vm.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.29.47.4906",
      "templateHash": "18192218196942100983"
    }
  },
  "parameters": {
    "vmName": {
      "type": "string",
      "defaultValue": "vm1",
      "metadata": {
        "description": "The name of your Virtual Machine."
      }
    },
    "vmSize": {
      "type": "string",
      "defaultValue": "Standard_B2s",
      "allowedValues": [
        "Standard_B1ls",
        "Standard_B1s",
        "Standard_B2s",
        "Standard_B1ms",
        "Standard_B2ms",
        "Standard_B4ms",
        "Standard_D2s_v5",
        "Standard_D4s_v5",
        "Standard_D2ps_v5",
        "Standard_D4ps_v5"
      ],
      "metadata": {
        "description": "The Virtual Machine size."
      }
    },
    "diskAccountType": {
      "type": "string",
      "defaultValue": "Premium_LRS",
      "allowedValues": [
        "Standard_LRS",
        "Premium_LRS",
        "UltraSSD_LRS"
      ],
      "metadata": {
        "description": "The Storage Account Type for OS and Data disks."
      }
    },
    "osDiskSize": {
      "type": "int",
      "defaultValue": 256,
      "allowedValues": [
        1024,
        512,
        256,
        128,
        64,
        32
      ],
      "metadata": {
        "description": "The OS Disk size."
      }
    },
    "osImage": {
      "type": "string",
      "defaultValue": "Ubuntu 20.04-LTS",
      "allowedValues": [
        "Ubuntu 20.04-LTS",
        "Ubuntu 20.04-LTS (arm64)",
        "Ubuntu 18.04-LTS"
      ],
      "metadata": {
        "description": "The OS image for the VM."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    },
    "virtualNetworkName": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Name of the VNET."
      }
    },
    "allowIpPort22": {
      "type": "string",
      "defaultValue": "127.0.0.1",
      "metadata": {
        "description": "Default IP to allow Port 22 (SSH). Set to your own IP Address"
      }
    },
    "adminUsername": {
      "type": "string",
      "defaultValue": "azureuser",
      "metadata": {
        "description": "Username for the Virtual Machine."
      }
    },
    "adminPasswordOrKey": {
      "type": "securestring",
      "defaultValue": "",
      "metadata": {
        "description": "SSH Key for the Virtual Machine."
      }
    },
    "cloudInit": {
      "type": "string",
      "defaultValue": "none",
      "allowedValues": [
        "none",
        "docker",
        "tailscale",
        "tailscale-private",
        "tailscale-postgres",
        "url"
      ],
      "metadata": {
        "description": "Deploy with cloud-init."
      }
    },
    "env": {
      "type": "secureObject",
      "defaultValue": {},
      "metadata": {
        "description": "Environment variables as JSON object."
      }
    }
  },
  "variables": {
    "rand": "[substring(uniqueString(resourceGroup().id), 0, 6)]",
    "virtualNetworkName_var": "[if(not(equals(parameters('virtualNetworkName'), '')), parameters('virtualNetworkName'), format('{0}-vnet', resourceGroup().name))]",
    "subnetName": "default",
    "keyData_var": "[if(not(equals(parameters('adminPasswordOrKey'), '')), parameters('adminPasswordOrKey'), 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3gkRpKwprN00sT7yekr0xO0F+uTllDua02puhu1v0zGu3aENvUsygBHJiTy+flgrO2q3mY9F5/D67+WHDeSpr5s71UtnbzMxTams89qmo+raTm+IqjzdNujaWf0/pbT6JUkQq0fR0BfIvg3/7NTXhlzjmCOP2EpD91LzN6b5jAm/5hXr0V5mcpERo8kk2GWxjKmwmDOV+huH1DIFDpMxT3WzR2qvZp1DZbNSYmKkrite3FHlPGLXA1I3bRQT+iTj8vRGpxOPSiMdPK4RNMEZVXSGQ3OZbSl2FBCbd/tdJ1idKo8/ZCkHxdh9/em28/yfPUK0D164shgiEdIkdOQJv')]",
    "publicIPAddressName": "[format('{0}-ip', parameters('vmName'))]",
    "networkInterfaceName": "[format('{0}-nic', parameters('vmName'))]",
    "ipConfigName": "[format('{0}-ipconfig', parameters('vmName'))]",
    "subnetAddressPrefix": "10.1.0.0/24",
    "addressPrefix": "10.1.0.0/16",
    "cloudInitDocker": "#cloud-config\n# vim: syntax=yaml\n\npackages:\n- docker.io\n- jq\n\n# create the docker group\ngroups:\n- docker\n\n# Add default auto created user to docker group\nsystem_info:\n  default_user:\n    groups: [docker]\n",
    "cloudInitTailscale": "#cloud-config\n# vim: syntax=yaml\n\npackages:\n- docker.io\n- jq\n\n# create the docker group\ngroups:\n- docker\n\n# Add default auto created user to docker group\nsystem_info:\n  default_user:\n    groups: [docker]\n\nwrite_files:\n- path: /home/azureuser/env.json\n  content: {0}\n  encoding: b64\n- path: /home/azureuser/tailscale.sh\n  content: |\n    curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null\n    curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list\n    \n    sudo apt-get update\n    sudo apt-get install -y tailscale\n    \n    sudo tailscale up --advertise-routes=10.1.0.0/24,168.63.129.16/32 --accept-dns=false --ssh --authkey \"$1\"\n\nruncmd:\n- cd /home/azureuser/\n- bash tailscale.sh \"$(jq -r '.tskey' env.json)\"\n- echo $(date) > hello.txt\n- chown -R azureuser:azureuser /home/azureuser/\n",
