Front Door configuration
This guidance applies to non-production and production environments where relevant. Production approvals and readiness checks remain part of Path to Live.
Purpose
Configuration
We use Azure Front Door as our entry point into the HMCTS estate.
CFT
Configuration is located in azure-platform-terraform. A minimal configuration for production would be:
{
product = "product"
name = "app-name"
custom_domain = "your-app.service.gov.uk"
backend_domain = ["firewall-prod-int-palo-cftprod.uksouth.cloudapp.azure.com"]
dns_zone_name = "your-app.service.gov.uk"
}
SDS
Configuration is located in sds-azure-platform. A minimal configuration for production would be:
{
name = "app-name"
custom_domain = "your-app.service.gov.uk"
backend_domain = ["firewall-prod-int-palo-sdsprod.uksouth.cloudapp.azure.com"]
dns_zone_name = "your-app.service.gov.uk"
}
For other options, look at what existing applications use in the same file.
TLS certificate
You do not need to supply a certificate. By default Front Door issues and renews a managed certificate for your custom domain, and the pipeline adds the record that validates it to your DNS zone.
A certificate from Key Vault is only used when an entry sets ssl_mode = "AzureKeyVault". The
certificate named in certificate_name must then already be in the platform’s Key Vault, or the
build fails. Many existing entries have certificate_name without ssl_mode; it has no effect there,
so leave it out when you copy one. If you think you need a Key Vault certificate, ask in
#platops-help.
If your domain’s DNS is hosted outside the HMCTS public DNS, the entry sets
hosted_externally = true and the validation record has to be added with your DNS provider instead.
Ask in #platops-help for the value.
Raise the pull request
Make sure your DNS pull request has been merged first. The build looks up the
zone named in dns_zone_name and fails if it does not exist.
Then send a pull request with your configuration change, you can ask for review in #platops-code-review.
Next step in Creating a New Component: Deploy and validate your first build