azure service principal credentials
   • AZURE_CONTAINER_REGISTRY: Container registry name
   • AZURE_RESOURCE_GROUP: Resource group name
   • CONTAINER_APP_NAME: Container app name

2. Create Azure Service Principal:

   az ad sp create-for-rbac \
     --name "github-actions-wordpress" \
     --role contributor \
     --scopes /subscriptions/{subscription-id}/resourceGroups/rg-wordpress-prod \
     --sdk-auth

3. Push to GitHub:

   git add .
   git commit -m "Initial WordPress deployment"
   git push origin main

4. Access WordPress

After deployment, your WordPress site will be available at the Container App URL provided in the deployment output.

📁 Project Structure

wordpress-deployment/
├── main.bicep                 # Main infrastructure template
├── monitoring.bicep           # Monitoring and alerting
├── backup.bicep              # Backup and disaster recovery
├── parameters.json           # Deployment parameters
├── Dockerfile                # WordPress container with wp-cli
├── update-wordpress.sh       # WordPress update script
├── wp-config-extra.php       # Additional WordPress configuration
├── custom-php.ini            # PHP configuration
├── backup-script.ps1         # PowerShell backup script
├── .github/
│   └── workflows/
│       ├── deploy-wordpress.yml    # Deployment workflow
│       └── update-wordpress.yml    # Update workflow
├── DEPLOYMENT_GUIDE.md       # Detailed deployment guide
└── README.md                 # This file

🔄 Automated Updates

Scheduled Updates

• Frequency: Every Sunday at 2 AM UTC
• Scope: WordPress core, plugins, and themes
• Method: wp-cli commands executed in container

Manual Updates

1. Go to GitHub Actions → "Update WordPress Core and Plugins"
2. Click "Run workflow"
3. Select update options and run

Update Process

1. Check for available updates
2. Update WordPress core (if available)
3. Update all plugins (if available)
4. Update all themes (if available)
5. Clear caches and optimize database
6. Set proper file permissions

📊 Monitoring

Application Insights

• Performance metrics
• Error tracking
• User analytics
• Custom dashboards

Log Analytics

• Container logs
• Database performance
• Security events
• Custom queries

Alerts

• High CPU/Memory usage
• Container health
• Response time
• Error rates
• Database connectivity

💾 Backup & Recovery

Automated Backups

• Database: Daily MySQL backups
• Files: WordPress uploads and themes
• Retention: 30 days (configurable)
• Cross-region: West US backup location

Manual Backup

# Trigger backup via GitHub Actions
# Or use Azure CLI:
az containerapp exec \
  --name wordpress-prod \
  --resource-group rg-wordpress-prod \
  --command "/usr/local/bin/update-wordpress.sh"

Restore Process

1. Stop WordPress container
2. Restore database from backup
3. Restore files from backup
4. Restart container
5. Verify functionality

🔧 Configuration

Environment Variables

• WORDPRESS_DB_HOST: Database host
• WORDPRESS_DB_NAME: Database name
• WORDPRESS_DB_USER: Database user
• WORDPRESS_DB_PASSWORD: Database password (from Key Vault)
• WORDPRESS_ADMIN_USER: WordPress admin user
• WORDPRESS_ADMIN_PASSWORD: WordPress admin password (from Key Vault)
• WORDPRESS_ADMIN_EMAIL: WordPress admin email

Custom Configuration

• PHP Settings: custom-php.ini
• WordPress Settings: wp-config-extra.php
• Update Script: update-wordpress.sh

🛡️ Security

Azure Key Vault

• Secure storage for passwords using SecureString parameters
• RBAC access control
• Audit logging
• No plain text passwords in deployment files

Network Security

• Private endpoints (optional)
• Firewall rules
• SSL/TLS encryption

WordPress Security

• Disable file editing
• Secure file permissions
• Regular security updates

Parameter Security

• PowerShell scripts use SecureString for password parameters
• Passwords converted to plain text only when needed for deployment
• Immediate cleanup of plain text passwords from memory
• Key Vault integration for production deployments

💰 Cost Optimization

Container Apps

• Consumption Plan: Pay per use
• Auto-scaling: Scale to zero when idle
• Resource limits: CPU and memory limits

Database

• Burstable tier: Cost-effective for development
• Auto-scaling: Scale based on demand
• Backup retention: Configurable retention period

Storage

• Standard LRS: Cost-effective storage
• Lifecycle policies: Automatic cleanup
• Compression: Reduce storage costs

🔍 Troubleshooting

Common Issues

1. Container won't start

   # Check container logs
   az containerapp logs show \
     --name wordpress-prod \
     --resource-group rg-wordpress-prod

2. Database connection issues

   # Test database connectivity
   az containerapp exec \
     --name wordpress-prod \
     --resource-group rg-wordpress-prod \
     --command "wp db check --allow-root --path=/var/www/html"

3. Update failures

   # Check update logs
   az containerapp exec \
     --name wordpress-prod \
     --resource-group rg-wordpress-prod \
     --command "tail -50 /var/log/wordpress-updates.log"

Useful Commands

# Check container status
az containerapp show \
  --name wordpress-prod \
  --resource-group rg-wordpress-prod

# Execute wp-cli commands
az containerapp exec \
  --name wordpress-prod \
  --resource-group rg-wordpress-prod \
  --command "wp --info --allow-root --path=/var/www/html"

# Check WordPress version
az containerapp exec \
  --name wordpress-prod \
  --resource-group rg-wordpress-prod \
  --command "wp core version --allow-root --path=/var/www/html"

📚 Documentation

• Deployment Guide - Detailed deployment instructions
• Azure Container Apps Documentation
• WordPress Documentation
• GitHub Actions Documentation

🤝 Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Test thoroughly
5. Submit a pull request

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🆘 Support

For support and questions:

• Create an issue in the GitHub repository
• Check the troubleshooting section
• Review Azure documentation
• Contact the development team

🔄 Updates

This deployment automatically updates:

• WordPress core
• All plugins
• All themes
• PHP dependencies
• Security patches

Manual updates can be triggered via GitHub Actions or Azure CLI commands.

---

Note: This deployment is designed for production use with proper security, monitoring, and backup capabilities. Always test in a development environment first.