    "cloudInitTailscaleFormat": "[format(variables('cloudInitTailscale'), base64(string(parameters('env'))))]",
    "cloudInitTailscalePostgres": "#cloud-config\n# vim: syntax=yaml\n\npackages:\n- docker.io\n- jq\n\n# create the docker group\ngroups:\n- docker\n\n# Add default auto created user to docker group\nsystem_info:\n  default_user:\n    groups: [docker]\n\nwrite_files:\n- path: /home/azureuser/env.json\n  content: {0}\n  encoding: b64\n- path: /home/azureuser/tailscale.sh\n  content: |\n    curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null\n    curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list\n    \n    sudo apt-get update\n    sudo apt-get install -y tailscale\n    \n    sudo tailscale up --advertise-routes=10.1.0.0/24,168.63.129.16/32 --accept-dns=false --ssh --authkey \"$1\"\n\nruncmd:\n- cd /home/azureuser/\n- bash tailscale.sh \"$(jq -r '.tskey' env.json)\"\n- docker run --name postgres --restart always -e POSTGRES_HOST_AUTH_METHOD=trust -v /home/azureuser/postgresql/data:/var/lib/postgresql/data -p 5432:5432 -d postgres:14\n- echo $(date) > hello.txt\n- chown -R azureuser:azureuser /home/azureuser/\n",
    "cloudInitTailscalePostgresFormat": "[format(variables('cloudInitTailscalePostgres'), base64(string(parameters('env'))))]",
    "cloudInitUrl": "#include\nhttps://raw.githubusercontent.com/Azure-Samples/azure-opensource-labs/main/linux/vm/cloud-init/cloud-init.sh\n",
    "kvCloudInit": {
      "none": null,
      "docker": "[base64(variables('cloudInitDocker'))]",
      "tailscale": "[base64(variables('cloudInitTailscaleFormat'))]",
      "tailscale-private": "[base64(variables('cloudInitTailscaleFormat'))]",
      "tailscale-postgres": "[base64(variables('cloudInitTailscalePostgresFormat'))]",
      "url": "[base64(variables('cloudInitUrl'))]"
    },
    "kvImageReference": {
      "Ubuntu 20.04-LTS": {
        "publisher": "canonical",
        "offer": "0001-com-ubuntu-server-focal",
        "sku": "20_04-lts-gen2",
        "version": "latest"
      },
      "Ubuntu 18.04-LTS": {
        "publisher": "Canonical",
        "offer": "UbuntuServer",
        "sku": "18.04-LTS",
        "version": "latest"
      },
      "Ubuntu 20.04-LTS (arm64)": {
        "publisher": "canonical",
        "offer": "0001-com-ubuntu-server-focal",
        "sku": "20_04-lts-arm64",
        "version": "latest"
      }
    },
    "nsgSecurityRulesBase": [
      {
        "name": "Port_22",
        "properties": {
          "priority": 100,
          "protocol": "Tcp",
          "access": "Allow",
          "direction": "Inbound",
          "sourceAddressPrefix": "[parameters('allowIpPort22')]",
          "sourcePortRange": "*",
          "destinationAddressPrefix": "*",
          "destinationPortRange": "22"
        }
      },
      {
        "name": "Port_80",
        "properties": {
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "80",
          "sourceAddressPrefix": "Internet",
          "destinationAddressPrefix": "*",
          "access": "Allow",
          "priority": 110,
          "direction": "Inbound"
        }
      },
      {
        "name": "Port_443",
        "properties": {
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "443",
          "sourceAddressPrefix": "Internet",
          "destinationAddressPrefix": "*",
          "access": "Allow",
          "priority": 120,
          "direction": "Inbound"
        }
      },
      {
        "name": "Port_8080",
        "properties": {
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "8080",
          "sourceAddressPrefix": "Internet",
          "destinationAddressPrefix": "*",
          "access": "Allow",
          "priority": 130,
          "direction": "Inbound"
        }
      },
      {
        "name": "Port_41641",
        "properties": {
          "protocol": "Udp",
          "sourcePortRange": "*",
          "destinationPortRange": "41641",
          "sourceAddressPrefix": "Internet",
          "destinationAddressPrefix": "*",
          "access": "Allow",
          "priority": 140,
          "direction": "Inbound"
        }
      }
    ],
    "nsgSecurityRules": "[if(equals(parameters('cloudInit'), 'tailscale-private'), createArray(last(variables('nsgSecurityRulesBase'))), variables('nsgSecurityRulesBase'))]"
  },
  "resources": [
    {
      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
      "apiVersion": "2018-11-30",
      "name": "[format('{0}-identity', resourceGroup().name)]",
      "location": "[parameters('location')]"
    },
    {
      "type": "Microsoft.Network/networkInterfaces",
      "apiVersion": "2021-05-01",
      "name": "[variables('networkInterfaceName')]",
      "location": "[parameters('location')]",
      "properties": {
        "ipConfigurations": [
          {
            "name": "[variables('ipConfigName')]",
            "properties": {
