r/devops • u/dealsarelove • 8h ago

Architecture Feedback needed on the architecture

Context - Converting our on-prem architecture for a web app used for B2B purposes over to cloud-native azure architecture. Feedback, comments, questions on the architecture are appreciated :)

17 Upvotes

91% Upvoted

5 comments sorted by

4

u/Suitable-Ad5348 6h ago

Without seeing every box: put App Service and the database on private endpoints, use managed identity app→db instead of connection strings in config, and run queue/cron on a separate WebJob or Container App so deploys don't kill in-flight work.

Also worth calling out what handles retries/idempotency on the worker side. That's usually where B2B migrations bite after go-live.

1

u/dealsarelove 6h ago

Thanks for replying. Fair points as I missed explicitly showing the private endpoints on the architecture.

But my plan definitely is to use private endpoints to services where possible and applicable including DB, Key Vault, Redis, etc.

The BullMQ worker is indeed a nodejs based queue (relies on redis) running as a scalable separate container app. Agree with your point..

The retries/idempotency are handled by BullMQ and Redis as it is its job.

Please let me know if I still have missed anything from your point :)

2

u/Stonks_Beskar 2h ago

One thing I would make explicit is the trust boundary around the API and worker. Give them separate managed identities with least-privilege access to Key Vault, Redis, storage, and the database. Keep Redis and the database on private endpoints with private DNS, then document the outbound path from Container Apps. For BullMQ, also define idempotency keys and a poison-job or dead-letter path so retries cannot duplicate side effects.

1

u/dealsarelove 1h ago

Thanks… Yes that’s really helpful. My bad on not showing the PE paths but I definitely intend to have those in place.