Security hardening / private endpoints / DNS

[JimCircadian]

Builds on from #31

Expose and restrict

• [x] Ensure storage accounts are not unnecessarily open
• [x] Create private endpoints in public subnet
  • [x] PyGeoAPI
  • [x] Assets function app
  • [x] Storage account
• [x] Create private endpoints in private subnet
  • [x] Create private endpoint definitions
• [x] Implement NAT gateway
• [ ] Do #38
• [ ] Set up NSG and https access via public interface
• [ ] Set up NSG/ASG between LB and internal services
• [ ] Set up internal routing / NSG/ASG between public and private subnets
• [ ] Set up dev.icenet.ai to point to public interface
• [ ] Test access via dev.icenet.ai
• [ ] Ensure closed access to function app public endpoints
• [ ] Check that non-admin IP sources cannot upload (test admin NSG)
• [ ] Activate private endpoints
  • [ ] pygeoapi/app.tf - pygeoapi
  • [ ] forecast_processor/events.tf - event_domain_endpoint
  • [ ] forecast_processor/functions.tf - evtproc_app_storage_endpoint
  • [ ] forecast_processor/functions.tf - event_proc_endpoint
  • [ ] data/postgresql.tf - database
  • [ ] data/storage.tf - data_blob
  • [ ] data/storage.tf - data_file
  • [ ] processing/functions.tf - proc_app_storage_endpoint
  • [ ] processing/functions.tf - proc_endpoint
  • [ ] application/app.tf - application

[JimCircadian]

The private endpoints caused an amazing nuisance, with the web application being unable to mount the share from the main storage, promptly breaking the container host with no real messaging.

Going to get the rest of the infrastructure set up behind the LB for access and then lock down from the edge, then transition into the private endpoint architecture. Azure is really a bit wobbly to use, with things failing silently all over the shop