              "subnet": {
                "id": "[format('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Network/virtualNetworks/{2}/subnets/{3}', subscription().subscriptionId, resourceGroup().name, variables('virtualNetworkName_var'), variables('subnetName'))]"
              },
              "privateIPAllocationMethod": "Dynamic",
              "publicIPAddress": "[if(not(equals(parameters('cloudInit'), 'tailscale-private')), createObject('id', resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))), null())]"
            }
          }
        ],
        "networkSecurityGroup": {
          "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg', resourceGroup().name))]"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg', resourceGroup().name))]",
        "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/networkSecurityGroups",
      "apiVersion": "2021-05-01",
      "name": "[format('{0}-nsg', resourceGroup().name)]",
      "location": "[parameters('location')]",
      "properties": {
        "securityRules": "[variables('nsgSecurityRules')]"
      }
    },
    {
      "condition": "[equals(parameters('virtualNetworkName'), '')]",
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2021-05-01",
      "name": "[variables('virtualNetworkName_var')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[variables('addressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "[variables('subnetName')]",
            "properties": {
              "addressPrefix": "[variables('subnetAddressPrefix')]",
              "privateEndpointNetworkPolicies": "Enabled",
              "privateLinkServiceNetworkPolicies": "Enabled"
            }
          },
          {
            "name": "AzureBastionSubnet",
            "properties": {
              "addressPrefix": "10.1.1.0/26",
              "privateEndpointNetworkPolicies": "Enabled",
              "privateLinkServiceNetworkPolicies": "Enabled"
            }
          }
        ]
      }
    },
    {
      "condition": "[not(equals(parameters('cloudInit'), 'tailscale-private'))]",
      "type": "Microsoft.Network/publicIPAddresses",
      "apiVersion": "2021-05-01",
      "name": "[variables('publicIPAddressName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard"
      },
      "properties": {
        "publicIPAllocationMethod": "Static",
        "dnsSettings": {
          "domainNameLabel": "[toLower(format('{0}-{1}', parameters('vmName'), variables('rand')))]"
        }
      }
    },
    {
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2021-11-01",
      "name": "[parameters('vmName')]",
      "location": "[parameters('location')]",
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentities": {
          "[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('{0}-identity', resourceGroup().name)))]": {}
        }
      },
      "properties": {
        "hardwareProfile": {
          "vmSize": "[parameters('vmSize')]"
        },
        "storageProfile": {
          "osDisk": {
            "managedDisk": {
              "storageAccountType": "[parameters('diskAccountType')]"
            },
            "name": "[format('{0}-osdisk1', parameters('vmName'))]",
            "diskSizeGB": "[parameters('osDiskSize')]",
            "createOption": "FromImage"
          },
          "imageReference": "[variables('kvImageReference')[parameters('osImage')]]"
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName'))]"
            }
          ]
        },
        "osProfile": {
          "computerName": "[parameters('vmName')]",
          "customData": "[variables('kvCloudInit')[parameters('cloudInit')]]",
          "adminUsername": "[parameters('adminUsername')]",
          "linuxConfiguration": {
            "disablePasswordAuthentication": true,
            "ssh": {
              "publicKeys": [
                {
                  "keyData": "[variables('keyData_var')]",
                  "path": "[format('/home/{0}/.ssh/authorized_keys', parameters('adminUsername'))]"
                }
              ]
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('{0}-identity', resourceGroup().name))]",
        "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName'))]"
      ]
    }
  ],
  "outputs": {
    "adminUsername": {
      "type": "string",
      "value": "[parameters('adminUsername')]"
    },
    "hostname": {
      "type": "string",
      "value": "[if(not(equals(parameters('cloudInit'), 'tailscale-private')), reference(resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName')), '2021-05-01').dnsSettings.fqdn, parameters('vmName'))]"
    },
    "sshCommand": {
      "type": "string",
      "value": "[format('ssh {0}@{1}', parameters('adminUsername'), if(not(equals(parameters('cloudInit'), 'tailscale-private')), reference(resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName')), '2021-05-01').dnsSettings.fqdn, parameters('vmName')))]"
    }
  }
}